@toon-protocol/client-mcp 0.20.2 → 0.20.4

package/dist/chunk-V7D5HJBT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/src/abstract/edwards.ts","../../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/src/abstract/montgomery.ts","../../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/src/abstract/oprf.ts","../../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/src/ed25519.ts"],"sourcesContent":["/**\n * Twisted Edwards curve. The formula is: ax² + y² = 1 + dx²y².\n * For design rationale of types / exports, see weierstrass module documentation.\n * Untwisted Edwards curves exist, but they aren't used in real-world protocols.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport {\n  abool,\n  abytes,\n  aInRange,\n  asafenumber,\n  bytesToHex,\n  bytesToNumberLE,\n  concatBytes,\n  copyBytes,\n  hexToBytes,\n  isBytes,\n  notImplemented,\n  validateObject,\n  randomBytes as wcRandomBytes,\n  type FHash,\n  type Signer,\n  type TArg,\n  type TRet,\n} from '../utils.ts';\nimport {\n  createCurveFields,\n  createKeygen,\n  normalizeZ,\n  wNAF,\n  type AffinePoint,\n  type CurveLengths,\n  type CurvePoint,\n  type CurvePointCons,\n} from './curve.ts';\nimport { type IField } from './modular.ts';\n\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _8n = /* @__PURE__ */ BigInt(8);\n\n/** Extended Edwards point with X/Y/Z/T coordinates. */\nexport interface EdwardsPoint extends CurvePoint<bigint, EdwardsPoint> {\n  /** extended X coordinate. Different from affine x. */\n  readonly X: bigint;\n  /** extended Y coordinate. Different from affine y. */\n  readonly Y: bigint;\n  /** extended Z coordinate */\n  readonly Z: bigint;\n  /** extended T coordinate */\n  readonly T: bigint;\n}\n/** Constructor and decoding helpers for extended Edwards points. */\nexport interface EdwardsPointCons extends CurvePointCons<EdwardsPoint> {\n  /** Create a point from extended X/Y/Z/T coordinates without validation. */\n  new (X: bigint, Y: bigint, Z: bigint, T: bigint): EdwardsPoint;\n  /**\n   * Return the curve parameters used by this point constructor.\n   * @returns Curve parameters.\n   */\n  CURVE(): EdwardsOpts;\n  /**\n   * Decode a point from bytes, optionally using ZIP-215 rules.\n   * @param bytes - Encoded point bytes.\n   * @param zip215 - Whether to accept ZIP-215 encodings.\n   * @returns Decoded Edwards point.\n   */\n  fromBytes(bytes: Uint8Array, zip215?: boolean): EdwardsPoint;\n  /**\n   * Decode a point from hex, optionally using ZIP-215 rules.\n   * @param hex - Encoded point hex.\n   * @param zip215 - Whether to accept ZIP-215 encodings.\n   * @returns Decoded Edwards point.\n   */\n  fromHex(hex: string, zip215?: boolean): EdwardsPoint;\n}\n\n/**\n * Twisted Edwards curve options.\n *\n * * a: formula param\n * * d: formula param\n * * p: prime characteristic (order) of finite field, in which arithmetics is done\n * * n: order of prime subgroup a.k.a total amount of valid curve points\n * * h: cofactor. h*n is group order; n is subgroup order\n * * Gx: x coordinate of generator point a.k.a. base point\n * * Gy: y coordinate of generator point\n */\nexport type EdwardsOpts = Readonly<{\n  /** Base-field modulus. */\n  p: bigint;\n  /** Prime subgroup order. */\n  n: bigint;\n  /** Curve cofactor. */\n  h: bigint;\n  /** Edwards curve parameter `a`. */\n  a: bigint;\n  /** Edwards curve parameter `d`. */\n  d: bigint;\n  /** Generator x coordinate. */\n  Gx: bigint;\n  /** Generator y coordinate. */\n  Gy: bigint;\n}>;\n\n/**\n * Extra curve options for Twisted Edwards.\n *\n * * Fp: redefined Field over curve.p\n * * Fn: redefined Field over curve.n\n * * uvRatio: helper function for decompression, calculating √(u/v)\n */\nexport type EdwardsExtraOpts = Partial<{\n  /** Optional base-field override. */\n  Fp: IField<bigint>;\n  /** Optional scalar-field override. */\n  Fn: IField<bigint>;\n  /** Whether field encodings are little-endian. */\n  FpFnLE: boolean;\n  /** Square-root ratio helper used during point decompression. */\n  uvRatio: (u: bigint, v: bigint) => { isValid: boolean; value: bigint };\n}>;\n\n/**\n * EdDSA (Edwards Digital Signature algorithm) options.\n *\n * * hash: hash function used to hash secret keys and messages\n * * adjustScalarBytes: clears bits to get valid field element\n * * domain: Used for hashing\n * * mapToCurve: for hash-to-curve standard\n * * prehash: RFC 8032 pre-hashing of messages to sign() / verify()\n * * randomBytes: function generating random bytes, used for randomSecretKey\n */\nexport type EdDSAOpts = Partial<{\n  /** Clamp or otherwise normalize secret-scalar bytes before reducing mod `n`. */\n  adjustScalarBytes: (bytes: TArg<Uint8Array>) => TRet<Uint8Array>;\n  /** Domain-separation helper for contexts and prehash mode. */\n  domain: (data: TArg<Uint8Array>, ctx: TArg<Uint8Array>, phflag: boolean) => TRet<Uint8Array>;\n  /** Optional hash-to-curve mapper for protocols like Ristretto hash-to-group. */\n  mapToCurve: (scalar: bigint[]) => AffinePoint<bigint>;\n  /** Optional prehash function used before signing or verifying messages. */\n  prehash: FHash;\n  /** Default verification decoding policy. ZIP-215 is more permissive than RFC 8032 / NIST. */\n  zip215: boolean;\n  /** RNG override used by helper constructors. */\n  randomBytes: (bytesLength?: number) => TRet<Uint8Array>;\n}>;\n\n/**\n * EdDSA (Edwards Digital Signature algorithm) helper namespace.\n * Allows creating and verifying signatures, and deriving public keys.\n */\nexport interface EdDSA {\n  /**\n   * Generate a secret/public key pair.\n   * @param seed - Optional seed material.\n   * @returns Secret/public key pair.\n   */\n  keygen: (seed?: TArg<Uint8Array>) => { secretKey: TRet<Uint8Array>; publicKey: TRet<Uint8Array> };\n  /**\n   * Derive the public key from a secret key.\n   * @param secretKey - Secret key bytes.\n   * @returns Encoded public key.\n   */\n  getPublicKey: (secretKey: TArg<Uint8Array>) => TRet<Uint8Array>;\n  /**\n   * Sign a message with an EdDSA secret key.\n   * @param message - Message bytes.\n   * @param secretKey - Secret key bytes.\n   * @param options - Optional signature tweaks:\n   *   - `context` (optional): Domain-separation context for Ed25519ctx/Ed448.\n   * @returns Encoded signature bytes.\n   */\n  sign: (\n    message: TArg<Uint8Array>,\n    secretKey: TArg<Uint8Array>,\n    options?: TArg<{ context?: Uint8Array }>\n  ) => TRet<Uint8Array>;\n  /**\n   * Verify a signature against a message and public key.\n   * @param sig - Encoded signature bytes.\n   * @param message - Message bytes.\n   * @param publicKey - Encoded public key.\n   * @param options - Optional verification tweaks:\n   *   - `context` (optional): Domain-separation context for Ed25519ctx/Ed448.\n   *   - `zip215` (optional): Whether to accept ZIP-215 encodings.\n   * @returns Whether the signature is valid.\n   */\n  verify: (\n    sig: TArg<Uint8Array>,\n    message: TArg<Uint8Array>,\n    publicKey: TArg<Uint8Array>,\n    options?: TArg<{ context?: Uint8Array; zip215?: boolean }>\n  ) => boolean;\n  /** Point constructor used by this signature scheme. */\n  Point: EdwardsPointCons;\n  /** Helper utilities for key validation and Montgomery conversion. */\n  utils: {\n    /**\n     * Generate a valid random secret key.\n     * Optional seed bytes are only length-checked and returned unchanged.\n     */\n    randomSecretKey: (seed?: TArg<Uint8Array>) => TRet<Uint8Array>;\n    /** Check whether a secret key has the expected encoding. */\n    isValidSecretKey: (secretKey: TArg<Uint8Array>) => boolean;\n    /** Check whether a public key decodes to a valid point. */\n    isValidPublicKey: (publicKey: TArg<Uint8Array>, zip215?: boolean) => boolean;\n\n    /**\n     * Converts ed public key to x public key.