@toon-protocol/client-mcp 0.20.2 → 0.20.4

package/dist/{chunk-LN2OF264.js → chunk-6GXZ4KRO.js}

@@ -927,20 +927,20 @@ function invert(number, modulo) {
     throw new Error("invert: does not exist");
   return mod(x, modulo);
 }
-function assertIsSquare(Fp2, root, n) {
-  const F = Fp2;
+function assertIsSquare(Fp, root, n) {
+  const F = Fp;
   if (!F.eql(F.sqr(root), n))
     throw new Error("Cannot find square root");
 }
-function sqrt3mod4(Fp2, n) {
-  const F = Fp2;
+function sqrt3mod4(Fp, n) {
+  const F = Fp;
   const p1div4 = (F.ORDER + _1n2) / _4n;
   const root = F.pow(n, p1div4);
   assertIsSquare(F, root, n);
   return root;
 }
-function sqrt5mod8(Fp2, n) {
-  const F = Fp2;
+function sqrt5mod8(Fp, n) {
+  const F = Fp;
   const p5div8 = (F.ORDER - _5n) / _8n;
   const n2 = F.mul(n, _2n);
   const v = F.pow(n2, p5div8);
@@ -957,8 +957,8 @@ function sqrt9mod16(P) {
   const c2 = tn(Fp_, c1);
   const c3 = tn(Fp_, Fp_.neg(c1));
   const c4 = (P + _7n) / _16n;
-  return ((Fp2, n) => {
-    const F = Fp2;
+  return ((Fp, n) => {
+    const F = Fp;
     let tv1 = F.pow(n, c4);
     let tv2 = F.mul(tv1, c1);
     const tv3 = F.mul(tv1, c2);
@@ -992,8 +992,8 @@ function tonelliShanks(P) {
     return sqrt3mod4;
   let cc = _Fp.pow(Z, Q);
   const Q1div2 = (Q + _1n2) / _2n;
-  return function tonelliSlow(Fp2, n) {
-    const F = Fp2;
+  return function tonelliSlow(Fp, n) {
+    const F = Fp;
     if (F.is0(n))
       return n;
     if (FpLegendre(F, n) !== 1)
@@ -1071,8 +1071,8 @@ function validateField(field) {
     throw new Error("invalid field: expected ORDER > 1, got " + field.ORDER);
   return field;
 }
-function FpPow(Fp2, num, power) {
-  const F = Fp2;
+function FpPow(Fp, num, power) {
+  const F = Fp;
   if (power < _0n2)
     throw new Error("invalid exponent, negatives unsupported");
   if (power === _0n2)
@@ -1089,8 +1089,8 @@ function FpPow(Fp2, num, power) {
   }
   return p;
 }
-function FpInvertBatch(Fp2, nums, passZero = false) {
-  const F = Fp2;
+function FpInvertBatch(Fp, nums, passZero = false) {
+  const F = Fp;
   const inverted = new Array(nums.length).fill(passZero ? F.ZERO : void 0);
   const multipliedAcc = nums.reduce((acc, num, i) => {
     if (F.is0(num))
@@ -1107,8 +1107,8 @@ function FpInvertBatch(Fp2, nums, passZero = false) {
   }, invertedAcc);
   return inverted;
 }
-function FpLegendre(Fp2, n) {
-  const F = Fp2;
+function FpLegendre(Fp, n) {
+  const F = Fp;
   const p1mod2 = (F.ORDER - _1n2) / _2n;
   const powered = F.pow(n, p1mod2);
   const yes = F.eql(powered, F.ONE);
@@ -1271,8 +1271,8 @@ Object.freeze(_Field.prototype);
 function Field(ORDER, opts = {}) {
   return new _Field(ORDER, opts);
 }
-function FpSqrtEven(Fp2, elm) {
-  const F = Fp2;
+function FpSqrtEven(Fp, elm) {
+  const F = Fp;
   if (!F.isOdd)
     throw new Error("Field doesn't have isOdd");
   const root = F.sqrt(elm);
@@ -1594,16 +1594,16 @@ function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
     if (!(typeof val === "bigint" && val > _0n3))
       throw new Error(`CURVE.${p} must be positive bigint`);
   }
-  const Fp2 = createField(CURVE.p, curveOpts.Fp, FpFnLE);
-  const Fn2 = createField(CURVE.n, curveOpts.Fn, FpFnLE);
+  const Fp = createField(CURVE.p, curveOpts.Fp, FpFnLE);
+  const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);
   const _b = type === "weierstrass" ? "b" : "d";
   const params = ["Gx", "Gy", "a", _b];
   for (const p of params) {
-    if (!Fp2.isValid(CURVE[p]))
+    if (!Fp.isValid(CURVE[p]))
       throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);
   }
   CURVE = Object.freeze(Object.assign({}, CURVE));
-  return { CURVE, Fp: Fp2, Fn: Fn2 };
+  return { CURVE, Fp, Fn };
 }
 function createKeygen(randomSecretKey, getPublicKey) {
   return function keygen(seed) {
@@ -1612,525 +1612,173 @@ function createKeygen(randomSecretKey, getPublicKey) {
   };
 }
 
-// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/edwards.js
-var _0n4 = /* @__PURE__ */ BigInt(0);
-var _1n4 = /* @__PURE__ */ BigInt(1);
-var _2n2 = /* @__PURE__ */ BigInt(2);
-var _8n2 = /* @__PURE__ */ BigInt(8);
-function isEdValidXY(Fp2, CURVE, x, y) {
-  const x2 = Fp2.sqr(x);
-  const y2 = Fp2.sqr(y);
-  const left = Fp2.add(Fp2.mul(CURVE.a, x2), y2);
-  const right = Fp2.add(Fp2.ONE, Fp2.mul(CURVE.d, Fp2.mul(x2, y2)));
-  return Fp2.eql(left, right);
-}
-function edwards(params, extraOpts = {}) {
-  const opts = extraOpts;
-  const validated = createCurveFields("edwards", params, opts, opts.FpFnLE);
-  const { Fp: Fp2, Fn: Fn2 } = validated;
-  let CURVE = validated.CURVE;
-  const { h: cofactor } = CURVE;
-  validateObject(opts, {}, { uvRatio: "function" });
-  const MASK = _2n2 << BigInt(Fn2.BYTES * 8) - _1n4;
-  const modP = (n) => Fp2.create(n);
-  const uvRatio2 = opts.uvRatio === void 0 ? (u, v) => {
-    try {
-      return { isValid: true, value: Fp2.sqrt(Fp2.div(u, v)) };
-    } catch (e) {
-      return { isValid: false, value: _0n4 };
-    }
-  } : opts.uvRatio;
-  if (!isEdValidXY(Fp2, CURVE, CURVE.Gx, CURVE.Gy))
-    throw new Error("bad curve params: generator point");
-  function acoord(title, n, banZero = false) {
-    const min = banZero ? _1n4 : _0n4;
-    aInRange("coordinate " + title, n, min, MASK);
-    return n;
-  }
-  function aedpoint(other) {
-    if (!(other instanceof Point))
-      throw new Error("EdwardsPoint expected");
-  }
-  class Point {
-    // base / generator point
-    static BASE = new Point(CURVE.Gx, CURVE.Gy, _1n4, modP(CURVE.Gx * CURVE.Gy));
-    // zero / infinity / identity point
-    static ZERO = new Point(_0n4, _1n4, _1n4, _0n4);
-    // 0, 1, 1, 0
-    // math field
-    static Fp = Fp2;
-    // scalar field
-    static Fn = Fn2;
-    X;
-    Y;
-    Z;
-    T;
-    constructor(X, Y, Z, T) {
-      this.X = acoord("x", X);
-      this.Y = acoord("y", Y);
-      this.Z = acoord("z", Z, true);
-      this.T = acoord("t", T);
-      Object.freeze(this);
-    }
-    static CURVE() {
-      return CURVE;
-    }
-    /**
-     * Create one extended Edwards point from affine coordinates.
-     * Does NOT validate that the point is on-curve or torsion-free.
-     * Use `.assertValidity()` on adversarial inputs.
-     */
-    static fromAffine(p) {
-      if (p instanceof Point)
-        throw new Error("extended point not allowed");
-      const { x, y } = p || {};
-      acoord("x", x);
-      acoord("y", y);
-      return new Point(x, y, _1n4, modP(x * y));
-    }
-    // Uses algo from RFC8032 5.1.3.
-    static fromBytes(bytes, zip215 = false) {
-      const len = Fp2.BYTES;
-      const { a, d } = CURVE;
-      bytes = copyBytes(abytes2(bytes, len, "point"));
-      abool(zip215, "zip215");
-      const normed = copyBytes(bytes);
-      const lastByte = bytes[len - 1];
-      normed[len - 1] = lastByte & ~128;
-      const y = bytesToNumberLE(normed);
-      const max = zip215 ? MASK : Fp2.ORDER;
-      aInRange("point.y", y, _0n4, max);
-      const y2 = modP(y * y);
-      const u = modP(y2 - _1n4);
-      const v = modP(d * y2 - a);
-      let { isValid, value: x } = uvRatio2(u, v);
-      if (!isValid)
-        throw new Error("bad point: invalid y coordinate");
-      const isXOdd = (x & _1n4) === _1n4;
-      const isLastByteOdd = (lastByte & 128) !== 0;
-      if (!zip215 && x === _0n4 && isLastByteOdd)
-        throw new Error("bad point: x=0 and x_0=1");
-      if (isLastByteOdd !== isXOdd)
-        x = modP(-x);
-      return Point.fromAffine({ x, y });
-    }
-    static fromHex(hex, zip215 = false) {
-      return Point.fromBytes(hexToBytes2(hex), zip215);
-    }
-    get x() {
-      return this.toAffine().x;
-    }
-    get y() {
-      return this.toAffine().y;
-    }
-    precompute(windowSize = 8, isLazy = true) {
-      wnaf.createCache(this, windowSize);
-      if (!isLazy)
-        this.multiply(_2n2);
-      return this;
-    }
-    // Useful in fromAffine() - not for fromBytes(), which always created valid points.
-    assertValidity() {
-      const p = this;
-      const { a, d } = CURVE;
-      if (p.is0())
-        throw new Error("bad point: ZERO");
-      const { X, Y, Z, T } = p;
-      const X2 = modP(X * X);
-      const Y2 = modP(Y * Y);
-      const Z2 = modP(Z * Z);
-      const Z4 = modP(Z2 * Z2);
-      const aX2 = modP(X2 * a);
-      const left = modP(Z2 * modP(aX2 + Y2));
-      const right = modP(Z4 + modP(d * modP(X2 * Y2)));
-      if (left !== right)
-        throw new Error("bad point: equation left != right (1)");
-      const XY = modP(X * Y);
-      const ZT = modP(Z * T);
-      if (XY !== ZT)
-        throw new Error("bad point: equation left != right (2)");
-    }
-    // Compare one point to another.
-    equals(other) {
-      aedpoint(other);
-      const { X: X1, Y: Y1, Z: Z1 } = this;
-      const { X: X2, Y: Y2, Z: Z2 } = other;
-      const X1Z2 = modP(X1 * Z2);
-      const X2Z1 = modP(X2 * Z1);
-      const Y1Z2 = modP(Y1 * Z2);
-      const Y2Z1 = modP(Y2 * Z1);
-      return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
-    }
-    is0() {
-      return this.equals(Point.ZERO);
-    }
-    negate() {
-      return new Point(modP(-this.X), this.Y, this.Z, modP(-this.T));
-    }
-    // Fast algo for doubling Extended Point.
-    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
-    // Cost: 4M + 4S + 1*a + 6add + 1*2.
-    double() {
-      const { a } = CURVE;
-      const { X: X1, Y: Y1, Z: Z1 } = this;
-      const A = modP(X1 * X1);
-      const B = modP(Y1 * Y1);
-      const C = modP(_2n2 * modP(Z1 * Z1));
-      const D = modP(a * A);
-      const x1y1 = X1 + Y1;
-      const E = modP(modP(x1y1 * x1y1) - A - B);
-      const G = D + B;
-      const F = G - C;
-      const H = D - B;
-      const X3 = modP(E * F);
-      const Y3 = modP(G * H);
-      const T3 = modP(E * H);
-      const Z3 = modP(F * G);
-      return new Point(X3, Y3, Z3, T3);
-    }
-    // Fast algo for adding 2 Extended Points.
-    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
-    // Cost: 9M + 1*a + 1*d + 7add.
