@toon-protocol/client-mcp 0.1.0 → 0.2.0

package/dist/{chunk-FSS45ZX3.js → chunk-DLYE6U2Z.js}

@@ -1,13 +1,17 @@
 import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
 
-// ../../node_modules/.pnpm/@noble+hashes@2.0.1/node_modules/@noble/hashes/utils.js
+// ../../node_modules/.pnpm/@noble+hashes@2.2.0/node_modules/@noble/hashes/utils.js
 function isBytes(a) {
-  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
 function anumber(n, title = "") {
+  if (typeof n !== "number") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(`${prefix}expected number, got ${typeof n}`);
+  }
   if (!Number.isSafeInteger(n) || n < 0) {
     const prefix = title && `"${title}" `;
-    throw new Error(`${prefix}expected integer >= 0, got ${n}`);
+    throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);
   }
 }
 function abytes(value, length, title = "") {
@@ -18,7 +22,10 @@ function abytes(value, length, title = "") {
     const prefix = title && `"${title}" `;
     const ofLen = needsLen ? ` of length ${length}` : "";
     const got = bytes ? `length=${len}` : `type=${typeof value}`;
-    throw new Error(prefix + "expected Uint8Array" + ofLen + ", got " + got);
+    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+    if (!bytes)
+      throw new TypeError(message);
+    throw new RangeError(message);
   }
   return value;
 }
@@ -32,7 +39,7 @@ function aoutput(out, instance) {
   abytes(out, void 0, "digestInto() output");
   const min = instance.outputLen;
   if (out.length < min) {
-    throw new Error('"digestInto() output" expected to be of length >=' + min);
+    throw new RangeError('"digestInto() output" expected to be of length >=' + min);
   }
 }
 function clean(...arrays) {
@@ -43,6 +50,9 @@ function clean(...arrays) {
 function createView(arr) {
   return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
 }
+function rotr(word, shift) {
+  return word << 32 - shift | word >>> shift;
+}
 var hasHexBuiltin = /* @__PURE__ */ (() => (
   // @ts-ignore
   typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function"
@@ -70,25 +80,37 @@ function asciiToBase16(ch) {
 }
 function hexToBytes(hex) {
   if (typeof hex !== "string")
-    throw new Error("hex string expected, got " + typeof hex);
-  if (hasHexBuiltin)
-    return Uint8Array.fromHex(hex);
+    throw new TypeError("hex string expected, got " + typeof hex);
+  if (hasHexBuiltin) {
+    try {
+      return Uint8Array.fromHex(hex);
+    } catch (error) {
+      if (error instanceof SyntaxError)
+        throw new RangeError(error.message);
+      throw error;
+    }
+  }
   const hl = hex.length;
   const al = hl / 2;
   if (hl % 2)
-    throw new Error("hex string expected, got unpadded hex of length " + hl);
+    throw new RangeError("hex string expected, got unpadded hex of length " + hl);
   const array = new Uint8Array(al);
   for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
     const n1 = asciiToBase16(hex.charCodeAt(hi));
     const n2 = asciiToBase16(hex.charCodeAt(hi + 1));
     if (n1 === void 0 || n2 === void 0) {
       const char = hex[hi] + hex[hi + 1];
-      throw new Error('hex string expected, got non-hex character "' + char + '" at index ' + hi);
+      throw new RangeError('hex string expected, got non-hex character "' + char + '" at index ' + hi);
     }
     array[ai] = n1 * 16 + n2;
   }
   return array;
 }
+function utf8ToBytes(str) {
+  if (typeof str !== "string")
+    throw new TypeError("string expected");
+  return new Uint8Array(new TextEncoder().encode(str));
+}
 function concatBytes(...arrays) {
   let sum = 0;
   for (let i = 0; i < arrays.length; i++) {
@@ -109,24 +131,37 @@ function createHasher(hashCons, info = {}) {
   const tmp = hashCons(void 0);
   hashC.outputLen = tmp.outputLen;
   hashC.blockLen = tmp.blockLen;
+  hashC.canXOF = tmp.canXOF;
   hashC.create = (opts) => hashCons(opts);
   Object.assign(hashC, info);
   return Object.freeze(hashC);
 }
 function randomBytes(bytesLength = 32) {
+  anumber(bytesLength, "bytesLength");
   const cr = typeof globalThis === "object" ? globalThis.crypto : null;
   if (typeof cr?.getRandomValues !== "function")
     throw new Error("crypto.getRandomValues must be defined");
+  if (bytesLength > 65536)
+    throw new RangeError(`"bytesLength" expected <= 65536, got ${bytesLength}`);
   return cr.getRandomValues(new Uint8Array(bytesLength));
 }
 var oidNist = (suffix) => ({
+  // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+  // Larger suffix values would need base-128 OID encoding and a different length byte.
   oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
 });
 
-// ../../node_modules/.pnpm/@noble+hashes@2.0.1/node_modules/@noble/hashes/_md.js
+// ../../node_modules/.pnpm/@noble+hashes@2.2.0/node_modules/@noble/hashes/_md.js
+function Chi(a, b, c) {
+  return a & b ^ ~a & c;
+}
+function Maj(a, b, c) {
+  return a & b ^ a & c ^ b & c;
+}
 var HashMD = class {
   blockLen;
   outputLen;
+  canXOF = false;
   padOffset;
   isLE;
   // For partial updates less than block size
@@ -219,6 +254,16 @@ var HashMD = class {
     return this._cloneInto();
   }
 };
+var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
 var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
   1779033703,
   4089235720,
@@ -238,7 +283,7 @@ var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
   327033209
 ]);
 
-// ../../node_modules/.pnpm/@noble+hashes@2.0.1/node_modules/@noble/hashes/_u64.js
+// ../../node_modules/.pnpm/@noble+hashes@2.2.0/node_modules/@noble/hashes/_u64.js
 var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
 var _32n = /* @__PURE__ */ BigInt(32);
 function fromBig(n, le = false) {
@@ -273,7 +318,152 @@ var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0
 var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
 var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
 
-// ../../node_modules/.pnpm/@noble+hashes@2.0.1/node_modules/@noble/hashes/sha2.js
+// ../../node_modules/.pnpm/@noble+hashes@2.2.0/node_modules/@noble/hashes/sha2.js
+var SHA256_K = /* @__PURE__ */ Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+var SHA2_32B = class extends HashMD {
+  constructor(outputLen) {
+    super(64, outputLen, 8, false);
+  }
+  get() {
+    const { A, B, C, D, E, F, G, H } = this;
+    return [A, B, C, D, E, F, G, H];
+  }
+  // prettier-ignore
+  set(A, B, C, D, E, F, G, H) {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D | 0;
+    this.E = E | 0;
+    this.F = F | 0;
+    this.G = G | 0;
+    this.H = H | 0;
+  }
+  process(view, offset) {
+    for (let i = 0; i < 16; i++, offset += 4)
+      SHA256_W[i] = view.getUint32(offset, false);
+    for (let i = 16; i < 64; i++) {
+      const W15 = SHA256_W[i - 15];
+      const W2 = SHA256_W[i - 2];
+      const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+      const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
+      SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
+    }
+    let { A, B, C, D, E, F, G, H } = this;
+    for (let i = 0; i < 64; i++) {
+      const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+      const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
+      const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
+      const T2 = sigma0 + Maj(A, B, C) | 0;
+      H = G;
+      G = F;
+      F = E;
+      E = D + T1 | 0;
+      D = C;
+      C = B;
+      B = A;
+      A = T1 + T2 | 0;
+    }
+    A = A + this.A | 0;
+    B = B + this.B | 0;
+    C = C + this.C | 0;
+    D = D + this.D | 0;
+    E = E + this.E | 0;
+    F = F + this.F | 0;
+    G = G + this.G | 0;
+    H = H + this.H | 0;
+    this.set(A, B, C, D, E, F, G, H);
+  }
+  roundClean() {
+    clean(SHA256_W);
+  }
+  destroy() {
+    this.destroyed = true;
+    this.set(0, 0, 0, 0, 0, 0, 0, 0);
+    clean(this.buffer);
+  }
+};
+var _SHA256 = class extends SHA2_32B {
+  // We cannot use array here since array allows indexing by variable
+  // which means optimizer/compiler cannot use registers.
+  A = SHA256_IV[0] | 0;
+  B = SHA256_IV[1] | 0;
+  C = SHA256_IV[2] | 0;
+  D = SHA256_IV[3] | 0;
+  E = SHA256_IV[4] | 0;
+  F = SHA256_IV[5] | 0;
+  G = SHA256_IV[6] | 0;
+  H = SHA256_IV[7] | 0;
+  constructor() {
+    super(32);
+  }
+};
 var K512 = /* @__PURE__ */ (() => split([
   "0x428a2f98d728ae22",
   "0x7137449123ef65cd",
@@ -451,6 +641,7 @@ var SHA2_64B = class extends HashMD {
     clean(SHA512_W_H, SHA512_W_L);
   }
   destroy() {
+    this.destroyed = true;
     clean(this.buffer);
     this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
   }
@@ -476,38 +667,53 @@ var _SHA512 = class extends SHA2_64B {
     super(64);
   }
 };
+var sha256 = /* @__PURE__ */ createHasher(
+  () => new _SHA256(),
+  /* @__PURE__ */ oidNist(1)
+);
 var sha512 = /* @__PURE__ */ createHasher(
   () => new _SHA512(),
   /* @__PURE__ */ oidNist(3)
 );
 
-// ../../node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/utils.js
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/utils.js
+var abytes2 = (value, length, title) => abytes(value, length, title);
+var anumber2 = anumber;
+var bytesToHex2 = bytesToHex;
+var concatBytes2 = (...arrays) => concatBytes(...arrays);
+var hexToBytes2 = (hex) => hexToBytes(hex);
+var isBytes2 = isBytes;
+var randomBytes2 = (bytesLength) => randomBytes(bytesLength);
 var _0n = /* @__PURE__ */ BigInt(0);
 var _1n = /* @__PURE__ */ BigInt(1);
 function abool(value, title = "") {
   if (typeof value !== "boolean") {
     const prefix = title && `"${title}" `;
-    throw new Error(prefix + "expected boolean, got type=" + typeof value);
+    throw new TypeError(prefix + "expected boolean, got type=" + typeof value);
   }
   return value;
 }
 function abignumber(n) {
   if (typeof n === "bigint") {
     if (!isPosBig(n))
-      throw new Error("positive bigint expected, got " + n);
+      throw new RangeError("positive bigint expected, got " + n);
   } else
-    anumber(n);
+    anumber2(n);
   return n;
 }
 function asafenumber(value, title = "") {
+  if (typeof value !== "number") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(prefix + "expected number, got type=" + typeof value);
+  }
   if (!Number.isSafeInteger(value)) {
     const prefix = title && `"${title}" `;
-    throw new Error(prefix + "expected safe integer, got type=" + typeof value);
+    throw new RangeError(prefix + "expected safe integer, got " + value);
   }
 }
 function hexToNumber(hex) {
   if (typeof hex !== "string")
-    throw new Error("hex string expected, got " + typeof hex);
+    throw new TypeError("hex string expected, got " + typeof hex);
   return hex === "" ? _0n : BigInt("0x" + hex);
 }
 function bytesToNumberBE(bytes) {
@@ -518,16 +724,20 @@ function bytesToNumberLE(bytes) {
 }
 function numberToBytesBE(n, len) {
   anumber(len);
+  if (len === 0)
+    throw new RangeError("zero length");
   n = abignumber(n);
-  const res = hexToBytes(n.toString(16).padStart(len * 2, "0"));
-  if (res.length !== len)
-    throw new Error("number too large");
-  return res;
+  const hex = n.toString(16);
+  if (hex.length > len * 2)
+    throw new RangeError("number too large");
+  return hexToBytes(hex.padStart(len * 2, "0"));
 }
 function numberToBytesLE(n, len) {
   return numberToBytesBE(n, len).reverse();
 }
 function equalBytes(a, b) {
+  a = abytes2(a);
+  b = abytes2(b);
   if (a.length !== b.length)
     return false;
   let diff = 0;
@@ -536,13 +746,15 @@ function equalBytes(a, b) {
   return diff === 0;
 }
 function copyBytes(bytes) {
-  return Uint8Array.from(bytes);
+  return Uint8Array.from(abytes2(bytes));
 }
 function asciiToBytes(ascii) {
+  if (typeof ascii !== "string")
+    throw new TypeError("ascii string expected, got " + typeof ascii);
   return Uint8Array.from(ascii, (c, i) => {
     const charCode = c.charCodeAt(0);
     if (c.length !== 1 || charCode > 127) {
-      throw new Error(`string contains non-ASCII character "${ascii[i]}" with code ${charCode} at position ${i}`);
+      throw new RangeError(`string contains non-ASCII character "${ascii[i]}" with code ${charCode} at position ${i}`);
     }
     return charCode;
   });
@@ -553,9 +765,11 @@ function inRange(n, min, max) {
 }
 function aInRange(title, n, min, max) {
   if (!inRange(n, min, max))
-    throw new Error("expected valid " + title + ": " + min + " <= n < " + max + ", got " + n);
+    throw new RangeError("expected valid " + title + ": " + min + " <= n < " + max + ", got " + n);
 }
 function bitLen(n) {
+  if (n < _0n)
+    throw new Error("expected non-negative bigint, got " + n);
   let len;
   for (len = 0; n > _0n; n >>= _1n, len += 1)
     ;
@@ -563,15 +777,17 @@ function bitLen(n) {
 }
 var bitMask = (n) => (_1n << BigInt(n)) - _1n;
 function validateObject(object, fields = {}, optFields = {}) {
-  if (!object || typeof object !== "object")
-    throw new Error("expected valid options object");
+  if (Object.prototype.toString.call(object) !== "[object Object]")
+    throw new TypeError("expected valid options object");
   function checkField(fieldName, expectedType, isOpt) {
+    if (!isOpt && expectedType !== "function" && !Object.hasOwn(object, fieldName))
+      throw new TypeError(`param "${fieldName}" is invalid: expected own property`);
     const val = object[fieldName];
     if (isOpt && val === void 0)
       return;
     const current = typeof val;
     if (current !== expectedType || val === null)
-      throw new Error(`param "${fieldName}" is invalid: expected ${expectedType}, got ${current}`);
+      throw new TypeError(`param "${fieldName}" is invalid: expected ${expectedType}, got ${current}`);
   }
   const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));
   iter(fields, false);
@@ -580,19 +796,8 @@ function validateObject(object, fields = {}, optFields = {}) {
 var notImplemented = () => {
   throw new Error("not implemented");
 };
-function memoized(fn) {
-  const map = /* @__PURE__ */ new WeakMap();
-  return (arg, ...args) => {
-    const val = map.get(arg);
-    if (val !== void 0)
-      return val;
-    const computed = fn(arg, ...args);
-    map.set(arg, computed);
-    return computed;
-  };
-}
 