\n     *\n     * There is NO `fromMontgomery`:\n     * - There are 2 valid ed25519 points for every x25519, with flipped coordinate\n     * - Sometimes there are 0 valid ed25519 points, because x25519 *additionally*\n     *   accepts inputs on the quadratic twist, which can't be moved to ed25519\n     *\n     * @example\n     * Converts ed public key to x public key.\n     *\n     * ```js\n     * const someonesPub_ed = ed25519.getPublicKey(ed25519.utils.randomSecretKey());\n     * const someonesPub = ed25519.utils.toMontgomery(someonesPub);\n     * const aPriv = x25519.utils.randomSecretKey();\n     * const shared = x25519.getSharedSecret(aPriv, someonesPub)\n     * ```\n     */\n    toMontgomery: (publicKey: TArg<Uint8Array>) => TRet<Uint8Array>;\n    /**\n     * Converts ed secret key to x secret key.\n     * @example\n     * Converts ed secret key to x secret key.\n     *\n     * ```js\n     * const someonesPub = x25519.getPublicKey(x25519.utils.randomSecretKey());\n     * const aPriv_ed = ed25519.utils.randomSecretKey();\n     * const aPriv = ed25519.utils.toMontgomerySecret(aPriv_ed);\n     * const shared = x25519.getSharedSecret(aPriv, someonesPub)\n     * ```\n     */\n    toMontgomerySecret: (secretKey: TArg<Uint8Array>) => TRet<Uint8Array>;\n    /** Return the expanded private key components used by RFC8032 signing. */\n    getExtendedPublicKey: (key: TArg<Uint8Array>) => {\n      head: TRet<Uint8Array>;\n      prefix: TRet<Uint8Array>;\n      scalar: bigint;\n      point: EdwardsPoint;\n      pointBytes: TRet<Uint8Array>;\n    };\n  };\n  /** Byte lengths for keys and signatures exposed by this scheme. */\n  lengths: CurveLengths;\n}\n\n// Affine Edwards-equation check only; this does not prove subgroup membership, canonical\n// encoding, prime-order base-point requirements, or identity exclusion.\nfunction isEdValidXY(Fp: TArg<IField<bigint>>, CURVE: EdwardsOpts, x: bigint, y: bigint): boolean {\n  const x2 = Fp.sqr(x);\n  const y2 = Fp.sqr(y);\n  const left = Fp.add(Fp.mul(CURVE.a, x2), y2);\n  const right = Fp.add(Fp.ONE, Fp.mul(CURVE.d, Fp.mul(x2, y2)));\n  return Fp.eql(left, right);\n}\n\n/**\n * @param params - Curve parameters. See {@link EdwardsOpts}.\n * @param extraOpts - Optional helpers and overrides. See {@link EdwardsExtraOpts}.\n * @returns Edwards point constructor. Generator validation here only checks\n *   that `(Gx, Gy)` satisfies the affine Edwards equation.\n *   RFC 8032 base-point constraints like `B != (0,1)` and `[L]B = 0`\n *   are left to the caller's chosen parameters, since eager subgroup\n *   validation here adds about 10-15ms to heavyweight imports like ed448.\n *   The returned constructor also eagerly marks `Point.BASE` for W=8\n *   precompute caching. Some code paths still assume\n *   `Fp.BYTES === Fn.BYTES`, so mismatched byte lengths are not fully audited here.\n * @throws If the curve parameters or Edwards overrides are invalid. {@link Error}\n * @example\n * ```ts\n * import { edwards } from '@noble/curves/abstract/edwards.js';\n * import { jubjub } from '@noble/curves/misc.js';\n * // Build a point constructor from explicit curve parameters, then use its base point.\n * const Point = edwards(jubjub.Point.CURVE());\n * Point.BASE.toHex();\n * ```\n */\nexport function edwards(\n  params: TArg<EdwardsOpts>,\n  extraOpts: TArg<EdwardsExtraOpts> = {}\n): EdwardsPointCons {\n  const opts = extraOpts as EdwardsExtraOpts;\n  const validated = createCurveFields('edwards', params as EdwardsOpts, opts, opts.FpFnLE);\n  const { Fp, Fn } = validated;\n  let CURVE = validated.CURVE as EdwardsOpts;\n  const { h: cofactor } = CURVE;\n  validateObject(opts, {}, { uvRatio: 'function' });\n\n  // Important:\n  // There are some places where Fp.BYTES is used instead of nByteLength.\n  // So far, everything has been tested with curves of Fp.BYTES == nByteLength.\n  // TODO: test and find curves which behave otherwise.\n  const MASK = _2n << (BigInt(Fn.BYTES * 8) - _1n);\n  const modP = (n: bigint) => Fp.create(n); // Function overrides\n\n  // sqrt(u/v)\n  const uvRatio =\n    opts.uvRatio === undefined\n      ? (u: bigint, v: bigint) => {\n          try {\n            return { isValid: true, value: Fp.sqrt(Fp.div(u, v)) };\n          } catch (e) {\n            return { isValid: false, value: _0n };\n          }\n        }\n      : opts.uvRatio;\n\n  // Validate whether the passed curve params are valid.\n  // equation ax² + y² = 1 + dx²y² should work for generator point.\n  if (!isEdValidXY(Fp, CURVE, CURVE.Gx, CURVE.Gy))\n    throw new Error('bad curve params: generator point');\n\n  /**\n   * Asserts coordinate is valid: 0 <= n < MASK.\n   * Coordinates >= Fp.ORDER are allowed for zip215.\n   */\n  function acoord(title: string, n: bigint, banZero = false) {\n    const min = banZero ? _1n : _0n;\n    aInRange('coordinate ' + title, n, min, MASK);\n    return n;\n  }\n\n  function aedpoint(other: unknown) {\n    if (!(other instanceof Point)) throw new Error('EdwardsPoint expected');\n  }\n\n  // Extended Point works in extended coordinates: (X, Y, Z, T) ∋ (x=X/Z, y=Y/Z, T=xy).\n  // https://en.wikipedia.org/wiki/Twisted_Edwards_curve#Extended_coordinates\n  class Point implements EdwardsPoint {\n    // base / generator point\n    static readonly BASE = new Point(CURVE.Gx, CURVE.Gy, _1n, modP(CURVE.Gx * CURVE.Gy));\n    // zero / infinity / identity point\n    static readonly ZERO = new Point(_0n, _1n, _1n, _0n); // 0, 1, 1, 0\n    // math field\n    static readonly Fp = Fp;\n    // scalar field\n    static readonly Fn = Fn;\n\n    readonly X: bigint;\n    readonly Y: bigint;\n    readonly Z: bigint;\n    readonly T: bigint;\n\n    constructor(X: bigint, Y: bigint, Z: bigint, T: bigint) {\n      this.X = acoord('x', X);\n      this.Y = acoord('y', Y);\n      this.Z = acoord('z', Z, true);\n      this.T = acoord('t', T);\n      Object.freeze(this);\n    }\n\n    static CURVE(): EdwardsOpts {\n      return CURVE;\n    }\n\n    /**\n     * Create one extended Edwards point from affine coordinates.\n     * Does NOT validate that the point is on-curve or torsion-free.\n     * Use `.assertValidity()` on adversarial inputs.\n     */\n    static fromAffine(p: AffinePoint<bigint>): Point {\n      if (p instanceof Point) throw new Error('extended point not allowed');\n      const { x, y } = p || {};\n      acoord('x', x);\n      acoord('y', y);\n      return new Point(x, y, _1n, modP(x * y));\n    }\n\n    // Uses algo from RFC8032 5.1.3.\n    static fromBytes(bytes: Uint8Array, zip215 = false): Point {\n      const len = Fp.BYTES;\n      const { a, d } = CURVE;\n      bytes = copyBytes(abytes(bytes, len, 'point'));\n      abool(zip215, 'zip215');\n      const normed = copyBytes(bytes); // copy again, we'll manipulate it\n      const lastByte = bytes[len - 1]; // select last byte\n      normed[len - 1] = lastByte & ~0x80; // clear last bit\n      const y = bytesToNumberLE(normed);\n\n      // zip215=true is good for consensus-critical apps. =false follows RFC8032 / NIST186-5.\n      // RFC8032 prohibits >= p, but ZIP215 doesn't\n      // zip215=true:  0 <= y < MASK (2^256 for ed25519)\n      // zip215=false: 0 <= y < P (2^255-19 for ed25519)\n      const max = zip215 ? MASK : Fp.ORDER;\n      aInRange('point.y', y, _0n, max);\n\n      // Ed25519: x² = (y²-1)/(dy²+1) mod p. Ed448: x² = (y²-1)/(dy²-1) mod p. Generic case:\n      // ax²+y²=1+dx²y² => y²-1=dx²y²-ax² => y²-1=x²(dy²-a) => x²=(y²-1)/(dy²-a)\n      const y2 = modP(y * y); // denominator is always non-0 mod p.