-    add(other) {
-      aedpoint(other);
-      const { a, d } = CURVE;
-      const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;
-      const { X: X2, Y: Y2, Z: Z2, T: T2 } = other;
-      const A = modP(X1 * X2);
-      const B = modP(Y1 * Y2);
-      const C = modP(T1 * d * T2);
-      const D = modP(Z1 * Z2);
-      const E = modP((X1 + Y1) * (X2 + Y2) - A - B);
-      const F = D - C;
-      const G = D + C;
-      const H = modP(B - a * A);
-      const X3 = modP(E * F);
-      const Y3 = modP(G * H);
-      const T3 = modP(E * H);
-      const Z3 = modP(F * G);
-      return new Point(X3, Y3, Z3, T3);
-    }
-    subtract(other) {
-      aedpoint(other);
-      return this.add(other.negate());
-    }
-    // Constant-time multiplication.
-    multiply(scalar) {
-      if (!Fn2.isValidNot0(scalar))
-        throw new RangeError("invalid scalar: expected 1 <= sc < curve.n");
-      const { p, f } = wnaf.cached(this, scalar, (p2) => normalizeZ(Point, p2));
-      return normalizeZ(Point, [p, f])[0];
-    }
-    // Non-constant-time multiplication. Uses double-and-add algorithm.
-    // It's faster, but should only be used when you don't care about
-    // an exposed private key e.g. sig verification.
-    // Keeps the same subgroup-scalar contract: 0 is allowed for public-scalar callers, but
-    // n and larger values are rejected instead of being reduced mod n to the identity point.
-    multiplyUnsafe(scalar) {
-      if (!Fn2.isValid(scalar))
-        throw new RangeError("invalid scalar: expected 0 <= sc < curve.n");
-      if (scalar === _0n4)
-        return Point.ZERO;
-      if (this.is0() || scalar === _1n4)
-        return this;
-      return wnaf.unsafe(this, scalar, (p) => normalizeZ(Point, p));
-    }
-    // Checks if point is of small order.
-    // If you add something to small order point, you will have "dirty"
-    // point with torsion component.
-    // Clears cofactor and checks if the result is 0.
-    isSmallOrder() {
-      return this.clearCofactor().is0();
-    }
-    // Multiplies point by curve order and checks if the result is 0.
-    // Returns `false` is the point is dirty.
-    isTorsionFree() {
-      return wnaf.unsafe(this, CURVE.n).is0();
-    }
-    // Converts Extended point to default (x, y) coordinates.
-    // Can accept precomputed Z^-1 - for example, from invertBatch.
-    toAffine(invertedZ) {
-      const p = this;
-      let iz = invertedZ;
-      const { X, Y, Z } = p;
-      const is0 = p.is0();
-      if (iz == null)
-        iz = is0 ? _8n2 : Fp2.inv(Z);
-      const x = modP(X * iz);
-      const y = modP(Y * iz);
-      const zz = Fp2.mul(Z, iz);
-      if (is0)
-        return { x: _0n4, y: _1n4 };
-      if (zz !== _1n4)
-        throw new Error("invZ was invalid");
-      return { x, y };
-    }
-    clearCofactor() {
-      if (cofactor === _1n4)
-        return this;
-      return this.multiplyUnsafe(cofactor);
-    }
-    toBytes() {
-      const { x, y } = this.toAffine();
-      const bytes = Fp2.toBytes(y);
-      bytes[bytes.length - 1] |= x & _1n4 ? 128 : 0;
-      return bytes;
-    }
-    toHex() {
-      return bytesToHex2(this.toBytes());
-    }
-    toString() {
-      return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
-    }
-  }
-  const wnaf = new wNAF(Point, Fn2.BITS);
-  if (Fn2.BITS >= 8)
-    Point.BASE.precompute(8);
-  Object.freeze(Point.prototype);
-  Object.freeze(Point);
-  return Point;
-}
-var PrimeEdwardsPoint = class {
-  static BASE;
-  static ZERO;
-  static Fp;
-  static Fn;
-  ep;
-  /**
-   * Wrap one internal Edwards representative directly.
-   * This is not a canonical encoding boundary: alternate Edwards
-   * representatives may still describe the same abstract wrapper element.
-   */
-  constructor(ep) {
-    this.ep = ep;
-  }
-  // Static methods that must be implemented by subclasses
-  static fromBytes(_bytes) {
-    notImplemented();
-  }
-  static fromHex(_hex) {
-    notImplemented();
-  }
-  get x() {
-    return this.toAffine().x;
-  }
-  get y() {
-    return this.toAffine().y;
-  }
-  // Common implementations
-  clearCofactor() {
-    return this;
-  }
-  assertValidity() {
-    this.ep.assertValidity();
-  }
-  /**
-   * Return affine coordinates of the current internal Edwards representative.
-   * This is a convenience helper, not a canonical Ristretto/Decaf encoding.
-   * Equal abstract elements may expose different `x` / `y`; use
-   * `toBytes()` / `fromBytes()` for canonical roundtrips.
-   */
-  toAffine(invertedZ) {
-    return this.ep.toAffine(invertedZ);
-  }
-  toHex() {
-    return bytesToHex2(this.toBytes());
-  }
-  toString() {
-    return this.toHex();
-  }
-  isTorsionFree() {
-    return true;
-  }
-  isSmallOrder() {
-    return false;
-  }
-  add(other) {
-    this.assertSame(other);
-    return this.init(this.ep.add(other.ep));
-  }
-  subtract(other) {
-    this.assertSame(other);
-    return this.init(this.ep.subtract(other.ep));
-  }
-  multiply(scalar) {
-    return this.init(this.ep.multiply(scalar));
-  }
-  multiplyUnsafe(scalar) {
-    return this.init(this.ep.multiplyUnsafe(scalar));
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/hash-to-curve.js
+var os2ip = bytesToNumberBE;
+function i2osp(value, length) {
+  asafenumber(value);
+  asafenumber(length);
+  if (length < 0 || length > 4)
+    throw new Error("invalid I2OSP length: " + length);
+  if (value < 0 || value > 2 ** (8 * length) - 1)
+    throw new Error("invalid I2OSP input: " + value);
+  const res = Array.from({ length }).fill(0);
+  for (let i = length - 1; i >= 0; i--) {
+    res[i] = value & 255;
+    value >>>= 8;
   }
-  double() {
-    return this.init(this.ep.double());
+  return new Uint8Array(res);
+}
+function strxor(a, b) {
+  const arr = new Uint8Array(a.length);
+  for (let i = 0; i < a.length; i++) {
+    arr[i] = a[i] ^ b[i];
   }
-  negate() {
-    return this.init(this.ep.negate());
+  return arr;
+}
+function normDST(DST) {
+  if (!isBytes2(DST) && typeof DST !== "string")
+    throw new Error("DST must be Uint8Array or ascii string");
+  const dst = typeof DST === "string" ? asciiToBytes(DST) : DST;
+  if (dst.length === 0)
+    throw new Error("DST must be non-empty");
+  return dst;
+}
+function expand_message_xmd(msg, DST, lenInBytes, H) {
+  abytes2(msg);
+  asafenumber(lenInBytes);
+  DST = normDST(DST);
+  if (DST.length > 255)
+    DST = H(concatBytes2(asciiToBytes("H2C-OVERSIZE-DST-"), DST));
+  const { outputLen: b_in_bytes, blockLen: r_in_bytes } = H;
+  const ell = Math.ceil(lenInBytes / b_in_bytes);
+  if (lenInBytes > 65535 || ell > 255)
+    throw new Error("expand_message_xmd: invalid lenInBytes");
+  const DST_prime = concatBytes2(DST, i2osp(DST.length, 1));
+  const Z_pad = new Uint8Array(r_in_bytes);
+  const l_i_b_str = i2osp(lenInBytes, 2);
+  const b = new Array(ell);
+  const b_0 = H(concatBytes2(Z_pad, msg, l_i_b_str, i2osp(0, 1), DST_prime));
+  b[0] = H(concatBytes2(b_0, i2osp(1, 1), DST_prime));
+  for (let i = 1; i < ell; i++) {
+    const args = [strxor(b_0, b[i - 1]), i2osp(i + 1, 1), DST_prime];
+    b[i] = H(concatBytes2(...args));
   }
-  precompute(windowSize, isLazy) {
-    this.ep.precompute(windowSize, isLazy);
-    return this;
+  const pseudo_random_bytes = concatBytes2(...b);
+  return pseudo_random_bytes.slice(0, lenInBytes);
+}
+function expand_message_xof(msg, DST, lenInBytes, k, H) {
+  abytes2(msg);
+  asafenumber(lenInBytes);
+  DST = normDST(DST);
+  if (DST.length > 255) {
+    const dkLen = Math.ceil(2 * k / 8);
+    DST = H.create({ dkLen }).update(asciiToBytes("H2C-OVERSIZE-DST-")).update(DST).digest();
   }
-};
-function eddsa(Point, cHash, eddsaOpts = {}) {
-  if (typeof cHash !== "function")
-    throw new Error('"hash" function param is required');
-  const hash = cHash;
-  const opts = eddsaOpts;
-  validateObject(opts, {}, {
-    adjustScalarBytes: "function",
-    randomBytes: "function",
-    domain: "function",
-    prehash: "function",
-    zip215: "boolean",
-    mapToCurve: "function"
+  if (lenInBytes > 65535 || DST.length > 255)
+    throw new Error("expand_message_xof: invalid lenInBytes");
+  return H.create({ dkLen: lenInBytes }).update(msg).update(i2osp(lenInBytes, 2)).update(DST).update(i2osp(DST.length, 1)).digest();
+}
+function hash_to_field(msg, count, options) {
+  validateObject(options, {
+    p: "bigint",
+    m: "number",
+    k: "number",
+    hash: "function"
   });
-  const { prehash } = opts;
-  const { BASE, Fp: Fp2, Fn: Fn2 } = Point;
-  const outputLen = hash.outputLen;
-  const expectedLen = 2 * Fp2.BYTES;
-  if (outputLen !== void 0) {
-    asafenumber(outputLen, "hash.outputLen");
-    if (outputLen !== expectedLen)
-      throw new Error(`hash.outputLen must be ${expectedLen}, got ${outputLen}`);
-  }
-  const randomBytes3 = opts.randomBytes === void 0 ? randomBytes2 : opts.randomBytes;
-  const adjustScalarBytes2 = opts.adjustScalarBytes === void 0 ? (bytes) => bytes : opts.adjustScalarBytes;
-  const domain = opts.domain === void 0 ? (data, ctx, phflag) => {
-    abool(phflag, "phflag");
-    if (ctx.length || phflag)
-      throw new Error("Contexts/pre-hash are not supported");
-    return data;
-  } : opts.domain;
-  function modN_LE(hash2) {
-    return Fn2.create(bytesToNumberLE(hash2));
-  }
-  function getPrivateScalar(key) {
-    const len = lengths.secretKey;
-    abytes2(key, lengths.secretKey, "secretKey");
-    const hashed = abytes2(hash(key), 2 * len, "hashedSecretKey");
-    const head = adjustScalarBytes2(hashed.slice(0, len));
-    const prefix = hashed.slice(len, 2 * len);
-    const scalar = modN_LE(head);
-    return { head, prefix, scalar };
-  }
-  function getExtendedPublicKey(secretKey) {
-    const { head, prefix, scalar } = getPrivateScalar(secretKey);
-    const point = BASE.multiply(scalar);
-    const pointBytes = point.toBytes();
-    return { head, prefix, scalar, point, pointBytes };
-  }
-  function getPublicKey(secretKey) {
-    return getExtendedPublicKey(secretKey).pointBytes;
-  }
-  function hashDomainToScalar(context = Uint8Array.of(), ...msgs) {
-    const msg = concatBytes2(...msgs);
-    return modN_LE(hash(domain(msg, abytes2(context, void 0, "context"), !!prehash)));
-  }
-  function sign(msg, secretKey, options = {}) {
-    msg = abytes2(msg, void 0, "message");
-    if (prehash)
-      msg = prehash(msg);
-    const { prefix, scalar, pointBytes } = getExtendedPublicKey(secretKey);
-    const r = hashDomainToScalar(options.context, prefix, msg);
-    const R = BASE.multiply(r).toBytes();
-    const k = hashDomainToScalar(options.context, R, pointBytes, msg);
-    const s = Fn2.create(r + k * scalar);
-    if (!Fn2.isValid(s))
-      throw new Error("sign failed: invalid s");
-    const rs = concatBytes2(R, Fn2.toBytes(s));
-    return abytes2(rs, lengths.signature, "result");
-  }
-  const verifyOpts = {
-    zip215: opts.zip215
-  };
-  function verify(sig, msg, publicKey, options = verifyOpts) {
-    const { context } = options;
-    const zip215 = options.zip215 === void 0 ? !!verifyOpts.zip215 : options.zip215;
-    const len = lengths.signature;
-    sig = abytes2(sig, len, "signature");
-    msg = abytes2(msg, void 0, "message");
-    publicKey = abytes2(publicKey, lengths.publicKey, "publicKey");
-    if (zip215 !== void 0)
-      abool(zip215, "zip215");
-    if (prehash)
-      msg = prehash(msg);
-    const mid = len / 2;
-    const r = sig.subarray(0, mid);
-    const s = bytesToNumberLE(sig.subarray(mid, len));
-    let A, R, SB;
-    try {
