@tatchi-xyz/sdk 0.21.0 → 0.31.1

package/dist/esm/server/node_modules/.pnpm/@noble_curves@2.0.1/node_modules/@noble/curves/abstract/modular.js

@@ -1,5 +1,11 @@
+import { abytes, anumber } from "../../../../../@noble_hashes@2.0.1/node_modules/@noble/hashes/utils.js";
+import { bytesToNumberBE, bytesToNumberLE, numberToBytesBE, numberToBytesLE, validateObject } from "../utils.js";
+
 //#region ../node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/abstract/modular.js
 const _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2);
+const _3n = /* @__PURE__ */ BigInt(3), _4n = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5);
+const _7n = /* @__PURE__ */ BigInt(7), _8n = /* @__PURE__ */ BigInt(8), _9n = /* @__PURE__ */ BigInt(9);
+const _16n = /* @__PURE__ */ BigInt(16);
 function mod(a, b) {
 	const result = a % b;
 	return result >= _0n ? result : b + result;
@@ -13,7 +19,367 @@ function pow2(x, power, modulo) {
 	}
 	return res;
 }
+/**
+* Inverses number over modulo.
+* Implemented using [Euclidean GCD](https://brilliant.org/wiki/extended-euclidean-algorithm/).
+*/
+function invert(number, modulo) {
+	if (number === _0n) throw new Error("invert: expected non-zero number");
+	if (modulo <= _0n) throw new Error("invert: expected positive modulus, got " + modulo);
+	let a = mod(number, modulo);
+	let b = modulo;
+	let x = _0n, y = _1n, u = _1n, v = _0n;
+	while (a !== _0n) {
+		const q = b / a;
+		const r = b % a;
+		const m = x - u * q;
+		const n = y - v * q;
+		b = a, a = r, x = u, y = v, u = m, v = n;
+	}
+	const gcd = b;
+	if (gcd !== _1n) throw new Error("invert: does not exist");
+	return mod(x, modulo);
+}
+function assertIsSquare(Fp, root, n) {
+	if (!Fp.eql(Fp.sqr(root), n)) throw new Error("Cannot find square root");
+}
+function sqrt3mod4(Fp, n) {
+	const p1div4 = (Fp.ORDER + _1n) / _4n;
+	const root = Fp.pow(n, p1div4);
+	assertIsSquare(Fp, root, n);
+	return root;
+}
+function sqrt5mod8(Fp, n) {
+	const p5div8 = (Fp.ORDER - _5n) / _8n;
+	const n2 = Fp.mul(n, _2n);
+	const v = Fp.pow(n2, p5div8);
+	const nv = Fp.mul(n, v);
+	const i = Fp.mul(Fp.mul(nv, _2n), v);
+	const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));
+	assertIsSquare(Fp, root, n);
+	return root;
+}
+function sqrt9mod16(P) {
+	const Fp_ = Field(P);
+	const tn = tonelliShanks(P);
+	const c1 = tn(Fp_, Fp_.neg(Fp_.ONE));
+	const c2 = tn(Fp_, c1);
+	const c3 = tn(Fp_, Fp_.neg(c1));
+	const c4 = (P + _7n) / _16n;
+	return (Fp, n) => {
+		let tv1 = Fp.pow(n, c4);
+		let tv2 = Fp.mul(tv1, c1);
+		const tv3 = Fp.mul(tv1, c2);
+		const tv4 = Fp.mul(tv1, c3);
+		const e1 = Fp.eql(Fp.sqr(tv2), n);
+		const e2 = Fp.eql(Fp.sqr(tv3), n);
+		tv1 = Fp.cmov(tv1, tv2, e1);
+		tv2 = Fp.cmov(tv4, tv3, e2);
+		const e3 = Fp.eql(Fp.sqr(tv2), n);
+		const root = Fp.cmov(tv1, tv2, e3);
+		assertIsSquare(Fp, root, n);
+		return root;
+	};
+}
+/**
+* Tonelli-Shanks square root search algorithm.
+* 1. https://eprint.iacr.org/2012/685.pdf (page 12)
+* 2. Square Roots from 1; 24, 51, 10 to Dan Shanks
+* @param P field order
+* @returns function that takes field Fp (created from P) and number n
+*/
+function tonelliShanks(P) {
+	if (P < _3n) throw new Error("sqrt is not defined for small field");
+	let Q = P - _1n;
+	let S = 0;
+	while (Q % _2n === _0n) {
+		Q /= _2n;
+		S++;
+	}
+	let Z = _2n;
+	const _Fp = Field(P);
+	while (FpLegendre(_Fp, Z) === 1) if (Z++ > 1e3) throw new Error("Cannot find square root: probably non-prime P");
+	if (S === 1) return sqrt3mod4;
+	let cc = _Fp.pow(Z, Q);
+	const Q1div2 = (Q + _1n) / _2n;
+	return function tonelliSlow(Fp, n) {
+		if (Fp.is0(n)) return n;
+		if (FpLegendre(Fp, n) !== 1) throw new Error("Cannot find square root");
+		let M = S;
+		let c = Fp.mul(Fp.ONE, cc);
+		let t = Fp.pow(n, Q);
+		let R = Fp.pow(n, Q1div2);
+		while (!Fp.eql(t, Fp.ONE)) {
+			if (Fp.is0(t)) return Fp.ZERO;
+			let i = 1;
+			let t_tmp = Fp.sqr(t);
+			while (!Fp.eql(t_tmp, Fp.ONE)) {
+				i++;
+				t_tmp = Fp.sqr(t_tmp);
+				if (i === M) throw new Error("Cannot find square root");
+			}
+			const exponent = _1n << BigInt(M - i - 1);
+			const b = Fp.pow(c, exponent);
+			M = i;
+			c = Fp.sqr(b);
+			t = Fp.mul(t, c);
+			R = Fp.mul(R, b);
+		}
+		return R;
+	};
+}
+/**
+* Square root for a finite field. Will try optimized versions first:
+*
+* 1. P ≡ 3 (mod 4)
+* 2. P ≡ 5 (mod 8)
+* 3. P ≡ 9 (mod 16)
+* 4. Tonelli-Shanks algorithm
+*
+* Different algorithms can give different roots, it is up to user to decide which one they want.
+* For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).
+*/
+function FpSqrt(P) {
+	if (P % _4n === _3n) return sqrt3mod4;
+	if (P % _8n === _5n) return sqrt5mod8;
+	if (P % _16n === _9n) return sqrt9mod16(P);
+	return tonelliShanks(P);
+}
+const isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n) === _1n;
+const FIELD_FIELDS = [
+	"create",
+	"isValid",
+	"is0",
+	"neg",
+	"inv",
+	"sqrt",
+	"sqr",
+	"eql",
+	"add",
+	"sub",
+	"mul",
+	"pow",
+	"div",
+	"addN",
+	"subN",
+	"mulN",
+	"sqrN"
+];
+function validateField(field) {
+	const initial = {
+		ORDER: "bigint",
+		BYTES: "number",
+		BITS: "number"
+	};
+	const opts = FIELD_FIELDS.reduce((map, val) => {
+		map[val] = "function";
+		return map;
+	}, initial);
+	validateObject(field, opts);
+	return field;
+}
+/**
+* Same as `pow` but for Fp: non-constant-time.
+* Unsafe in some contexts: uses ladder, so can expose bigint bits.
+*/
+function FpPow(Fp, num, power) {
+	if (power < _0n) throw new Error("invalid exponent, negatives unsupported");
+	if (power === _0n) return Fp.ONE;
+	if (power === _1n) return num;
+	let p = Fp.ONE;
+	let d = num;
+	while (power > _0n) {
+		if (power & _1n) p = Fp.mul(p, d);
+		d = Fp.sqr(d);
+		power >>= _1n;
+	}
+	return p;
+}
+/**
+* Efficiently invert an array of Field elements.
+* Exception-free. Will return `undefined` for 0 elements.
+* @param passZero map 0 to 0 (instead of undefined)
+*/
+function FpInvertBatch(Fp, nums, passZero = false) {
+	const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : void 0);
+	const multipliedAcc = nums.reduce((acc, num, i) => {
+		if (Fp.is0(num)) return acc;
+		inverted[i] = acc;
+		return Fp.mul(acc, num);
+	}, Fp.ONE);
+	const invertedAcc = Fp.inv(multipliedAcc);
+	nums.reduceRight((acc, num, i) => {
+		if (Fp.is0(num)) return acc;
+		inverted[i] = Fp.mul(acc, inverted[i]);
+		return Fp.mul(acc, num);
+	}, invertedAcc);
+	return inverted;
+}
+/**
+* Legendre symbol.
+* Legendre constant is used to calculate Legendre symbol (a | p)
+* which denotes the value of a^((p-1)/2) (mod p).