\n      const u = modP(y2 - _1n); // u = y² - 1\n      const v = modP(d * y2 - a); // v = d y² + 1.\n      let { isValid, value: x } = uvRatio(u, v); // √(u/v)\n      if (!isValid) throw new Error('bad point: invalid y coordinate');\n      const isXOdd = (x & _1n) === _1n; // There are 2 square roots. Use x_0 bit to select proper\n      const isLastByteOdd = (lastByte & 0x80) !== 0; // x_0, last bit\n      if (!zip215 && x === _0n && isLastByteOdd)\n        // if x=0 and x_0 = 1, fail\n        throw new Error('bad point: x=0 and x_0=1');\n      if (isLastByteOdd !== isXOdd) x = modP(-x); // if x_0 != x mod 2, set x = p-x\n      return Point.fromAffine({ x, y });\n    }\n\n    static fromHex(hex: string, zip215 = false): Point {\n      return Point.fromBytes(hexToBytes(hex), zip215);\n    }\n\n    get x(): bigint {\n      return this.toAffine().x;\n    }\n    get y(): bigint {\n      return this.toAffine().y;\n    }\n\n    precompute(windowSize: number = 8, isLazy = true) {\n      wnaf.createCache(this, windowSize);\n      if (!isLazy) this.multiply(_2n); // random number\n      return this;\n    }\n\n    // Useful in fromAffine() - not for fromBytes(), which always created valid points.\n    assertValidity(): void {\n      const p = this;\n      const { a, d } = CURVE;\n      // Keep generic Edwards validation fail-closed on the neutral point.\n      // Even though ZERO is algebraically valid and can roundtrip through encodings, higher-level\n      // callers often reach it only through broken hash/scalar plumbing; rejecting it here avoids\n      // silently treating that degenerate state as an ordinary public point.\n      if (p.is0()) throw new Error('bad point: ZERO'); // TODO: optimize, with vars below?\n      // Equation in affine coordinates: ax² + y² = 1 + dx²y²\n      // Equation in projective coordinates (X/Z, Y/Z, Z):  (aX² + Y²)Z² = Z⁴ + dX²Y²\n      const { X, Y, Z, T } = p;\n      const X2 = modP(X * X); // X²\n      const Y2 = modP(Y * Y); // Y²\n      const Z2 = modP(Z * Z); // Z²\n      const Z4 = modP(Z2 * Z2); // Z⁴\n      const aX2 = modP(X2 * a); // aX²\n      const left = modP(Z2 * modP(aX2 + Y2)); // (aX² + Y²)Z²\n      const right = modP(Z4 + modP(d * modP(X2 * Y2))); // Z⁴ + dX²Y²\n      if (left !== right) throw new Error('bad point: equation left != right (1)');\n      // In Extended coordinates we also have T, which is x*y=T/Z: check X*Y == Z*T\n      const XY = modP(X * Y);\n      const ZT = modP(Z * T);\n      if (XY !== ZT) throw new Error('bad point: equation left != right (2)');\n    }\n\n    // Compare one point to another.\n    equals(other: Point): boolean {\n      aedpoint(other);\n      const { X: X1, Y: Y1, Z: Z1 } = this;\n      const { X: X2, Y: Y2, Z: Z2 } = other;\n      const X1Z2 = modP(X1 * Z2);\n      const X2Z1 = modP(X2 * Z1);\n      const Y1Z2 = modP(Y1 * Z2);\n      const Y2Z1 = modP(Y2 * Z1);\n      return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;\n    }\n\n    is0(): boolean {\n      return this.equals(Point.ZERO);\n    }\n\n    negate(): Point {\n      // Flips point sign to a negative one (-x, y in affine coords)\n      return new Point(modP(-this.X), this.Y, this.Z, modP(-this.T));\n    }\n\n    // Fast algo for doubling Extended Point.\n    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd\n    // Cost: 4M + 4S + 1*a + 6add + 1*2.\n    double(): Point {\n      const { a } = CURVE;\n      const { X: X1, Y: Y1, Z: Z1 } = this;\n      const A = modP(X1 * X1); // A = X12\n      const B = modP(Y1 * Y1); // B = Y12\n      const C = modP(_2n * modP(Z1 * Z1)); // C = 2*Z12\n      const D = modP(a * A); // D = a*A\n      const x1y1 = X1 + Y1;\n      const E = modP(modP(x1y1 * x1y1) - A - B); // E = (X1+Y1)2-A-B\n      const G = D + B; // G = D+B\n      const F = G - C; // F = G-C\n      const H = D - B; // H = D-B\n      const X3 = modP(E * F); // X3 = E*F\n      const Y3 = modP(G * H); // Y3 = G*H\n      const T3 = modP(E * H); // T3 = E*H\n      const Z3 = modP(F * G); // Z3 = F*G\n      return new Point(X3, Y3, Z3, T3);\n    }\n\n    // Fast algo for adding 2 Extended Points.\n    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd\n    // Cost: 9M + 1*a + 1*d + 7add.\n    add(other: Point) {\n      aedpoint(other);\n      const { a, d } = CURVE;\n      const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;\n      const { X: X2, Y: Y2, Z: Z2, T: T2 } = other;\n      const A = modP(X1 * X2); // A = X1*X2\n      const B = modP(Y1 * Y2); // B = Y1*Y2\n      const C = modP(T1 * d * T2); // C = T1*d*T2\n      const D = modP(Z1 * Z2); // D = Z1*Z2\n      const E = modP((X1 + Y1) * (X2 + Y2) - A - B); // E = (X1+Y1)*(X2+Y2)-A-B\n      const F = D - C; // F = D-C\n      const G = D + C; // G = D+C\n      const H = modP(B - a * A); // H = B-a*A\n      const X3 = modP(E * F); // X3 = E*F\n      const Y3 = modP(G * H); // Y3 = G*H\n      const T3 = modP(E * H); // T3 = E*H\n      const Z3 = modP(F * G); // Z3 = F*G\n      return new Point(X3, Y3, Z3, T3);\n    }\n\n    subtract(other: Point): Point {\n      // Validate before calling `negate()` so wrong inputs fail with the point guard\n      // instead of leaking a foreign `negate()` error.\n      aedpoint(other);\n      return this.add(other.negate());\n    }\n\n    // Constant-time multiplication.\n    multiply(scalar: bigint): Point {\n      // 1 <= scalar < L\n      // Keep the subgroup-scalar contract strict instead of reducing 0 / n to ZERO.\n      // In keygen/signing-style callers, those values usually mean broken hash/scalar plumbing,\n      // and failing closed is safer than silently producing the identity point.\n      if (!Fn.isValidNot0(scalar))\n        throw new RangeError('invalid scalar: expected 1 <= sc < curve.n');\n      const { p, f } = wnaf.cached(this, scalar, (p) => normalizeZ(Point, p));\n      return normalizeZ(Point, [p, f])[0];\n    }\n\n    // Non-constant-time multiplication. Uses double-and-add algorithm.\n    // It's faster, but should only be used when you don't care about\n    // an exposed private key e.g. sig verification.\n    // Keeps the same subgroup-scalar contract: 0 is allowed for public-scalar callers, but\n    // n and larger values are rejected instead of being reduced mod n to the identity point.\n    multiplyUnsafe(scalar: bigint): Point {\n      // 0 <= scalar < L\n      if (!Fn.isValid(scalar)) throw new RangeError('invalid scalar: expected 0 <= sc < curve.n');\n      if (scalar === _0n) return Point.ZERO;\n      if (this.is0() || scalar === _1n) return this;\n      return wnaf.unsafe(this, scalar, (p) => normalizeZ(Point, p));\n    }\n\n    // Checks if point is of small order.\n    // If you add something to small order point, you will have \"dirty\"\n    // point with torsion component.\n    // Clears cofactor and checks if the result is 0.\n    isSmallOrder(): boolean {\n      return this.clearCofactor().is0();\n    }\n\n    // Multiplies point by curve order and checks if the result is 0.\n    // Returns `false` is the point is dirty.\n    isTorsionFree(): boolean {\n      return wnaf.unsafe(this, CURVE.n).is0();\n    }\n\n    // Converts Extended point to default (x, y) coordinates.\n    // Can accept precomputed Z^-1 - for example, from invertBatch.\n    toAffine(invertedZ?: bigint): AffinePoint<bigint> {\n      const p = this;\n      let iz = invertedZ;\n      const { X, Y, Z } = p;\n      const is0 = p.is0();\n      if (iz == null) iz = is0 ? _8n : (Fp.inv(Z) as bigint); // 8 was chosen arbitrarily\n      const x = modP(X * iz);\n      const y = modP(Y * iz);\n      const zz = Fp.mul(Z, iz);\n      if (is0) return { x: _0n, y: _1n };\n      if (zz !