-      A = Point.fromBytes(publicKey, zip215);
-      R = Point.fromBytes(r, zip215);
-      SB = BASE.multiplyUnsafe(s);
-    } catch (error) {
-      return false;
+  const { p, k, m, hash, expand, DST } = options;
+  asafenumber(hash.outputLen, "valid hash");
+  abytes2(msg);
+  asafenumber(count);
+  if (count < 1)
+    throw new Error("hash_to_field: expected count >= 1");
+  if (m < 1)
+    throw new Error("hash_to_field: expected m >= 1");
+  const log2p = p.toString(2).length;
+  const L = Math.ceil((log2p + k) / 8);
+  const len_in_bytes = count * m * L;
+  let prb;
+  if (expand === "xmd") {
+    prb = expand_message_xmd(msg, DST, len_in_bytes, hash);
+  } else if (expand === "xof") {
+    prb = expand_message_xof(msg, DST, len_in_bytes, k, hash);
+  } else if (expand === "_internal_pass") {
+    prb = msg;
+  } else {
+    throw new Error('expand must be "xmd" or "xof"');
+  }
+  const u = new Array(count);
+  for (let i = 0; i < count; i++) {
+    const e = new Array(m);
+    for (let j = 0; j < m; j++) {
+      const elm_offset = L * (j + i * m);
+      const tv = prb.subarray(elm_offset, elm_offset + L);
+      e[j] = mod(os2ip(tv), p);
     }
-    if (!zip215 && A.isSmallOrder())
-      return false;
-    const k = hashDomainToScalar(context, r, publicKey, msg);
-    const RkA = R.add(A.multiplyUnsafe(k));
-    return RkA.subtract(SB).clearCofactor().is0();
-  }
-  const _size = Fp2.BYTES;
-  const lengths = {
-    secretKey: _size,
-    publicKey: _size,
-    signature: 2 * _size,
-    seed: _size
-  };
-  function randomSecretKey(seed) {
-    seed = seed === void 0 ? randomBytes3(lengths.seed) : seed;
-    return abytes2(seed, lengths.seed, "seed");
+    u[i] = e;
   }
-  function isValidSecretKey(key) {
-    return isBytes2(key) && key.length === lengths.secretKey;
+  return u;
+}
+var _DST_scalar = "HashToScalar-";
+function createHasher2(Point, mapToCurve, defaults) {
+  if (typeof mapToCurve !== "function")
+    throw new Error("mapToCurve() must be defined");
+  const snapshot = (src) => Object.freeze({
+    ...src,
+    DST: isBytes2(src.DST) ? copyBytes(src.DST) : src.DST,
+    ...src.encodeDST === void 0 ? {} : { encodeDST: isBytes2(src.encodeDST) ? copyBytes(src.encodeDST) : src.encodeDST }
+  });
+  const safeDefaults = snapshot(defaults);
+  function map(num) {
+    return Point.fromAffine(mapToCurve(num));
   }
-  function isValidPublicKey(key, zip215) {
-    try {
-      return !!Point.fromBytes(key, zip215 === void 0 ? verifyOpts.zip215 : zip215);
-    } catch (error) {
-      return false;
-    }
+  function clear(initial) {
+    const P = initial.clearCofactor();
+    if (P.equals(Point.ZERO))
+      return Point.ZERO;
+    P.assertValidity();
+    return P;
   }
-  const utils = {
-    getExtendedPublicKey,
-    randomSecretKey,
-    isValidSecretKey,
-    isValidPublicKey,
-    /**
-     * Converts ed public key to x public key. Uses formula:
-     * - ed25519:
-     *   - `(u, v) = ((1+y)/(1-y), sqrt(-486664)*u/x)`
-     *   - `(x, y) = (sqrt(-486664)*u/v, (u-1)/(u+1))`
-     * - ed448:
-     *   - `(u, v) = ((y-1)/(y+1), sqrt(156324)*u/x)`
-     *   - `(x, y) = (sqrt(156324)*u/v, (1+u)/(1-u))`
-     */
-    toMontgomery(publicKey) {
-      const { y } = Point.fromBytes(publicKey);
-      const size = lengths.publicKey;
-      const is25519 = size === 32;
-      if (!is25519 && size !== 57)
-        throw new Error("only defined for 25519 and 448");
-      const u = is25519 ? Fp2.div(_1n4 + y, _1n4 - y) : Fp2.div(y - _1n4, y + _1n4);
-      return Fp2.toBytes(u);
-    },
-    toMontgomerySecret(secretKey) {
-      const size = lengths.secretKey;
-      abytes2(secretKey, size);
-      const hashed = hash(secretKey.subarray(0, size));
-      return adjustScalarBytes2(hashed).subarray(0, size);
-    }
-  };
-  Object.freeze(lengths);
-  Object.freeze(utils);
   return Object.freeze({
-    keygen: createKeygen(randomSecretKey, getPublicKey),
-    getPublicKey,
-    sign,
-    verify,
-    utils,
+    get defaults() {
+      return snapshot(safeDefaults);
+    },
     Point,
-    lengths
+    hashToCurve(msg, options) {
+      const opts = Object.assign({}, safeDefaults, options);
+      const u = hash_to_field(msg, 2, opts);
+      const u0 = map(u[0]);
+      const u1 = map(u[1]);
+      return clear(u0.add(u1));
+    },
+    encodeToCurve(msg, options) {
+      const optsDst = safeDefaults.encodeDST ? { DST: safeDefaults.encodeDST } : {};
+      const opts = Object.assign({}, safeDefaults, optsDst, options);
+      const u = hash_to_field(msg, 1, opts);
+      const u0 = map(u[0]);
+      return clear(u0);
+    },
+    /** See {@link H2CHasher} */
+    mapToCurve(scalars) {
+      if (safeDefaults.m === 1) {
+        if (typeof scalars !== "bigint")
+          throw new Error("expected bigint (m=1)");
+        return clear(map([scalars]));
+      }
+      if (!Array.isArray(scalars))
+        throw new Error("expected array of bigints");
+      for (const i of scalars)
+        if (typeof i !== "bigint")
+          throw new Error("expected array of bigints");
+      return clear(map(scalars));
+    },
+    // hash_to_scalar can produce 0: https://www.rfc-editor.org/errata/eid8393
+    // RFC 9380, draft-irtf-cfrg-bbs-signatures-08. Default scalar DST is the shared generic
+    // `HashToScalar-` prefix above unless the caller overrides it per invocation.
+    hashToScalar(msg, options) {
+      const N = Point.Fn.ORDER;
+      const opts = Object.assign({}, safeDefaults, { p: N, m: 1, DST: _DST_scalar }, options);
+      return hash_to_field(msg, 1, opts)[0][0];
+    }
   });
 }
 
@@ -2343,176 +1991,6 @@ function poly(field, roots, create, fft, length) {
   };
 }
 
-// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/hash-to-curve.js
-var os2ip = bytesToNumberBE;
-function i2osp(value, length) {
-  asafenumber(value);
-  asafenumber(length);
-  if (length < 0 || length > 4)
-    throw new Error("invalid I2OSP length: " + length);
-  if (value < 0 || value > 2 ** (8 * length) - 1)
-    throw new Error("invalid I2OSP input: " + value);
-  const res = Array.from({ length }).fill(0);
-  for (let i = length - 1; i >= 0; i--) {
-    res[i] = value & 255;
-    value >>>= 8;
-  }
-  return new Uint8Array(res);
-}
-function strxor(a, b) {
-  const arr = new Uint8Array(a.length);
-  for (let i = 0; i < a.length; i++) {
-    arr[i] = a[i] ^ b[i];
-  }
-  return arr;
-}
-function normDST(DST) {
-  if (!isBytes2(DST) && typeof DST !== "string")
-    throw new Error("DST must be Uint8Array or ascii string");
-  const dst = typeof DST === "string" ? asciiToBytes(DST) : DST;
-  if (dst.length === 0)
-    throw new Error("DST must be non-empty");
-  return dst;
-}
-function expand_message_xmd(msg, DST, lenInBytes, H) {
-  abytes2(msg);
-  asafenumber(lenInBytes);
-  DST = normDST(DST);
-  if (DST.length > 255)
-    DST = H(concatBytes2(asciiToBytes("H2C-OVERSIZE-DST-"), DST));
-  const { outputLen: b_in_bytes, blockLen: r_in_bytes } = H;
-  const ell = Math.ceil(lenInBytes / b_in_bytes);
-  if (lenInBytes > 65535 || ell > 255)
-    throw new Error("expand_message_xmd: invalid lenInBytes");
-  const DST_prime = concatBytes2(DST, i2osp(DST.length, 1));
-  const Z_pad = new Uint8Array(r_in_bytes);
-  const l_i_b_str = i2osp(lenInBytes, 2);
-  const b = new Array(ell);
-  const b_0 = H(concatBytes2(Z_pad, msg, l_i_b_str, i2osp(0, 1), DST_prime));
-  b[0] = H(concatBytes2(b_0, i2osp(1, 1), DST_prime));
-  for (let i = 1; i < ell; i++) {
-    const args = [strxor(b_0, b[i - 1]), i2osp(i + 1, 1), DST_prime];
-    b[i] = H(concatBytes2(...args));
-  }
-  const pseudo_random_bytes = concatBytes2(...b);
-  return pseudo_random_bytes.slice(0, lenInBytes);
-}
-function expand_message_xof(msg, DST, lenInBytes, k, H) {
-  abytes2(msg);
-  asafenumber(lenInBytes);
-  DST = normDST(DST);
-  if (DST.length > 255) {
-    const dkLen = Math.ceil(2 * k / 8);
-    DST = H.create({ dkLen }).update(asciiToBytes("H2C-OVERSIZE-DST-")).update(DST).digest();
-  }
-  if (lenInBytes > 65535 || DST.length > 255)
-    throw new Error("expand_message_xof: invalid lenInBytes");
-  return H.create({ dkLen: lenInBytes }).update(msg).update(i2osp(lenInBytes, 2)).update(DST).update(i2osp(DST.length, 1)).digest();
-}
-function hash_to_field(msg, count, options) {
-  validateObject(options, {
-    p: "bigint",
-    m: "number",
-    k: "number",
-    hash: "function"
-  });
-  const { p, k, m, hash, expand, DST } = options;
-  asafenumber(hash.outputLen, "valid hash");
-  abytes2(msg);
-  asafenumber(count);
-  if (count < 1)
-    throw new Error("hash_to_field: expected count >= 1");
-  if (m < 1)
-    throw new Error("hash_to_field: expected m >= 1");
-  const log2p = p.toString(2).length;
-  const L = Math.ceil((log2p + k) / 8);
-  const len_in_bytes = count * m * L;
-  let prb;
-  if (expand === "xmd") {
-    prb = expand_message_xmd(msg, DST, len_in_bytes, hash);
-  } else if (expand === "xof") {
-    prb = expand_message_xof(msg, DST, len_in_bytes, k, hash);
-  } else if (expand === "_internal_pass") {
-    prb = msg;
-  } else {
-    throw new Error('expand must be "xmd" or "xof"');
-  }
-  const u = new Array(count);
-  for (let i = 0; i < count; i++) {
-    const e = new Array(m);
-    for (let j = 0; j < m; j++) {
-      const elm_offset = L * (j + i * m);
-      const tv = prb.subarray(elm_offset, elm_offset + L);
-      e[j] = mod(os2ip(tv), p);
-    }
-    u[i] = e;
-  }
-  return u;
-}
-var _DST_scalar = "HashToScalar-";
-function createHasher2(Point, mapToCurve, defaults) {
-  if (typeof mapToCurve !== "function")
-    throw new Error("mapToCurve() must be defined");
-  const snapshot = (src) => Object.freeze({
-    ...src,
-    DST: isBytes2(src.DST) ? copyBytes(src.DST) : src.DST,
-    ...src.encodeDST === void 0 ? {} : { encodeDST: isBytes2(src.encodeDST) ? copyBytes(src.encodeDST) : src.encodeDST }
-  });
-  const safeDefaults = snapshot(defaults);
-  function map(num) {
-    return Point.fromAffine(mapToCurve(num));
-  }
-  function clear(initial) {
-    const P = initial.clearCofactor();
-    if (P.equals(Point.ZERO))
-      return Point.ZERO;
-    P.assertValidity();
-    return P;
-  }
-  return Object.freeze({
-    get defaults() {
-      return snapshot(safeDefaults);
-    },
-    Point,
-    hashToCurve(msg, options) {
-      const opts = Object.assign({}, safeDefaults, options);
-      const u = hash_to_field(msg, 2, opts);
-      const u0 = map(u[0]);
-      const u1 = map(u[1]);
-      return clear(u0.add(u1));
-    },
-    encodeToCurve(msg, options) {
-      const optsDst = safeDefaults.encodeDST ? { DST: safeDefaults.encodeDST } : {};
-      const opts = Object.assign({}, safeDefaults, optsDst, options);
-      const u = hash_to_field(msg, 1, opts);
-      const u0 = map(u[0]);
-      return clear(u0);
-    },
-    /** See {@link H2CHasher} */
-    mapToCurve(scalars) {
-      if (safeDefaults.m === 1) {
-        if (typeof scalars !== "bigint")
-          throw new Error("expected bigint (m=1)");
-        return clear(map([scalars]));
-      }
-      if (!Array.isArray(scalars))
-        throw new Error("expected array of bigints");
-      for (const i of scalars)
-        if (typeof i !== "bigint")
-          throw new Error("expected array of bigints");
-      return clear(map(scalars));
-    },
-    // hash_to_scalar can produce 0: https://www.rfc-editor.org/errata/eid8393
-    // RFC 9380, draft-irtf-cfrg-bbs-signatures-08. Default scalar DST is the shared generic
-    // `HashToScalar-` prefix above unless the caller overrides it per invocation.