+*
+* * (a | p) ≡ 1    if a is a square (mod p), quadratic residue
+* * (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue
+* * (a | p) ≡ 0    if a ≡ 0 (mod p)
+*/
+function FpLegendre(Fp, n) {
+	const p1mod2 = (Fp.ORDER - _1n) / _2n;
+	const powered = Fp.pow(n, p1mod2);
+	const yes = Fp.eql(powered, Fp.ONE);
+	const zero = Fp.eql(powered, Fp.ZERO);
+	const no = Fp.eql(powered, Fp.neg(Fp.ONE));
+	if (!yes && !zero && !no) throw new Error("invalid Legendre symbol result");
+	return yes ? 1 : zero ? 0 : -1;
+}
+function nLength(n, nBitLength) {
+	if (nBitLength !== void 0) anumber(nBitLength);
+	const _nBitLength = nBitLength !== void 0 ? nBitLength : n.toString(2).length;
+	const nByteLength = Math.ceil(_nBitLength / 8);
+	return {
+		nBitLength: _nBitLength,
+		nByteLength
+	};
+}
+var _Field = class {
+	ORDER;
+	BITS;
+	BYTES;
+	isLE;
+	ZERO = _0n;
+	ONE = _1n;
+	_lengths;
+	_sqrt;
+	_mod;
+	constructor(ORDER, opts = {}) {
+		if (ORDER <= _0n) throw new Error("invalid field: expected ORDER > 0, got " + ORDER);
+		let _nbitLength = void 0;
+		this.isLE = false;
+		if (opts != null && typeof opts === "object") {
+			if (typeof opts.BITS === "number") _nbitLength = opts.BITS;
+			if (typeof opts.sqrt === "function") this.sqrt = opts.sqrt;
+			if (typeof opts.isLE === "boolean") this.isLE = opts.isLE;
+			if (opts.allowedLengths) this._lengths = opts.allowedLengths?.slice();
+			if (typeof opts.modFromBytes === "boolean") this._mod = opts.modFromBytes;
+		}
+		const { nBitLength, nByteLength } = nLength(ORDER, _nbitLength);
+		if (nByteLength > 2048) throw new Error("invalid field: expected ORDER of <= 2048 bytes");
+		this.ORDER = ORDER;
+		this.BITS = nBitLength;
+		this.BYTES = nByteLength;
+		this._sqrt = void 0;
+		Object.preventExtensions(this);
+	}
+	create(num) {
+		return mod(num, this.ORDER);
+	}
+	isValid(num) {
+		if (typeof num !== "bigint") throw new Error("invalid field element: expected bigint, got " + typeof num);
+		return _0n <= num && num < this.ORDER;
+	}
+	is0(num) {
+		return num === _0n;
+	}
+	isValidNot0(num) {
+		return !this.is0(num) && this.isValid(num);
+	}
+	isOdd(num) {
+		return (num & _1n) === _1n;
+	}
+	neg(num) {
+		return mod(-num, this.ORDER);
+	}
+	eql(lhs, rhs) {
+		return lhs === rhs;
+	}
+	sqr(num) {
+		return mod(num * num, this.ORDER);
+	}
+	add(lhs, rhs) {
+		return mod(lhs + rhs, this.ORDER);
+	}
+	sub(lhs, rhs) {
+		return mod(lhs - rhs, this.ORDER);
+	}
+	mul(lhs, rhs) {
+		return mod(lhs * rhs, this.ORDER);
+	}
+	pow(num, power) {
+		return FpPow(this, num, power);
+	}
+	div(lhs, rhs) {
+		return mod(lhs * invert(rhs, this.ORDER), this.ORDER);
+	}
+	sqrN(num) {
+		return num * num;
+	}
+	addN(lhs, rhs) {
+		return lhs + rhs;
+	}
+	subN(lhs, rhs) {
+		return lhs - rhs;
+	}
+	mulN(lhs, rhs) {
+		return lhs * rhs;
+	}
+	inv(num) {
+		return invert(num, this.ORDER);
+	}
+	sqrt(num) {
+		if (!this._sqrt) this._sqrt = FpSqrt(this.ORDER);
+		return this._sqrt(this, num);
+	}
+	toBytes(num) {
+		return this.isLE ? numberToBytesLE(num, this.BYTES) : numberToBytesBE(num, this.BYTES);
+	}
+	fromBytes(bytes, skipValidation = false) {
+		abytes(bytes);
+		const { _lengths: allowedLengths, BYTES, isLE, ORDER, _mod: modFromBytes } = this;
+		if (allowedLengths) {
+			if (!allowedLengths.includes(bytes.length) || bytes.length > BYTES) throw new Error("Field.fromBytes: expected " + allowedLengths + " bytes, got " + bytes.length);
+			const padded = new Uint8Array(BYTES);
+			padded.set(bytes, isLE ? 0 : padded.length - bytes.length);
+			bytes = padded;
+		}
+		if (bytes.length !== BYTES) throw new Error("Field.fromBytes: expected " + BYTES + " bytes, got " + bytes.length);
+		let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);
+		if (modFromBytes) scalar = mod(scalar, ORDER);
+		if (!skipValidation) {
+			if (!this.isValid(scalar)) throw new Error("invalid field element: outside of range 0..ORDER");
+		}
+		return scalar;
+	}
+	invertBatch(lst) {
+		return FpInvertBatch(this, lst);
+	}
+	cmov(a, b, condition) {
+		return condition ? b : a;
+	}
+};
+/**
+* Creates a finite field. Major performance optimizations:
+* * 1. Denormalized operations like mulN instead of mul.
+* * 2. Identical object shape: never add or remove keys.
+* * 3. `Object.freeze`.
+* Fragile: always run a benchmark on a change.
+* Security note: operations don't check 'isValid' for all elements for performance reasons,
+* it is caller responsibility to check this.
+* This is low-level code, please make sure you know what you're doing.
+*
+* Note about field properties:
+* * CHARACTERISTIC p = prime number, number of elements in main subgroup.
+* * ORDER q = similar to cofactor in curves, may be composite `q = p^m`.
+*
+* @param ORDER field order, probably prime, or could be composite
+* @param bitLen how many bits the field consumes
+* @param isLE (default: false) if encoding / decoding should be in little-endian
+* @param redef optional faster redefinitions of sqrt and other methods
+*/
+function Field(ORDER, opts = {}) {
+	return new _Field(ORDER, opts);
+}
 
 //#endregion
-export { mod, pow2 };
+export { Field, FpInvertBatch, isNegativeLE, mod, pow2, validateField };
 //# sourceMappingURL=modular.js.map

package/dist/esm/server/node_modules/.pnpm/@noble_curves@2.0.1/node_modules/@noble/curves/abstract/modular.js.map

@@ -1 +1 @@
-{"version":3,"file":"modular.js","names":[],"sources":["../../../../../../../../../../../node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/abstract/modular.js"],"sourcesContent":["/**\n * Utils for modular division and fields.\n * Field over 11 is a finite (Galois) field is integer number operations `mod 11`.\n * There is no division: it is replaced by modular multiplicative inverse.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { abytes, anumber, bytesToNumberBE, bytesToNumberLE, numberToBytesBE, numberToBytesLE, validateObject, } from \"../utils.js\";\n// Numbers aren't used in x25519 / x448 builds\n// prettier-ignore\nconst _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2);\n// prettier-ignore\nconst _3n = /* @__PURE__ */ BigInt(3), _4n = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5);\n// prettier-ignore\nconst _7n = /* @__PURE__ */ BigInt(7), _8n = /* @__PURE__ */ BigInt(8), _9n = /* @__PURE__ */ BigInt(9);\nconst _16n = /* @__PURE__ */ BigInt(16);\n// Calculates a modulo b\nexport function mod(a, b) {\n    const result = a % b;\n    return result >= _0n ? result : b + result;\n}\n/**\n * Efficiently raise num to power and do modular division.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * @example\n * pow(2n, 6n, 11n) // 64n % 11n == 9n\n */\nexport function pow(num, power, modulo) {\n    return FpPow(Field(modulo), num, power);\n}\n/** Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)` */\nexport function pow2(x, power, modulo) {\n    let res = x;\n    while (power-- > _0n) {\n        res *= res;\n        res %= modulo;\n    }\n    return res;\n}\n/**\n * Inverses number over modulo.\n * Implemented using [Euclidean GCD](https://brilliant.org/wiki/extended-euclidean-algorithm/).\n */\nexport function invert(number, modulo) {\n    if (number === _0n)\n        throw new Error('invert: expected non-zero number');\n    if (modulo <= _0n)\n        throw new Error('invert: expected positive modulus, got ' + modulo);\n    // Fermat's little theorem \"CT-like\" version inv(n) = n^(m-2) mod m is 30x slower.\n    let a = mod(number, modulo);\n    let b = modulo;\n    // prettier-ignore\n    let x = _0n, y = _1n, u = _1n, v = _0n;\n    while (a !== _0n) {\n        // JIT applies optimization if those two lines follow each other\n        const q = b / a;\n        const r = b % a;\n        const m = x - u * q;\n        const n = y - v * q;\n        // prettier-ignore\n        b = a, a = r, x = u, y = v, u = m, v = n;\n    }\n    const gcd = b;\n    if (gcd !