== _1n) throw new Error('invZ was invalid');\n      return { x, y };\n    }\n\n    clearCofactor(): Point {\n      if (cofactor === _1n) return this;\n      return this.multiplyUnsafe(cofactor);\n    }\n\n    toBytes(): Uint8Array {\n      const { x, y } = this.toAffine();\n      // Fp.toBytes() allows non-canonical encoding of y (>= p).\n      const bytes = Fp.toBytes(y);\n      // Each y has 2 valid points: (x, y), (x,-y).\n      // When compressing, it's enough to store y and use the last byte to encode sign of x\n      bytes[bytes.length - 1] |= x & _1n ? 0x80 : 0;\n      return bytes;\n    }\n    toHex(): string {\n      return bytesToHex(this.toBytes());\n    }\n\n    toString() {\n      return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;\n    }\n  }\n  const wnaf = new wNAF(Point, Fn.BITS);\n  // Keep constructor work cheap: subgroup/generator validation belongs to the caller's curve\n  // parameters, and doing the extra checks here adds about 10-15ms to heavy module imports.\n  // Callers that construct custom curves are responsible for supplying the correct base point.\n  // try {\n  //   Point.BASE.assertValidity();\n  //   if (!Point.BASE.isTorsionFree()) throw new Error('bad point: not in prime-order subgroup');\n  // } catch {\n  //   throw new Error('bad curve params: generator point');\n  // }\n  // Tiny toy curves can have scalar fields narrower than 8 bits. Skip the\n  // eager W=8 cache there instead of rejecting an otherwise valid constructor.\n  if (Fn.BITS >= 8) Point.BASE.precompute(8); // Enable precomputes. Slows down first publicKey computation by 20ms.\n  Object.freeze(Point.prototype);\n  Object.freeze(Point);\n  return Point;\n}\n\n/**\n * Base class for prime-order points like Ristretto255 and Decaf448.\n * These points eliminate cofactor issues by representing equivalence classes\n * of Edwards curve points. Multiple Edwards representatives can describe the\n * same abstract wrapper element, so wrapper validity is not the same thing as\n * the hidden representative being torsion-free.\n * @param ep - Backing Edwards point.\n * @example\n * Base class for prime-order points like Ristretto255 and Decaf448.\n *\n * ```ts\n * import { ristretto255 } from '@noble/curves/ed25519.js';\n * const point = ristretto255.Point.BASE.multiply(2n);\n * ```\n */\nexport abstract class PrimeEdwardsPoint<T extends PrimeEdwardsPoint<T>>\n  implements CurvePoint<bigint, T>\n{\n  static BASE: PrimeEdwardsPoint<any>;\n  static ZERO: PrimeEdwardsPoint<any>;\n  static Fp: IField<bigint>;\n  static Fn: IField<bigint>;\n\n  protected readonly ep: EdwardsPoint;\n\n  /**\n   * Wrap one internal Edwards representative directly.\n   * This is not a canonical encoding boundary: alternate Edwards\n   * representatives may still describe the same abstract wrapper element.\n   */\n  constructor(ep: EdwardsPoint) {\n    this.ep = ep;\n  }\n\n  // Abstract methods that must be implemented by subclasses\n  abstract toBytes(): Uint8Array;\n  abstract equals(other: T): boolean;\n\n  // Static methods that must be implemented by subclasses\n  static fromBytes(_bytes: Uint8Array): any {\n    notImplemented();\n  }\n\n  static fromHex(_hex: string): any {\n    notImplemented();\n  }\n\n  get x(): bigint {\n    return this.toAffine().x;\n  }\n  get y(): bigint {\n    return this.toAffine().y;\n  }\n\n  // Common implementations\n  clearCofactor(): T {\n    // no-op for the abstract prime-order wrapper group; this is about the\n    // wrapper element, not the hidden Edwards representative.\n    return this as any;\n  }\n\n  assertValidity(): void {\n    // Keep wrapper validity at the abstract-group boundary. Canonical decode\n    // may choose Edwards representatives that differ by small torsion, so\n    // checking `this.ep.isTorsionFree()` here would reject valid wrapper points.\n    this.ep.assertValidity();\n  }\n\n  /**\n   * Return affine coordinates of the current internal Edwards representative.\n   * This is a convenience helper, not a canonical Ristretto/Decaf encoding.\n   * Equal abstract elements may expose different `x` / `y`; use\n   * `toBytes()` / `fromBytes()` for canonical roundtrips.\n   */\n  toAffine(invertedZ?: bigint): AffinePoint<bigint> {\n    return this.ep.toAffine(invertedZ);\n  }\n\n  toHex(): string {\n    return bytesToHex(this.toBytes());\n  }\n\n  toString(): string {\n    return this.toHex();\n  }\n\n  isTorsionFree(): boolean {\n    // Abstract Ristretto/Decaf elements are already prime-order even when the\n    // hidden Edwards representative is not torsion-free.\n    return true;\n  }\n\n  isSmallOrder(): boolean {\n    return false;\n  }\n\n  add(other: T): T {\n    this.assertSame(other);\n    return this.init(this.ep.add(other.ep));\n  }\n\n  subtract(other: T): T {\n    this.assertSame(other);\n    return this.init(this.ep.subtract(other.ep));\n  }\n\n  multiply(scalar: bigint): T {\n    return this.init(this.ep.multiply(scalar));\n  }\n\n  multiplyUnsafe(scalar: bigint): T {\n    return this.init(this.ep.multiplyUnsafe(scalar));\n  }\n\n  double(): T {\n    return this.init(this.ep.double());\n  }\n\n  negate(): T {\n    return this.init(this.ep.negate());\n  }\n\n  precompute(windowSize?: number, isLazy?: boolean): T {\n    this.ep.precompute(windowSize, isLazy);\n    // Keep the wrapper identity stable like the backing Edwards API instead of\n    // allocating a fresh wrapper around the same cached point.\n    return this as unknown as T;\n  }\n\n  // Helper methods\n  abstract is0(): boolean;\n  protected abstract assertSame(other: T): void;\n  protected abstract init(ep: EdwardsPoint): T;\n}\n\n/**\n * Initializes EdDSA signatures over given Edwards curve.\n * @param Point - Edwards point constructor.\n * @param cHash - Hash function.\n * @param eddsaOpts - Optional signature helpers. See {@link EdDSAOpts}.\n * @returns EdDSA helper namespace.\n * @throws If the hash function, options, or derived point operations are invalid. {@link Error}\n * @example\n * Initializes EdDSA signatures over given Edwards curve.\n *\n * ```ts\n * import { eddsa } from '@noble/curves/abstract/edwards.js';\n * import { jubjub } from '@noble/curves/misc.js';\n * import { sha512 } from '@noble/hashes/sha2.js';\n * const sigs = eddsa(jubjub.Point, sha512);\n * const { secretKey, publicKey } = sigs.keygen();\n * const msg = new TextEncoder().encode('hello noble');\n * const sig = sigs.sign(msg, secretKey);\n * const isValid = sigs.verify(sig, msg, publicKey);\n * ```\n */\nexport function eddsa(\n  Point: EdwardsPointCons,\n  cHash: TArg<FHash>,\n  eddsaOpts: TArg<EdDSAOpts> = {}\n): EdDSA {\n  if (typeof cHash !== 'function') throw new Error('\"hash\" function param is required');\n  const hash = cHash as FHash;\n  const opts = eddsaOpts as EdDSAOpts;\n  validateObject(\n    opts,\n    {},\n    {\n      adjustScalarBytes: 'function',\n      randomBytes: 'function',\n      domain: 'function',\n      prehash: 'function',\n      zip215: 'boolean',\n      mapToCurve: 'function',\n    }\n  );\n\n  const { prehash } = opts;\n  const { BASE, Fp, Fn } = Point;\n  const outputLen = (hash as FHash & { outputLen?: number }).outputLen;\n  const expectedLen = 2 * Fp.BYTES;\n  // When hash metadata is available, reject incompatible EdDSA wrappers at construction time\n  // instead of deferring the mismatch until the first keygen/sign call.\n  if (outputLen !== undefined) {\n    asafenumber(outputLen, 'hash.outputLen');\n    if (outputLen !