-    hashToScalar(msg, options) {
-      const N = Point.Fn.ORDER;
-      const opts = Object.assign({}, safeDefaults, { p: N, m: 1, DST: _DST_scalar }, options);
-      return hash_to_field(msg, 1, opts)[0][0];
-    }
-  });
-}
-
 // ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/frost.js
 var validateSigners = (signers) => {
   if (!Number.isSafeInteger(signers.min) || !Number.isSafeInteger(signers.max))
@@ -2551,11 +2029,11 @@ function createFROST(opts) {
   });
   validatePointCons(opts.Point);
   const { Point } = opts;
-  const Fn2 = opts.Fn === void 0 ? Point.Fn : opts.Fn;
+  const Fn = opts.Fn === void 0 ? Point.Fn : opts.Fn;
   const hashBytes = opts.hash;
   const hashToScalar = opts.hashToScalar === void 0 ? (msg, opts2 = { DST: new Uint8Array() }) => {
     const t = hashBytes(concatBytes2(opts2.DST, msg));
-    return Fn2.create(Fn2.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t));
+    return Fn.create(Fn.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t));
   } : opts.hashToScalar;
   const H1Prefix = utf8ToBytes(opts.H1 !== void 0 ? opts.H1 : opts.name + "rho");
   const H2Prefix = utf8ToBytes(opts.H2 !== void 0 ? opts.H2 : opts.name + "chal");
@@ -2572,8 +2050,8 @@ function createFROST(opts) {
   const HDKG = (msg) => hashToScalar(msg, { DST: HDKGPrefix });
   const HID = (msg) => hashToScalar(msg, { DST: HIDPrefix });
   const randomScalar = (rng = randomBytes2) => {
-    const t = mapHashToField(rng(getMinHashLength(Fn2.ORDER)), Fn2.ORDER, Fn2.isLE);
-    return Fn2.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t);
+    const t = mapHashToField(rng(getMinHashLength(Fn.ORDER)), Fn.ORDER, Fn.isLE);
+    return Fn.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t);
   };
   const serializePoint = (p) => p.toBytes();
   const parsePoint = (bytes) => {
@@ -2584,18 +2062,18 @@ function createFROST(opts) {
   };
   const nonceCommitments = (identifier, nonces) => ({
     identifier,
-    hiding: serializePoint(Point.BASE.multiply(Fn2.fromBytes(nonces.hiding))),
-    binding: serializePoint(Point.BASE.multiply(Fn2.fromBytes(nonces.binding)))
+    hiding: serializePoint(Point.BASE.multiply(Fn.fromBytes(nonces.hiding))),
+    binding: serializePoint(Point.BASE.multiply(Fn.fromBytes(nonces.binding)))
   });
   const adjustPoint = opts.adjustPoint === void 0 ? (n) => n : opts.adjustPoint;
   const validateIdentifier = (n) => {
-    if (!Fn2.isValid(n) || Fn2.is0(n))
+    if (!Fn.isValid(n) || Fn.is0(n))
       throw new Error("Invalid identifier " + n);
     return n;
   };
-  const serializeIdentifier = (id) => bytesToHex2(Fn2.toBytes(validateIdentifier(id)));
+  const serializeIdentifier = (id) => bytesToHex2(Fn.toBytes(validateIdentifier(id)));
   const parseIdentifier = (id) => {
-    const n = validateIdentifier(Fn2.fromBytes(hexToBytes2(id)));
+    const n = validateIdentifier(Fn.fromBytes(hexToBytes2(id)));
     if (serializeIdentifier(n) !== id)
       throw new Error("expected canonical identifier hex");
     return n;
@@ -2604,7 +2082,7 @@ function createFROST(opts) {
     // RFC 9591 Appendix A encodes signatures canonically as
     // SerializeElement(R) || SerializeScalar(z).
     encode: (R, z) => {
-      let res = concatBytes2(serializePoint(R), Fn2.toBytes(z));
+      let res = concatBytes2(serializePoint(R), Fn.toBytes(z));
       if (opts.adjustTx)
         res = opts.adjustTx.encode(res);
       return res;
@@ -2612,8 +2090,8 @@ function createFROST(opts) {
     decode: (sig) => {
       if (opts.adjustTx)
         sig = opts.adjustTx.decode(sig);
-      const R = parsePoint(sig.subarray(0, -Fn2.BYTES));
-      const z = Fn2.fromBytes(sig.subarray(-Fn2.BYTES));
+      const R = parsePoint(sig.subarray(0, -Fn.BYTES));
+      const z = Fn.fromBytes(sig.subarray(-Fn.BYTES));
       return { R, z };
     }
   };
@@ -2626,7 +2104,7 @@ function createFROST(opts) {
   };
   const nrErr = "roots are unavailable in FROST polynomial mode";
   const noRoots = {
-    info: { G: Fn2.ZERO, oddFactor: Fn2.ZERO, powerOfTwo: 0 },
+    info: { G: Fn.ZERO, oddFactor: Fn.ZERO, powerOfTwo: 0 },
     roots() {
       throw new Error(nrErr);
     },
@@ -2642,7 +2120,7 @@ function createFROST(opts) {
     clear() {
     }
   };
-  const Poly = poly(Fn2, noRoots);
+  const Poly = poly(Fn, noRoots);
   const msm = (points, scalars) => pippenger(Point, points, scalars);
   const polynomialEvaluate = (x, coeffs) => {
     if (!coeffs.length)
@@ -2651,22 +2129,22 @@ function createFROST(opts) {
   };
   const deriveInterpolatingValue = (L, xi) => {
     const err = "invalid parameters";
-    if (!L.some((x) => Fn2.eql(x, xi)))
+    if (!L.some((x) => Fn.eql(x, xi)))
       throw new Error(err);
     const Lset = new Set(L);
     if (Lset.size !== L.length)
       throw new Error(err);
     if (!Lset.has(xi))
       throw new Error(err);
-    let num = Fn2.ONE;
-    let den = Fn2.ONE;
+    let num = Fn.ONE;
+    let den = Fn.ONE;
     for (const x of L) {
-      if (Fn2.eql(x, xi))
+      if (Fn.eql(x, xi))
         continue;
-      num = Fn2.mul(num, x);
-      den = Fn2.mul(den, Fn2.sub(x, xi));
+      num = Fn.mul(num, x);
+      den = Fn.mul(den, Fn.sub(x, xi));
     }
-    return Fn2.div(num, den);
+    return Fn.div(num, den);
   };
   const evalutateVSS = (identifier, commitment) => {
     const monomial = Poly.monomial.basis(identifier, commitment.length);
@@ -2674,7 +2152,7 @@ function createFROST(opts) {
   };
   const generateSecretPolynomial = (signers, secret, coeffs, rng = randomBytes2) => {
     validateSigners(signers);
-    const secretScalar = secret === void 0 ? randomScalar(rng) : Fn2.fromBytes(secret);
+    const secretScalar = secret === void 0 ? randomScalar(rng) : Fn.fromBytes(secret);
     if (!coeffs) {
       coeffs = [];
       for (let i = 0; i < signers.min - 1; i++)
@@ -2687,14 +2165,14 @@ function createFROST(opts) {
     return { coefficients, commitment, secret: secretScalar };
   };
   const ProofOfKnowledge = {
-    challenge: (id, verKey, R) => HDKG(concatBytes2(Fn2.toBytes(id), serializePoint(verKey), serializePoint(R))),
+    challenge: (id, verKey, R) => HDKG(concatBytes2(Fn.toBytes(id), serializePoint(verKey), serializePoint(R))),
     compute(id, coefficents, commitments, rng = randomBytes2) {
       if (coefficents.length < 1)
         throw new Error("coefficients should have at least one element");
       const { point: R, scalar: k } = genPointScalarPair(rng);
       const verKey = commitments[0];
       const c = this.challenge(id, verKey, R);
-      const mu = Fn2.add(k, Fn2.mul(coefficents[0], c));
+      const mu = Fn.add(k, Fn.mul(coefficents[0], c));
       return Signature.encode(R, mu);
     },
     validate(id, commitment, proof) {
@@ -2717,7 +2195,7 @@ function createFROST(opts) {
       const { point: R, scalar: r } = genPointScalarPair(rng);
       const PK = Point.BASE.multiply(sk);
       const c = this.challenge(R, PK, msg);
-      const z = Fn2.add(r, Fn2.mul(c, sk));
+      const z = Fn.add(r, Fn.mul(c, sk));
       return [R, z];
     },
     verify(msg, R, z, PK) {
@@ -2752,7 +2230,7 @@ function createFROST(opts) {
       return serializeIdentifier(HID(utf8ToBytes(s)));
     }
   };
-  const generateNonce = (secret, rng = randomBytes2) => H3(concatBytes2(rng(32), Fn2.toBytes(secret)));
+  const generateNonce = (secret, rng = randomBytes2) => H3(concatBytes2(rng(32), Fn.toBytes(secret)));
   const getGroupCommitment = (GPK, commitmentList, msg) => {
     const CL = commitmentList.map((i) => [
       i.identifier,
@@ -2763,12 +2241,12 @@ function createFROST(opts) {
     CL.sort((a, b) => a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0);
     const Cbytes = [];
     for (const [_, id, hC, bC] of CL)
-      Cbytes.push(Fn2.toBytes(id), serializePoint(hC), serializePoint(bC));
+      Cbytes.push(Fn.toBytes(id), serializePoint(hC), serializePoint(bC));
     const encodedCommitmentHash = H5(concatBytes2(...Cbytes));
     const rhoPrefix = concatBytes2(serializePoint(GPK), H4(msg), encodedCommitmentHash);
     const bindingFactors = {};
     for (const [i, id] of CL) {
-      bindingFactors[i] = H1(concatBytes2(rhoPrefix, Fn2.toBytes(id)));
+      bindingFactors[i] = H1(concatBytes2(rhoPrefix, Fn.toBytes(id)));
     }
     const points = [];
     const scalars = [];
@@ -2776,7 +2254,7 @@ function createFROST(opts) {
       if (Point.ZERO.equals(hC) || Point.ZERO.equals(bC))
         throw new Error("infinity commitment");
       points.push(hC, bC);
-      scalars.push(Fn2.ONE, bindingFactors[i]);
+      scalars.push(Fn.ONE, bindingFactors[i]);
     }
     const groupCommitment = msm(points, scalars);
     const identifiers = CL.map((i) => i[1]);
@@ -2836,7 +2314,7 @@ function createFROST(opts) {
             parsePoint(c);
           if (res[p.identifier])
             throw new Error("Duplicate id=" + id);
-          const signingShare = Fn2.toBytes(polynomialEvaluate(id, secret.coefficients));
+          const signingShare = Fn.toBytes(polynomialEvaluate(id, secret.coefficients));
           res[p.identifier] = {
             identifier: serializeIdentifier(secret.identifier),
             signingShare
@@ -2867,7 +2345,7 @@ function createFROST(opts) {
         }
         if (Object.keys(merged).length !== round1.length)
           throw new Error("mismatch identifiers between rounds");
-        let signingShare = Fn2.ZERO;
+        let signingShare = Fn.ZERO;
         if (secret.commitment.length !== secret.signers.min)
           throw new Error("wrong commitments length");
         const localCommitment = secret.commitment.map(parsePoint);
@@ -2882,16 +2360,16 @@ function createFROST(opts) {
           if (!v.signingShare || !v.commitment)
             throw new Error("mismatch identifiers");
           const id = parseIdentifier(k);
-          const signingSharePart = Fn2.fromBytes(v.signingShare);
+          const signingSharePart = Fn.fromBytes(v.signingShare);
           const commitment = v.commitment.map(parsePoint);
           validateSecretShare(secret.identifier, commitment, signingSharePart);
-          signingShare = Fn2.add(signingShare, signingSharePart);
+          signingShare = Fn.add(signingShare, signingSharePart);
           const idSer = serializeIdentifier(id);
           if (commitments[idSer])
             throw new Error("duplicated id=" + idSer);
           commitments[idSer] = v.commitment;
         }
-        signingShare = Fn2.add(signingShare, localShare);
+        signingShare = Fn.add(signingShare, localShare);
         const mergedCommitment = new Array(secret.signers.min).fill(Point.ZERO);
         for (const k in commitments) {
           const v = commitments[k];
@@ -2912,7 +2390,7 @@ function createFROST(opts) {
           },
           secret: {
             identifier: serializeIdentifier(secret.identifier),
-            signingShare: Fn2.toBytes(signingShare)
+            signingShare: Fn.toBytes(signingShare)
           }
         };
         if (opts.adjustDKG)
@@ -2960,7 +2438,7 @@ function createFROST(opts) {
         verifyingShares[id] = serializePoint(Point.BASE.multiply(signingShare));
         secretShares[id] = {
           identifier: id,
-          signingShare: Fn2.toBytes(signingShare)
+          signingShare: Fn.toBytes(signingShare)
         };
       }
       return {
@@ -2976,7 +2454,7 @@ function createFROST(opts) {
     validateSecret(secret, pub) {
       const id = parseIdentifier(secret.identifier);
       const commitment = pub.commitments.map(parsePoint);
-      const signingShare = Fn2.fromBytes(secret.signingShare);
+      const signingShare = Fn.fromBytes(secret.signingShare);
       validateSecretShare(id, commitment, signingShare);
     },
     // Actual signing
@@ -2987,19 +2465,19 @@ function createFROST(opts) {
     // round1 for signing.