-// ../../node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/abstract/modular.js
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/modular.js
 var _0n2 = /* @__PURE__ */ BigInt(0);
 var _1n2 = /* @__PURE__ */ BigInt(1);
 var _2n = /* @__PURE__ */ BigInt(2);
@@ -604,10 +809,14 @@ var _8n = /* @__PURE__ */ BigInt(8);
 var _9n = /* @__PURE__ */ BigInt(9);
 var _16n = /* @__PURE__ */ BigInt(16);
 function mod(a, b) {
+  if (b <= _0n2)
+    throw new Error("mod: expected positive modulus, got " + b);
   const result = a % b;
   return result >= _0n2 ? result : b + result;
 }
 function pow2(x, power, modulo) {
+  if (power < _0n2)
+    throw new Error("pow2: expected non-negative exponent, got " + power);
   let res = x;
   while (power-- > _0n2) {
     res *= res;
@@ -625,7 +834,7 @@ function invert(number, modulo) {
   let x = _0n2, y = _1n2, u = _1n2, v = _0n2;
   while (a !== _0n2) {
     const q = b / a;
-    const r = b % a;
+    const r = b - a * q;
     const m = x - u * q;
     const n = y - v * q;
     b = a, a = r, x = u, y = v, u = m, v = n;
@@ -636,23 +845,26 @@ function invert(number, modulo) {
   return mod(x, modulo);
 }
 function assertIsSquare(Fp2, root, n) {
-  if (!Fp2.eql(Fp2.sqr(root), n))
+  const F = Fp2;
+  if (!F.eql(F.sqr(root), n))
     throw new Error("Cannot find square root");
 }
 function sqrt3mod4(Fp2, n) {
-  const p1div4 = (Fp2.ORDER + _1n2) / _4n;
-  const root = Fp2.pow(n, p1div4);
-  assertIsSquare(Fp2, root, n);
+  const F = Fp2;
+  const p1div4 = (F.ORDER + _1n2) / _4n;
+  const root = F.pow(n, p1div4);
+  assertIsSquare(F, root, n);
   return root;
 }
 function sqrt5mod8(Fp2, n) {
-  const p5div8 = (Fp2.ORDER - _5n) / _8n;
-  const n2 = Fp2.mul(n, _2n);
-  const v = Fp2.pow(n2, p5div8);
-  const nv = Fp2.mul(n, v);
-  const i = Fp2.mul(Fp2.mul(nv, _2n), v);
-  const root = Fp2.mul(nv, Fp2.sub(i, Fp2.ONE));
-  assertIsSquare(Fp2, root, n);
+  const F = Fp2;
+  const p5div8 = (F.ORDER - _5n) / _8n;
+  const n2 = F.mul(n, _2n);
+  const v = F.pow(n2, p5div8);
+  const nv = F.mul(n, v);
+  const i = F.mul(F.mul(nv, _2n), v);
+  const root = F.mul(nv, F.sub(i, F.ONE));
+  assertIsSquare(F, root, n);
   return root;
 }
 function sqrt9mod16(P) {
@@ -662,20 +874,21 @@ function sqrt9mod16(P) {
   const c2 = tn(Fp_, c1);
   const c3 = tn(Fp_, Fp_.neg(c1));
   const c4 = (P + _7n) / _16n;
-  return (Fp2, n) => {
-    let tv1 = Fp2.pow(n, c4);
-    let tv2 = Fp2.mul(tv1, c1);
-    const tv3 = Fp2.mul(tv1, c2);
-    const tv4 = Fp2.mul(tv1, c3);
-    const e1 = Fp2.eql(Fp2.sqr(tv2), n);
-    const e2 = Fp2.eql(Fp2.sqr(tv3), n);
-    tv1 = Fp2.cmov(tv1, tv2, e1);
-    tv2 = Fp2.cmov(tv4, tv3, e2);
-    const e3 = Fp2.eql(Fp2.sqr(tv2), n);
-    const root = Fp2.cmov(tv1, tv2, e3);
-    assertIsSquare(Fp2, root, n);
+  return ((Fp2, n) => {
+    const F = Fp2;
+    let tv1 = F.pow(n, c4);
+    let tv2 = F.mul(tv1, c1);
+    const tv3 = F.mul(tv1, c2);
+    const tv4 = F.mul(tv1, c3);
+    const e1 = F.eql(F.sqr(tv2), n);
+    const e2 = F.eql(F.sqr(tv3), n);
+    tv1 = F.cmov(tv1, tv2, e1);
+    tv2 = F.cmov(tv4, tv3, e2);
+    const e3 = F.eql(F.sqr(tv2), n);
+    const root = F.cmov(tv1, tv2, e3);
+    assertIsSquare(F, root, n);
     return root;
-  };
+  });
 }
 function tonelliShanks(P) {
   if (P < _3n)
@@ -697,31 +910,32 @@ function tonelliShanks(P) {
   let cc = _Fp.pow(Z, Q);
   const Q1div2 = (Q + _1n2) / _2n;
   return function tonelliSlow(Fp2, n) {
-    if (Fp2.is0(n))
+    const F = Fp2;
+    if (F.is0(n))
       return n;
-    if (FpLegendre(Fp2, n) !== 1)
+    if (FpLegendre(F, n) !== 1)
       throw new Error("Cannot find square root");
     let M = S;
-    let c = Fp2.mul(Fp2.ONE, cc);
-    let t = Fp2.pow(n, Q);
-    let R = Fp2.pow(n, Q1div2);
-    while (!Fp2.eql(t, Fp2.ONE)) {
-      if (Fp2.is0(t))
-        return Fp2.ZERO;
+    let c = F.mul(F.ONE, cc);
+    let t = F.pow(n, Q);
+    let R = F.pow(n, Q1div2);
+    while (!F.eql(t, F.ONE)) {
+      if (F.is0(t))
+        return F.ZERO;
       let i = 1;
-      let t_tmp = Fp2.sqr(t);
-      while (!Fp2.eql(t_tmp, Fp2.ONE)) {
+      let t_tmp = F.sqr(t);
+      while (!F.eql(t_tmp, F.ONE)) {
         i++;
-        t_tmp = Fp2.sqr(t_tmp);
+        t_tmp = F.sqr(t_tmp);
         if (i === M)
           throw new Error("Cannot find square root");
       }
       const exponent = _1n2 << BigInt(M - i - 1);
-      const b = Fp2.pow(c, exponent);
+      const b = F.pow(c, exponent);
       M = i;
-      c = Fp2.sqr(b);
-      t = Fp2.mul(t, c);
-      R = Fp2.mul(R, b);
+      c = F.sqr(b);
+      t = F.mul(t, c);
+      R = F.mul(R, b);
     }
     return R;
   };
@@ -766,59 +980,76 @@ function validateField(field) {
     return map;
   }, initial);
   validateObject(field, opts);
+  asafenumber(field.BYTES, "BYTES");
+  asafenumber(field.BITS, "BITS");
+  if (field.BYTES < 1 || field.BITS < 1)
+    throw new Error("invalid field: expected BYTES/BITS > 0");
+  if (field.ORDER <= _1n2)
+    throw new Error("invalid field: expected ORDER > 1, got " + field.ORDER);
   return field;
 }
 function FpPow(Fp2, num, power) {
+  const F = Fp2;
   if (power < _0n2)
     throw new Error("invalid exponent, negatives unsupported");
   if (power === _0n2)
-    return Fp2.ONE;
+    return F.ONE;
   if (power === _1n2)
     return num;
-  let p = Fp2.ONE;
+  let p = F.ONE;
   let d = num;
   while (power > _0n2) {
     if (power & _1n2)
-      p = Fp2.mul(p, d);
-    d = Fp2.sqr(d);
+      p = F.mul(p, d);
+    d = F.sqr(d);
     power >>= _1n2;
   }
   return p;
 }
 function FpInvertBatch(Fp2, nums, passZero = false) {
-  const inverted = new Array(nums.length).fill(passZero ? Fp2.ZERO : void 0);
+  const F = Fp2;
+  const inverted = new Array(nums.length).fill(passZero ? F.ZERO : void 0);
   const multipliedAcc = nums.reduce((acc, num, i) => {
-    if (Fp2.is0(num))
+    if (F.is0(num))
       return acc;
     inverted[i] = acc;
-    return Fp2.mul(acc, num);
-  }, Fp2.ONE);
-  const invertedAcc = Fp2.inv(multipliedAcc);
+    return F.mul(acc, num);
+  }, F.ONE);
+  const invertedAcc = F.inv(multipliedAcc);
   nums.reduceRight((acc, num, i) => {
-    if (Fp2.is0(num))
+    if (F.is0(num))
       return acc;
-    inverted[i] = Fp2.mul(acc, inverted[i]);
-    return Fp2.mul(acc, num);
+    inverted[i] = F.mul(acc, inverted[i]);
+    return F.mul(acc, num);
   }, invertedAcc);
   return inverted;
 }
 function FpLegendre(Fp2, n) {
-  const p1mod2 = (Fp2.ORDER - _1n2) / _2n;
-  const powered = Fp2.pow(n, p1mod2);
-  const yes = Fp2.eql(powered, Fp2.ONE);
-  const zero = Fp2.eql(powered, Fp2.ZERO);
-  const no = Fp2.eql(powered, Fp2.neg(Fp2.ONE));
+  const F = Fp2;
+  const p1mod2 = (F.ORDER - _1n2) / _2n;
+  const powered = F.pow(n, p1mod2);
+  const yes = F.eql(powered, F.ONE);
+  const zero = F.eql(powered, F.ZERO);
+  const no = F.eql(powered, F.neg(F.ONE));
   if (!yes && !zero && !no)
     throw new Error("invalid Legendre symbol result");
   return yes ? 1 : zero ? 0 : -1;
 }
 function nLength(n, nBitLength) {
   if (nBitLength !== void 0)
-    anumber(nBitLength);
-  const _nBitLength = nBitLength !== void 0 ? nBitLength : n.toString(2).length;
+    anumber2(nBitLength);
+  if (n <= _0n2)
+    throw new Error("invalid n length: expected positive n, got " + n);
+  if (nBitLength !== void 0 && nBitLength < 1)
+    throw new Error("invalid n length: expected positive bit length, got " + nBitLength);
+  const bits = bitLen(n);
+  if (nBitLength !== void 0 && nBitLength < bits)
+    throw new Error(`invalid n length: expected bit length (${bits}) >= n.length (${nBitLength})`);
+  const _nBitLength = nBitLength !== void 0 ? nBitLength : bits;
   const nByteLength = Math.ceil(_nBitLength / 8);
   return { nBitLength: _nBitLength, nByteLength };
 }
+var FIELD_SQRT = /* @__PURE__ */ new WeakMap();
 var _Field = class {
   ORDER;
   BITS;
@@ -827,23 +1058,21 @@ var _Field = class {
   ZERO = _0n2;
   ONE = _1n2;
   _lengths;
-  _sqrt;
-  // cached sqrt
   _mod;
   constructor(ORDER, opts = {}) {
-    if (ORDER <= _0n2)
-      throw new Error("invalid field: expected ORDER > 0, got " + ORDER);
+    if (ORDER <= _1n2)
+      throw new Error("invalid field: expected ORDER > 1, got " + ORDER);
     let _nbitLength = void 0;
     this.isLE = false;
     if (opts != null && typeof opts === "object") {
       if (typeof opts.BITS === "number")
         _nbitLength = opts.BITS;
       if (typeof opts.sqrt === "function")
-        this.sqrt = opts.sqrt;
+        Object.defineProperty(this, "sqrt", { value: opts.sqrt, enumerable: true });
       if (typeof opts.isLE === "boolean")
         this.isLE = opts.isLE;
       if (opts.allowedLengths)
-        this._lengths = opts.allowedLengths?.slice();
+        this._lengths = Object.freeze(opts.allowedLengths.slice());
       if (typeof opts.modFromBytes === "boolean")
         this._mod = opts.modFromBytes;
     }
@@ -853,15 +1082,14 @@ var _Field = class {
     this.ORDER = ORDER;
     this.BITS = nBitLength;
     this.BYTES = nByteLength;
-    this._sqrt = void 0;
-    Object.preventExtensions(this);
+    Object.freeze(this);
   }
   create(num) {
     return mod(num, this.ORDER);
   }
   isValid(num) {
     if (typeof num !== "bigint")
-      throw new Error("invalid field element: expected bigint, got " + typeof num);
+      throw new TypeError("invalid field element: expected bigint, got " + typeof num);
     return _0n2 <= num && num < this.ORDER;
   }
   is0(num) {
@@ -915,18 +1143,19 @@ var _Field = class {
     return invert(num, this.ORDER);
   }
   sqrt(num) {
-    if (!this._sqrt)
-      this._sqrt = FpSqrt(this.ORDER);
-    return this._sqrt(this, num);
+    let sqrt = FIELD_SQRT.get(this);
+    if (!sqrt)
+      FIELD_SQRT.set(this, sqrt = FpSqrt(this.ORDER));
+    return sqrt(this, num);
   }
   toBytes(num) {
     return this.isLE ? numberToBytesLE(num, this.BYTES) : numberToBytesBE(num, this.BYTES);
   }
   fromBytes(bytes, skipValidation = false) {
-    abytes(bytes);
+    abytes2(bytes);
     const { _lengths: allowedLengths, BYTES, isLE, ORDER, _mod: modFromBytes } = this;
     if (allowedLengths) {
-      if (!allowedLengths.includes(bytes.length) || bytes.length > BYTES) {
+      if (bytes.length < 1 || !allowedLengths.includes(bytes.length) || bytes.length > BYTES) {
         throw new Error("Field.fromBytes: expected " + allowedLengths + " bytes, got " + bytes.length);
       }
       const padded = new Uint8Array(BYTES);
@@ -951,22 +1180,27 @@ var _Field = class {
   // We can't move this out because Fp6, Fp12 implement it
   // and it's unclear what to return in there.
   cmov(a, b, condition) {
+    abool(condition, "condition");
     return condition ? b : a;
   }
 };
+Object.freeze(_Field.prototype);
 function Field(ORDER, opts = {}) {
   return new _Field(ORDER, opts);
 }
 function FpSqrtEven(Fp2, elm) {
-  if (!Fp2.isOdd)
+  const F = Fp2;
+  if (!F.isOdd)
     throw new Error("Field doesn't have isOdd");
-  const root = Fp2.sqrt(elm);
-  return Fp2.isOdd(root) ? Fp2.neg(root) : root;
+  const root = F.sqrt(elm);
+  return F.isOdd(root) ? F.neg(root) : root;
 }
 function getFieldBytesLength(fieldOrder) {
   if (typeof fieldOrder !== "bigint")
     throw new Error("field order must be bigint");
-  const bitLength = fieldOrder.toString(2).length;
+  if (fieldOrder <= _1n2)
+    throw new Error("field order must be greater than 1");
+  const bitLength = bitLen(fieldOrder - _1n2);
   return Math.ceil(bitLength / 8);
 }
 function getMinHashLength(fieldOrder) {
@@ -974,20 +1208,40 @@ function getMinHashLength(fieldOrder) {
   return length + Math.ceil(length / 2);
 }
 function mapHashToField(key, fieldOrder, isLE = false) {
-  abytes(key);
+  abytes2(key);
   const len = key.length;
   const fieldLen = getFieldBytesLength(fieldOrder);
-  const minLen = getMinHashLength(fieldOrder);
-  if (len < 16 || len < minLen || len > 1024)
+  const minLen = Math.max(getMinHashLength(fieldOrder), 16);
+  if (len < minLen || len > 1024)
     throw new Error("expected " + minLen + "-1024 bytes of input, got " + len);
   const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);
   const reduced = mod(num, fieldOrder - _1n2) + _1n2;
   return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
 }
 