== expectedLen)\n      throw new Error(`hash.outputLen must be ${expectedLen}, got ${outputLen}`);\n  }\n\n  const randomBytes = opts.randomBytes === undefined ? wcRandomBytes : opts.randomBytes;\n  const adjustScalarBytes =\n    opts.adjustScalarBytes === undefined\n      ? (bytes: TArg<Uint8Array>) => bytes as TRet<Uint8Array>\n      : opts.adjustScalarBytes;\n  const domain =\n    opts.domain === undefined\n      ? (data: TArg<Uint8Array>, ctx: TArg<Uint8Array>, phflag: boolean) => {\n          abool(phflag, 'phflag');\n          if (ctx.length || phflag) throw new Error('Contexts/pre-hash are not supported');\n          return data as TRet<Uint8Array>;\n        }\n      : opts.domain; // NOOP\n\n  // Parse an EdDSA digest as a little-endian integer and reduce it modulo the scalar field order.\n  function modN_LE(hash: TArg<Uint8Array>): bigint {\n    return Fn.create(bytesToNumberLE(hash)); // Not Fn.fromBytes: it has length limit\n  }\n\n  // Get the hashed private scalar per RFC8032 5.1.5\n  function getPrivateScalar(key: TArg<Uint8Array>) {\n    const len = lengths.secretKey;\n    abytes(key, lengths.secretKey, 'secretKey');\n    // Hash private key with curve's hash function to produce uniformingly random input\n    // Check byte lengths: ensure(64, h(ensure(32, key)))\n    const hashed = abytes(hash(key), 2 * len, 'hashedSecretKey');\n    // Slice before clamping so in-place adjustors don't corrupt the prefix half.\n    const head = adjustScalarBytes(hashed.slice(0, len)); // clear first half bits, produce FE\n    const prefix = hashed.slice(len, 2 * len) as TRet<Uint8Array>; // second half is called key prefix (5.1.6)\n    const scalar = modN_LE(head); // The actual private scalar\n    return { head, prefix, scalar };\n  }\n\n  /** Convenience method that creates public key from scalar. RFC8032 5.1.5\n   * Also exposes the derived scalar/prefix tuple and point form reused by sign().\n   */\n  function getExtendedPublicKey(secretKey: TArg<Uint8Array>) {\n    const { head, prefix, scalar } = getPrivateScalar(secretKey);\n    const point = BASE.multiply(scalar); // Point on Edwards curve aka public key\n    const pointBytes = point.toBytes() as TRet<Uint8Array>;\n    return { head, prefix, scalar, point, pointBytes };\n  }\n\n  /** Calculates EdDSA pub key. RFC8032 5.1.5. */\n  function getPublicKey(secretKey: TArg<Uint8Array>): TRet<Uint8Array> {\n    return getExtendedPublicKey(secretKey).pointBytes;\n  }\n\n  // Hash domain-separated chunks into a little-endian scalar modulo the group order.\n  function hashDomainToScalar(\n    context: TArg<Uint8Array> = Uint8Array.of(),\n    ...msgs: TArg<Uint8Array[]>\n  ) {\n    const msg = concatBytes(...msgs);\n    return modN_LE(hash(domain(msg, abytes(context, undefined, 'context'), !!prehash)));\n  }\n\n  /** Signs message with secret key. RFC8032 5.1.6 */\n  function sign(\n    msg: TArg<Uint8Array>,\n    secretKey: TArg<Uint8Array>,\n    options: TArg<{ context?: Uint8Array }> = {}\n  ): TRet<Uint8Array> {\n    msg = abytes(msg, undefined, 'message');\n    if (prehash) msg = prehash(msg); // for ed25519ph etc.\n    const { prefix, scalar, pointBytes } = getExtendedPublicKey(secretKey);\n    const r = hashDomainToScalar(options.context, prefix, msg); // r = dom2(F, C) || prefix || PH(M)\n    // RFC 8032 5.1.6 allows r mod L = 0, and SUPERCOP ref10 accepts the resulting identity-point\n    // signature.\n    // We intentionally keep the safe multiply() rejection here so a miswired all-zero hash provider\n    // fails loudly instead of silently producing a degenerate signature.\n    const R = BASE.multiply(r).toBytes(); // R = rG\n    const k = hashDomainToScalar(options.context, R, pointBytes, msg); // R || A || PH(M)\n    const s = Fn.create(r + k * scalar); // S = (r + k * s) mod L\n    if (!Fn.isValid(s)) throw new Error('sign failed: invalid s'); // 0 <= s < L\n    const rs = concatBytes(R, Fn.toBytes(s));\n    return abytes(rs, lengths.signature, 'result') as TRet<Uint8Array>;\n  }\n\n  // Keep the shared helper strict by default: RFC 8032 / NIST-style wrappers should reject\n  // non-canonical encodings unless they explicitly opt into ZIP-215's more permissive decode rules.\n  const verifyOpts: TArg<{ context?: Uint8Array; zip215?: boolean }> = {\n    zip215: opts.zip215,\n  };\n\n  /**\n   * Verifies EdDSA signature against message and public key. RFC 8032 §§5.1.7 and 5.2.7.\n   * A cofactored verification equation is checked.\n   */\n  function verify(\n    sig: TArg<Uint8Array>,\n    msg: TArg<Uint8Array>,\n    publicKey: TArg<Uint8Array>,\n    options = verifyOpts\n  ): boolean {\n    // Preserve the wrapper-selected default for `{}` / `{ zip215: undefined }`, not just omitted opts.\n    const { context } = options;\n    const zip215 = options.zip215 === undefined ? !!verifyOpts.zip215 : options.zip215;\n    const len = lengths.signature;\n    sig = abytes(sig, len, 'signature');\n    msg = abytes(msg, undefined, 'message');\n    publicKey = abytes(publicKey, lengths.publicKey, 'publicKey');\n    if (zip215 !== undefined) abool(zip215, 'zip215');\n    if (prehash) msg = prehash(msg); // for ed25519ph, etc\n\n    const mid = len / 2;\n    const r = sig.subarray(0, mid);\n    const s = bytesToNumberLE(sig.subarray(mid, len));\n    let A, R, SB;\n    try {\n      // ZIP-215 is more permissive than RFC 8032 / NIST186-5. Use it only for wrappers that\n      // explicitly want consensus-style unreduced encoding acceptance.\n      // zip215=true:  0 <= y < MASK (2^256 for ed25519)\n      // zip215=false: 0 <= y < P (2^255-19 for ed25519)\n      A = Point.fromBytes(publicKey, zip215);\n      R = Point.fromBytes(r, zip215);\n      SB = BASE.multiplyUnsafe(s); // 0 <= s < l is done inside\n    } catch (error) {\n      return false;\n    }\n    // RFC 8032 §§5.1.7/5.2.7 and FIPS 186-5 §§7.7.2/7.8.2 only decode A' and check the cofactored\n    // verification equation; they do not add a separate low-order-public-key rejection here.\n    // Strict mode still rejects small-order A' intentionally for SBS-style non-repudiation and to\n    // avoid ambiguous verification outcomes where unusual low-order keys can make distinct\n    // key/signature/message combinations verify.\n    if (!zip215 && A.isSmallOrder()) return false;\n\n    // ZIP-215 accepts noncanonical / unreduced point encodings, so the challenge hash must use the\n    // exact signature/public-key bytes rather than canonicalized re-encodings of the decoded points.\n    const k = hashDomainToScalar(context, r, publicKey, msg);\n    const RkA = R.add(A.multiplyUnsafe(k));\n    // Check the cofactored verification equation via the curve cofactor h.\n    // [h][S]B = [h]R + [h][k]A'\n    return RkA.subtract(SB).clearCofactor().is0();\n  }\n\n  const _size = Fp.BYTES; // 32 for ed25519, 57 for ed448\n  const lengths = {\n    secretKey: _size,\n    publicKey: _size,\n    signature: 2 * _size,\n    seed: _size,\n  };\n  function randomSecretKey(seed?: TArg<Uint8Array>): TRet<Uint8Array> {\n    seed = seed === undefined ? randomBytes(lengths.seed) : seed;\n    return abytes(seed, lengths.seed, 'seed') as TRet<Uint8Array>;\n  }\n\n  function isValidSecretKey(key: TArg<Uint8Array>): boolean {\n    return isBytes(key) && key.length === lengths.secretKey;\n  }\n\n  function isValidPublicKey(key: TArg<Uint8Array>, zip215?: boolean): boolean {\n    try {\n      // Preserve the wrapper-selected default for omitted / `undefined` ZIP-215 flags here too.