== _1n)\n        throw new Error('invert: does not exist');\n    return mod(x, modulo);\n}\nfunction assertIsSquare(Fp, root, n) {\n    if (!Fp.eql(Fp.sqr(root), n))\n        throw new Error('Cannot find square root');\n}\n// Not all roots are possible! Example which will throw:\n// const NUM =\n// n = 72057594037927816n;\n// Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'));\nfunction sqrt3mod4(Fp, n) {\n    const p1div4 = (Fp.ORDER + _1n) / _4n;\n    const root = Fp.pow(n, p1div4);\n    assertIsSquare(Fp, root, n);\n    return root;\n}\nfunction sqrt5mod8(Fp, n) {\n    const p5div8 = (Fp.ORDER - _5n) / _8n;\n    const n2 = Fp.mul(n, _2n);\n    const v = Fp.pow(n2, p5div8);\n    const nv = Fp.mul(n, v);\n    const i = Fp.mul(Fp.mul(nv, _2n), v);\n    const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));\n    assertIsSquare(Fp, root, n);\n    return root;\n}\n// Based on RFC9380, Kong algorithm\n// prettier-ignore\nfunction sqrt9mod16(P) {\n    const Fp_ = Field(P);\n    const tn = tonelliShanks(P);\n    const c1 = tn(Fp_, Fp_.neg(Fp_.ONE)); //  1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F\n    const c2 = tn(Fp_, c1); //  2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F\n    const c3 = tn(Fp_, Fp_.neg(c1)); //  3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F\n    const c4 = (P + _7n) / _16n; //  4. c4 = (q + 7) / 16        # Integer arithmetic\n    return (Fp, n) => {\n        let tv1 = Fp.pow(n, c4); //  1. tv1 = x^c4\n        let tv2 = Fp.mul(tv1, c1); //  2. tv2 = c1 * tv1\n        const tv3 = Fp.mul(tv1, c2); //  3. tv3 = c2 * tv1\n        const tv4 = Fp.mul(tv1, c3); //  4. tv4 = c3 * tv1\n        const e1 = Fp.eql(Fp.sqr(tv2), n); //  5.  e1 = (tv2^2) == x\n        const e2 = Fp.eql(Fp.sqr(tv3), n); //  6.  e2 = (tv3^2) == x\n        tv1 = Fp.cmov(tv1, tv2, e1); //  7. tv1 = CMOV(tv1, tv2, e1)  # Select tv2 if (tv2^2) == x\n        tv2 = Fp.cmov(tv4, tv3, e2); //  8. tv2 = CMOV(tv4, tv3, e2)  # Select tv3 if (tv3^2) == x\n        const e3 = Fp.eql(Fp.sqr(tv2), n); //  9.  e3 = (tv2^2) == x\n        const root = Fp.cmov(tv1, tv2, e3); // 10.  z = CMOV(tv1, tv2, e3)   # Select sqrt from tv1 & tv2\n        assertIsSquare(Fp, root, n);\n        return root;\n    };\n}\n/**\n * Tonelli-Shanks square root search algorithm.\n * 1. https://eprint.iacr.org/2012/685.pdf (page 12)\n * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks\n * @param P field order\n * @returns function that takes field Fp (created from P) and number n\n */\nexport function tonelliShanks(P) {\n    // Initialization (precomputation).\n    // Caching initialization could boost perf by 7%.\n    if (P < _3n)\n        throw new Error('sqrt is not defined for small field');\n    // Factor P - 1 = Q * 2^S, where Q is odd\n    let Q = P - _1n;\n    let S = 0;\n    while (Q % _2n === _0n) {\n        Q /= _2n;\n        S++;\n    }\n    // Find the first quadratic non-residue Z >= 2\n    let Z = _2n;\n    const _Fp = Field(P);\n    while (FpLegendre(_Fp, Z) === 1) {\n        // Basic primality test for P. After x iterations, chance of\n        // not finding quadratic non-residue is 2^x, so 2^1000.\n        if (Z++ > 1000)\n            throw new Error('Cannot find square root: probably non-prime P');\n    }\n    // Fast-path; usually done before Z, but we do \"primality test\".\n    if (S === 1)\n        return sqrt3mod4;\n    // Slow-path\n    // TODO: test on Fp2 and others\n    let cc = _Fp.pow(Z, Q); // c = z^Q\n    const Q1div2 = (Q + _1n) / _2n;\n    return function tonelliSlow(Fp, n) {\n        if (Fp.is0(n))\n            return n;\n        // Check if n is a quadratic residue using Legendre symbol\n        if (FpLegendre(Fp, n) !== 1)\n            throw new Error('Cannot find square root');\n        // Initialize variables for the main loop\n        let M = S;\n        let c = Fp.mul(Fp.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp\n        let t = Fp.pow(n, Q); // t = n^Q, first guess at the fudge factor\n        let R = Fp.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root\n        // Main loop\n        // while t != 1\n        while (!Fp.eql(t, Fp.ONE)) {\n            if (Fp.is0(t))\n                return Fp.ZERO; // if t=0 return R=0\n            let i = 1;\n            // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P)\n            let t_tmp = Fp.sqr(t); // t^(2^1)\n            while (!Fp.eql(t_tmp, Fp.ONE)) {\n                i++;\n                t_tmp = Fp.sqr(t_tmp); // t^(2^2)...\n                if (i === M)\n                    throw new Error('Cannot find square root');\n            }\n            // Calculate the exponent for b: 2^(M - i - 1)\n            const exponent = _1n << BigInt(M - i - 1); // bigint is important\n            const b = Fp.pow(c, exponent); // b = 2^(M - i - 1)\n            // Update variables\n            M = i;\n            c = Fp.sqr(b); // c = b^2\n            t = Fp.mul(t, c); // t = (t * b^2)\n            R = Fp.mul(R, b); // R = R*b\n        }\n        return R;\n    };\n}\n/**\n * Square root for a finite field. Will try optimized versions first:\n *\n * 1. P ≡ 3 (mod 4)\n * 2. P ≡ 5 (mod 8)\n * 3. P ≡ 9 (mod 16)\n * 4. Tonelli-Shanks algorithm\n *\n * Different algorithms can give different roots, it is up to user to decide which one they want.\n * For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).\n */\nexport function FpSqrt(P) {\n    // P ≡ 3 (mod 4) => √n = n^((P+1)/4)\n    if (P % _4n === _3n)\n        return sqrt3mod4;\n    // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf\n    if (P % _8n === _5n)\n        return sqrt5mod8;\n    // P ≡ 9 (mod 16) => Kong algorithm, page 11 of https://eprint.iacr.org/2012/685.pdf (algorithm 4)\n    if (P % _16n === _9n)\n        return sqrt9mod16(P);\n    // Tonelli-Shanks algorithm\n    return tonelliShanks(P);\n}\n// Little-endian check for first LE bit (last BE bit);\nexport const isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n) === _1n;\n// prettier-ignore\nconst FIELD_FIELDS = [\n    'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',\n    'eql', 'add', 'sub', 'mul', 'pow', 'div',\n    'addN', 'subN', 'mulN', 'sqrN'\n];\nexport function validateField(field) {\n    const initial = {\n        ORDER: 'bigint',\n        BYTES: 'number',\n        BITS: 'number',\n    };\n    const opts = FIELD_FIELDS.reduce((map, val) => {\n        map[val] = 'function';\n        return map;\n    }, initial);\n    validateObject(field, opts);\n    // const max = 16384;\n    // if (field.BYTES < 1 || field.BYTES > max) throw new Error('invalid field');\n    // if (field.BITS < 1 || field.BITS > 8 * max) throw new Error('invalid field');\n    return field;\n}\n// Generic field functions\n/**\n * Same as `pow` but for Fp: non-constant-time.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n */\nexport function FpPow(Fp, num, power) {\n    if (power < _0n)\n        throw new Error('invalid exponent, negatives unsupported');\n    if (power === _0n)\n        return Fp.ONE;\n    if (power === _1n)\n        return num;\n    let p = Fp.ONE;\n    let d = num;\n    while (power > _0n) {\n        if (power & _1n)\n            p = Fp.mul(p, d);\n        d = Fp.sqr(d);\n        power >>= _1n;\n    }\n    return p;\n}\n/**\n * Efficiently invert an array of Field elements.\n * Exception-free. Will return `undefined` for 0 elements.\n * @param passZero map 0 to 0 (instead of undefined)\n */\nexport function FpInvertBatch(Fp, nums, passZero = false) {\n    const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : undefined);\n    // Walk from first to last, multiply them by each other MOD p\n    const multipliedAcc = nums.reduce((acc, num, i) => {\n        if (Fp.is0(num))\n            return acc;\n        inverted[i] = acc;\n        return Fp.mul(acc, num);\n    }, Fp.ONE);\n    // Invert last element\n    const invertedAcc = Fp.inv(multipliedAcc);\n    // Walk from last to first, multiply them by inverted each other MOD p\n    nums.reduceRight((acc, num, i) => {\n        if (Fp.is0(num))\n            return acc;\n        inverted[i] = Fp.mul(acc, inverted[i]);\n        return Fp.mul(acc, num);\n    }, invertedAcc);\n    return inverted;\n}\n// TODO: remove\nexport function FpDiv(Fp, lhs, rhs) {\n    return Fp.mul(lhs, typeof rhs === 'bigint' ? invert(rhs, Fp.ORDER) : Fp.inv(rhs));\n}\n/**\n * Legendre symbol.\n * Legendre constant is used to calculate Legendre symbol (a | p)\n * which denotes the value of a^((p-1)/2) (mod p).