-// ../../node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/abstract/curve.js
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/curve.js
 var _0n3 = /* @__PURE__ */ BigInt(0);
 var _1n3 = /* @__PURE__ */ BigInt(1);
+function validatePointCons(Point) {
+  const pc = Point;
+  if (typeof pc !== "function")
+    throw new TypeError("Point must be a constructor");
+  validateObject({
+    Fp: pc.Fp,
+    Fn: pc.Fn,
+    fromAffine: pc.fromAffine,
+    fromBytes: pc.fromBytes,
+    fromHex: pc.fromHex
+  }, {
+    Fp: "object",
+    Fn: "object",
+    fromAffine: "function",
+    fromBytes: "function",
+    fromHex: "function"
+  });
+  validateField(pc.Fp);
+  validateField(pc.Fn);
+}
 function negateCt(condition, item) {
   const neg = item.negate();
   return condition ? neg : item;
@@ -1081,8 +1335,8 @@ var wNAF = class {
    * - 𝑊 is the window size
    * - 𝑛 is the bitlength of the curve order.
    * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
-   * @param point Point instance
-   * @param W window size
+   * @param point - Point instance
+   * @param W - window size
    * @returns precomputed point tables flattened to a single array
    */
   precomputeWindow(point, W) {
@@ -1126,8 +1380,9 @@ var wNAF = class {
     return { p, f };
   }
   /**
-   * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.
-   * @param acc accumulator point to add result of multiplication
+   * Implements unsafe EC multiplication using precomputed tables
+   * and w-ary non-adjacent form.
+   * @param acc - accumulator point to add result of multiplication
    * @returns point
    */
   wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {
@@ -1259,11 +1514,11 @@ function createKeygen(randomSecretKey, getPublicKey) {
   };
 }
 
-// ../../node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/abstract/edwards.js
-var _0n4 = BigInt(0);
-var _1n4 = BigInt(1);
-var _2n2 = BigInt(2);
-var _8n2 = BigInt(8);
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/edwards.js
+var _0n4 = /* @__PURE__ */ BigInt(0);
+var _1n4 = /* @__PURE__ */ BigInt(1);
+var _2n2 = /* @__PURE__ */ BigInt(2);
+var _8n2 = /* @__PURE__ */ BigInt(8);
 function isEdValidXY(Fp2, CURVE, x, y) {
   const x2 = Fp2.sqr(x);
   const y2 = Fp2.sqr(y);
@@ -1272,20 +1527,21 @@ function isEdValidXY(Fp2, CURVE, x, y) {
   return Fp2.eql(left, right);
 }
 function edwards(params, extraOpts = {}) {
-  const validated = createCurveFields("edwards", params, extraOpts, extraOpts.FpFnLE);
+  const opts = extraOpts;
+  const validated = createCurveFields("edwards", params, opts, opts.FpFnLE);
   const { Fp: Fp2, Fn: Fn2 } = validated;
   let CURVE = validated.CURVE;
   const { h: cofactor } = CURVE;
-  validateObject(extraOpts, {}, { uvRatio: "function" });
+  validateObject(opts, {}, { uvRatio: "function" });
   const MASK = _2n2 << BigInt(Fn2.BYTES * 8) - _1n4;
   const modP = (n) => Fp2.create(n);
-  const uvRatio2 = extraOpts.uvRatio || ((u, v) => {
+  const uvRatio2 = opts.uvRatio === void 0 ? (u, v) => {
     try {
       return { isValid: true, value: Fp2.sqrt(Fp2.div(u, v)) };
     } catch (e) {
       return { isValid: false, value: _0n4 };
     }
-  });
+  } : opts.uvRatio;
   if (!isEdValidXY(Fp2, CURVE, CURVE.Gx, CURVE.Gy))
     throw new Error("bad curve params: generator point");
   function acoord(title, n, banZero = false) {
@@ -1297,40 +1553,6 @@ function edwards(params, extraOpts = {}) {
     if (!(other instanceof Point))
       throw new Error("EdwardsPoint expected");
   }
-  const toAffineMemo = memoized((p, iz) => {
-    const { X, Y, Z } = p;
-    const is0 = p.is0();
-    if (iz == null)
-      iz = is0 ? _8n2 : Fp2.inv(Z);
-    const x = modP(X * iz);
-    const y = modP(Y * iz);
-    const zz = Fp2.mul(Z, iz);
-    if (is0)
-      return { x: _0n4, y: _1n4 };
-    if (zz !== _1n4)
-      throw new Error("invZ was invalid");
-    return { x, y };
-  });
-  const assertValidMemo = memoized((p) => {
-    const { a, d } = CURVE;
-    if (p.is0())
-      throw new Error("bad point: ZERO");
-    const { X, Y, Z, T } = p;
-    const X2 = modP(X * X);
-    const Y2 = modP(Y * Y);
-    const Z2 = modP(Z * Z);
-    const Z4 = modP(Z2 * Z2);
-    const aX2 = modP(X2 * a);
-    const left = modP(Z2 * modP(aX2 + Y2));
-    const right = modP(Z4 + modP(d * modP(X2 * Y2)));
-    if (left !== right)
-      throw new Error("bad point: equation left != right (1)");
-    const XY = modP(X * Y);
-    const ZT = modP(Z * T);
-    if (XY !== ZT)
-      throw new Error("bad point: equation left != right (2)");
-    return true;
-  });
   class Point {
     // base / generator point
     static BASE = new Point(CURVE.Gx, CURVE.Gy, _1n4, modP(CURVE.Gx * CURVE.Gy));
@@ -1355,6 +1577,11 @@ function edwards(params, extraOpts = {}) {
     static CURVE() {
       return CURVE;
     }
+    /**
+     * Create one extended Edwards point from affine coordinates.
+     * Does NOT validate that the point is on-curve or torsion-free.
+     * Use `.assertValidity()` on adversarial inputs.
+     */
     static fromAffine(p) {
       if (p instanceof Point)
         throw new Error("extended point not allowed");
@@ -1367,7 +1594,7 @@ function edwards(params, extraOpts = {}) {
     static fromBytes(bytes, zip215 = false) {
       const len = Fp2.BYTES;
       const { a, d } = CURVE;
-      bytes = copyBytes(abytes(bytes, len, "point"));
+      bytes = copyBytes(abytes2(bytes, len, "point"));
       abool(zip215, "zip215");
       const normed = copyBytes(bytes);
       const lastByte = bytes[len - 1];
@@ -1390,7 +1617,7 @@ function edwards(params, extraOpts = {}) {
       return Point.fromAffine({ x, y });
     }
     static fromHex(hex, zip215 = false) {
-      return Point.fromBytes(hexToBytes(hex), zip215);
+      return Point.fromBytes(hexToBytes2(hex), zip215);
     }
     get x() {
       return this.toAffine().x;
@@ -1406,7 +1633,24 @@ function edwards(params, extraOpts = {}) {
     }
     // Useful in fromAffine() - not for fromBytes(), which always created valid points.
     assertValidity() {
-      assertValidMemo(this);
+      const p = this;
+      const { a, d } = CURVE;
+      if (p.is0())
+        throw new Error("bad point: ZERO");
+      const { X, Y, Z, T } = p;
+      const X2 = modP(X * X);
+      const Y2 = modP(Y * Y);
+      const Z2 = modP(Z * Z);
+      const Z4 = modP(Z2 * Z2);
+      const aX2 = modP(X2 * a);
+      const left = modP(Z2 * modP(aX2 + Y2));
+      const right = modP(Z4 + modP(d * modP(X2 * Y2)));
+      if (left !== right)
+        throw new Error("bad point: equation left != right (1)");
+      const XY = modP(X * Y);
+      const ZT = modP(Z * T);
+      if (XY !== ZT)
+        throw new Error("bad point: equation left != right (2)");
     }
     // Compare one point to another.
     equals(other) {
@@ -1469,35 +1713,36 @@ function edwards(params, extraOpts = {}) {
       return new Point(X3, Y3, Z3, T3);
     }
     subtract(other) {
+      aedpoint(other);
       return this.add(other.negate());
     }
     // Constant-time multiplication.
     multiply(scalar) {
       if (!Fn2.isValidNot0(scalar))
-        throw new Error("invalid scalar: expected 1 <= sc < curve.n");
+        throw new RangeError("invalid scalar: expected 1 <= sc < curve.n");
       const { p, f } = wnaf.cached(this, scalar, (p2) => normalizeZ(Point, p2));
       return normalizeZ(Point, [p, f])[0];
     }
     // Non-constant-time multiplication. Uses double-and-add algorithm.
     // It's faster, but should only be used when you don't care about
     // an exposed private key e.g. sig verification.
-    // Does NOT allow scalars higher than CURVE.n.
-    // Accepts optional accumulator to merge with multiply (important for sparse scalars)
-    multiplyUnsafe(scalar, acc = Point.ZERO) {
+    // Keeps the same subgroup-scalar contract: 0 is allowed for public-scalar callers, but
+    // n and larger values are rejected instead of being reduced mod n to the identity point.
+    multiplyUnsafe(scalar) {
       if (!Fn2.isValid(scalar))
-        throw new Error("invalid scalar: expected 0 <= sc < curve.n");
+        throw new RangeError("invalid scalar: expected 0 <= sc < curve.n");
       if (scalar === _0n4)
         return Point.ZERO;
       if (this.is0() || scalar === _1n4)
         return this;
-      return wnaf.unsafe(this, scalar, (p) => normalizeZ(Point, p), acc);
+      return wnaf.unsafe(this, scalar, (p) => normalizeZ(Point, p));
     }
     // Checks if point is of small order.
     // If you add something to small order point, you will have "dirty"
     // point with torsion component.
-    // Multiplies point by cofactor and checks if the result is 0.
+    // Clears cofactor and checks if the result is 0.
     isSmallOrder() {
-      return this.multiplyUnsafe(cofactor).is0();
+      return this.clearCofactor().is0();
     }
     // Multiplies point by curve order and checks if the result is 0.
     // Returns `false` is the point is dirty.
@@ -1507,7 +1752,20 @@ function edwards(params, extraOpts = {}) {
     // Converts Extended point to default (x, y) coordinates.
     // Can accept precomputed Z^-1 - for example, from invertBatch.
     toAffine(invertedZ) {
-      return toAffineMemo(this, invertedZ);
+      const p = this;
+      let iz = invertedZ;
+      const { X, Y, Z } = p;
+      const is0 = p.is0();
+      if (iz == null)
+        iz = is0 ? _8n2 : Fp2.inv(Z);
+      const x = modP(X * iz);
+      const y = modP(Y * iz);
+      const zz = Fp2.mul(Z, iz);
+      if (is0)
+        return { x: _0n4, y: _1n4 };
+      if (zz !== _1n4)
+        throw new Error("invZ was invalid");
+      return { x, y };
     }
     clearCofactor() {
       if (cofactor === _1n4)
@@ -1521,14 +1779,17 @@ function edwards(params, extraOpts = {}) {
       return bytes;
     }
     toHex() {
-      return bytesToHex(this.toBytes());
+      return bytesToHex2(this.toBytes());
     }
     toString() {
       return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
     }
   }
   const wnaf = new wNAF(Point, Fn2.BITS);
-  Point.BASE.precompute(8);
+  if (Fn2.BITS >= 8)
+    Point.BASE.precompute(8);
+  Object.freeze(Point.prototype);
+  Object.freeze(Point);
   return Point;
 }
 var PrimeEdwardsPoint = class {
@@ -1537,6 +1798,11 @@ var PrimeEdwardsPoint = class {
   static Fp;
   static Fn;
   ep;
+  /**
+   * Wrap one internal Edwards representative directly.
+   * This is not a canonical encoding boundary: alternate Edwards
+   * representatives may still describe the same abstract wrapper element.
+   */
   constructor(ep) {
     this.ep = ep;
   }
@@ -1560,11 +1826,17 @@ var PrimeEdwardsPoint = class {
   assertValidity() {
     this.ep.assertValidity();
   }
+  /**
+   * Return affine coordinates of the current internal Edwards representative.
+   * This is a convenience helper, not a canonical Ristretto/Decaf encoding.
+   * Equal abstract elements may expose different `x` / `y`; use
+   * `toBytes()` / `fromBytes()` for canonical roundtrips.
+   */
   toAffine(invertedZ) {
     return this.ep.toAffine(invertedZ);
   }
   toHex() {
-    return bytesToHex(this.toBytes());
+    return bytesToHex2(this.toBytes());
   }
   toString() {
     return this.toHex();
@@ -1596,36 +1868,47 @@ var PrimeEdwardsPoint = class {
     return this.init(this.ep.negate());
   }
   precompute(windowSize, isLazy) {
-    return this.init(this.ep.precompute(windowSize, isLazy));
+    this.ep.precompute(windowSize, isLazy);
+    return this;
   }
 };
 function eddsa(Point, cHash, eddsaOpts = {}) {
   if (typeof cHash !== "function")
     throw new Error('"hash" function param is required');
-  validateObject(eddsaOpts, {}, {
+  const hash = cHash;
+  const opts = eddsaOpts;
+  validateObject(opts, {}, {
     adjustScalarBytes: "function",
     randomBytes: "function",
     domain: "function",
     prehash: "function",
+    zip215: "boolean",
     mapToCurve: "function"
   });
-  const { prehash } = eddsaOpts;
+  const { prehash } = opts;
   const { BASE, Fp: Fp2, Fn: Fn2 } = Point;
-  const randomBytes2 = eddsaOpts.randomBytes || randomBytes;
-  const adjustScalarBytes2 = eddsaOpts.adjustScalarBytes || ((bytes) => bytes);
-  const domain = eddsaOpts.domain || ((data, ctx, phflag) => {
+  const outputLen = hash.outputLen;
+  const expectedLen = 2 * Fp2.BYTES;
+  if (outputLen !== void 0) {
+    asafenumber(outputLen, "hash.outputLen");
+    if (outputLen !== expectedLen)
+      throw new Error(`hash.outputLen must be ${expectedLen}, got ${outputLen}`);
+  }
+  const randomBytes3 = opts.randomBytes === void 0 ? randomBytes2 : opts.randomBytes;
+  const adjustScalarBytes2 = opts.adjustScalarBytes === void 0 ? (bytes) => bytes : opts.adjustScalarBytes;
+  const domain = opts.domain === void 0 ? (data, ctx, phflag) => {
     abool(phflag, "phflag");
     if (ctx.length || phflag)
       throw new Error("Contexts/pre-hash are not supported");
     return data;
-  });
-  function modN_LE(hash) {
-    return Fn2.create(bytesToNumberLE(hash));
+  } : opts.domain;
+  function modN_LE(hash2) {
+    return Fn2.create(bytesToNumberLE(hash2));
   }
   function getPrivateScalar(key) {
     const len = lengths.secretKey;
-    abytes(key, lengths.secretKey, "secretKey");
-    const hashed = abytes(cHash(key), 2 * len, "hashedSecretKey");
+    abytes2(key, lengths.secretKey, "secretKey");
+    const hashed = abytes2(hash(key), 2 * len, "hashedSecretKey");
     const head = adjustScalarBytes2(hashed.slice(0, len));
     const prefix = hashed.slice(len, 2 * len);
     const scalar = modN_LE(head);
@@ -1641,11 +1924,11 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     return getExtendedPublicKey(secretKey).pointBytes;
   }
   function hashDomainToScalar(context = Uint8Array.of(), ...msgs) {
-    const msg = concatBytes(...msgs);
-    return modN_LE(cHash(domain(msg, abytes(context, void 0, "context"), !!prehash)));
+    const msg = concatBytes2(...msgs);
+    return modN_LE(hash(domain(msg, abytes2(context, void 0, "context"), !!prehash)));
   }
   function sign(msg, secretKey, options = {}) {
-    msg = abytes(msg, void 0, "message");
+    msg = abytes2(msg, void 0, "message");
     if (prehash)
       msg = prehash(msg);
     const { prefix, scalar, pointBytes } = getExtendedPublicKey(secretKey);
@@ -1655,16 +1938,19 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     const s = Fn2.create(r + k * scalar);
     if (!Fn2.isValid(s))
       throw new Error("sign failed: invalid s");
-    const rs = concatBytes(R, Fn2.toBytes(s));
-    return abytes(rs, lengths.signature, "result");
+    const rs = concatBytes2(R, Fn2.toBytes(s));
+    return abytes2(rs, lengths.signature, "result");
   }
-  const verifyOpts = { zip215: true };
+  const verifyOpts = {
+    zip215: opts.zip215
+  };
   function verify(sig, msg, publicKey, options = verifyOpts) {
-    const { context, zip215 } = options;
+    const { context } = options;
+    const zip215 = options.zip215 === void 0 ? !!verifyOpts.zip215 : options.zip215;
     const len = lengths.signature;
-    sig = abytes(sig, len, "signature");
-    msg = abytes(msg, void 0, "message");
-    publicKey = abytes(publicKey, lengths.publicKey, "publicKey");
+    sig = abytes2(sig, len, "signature");
+    msg = abytes2(msg, void 0, "message");
+    publicKey = abytes2(publicKey, lengths.publicKey, "publicKey");
     if (zip215 !== void 0)
       abool(zip215, "zip215");
     if (prehash)
@@ -1682,7 +1968,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     }
     if (!zip215 && A.isSmallOrder())
       return false;
-    const k = hashDomainToScalar(context, R.toBytes(), A.toBytes(), msg);
+    const k = hashDomainToScalar(context, r, publicKey, msg);
     const RkA = R.add(A.multiplyUnsafe(k));
     return RkA.subtract(SB).clearCofactor().is0();
   }
@@ -1693,15 +1979,16 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     signature: 2 * _size,
     seed: _size
   };
-  function randomSecretKey(seed = randomBytes2(lengths.seed)) {
-    return abytes(seed, lengths.seed, "seed");
+  function randomSecretKey(seed) {
+    seed = seed === void 0 ? randomBytes3(lengths.seed) : seed;
+    return abytes2(seed, lengths.seed, "seed");
   }
   function isValidSecretKey(key) {
-    return isBytes(key) && key.length === Fn2.BYTES;
+    return isBytes2(key) && key.length === lengths.secretKey;
   }
   function isValidPublicKey(key, zip215) {
     try {
-      return !!Point.fromBytes(key, zip215);
+      return !!Point.fromBytes(key, zip215 === void 0 ? verifyOpts.zip215 : zip215);
     } catch (error) {
       return false;
     }
@@ -1731,11 +2018,13 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     },
     toMontgomerySecret(secretKey) {
       const size = lengths.secretKey;
-      abytes(secretKey, size);
-      const hashed = cHash(secretKey.subarray(0, size));
+      abytes2(secretKey, size);
+      const hashed = hash(secretKey.subarray(0, size));
       return adjustScalarBytes2(hashed).subarray(0, size);
     }
   };
+  Object.freeze(lengths);
+  Object.freeze(utils);
   return Object.freeze({
     keygen: createKeygen(randomSecretKey, getPublicKey),
     getPublicKey,
@@ -1747,12 +2036,223 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
   });
 }
 