\n      return !!Point.fromBytes(key, zip215 === undefined ? verifyOpts.zip215 : zip215);\n    } catch (error) {\n      return false;\n    }\n  }\n\n  const utils = {\n    getExtendedPublicKey,\n    randomSecretKey,\n    isValidSecretKey,\n    isValidPublicKey,\n    /**\n     * Converts ed public key to x public key. Uses formula:\n     * - ed25519:\n     *   - `(u, v) = ((1+y)/(1-y), sqrt(-486664)*u/x)`\n     *   - `(x, y) = (sqrt(-486664)*u/v, (u-1)/(u+1))`\n     * - ed448:\n     *   - `(u, v) = ((y-1)/(y+1), sqrt(156324)*u/x)`\n     *   - `(x, y) = (sqrt(156324)*u/v, (1+u)/(1-u))`\n     */\n    toMontgomery(publicKey: TArg<Uint8Array>): TRet<Uint8Array> {\n      const { y } = Point.fromBytes(publicKey);\n      const size = lengths.publicKey;\n      const is25519 = size === 32;\n      if (!is25519 && size !== 57) throw new Error('only defined for 25519 and 448');\n      const u = is25519 ? Fp.div(_1n + y, _1n - y) : Fp.div(y - _1n, y + _1n);\n      return Fp.toBytes(u) as TRet<Uint8Array>;\n    },\n    toMontgomerySecret(secretKey: TArg<Uint8Array>): TRet<Uint8Array> {\n      const size = lengths.secretKey;\n      abytes(secretKey, size);\n      const hashed = hash(secretKey.subarray(0, size));\n      return adjustScalarBytes(hashed).subarray(0, size) as TRet<Uint8Array>;\n    },\n  };\n  Object.freeze(lengths);\n  Object.freeze(utils);\n\n  return Object.freeze({\n    keygen: createKeygen(randomSecretKey, getPublicKey),\n    getPublicKey,\n    sign,\n    verify,\n    utils,\n    Point,\n    lengths,\n  }) satisfies Signer;\n}\n","/**\n * Montgomery curve methods. It's not really whole montgomery curve,\n * just bunch of very specific methods for X25519 / X448 from\n * [RFC 7748](https://www.rfc-editor.org/rfc/rfc7748)\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport {\n  abytes,\n  aInRange,\n  bytesToNumberLE,\n  copyBytes,\n  numberToBytesLE,\n  randomBytes,\n  validateObject,\n  type CryptoKeys,\n  type TArg,\n  type TRet,\n} from '../utils.ts';\nimport { createKeygen, type CurveLengths } from './curve.ts';\nimport { mod } from './modular.ts';\n\nconst _0n = BigInt(0);\nconst _1n = BigInt(1);\nconst _2n = BigInt(2);\n\n/** Curve-specific hooks required to build one X25519/X448 helper. */\nexport type MontgomeryOpts = {\n  /** Prime field modulus. */\n  P: bigint;\n  /** RFC 7748 variant name. */\n  type: 'x25519' | 'x448';\n  /**\n   * Clamp or otherwise normalize one scalar byte string before use.\n   * @param bytes - Raw secret scalar bytes.\n   * @returns Adjusted scalar bytes ready for Montgomery multiplication.\n   */\n  adjustScalarBytes: (bytes: TArg<Uint8Array>) => TRet<Uint8Array>;\n  /**\n   * Invert one field element with exponentiation by `p - 2`.\n   * @param x - Field element to invert.\n   * @returns Multiplicative inverse of `x`.\n   */\n  powPminus2: (x: bigint) => bigint;\n  /**\n   * Optional randomness source for `keygen()` and `utils.randomSecretKey()`.\n   * Receives the requested byte length and returns fresh random bytes.\n   */\n  randomBytes?: (bytesLength?: number) => TRet<Uint8Array>;\n};\n\n/** Public X25519/X448 ECDH API built on a Montgomery ladder. */\nexport type MontgomeryECDH = {\n  /**\n   * Multiply one scalar by one Montgomery `u` coordinate.\n   * @param scalar - Secret scalar bytes.\n   * @param u - Public Montgomery `u` coordinate.\n   * @returns Shared point encoded as bytes.\n   */\n  scalarMult: (scalar: TArg<Uint8Array>, u: TArg<Uint8Array>) => TRet<Uint8Array>;\n  /**\n   * Multiply one scalar by the curve base point.\n   * @param scalar - Secret scalar bytes.\n   * @returns Public key bytes.\n   */\n  scalarMultBase: (scalar: TArg<Uint8Array>) => TRet<Uint8Array>;\n  /**\n   * Derive a shared secret from a local secret key and peer public key.\n   * @param secretKeyA - Local secret key bytes.\n   * @param publicKeyB - Peer public key bytes.\n   * Rejects low-order public inputs instead of returning the all-zero shared secret.\n   * @returns Shared secret bytes.\n   */\n  getSharedSecret: (secretKeyA: TArg<Uint8Array>, publicKeyB: TArg<Uint8Array>) => TRet<Uint8Array>;\n  /**\n   * Derive one public key from a secret key.\n   * @param secretKey - Secret key bytes.\n   * @returns Public key bytes.\n   */\n  getPublicKey: (secretKey: TArg<Uint8Array>) => TRet<Uint8Array>;\n  /** Utility helpers for secret-key generation. */\n  utils: {\n    /** Generate one random secret key with the curve's expected byte length. */\n    randomSecretKey: () => TRet<Uint8Array>;\n  };\n  /** Encoded Montgomery base point `u`. */\n  GuBytes: TRet<Uint8Array>;\n  /** Public lengths for keys and seeds. */\n  lengths: CurveLengths;\n  /**\n   * Generate one random secret/public keypair.\n   * @param seed - Optional seed bytes to use instead of random generation.\n   * @returns Fresh secret/public keypair.\n   */\n  keygen: (seed?: TArg<Uint8Array>) => {\n    secretKey: TRet<Uint8Array>;\n    publicKey: TRet<Uint8Array>;\n  };\n};\n\nfunction validateOpts(curve: TArg<MontgomeryOpts>) {\n  // Validate constructor config eagerly, but do not call user-provided hooks here:\n  // `randomBytes` may be transcript-backed or otherwise contextual. Runtime type checks are\n  // enough to fail fast on malformed configs without consuming user state.\n  validateObject(\n    curve,\n    {\n      P: 'bigint',\n      type: 'string',\n      adjustScalarBytes: 'function',\n      powPminus2: 'function',\n    },\n    {\n      randomBytes: 'function',\n    }\n  );\n  return Object.freeze({ ...curve } as const);\n}\n\n/**\n * @param curveDef - Montgomery curve definition.\n * @returns ECDH helper namespace.\n * @throws If the curve definition or derived shared point is invalid. {@link Error}\n * @example\n * Perform one X25519 key exchange through the generic Montgomery helper.\n *\n * ```ts\n * import { x25519 } from '@noble/curves/ed25519.js';\n * const alice = x25519.keygen();\n * const shared = x25519.getSharedSecret(alice.secretKey, alice.publicKey);\n * ```\n */\nexport function montgomery(curveDef: TArg<MontgomeryOpts>): TRet<MontgomeryECDH> {\n  const CURVE = validateOpts(curveDef);\n  const { P, type, adjustScalarBytes, powPminus2, randomBytes: rand } = CURVE;\n  const is25519 = type === 'x25519';\n  if (!is25519 && type !== 'x448') throw new Error('invalid type');\n  const randomBytes_ = rand === undefined ? randomBytes : rand;\n\n  const montgomeryBits = is25519 ? 255 : 448;\n  const fieldLen = is25519 ? 32 : 56;\n  const Gu = is25519 ? BigInt(9) : BigInt(5);\n  // RFC 7748 #5:\n  // The constant a24 is (486662 - 2) / 4 = 121665 for curve25519/X25519 and\n  // (156326 - 2) / 4 = 39081 for curve448/X448\n  // const a = is25519 ? 486662n : 156326n;\n  const a24 = is25519 ? BigInt(121665) : BigInt(39081);\n  // RFC: x25519 \"the resulting integer is of the form 2^254 plus\n  // eight times a value between 0 and 2^251 - 1 (inclusive)\"\n  // x448: \"2^447 plus four times a value between 0 and 2^445 - 1 (inclusive)\"\n  const minScalar = is25519 ? _2n ** BigInt(254) : _2n ** BigInt(447);\n  const maxAdded = is25519\n    ? BigInt(8) * _2n ** BigInt(251) - _1n\n    : BigInt(4) * _2n ** BigInt(445) - _1n;\n  const maxScalar = minScalar + maxAdded + _1n; // (inclusive)\n  const modP = (n: bigint) => mod(n, P);\n  const GuBytes = encodeU(Gu);\n  function encodeU(u: bigint): TRet<Uint8Array> {\n    return numberToBytesLE(modP(u), fieldLen);\n  }\n  function decodeU(u: TArg<Uint8Array>): bigint {\n    const _u = copyBytes(abytes(u, fieldLen, 'uCoordinate'));\n    // RFC: When receiving such an array, implementations of X25519\n    // (but not X448) MUST mask the most significant bit in the final byte.\n    if (is25519) _u[31] &= 127; // 0b0111_1111\n    // RFC: Implementations MUST accept non-canonical values and process them as\n    // if they had been reduced modulo the field prime.  The non-canonical\n    // values are 2^255 - 19 through 2^255 - 1 for X25519 and 2^448 - 2^224\n    // - 1 through 2^448 - 1 for X448.