\n *\n * * (a | p) ≡ 1    if a is a square (mod p), quadratic residue\n * * (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue\n * * (a | p) ≡ 0    if a ≡ 0 (mod p)\n */\nexport function FpLegendre(Fp, n) {\n    // We can use 3rd argument as optional cache of this value\n    // but seems unneeded for now. The operation is very fast.\n    const p1mod2 = (Fp.ORDER - _1n) / _2n;\n    const powered = Fp.pow(n, p1mod2);\n    const yes = Fp.eql(powered, Fp.ONE);\n    const zero = Fp.eql(powered, Fp.ZERO);\n    const no = Fp.eql(powered, Fp.neg(Fp.ONE));\n    if (!yes && !zero && !no)\n        throw new Error('invalid Legendre symbol result');\n    return yes ? 1 : zero ? 0 : -1;\n}\n// This function returns True whenever the value x is a square in the field F.\nexport function FpIsSquare(Fp, n) {\n    const l = FpLegendre(Fp, n);\n    return l === 1;\n}\n// CURVE.n lengths\nexport function nLength(n, nBitLength) {\n    // Bit size, byte size of CURVE.n\n    if (nBitLength !== undefined)\n        anumber(nBitLength);\n    const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length;\n    const nByteLength = Math.ceil(_nBitLength / 8);\n    return { nBitLength: _nBitLength, nByteLength };\n}\nclass _Field {\n    ORDER;\n    BITS;\n    BYTES;\n    isLE;\n    ZERO = _0n;\n    ONE = _1n;\n    _lengths;\n    _sqrt; // cached sqrt\n    _mod;\n    constructor(ORDER, opts = {}) {\n        if (ORDER <= _0n)\n            throw new Error('invalid field: expected ORDER > 0, got ' + ORDER);\n        let _nbitLength = undefined;\n        this.isLE = false;\n        if (opts != null && typeof opts === 'object') {\n            if (typeof opts.BITS === 'number')\n                _nbitLength = opts.BITS;\n            if (typeof opts.sqrt === 'function')\n                this.sqrt = opts.sqrt;\n            if (typeof opts.isLE === 'boolean')\n                this.isLE = opts.isLE;\n            if (opts.allowedLengths)\n                this._lengths = opts.allowedLengths?.slice();\n            if (typeof opts.modFromBytes === 'boolean')\n                this._mod = opts.modFromBytes;\n        }\n        const { nBitLength, nByteLength } = nLength(ORDER, _nbitLength);\n        if (nByteLength > 2048)\n            throw new Error('invalid field: expected ORDER of <= 2048 bytes');\n        this.ORDER = ORDER;\n        this.BITS = nBitLength;\n        this.BYTES = nByteLength;\n        this._sqrt = undefined;\n        Object.preventExtensions(this);\n    }\n    create(num) {\n        return mod(num, this.ORDER);\n    }\n    isValid(num) {\n        if (typeof num !== 'bigint')\n            throw new Error('invalid field element: expected bigint, got ' + typeof num);\n        return _0n <= num && num < this.ORDER; // 0 is valid element, but it's not invertible\n    }\n    is0(num) {\n        return num === _0n;\n    }\n    // is valid and invertible\n    isValidNot0(num) {\n        return !this.is0(num) && this.isValid(num);\n    }\n    isOdd(num) {\n        return (num & _1n) === _1n;\n    }\n    neg(num) {\n        return mod(-num, this.ORDER);\n    }\n    eql(lhs, rhs) {\n        return lhs === rhs;\n    }\n    sqr(num) {\n        return mod(num * num, this.ORDER);\n    }\n    add(lhs, rhs) {\n        return mod(lhs + rhs, this.ORDER);\n    }\n    sub(lhs, rhs) {\n        return mod(lhs - rhs, this.ORDER);\n    }\n    mul(lhs, rhs) {\n        return mod(lhs * rhs, this.ORDER);\n    }\n    pow(num, power) {\n        return FpPow(this, num, power);\n    }\n    div(lhs, rhs) {\n        return mod(lhs * invert(rhs, this.ORDER), this.ORDER);\n    }\n    // Same as above, but doesn't normalize\n    sqrN(num) {\n        return num * num;\n    }\n    addN(lhs, rhs) {\n        return lhs + rhs;\n    }\n    subN(lhs, rhs) {\n        return lhs - rhs;\n    }\n    mulN(lhs, rhs) {\n        return lhs * rhs;\n    }\n    inv(num) {\n        return invert(num, this.ORDER);\n    }\n    sqrt(num) {\n        // Caching _sqrt speeds up sqrt9mod16 by 5x and tonneli-shanks by 10%\n        if (!this._sqrt)\n            this._sqrt = FpSqrt(this.ORDER);\n        return this._sqrt(this, num);\n    }\n    toBytes(num) {\n        return this.isLE ? numberToBytesLE(num, this.BYTES) : numberToBytesBE(num, this.BYTES);\n    }\n    fromBytes(bytes, skipValidation = false) {\n        abytes(bytes);\n        const { _lengths: allowedLengths, BYTES, isLE, ORDER, _mod: modFromBytes } = this;\n        if (allowedLengths) {\n            if (!allowedLengths.includes(bytes.length) || bytes.length > BYTES) {\n                throw new Error('Field.fromBytes: expected ' + allowedLengths + ' bytes, got ' + bytes.length);\n            }\n            const padded = new Uint8Array(BYTES);\n            // isLE add 0 to right, !isLE to the left.\n            padded.set(bytes, isLE ? 0 : padded.length - bytes.length);\n            bytes = padded;\n        }\n        if (bytes.length !== BYTES)\n            throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);\n        let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n        if (modFromBytes)\n            scalar = mod(scalar, ORDER);\n        if (!skipValidation)\n            if (!this.isValid(scalar))\n                throw new Error('invalid field element: outside of range 0..ORDER');\n        // NOTE: we don't validate scalar here, please use isValid. This done such way because some\n        // protocol may allow non-reduced scalar that reduced later or changed some other way.\n        return scalar;\n    }\n    // TODO: we don't need it here, move out to separate fn\n    invertBatch(lst) {\n        return FpInvertBatch(this, lst);\n    }\n    // We can't move this out because Fp6, Fp12 implement it\n    // and it's unclear what to return in there.\n    cmov(a, b, condition) {\n        return condition ? b : a;\n    }\n}\n/**\n * Creates a finite field. Major performance optimizations:\n * * 1. Denormalized operations like mulN instead of mul.\n * * 2. Identical object shape: never add or remove keys.\n * * 3. `Object.freeze`.\n * Fragile: always run a benchmark on a change.\n * Security note: operations don't check 'isValid' for all elements for performance reasons,\n * it is caller responsibility to check this.\n * This is low-level code, please make sure you know what you're doing.\n *\n * Note about field properties:\n * * CHARACTERISTIC p = prime number, number of elements in main subgroup.\n * * ORDER q = similar to cofactor in curves, may be composite `q = p^m`.\n *\n * @param ORDER field order, probably prime, or could be composite\n * @param bitLen how many bits the field consumes\n * @param isLE (default: false) if encoding / decoding should be in little-endian\n * @param redef optional faster redefinitions of sqrt and other methods\n */\nexport function Field(ORDER, opts = {}) {\n    return new _Field(ORDER, opts);\n}\n// Generic random scalar, we can do same for other fields if via Fp2.mul(Fp2.ONE, Fp2.random)?\n// This allows unsafe methods like ignore bias or zero. These unsafe, but often used in different protocols (if deterministic RNG).\n// which mean we cannot force this via opts.\n// Not sure what to do with randomBytes, we can accept it inside opts if wanted.\n// Probably need to export getMinHashLength somewhere?\n// random(bytes?: Uint8Array, unsafeAllowZero = false, unsafeAllowBias = false) {\n//   const LEN = !unsafeAllowBias ? getMinHashLength(ORDER) : BYTES;\n//   if (bytes === undefined) bytes = randomBytes(LEN); // _opts.randomBytes?\n//   const num = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n//   // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n//   const reduced = unsafeAllowZero ? mod(num, ORDER) : mod(num, ORDER - _1n) + _1n;\n//   return reduced;\n// },\nexport function FpSqrtOdd(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? root : Fp.neg(root);\n}\nexport function FpSqrtEven(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? Fp.neg(root) : root;\n}\n/**\n * Returns total number of bytes consumed by the field element.\n * For example, 32 bytes for usual 256-bit weierstrass curve.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of field\n */\nexport function getFieldBytesLength(fieldOrder) {\n    if (typeof fieldOrder !