-// ../../node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/abstract/hash-to-curve.js
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/fft.js
+function checkU32(n) {
+  if (!Number.isSafeInteger(n) || n < 0 || n > 4294967295)
+    throw new Error("wrong u32 integer:" + n);
+  return n;
+}
+function nextPowerOfTwo(n) {
+  checkU32(n);
+  if (n <= 1)
+    return 1;
+  if (n > 2147483648)
+    throw new Error("nextPowerOfTwo overflow: result does not fit u32");
+  return 1 << log2(n - 1) + 1 >>> 0;
+}
+function log2(n) {
+  checkU32(n);
+  return 31 - Math.clz32(n);
+}
+function poly(field, roots, create, fft, length) {
+  const F = field;
+  const _create = create || ((len, elm) => new Array(len).fill(elm ?? F.ZERO));
+  const isPoly = (x) => {
+    if (Array.isArray(x))
+      return true;
+    if (!ArrayBuffer.isView(x))
+      return false;
+    const v = x;
+    return typeof v.length === "number" && typeof v.slice === "function" && typeof v[Symbol.iterator] === "function";
+  };
+  const checkLength = (...lst) => {
+    if (!lst.length)
+      return 0;
+    for (const i of lst)
+      if (!isPoly(i))
+        throw new Error("poly: not polynomial: " + i);
+    const L = lst[0].length;
+    for (let i = 1; i < lst.length; i++)
+      if (lst[i].length !== L)
+        throw new Error(`poly: mismatched lengths ${L} vs ${lst[i].length}`);
+    if (length !== void 0 && L !== length)
+      throw new Error(`poly: expected fixed length ${length}, got ${L}`);
+    return L;
+  };
+  function findOmegaIndex(x, n, brp = false) {
+    const bits = log2(n);
+    const omega = brp ? roots.brp(bits) : roots.roots(bits);
+    for (let i = 0; i < n; i++)
+      if (F.eql(x, omega[i]))
+        return i;
+    return -1;
+  }
+  return {
+    roots,
+    create: _create,
+    length,
+    extend: (a, len) => {
+      checkLength(a);
+      const out = _create(len, F.ZERO);
+      for (let i = 0; i < Math.min(a.length, len); i++)
+        out[i] = a[i];
+      return out;
+    },
+    degree: (a) => {
+      checkLength(a);
+      for (let i = a.length - 1; i >= 0; i--)
+        if (!F.is0(a[i]))
+          return i;
+      return -1;
+    },
+    add: (a, b) => {
+      const len = checkLength(a, b);
+      const out = _create(len);
+      for (let i = 0; i < len; i++)
+        out[i] = F.add(a[i], b[i]);
+      return out;
+    },
+    sub: (a, b) => {
+      const len = checkLength(a, b);
+      const out = _create(len);
+      for (let i = 0; i < len; i++)
+        out[i] = F.sub(a[i], b[i]);
+      return out;
+    },
+    dot: (a, b) => {
+      const len = checkLength(a, b);
+      const out = _create(len);
+      for (let i = 0; i < len; i++)
+        out[i] = F.mul(a[i], b[i]);
+      return out;
+    },
+    mul: (a, b) => {
+      if (isPoly(b)) {
+        const len = checkLength(a, b);
+        if (fft) {
+          const A = fft.direct(a, false, true);
+          const B = fft.direct(b, false, true);
+          for (let i = 0; i < A.length; i++)
+            A[i] = F.mul(A[i], B[i]);
+          return fft.inverse(A, true, false);
+        } else {
+          const res = _create(len);
+          for (let i = 0; i < len; i++) {
+            for (let j = 0; j < len; j++) {
+              const k = (i + j) % len;
+              res[k] = F.add(res[k], F.mul(a[i], b[j]));
+            }
+          }
+          return res;
+        }
+      } else {
+        const out = _create(checkLength(a));
+        for (let i = 0; i < out.length; i++)
+          out[i] = F.mul(a[i], b);
+        return out;
+      }
+    },
+    convolve(a, b) {
+      const len = nextPowerOfTwo(a.length + b.length - 1);
+      return this.mul(this.extend(a, len), this.extend(b, len));
+    },
+    shift(p, factor) {
+      const out = _create(checkLength(p));
+      out[0] = p[0];
+      for (let i = 1, power = F.ONE; i < p.length; i++) {
+        power = F.mul(power, factor);
+        out[i] = F.mul(p[i], power);
+      }
+      return out;
+    },
+    clone: (a) => {
+      checkLength(a);
+      const out = _create(a.length);
+      for (let i = 0; i < a.length; i++)
+        out[i] = a[i];
+      return out;
+    },
+    eval: (a, basis) => {
+      checkLength(a, basis);
+      let acc = F.ZERO;
+      for (let i = 0; i < a.length; i++)
+        acc = F.add(acc, F.mul(a[i], basis[i]));
+      return acc;
+    },
+    monomial: {
+      basis: (x, n) => {
+        const out = _create(n);
+        let pow = F.ONE;
+        for (let i = 0; i < n; i++) {
+          out[i] = pow;
+          pow = F.mul(pow, x);
+        }
+        return out;
+      },
+      eval: (a, x) => {
+        checkLength(a);
+        let acc = F.ZERO;
+        for (let i = a.length - 1; i >= 0; i--)
+          acc = F.add(F.mul(acc, x), a[i]);
+        return acc;
+      }
+    },
+    lagrange: {
+      basis: (x, n, brp = false, weights) => {
+        const bits = log2(n);
+        const cache = weights || (brp ? roots.brp(bits) : roots.roots(bits));
+        const out = _create(n);
+        const idx = findOmegaIndex(x, n, brp);
+        if (idx !== -1) {
+          out[idx] = F.ONE;
+          return out;
+        }
+        const tm = F.pow(x, BigInt(n));
+        const c = F.mul(F.sub(tm, F.ONE), F.inv(BigInt(n)));
+        const denom = _create(n);
+        for (let i = 0; i < n; i++)
+          denom[i] = F.sub(x, cache[i]);
+        const inv = F.invertBatch(denom);
+        for (let i = 0; i < n; i++)
+          out[i] = F.mul(c, F.mul(cache[i], inv[i]));
+        return out;
+      },
+      eval(a, x, brp = false) {
+        checkLength(a);
+        const idx = findOmegaIndex(x, a.length, brp);
+        if (idx !== -1)
+          return a[idx];
+        const L = this.basis(x, a.length, brp);
+        let acc = F.ZERO;
+        for (let i = 0; i < a.length; i++)
+          if (!F.is0(a[i]))
+            acc = F.add(acc, F.mul(a[i], L[i]));
+        return acc;
+      }
+    },
+    vanishing(roots2) {
+      checkLength(roots2);
+      const out = _create(roots2.length + 1, F.ZERO);
+      out[0] = F.ONE;
+      for (const r of roots2) {
+        const neg = F.neg(r);
+        for (let j = out.length - 1; j > 0; j--)
+          out[j] = F.add(F.mul(out[j], neg), out[j - 1]);
+        out[0] = F.mul(out[0], neg);
+      }
+      return out;
+    }
+  };
+}
+
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/hash-to-curve.js
 var os2ip = bytesToNumberBE;
 function i2osp(value, length) {
   asafenumber(value);
   asafenumber(length);
-  if (value < 0 || value >= 1 << 8 * length)
+  if (length < 0 || length > 4)
+    throw new Error("invalid I2OSP length: " + length);
+  if (value < 0 || value > 2 ** (8 * length) - 1)
     throw new Error("invalid I2OSP input: " + value);
   const res = Array.from({ length }).fill(0);
   for (let i = length - 1; i >= 0; i--) {
@@ -1769,35 +2269,38 @@ function strxor(a, b) {
   return arr;
 }
 function normDST(DST) {
-  if (!isBytes(DST) && typeof DST !== "string")
+  if (!isBytes2(DST) && typeof DST !== "string")
     throw new Error("DST must be Uint8Array or ascii string");
-  return typeof DST === "string" ? asciiToBytes(DST) : DST;
+  const dst = typeof DST === "string" ? asciiToBytes(DST) : DST;
+  if (dst.length === 0)
+    throw new Error("DST must be non-empty");
+  return dst;
 }
 function expand_message_xmd(msg, DST, lenInBytes, H) {
-  abytes(msg);
+  abytes2(msg);
   asafenumber(lenInBytes);
   DST = normDST(DST);
   if (DST.length > 255)
-    DST = H(concatBytes(asciiToBytes("H2C-OVERSIZE-DST-"), DST));
+    DST = H(concatBytes2(asciiToBytes("H2C-OVERSIZE-DST-"), DST));
   const { outputLen: b_in_bytes, blockLen: r_in_bytes } = H;
   const ell = Math.ceil(lenInBytes / b_in_bytes);
   if (lenInBytes > 65535 || ell > 255)
     throw new Error("expand_message_xmd: invalid lenInBytes");
-  const DST_prime = concatBytes(DST, i2osp(DST.length, 1));
-  const Z_pad = i2osp(0, r_in_bytes);
+  const DST_prime = concatBytes2(DST, i2osp(DST.length, 1));
+  const Z_pad = new Uint8Array(r_in_bytes);
   const l_i_b_str = i2osp(lenInBytes, 2);
   const b = new Array(ell);
-  const b_0 = H(concatBytes(Z_pad, msg, l_i_b_str, i2osp(0, 1), DST_prime));
-  b[0] = H(concatBytes(b_0, i2osp(1, 1), DST_prime));
-  for (let i = 1; i <= ell; i++) {
+  const b_0 = H(concatBytes2(Z_pad, msg, l_i_b_str, i2osp(0, 1), DST_prime));
+  b[0] = H(concatBytes2(b_0, i2osp(1, 1), DST_prime));
+  for (let i = 1; i < ell; i++) {
     const args = [strxor(b_0, b[i - 1]), i2osp(i + 1, 1), DST_prime];
-    b[i] = H(concatBytes(...args));
+    b[i] = H(concatBytes2(...args));
   }
-  const pseudo_random_bytes = concatBytes(...b);
+  const pseudo_random_bytes = concatBytes2(...b);
   return pseudo_random_bytes.slice(0, lenInBytes);
 }
 function expand_message_xof(msg, DST, lenInBytes, k, H) {
-  abytes(msg);
+  abytes2(msg);
   asafenumber(lenInBytes);
   DST = normDST(DST);
   if (DST.length > 255) {
@@ -1817,8 +2320,12 @@ function hash_to_field(msg, count, options) {
   });
   const { p, k, m, hash, expand, DST } = options;
   asafenumber(hash.outputLen, "valid hash");
-  abytes(msg);
+  abytes2(msg);
   asafenumber(count);
+  if (count < 1)
+    throw new Error("hash_to_field: expected count >= 1");
+  if (m < 1)
+    throw new Error("hash_to_field: expected m >= 1");
   const log2p = p.toString(2).length;
   const L = Math.ceil((log2p + k) / 8);
   const len_in_bytes = count * m * L;
@@ -1844,10 +2351,16 @@ function hash_to_field(msg, count, options) {
   }
   return u;
 }
-var _DST_scalar = asciiToBytes("HashToScalar-");
+var _DST_scalar = "HashToScalar-";
 function createHasher2(Point, mapToCurve, defaults) {
   if (typeof mapToCurve !== "function")
     throw new Error("mapToCurve() must be defined");
+  const snapshot = (src) => Object.freeze({
+    ...src,
+    DST: isBytes2(src.DST) ? copyBytes(src.DST) : src.DST,
+    ...src.encodeDST === void 0 ? {} : { encodeDST: isBytes2(src.encodeDST) ? copyBytes(src.encodeDST) : src.encodeDST }
+  });
+  const safeDefaults = snapshot(defaults);
   function map(num) {
     return Point.fromAffine(mapToCurve(num));
   }
@@ -1858,26 +2371,28 @@ function createHasher2(Point, mapToCurve, defaults) {
     P.assertValidity();
     return P;
   }
-  return {
-    defaults: Object.freeze(defaults),
+  return Object.freeze({
+    get defaults() {
+      return snapshot(safeDefaults);
+    },
     Point,
     hashToCurve(msg, options) {
-      const opts = Object.assign({}, defaults, options);
+      const opts = Object.assign({}, safeDefaults, options);
       const u = hash_to_field(msg, 2, opts);
       const u0 = map(u[0]);
       const u1 = map(u[1]);
       return clear(u0.add(u1));
     },
     encodeToCurve(msg, options) {
-      const optsDst = defaults.encodeDST ? { DST: defaults.encodeDST } : {};
-      const opts = Object.assign({}, defaults, optsDst, options);
+      const optsDst = safeDefaults.encodeDST ? { DST: safeDefaults.encodeDST } : {};
+      const opts = Object.assign({}, safeDefaults, optsDst, options);
       const u = hash_to_field(msg, 1, opts);
       const u0 = map(u[0]);
       return clear(u0);
     },
     /** See {@link H2CHasher} */
     mapToCurve(scalars) {
-      if (defaults.m === 1) {
+      if (safeDefaults.m === 1) {
         if (typeof scalars !== "bigint")
           throw new Error("expected bigint (m=1)");
         return clear(map([scalars]));
@@ -1890,23 +2405,641 @@ function createHasher2(Point, mapToCurve, defaults) {
       return clear(map(scalars));
     },
     // hash_to_scalar can produce 0: https://www.rfc-editor.org/errata/eid8393
-    // RFC 9380, draft-irtf-cfrg-bbs-signatures-08
+    // RFC 9380, draft-irtf-cfrg-bbs-signatures-08. Default scalar DST is the shared generic
+    // `HashToScalar-` prefix above unless the caller overrides it per invocation.
     hashToScalar(msg, options) {
       const N = Point.Fn.ORDER;
-      const opts = Object.assign({}, defaults, { p: N, m: 1, DST: _DST_scalar }, options);
+      const opts = Object.assign({}, safeDefaults, { p: N, m: 1, DST: _DST_scalar }, options);
       return hash_to_field(msg, 1, opts)[0][0];
     }
+  });
+}
+
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/frost.js
+var validateSigners = (signers) => {
+  if (!Number.isSafeInteger(signers.min) || !Number.isSafeInteger(signers.max))
+    throw new Error("Wrong signers info: min=" + signers.min + " max=" + signers.max);
+  if (signers.min < 2 || signers.max < 2 || signers.min > signers.max)
+    throw new Error("Wrong signers info: min=" + signers.min + " max=" + signers.max);
+};
+var validateCommitmentsNum = (signers, len) => {
+  if (len < signers.min || len > signers.max)
+    throw new Error("Wrong number of commitments=" + len);
+};
+var AggErr = class extends Error {
+  // Empty means aggregation failed before per-share verification could attribute a signer.
+  cheaters;
+  constructor(msg, cheaters) {
+    super(msg);
+    this.cheaters = cheaters;
+  }
+};
+function createFROST(opts) {
+  validateObject(opts, {
+    name: "string",
+    hash: "function"
+  }, {
+    hashToScalar: "function",
+    validatePoint: "function",
+    parsePublicKey: "function",
+    adjustScalar: "function",
+    adjustPoint: "function",
+    challenge: "function",
+    adjustNonces: "function",
+    adjustSecret: "function",
+    adjustPublic: "function",
+    adjustGroupCommitmentShare: "function",
+    adjustDKG: "function"
+  });
+  validatePointCons(opts.Point);
+  const { Point } = opts;
+  const Fn2 = opts.Fn === void 0 ? Point.Fn : opts.Fn;
+  const hashBytes = opts.hash;
+  const hashToScalar = opts.hashToScalar === void 0 ? (msg, opts2 = { DST: new Uint8Array() }) => {
+    const t = hashBytes(concatBytes2(opts2.DST, msg));
+    return Fn2.create(Fn2.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t));
+  } : opts.hashToScalar;
+  const H1Prefix = utf8ToBytes(opts.H1 !== void 0 ? opts.H1 : opts.name + "rho");
+  const H2Prefix = utf8ToBytes(opts.H2 !== void 0 ? opts.H2 : opts.name + "chal");
+  const H3Prefix = utf8ToBytes(opts.H3 !== void 0 ? opts.H3 : opts.name + "nonce");
+  const H4Prefix = utf8ToBytes(opts.H4 !== void 0 ? opts.H4 : opts.name + "msg");
+  const H5Prefix = utf8ToBytes(opts.H5 !== void 0 ? opts.H5 : opts.name + "com");
+  const HDKGPrefix = utf8ToBytes(opts.HDKG !== void 0 ? opts.HDKG : opts.name + "dkg");
+  const HIDPrefix = utf8ToBytes(opts.HID !== void 0 ? opts.HID : opts.name + "id");
+  const H1 = (msg) => hashToScalar(msg, { DST: H1Prefix });
+  const H2 = (msg) => hashToScalar(msg, { DST: H2Prefix });
+  const H3 = (msg) => hashToScalar(msg, { DST: H3Prefix });
+  const H4 = (msg) => hashBytes(concatBytes2(H4Prefix, msg));
+  const H5 = (msg) => hashBytes(concatBytes2(H5Prefix, msg));
+  const HDKG = (msg) => hashToScalar(msg, { DST: HDKGPrefix });
+  const HID = (msg) => hashToScalar(msg, { DST: HIDPrefix });
+  const randomScalar = (rng = randomBytes2) => {
+    const t = mapHashToField(rng(getMinHashLength(Fn2.ORDER)), Fn2.ORDER, Fn2.isLE);
+    return Fn2.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t);
+  };
+  const serializePoint = (p) => p.toBytes();
+  const parsePoint = (bytes) => {
+    const p = Point.fromBytes(bytes);
+    if (opts.validatePoint)
+      opts.validatePoint(p);
+    return p;
+  };
+  const nonceCommitments = (identifier, nonces) => ({
+    identifier,
+    hiding: serializePoint(Point.BASE.multiply(Fn2.fromBytes(nonces.hiding))),
+    binding: serializePoint(Point.BASE.multiply(Fn2.fromBytes(nonces.binding)))
+  });
+  const adjustPoint = opts.adjustPoint === void 0 ? (n) => n : opts.adjustPoint;
+  const validateIdentifier = (n) => {
+    if (!Fn2.isValid(n) || Fn2.is0(n))
+      throw new Error("Invalid identifier " + n);
+    return n;
+  };
+  const serializeIdentifier = (id) => bytesToHex2(Fn2.toBytes(validateIdentifier(id)));
+  const parseIdentifier = (id) => {
+    const n = validateIdentifier(Fn2.fromBytes(hexToBytes2(id)));
+    if (serializeIdentifier(n) !== id)
+      throw new Error("expected canonical identifier hex");
+    return n;
+  };
+  const Signature = {
+    // RFC 9591 Appendix A encodes signatures canonically as
+    // SerializeElement(R) || SerializeScalar(z).
+    encode: (R, z) => {
+      let res = concatBytes2(serializePoint(R), Fn2.toBytes(z));
+      if (opts.adjustTx)
+        res = opts.adjustTx.encode(res);
+      return res;
+    },
+    decode: (sig) => {
+      if (opts.adjustTx)
+        sig = opts.adjustTx.decode(sig);
+      const R = parsePoint(sig.subarray(0, -Fn2.BYTES));
+      const z = Fn2.fromBytes(sig.subarray(-Fn2.BYTES));
+      return { R, z };
+    }
+  };
+  const genPointScalarPair = (rng = randomBytes2) => {
+    let n = randomScalar(rng);
+    if (opts.adjustScalar)
+      n = opts.adjustScalar(n);
+    let p = Point.BASE.multiply(n);
+    return { scalar: n, point: p };
+  };
+  const nrErr = "roots are unavailable in FROST polynomial mode";
+  const noRoots = {
+    info: { G: Fn2.ZERO, oddFactor: Fn2.ZERO, powerOfTwo: 0 },
+    roots() {
+      throw new Error(nrErr);
+    },
+    brp() {
+      throw new Error(nrErr);
+    },
+    inverse() {
+      throw new Error(nrErr);
+    },
+    omega() {
+      throw new Error(nrErr);
+    },
+    clear() {
+    }
+  };
+  const Poly = poly(Fn2, noRoots);
+  const msm = (points, scalars) => pippenger(Point, points, scalars);
+  const polynomialEvaluate = (x, coeffs) => {
+    if (!coeffs.length)
+      throw new Error("empty coefficients");
+    return Poly.monomial.eval(coeffs, x);
+  };
+  const deriveInterpolatingValue = (L, xi) => {
+    const err = "invalid parameters";
+    if (!L.some((x) => Fn2.eql(x, xi)))
+      throw new Error(err);
+    const Lset = new Set(L);
+    if (Lset.size !== L.length)
+      throw new Error(err);
+    if (!Lset.has(xi))
+      throw new Error(err);
+    let num = Fn2.ONE;
+    let den = Fn2.ONE;
+    for (const x of L) {
+      if (Fn2.eql(x, xi))
+        continue;
+      num = Fn2.mul(num, x);
+      den = Fn2.mul(den, Fn2.sub(x, xi));
+    }
+    return Fn2.div(num, den);
+  };
+  const evalutateVSS = (identifier, commitment) => {
+    const monomial = Poly.monomial.basis(identifier, commitment.length);
+    return msm(commitment, monomial);
+  };
+  const generateSecretPolynomial = (signers, secret, coeffs, rng = randomBytes2) => {
+    validateSigners(signers);
+    const secretScalar = secret === void 0 ? randomScalar(rng) : Fn2.fromBytes(secret);
+    if (!coeffs) {
+      coeffs = [];
+      for (let i = 0; i < signers.min - 1; i++)
+        coeffs.push(randomScalar(rng));
+    }
+    if (coeffs.length !== signers.min - 1)
+      throw new Error("wrong coefficients length");
+    const coefficients = [secretScalar, ...coeffs];
+    const commitment = coefficients.map((i) => Point.BASE.multiply(i));
+    return { coefficients, commitment, secret: secretScalar };
+  };
+  const ProofOfKnowledge = {
+    challenge: (id, verKey, R) => HDKG(concatBytes2(Fn2.toBytes(id), serializePoint(verKey), serializePoint(R))),
+    compute(id, coefficents, commitments, rng = randomBytes2) {
+      if (coefficents.length < 1)
+        throw new Error("coefficients should have at least one element");
+      const { point: R, scalar: k } = genPointScalarPair(rng);
+      const verKey = commitments[0];
+      const c = this.challenge(id, verKey, R);
+      const mu = Fn2.add(k, Fn2.mul(coefficents[0], c));
+      return Signature.encode(R, mu);