     // But then each participant needs to remember generated shares
     commit(secret, rng = randomBytes2) {
-      const secretScalar = Fn2.fromBytes(secret.signingShare);
+      const secretScalar = Fn.fromBytes(secret.signingShare);
       const hiding = generateNonce(secretScalar, rng);
       const binding = generateNonce(secretScalar, rng);
-      const nonces = { hiding: Fn2.toBytes(hiding), binding: Fn2.toBytes(binding) };
+      const nonces = { hiding: Fn.toBytes(hiding), binding: Fn.toBytes(binding) };
       return { nonces, commitments: nonceCommitments(secret.identifier, nonces) };
     },
     // Round2: sign. Each participant creates a signature share from the secret
     // and the selected nonce commitments.
     signShare(secret, pub, nonces, commitmentList, msg) {
       validateCommitmentsNum(pub.signers, commitmentList.length);
-      const hidingNonce0 = Fn2.fromBytes(nonces.hiding);
-      const bindingNonce0 = Fn2.fromBytes(nonces.binding);
-      if (Fn2.is0(hidingNonce0) || Fn2.is0(bindingNonce0))
+      const hidingNonce0 = Fn.fromBytes(nonces.hiding);
+      const bindingNonce0 = Fn.fromBytes(nonces.binding);
+      if (Fn.is0(hidingNonce0) || Fn.is0(bindingNonce0))
         throw new Error("signing nonces already used");
       const expectedCommitment = {
         identifier: secret.identifier,
@@ -3015,14 +2493,14 @@ function createFROST(opts) {
         secret = opts.adjustSecret(secret, pub);
       if (opts.adjustPublic)
         pub = opts.adjustPublic(pub);
-      const SK = Fn2.fromBytes(secret.signingShare);
+      const SK = Fn.fromBytes(secret.signingShare);
       const { lambda, challenge, bindingFactor, groupCommitment } = prepareShare(pub.commitments[0], commitmentList, msg, secret.identifier);
       const N = opts.adjustNonces ? opts.adjustNonces(groupCommitment, nonces) : nonces;
-      const hidingNonce = opts.adjustNonces ? Fn2.fromBytes(N.hiding) : hidingNonce0;
-      const bindingNonce = opts.adjustNonces ? Fn2.fromBytes(N.binding) : bindingNonce0;
-      const t = Fn2.mul(Fn2.mul(lambda, SK), challenge);
-      const t2 = Fn2.mul(bindingNonce, bindingFactor);
-      const r = Fn2.toBytes(Fn2.add(Fn2.add(hidingNonce, t2), t));
+      const hidingNonce = opts.adjustNonces ? Fn.fromBytes(N.hiding) : hidingNonce0;
+      const bindingNonce = opts.adjustNonces ? Fn.fromBytes(N.binding) : bindingNonce0;
+      const t = Fn.mul(Fn.mul(lambda, SK), challenge);
+      const t2 = Fn.mul(bindingNonce, bindingFactor);
+      const r = Fn.toBytes(Fn.add(Fn.add(hidingNonce, t2), t));
       nonces.hiding.fill(0);
       nonces.binding.fill(0);
       return r;
@@ -3041,8 +2519,8 @@ function createFROST(opts) {
       let commShare = hidingNonceCommitment.add(bindingNonceCommitment.multiply(bindingFactor));
       if (opts.adjustGroupCommitmentShare)
         commShare = opts.adjustGroupCommitmentShare(groupCommitment, commShare);
-      const l = Point.BASE.multiply(Fn2.fromBytes(sigShare));
-      const r = commShare.add(PK.multiply(Fn2.mul(challenge, lambda)));
+      const l = Point.BASE.multiply(Fn.fromBytes(sigShare));
+      const r = commShare.add(PK.multiply(Fn.mul(challenge, lambda)));
       return l.equals(r);
     },
     // Aggregate multiple signature shares into groupSignature
@@ -3063,9 +2541,9 @@ function createFROST(opts) {
       }
       const GPK = parsePoint(pub.commitments[0]);
       const { groupCommitment } = getGroupCommitment(GPK, commitmentList, msg);
-      let z = Fn2.ZERO;
+      let z = Fn.ZERO;
       for (const id of ids)
-        z = Fn2.add(z, Fn2.fromBytes(sigShares[id]));
+        z = Fn.add(z, Fn.fromBytes(sigShares[id]));
       if (!Basic.verify(msg, groupCommitment, z, GPK)) {
         const cheaters = [];
         for (const id of ids) {
@@ -3078,7 +2556,7 @@ function createFROST(opts) {
     },
     // Basic sign/verify using single key
     sign(msg, secretKey) {
-      let sk = Fn2.fromBytes(secretKey);
+      let sk = Fn.fromBytes(secretKey);
       if (opts.adjustScalar)
         sk = opts.adjustScalar(sk);
       const [R, z] = Basic.sign(msg, sk);
@@ -3102,21 +2580,21 @@ function createFROST(opts) {
         if (seen[id])
           throw new Error("duplicated id=" + id);
         seen[id] = true;
-        points.push([idNum, Fn2.fromBytes(s.signingShare)]);
+        points.push([idNum, Fn.fromBytes(s.signingShare)]);
       }
       const xCoords = points.map(([x]) => x);
-      let res = Fn2.ZERO;
+      let res = Fn.ZERO;
       for (const [x, y] of points)
-        res = Fn2.add(res, Fn2.mul(y, deriveInterpolatingValue(xCoords, x)));
-      return Fn2.toBytes(res);
+        res = Fn.add(res, Fn.mul(y, deriveInterpolatingValue(xCoords, x)));
+      return Fn.toBytes(res);
     },
     // Utils
     utils: Object.freeze({
-      Fn: Fn2,
+      Fn,
       // NOTE: we re-export it here because it may be different from Point.Fn (ed448 is fun!)
       // Test RNG overrides still go through noble's non-zero scalar derivation; this is not a raw
       // "bytes become scalar" escape hatch.