== 'bigint')\n        throw new Error('field order must be bigint');\n    const bitLength = fieldOrder.toString(2).length;\n    return Math.ceil(bitLength / 8);\n}\n/**\n * Returns minimal amount of bytes that can be safely reduced\n * by field order.\n * Should be 2^-128 for 128-bit curve such as P256.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of target hash\n */\nexport function getMinHashLength(fieldOrder) {\n    const length = getFieldBytesLength(fieldOrder);\n    return length + Math.ceil(length / 2);\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF\n * and convert them into private scalar, with the modulo bias being negligible.\n * Needs at least 48 bytes of input for 32-byte private key.\n * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/\n * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final\n * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5\n * @param hash hash output from SHA3 or a similar function\n * @param groupOrder size of subgroup - (e.g. secp256k1.Point.Fn.ORDER)\n * @param isLE interpret hash bytes as LE num\n * @returns valid private scalar\n */\nexport function mapHashToField(key, fieldOrder, isLE = false) {\n    abytes(key);\n    const len = key.length;\n    const fieldLen = getFieldBytesLength(fieldOrder);\n    const minLen = getMinHashLength(fieldOrder);\n    // No small numbers: need to understand bias story. No huge numbers: easier to detect JS timings.\n    if (len < 16 || len < minLen || len > 1024)\n        throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);\n    const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);\n    // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n    const reduced = mod(num, fieldOrder - _1n) + _1n;\n    return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);\n}\n//# sourceMappingURL=modular.js.map"],"x_google_ignoreList":[0],"mappings":";AAUA,MAAM,MAAsB,uBAAO,IAAI,MAAsB,uBAAO,IAAI,MAAsB,uBAAO;AAOrG,SAAgB,IAAI,GAAG,GAAG;CACtB,MAAM,SAAS,IAAI;AACnB,QAAO,UAAU,MAAM,SAAS,IAAI;;;AAYxC,SAAgB,KAAK,GAAG,OAAO,QAAQ;CACnC,IAAI,MAAM;AACV,QAAO,UAAU,KAAK;AAClB,SAAO;AACP,SAAO;;AAEX,QAAO"}
+{"version":3,"file":"modular.js","names":[],"sources":["../../../../../../../../../../../node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/abstract/modular.js"],"sourcesContent":["/**\n * Utils for modular division and fields.\n * Field over 11 is a finite (Galois) field is integer number operations `mod 11`.\n * There is no division: it is replaced by modular multiplicative inverse.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { abytes, anumber, bytesToNumberBE, bytesToNumberLE, numberToBytesBE, numberToBytesLE, validateObject, } from \"../utils.js\";\n// Numbers aren't used in x25519 / x448 builds\n// prettier-ignore\nconst _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2);\n// prettier-ignore\nconst _3n = /* @__PURE__ */ BigInt(3), _4n = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5);\n// prettier-ignore\nconst _7n = /* @__PURE__ */ BigInt(7), _8n = /* @__PURE__ */ BigInt(8), _9n = /* @__PURE__ */ BigInt(9);\nconst _16n = /* @__PURE__ */ BigInt(16);\n// Calculates a modulo b\nexport function mod(a, b) {\n    const result = a % b;\n    return result >= _0n ? result : b + result;\n}\n/**\n * Efficiently raise num to power and do modular division.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * @example\n * pow(2n, 6n, 11n) // 64n % 11n == 9n\n */\nexport function pow(num, power, modulo) {\n    return FpPow(Field(modulo), num, power);\n}\n/** Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)` */\nexport function pow2(x, power, modulo) {\n    let res = x;\n    while (power-- > _0n) {\n        res *= res;\n        res %= modulo;\n    }\n    return res;\n}\n/**\n * Inverses number over modulo.\n * Implemented using [Euclidean GCD](https://brilliant.org/wiki/extended-euclidean-algorithm/).\n */\nexport function invert(number, modulo) {\n    if (number === _0n)\n        throw new Error('invert: expected non-zero number');\n    if (modulo <= _0n)\n        throw new Error('invert: expected positive modulus, got ' + modulo);\n    // Fermat's little theorem \"CT-like\" version inv(n) = n^(m-2) mod m is 30x slower.\n    let a = mod(number, modulo);\n    let b = modulo;\n    // prettier-ignore\n    let x = _0n, y = _1n, u = _1n, v = _0n;\n    while (a !== _0n) {\n        // JIT applies optimization if those two lines follow each other\n        const q = b / a;\n        const r = b % a;\n        const m = x - u * q;\n        const n = y - v * q;\n        // prettier-ignore\n        b = a, a = r, x = u, y = v, u = m, v = n;\n    }\n    const gcd = b;\n    if (gcd !== _1n)\n        throw new Error('invert: does not exist');\n    return mod(x, modulo);\n}\nfunction assertIsSquare(Fp, root, n) {\n    if (!Fp.eql(Fp.sqr(root), n))\n        throw new Error('Cannot find square root');\n}\n// Not all roots are possible! Example which will throw:\n// const NUM =\n// n = 72057594037927816n;\n// Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'));\nfunction sqrt3mod4(Fp, n) {\n    const p1div4 = (Fp.ORDER + _1n) / _4n;\n    const root = Fp.pow(n, p1div4);\n    assertIsSquare(Fp, root, n);\n    return root;\n}\nfunction sqrt5mod8(Fp, n) {\n    const p5div8 = (Fp.ORDER - _5n) / _8n;\n    const n2 = Fp.mul(n, _2n);\n    const v = Fp.pow(n2, p5div8);\n    const nv = Fp.mul(n, v);\n    const i = Fp.mul(Fp.mul(nv, _2n), v);\n    const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));\n    assertIsSquare(Fp, root, n);\n    return root;\n}\n// Based on RFC9380, Kong algorithm\n// prettier-ignore\nfunction sqrt9mod16(P) {\n    const Fp_ = Field(P);\n    const tn = tonelliShanks(P);\n    const c1 = tn(Fp_, Fp_.neg(Fp_.ONE)); //  1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F\n    const c2 = tn(Fp_, c1); //  2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F\n    const c3 = tn(Fp_, Fp_.neg(c1)); //  3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F\n    const c4 = (P + _7n) / _16n; //  4. c4 = (q + 7) / 16        # Integer arithmetic\n    return (Fp, n) => {\n        let tv1 = Fp.pow(n, c4); //  1. tv1 = x^c4\n        let tv2 = Fp.mul(tv1, c1); //  2. tv2 = c1 * tv1\n        const tv3 = Fp.mul(tv1, c2); //  3. tv3 = c2 * tv1\n        const tv4 = Fp.mul(tv1, c3); //  4. tv4 = c3 * tv1\n        const e1 = Fp.eql(Fp.sqr(tv2), n); //  5.  e1 = (tv2^2) == x\n        const e2 = Fp.eql(Fp.sqr(tv3), n); //  6.  e2 = (tv3^2) == x\n        tv1 = Fp.cmov(tv1, tv2, e1); //  7. tv1 = CMOV(tv1, tv2, e1)  # Select tv2 if (tv2^2) == x\n        tv2 = Fp.cmov(tv4, tv3, e2); //  8. tv2 = CMOV(tv4, tv3, e2)  # Select tv3 if (tv3^2) == x\n        const e3 = Fp.eql(Fp.sqr(tv2), n); //  9.  e3 = (tv2^2) == x\n        const root = Fp.cmov(tv1, tv2, e3); // 10.  z = CMOV(tv1, tv2, e3)   # Select sqrt from tv1 & tv2\n        assertIsSquare(Fp, root, n);\n        return root;\n    };\n}\n/**\n * Tonelli-Shanks square root search algorithm.\n * 1. https://eprint.iacr.org/2012/685.pdf (page 12)\n * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks\n * @param P field order\n * @returns function that takes field Fp (created from P) and number n\n */\nexport function tonelliShanks(P) {\n    // Initialization (precomputation).\n    // Caching initialization could boost perf by 7%.\n    if (P < _3n)\n        throw new Error('sqrt is not defined for small field');\n    // Factor P - 1 = Q * 2^S, where Q is odd\n    let Q = P - _1n;\n    let S = 0;\n    while (Q % _2n === _0n) {\n        Q /= _2n;\n        S++;\n    }\n    // Find the first quadratic non-residue Z >= 2\n    let Z = _2n;\n    const _Fp = Field(P);\n    while (FpLegendre(_Fp, Z) === 1) {\n        // Basic primality test for P. After x iterations, chance of\n        // not finding quadratic non-residue is 2^x, so 2^1000.\n        if (Z++ > 1000)\n            throw new Error('Cannot find square root: probably non-prime P');\n    }\n    // Fast-path; usually done before Z, but we do \"primality test\".\n    if (S === 1)\n        return sqrt3mod4;\n    // Slow-path\n    // TODO: test on Fp2 and others\n    let cc = _Fp.pow(Z, Q); // c = z^Q\n    const Q1div2 = (Q + _1n) / _2n;\n    return function tonelliSlow(Fp, n) {\n        if (Fp.is0(n))\n            return n;\n        // Check if n is a quadratic residue using Legendre symbol\n        if (FpLegendre(Fp, n) !