+    },
+    validate(id, commitment, proof) {
+      if (commitment.length < 1)
+        throw new Error("commitment should have at least one element");
+      const { R, z } = Signature.decode(proof);
+      const phi = parsePoint(commitment[0]);
+      const c = this.challenge(id, phi, R);
+      if (!R.equals(Point.BASE.multiply(z).subtract(phi.multiply(c))))
+        throw new Error("invalid proof of knowledge");
+    }
+  };
+  const Basic = {
+    challenge: (R, PK, msg) => {
+      if (opts.challenge)
+        return opts.challenge(R, PK, msg);
+      return H2(concatBytes2(serializePoint(R), serializePoint(PK), msg));
+    },
+    sign(msg, sk, rng = randomBytes2) {
+      const { point: R, scalar: r } = genPointScalarPair(rng);
+      const PK = Point.BASE.multiply(sk);
+      const c = this.challenge(R, PK, msg);
+      const z = Fn2.add(r, Fn2.mul(c, sk));
+      return [R, z];
+    },
+    verify(msg, R, z, PK) {
+      if (opts.adjustPoint)
+        PK = opts.adjustPoint(PK);
+      if (opts.adjustPoint)
+        R = opts.adjustPoint(R);
+      const c = this.challenge(R, PK, msg);
+      const zB = Point.BASE.multiply(z);
+      const cA = PK.multiply(c);
+      let check = zB.subtract(cA).subtract(R);
+      if (check.clearCofactor)
+        check = check.clearCofactor();
+      return Point.ZERO.equals(check);
+    }
+  };
+  const validateSecretShare = (identifier, commitment, signingShare) => {
+    if (!Point.BASE.multiply(signingShare).equals(evalutateVSS(identifier, commitment)))
+      throw new Error("invalid secret share");
+  };
+  const Identifier = {
+    fromNumber(n) {
+      if (!Number.isSafeInteger(n))
+        throw new Error("expected safe interger");
+      return serializeIdentifier(BigInt(n));
+    },
+    // Not in spec, but in FROST implementation,
+    // seems useful and nice, no need to sync identifiers (would require more interactions)
+    derive(s) {
+      if (typeof s !== "string")
+        throw new Error("wrong identifier string: " + s);
+      return serializeIdentifier(HID(utf8ToBytes(s)));
+    }
+  };
+  const generateNonce = (secret, rng = randomBytes2) => H3(concatBytes2(rng(32), Fn2.toBytes(secret)));
+  const getGroupCommitment = (GPK, commitmentList, msg) => {
+    const CL = commitmentList.map((i) => [
+      i.identifier,
+      parseIdentifier(i.identifier),
+      parsePoint(i.hiding),
+      parsePoint(i.binding)
+    ]);
+    CL.sort((a, b) => a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0);
+    const Cbytes = [];
+    for (const [_, id, hC, bC] of CL)
+      Cbytes.push(Fn2.toBytes(id), serializePoint(hC), serializePoint(bC));
+    const encodedCommitmentHash = H5(concatBytes2(...Cbytes));
+    const rhoPrefix = concatBytes2(serializePoint(GPK), H4(msg), encodedCommitmentHash);
+    const bindingFactors = {};
+    for (const [i, id] of CL) {
+      bindingFactors[i] = H1(concatBytes2(rhoPrefix, Fn2.toBytes(id)));
+    }
+    const points = [];
+    const scalars = [];
+    for (const [i, _, hC, bC] of CL) {
+      if (Point.ZERO.equals(hC) || Point.ZERO.equals(bC))
+        throw new Error("infinity commitment");
+      points.push(hC, bC);
+      scalars.push(Fn2.ONE, bindingFactors[i]);
+    }
+    const groupCommitment = msm(points, scalars);
+    const identifiers = CL.map((i) => i[1]);
+    return { identifiers, groupCommitment, bindingFactors };
+  };
+  const prepareShare = (PK, commitmentList, msg, identifier) => {
+    const GPK = adjustPoint(parsePoint(PK));
+    const id = parseIdentifier(identifier);
+    const { identifiers, groupCommitment, bindingFactors } = getGroupCommitment(GPK, commitmentList, msg);
+    const bindingFactor = bindingFactors[identifier];
+    const lambda = deriveInterpolatingValue(identifiers, id);
+    const challenge = Basic.challenge(groupCommitment, GPK, msg);
+    return { lambda, challenge, bindingFactor, groupCommitment };
   };
+  Object.freeze(Identifier);
+  const frost = {
+    Identifier,
+    // DKG is Distributed Key Generation, not Trusted Dealer Key Generation.
+    DKG: Object.freeze({
+      // NOTE: we allow to pass secret scalar from user side,
+      // this way it can be derived, instead of random generation
+      round1: (id, signers, secret, rng = randomBytes2) => {
+        validateSigners(signers);
+        const idNum = parseIdentifier(id);
+        const { coefficients, commitment } = generateSecretPolynomial(signers, secret, void 0, rng);
+        const proofOfKnowledge = ProofOfKnowledge.compute(idNum, coefficients, commitment, rng);
+        const commitmentBytes = commitment.map(serializePoint);
+        const round1Public = {
+          identifier: serializeIdentifier(idNum),
+          commitment: commitmentBytes,
+          proofOfKnowledge
+        };
+        const round1Secret = {
+          identifier: idNum,
+          coefficients,
+          commitment: commitment.map(serializePoint),
+          // Copy threshold metadata instead of retaining the caller-owned object by reference.
+          signers: { min: signers.min, max: signers.max },
+          step: 1
+        };
+        return { public: round1Public, secret: round1Secret };
+      },
+      round2: (secret, others) => {
+        if (others.length !== secret.signers.max - 1)
+          throw new Error("wrong number of round1 packages");
+        if (!secret.coefficients || secret.step === 3)
+          throw new Error("round3 package used in round2");
+        const res = {};
+        for (const p of others) {
+          if (p.commitment.length !== secret.signers.min)
+            throw new Error("wrong number of commitments");
+          const id = parseIdentifier(p.identifier);
+          if (id === secret.identifier)
+            throw new Error("duplicate id=" + serializeIdentifier(id));
+          ProofOfKnowledge.validate(id, p.commitment, p.proofOfKnowledge);
+          for (const c of p.commitment)
+            parsePoint(c);
+          if (res[p.identifier])
+            throw new Error("Duplicate id=" + id);
+          const signingShare = Fn2.toBytes(polynomialEvaluate(id, secret.coefficients));
+          res[p.identifier] = {
+            identifier: serializeIdentifier(secret.identifier),
+            signingShare
+          };
+        }
+        secret.step = 2;
+        return res;
+      },
+      round3: (secret, round1, round2) => {
+        if (round1.length !== secret.signers.max - 1)
+          throw new Error("wrong length of round1 packages");
+        if (!secret.coefficients || secret.step !== 2)
+          throw new Error("round2 package used in round3");
+        if (round2.length !== round1.length)
+          throw new Error("wrong length of round2 packages");
+        const merged = {};
+        for (const r1 of round1) {
+          if (!r1.identifier || !r1.commitment)
+            throw new Error("wrong round1 share");
+          merged[r1.identifier] = { ...r1 };
+        }
+        for (const r2 of round2) {
+          if (!r2.identifier || !r2.signingShare)
+            throw new Error("wrong round2 share");
+          if (!merged[r2.identifier])
+            throw new Error("round1 share for " + r2.identifier + " is missing");
+          merged[r2.identifier].signingShare = r2.signingShare;
+        }
+        if (Object.keys(merged).length !== round1.length)
+          throw new Error("mismatch identifiers between rounds");
+        let signingShare = Fn2.ZERO;
+        if (secret.commitment.length !== secret.signers.min)
+          throw new Error("wrong commitments length");
+        const localCommitment = secret.commitment.map(parsePoint);
+        const localShare = polynomialEvaluate(secret.identifier, secret.coefficients);
+        validateSecretShare(secret.identifier, localCommitment, localShare);
+        const localCommitmentBytes = localCommitment.map(serializePoint);
+        const commitments = {
+          [serializeIdentifier(secret.identifier)]: localCommitmentBytes
+        };
+        for (const k in merged) {
+          const v = merged[k];
+          if (!v.signingShare || !v.commitment)
+            throw new Error("mismatch identifiers");
+          const id = parseIdentifier(k);
+          const signingSharePart = Fn2.fromBytes(v.signingShare);
+          const commitment = v.commitment.map(parsePoint);
+          validateSecretShare(secret.identifier, commitment, signingSharePart);
+          signingShare = Fn2.add(signingShare, signingSharePart);
+          const idSer = serializeIdentifier(id);
+          if (commitments[idSer])
+            throw new Error("duplicated id=" + idSer);
+          commitments[idSer] = v.commitment;
+        }
+        signingShare = Fn2.add(signingShare, localShare);
+        const mergedCommitment = new Array(secret.signers.min).fill(Point.ZERO);
+        for (const k in commitments) {
+          const v = commitments[k];
+          if (v.length !== secret.signers.min)
+            throw new Error("wrong commitments length");
+          for (let i = 0; i < v.length; i++)
+            mergedCommitment[i] = mergedCommitment[i].add(parsePoint(v[i]));
+        }
+        const mergedCommitmentBytes = mergedCommitment.map(serializePoint);
+        const verifyingShares = {};
+        for (const k in commitments)
+          verifyingShares[k] = serializePoint(evalutateVSS(parseIdentifier(k), mergedCommitment));
+        let res = {
+          public: {
+            signers: { min: secret.signers.min, max: secret.signers.max },
+            commitments: mergedCommitmentBytes,
+            verifyingShares: Object.fromEntries(Object.entries(verifyingShares).map(([k, v]) => [k, v.slice()]))
+          },
+          secret: {
+            identifier: serializeIdentifier(secret.identifier),
+            signingShare: Fn2.toBytes(signingShare)
+          }
+        };
+        if (opts.adjustDKG)
+          res = opts.adjustDKG(res);
+        for (let i = 0; i < secret.coefficients.length; i++)
+          secret.coefficients[i] -= secret.coefficients[i];
+        delete secret.coefficients;
+        secret.step = 3;
+        return res;
+      },
+      clean(secret) {
+        secret.identifier -= secret.identifier;
+        if (secret.coefficients) {
+          for (let i = 0; i < secret.coefficients.length; i++)
+            secret.coefficients[i] -= secret.coefficients[i];
+        }
+        secret.step = 3;
+      }
+    }),
+    // Trusted dealer setup
+    // Generates keys for all participants
+    trustedDealer(signers, identifiers, secret, rng = randomBytes2) {
+      validateSigners(signers);
+      if (identifiers === void 0) {
+        identifiers = [];
+        for (let i = 1; i <= signers.max; i++)
+          identifiers.push(Identifier.fromNumber(i));
+      } else {
+        if (!Array.isArray(identifiers) || identifiers.length !== signers.max)
+          throw new Error("identifiers should be array of " + signers.max);
+      }
+      const identifierNums = {};
+      for (const id of identifiers) {
+        const idNum = parseIdentifier(id);
+        if (id in identifierNums)
+          throw new Error("duplicated id=" + id);
+        identifierNums[id] = idNum;
+      }
+      const sp = generateSecretPolynomial(signers, secret, void 0, rng);
+      const commitmentBytes = sp.commitment.map(serializePoint);
+      const secretShares = {};
+      const verifyingShares = {};
+      for (const id of identifiers) {
+        const signingShare = polynomialEvaluate(identifierNums[id], sp.coefficients);
+        verifyingShares[id] = serializePoint(Point.BASE.multiply(signingShare));
+        secretShares[id] = {
+          identifier: id,
+          signingShare: Fn2.toBytes(signingShare)
+        };
+      }
+      return {
+        public: {
+          signers: { min: signers.min, max: signers.max },
+          commitments: commitmentBytes,
+          verifyingShares
+        },
+        secretShares
+      };
+    },
+    // Validate secret (from trusted dealer or DKG)
+    validateSecret(secret, pub) {
+      const id = parseIdentifier(secret.identifier);
+      const commitment = pub.commitments.map(parsePoint);
+      const signingShare = Fn2.fromBytes(secret.signingShare);
+      validateSecretShare(id, commitment, signingShare);
+    },
+    // Actual signing
+    // Round 1: each participant commit to nonces
+    // Nonces kept private, commitments sent to coordinator (or every other participant)
+    // NOTE: we don't need the message at this point, which lets a coordinator
+    // keep multiple nonce commitments per participant in advance and skip
+    // round1 for signing.
+    // But then each participant needs to remember generated shares
+    commit(secret, rng = randomBytes2) {
+      const secretScalar = Fn2.fromBytes(secret.signingShare);
+      const hiding = generateNonce(secretScalar, rng);
+      const binding = generateNonce(secretScalar, rng);
+      const nonces = { hiding: Fn2.toBytes(hiding), binding: Fn2.toBytes(binding) };
+      return { nonces, commitments: nonceCommitments(secret.identifier, nonces) };
+    },
+    // Round2: sign. Each participant creates a signature share from the secret
+    // and the selected nonce commitments.
+    signShare(secret, pub, nonces, commitmentList, msg) {
+      validateCommitmentsNum(pub.signers, commitmentList.length);
+      const hidingNonce0 = Fn2.fromBytes(nonces.hiding);
+      const bindingNonce0 = Fn2.fromBytes(nonces.binding);
+      if (Fn2.is0(hidingNonce0) || Fn2.is0(bindingNonce0))
+        throw new Error("signing nonces already used");
+      const expectedCommitment = {
+        identifier: secret.identifier,
+        hiding: serializePoint(Point.BASE.multiply(hidingNonce0)),
+        binding: serializePoint(Point.BASE.multiply(bindingNonce0))
+      };
+      const commitment = commitmentList.find((i) => i.identifier === secret.identifier);
+      if (!commitment)
+        throw new Error("missing signer commitment");
+      if (bytesToHex2(commitment.hiding) !== bytesToHex2(expectedCommitment.hiding) || bytesToHex2(commitment.binding) !== bytesToHex2(expectedCommitment.binding))
+        throw new Error("incorrect signer commitment");
+      if (opts.adjustSecret)
+        secret = opts.adjustSecret(secret, pub);
+      if (opts.adjustPublic)
+        pub = opts.adjustPublic(pub);
+      const SK = Fn2.fromBytes(secret.signingShare);
+      const { lambda, challenge, bindingFactor, groupCommitment } = prepareShare(pub.commitments[0], commitmentList, msg, secret.identifier);
+      const N = opts.adjustNonces ? opts.adjustNonces(groupCommitment, nonces) : nonces;
+      const hidingNonce = opts.adjustNonces ? Fn2.fromBytes(N.hiding) : hidingNonce0;
+      const bindingNonce = opts.adjustNonces ? Fn2.fromBytes(N.binding) : bindingNonce0;
+      const t = Fn2.mul(Fn2.mul(lambda, SK), challenge);
+      const t2 = Fn2.mul(bindingNonce, bindingFactor);
+      const r = Fn2.toBytes(Fn2.add(Fn2.add(hidingNonce, t2), t));
+      nonces.hiding.fill(0);
+      nonces.binding.fill(0);
+      return r;
+    },
+    // Each participant (or coordinator) can verify signatures from other participants
+    verifyShare(pub, commitmentList, msg, identifier, sigShare) {
+      if (opts.adjustPublic)
+        pub = opts.adjustPublic(pub);
+      const comm = commitmentList.find((i) => i.identifier === identifier);
+      if (!comm)
+        throw new Error("cannot find identifier commitment");
+      const PK = parsePoint(pub.verifyingShares[identifier]);
+      const hidingNonceCommitment = parsePoint(comm.hiding);
+      const bindingNonceCommitment = parsePoint(comm.binding);
+      const { lambda, challenge, bindingFactor, groupCommitment } = prepareShare(pub.commitments[0], commitmentList, msg, identifier);
+      let commShare = hidingNonceCommitment.add(bindingNonceCommitment.multiply(bindingFactor));
+      if (opts.adjustGroupCommitmentShare)
+        commShare = opts.adjustGroupCommitmentShare(groupCommitment, commShare);
+      const l = Point.BASE.multiply(Fn2.fromBytes(sigShare));
+      const r = commShare.add(PK.multiply(Fn2.mul(challenge, lambda)));
+      return l.equals(r);
+    },
+    // Aggregate multiple signature shares into groupSignature
+    aggregate(pub, commitmentList, msg, sigShares) {
+      if (opts.adjustPublic)
+        pub = opts.adjustPublic(pub);
+      try {
+        validateCommitmentsNum(pub.signers, commitmentList.length);
+      } catch {
+        throw new AggErr("aggregation failed", []);
+      }
+      const ids = commitmentList.map((i) => i.identifier);
+      if (ids.length !== Object.keys(sigShares).length)
+        throw new AggErr("aggregation failed", []);
+      for (const id of ids) {
+        if (!(id in sigShares) || !(id in pub.verifyingShares))
+          throw new AggErr("aggregation failed", []);
+      }
+      const GPK = parsePoint(pub.commitments[0]);
+      const { groupCommitment } = getGroupCommitment(GPK, commitmentList, msg);
+      let z = Fn2.ZERO;
+      for (const id of ids)
+        z = Fn2.add(z, Fn2.fromBytes(sigShares[id]));
+      if (!Basic.verify(msg, groupCommitment, z, GPK)) {
+        const cheaters = [];
+        for (const id of ids) {
+          if (!this.verifyShare(pub, commitmentList, msg, id, sigShares[id]))
+            cheaters.push(id);
+        }
+        throw new AggErr("aggregation failed", cheaters);
+      }
+      return Signature.encode(groupCommitment, z);
+    },
+    // Basic sign/verify using single key
+    sign(msg, secretKey) {
+      let sk = Fn2.fromBytes(secretKey);
+      if (opts.adjustScalar)
+        sk = opts.adjustScalar(sk);
+      const [R, z] = Basic.sign(msg, sk);
+      return Signature.encode(R, z);
+    },
+    verify(sig, msg, publicKey) {
+      const PK = opts.parsePublicKey ? opts.parsePublicKey(publicKey) : parsePoint(publicKey);
+      const { R, z } = Signature.decode(sig);
+      return Basic.verify(msg, R, z, PK);
+    },
+    // Combine multiple secret shares to restore secret
+    combineSecret(shares, signers) {
+      validateSigners(signers);
+      if (!Array.isArray(shares) || shares.length < signers.min)
+        throw new Error("wrong secret shares array");
+      const points = [];
+      const seen = {};
+      for (const s of shares) {
+        const idNum = parseIdentifier(s.identifier);
+        const id = serializeIdentifier(idNum);
+        if (seen[id])
+          throw new Error("duplicated id=" + id);
+        seen[id] = true;
+        points.push([idNum, Fn2.fromBytes(s.signingShare)]);
+      }
+      const xCoords = points.map(([x]) => x);
+      let res = Fn2.ZERO;
+      for (const [x, y] of points)
+        res = Fn2.add(res, Fn2.mul(y, deriveInterpolatingValue(xCoords, x)));
+      return Fn2.toBytes(res);
+    },
+    // Utils
+    utils: Object.freeze({
+      Fn: Fn2,
+      // NOTE: we re-export it here because it may be different from Point.Fn (ed448 is fun!)
+      // Test RNG overrides still go through noble's non-zero scalar derivation; this is not a raw
+      // "bytes become scalar" escape hatch.
+      randomScalar: (rng = randomBytes2) => Fn2.toBytes(genPointScalarPair(rng).scalar),
+      generateSecretPolynomial: (signers, secret, coeffs, rng) => {
+        const res = generateSecretPolynomial(signers, secret, coeffs, rng);
+        return { ...res, commitment: res.commitment.map(serializePoint) };
+      }
+    })
+  };
+  return Object.freeze(frost);
 }
 