-      randomScalar: (rng = randomBytes2) => Fn2.toBytes(genPointScalarPair(rng).scalar),
+      randomScalar: (rng = randomBytes2) => Fn.toBytes(genPointScalarPair(rng).scalar),
       generateSecretPolynomial: (signers, secret, coeffs, rng) => {
         const res = generateSecretPolynomial(signers, secret, coeffs, rng);
         return { ...res, commitment: res.commitment.map(serializePoint) };
@@ -3126,781 +2604,6 @@ function createFROST(opts) {
   return Object.freeze(frost);
 }
 
-// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/montgomery.js
-var _0n5 = BigInt(0);
-var _1n5 = BigInt(1);
-var _2n3 = BigInt(2);
-function validateOpts(curve) {
-  validateObject(curve, {
-    P: "bigint",
-    type: "string",
-    adjustScalarBytes: "function",
-    powPminus2: "function"
-  }, {
-    randomBytes: "function"
-  });
-  return Object.freeze({ ...curve });
-}
-function montgomery(curveDef) {
-  const CURVE = validateOpts(curveDef);
-  const { P, type, adjustScalarBytes: adjustScalarBytes2, powPminus2, randomBytes: rand } = CURVE;
-  const is25519 = type === "x25519";
-  if (!is25519 && type !== "x448")
-    throw new Error("invalid type");
-  const randomBytes_ = rand === void 0 ? randomBytes2 : rand;
-  const montgomeryBits = is25519 ? 255 : 448;
-  const fieldLen = is25519 ? 32 : 56;
-  const Gu = is25519 ? BigInt(9) : BigInt(5);
-  const a24 = is25519 ? BigInt(121665) : BigInt(39081);
-  const minScalar = is25519 ? _2n3 ** BigInt(254) : _2n3 ** BigInt(447);
-  const maxAdded = is25519 ? BigInt(8) * _2n3 ** BigInt(251) - _1n5 : BigInt(4) * _2n3 ** BigInt(445) - _1n5;
-  const maxScalar = minScalar + maxAdded + _1n5;
-  const modP = (n) => mod(n, P);
-  const GuBytes = encodeU(Gu);
-  function encodeU(u) {
-    return numberToBytesLE(modP(u), fieldLen);
-  }
-  function decodeU(u) {
-    const _u = copyBytes(abytes2(u, fieldLen, "uCoordinate"));
-    if (is25519)
-      _u[31] &= 127;
-    return modP(bytesToNumberLE(_u));
-  }
-  function decodeScalar(scalar) {
-    return bytesToNumberLE(adjustScalarBytes2(copyBytes(abytes2(scalar, fieldLen, "scalar"))));
-  }
-  function scalarMult(scalar, u) {
-    const pu = montgomeryLadder(decodeU(u), decodeScalar(scalar));
-    if (pu === _0n5)
-      throw new Error("invalid private or public key received");
-    return encodeU(pu);
-  }
-  function scalarMultBase(scalar) {
-    return scalarMult(scalar, GuBytes);
-  }
-  const getPublicKey = scalarMultBase;
-  const getSharedSecret = scalarMult;
-  function cswap(swap, x_2, x_3) {
-    const dummy = modP(swap * (x_2 - x_3));
-    x_2 = modP(x_2 - dummy);
-    x_3 = modP(x_3 + dummy);
-    return { x_2, x_3 };
-  }
-  function montgomeryLadder(u, scalar) {
-    aInRange("u", u, _0n5, P);
-    aInRange("scalar", scalar, minScalar, maxScalar);
-    const k = scalar;
-    const x_1 = u;
-    let x_2 = _1n5;
-    let z_2 = _0n5;
-    let x_3 = u;
-    let z_3 = _1n5;
-    let swap = _0n5;
-    for (let t = BigInt(montgomeryBits - 1); t >= _0n5; t--) {
-      const k_t = k >> t & _1n5;
-      swap ^= k_t;
-      ({ x_2, x_3 } = cswap(swap, x_2, x_3));
-      ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));
-      swap = k_t;
-      const A = x_2 + z_2;
-      const AA = modP(A * A);
-      const B = x_2 - z_2;
-      const BB = modP(B * B);
-      const E = AA - BB;
-      const C = x_3 + z_3;
-      const D = x_3 - z_3;
-      const DA = modP(D * A);
-      const CB = modP(C * B);
-      const dacb = DA + CB;
-      const da_cb = DA - CB;
-      x_3 = modP(dacb * dacb);
-      z_3 = modP(x_1 * modP(da_cb * da_cb));
-      x_2 = modP(AA * BB);
-      z_2 = modP(E * (AA + modP(a24 * E)));
-    }
-    ({ x_2, x_3 } = cswap(swap, x_2, x_3));
-    ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));
-    const z2 = powPminus2(z_2);
-    return modP(x_2 * z2);
-  }
-  const lengths = {
-    secretKey: fieldLen,
-    publicKey: fieldLen,
-    seed: fieldLen
-  };
-  const randomSecretKey = (seed) => {
-    seed = seed === void 0 ? randomBytes_(fieldLen) : seed;
-    abytes2(seed, lengths.seed, "seed");
-    return seed;
-  };
-  const utils = { randomSecretKey };
-  Object.freeze(lengths);
-  Object.freeze(utils);
-  return Object.freeze({
-    keygen: createKeygen(randomSecretKey, getPublicKey),
-    getSharedSecret,
-    getPublicKey,
-    scalarMult,
-    scalarMultBase,
-    utils,
-    GuBytes: GuBytes.slice(),
-    lengths
-  });
-}
-
-// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/oprf.js
-var _DST_scalarBytes = /* @__PURE__ */ asciiToBytes(_DST_scalar);
-function createOPRF(opts) {
-  validateObject(opts, {
-    name: "string",
-    hash: "function",
-    hashToScalar: "function",
-    hashToGroup: "function"
-  });
-  validatePointCons(opts.Point);
-  const { name, Point, hash } = opts;
-  const { Fn: Fn2 } = Point;
-  const hashToGroup = (msg, ctx) => opts.hashToGroup(msg, {
-    DST: concatBytes2(asciiToBytes("HashToGroup-"), ctx)
-  });
-  const hashToScalarPrefixed = (msg, ctx) => opts.hashToScalar(msg, { DST: concatBytes2(_DST_scalarBytes, ctx) });
-  const randomScalar = (rng = randomBytes2) => {
-    const t = mapHashToField(rng(getMinHashLength(Fn2.ORDER)), Fn2.ORDER, Fn2.isLE);
-    return Fn2.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t);
-  };
-  const msm = (points, scalars) => pippenger(Point, points, scalars);
-  const getCtx = (mode) => concatBytes2(asciiToBytes("OPRFV1-"), new Uint8Array([mode]), asciiToBytes("-" + name));
-  const ctxOPRF = getCtx(0);
-  const ctxVOPRF = getCtx(1);
-  const ctxPOPRF = getCtx(2);
-  function encode(...args) {
-    const res2 = [];
-    for (const a of args) {
-      if (typeof a === "number")
-        res2.push(numberToBytesBE(a, 2));
-      else if (typeof a === "string")
-        res2.push(asciiToBytes(a));
-      else {
-        abytes2(a);
-        res2.push(numberToBytesBE(a.length, 2), a);
-      }
-    }
-    return concatBytes2(...res2);
-  }
-  const inputBytes = (title, bytes) => {
-    abytes2(bytes, void 0, title);
-    if (bytes.length > 65535)
-      throw new Error(`"${title}" expected Uint8Array of length <= 65535, got length=${bytes.length}`);
-    return bytes;
-  };
-  const hashInput = (...bytes) => hash(encode(...bytes, "Finalize"));
-  function getTranscripts(B, C, D, ctx) {
-    const Bm = B.toBytes();
-    const seed = hash(encode(Bm, concatBytes2(asciiToBytes("Seed-"), ctx)));
-    const res2 = [];
-    for (let i = 0; i < C.length; i++) {
-      const Ci = C[i].toBytes();
-      const Di = D[i].toBytes();
-      const di = hashToScalarPrefixed(encode(seed, i, Ci, Di, "Composite"), ctx);
-      res2.push(di);
-    }
-    return res2;
-  }
-  function computeComposites(B, C, D, ctx) {
-    const T = getTranscripts(B, C, D, ctx);
-    const M = msm(C, T);
-    const Z = msm(D, T);
-    return { M, Z };
-  }
-  function computeCompositesFast(k, B, C, D, ctx) {
-    const T = getTranscripts(B, C, D, ctx);
-    const M = msm(C, T);
-    const Z = M.multiply(k);
-    return { M, Z };
-  }
-  function challengeTranscript(B, M, Z, t2, t3, ctx) {
-    const [Bm, a0, a1, a2, a3] = [B, M, Z, t2, t3].map((i) => i.toBytes());
-    return hashToScalarPrefixed(encode(Bm, a0, a1, a2, a3, "Challenge"), ctx);
-  }
-  function generateProof(ctx, k, B, C, D, rng) {
-    const { M, Z } = computeCompositesFast(k, B, C, D, ctx);
-    const r = randomScalar(rng);
-    const t2 = Point.BASE.multiply(r);
-    const t3 = M.multiply(r);
-    const c = challengeTranscript(B, M, Z, t2, t3, ctx);
-    const s = Fn2.sub(r, Fn2.mul(c, k));
-    return concatBytes2(...[c, s].map((i) => Fn2.toBytes(i)));
-  }
-  function verifyProof(ctx, B, C, D, proof) {
-    abytes2(proof, 2 * Fn2.BYTES);
-    const { M, Z } = computeComposites(B, C, D, ctx);
-    const [c, s] = [proof.subarray(0, Fn2.BYTES), proof.subarray(Fn2.BYTES)].map((f) => Fn2.fromBytes(f));
-    const t2 = Point.BASE.multiply(s).add(B.multiply(c));
-    const t3 = M.multiply(s).add(Z.multiply(c));
-    const expectedC = challengeTranscript(B, M, Z, t2, t3, ctx);
-    if (!Fn2.eql(c, expectedC))
-      throw new Error("proof verification failed");
-  }
-  function generateKeyPair() {
-    const skS = randomScalar();
-    const pkS = Point.BASE.multiply(skS);
-    return { secretKey: Fn2.toBytes(skS), publicKey: pkS.toBytes() };
-  }
-  function deriveKeyPair(ctx, seed, info) {
-    abytes2(seed, 32, "seed");
-    info = inputBytes("keyInfo", info);
-    const dst = concatBytes2(asciiToBytes("DeriveKeyPair"), ctx);
-    const msg = concatBytes2(seed, encode(info), Uint8Array.of(0));
-    for (let counter = 0; counter <= 255; counter++) {
-      msg[msg.length - 1] = counter;
-      const skS = opts.hashToScalar(msg, { DST: dst });
-      if (Fn2.is0(skS))
-        continue;
-      return {
-        secretKey: Fn2.toBytes(skS),
-        publicKey: Point.BASE.multiply(skS).toBytes()
-      };
-    }
-    throw new Error("Cannot derive key");
-  }
-  const wirePoint = (label, bytes) => {
-    const point = Point.fromBytes(bytes);
-    if (point.equals(Point.ZERO))
-      throw new Error(label + " point at infinity");
-    return point;
-  };
-  function blind(ctx, input, rng = randomBytes2) {
-    input = inputBytes("input", input);
-    const blind2 = randomScalar(rng);
-    const inputPoint = hashToGroup(input, ctx);
-    if (inputPoint.equals(Point.ZERO))
-      throw new Error("Input point at infinity");
-    const blinded = inputPoint.multiply(blind2);
-    return { blind: Fn2.toBytes(blind2), blinded: blinded.toBytes() };
-  }
-  function evaluate(ctx, secretKey, input) {
-    input = inputBytes("input", input);
-    const skS = Fn2.fromBytes(secretKey);
-    const inputPoint = hashToGroup(input, ctx);
-    if (inputPoint.equals(Point.ZERO))
-      throw new Error("Input point at infinity");
-    const unblinded = inputPoint.multiply(skS).toBytes();
-    return hashInput(input, unblinded);
-  }
-  const oprf = Object.freeze({
-    generateKeyPair,
-    deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxOPRF, seed, keyInfo),
-    blind: (input, rng = randomBytes2) => blind(ctxOPRF, input, rng),
-    blindEvaluate(secretKey, blindedPoint) {
-      const skS = Fn2.fromBytes(secretKey);
-      const elm = wirePoint("blinded", blindedPoint);
-      return elm.multiply(skS).toBytes();
-    },
-    finalize(input, blindBytes, evaluatedBytes) {
-      input = inputBytes("input", input);
-      const blind2 = Fn2.fromBytes(blindBytes);
-      const evalPoint = wirePoint("evaluated", evaluatedBytes);
-      const unblinded = evalPoint.multiply(Fn2.inv(blind2)).toBytes();
-      return hashInput(input, unblinded);
-    },
-    evaluate: (secretKey, input) => evaluate(ctxOPRF, secretKey, input)
-  });
-  const voprf = Object.freeze({
-    generateKeyPair,
-    deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxVOPRF, seed, keyInfo),
-    blind: (input, rng = randomBytes2) => blind(ctxVOPRF, input, rng),
-    blindEvaluateBatch(secretKey, publicKey, blinded, rng = randomBytes2) {
-      if (!Array.isArray(blinded))
-        throw new Error("expected array");
-      const skS = Fn2.fromBytes(secretKey);
-      const pkS = wirePoint("public key", publicKey);
-      const blindedPoints = blinded.map((i) => wirePoint("blinded", i));
-      const evaluated = blindedPoints.map((i) => i.multiply(skS));
-      const proof = generateProof(ctxVOPRF, skS, pkS, blindedPoints, evaluated, rng);
-      return { evaluated: evaluated.map((i) => i.toBytes()), proof };
-    },
-    blindEvaluate(secretKey, publicKey, blinded, rng = randomBytes2) {
-      const res2 = this.blindEvaluateBatch(secretKey, publicKey, [blinded], rng);
-      return { evaluated: res2.evaluated[0], proof: res2.proof };
-    },
-    finalizeBatch(items, publicKey, proof) {
-      if (!Array.isArray(items))
-        throw new Error("expected array");
-      const pkS = wirePoint("public key", publicKey);
-      const blindedPoints = items.map((i) => wirePoint("blinded", i.blinded));