== 1)\n            throw new Error('Cannot find square root');\n        // Initialize variables for the main loop\n        let M = S;\n        let c = Fp.mul(Fp.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp\n        let t = Fp.pow(n, Q); // t = n^Q, first guess at the fudge factor\n        let R = Fp.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root\n        // Main loop\n        // while t != 1\n        while (!Fp.eql(t, Fp.ONE)) {\n            if (Fp.is0(t))\n                return Fp.ZERO; // if t=0 return R=0\n            let i = 1;\n            // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P)\n            let t_tmp = Fp.sqr(t); // t^(2^1)\n            while (!Fp.eql(t_tmp, Fp.ONE)) {\n                i++;\n                t_tmp = Fp.sqr(t_tmp); // t^(2^2)...\n                if (i === M)\n                    throw new Error('Cannot find square root');\n            }\n            // Calculate the exponent for b: 2^(M - i - 1)\n            const exponent = _1n << BigInt(M - i - 1); // bigint is important\n            const b = Fp.pow(c, exponent); // b = 2^(M - i - 1)\n            // Update variables\n            M = i;\n            c = Fp.sqr(b); // c = b^2\n            t = Fp.mul(t, c); // t = (t * b^2)\n            R = Fp.mul(R, b); // R = R*b\n        }\n        return R;\n    };\n}\n/**\n * Square root for a finite field. Will try optimized versions first:\n *\n * 1. P ≡ 3 (mod 4)\n * 2. P ≡ 5 (mod 8)\n * 3. P ≡ 9 (mod 16)\n * 4. Tonelli-Shanks algorithm\n *\n * Different algorithms can give different roots, it is up to user to decide which one they want.\n * For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).\n */\nexport function FpSqrt(P) {\n    // P ≡ 3 (mod 4) => √n = n^((P+1)/4)\n    if (P % _4n === _3n)\n        return sqrt3mod4;\n    // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf\n    if (P % _8n === _5n)\n        return sqrt5mod8;\n    // P ≡ 9 (mod 16) => Kong algorithm, page 11 of https://eprint.iacr.org/2012/685.pdf (algorithm 4)\n    if (P % _16n === _9n)\n        return sqrt9mod16(P);\n    // Tonelli-Shanks algorithm\n    return tonelliShanks(P);\n}\n// Little-endian check for first LE bit (last BE bit);\nexport const isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n) === _1n;\n// prettier-ignore\nconst FIELD_FIELDS = [\n    'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',\n    'eql', 'add', 'sub', 'mul', 'pow', 'div',\n    'addN', 'subN', 'mulN', 'sqrN'\n];\nexport function validateField(field) {\n    const initial = {\n        ORDER: 'bigint',\n        BYTES: 'number',\n        BITS: 'number',\n    };\n    const opts = FIELD_FIELDS.reduce((map, val) => {\n        map[val] = 'function';\n        return map;\n    }, initial);\n    validateObject(field, opts);\n    // const max = 16384;\n    // if (field.BYTES < 1 || field.BYTES > max) throw new Error('invalid field');\n    // if (field.BITS < 1 || field.BITS > 8 * max) throw new Error('invalid field');\n    return field;\n}\n// Generic field functions\n/**\n * Same as `pow` but for Fp: non-constant-time.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n */\nexport function FpPow(Fp, num, power) {\n    if (power < _0n)\n        throw new Error('invalid exponent, negatives unsupported');\n    if (power === _0n)\n        return Fp.ONE;\n    if (power === _1n)\n        return num;\n    let p = Fp.ONE;\n    let d = num;\n    while (power > _0n) {\n        if (power & _1n)\n            p = Fp.mul(p, d);\n        d = Fp.sqr(d);\n        power >>= _1n;\n    }\n    return p;\n}\n/**\n * Efficiently invert an array of Field elements.\n * Exception-free. Will return `undefined` for 0 elements.\n * @param passZero map 0 to 0 (instead of undefined)\n */\nexport function FpInvertBatch(Fp, nums, passZero = false) {\n    const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : undefined);\n    // Walk from first to last, multiply them by each other MOD p\n    const multipliedAcc = nums.reduce((acc, num, i) => {\n        if (Fp.is0(num))\n            return acc;\n        inverted[i] = acc;\n        return Fp.mul(acc, num);\n    }, Fp.ONE);\n    // Invert last element\n    const invertedAcc = Fp.inv(multipliedAcc);\n    // Walk from last to first, multiply them by inverted each other MOD p\n    nums.reduceRight((acc, num, i) => {\n        if (Fp.is0(num))\n            return acc;\n        inverted[i] = Fp.mul(acc, inverted[i]);\n        return Fp.mul(acc, num);\n    }, invertedAcc);\n    return inverted;\n}\n// TODO: remove\nexport function FpDiv(Fp, lhs, rhs) {\n    return Fp.mul(lhs, typeof rhs === 'bigint' ? invert(rhs, Fp.ORDER) : Fp.inv(rhs));\n}\n/**\n * Legendre symbol.\n * Legendre constant is used to calculate Legendre symbol (a | p)\n * which denotes the value of a^((p-1)/2) (mod p).\n *\n * * (a | p) ≡ 1    if a is a square (mod p), quadratic residue\n * * (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue\n * * (a | p) ≡ 0    if a ≡ 0 (mod p)\n */\nexport function FpLegendre(Fp, n) {\n    // We can use 3rd argument as optional cache of this value\n    // but seems unneeded for now. The operation is very fast.\n    const p1mod2 = (Fp.ORDER - _1n) / _2n;\n    const powered = Fp.pow(n, p1mod2);\n    const yes = Fp.eql(powered, Fp.ONE);\n    const zero = Fp.eql(powered, Fp.ZERO);\n    const no = Fp.eql(powered, Fp.neg(Fp.ONE));\n    if (!yes && !zero && !no)\n        throw new Error('invalid Legendre symbol result');\n    return yes ? 1 : zero ? 0 : -1;\n}\n// This function returns True whenever the value x is a square in the field F.\nexport function FpIsSquare(Fp, n) {\n    const l = FpLegendre(Fp, n);\n    return l === 1;\n}\n// CURVE.n lengths\nexport function nLength(n, nBitLength) {\n    // Bit size, byte size of CURVE.n\n    if (nBitLength !== undefined)\n        anumber(nBitLength);\n    const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length;\n    const nByteLength = Math.ceil(_nBitLength / 8);\n    return { nBitLength: _nBitLength, nByteLength };\n}\nclass _Field {\n    ORDER;\n    BITS;\n    BYTES;\n    isLE;\n    ZERO = _0n;\n    ONE = _1n;\n    _lengths;\n    _sqrt; // cached sqrt\n    _mod;\n    constructor(ORDER, opts = {}) {\n        if (ORDER <= _0n)\n            throw new Error('invalid field: expected ORDER > 0, got ' + ORDER);\n        let _nbitLength = undefined;\n        this.isLE = false;\n        if (opts != null && typeof opts === 'object') {\n            if (typeof opts.BITS === 'number')\n                _nbitLength = opts.BITS;\n            if (typeof opts.sqrt === 'function')\n                this.sqrt = opts.sqrt;\n            if (typeof opts.isLE === 'boolean')\n                this.isLE = opts.isLE;\n            if (opts.allowedLengths)\n                this._lengths = opts.allowedLengths?.slice();\n            if (typeof opts.modFromBytes === 'boolean')\n                this._mod = opts.modFromBytes;\n        }\n        const { nBitLength, nByteLength } = nLength(ORDER, _nbitLength);\n        if (nByteLength > 2048)\n            throw new Error('invalid field: expected ORDER of <= 2048 bytes');\n        this.ORDER = ORDER;\n        this.BITS = nBitLength;\n        this.BYTES = nByteLength;\n        this._sqrt = undefined;\n        Object.preventExtensions(this);\n    }\n    create(num) {\n        return mod(num, this.ORDER);\n    }\n    isValid(num) {\n        if (typeof num !