-// ../../node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/abstract/montgomery.js
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/montgomery.js
 var _0n5 = BigInt(0);
 var _1n5 = BigInt(1);
 var _2n3 = BigInt(2);
 function validateOpts(curve) {
   validateObject(curve, {
+    P: "bigint",
+    type: "string",
     adjustScalarBytes: "function",
     powPminus2: "function"
+  }, {
+    randomBytes: "function"
   });
   return Object.freeze({ ...curve });
 }
@@ -1916,7 +3049,7 @@ function montgomery(curveDef) {
   const is25519 = type === "x25519";
   if (!is25519 && type !== "x448")
     throw new Error("invalid type");
-  const randomBytes_ = rand || randomBytes;
+  const randomBytes_ = rand === void 0 ? randomBytes2 : rand;
   const montgomeryBits = is25519 ? 255 : 448;
   const fieldLen = is25519 ? 32 : 56;
   const Gu = is25519 ? BigInt(9) : BigInt(5);
@@ -1930,13 +3063,13 @@ function montgomery(curveDef) {
     return numberToBytesLE(modP(u), fieldLen);
   }
   function decodeU(u) {
-    const _u = copyBytes(abytes(u, fieldLen, "uCoordinate"));
+    const _u = copyBytes(abytes2(u, fieldLen, "uCoordinate"));
     if (is25519)
       _u[31] &= 127;
     return modP(bytesToNumberLE(_u));
   }
   function decodeScalar(scalar) {
-    return bytesToNumberLE(adjustScalarBytes2(copyBytes(abytes(scalar, fieldLen, "scalar"))));
+    return bytesToNumberLE(adjustScalarBytes2(copyBytes(abytes2(scalar, fieldLen, "scalar"))));
   }
   function scalarMult(scalar, u) {
     const pu = montgomeryLadder(decodeU(u), decodeScalar(scalar));
@@ -1997,11 +3130,14 @@ function montgomery(curveDef) {
     publicKey: fieldLen,
     seed: fieldLen
   };
-  const randomSecretKey = (seed = randomBytes_(fieldLen)) => {
-    abytes(seed, lengths.seed, "seed");
+  const randomSecretKey = (seed) => {
+    seed = seed === void 0 ? randomBytes_(fieldLen) : seed;
+    abytes2(seed, lengths.seed, "seed");
     return seed;
   };
   const utils = { randomSecretKey };
+  Object.freeze(lengths);
+  Object.freeze(utils);
   return Object.freeze({
     keygen: createKeygen(randomSecretKey, getPublicKey),
     getSharedSecret,
@@ -2014,55 +3150,63 @@ function montgomery(curveDef) {
   });
 }
 