-      const evalPoints = items.map((i) => wirePoint("evaluated", i.evaluated));
-      verifyProof(ctxVOPRF, pkS, blindedPoints, evalPoints, proof);
-      return items.map((i) => oprf.finalize(i.input, i.blind, i.evaluated));
-    },
-    finalize(input, blind2, evaluated, blinded, publicKey, proof) {
-      return this.finalizeBatch([{ input, blind: blind2, evaluated, blinded }], publicKey, proof)[0];
-    },
-    evaluate: (secretKey, input) => evaluate(ctxVOPRF, secretKey, input)
-  });
-  const poprf = (info) => {
-    info = inputBytes("info", info);
-    const m = hashToScalarPrefixed(encode("Info", info), ctxPOPRF);
-    const T = Point.BASE.multiply(m);
-    return Object.freeze({
-      generateKeyPair,
-      deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxPOPRF, seed, keyInfo),
-      blind(input, publicKey, rng = randomBytes2) {
-        input = inputBytes("input", input);
-        const pkS = wirePoint("public key", publicKey);
-        const tweakedKey = T.add(pkS);
-        if (tweakedKey.equals(Point.ZERO))
-          throw new Error("tweakedKey point at infinity");
-        const blind2 = randomScalar(rng);
-        const inputPoint = hashToGroup(input, ctxPOPRF);
-        if (inputPoint.equals(Point.ZERO))
-          throw new Error("Input point at infinity");
-        const blindedPoint = inputPoint.multiply(blind2);
-        return {
-          blind: Fn2.toBytes(blind2),
-          blinded: blindedPoint.toBytes(),
-          tweakedKey: tweakedKey.toBytes()
-        };
-      },
-      blindEvaluateBatch(secretKey, blinded, rng = randomBytes2) {
-        if (!Array.isArray(blinded))
-          throw new Error("expected array");
-        const skS = Fn2.fromBytes(secretKey);
-        const t = Fn2.add(skS, m);
-        const invT = Fn2.inv(t);
-        const blindedPoints = blinded.map((i) => wirePoint("blinded", i));
-        const evalPoints = blindedPoints.map((i) => i.multiply(invT));
-        const tweakedKey = Point.BASE.multiply(t);
-        const proof = generateProof(ctxPOPRF, t, tweakedKey, evalPoints, blindedPoints, rng);
-        return { evaluated: evalPoints.map((i) => i.toBytes()), proof };
-      },
-      blindEvaluate(secretKey, blinded, rng = randomBytes2) {
-        const res2 = this.blindEvaluateBatch(secretKey, [blinded], rng);
-        return { evaluated: res2.evaluated[0], proof: res2.proof };
-      },
-      finalizeBatch(items, proof, tweakedKey) {
-        if (!Array.isArray(items))
-          throw new Error("expected array");
-        const inputs = items.map((i) => inputBytes("input", i.input));
-        const evalPoints = items.map((i) => wirePoint("evaluated", i.evaluated));
-        verifyProof(ctxPOPRF, wirePoint("tweakedKey", tweakedKey), evalPoints, items.map((i) => wirePoint("blinded", i.blinded)), proof);
-        return items.map((i, j) => {
-          const blind2 = Fn2.fromBytes(i.blind);
-          const point = evalPoints[j].multiply(Fn2.inv(blind2)).toBytes();
-          return hashInput(inputs[j], info, point);
-        });
-      },
-      finalize(input, blind2, evaluated, blinded, proof, tweakedKey) {
-        return this.finalizeBatch([{ input, blind: blind2, evaluated, blinded }], proof, tweakedKey)[0];
-      },
-      evaluate(secretKey, input) {
-        input = inputBytes("input", input);
-        const skS = Fn2.fromBytes(secretKey);
-        const inputPoint = hashToGroup(input, ctxPOPRF);
-        if (inputPoint.equals(Point.ZERO))
-          throw new Error("Input point at infinity");
-        const t = Fn2.add(skS, m);
-        const invT = Fn2.inv(t);
-        const unblinded = inputPoint.multiply(invT).toBytes();
-        return hashInput(input, info, unblinded);
-      }
-    });
-  };
-  const res = { name, oprf, voprf, poprf, __tests: Object.freeze({ Fn: Fn2 }) };
-  return Object.freeze(res);
-}
-
-// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/ed25519.js
-var _0n6 = /* @__PURE__ */ BigInt(0);
-var _1n6 = /* @__PURE__ */ BigInt(1);
-var _2n4 = /* @__PURE__ */ BigInt(2);
-var _3n2 = /* @__PURE__ */ BigInt(3);
-var _5n2 = /* @__PURE__ */ BigInt(5);
-var _8n3 = /* @__PURE__ */ BigInt(8);
-var ed25519_CURVE_p = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
-var ed25519_CURVE = /* @__PURE__ */ (() => ({
-  p: ed25519_CURVE_p,
-  n: BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),
-  h: _8n3,
-  a: BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),
-  d: BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),
-  Gx: BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),
-  Gy: BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")
-}))();
-function ed25519_pow_2_252_3(x) {
-  const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
-  const P = ed25519_CURVE_p;
-  const x2 = x * x % P;
-  const b2 = x2 * x % P;
-  const b4 = pow2(b2, _2n4, P) * b2 % P;
-  const b5 = pow2(b4, _1n6, P) * x % P;
-  const b10 = pow2(b5, _5n2, P) * b5 % P;
-  const b20 = pow2(b10, _10n, P) * b10 % P;
-  const b40 = pow2(b20, _20n, P) * b20 % P;
-  const b80 = pow2(b40, _40n, P) * b40 % P;
-  const b160 = pow2(b80, _80n, P) * b80 % P;
-  const b240 = pow2(b160, _80n, P) * b80 % P;
-  const b250 = pow2(b240, _10n, P) * b10 % P;
-  const pow_p_5_8 = pow2(b250, _2n4, P) * x % P;
-  return { pow_p_5_8, b2 };
-}
-function adjustScalarBytes(bytes) {
-  bytes[0] &= 248;
-  bytes[31] &= 127;
-  bytes[31] |= 64;
-  return bytes;
-}
-var ED25519_SQRT_M1 = /* @__PURE__ */ BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");
-function uvRatio(u, v) {
-  const P = ed25519_CURVE_p;
-  const v3 = mod(v * v * v, P);
-  const v7 = mod(v3 * v3 * v, P);
-  const pow = ed25519_pow_2_252_3(u * v7).pow_p_5_8;
-  let x = mod(u * v3 * pow, P);
-  const vx2 = mod(v * x * x, P);
-  const root1 = x;
-  const root2 = mod(x * ED25519_SQRT_M1, P);
-  const useRoot1 = vx2 === u;
-  const useRoot2 = vx2 === mod(-u, P);
-  const noRoot = vx2 === mod(-u * ED25519_SQRT_M1, P);
-  if (useRoot1)
-    x = root1;
-  if (useRoot2 || noRoot)
-    x = root2;
-  if (isNegativeLE(x, P))
-    x = mod(-x, P);
-  return { isValid: useRoot1 || useRoot2, value: x };
-}
-var ed25519_Point = /* @__PURE__ */ edwards(ed25519_CURVE, { uvRatio });
-var Fp = /* @__PURE__ */ (() => ed25519_Point.Fp)();
-var Fn = /* @__PURE__ */ (() => ed25519_Point.Fn)();
-function ed25519_domain(data, ctx, phflag) {
-  if (ctx.length > 255)
-    throw new Error("Context is too big");
-  return concatBytes(asciiToBytes("SigEd25519 no Ed25519 collisions"), new Uint8Array([phflag ? 1 : 0, ctx.length]), ctx, data);
-}
-function ed(opts) {
-  return eddsa(ed25519_Point, sha512, Object.assign({ adjustScalarBytes, zip215: true }, opts));
-}
-var ed25519 = /* @__PURE__ */ ed({});
-var ed25519ctx = /* @__PURE__ */ ed({ domain: ed25519_domain });
-var ed25519ph = /* @__PURE__ */ ed({ domain: ed25519_domain, prehash: sha512 });
-var ed25519_FROST = /* @__PURE__ */ (() => createFROST({
-  name: "FROST-ED25519-SHA512-v1",
-  Point: ed25519_Point,
-  validatePoint: (p) => {
-    p.assertValidity();
-    if (!p.isTorsionFree())
-      throw new Error("bad point: not torsion-free");
-  },
-  hash: sha512,
-  // RFC 9591 keeps H2 undecorated here for RFC 8032 compatibility. In createFROST(),
-  // `H2: ''` becomes an empty DST prefix; the built-in hashToScalar fallback treats
-  // that the same as omitted DST, even though custom hooks can still observe the empty bag.
-  H2: ""
-}))();
-var x25519 = /* @__PURE__ */ (() => {
-  const P = ed25519_CURVE_p;
-  return montgomery({
-    P,
-    type: "x25519",
-    powPminus2: (x) => {
-      const { pow_p_5_8, b2 } = ed25519_pow_2_252_3(x);
-      return mod(pow2(pow_p_5_8, _3n2, P) * b2, P);
-    },
-    adjustScalarBytes
-  });
-})();
-var ELL2_C1 = /* @__PURE__ */ (() => (ed25519_CURVE_p + _3n2) / _8n3)();
-var ELL2_C2 = /* @__PURE__ */ (() => Fp.pow(_2n4, ELL2_C1))();
-var ELL2_C3 = /* @__PURE__ */ (() => Fp.sqrt(Fp.neg(Fp.ONE)))();
-function _map_to_curve_elligator2_curve25519(u) {
-  const ELL2_C4 = (ed25519_CURVE_p - _5n2) / _8n3;
-  const ELL2_J = BigInt(486662);
-  let tv1 = Fp.sqr(u);
-  tv1 = Fp.mul(tv1, _2n4);
-  let xd = Fp.add(tv1, Fp.ONE);
-  let x1n = Fp.neg(ELL2_J);
-  let tv2 = Fp.sqr(xd);
-  let gxd = Fp.mul(tv2, xd);
-  let gx1 = Fp.mul(tv1, ELL2_J);
-  gx1 = Fp.mul(gx1, x1n);
-  gx1 = Fp.add(gx1, tv2);
-  gx1 = Fp.mul(gx1, x1n);
-  let tv3 = Fp.sqr(gxd);
-  tv2 = Fp.sqr(tv3);
-  tv3 = Fp.mul(tv3, gxd);
-  tv3 = Fp.mul(tv3, gx1);
-  tv2 = Fp.mul(tv2, tv3);
-  let y11 = Fp.pow(tv2, ELL2_C4);
-  y11 = Fp.mul(y11, tv3);
-  let y12 = Fp.mul(y11, ELL2_C3);
-  tv2 = Fp.sqr(y11);
-  tv2 = Fp.mul(tv2, gxd);
-  let e1 = Fp.eql(tv2, gx1);
-  let y1 = Fp.cmov(y12, y11, e1);
-  let x2n = Fp.mul(x1n, tv1);
-  let y21 = Fp.mul(y11, u);
-  y21 = Fp.mul(y21, ELL2_C2);
-  let y22 = Fp.mul(y21, ELL2_C3);
-  let gx2 = Fp.mul(gx1, tv1);
-  tv2 = Fp.sqr(y21);
-  tv2 = Fp.mul(tv2, gxd);
-  let e2 = Fp.eql(tv2, gx2);
-  let y2 = Fp.cmov(y22, y21, e2);
-  tv2 = Fp.sqr(y1);
-  tv2 = Fp.mul(tv2, gxd);
-  let e3 = Fp.eql(tv2, gx1);
-  let xn = Fp.cmov(x2n, x1n, e3);
-  let y = Fp.cmov(y2, y1, e3);
-  let e4 = Fp.isOdd(y);
-  y = Fp.cmov(y, Fp.neg(y), e3 !== e4);
-  return { xMn: xn, xMd: xd, yMn: y, yMd: _1n6 };
-}
-var ELL2_C1_EDWARDS = /* @__PURE__ */ (() => FpSqrtEven(Fp, Fp.neg(BigInt(486664))))();
-function map_to_curve_elligator2_edwards25519(u) {
-  const { xMn, xMd, yMn, yMd } = _map_to_curve_elligator2_curve25519(u);
-  let xn = Fp.mul(xMn, yMd);
-  xn = Fp.mul(xn, ELL2_C1_EDWARDS);
-  let xd = Fp.mul(xMd, yMn);
-  let yn = Fp.sub(xMn, xMd);
-  let yd = Fp.add(xMn, xMd);
-  let tv1 = Fp.mul(xd, yd);
-  let e = Fp.eql(tv1, Fp.ZERO);
-  xn = Fp.cmov(xn, Fp.ZERO, e);
-  xd = Fp.cmov(xd, Fp.ONE, e);
-  yn = Fp.cmov(yn, Fp.ONE, e);
-  yd = Fp.cmov(yd, Fp.ONE, e);
-  const [xd_inv, yd_inv] = FpInvertBatch(Fp, [xd, yd], true);
-  return { x: Fp.mul(xn, xd_inv), y: Fp.mul(yn, yd_inv) };
-}
-var ed25519_hasher = /* @__PURE__ */ (() => createHasher2(ed25519_Point, (scalars) => map_to_curve_elligator2_edwards25519(scalars[0]), {
-  DST: "edwards25519_XMD:SHA-512_ELL2_RO_",
-  encodeDST: "edwards25519_XMD:SHA-512_ELL2_NU_",
-  p: ed25519_CURVE_p,
-  m: 1,
-  k: 128,
-  expand: "xmd",
-  hash: sha512
-}))();
-var SQRT_M1 = ED25519_SQRT_M1;
-var SQRT_AD_MINUS_ONE = /* @__PURE__ */ BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235");
-var INVSQRT_A_MINUS_D = /* @__PURE__ */ BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578");
-var ONE_MINUS_D_SQ = /* @__PURE__ */ BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838");
-var D_MINUS_ONE_SQ = /* @__PURE__ */ BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952");
-var invertSqrt = (number) => uvRatio(_1n6, number);
-var MAX_255B = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
-var bytes255ToNumberLE = (bytes) => Fp.create(bytesToNumberLE(bytes) & MAX_255B);
-function calcElligatorRistrettoMap(r0) {
-  const { d } = ed25519_CURVE;
-  const P = ed25519_CURVE_p;
-  const mod2 = (n) => Fp.create(n);
-  const r = mod2(SQRT_M1 * r0 * r0);
-  const Ns = mod2((r + _1n6) * ONE_MINUS_D_SQ);
-  let c = BigInt(-1);
-  const D = mod2((c - d * r) * mod2(r + d));
-  let { isValid: Ns_D_is_sq, value: s } = uvRatio(Ns, D);
-  let s_ = mod2(s * r0);
-  if (!isNegativeLE(s_, P))
-    s_ = mod2(-s_);
-  if (!Ns_D_is_sq)
-    s = s_;
-  if (!Ns_D_is_sq)
-    c = r;
-  const Nt = mod2(c * (r - _1n6) * D_MINUS_ONE_SQ - D);
-  const s2 = s * s;
-  const W0 = mod2((s + s) * D);
-  const W1 = mod2(Nt * SQRT_AD_MINUS_ONE);
-  const W2 = mod2(_1n6 - s2);
-  const W3 = mod2(_1n6 + s2);
-  return new ed25519_Point(mod2(W0 * W3), mod2(W2 * W1), mod2(W1 * W3), mod2(W0 * W2));
-}
-var _RistrettoPoint = class __RistrettoPoint extends PrimeEdwardsPoint {
-  // Do NOT change syntax: the following gymnastics is done,
-  // because typescript strips comments, which makes bundlers disable tree-shaking.