\n    return modP(bytesToNumberLE(_u));\n  }\n  function decodeScalar(scalar: TArg<Uint8Array>): bigint {\n    return bytesToNumberLE(adjustScalarBytes(copyBytes(abytes(scalar, fieldLen, 'scalar'))));\n  }\n  function scalarMult(scalar: TArg<Uint8Array>, u: TArg<Uint8Array>): TRet<Uint8Array> {\n    const pu = montgomeryLadder(decodeU(u), decodeScalar(scalar));\n    // Some public keys are useless, of low-order. Curve author doesn't think\n    // it needs to be validated, but we do it nonetheless.\n    // https://cr.yp.to/ecdh.html#validate\n    if (pu === _0n) throw new Error('invalid private or public key received');\n    return encodeU(pu);\n  }\n  // Computes public key from private. By doing scalar multiplication of base point.\n  function scalarMultBase(scalar: TArg<Uint8Array>): TRet<Uint8Array> {\n    return scalarMult(scalar, GuBytes);\n  }\n  const getPublicKey = scalarMultBase;\n  const getSharedSecret = scalarMult;\n\n  // cswap from RFC7748 \"example code\"\n  function cswap(swap: bigint, x_2: bigint, x_3: bigint): { x_2: bigint; x_3: bigint } {\n    // dummy = mask(swap) AND (x_2 XOR x_3)\n    // Where mask(swap) is the all-1 or all-0 word of the same length as x_2\n    // and x_3, computed, e.g., as mask(swap) = 0 - swap.\n    const dummy = modP(swap * (x_2 - x_3));\n    x_2 = modP(x_2 - dummy); // x_2 = x_2 XOR dummy\n    x_3 = modP(x_3 + dummy); // x_3 = x_3 XOR dummy\n    return { x_2, x_3 };\n  }\n\n  /**\n   * Montgomery x-only multiplication ladder for the selected X25519/X448 curve.\n   * @param pointU - decoded Montgomery u coordinate for the selected curve\n   * @param scalar - decoded clamped scalar by which the point is multiplied\n   * @returns resulting Montgomery u coordinate for the selected curve\n   */\n  function montgomeryLadder(u: bigint, scalar: bigint): bigint {\n    aInRange('u', u, _0n, P);\n    aInRange('scalar', scalar, minScalar, maxScalar);\n    const k = scalar;\n    const x_1 = u;\n    let x_2 = _1n;\n    let z_2 = _0n;\n    let x_3 = u;\n    let z_3 = _1n;\n    let swap = _0n;\n    for (let t = BigInt(montgomeryBits - 1); t >= _0n; t--) {\n      const k_t = (k >> t) & _1n;\n      swap ^= k_t;\n      ({ x_2, x_3 } = cswap(swap, x_2, x_3));\n      ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));\n      swap = k_t;\n\n      const A = x_2 + z_2;\n      const AA = modP(A * A);\n      const B = x_2 - z_2;\n      const BB = modP(B * B);\n      const E = AA - BB;\n      const C = x_3 + z_3;\n      const D = x_3 - z_3;\n      const DA = modP(D * A);\n      const CB = modP(C * B);\n      const dacb = DA + CB;\n      const da_cb = DA - CB;\n      x_3 = modP(dacb * dacb);\n      z_3 = modP(x_1 * modP(da_cb * da_cb));\n      x_2 = modP(AA * BB);\n      z_2 = modP(E * (AA + modP(a24 * E)));\n    }\n    ({ x_2, x_3 } = cswap(swap, x_2, x_3));\n    ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));\n    const z2 = powPminus2(z_2); // `Fp.pow(x, P - _2n)` is much slower equivalent\n    return modP(x_2 * z2); // Return x_2 * (z_2^(p - 2))\n  }\n  const lengths = {\n    secretKey: fieldLen,\n    publicKey: fieldLen,\n    seed: fieldLen,\n  };\n  const randomSecretKey = (seed?: TArg<Uint8Array>): TRet<Uint8Array> => {\n    seed = seed === undefined ? randomBytes_(fieldLen) : seed;\n    abytes(seed, lengths.seed, 'seed');\n    // Reuse caller-supplied seed bytes verbatim; clamping is deferred until\n    // decodeScalar(...) when the secret key is actually used.\n    return seed as TRet<Uint8Array>;\n  };\n  const utils = { randomSecretKey };\n  Object.freeze(lengths);\n  Object.freeze(utils);\n\n  return Object.freeze({\n    keygen: createKeygen(randomSecretKey, getPublicKey),\n    getSharedSecret,\n    getPublicKey,\n    scalarMult,\n    scalarMultBase,\n    utils,\n    GuBytes: GuBytes.slice() as TRet<Uint8Array>,\n    lengths,\n  }) satisfies CryptoKeys;\n}\n","/**\n * RFC 9497: Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups.\n * https://www.rfc-editor.org/rfc/rfc9497\n *\n\nOPRF allows to interactively create an `Output = PRF(Input, serverSecretKey)`:\n\n- Server cannot calculate Output by itself: it doesn't know Input\n- Client cannot calculate Output by itself: it doesn't know server secretKey\n- An attacker interception the communication can't restore Input/Output/serverSecretKey and can't\n  link Input to some value.\n\n## Issues\n\n- Low-entropy inputs (e.g. password '123') enable brute-forced dictionary attacks by the server\n  (solveable by domain separation in POPRF)\n- High-level protocol needs to be constructed on top, because OPRF is low-level\n\n## Use cases\n\n1. **Password-Authenticated Key Exchange (PAKE):** Enables secure password login (e.g., OPAQUE)\n   without revealing the password to the server.\n2. **Private Set Intersection (PSI):** Allows two parties to compute the intersection of their\n   private sets without revealing non-intersecting elements.\n3. **Anonymous Credential Systems:** Supports issuance of anonymous, unlinkable credentials\n   (e.g., Privacy Pass) using blind OPRF evaluation.\n4. **Private Information Retrieval (PIR):** Helps users query databases without revealing which\n   item they accessed.\n5. **Encrypted Search / Secure Indexing:** Enables keyword search over encrypted data while keeping\n   queries private.\n6. **Spam Prevention and Rate-Limiting:** Issues anonymous tokens to prevent abuse\n   (e.g., CAPTCHA bypass) without compromising user privacy.\n\n## Modes\n\n- OPRF: simple mode, client doesn't need to know server public key\n- VOPRF: verifiable mode. It lets the client verify that the server used the\n  secret key corresponding to a known public key\n- POPRF: partially oblivious mode, VOPRF + domain separation\n\nThere is also non-interactive mode (Evaluate), which creates Output\nnon-interactively with knowledge of the secret key.\n\nFlow:\n- (once) Server generates secret and public keys, distributes public keys to clients\n  - deterministically: `deriveKeyPair` or just random: `generateKeyPair`\n- Client blinds input: `blind(secretInput)`\n- Server evaluates blinded input: `blindEvaluate` generated by client, sends result to client\n- Client creates output using result of evaluation via 'finalize'\n\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport {\n  abytes,\n  asciiToBytes,\n  bytesToNumberBE,\n  bytesToNumberLE,\n  concatBytes,\n  numberToBytesBE,\n  randomBytes,\n  validateObject,\n  type TArg,\n  type TRet,\n} from '../utils.ts';\nimport { pippenger, validatePointCons, type CurvePoint, type CurvePointCons } from './curve.ts';\nimport { _DST_scalar, type H2CDSTOpts } from './hash-to-curve.ts';\nimport { getMinHashLength, mapHashToField } from './modular.ts';\n\n// OPRF is designed to be used across network, so we default to serialized values.\n/** Serialized group element passed between OPRF participants. */\nexport type PointBytes = Uint8Array;\n/** Serialized scalar used for blinds and server secret keys. */\nexport type ScalarBytes = Uint8Array;\n/** Arbitrary byte input or output used by the OPRF protocol. */\nexport type Bytes = Uint8Array;\nconst _DST_scalarBytes = /* @__PURE__ */ asciiToBytes(_DST_scalar);\n/** Cryptographically secure byte generator used for blinds and proofs. */\nexport type RNG = typeof randomBytes;\n\n/** Curve and hash hooks required to instantiate one OPRF ciphersuite. */\nexport type OPRFOpts<P extends CurvePoint<any, P>> = {\n  /** Human-readable suite identifier used for domain separation. */\n  name: string;\n  /**\n   * Prime-order group used by the OPRF construction.\n   * Kept generic because the suite returns serialized points.\n   */\n  Point: CurvePointCons<P>;\n  // Fn: IField<bigint>;\n  /**\n   * Hash function used for transcripts, proofs, and outputs.