-// ../../node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/abstract/oprf.js
-function createORPF(opts) {
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/oprf.js
+var _DST_scalarBytes = /* @__PURE__ */ asciiToBytes(_DST_scalar);
+function createOPRF(opts) {
   validateObject(opts, {
     name: "string",
     hash: "function",
     hashToScalar: "function",
     hashToGroup: "function"
   });
+  validatePointCons(opts.Point);
   const { name, Point, hash } = opts;
   const { Fn: Fn2 } = Point;
   const hashToGroup = (msg, ctx) => opts.hashToGroup(msg, {
-    DST: concatBytes(asciiToBytes("HashToGroup-"), ctx)
+    DST: concatBytes2(asciiToBytes("HashToGroup-"), ctx)
   });
-  const hashToScalarPrefixed = (msg, ctx) => opts.hashToScalar(msg, { DST: concatBytes(_DST_scalar, ctx) });
-  const randomScalar = (rng = randomBytes) => {
+  const hashToScalarPrefixed = (msg, ctx) => opts.hashToScalar(msg, { DST: concatBytes2(_DST_scalarBytes, ctx) });
+  const randomScalar = (rng = randomBytes2) => {
     const t = mapHashToField(rng(getMinHashLength(Fn2.ORDER)), Fn2.ORDER, Fn2.isLE);
     return Fn2.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t);
   };
   const msm = (points, scalars) => pippenger(Point, points, scalars);
-  const getCtx = (mode) => concatBytes(asciiToBytes("OPRFV1-"), new Uint8Array([mode]), asciiToBytes("-" + name));
+  const getCtx = (mode) => concatBytes2(asciiToBytes("OPRFV1-"), new Uint8Array([mode]), asciiToBytes("-" + name));
   const ctxOPRF = getCtx(0);
   const ctxVOPRF = getCtx(1);
   const ctxPOPRF = getCtx(2);
   function encode(...args) {
-    const res = [];
+    const res2 = [];
     for (const a of args) {
       if (typeof a === "number")
-        res.push(numberToBytesBE(a, 2));
+        res2.push(numberToBytesBE(a, 2));
       else if (typeof a === "string")
-        res.push(asciiToBytes(a));
+        res2.push(asciiToBytes(a));
       else {
-        abytes(a);
-        res.push(numberToBytesBE(a.length, 2), a);
+        abytes2(a);
+        res2.push(numberToBytesBE(a.length, 2), a);
       }
     }
-    return concatBytes(...res);
+    return concatBytes2(...res2);
   }
+  const inputBytes = (title, bytes) => {
+    abytes2(bytes, void 0, title);
+    if (bytes.length > 65535)
+      throw new Error(`"${title}" expected Uint8Array of length <= 65535, got length=${bytes.length}`);
+    return bytes;
+  };
   const hashInput = (...bytes) => hash(encode(...bytes, "Finalize"));
   function getTranscripts(B, C, D, ctx) {
     const Bm = B.toBytes();
-    const seed = hash(encode(Bm, concatBytes(asciiToBytes("Seed-"), ctx)));
-    const res = [];
+    const seed = hash(encode(Bm, concatBytes2(asciiToBytes("Seed-"), ctx)));
+    const res2 = [];
     for (let i = 0; i < C.length; i++) {
       const Ci = C[i].toBytes();
       const Di = D[i].toBytes();
       const di = hashToScalarPrefixed(encode(seed, i, Ci, Di, "Composite"), ctx);
-      res.push(di);
+      res2.push(di);
     }
-    return res;
+    return res2;
   }
   function computeComposites(B, C, D, ctx) {
     const T = getTranscripts(B, C, D, ctx);
@@ -2087,10 +3231,10 @@ function createORPF(opts) {
     const t3 = M.multiply(r);
     const c = challengeTranscript(B, M, Z, t2, t3, ctx);
     const s = Fn2.sub(r, Fn2.mul(c, k));
-    return concatBytes(...[c, s].map((i) => Fn2.toBytes(i)));
+    return concatBytes2(...[c, s].map((i) => Fn2.toBytes(i)));
   }
   function verifyProof(ctx, B, C, D, proof) {
-    abytes(proof, 2 * Fn2.BYTES);
+    abytes2(proof, 2 * Fn2.BYTES);
     const { M, Z } = computeComposites(B, C, D, ctx);
     const [c, s] = [proof.subarray(0, Fn2.BYTES), proof.subarray(Fn2.BYTES)].map((f) => Fn2.fromBytes(f));
     const t2 = Point.BASE.multiply(s).add(B.multiply(c));
@@ -2105,18 +3249,30 @@ function createORPF(opts) {
     return { secretKey: Fn2.toBytes(skS), publicKey: pkS.toBytes() };
   }
   function deriveKeyPair(ctx, seed, info) {
-    const dst = concatBytes(asciiToBytes("DeriveKeyPair"), ctx);
-    const msg = concatBytes(seed, encode(info), Uint8Array.of(0));
+    abytes2(seed, 32, "seed");
+    info = inputBytes("keyInfo", info);
+    const dst = concatBytes2(asciiToBytes("DeriveKeyPair"), ctx);
+    const msg = concatBytes2(seed, encode(info), Uint8Array.of(0));
     for (let counter = 0; counter <= 255; counter++) {
       msg[msg.length - 1] = counter;
       const skS = opts.hashToScalar(msg, { DST: dst });
       if (Fn2.is0(skS))
         continue;
-      return { secretKey: Fn2.toBytes(skS), publicKey: Point.BASE.multiply(skS).toBytes() };
+      return {
+        secretKey: Fn2.toBytes(skS),
+        publicKey: Point.BASE.multiply(skS).toBytes()
+      };
     }
     throw new Error("Cannot derive key");
   }
-  function blind(ctx, input, rng = randomBytes) {
+  const wirePoint = (label, bytes) => {
+    const point = Point.fromBytes(bytes);
+    if (point.equals(Point.ZERO))
+      throw new Error(label + " point at infinity");
+    return point;
+  };
+  function blind(ctx, input, rng = randomBytes2) {
+    input = inputBytes("input", input);
     const blind2 = randomScalar(rng);
     const inputPoint = hashToGroup(input, ctx);
     if (inputPoint.equals(Point.ZERO))
@@ -2125,6 +3281,7 @@ function createORPF(opts) {
     return { blind: Fn2.toBytes(blind2), blinded: blinded.toBytes() };
   }
   function evaluate(ctx, secretKey, input) {
+    input = inputBytes("input", input);
     const skS = Fn2.fromBytes(secretKey);
     const inputPoint = hashToGroup(input, ctx);
     if (inputPoint.equals(Point.ZERO))
@@ -2132,47 +3289,48 @@ function createORPF(opts) {
     const unblinded = inputPoint.multiply(skS).toBytes();
     return hashInput(input, unblinded);
   }
-  const oprf = {
+  const oprf = Object.freeze({
     generateKeyPair,
     deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxOPRF, seed, keyInfo),
-    blind: (input, rng = randomBytes) => blind(ctxOPRF, input, rng),
+    blind: (input, rng = randomBytes2) => blind(ctxOPRF, input, rng),
     blindEvaluate(secretKey, blindedPoint) {
       const skS = Fn2.fromBytes(secretKey);
-      const elm = Point.fromBytes(blindedPoint);
+      const elm = wirePoint("blinded", blindedPoint);
       return elm.multiply(skS).toBytes();
     },
     finalize(input, blindBytes, evaluatedBytes) {
+      input = inputBytes("input", input);
       const blind2 = Fn2.fromBytes(blindBytes);
-      const evalPoint = Point.fromBytes(evaluatedBytes);
+      const evalPoint = wirePoint("evaluated", evaluatedBytes);
       const unblinded = evalPoint.multiply(Fn2.inv(blind2)).toBytes();
       return hashInput(input, unblinded);
     },
     evaluate: (secretKey, input) => evaluate(ctxOPRF, secretKey, input)
-  };
-  const voprf = {
+  });
+  const voprf = Object.freeze({
     generateKeyPair,
     deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxVOPRF, seed, keyInfo),
-    blind: (input, rng = randomBytes) => blind(ctxVOPRF, input, rng),
-    blindEvaluateBatch(secretKey, publicKey, blinded, rng = randomBytes) {
+    blind: (input, rng = randomBytes2) => blind(ctxVOPRF, input, rng),
+    blindEvaluateBatch(secretKey, publicKey, blinded, rng = randomBytes2) {
       if (!Array.isArray(blinded))
         throw new Error("expected array");
       const skS = Fn2.fromBytes(secretKey);
-      const pkS = Point.fromBytes(publicKey);
-      const blindedPoints = blinded.map(Point.fromBytes);
+      const pkS = wirePoint("public key", publicKey);
+      const blindedPoints = blinded.map((i) => wirePoint("blinded", i));
       const evaluated = blindedPoints.map((i) => i.multiply(skS));
       const proof = generateProof(ctxVOPRF, skS, pkS, blindedPoints, evaluated, rng);
       return { evaluated: evaluated.map((i) => i.toBytes()), proof };
     },
-    blindEvaluate(secretKey, publicKey, blinded, rng = randomBytes) {
-      const res = this.blindEvaluateBatch(secretKey, publicKey, [blinded], rng);
-      return { evaluated: res.evaluated[0], proof: res.proof };
+    blindEvaluate(secretKey, publicKey, blinded, rng = randomBytes2) {
+      const res2 = this.blindEvaluateBatch(secretKey, publicKey, [blinded], rng);
+      return { evaluated: res2.evaluated[0], proof: res2.proof };
     },
     finalizeBatch(items, publicKey, proof) {
       if (!Array.isArray(items))
         throw new Error("expected array");
-      const pkS = Point.fromBytes(publicKey);
-      const blindedPoints = items.map((i) => i.blinded).map(Point.fromBytes);
-      const evalPoints = items.map((i) => i.evaluated).map(Point.fromBytes);
+      const pkS = wirePoint("public key", publicKey);
+      const blindedPoints = items.map((i) => wirePoint("blinded", i.blinded));
+      const evalPoints = items.map((i) => wirePoint("evaluated", i.evaluated));
       verifyProof(ctxVOPRF, pkS, blindedPoints, evalPoints, proof);
       return items.map((i) => oprf.finalize(i.input, i.blind, i.evaluated));
     },
@@ -2180,15 +3338,17 @@ function createORPF(opts) {
       return this.finalizeBatch([{ input, blind: blind2, evaluated, blinded }], publicKey, proof)[0];
     },
     evaluate: (secretKey, input) => evaluate(ctxVOPRF, secretKey, input)
-  };
+  });
   const poprf = (info) => {
+    info = inputBytes("info", info);
     const m = hashToScalarPrefixed(encode("Info", info), ctxPOPRF);
     const T = Point.BASE.multiply(m);
-    return {
+    return Object.freeze({
       generateKeyPair,
       deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxPOPRF, seed, keyInfo),
-      blind(input, publicKey, rng = randomBytes) {
-        const pkS = Point.fromBytes(publicKey);
+      blind(input, publicKey, rng = randomBytes2) {
+        input = inputBytes("input", input);
+        const pkS = wirePoint("public key", publicKey);
         const tweakedKey = T.add(pkS);
         if (tweakedKey.equals(Point.ZERO))
           throw new Error("tweakedKey point at infinity");
@@ -2203,37 +3363,39 @@ function createORPF(opts) {
           tweakedKey: tweakedKey.toBytes()
         };
       },
-      blindEvaluateBatch(secretKey, blinded, rng = randomBytes) {
+      blindEvaluateBatch(secretKey, blinded, rng = randomBytes2) {
         if (!Array.isArray(blinded))
           throw new Error("expected array");
         const skS = Fn2.fromBytes(secretKey);
         const t = Fn2.add(skS, m);
         const invT = Fn2.inv(t);
-        const blindedPoints = blinded.map(Point.fromBytes);
+        const blindedPoints = blinded.map((i) => wirePoint("blinded", i));
         const evalPoints = blindedPoints.map((i) => i.multiply(invT));
         const tweakedKey = Point.BASE.multiply(t);
         const proof = generateProof(ctxPOPRF, t, tweakedKey, evalPoints, blindedPoints, rng);
         return { evaluated: evalPoints.map((i) => i.toBytes()), proof };
       },
-      blindEvaluate(secretKey, blinded, rng = randomBytes) {
-        const res = this.blindEvaluateBatch(secretKey, [blinded], rng);
-        return { evaluated: res.evaluated[0], proof: res.proof };
+      blindEvaluate(secretKey, blinded, rng = randomBytes2) {
+        const res2 = this.blindEvaluateBatch(secretKey, [blinded], rng);
+        return { evaluated: res2.evaluated[0], proof: res2.proof };
       },
       finalizeBatch(items, proof, tweakedKey) {
         if (!Array.isArray(items))
           throw new Error("expected array");
-        const evalPoints = items.map((i) => i.evaluated).map(Point.fromBytes);
-        verifyProof(ctxPOPRF, Point.fromBytes(tweakedKey), evalPoints, items.map((i) => i.blinded).map(Point.fromBytes), proof);
+        const inputs = items.map((i) => inputBytes("input", i.input));
+        const evalPoints = items.map((i) => wirePoint("evaluated", i.evaluated));
+        verifyProof(ctxPOPRF, wirePoint("tweakedKey", tweakedKey), evalPoints, items.map((i) => wirePoint("blinded", i.blinded)), proof);
         return items.map((i, j) => {
           const blind2 = Fn2.fromBytes(i.blind);
           const point = evalPoints[j].multiply(Fn2.inv(blind2)).toBytes();
-          return hashInput(i.input, info, point);
+          return hashInput(inputs[j], info, point);
         });
       },
       finalize(input, blind2, evaluated, blinded, proof, tweakedKey) {
         return this.finalizeBatch([{ input, blind: blind2, evaluated, blinded }], proof, tweakedKey)[0];
       },
       evaluate(secretKey, input) {
+        input = inputBytes("input", input);
         const skS = Fn2.fromBytes(secretKey);
         const inputPoint = hashToGroup(input, ctxPOPRF);
         if (inputPoint.equals(Point.ZERO))
@@ -2243,19 +3405,20 @@ function createORPF(opts) {
         const unblinded = inputPoint.multiply(invT).toBytes();
         return hashInput(input, info, unblinded);
       }
-    };
+    });
   };
-  return Object.freeze({ name, oprf, voprf, poprf, __tests: { Fn: Fn2 } });
+  const res = { name, oprf, voprf, poprf, __tests: Object.freeze({ Fn: Fn2 }) };
+  return Object.freeze(res);
 }
 