== 'bigint')\n            throw new Error('invalid field element: expected bigint, got ' + typeof num);\n        return _0n <= num && num < this.ORDER; // 0 is valid element, but it's not invertible\n    }\n    is0(num) {\n        return num === _0n;\n    }\n    // is valid and invertible\n    isValidNot0(num) {\n        return !this.is0(num) && this.isValid(num);\n    }\n    isOdd(num) {\n        return (num & _1n) === _1n;\n    }\n    neg(num) {\n        return mod(-num, this.ORDER);\n    }\n    eql(lhs, rhs) {\n        return lhs === rhs;\n    }\n    sqr(num) {\n        return mod(num * num, this.ORDER);\n    }\n    add(lhs, rhs) {\n        return mod(lhs + rhs, this.ORDER);\n    }\n    sub(lhs, rhs) {\n        return mod(lhs - rhs, this.ORDER);\n    }\n    mul(lhs, rhs) {\n        return mod(lhs * rhs, this.ORDER);\n    }\n    pow(num, power) {\n        return FpPow(this, num, power);\n    }\n    div(lhs, rhs) {\n        return mod(lhs * invert(rhs, this.ORDER), this.ORDER);\n    }\n    // Same as above, but doesn't normalize\n    sqrN(num) {\n        return num * num;\n    }\n    addN(lhs, rhs) {\n        return lhs + rhs;\n    }\n    subN(lhs, rhs) {\n        return lhs - rhs;\n    }\n    mulN(lhs, rhs) {\n        return lhs * rhs;\n    }\n    inv(num) {\n        return invert(num, this.ORDER);\n    }\n    sqrt(num) {\n        // Caching _sqrt speeds up sqrt9mod16 by 5x and tonneli-shanks by 10%\n        if (!this._sqrt)\n            this._sqrt = FpSqrt(this.ORDER);\n        return this._sqrt(this, num);\n    }\n    toBytes(num) {\n        return this.isLE ? numberToBytesLE(num, this.BYTES) : numberToBytesBE(num, this.BYTES);\n    }\n    fromBytes(bytes, skipValidation = false) {\n        abytes(bytes);\n        const { _lengths: allowedLengths, BYTES, isLE, ORDER, _mod: modFromBytes } = this;\n        if (allowedLengths) {\n            if (!allowedLengths.includes(bytes.length) || bytes.length > BYTES) {\n                throw new Error('Field.fromBytes: expected ' + allowedLengths + ' bytes, got ' + bytes.length);\n            }\n            const padded = new Uint8Array(BYTES);\n            // isLE add 0 to right, !isLE to the left.\n            padded.set(bytes, isLE ? 0 : padded.length - bytes.length);\n            bytes = padded;\n        }\n        if (bytes.length !== BYTES)\n            throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);\n        let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n        if (modFromBytes)\n            scalar = mod(scalar, ORDER);\n        if (!skipValidation)\n            if (!this.isValid(scalar))\n                throw new Error('invalid field element: outside of range 0..ORDER');\n        // NOTE: we don't validate scalar here, please use isValid. This done such way because some\n        // protocol may allow non-reduced scalar that reduced later or changed some other way.\n        return scalar;\n    }\n    // TODO: we don't need it here, move out to separate fn\n    invertBatch(lst) {\n        return FpInvertBatch(this, lst);\n    }\n    // We can't move this out because Fp6, Fp12 implement it\n    // and it's unclear what to return in there.\n    cmov(a, b, condition) {\n        return condition ? b : a;\n    }\n}\n/**\n * Creates a finite field. Major performance optimizations:\n * * 1. Denormalized operations like mulN instead of mul.\n * * 2. Identical object shape: never add or remove keys.\n * * 3. `Object.freeze`.\n * Fragile: always run a benchmark on a change.\n * Security note: operations don't check 'isValid' for all elements for performance reasons,\n * it is caller responsibility to check this.\n * This is low-level code, please make sure you know what you're doing.\n *\n * Note about field properties:\n * * CHARACTERISTIC p = prime number, number of elements in main subgroup.\n * * ORDER q = similar to cofactor in curves, may be composite `q = p^m`.\n *\n * @param ORDER field order, probably prime, or could be composite\n * @param bitLen how many bits the field consumes\n * @param isLE (default: false) if encoding / decoding should be in little-endian\n * @param redef optional faster redefinitions of sqrt and other methods\n */\nexport function Field(ORDER, opts = {}) {\n    return new _Field(ORDER, opts);\n}\n// Generic random scalar, we can do same for other fields if via Fp2.mul(Fp2.ONE, Fp2.random)?\n// This allows unsafe methods like ignore bias or zero. These unsafe, but often used in different protocols (if deterministic RNG).\n// which mean we cannot force this via opts.\n// Not sure what to do with randomBytes, we can accept it inside opts if wanted.\n// Probably need to export getMinHashLength somewhere?\n// random(bytes?: Uint8Array, unsafeAllowZero = false, unsafeAllowBias = false) {\n//   const LEN = !unsafeAllowBias ? getMinHashLength(ORDER) : BYTES;\n//   if (bytes === undefined) bytes = randomBytes(LEN); // _opts.randomBytes?\n//   const num = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n//   // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n//   const reduced = unsafeAllowZero ? mod(num, ORDER) : mod(num, ORDER - _1n) + _1n;\n//   return reduced;\n// },\nexport function FpSqrtOdd(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? root : Fp.neg(root);\n}\nexport function FpSqrtEven(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? Fp.neg(root) : root;\n}\n/**\n * Returns total number of bytes consumed by the field element.\n * For example, 32 bytes for usual 256-bit weierstrass curve.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of field\n */\nexport function getFieldBytesLength(fieldOrder) {\n    if (typeof fieldOrder !== 'bigint')\n        throw new Error('field order must be bigint');\n    const bitLength = fieldOrder.toString(2).length;\n    return Math.ceil(bitLength / 8);\n}\n/**\n * Returns minimal amount of bytes that can be safely reduced\n * by field order.\n * Should be 2^-128 for 128-bit curve such as P256.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of target hash\n */\nexport function getMinHashLength(fieldOrder) {\n    const length = getFieldBytesLength(fieldOrder);\n    return length + Math.ceil(length / 2);\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF\n * and convert them into private scalar, with the modulo bias being negligible.\n * Needs at least 48 bytes of input for 32-byte private key.\n * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/\n * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final\n * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5\n * @param hash hash output from SHA3 or a similar function\n * @param groupOrder size of subgroup - (e.g. secp256k1.Point.Fn.ORDER)\n * @param isLE interpret hash bytes as LE num\n * @returns valid private scalar\n */\nexport function mapHashToField(key, fieldOrder, isLE = false) {\n    abytes(key);\n    const len = key.length;\n    const fieldLen = getFieldBytesLength(fieldOrder);\n    const minLen = getMinHashLength(fieldOrder);\n    // No small numbers: need to understand bias story. No huge numbers: easier to detect JS timings.\n    if (len < 16 || len < minLen || len > 1024)\n        throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);\n    const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);\n    // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n    const reduced = mod(num, fieldOrder - _1n) + _1n;\n    return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);\n}\n//# sourceMappingURL=modular.js.map"],"x_google_ignoreList":[0],"mappings":";;;;AAUA,MAAM,MAAsB,uBAAO,IAAI,MAAsB,uBAAO,IAAI,MAAsB,uBAAO;AAErG,MAAM,MAAsB,uBAAO,IAAI,MAAsB,uBAAO,IAAI,MAAsB,uBAAO;AAErG,MAAM,MAAsB,uBAAO,IAAI,MAAsB,uBAAO,IAAI,MAAsB,uBAAO;AACrG,MAAM,OAAuB,uBAAO;AAEpC,SAAgB,IAAI,GAAG,GAAG;CACtB,MAAM,SAAS,IAAI;AACnB,QAAO,UAAU,MAAM,SAAS,IAAI;;;AAYxC,SAAgB,KAAK,GAAG,OAAO,QAAQ;CACnC,IAAI,MAAM;AACV,QAAO,UAAU,KAAK;AAClB,SAAO;AACP,SAAO;;AAEX,QAAO;;;;;;AAMX,SAAgB,OAAO,QAAQ,QAAQ;AACnC,KAAI,WAAW,IACX,OAAM,IAAI,MAAM;AACpB,KAAI,UAAU,IACV,OAAM,IAAI,MAAM,4CAA4C;CAEhE,IAAI,IAAI,IAAI,QAAQ;CACpB,IAAI,IAAI;CAER,IAAI,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI;AACnC,QAAO,MAAM,KAAK;EAEd,MAAM,IAAI,IAAI;EACd,MAAM,IAAI,IAAI;EACd,MAAM,IAAI,IAAI,IAAI;EAClB,MAAM,IAAI,IAAI,IAAI;AAElB,MAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI;;CAE3C,MAAM,MAAM;AACZ,KAAI,QAAQ,IACR,OAAM,IAAI,MAAM;AACpB,QAAO,IAAI,GAAG;;AAElB,SAAS,eAAe,IAAI,MAAM,GAAG;AACjC,KAAI,CAAC,GAAG,IAAI,GAAG,IAAI,OAAO,GACtB,OAAM,IAAI,MAAM;;AAMxB,SAAS,UAAU,IAAI,GAAG;CACtB,MAAM,UAAU,GAAG,QAAQ,OAAO;CAClC,MAAM,OAAO,GAAG,IAAI,GAAG;AACvB,gBAAe,IAAI,MAAM;AACzB,QAAO;;AAEX,SAAS,UAAU,IAAI,GAAG;CACtB,MAAM,UAAU,GAAG,QAAQ,OAAO;CAClC,MAAM,KAAK,GAAG,IAAI,GAAG;CACrB,MAAM,IAAI,GAAG,IAAI,IAAI;CACrB,MAAM,KAAK,GAAG,IAAI,GAAG;CACrB,MAAM,IAAI,GAAG,IAAI,GAAG,IAAI,IAAI,MAAM;CAClC,MAAM,OAAO,GAAG,IAAI,IAAI,GAAG,IAAI,GAAG,GAAG;AACrC,gBAAe,IAAI,MAAM;AACzB,QAAO;;AAIX,SAAS,WAAW,GAAG;CACnB,MAAM,MAAM,MAAM;CAClB,MAAM,KAAK,cAAc;CACzB,MAAM,KAAK,GAAG,KAAK,IAAI,IAAI,IAAI;CAC/B,MAAM,KAAK,GAAG,KAAK;CACnB,MAAM,KAAK,GAAG,KAAK,IAAI,IAAI;CAC3B,MAAM,MAAM,IAAI,OAAO;AACvB,SAAQ,IAAI,MAAM;EACd,