-  // prettier-ignore
-  static BASE = /* @__PURE__ */ (() => new __RistrettoPoint(ed25519_Point.BASE))();
-  // prettier-ignore
-  static ZERO = /* @__PURE__ */ (() => new __RistrettoPoint(ed25519_Point.ZERO))();
-  // prettier-ignore
-  static Fp = /* @__PURE__ */ (() => Fp)();
-  // prettier-ignore
-  static Fn = /* @__PURE__ */ (() => Fn)();
-  constructor(ep) {
-    super(ep);
-  }
-  /**
-   * Create one Ristretto255 point from affine Edwards coordinates.
-   * This wraps the internal Edwards representative directly and is not a
-   * canonical ristretto255 decoding path.
-   * Use `toBytes()` / `fromBytes()` if canonical ristretto255 bytes matter.
-   */
-  static fromAffine(ap) {
-    return new __RistrettoPoint(ed25519_Point.fromAffine(ap));
-  }
-  assertSame(other) {
-    if (!(other instanceof __RistrettoPoint))
-      throw new Error("RistrettoPoint expected");
-  }
-  init(ep) {
-    return new __RistrettoPoint(ep);
-  }
-  static fromBytes(bytes) {
-    abytes(bytes, 32);
-    const { a, d } = ed25519_CURVE;
-    const P = ed25519_CURVE_p;
-    const mod2 = (n) => Fp.create(n);
-    const s = bytes255ToNumberLE(bytes);
-    if (!equalBytes(Fp.toBytes(s), bytes) || isNegativeLE(s, P))
-      throw new Error("invalid ristretto255 encoding 1");
-    const s2 = mod2(s * s);
-    const u1 = mod2(_1n6 + a * s2);
-    const u2 = mod2(_1n6 - a * s2);
-    const u1_2 = mod2(u1 * u1);
-    const u2_2 = mod2(u2 * u2);
-    const v = mod2(a * d * u1_2 - u2_2);
-    const { isValid, value: I } = invertSqrt(mod2(v * u2_2));
-    const Dx = mod2(I * u2);
-    const Dy = mod2(I * Dx * v);
-    let x = mod2((s + s) * Dx);
-    if (isNegativeLE(x, P))
-      x = mod2(-x);
-    const y = mod2(u1 * Dy);
-    const t = mod2(x * y);
-    if (!isValid || isNegativeLE(t, P) || y === _0n6)
-      throw new Error("invalid ristretto255 encoding 2");
-    return new __RistrettoPoint(new ed25519_Point(x, y, _1n6, t));
-  }
-  /**
-   * Converts ristretto-encoded string to ristretto point.
-   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).
-   * @param hex - Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
-   */
-  static fromHex(hex) {
-    return __RistrettoPoint.fromBytes(hexToBytes(hex));
-  }
-  /**
-   * Encodes ristretto point to Uint8Array.
-   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode).
-   */
-  toBytes() {
-    let { X, Y, Z, T } = this.ep;
-    const P = ed25519_CURVE_p;
-    const mod2 = (n) => Fp.create(n);
-    const u1 = mod2(mod2(Z + Y) * mod2(Z - Y));
-    const u2 = mod2(X * Y);
-    const u2sq = mod2(u2 * u2);
-    const { value: invsqrt } = invertSqrt(mod2(u1 * u2sq));
-    const D1 = mod2(invsqrt * u1);
-    const D2 = mod2(invsqrt * u2);
-    const zInv = mod2(D1 * D2 * T);
-    let D;
-    if (isNegativeLE(T * zInv, P)) {
-      let _x = mod2(Y * SQRT_M1);
-      let _y = mod2(X * SQRT_M1);
-      X = _x;
-      Y = _y;
-      D = mod2(D1 * INVSQRT_A_MINUS_D);
-    } else {
-      D = D2;
-    }
-    if (isNegativeLE(X * zInv, P))
-      Y = mod2(-Y);
-    let s = mod2((Z - Y) * D);
-    if (isNegativeLE(s, P))
-      s = mod2(-s);
-    return Fp.toBytes(s);
-  }
-  /**
-   * Compares two Ristretto points.
-   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals).
-   */
-  equals(other) {
-    this.assertSame(other);
-    const { X: X1, Y: Y1 } = this.ep;
-    const { X: X2, Y: Y2 } = other.ep;
-    const mod2 = (n) => Fp.create(n);
-    const one = mod2(X1 * Y2) === mod2(Y1 * X2);
-    const two = mod2(Y1 * Y2) === mod2(X1 * X2);
-    return one || two;
-  }
-  is0() {
-    return this.equals(__RistrettoPoint.ZERO);
-  }
-};
-Object.freeze(_RistrettoPoint.BASE);
-Object.freeze(_RistrettoPoint.ZERO);
-Object.freeze(_RistrettoPoint.prototype);
-Object.freeze(_RistrettoPoint);
-var ristretto255 = /* @__PURE__ */ Object.freeze({ Point: _RistrettoPoint });
-var ristretto255_hasher = Object.freeze({
-  Point: _RistrettoPoint,
-  /**
-  * Spec: https://www.rfc-editor.org/rfc/rfc9380.html#name-hashing-to-ristretto255. Caveats:
-  * * There are no test vectors
-  * * encodeToCurve / mapToCurve is undefined
-  * * mapToCurve would be `calcElligatorRistrettoMap(scalars[0])`, not ristretto255_map!
-  * * hashToScalar is undefined too, so we just use OPRF implementation
-  * * We cannot re-use 'createHasher', because ristretto255_map is different algorithm/RFC
-    (os2ip -> bytes255ToNumberLE)
-  * * mapToCurve == calcElligatorRistrettoMap, hashToCurve == ristretto255_map
-  * * hashToScalar is undefined in RFC9380 for ristretto, so we use the OPRF
-    version here. Using `bytes255ToNumblerLE` will create a different result
-    if we use `bytes255ToNumberLE` as os2ip
-  * * current version is closest to spec.
-  */
-  hashToCurve(msg, options) {
-    const DST = options?.DST === void 0 ? "ristretto255_XMD:SHA-512_R255MAP_RO_" : options.DST;
-    const xmd = expand_message_xmd(msg, DST, 64, sha512);
-    return ristretto255_hasher.deriveToCurve(xmd);
-  },
-  hashToScalar(msg, options = { DST: _DST_scalar }) {
-    const xmd = expand_message_xmd(msg, options.DST, 64, sha512);
-    return Fn.create(bytesToNumberLE(xmd));
-  },
-  /**
-   * HashToCurve-like construction based on RFC 9496 (Element Derivation).
-   * Converts 64 uniform random bytes into a curve point.
-   *
-   * WARNING: This represents an older hash-to-curve construction from before
-   * RFC 9380 was finalized.
-   * It was later reused as a component in the newer
-   * `hash_to_ristretto255` function defined in RFC 9380.
-   */
-  deriveToCurve(bytes) {
-    abytes(bytes, 64);
-    const r1 = bytes255ToNumberLE(bytes.subarray(0, 32));
-    const R1 = calcElligatorRistrettoMap(r1);
-    const r2 = bytes255ToNumberLE(bytes.subarray(32, 64));
-    const R2 = calcElligatorRistrettoMap(r2);
-    return new _RistrettoPoint(R1.add(R2));
-  }
-});
-var ristretto255_oprf = /* @__PURE__ */ (() => createOPRF({
-  name: "ristretto255-SHA512",
-  Point: _RistrettoPoint,
-  hash: sha512,
-  hashToGroup: ristretto255_hasher.hashToCurve,
-  hashToScalar: ristretto255_hasher.hashToScalar
-}))();
-var ristretto255_FROST = /* @__PURE__ */ (() => createFROST({
-  name: "FROST-RISTRETTO255-SHA512-v1",
-  Point: _RistrettoPoint,
-  validatePoint: (p) => {
-    p.assertValidity();
-  },
-  hash: sha512
-}))();
-var ED25519_TORSION_SUBGROUP = /* @__PURE__ */ Object.freeze([
-  "0100000000000000000000000000000000000000000000000000000000000000",
-  "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a",
-  "0000000000000000000000000000000000000000000000000000000000000080",
-  "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05",
-  "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
-  "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85",
-  "0000000000000000000000000000000000000000000000000000000000000000",
-  "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa"
-]);
-
 export {
   split,
   rotlSH,
@@ -3917,12 +2620,14 @@ export {
   swap32IfBE,
   bytesToHex,
   hexToBytes,
+  concatBytes,
   createHasher,
   randomBytes,
   sha256,
+  sha512,
   abytes2,
   bytesToHex2,
-  concatBytes2 as concatBytes,
+  concatBytes2,
   hexToBytes2,
   isBytes2 as isBytes,
   randomBytes2,
@@ -3931,44 +2636,44 @@ export {
   asafenumber,
   numberToHexUnpadded,
   bytesToNumberBE,
+  bytesToNumberLE,
+  numberToBytesBE,
+  numberToBytesLE,
+  equalBytes,
+  copyBytes,
   asciiToBytes,
   aInRange,
   bitLen,
   bitMask,
   createHmacDrbg,
   validateObject,
+  notImplemented,
+  mod,
   pow2,
+  isNegativeLE,
+  FpInvertBatch,
   Field,
+  FpSqrtEven,
   getMinHashLength,
   mapHashToField,
+  validatePointCons,
   negateCt,
   normalizeZ,
   wNAF,
   mulEndoUnsafe,
+  pippenger,
   createCurveFields,
   createKeygen,
-  ed25519,
-  ed25519ctx,
-  ed25519ph,
-  ed25519_FROST,
-  x25519,
-  _map_to_curve_elligator2_curve25519,
-  ed25519_hasher,
-  ristretto255,
-  ristretto255_hasher,
-  ristretto255_oprf,
-  ristretto255_FROST,
-  ED25519_TORSION_SUBGROUP
+  expand_message_xmd,
+  _DST_scalar,
+  createHasher2,
+  createFROST
 };
 /*! Bundled license information:
 
 @noble/curves/utils.js:
 @noble/curves/abstract/modular.js:
 @noble/curves/abstract/curve.js:
-@noble/curves/abstract/edwards.js:
-@noble/curves/abstract/montgomery.js:
-@noble/curves/abstract/oprf.js:
-@noble/curves/ed25519.js:
   (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
 */
-//# sourceMappingURL=chunk-LN2OF264.js.map
+//# sourceMappingURL=chunk-6GXZ4KRO.js.map