-// ../../node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/ed25519.js
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/ed25519.js
 var _0n6 = /* @__PURE__ */ BigInt(0);
-var _1n6 = BigInt(1);
-var _2n4 = BigInt(2);
+var _1n6 = /* @__PURE__ */ BigInt(1);
+var _2n4 = /* @__PURE__ */ BigInt(2);
 var _3n2 = /* @__PURE__ */ BigInt(3);
-var _5n2 = BigInt(5);
-var _8n3 = BigInt(8);
-var ed25519_CURVE_p = BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
+var _5n2 = /* @__PURE__ */ BigInt(5);
+var _8n3 = /* @__PURE__ */ BigInt(8);
+var ed25519_CURVE_p = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
 var ed25519_CURVE = /* @__PURE__ */ (() => ({
   p: ed25519_CURVE_p,
   n: BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),
@@ -2318,11 +3481,25 @@ function ed25519_domain(data, ctx, phflag) {
   return concatBytes(asciiToBytes("SigEd25519 no Ed25519 collisions"), new Uint8Array([phflag ? 1 : 0, ctx.length]), ctx, data);
 }
 function ed(opts) {
-  return eddsa(ed25519_Point, sha512, Object.assign({ adjustScalarBytes }, opts));
+  return eddsa(ed25519_Point, sha512, Object.assign({ adjustScalarBytes, zip215: true }, opts));
 }
 var ed25519 = /* @__PURE__ */ ed({});
 var ed25519ctx = /* @__PURE__ */ ed({ domain: ed25519_domain });
 var ed25519ph = /* @__PURE__ */ ed({ domain: ed25519_domain, prehash: sha512 });
+var ed25519_FROST = /* @__PURE__ */ (() => createFROST({
+  name: "FROST-ED25519-SHA512-v1",
+  Point: ed25519_Point,
+  validatePoint: (p) => {
+    p.assertValidity();
+    if (!p.isTorsionFree())
+      throw new Error("bad point: not torsion-free");
+  },
+  hash: sha512,
+  // RFC 9591 keeps H2 undecorated here for RFC 8032 compatibility. In createFROST(),
+  // `H2: ''` becomes an empty DST prefix; the built-in hashToScalar fallback treats
+  // that the same as omitted DST, even though custom hooks can still observe the empty bag.
+  H2: ""
+}))();
 var x25519 = /* @__PURE__ */ (() => {
   const P = ed25519_CURVE_p;
   return montgomery({
@@ -2453,6 +3630,12 @@ var _RistrettoPoint = class __RistrettoPoint extends PrimeEdwardsPoint {
   constructor(ep) {
     super(ep);
   }
+  /**
+   * Create one Ristretto255 point from affine Edwards coordinates.
+   * This wraps the internal Edwards representative directly and is not a
+   * canonical ristretto255 decoding path.
+   * Use `toBytes()` / `fromBytes()` if canonical ristretto255 bytes matter.
+   */
   static fromAffine(ap) {
     return new __RistrettoPoint(ed25519_Point.fromAffine(ap));
   }
@@ -2492,7 +3675,7 @@ var _RistrettoPoint = class __RistrettoPoint extends PrimeEdwardsPoint {
   /**
    * Converts ristretto-encoded string to ristretto point.
    * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).
-   * @param hex Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
+   * @param hex - Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
    */
   static fromHex(hex) {
     return __RistrettoPoint.fromBytes(hexToBytes(hex));
@@ -2546,8 +3729,12 @@ var _RistrettoPoint = class __RistrettoPoint extends PrimeEdwardsPoint {
     return this.equals(__RistrettoPoint.ZERO);
   }
 };
-var ristretto255 = { Point: _RistrettoPoint };
-var ristretto255_hasher = {
+Object.freeze(_RistrettoPoint.BASE);
+Object.freeze(_RistrettoPoint.ZERO);
+Object.freeze(_RistrettoPoint.prototype);
+Object.freeze(_RistrettoPoint);
+var ristretto255 = /* @__PURE__ */ Object.freeze({ Point: _RistrettoPoint });
+var ristretto255_hasher = Object.freeze({
   Point: _RistrettoPoint,
   /**
   * Spec: https://www.rfc-editor.org/rfc/rfc9380.html#name-hashing-to-ristretto255. Caveats:
@@ -2558,11 +3745,13 @@ var ristretto255_hasher = {
   * * We cannot re-use 'createHasher', because ristretto255_map is different algorithm/RFC
     (os2ip -> bytes255ToNumberLE)
   * * mapToCurve == calcElligatorRistrettoMap, hashToCurve == ristretto255_map
-  * * hashToScalar is undefined in RFC9380 for ristretto, we are using version from OPRF here, using bytes255ToNumblerLE will create different result if we use bytes255ToNumberLE as os2ip
+  * * hashToScalar is undefined in RFC9380 for ristretto, so we use the OPRF
+    version here. Using `bytes255ToNumblerLE` will create a different result
+    if we use `bytes255ToNumberLE` as os2ip
   * * current version is closest to spec.
   */
   hashToCurve(msg, options) {
-    const DST = options?.DST || "ristretto255_XMD:SHA-512_R255MAP_RO_";
+    const DST = options?.DST === void 0 ? "ristretto255_XMD:SHA-512_R255MAP_RO_" : options.DST;
     const xmd = expand_message_xmd(msg, DST, 64, sha512);
     return ristretto255_hasher.deriveToCurve(xmd);
   },
@@ -2574,8 +3763,10 @@ var ristretto255_hasher = {
    * HashToCurve-like construction based on RFC 9496 (Element Derivation).
    * Converts 64 uniform random bytes into a curve point.
    *
-   * WARNING: This represents an older hash-to-curve construction, preceding the finalization of RFC 9380.
-   * It was later reused as a component in the newer `hash_to_ristretto255` function defined in RFC 9380.
+   * WARNING: This represents an older hash-to-curve construction from before
+   * RFC 9380 was finalized.
+   * It was later reused as a component in the newer
+   * `hash_to_ristretto255` function defined in RFC 9380.
    */
   deriveToCurve(bytes) {
     abytes(bytes, 64);
@@ -2585,15 +3776,23 @@ var ristretto255_hasher = {
     const R2 = calcElligatorRistrettoMap(r2);
     return new _RistrettoPoint(R1.add(R2));
   }
-};
-var ristretto255_oprf = /* @__PURE__ */ (() => createORPF({
+});
+var ristretto255_oprf = /* @__PURE__ */ (() => createOPRF({
   name: "ristretto255-SHA512",
   Point: _RistrettoPoint,
   hash: sha512,
   hashToGroup: ristretto255_hasher.hashToCurve,
   hashToScalar: ristretto255_hasher.hashToScalar
 }))();
-var ED25519_TORSION_SUBGROUP = [
+var ristretto255_FROST = /* @__PURE__ */ (() => createFROST({
+  name: "FROST-RISTRETTO255-SHA512-v1",
+  Point: _RistrettoPoint,
+  validatePoint: (p) => {
+    p.assertValidity();
+  },
+  hash: sha512
+}))();
+var ED25519_TORSION_SUBGROUP = /* @__PURE__ */ Object.freeze([
   "0100000000000000000000000000000000000000000000000000000000000000",
   "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a",
   "0000000000000000000000000000000000000000000000000000000000000080",
@@ -2602,25 +3801,26 @@ var ED25519_TORSION_SUBGROUP = [
   "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85",
   "0000000000000000000000000000000000000000000000000000000000000000",
   "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa"
-];
+]);
 
 export {
+  hexToBytes,
+  sha256,
   ed25519,
   ed25519ctx,
   ed25519ph,
+  ed25519_FROST,
   x25519,
   _map_to_curve_elligator2_curve25519,
   ed25519_hasher,
   ristretto255,
   ristretto255_hasher,
   ristretto255_oprf,
+  ristretto255_FROST,
   ED25519_TORSION_SUBGROUP
 };
 /*! Bundled license information:
 
-@noble/hashes/utils.js:
-  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
-
 @noble/curves/utils.js:
 @noble/curves/abstract/modular.js:
 @noble/curves/abstract/curve.js:
@@ -2630,4 +3830,4 @@ export {
 @noble/curves/ed25519.js:
   (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
 */
-//# sourceMappingURL=chunk-FSS45ZX3.js.map
+//# sourceMappingURL=chunk-DLYE6U2Z.js.map