IAAI,MAAM,GAAG,IAAI,GAAG;EACpB,IAAI,MAAM,GAAG,IAAI,KAAK;EACtB,MAAM,MAAM,GAAG,IAAI,KAAK;EACxB,MAAM,MAAM,GAAG,IAAI,KAAK;EACxB,MAAM,KAAK,GAAG,IAAI,GAAG,IAAI,MAAM;EAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,IAAI,MAAM;AAC/B,QAAM,GAAG,KAAK,KAAK,KAAK;AACxB,QAAM,GAAG,KAAK,KAAK,KAAK;EACxB,MAAM,KAAK,GAAG,IAAI,GAAG,IAAI,MAAM;EAC/B,MAAM,OAAO,GAAG,KAAK,KAAK,KAAK;AAC/B,iBAAe,IAAI,MAAM;AACzB,SAAO;;;;;;;;;;AAUf,SAAgB,cAAc,GAAG;AAG7B,KAAI,IAAI,IACJ,OAAM,IAAI,MAAM;CAEpB,IAAI,IAAI,IAAI;CACZ,IAAI,IAAI;AACR,QAAO,IAAI,QAAQ,KAAK;AACpB,OAAK;AACL;;CAGJ,IAAI,IAAI;CACR,MAAM,MAAM,MAAM;AAClB,QAAO,WAAW,KAAK,OAAO,EAG1B,KAAI,MAAM,IACN,OAAM,IAAI,MAAM;AAGxB,KAAI,MAAM,EACN,QAAO;CAGX,IAAI,KAAK,IAAI,IAAI,GAAG;CACpB,MAAM,UAAU,IAAI,OAAO;AAC3B,QAAO,SAAS,YAAY,IAAI,GAAG;AAC/B,MAAI,GAAG,IAAI,GACP,QAAO;AAEX,MAAI,WAAW,IAAI,OAAO,EACtB,OAAM,IAAI,MAAM;EAEpB,IAAI,IAAI;EACR,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;EACvB,IAAI,IAAI,GAAG,IAAI,GAAG;EAClB,IAAI,IAAI,GAAG,IAAI,GAAG;AAGlB,SAAO,CAAC,GAAG,IAAI,GAAG,GAAG,MAAM;AACvB,OAAI,GAAG,IAAI,GACP,QAAO,GAAG;GACd,IAAI,IAAI;GAER,IAAI,QAAQ,GAAG,IAAI;AACnB,UAAO,CAAC,GAAG,IAAI,OAAO,GAAG,MAAM;AAC3B;AACA,YAAQ,GAAG,IAAI;AACf,QAAI,MAAM,EACN,OAAM,IAAI,MAAM;;GAGxB,MAAM,WAAW,OAAO,OAAO,IAAI,IAAI;GACvC,MAAM,IAAI,GAAG,IAAI,GAAG;AAEpB,OAAI;AACJ,OAAI,GAAG,IAAI;AACX,OAAI,GAAG,IAAI,GAAG;AACd,OAAI,GAAG,IAAI,GAAG;;AAElB,SAAO;;;;;;;;;;;;;;AAcf,SAAgB,OAAO,GAAG;AAEtB,KAAI,IAAI,QAAQ,IACZ,QAAO;AAEX,KAAI,IAAI,QAAQ,IACZ,QAAO;AAEX,KAAI,IAAI,SAAS,IACb,QAAO,WAAW;AAEtB,QAAO,cAAc;;AAGzB,MAAa,gBAAgB,KAAK,YAAY,IAAI,KAAK,UAAU,SAAS;AAE1E,MAAM,eAAe;CACjB;CAAU;CAAW;CAAO;CAAO;CAAO;CAAQ;CAClD;CAAO;CAAO;CAAO;CAAO;CAAO;CACnC;CAAQ;CAAQ;CAAQ;;AAE5B,SAAgB,cAAc,OAAO;CACjC,MAAM,UAAU;EACZ,OAAO;EACP,OAAO;EACP,MAAM;;CAEV,MAAM,OAAO,aAAa,QAAQ,KAAK,QAAQ;AAC3C,MAAI,OAAO;AACX,SAAO;IACR;AACH,gBAAe,OAAO;AAItB,QAAO;;;;;;AAOX,SAAgB,MAAM,IAAI,KAAK,OAAO;AAClC,KAAI,QAAQ,IACR,OAAM,IAAI,MAAM;AACpB,KAAI,UAAU,IACV,QAAO,GAAG;AACd,KAAI,UAAU,IACV,QAAO;CACX,IAAI,IAAI,GAAG;CACX,IAAI,IAAI;AACR,QAAO,QAAQ,KAAK;AAChB,MAAI,QAAQ,IACR,KAAI,GAAG,IAAI,GAAG;AAClB,MAAI,GAAG,IAAI;AACX,YAAU;;AAEd,QAAO;;;;;;;AAOX,SAAgB,cAAc,IAAI,MAAM,WAAW,OAAO;CACtD,MAAM,WAAW,IAAI,MAAM,KAAK,QAAQ,KAAK,WAAW,GAAG,OAAO;CAElE,MAAM,gBAAgB,KAAK,QAAQ,KAAK,KAAK,MAAM;AAC/C,MAAI,GAAG,IAAI,KACP,QAAO;AACX,WAAS,KAAK;AACd,SAAO,GAAG,IAAI,KAAK;IACpB,GAAG;CAEN,MAAM,cAAc,GAAG,IAAI;AAE3B,MAAK,aAAa,KAAK,KAAK,MAAM;AAC9B,MAAI,GAAG,IAAI,KACP,QAAO;AACX,WAAS,KAAK,GAAG,IAAI,KAAK,SAAS;AACnC,SAAO,GAAG,IAAI,KAAK;IACpB;AACH,QAAO;;;;;;;;;;;AAeX,SAAgB,WAAW,IAAI,GAAG;CAG9B,MAAM,UAAU,GAAG,QAAQ,OAAO;CAClC,MAAM,UAAU,GAAG,IAAI,GAAG;CAC1B,MAAM,MAAM,GAAG,IAAI,SAAS,GAAG;CAC/B,MAAM,OAAO,GAAG,IAAI,SAAS,GAAG;CAChC,MAAM,KAAK,GAAG,IAAI,SAAS,GAAG,IAAI,GAAG;AACrC,KAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAClB,OAAM,IAAI,MAAM;AACpB,QAAO,MAAM,IAAI,OAAO,IAAI;;AAQhC,SAAgB,QAAQ,GAAG,YAAY;AAEnC,KAAI,eAAe,OACf,SAAQ;CACZ,MAAM,cAAc,eAAe,SAAY,aAAa,EAAE,SAAS,GAAG;CAC1E,MAAM,cAAc,KAAK,KAAK,cAAc;AAC5C,QAAO;EAAE,YAAY;EAAa;;;AAEtC,IAAM,SAAN,MAAa;CACT;CACA;CACA;CACA;CACA,OAAO;CACP,MAAM;CACN;CACA;CACA;CACA,YAAY,OAAO,OAAO,IAAI;AAC1B,MAAI,SAAS,IACT,OAAM,IAAI,MAAM,4CAA4C;EAChE,IAAI,cAAc;AAClB,OAAK,OAAO;AACZ,MAAI,QAAQ,QAAQ,OAAO,SAAS,UAAU;AAC1C,OAAI,OAAO,KAAK,SAAS,SACrB,eAAc,KAAK;AACvB,OAAI,OAAO,KAAK,SAAS,WACrB,MAAK,OAAO,KAAK;AACrB,OAAI,OAAO,KAAK,SAAS,UACrB,MAAK,OAAO,KAAK;AACrB,OAAI,KAAK,eACL,MAAK,WAAW,KAAK,gBAAgB;AACzC,OAAI,OAAO,KAAK,iBAAiB,UAC7B,MAAK,OAAO,KAAK;;EAEzB,MAAM,EAAE,YAAY,gBAAgB,QAAQ,OAAO;AACnD,MAAI,cAAc,KACd,OAAM,IAAI,MAAM;AACpB,OAAK,QAAQ;AACb,OAAK,OAAO;AACZ,OAAK,QAAQ;AACb,OAAK,QAAQ;AACb,SAAO,kBAAkB;;CAE7B,OAAO,KAAK;AACR,SAAO,IAAI,KAAK,KAAK;;CAEzB,QAAQ,KAAK;AACT,MAAI,OAAO,QAAQ,SACf,OAAM,IAAI,MAAM,iDAAiD,OAAO;AAC5E,SAAO,OAAO,OAAO,MAAM,KAAK;;CAEpC,IAAI,KAAK;AACL,SAAO,QAAQ;;CAGnB,YAAY,KAAK;AACb,SAAO,CAAC,KAAK,IAAI,QAAQ,KAAK,QAAQ;;CAE1C,MAAM,KAAK;AACP,UAAQ,MAAM,SAAS;;CAE3B,IAAI,KAAK;AACL,SAAO,IAAI,CAAC,KAAK,KAAK;;CAE1B,IAAI,KAAK,KAAK;AACV,SAAO,QAAQ;;CAEnB,IAAI,KAAK;AACL,SAAO,IAAI,MAAM,KAAK,KAAK;;CAE/B,IAAI,KAAK,KAAK;AACV,SAAO,IAAI,MAAM,KAAK,KAAK;;CAE/B,IAAI,KAAK,KAAK;AACV,SAAO,IAAI,MAAM,KAAK,KAAK;;CAE/B,IAAI,KAAK,KAAK;AACV,SAAO,IAAI,MAAM,KAAK,KAAK;;CAE/B,IAAI,KAAK,OAAO;AACZ,SAAO,MAAM,MAAM,KAAK;;CAE5B,IAAI,KAAK,KAAK;AACV,SAAO,IAAI,MAAM,OAAO,KAAK,KAAK,QAAQ,KAAK;;CAGnD,KAAK,KAAK;AACN,SAAO,MAAM;;CAEjB,KAAK,KAAK,KAAK;AACX,SAAO,MAAM;;CAEjB,KAAK,KAAK,KAAK;AACX,SAAO,MAAM;;CAEjB,KAAK,KAAK,KAAK;AACX,SAAO,MAAM;;CAEjB,IAAI,KAAK;AACL,SAAO,OAAO,KAAK,KAAK;;CAE5B,KAAK,KAAK;AAEN,MAAI,CAAC,KAAK,MACN,MAAK,QAAQ,OAAO,KAAK;AAC7B,SAAO,KAAK,MAAM,MAAM;;CAE5B,QAAQ,KAAK;AACT,SAAO,KAAK,OAAO,gBAAgB,KAAK,KAAK,SAAS,gBAAgB,KAAK,KAAK;;CAEpF,UAAU,OAAO,iBAAiB,OAAO;AACrC,SAAO;EACP,MAAM,EAAE,UAAU,gBAAgB,OAAO,MAAM,OAAO,MAAM,iBAAiB;AAC7E,MAAI,gBAAgB;AAChB,OAAI,CAAC,eAAe,SAAS,MAAM,WAAW,MAAM,SAAS,MACzD,OAAM,IAAI,MAAM,+BAA+B,iBAAiB,iBAAiB,MAAM;GAE3F,MAAM,SAAS,IAAI,WAAW;AAE9B,UAAO,IAAI,OAAO,OAAO,IAAI,OAAO,SAAS,MAAM;AACnD,WAAQ;;AAEZ,MAAI,MAAM,WAAW,MACjB,OAAM,IAAI,MAAM,+BAA+B,QAAQ,iBAAiB,MAAM;EAClF,IAAI,SAAS,OAAO,gBAAgB,SAAS,gBAAgB;AAC7D,MAAI,aACA,UAAS,IAAI,QAAQ;AACzB,MAAI,CAAC,gBACD;OAAI,CAAC,KAAK,QAAQ,QACd,OAAM,IAAI,MAAM;;AAGxB,SAAO;;CAGX,YAAY,KAAK;AACb,SAAO,cAAc,MAAM;;CAI/B,KAAK,GAAG,GAAG,WAAW;AAClB,SAAO,YAAY,IAAI;;;;;;;;;;;;;;;;;;;;;;AAsB/B,SAAgB,MAAM,OAAO,OAAO,IAAI;AACpC,QAAO,IAAI,OAAO,OAAO"}

package/dist/esm/server/node_modules/.pnpm/@noble_curves@2.0.1/node_modules/@noble/curves/ed25519.js

@@ -1,10 +1,21 @@
-import { mod, pow2 } from "./abstract/modular.js";
+import { sha512 } from "../../../../@noble_hashes@2.0.1/node_modules/@noble/hashes/sha2.js";
+import { isNegativeLE, mod, pow2 } from "./abstract/modular.js";
+import { eddsa, edwards } from "./abstract/edwards.js";
 import { montgomery } from "./abstract/montgomery.js";
 
 //#region ../node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/ed25519.js
 const _0n = /* @__PURE__ */ BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = /* @__PURE__ */ BigInt(3);
 const _5n = BigInt(5), _8n = BigInt(8);
 const ed25519_CURVE_p = BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
+const ed25519_CURVE = /* @__PURE__ */ (() => ({
+	p: ed25519_CURVE_p,
+	n: BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),
+	h: _8n,
+	a: BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),
+	d: BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),
+	Gx: BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),
+	Gy: BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")
+}))();
 function ed25519_pow_2_252_3(x) {
 	const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
 	const P = ed25519_CURVE_p;
@@ -31,6 +42,46 @@ function adjustScalarBytes(bytes) {
 	bytes[31] |= 64;
 	return bytes;
 }
+const ED25519_SQRT_M1 = /* @__PURE__ */ BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");
+function uvRatio(u, v) {
+	const P = ed25519_CURVE_p;
+	const v3 = mod(v * v * v, P);
+	const v7 = mod(v3 * v3 * v, P);
+	const pow = ed25519_pow_2_252_3(u * v7).pow_p_5_8;
+	let x = mod(u * v3 * pow, P);
+	const vx2 = mod(v * x * x, P);
+	const root1 = x;
+	const root2 = mod(x * ED25519_SQRT_M1, P);
+	const useRoot1 = vx2 === u;
+	const useRoot2 = vx2 === mod(-u, P);
+	const noRoot = vx2 === mod(-u * ED25519_SQRT_M1, P);
+	if (useRoot1) x = root1;
+	if (useRoot2 || noRoot) x = root2;
+	if (isNegativeLE(x, P)) x = mod(-x, P);
+	return {
+		isValid: useRoot1 || useRoot2,
+		value: x
+	};
+}
+const ed25519_Point = /* @__PURE__ */ edwards(ed25519_CURVE, { uvRatio });
+function ed(opts) {
+	return eddsa(ed25519_Point, sha512, Object.assign({ adjustScalarBytes }, opts));
+}
+/**
+* ed25519 curve with EdDSA signatures.
+* @example
+* ```js
+* import { ed25519 } from '@noble/curves/ed25519.js';
+* const { secretKey, publicKey } = ed25519.keygen();
+* // const publicKey = ed25519.getPublicKey(secretKey);
+* const msg = new TextEncoder().encode('hello noble');
+* const sig = ed25519.sign(msg, secretKey);
+* const isValid = ed25519.verify(sig, msg, pub); // ZIP215
+* // RFC8032 / FIPS 186-5
+* const isValid2 = ed25519.verify(sig, msg, pub, { zip215: false });
+* ```
+*/
+const ed25519 = /* @__PURE__ */ ed({});
 /**
 * ECDH using curve25519 aka x25519.
 * @example
@@ -55,5 +106,5 @@ const x25519 = /* @__PURE__ */ (() => {
 })();
 
 //#endregion
-export { x25519 };
+export { ed25519, x25519 };
 //# sourceMappingURL=ed25519.js.map