\n   * @param msg - Message bytes to hash.\n   * @returns Digest bytes.\n   */\n  hash(msg: TArg<Bytes>): TRet<Bytes>;\n  /**\n   * Hash arbitrary bytes into one scalar in the suite order.\n   * @param msg - Message bytes to map.\n   * @param options - Hash-to-field domain-separation options. See {@link H2CDSTOpts}.\n   * Implementations MUST treat `msg` and `options` as read-only.\n   * @returns Scalar in the suite order.\n   */\n  hashToScalar(msg: TArg<Uint8Array>, options: TArg<H2CDSTOpts>): bigint;\n  /**\n   * Hash arbitrary bytes directly onto one curve point.\n   * @param msg - Message bytes to map.\n   * @param options - Hash-to-curve domain-separation options. See {@link H2CDSTOpts}.\n   * Implementations MUST treat `msg` and `options` as read-only.\n   * @returns Point on the suite curve.\n   */\n  hashToGroup(msg: TArg<Uint8Array>, options: TArg<H2CDSTOpts>): P;\n};\n\n/** Server keypair for one OPRF suite. */\nexport type OPRFKeys = {\n  /** Secret scalar kept by the server. */\n  secretKey: TRet<ScalarBytes>;\n  /** Public point distributed to clients in verifiable modes. */\n  publicKey: TRet<PointBytes>;\n};\n/** Result of the client-side blind step. */\nexport type OPRFBlind = {\n  /** Secret blind scalar that the client keeps locally. */\n  blind: TRet<ScalarBytes>;\n  /** Blinded group element sent to the server. */\n  blinded: TRet<PointBytes>;\n};\n/** Server response for one verifiable OPRF evaluation. */\nexport type OPRFBlindEval = {\n  /** Evaluated group element returned by the server. */\n  evaluated: TRet<PointBytes>;\n  /** DLEQ proof binding the evaluation to the server public key. */\n  proof: TRet<Bytes>;\n};\n/** Server response for a batch of verifiable OPRF evaluations. */\nexport type OPRFBlindEvalBatch = {\n  /** Evaluated group elements returned for each blinded input. */\n  evaluated: TRet<PointBytes[]>;\n  /** Batch proof covering all evaluated elements. */\n  proof: TRet<Bytes>;\n};\n/** One finalized transcript item used by batch verification helpers. */\nexport type OPRFFinalizeItem = {\n  /** Original client input. */\n  input: Bytes;\n  /** Secret blind scalar used for the input. */\n  blind: ScalarBytes;\n  /** Evaluated point returned by the server. */\n  evaluated: PointBytes;\n  /** Blinded point originally sent to the server. */\n  blinded: PointBytes;\n};\n/** Result of the POPRF client-side blind step with the tweaked server public key. */\nexport type OPRFBlindTweaked = OPRFBlind & { tweakedKey: TRet<PointBytes> };\n\n/**\n * Represents a full OPRF ciphersuite implementation according to RFC 9497.\n * This object bundles the three protocol variants (OPRF, VOPRF, POPRF) for a specific\n * prime-order group and hash function combination.\n *\n * @see https://www.rfc-editor.org/rfc/rfc9497.html\n */\nexport type OPRF = {\n  /**\n   * The unique identifier for the ciphersuite, e.g., \"ristretto255-SHA512\".\n   * This name is used for domain separation to prevent cross-protocol attacks.\n   */\n  readonly name: string;\n\n  /**\n   * The base Oblivious Pseudorandom Function (OPRF) mode (mode 0x00).\n   * This is a two-party protocol between a client and a server to compute F(k, x)\n   * where 'k' is the server's key and 'x' is the client's input.\n   *\n   * The client learns the output F(k, x) but nothing about 'k'.\n   * The server learns nothing about 'x' or F(k, x).\n   * This mode is NOT verifiable; the client cannot prove the server used a specific key.\n   */\n  readonly oprf: {\n    /**\n     * (Server-side) Generates a new random private/public key pair for the server.\n     * @returns A new key pair.\n     */\n    generateKeyPair(): TRet<OPRFKeys>;\n\n    /**\n     * (Server-side) Deterministically derives a private/public key pair from a seed.\n     * @param seed - A 32-byte cryptographically secure random seed.\n     * @param keyInfo - An optional byte string for domain separation.\n     * @returns The derived key pair.\n     */\n    deriveKeyPair(seed: TArg<Bytes>, keyInfo: TArg<Bytes>): TRet<OPRFKeys>;\n\n    /**\n     * (Client-side) The first step of the protocol. The client blinds its private input.\n     * @param input - The client's private input bytes.\n     * @param rng - An optional cryptographically secure random number generator.\n     * @returns An object containing the `blind` scalar (which the client MUST keep secret)\n     * and the `blinded` element (which the client sends to the server).\n     */\n    blind(input: TArg<Bytes>, rng?: RNG): TRet<OPRFBlind>;\n\n    /**\n     * (Server-side) The second step. The server evaluates the client's blinded element\n     * using its secret key.\n     * @param secretKey - The server's private key.\n     * @param blinded - The blinded group element received from the client.\n     * @returns The evaluated group element, to be sent back to the client.\n     */\n    blindEvaluate(secretKey: TArg<ScalarBytes>, blinded: TArg<PointBytes>): TRet<PointBytes>;\n\n    /**\n     * (Client-side) The final step. The client unblinds the server's response to\n     * compute the final OPRF output.\n     * @param input - The original private input from the `blind` step.\n     * @param blind - The secret scalar from the `blind` step.\n     * @param evaluated - The evaluated group element received from the server.\n     * @returns The final OPRF output, `Hash(len(input)||input||len(unblinded)||unblinded||\"Finalize\")`.\n     */\n    finalize(\n      input: TArg<Bytes>,\n      blind: TArg<ScalarBytes>,\n      evaluated: TArg<PointBytes>\n    ): TRet<Bytes>;\n  };\n\n  /**\n   * The Verifiable Oblivious Pseudorandom Function (VOPRF) mode (mode 0x01).\n   * This mode extends the base OPRF by providing a proof that the server used the\n   * secret key corresponding to its known public key.\n   */\n  readonly voprf: {\n    /** (Server-side) Generates a key pair for the VOPRF mode. */\n    generateKeyPair(): TRet<OPRFKeys>;\n    /** (Server-side) Deterministically derives a key pair for the VOPRF mode. */\n    deriveKeyPair(seed: TArg<Bytes>, keyInfo: TArg<Bytes>): TRet<OPRFKeys>;\n    /** (Client-side) Blinds the client's private input for the VOPRF protocol. */\n    blind(input: TArg<Bytes>, rng?: RNG): TRet<OPRFBlind>;\n\n    /**\n     * (Server-side) Evaluates the client's blinded element and generates a DLEQ proof\n     * of correctness.\n     * @param secretKey - The server's private key.\n     * @param publicKey - The server's public key, used in proof generation.\n     * @param blinded - The blinded group element received from the client.\n     * @param rng - An optional cryptographically secure random number generator for the proof.\n     * @returns The evaluated element and a proof of correct computation.\n     */\n    blindEvaluate(\n      secretKey: TArg<ScalarBytes>,\n      publicKey: TArg<PointBytes>,\n      blinded: TArg<PointBytes>,\n      rng?: RNG\n    ): TRet<OPRFBlindEval>;\n\n    /**\n     * (Server-side) An optimized batch version of `blindEvaluate`. It evaluates multiple\n     * blinded elements and produces a single, constant-size proof for the entire batch,\n     * amortizing the cost of proof generation.\n     * @param secretKey - The server's private key.\n     * @param publicKey - The server's public key.\n     * @param blinded - An array of blinded group elements from one or more clients.\n     * @param rng - An optional cryptographically secure random number generator for the proof.\n     * @returns An array of evaluated elements and a single proof for the batch.\n     */\n    blindEvaluateBatch(\n      secretKey: TArg<ScalarBytes>,\n      publicKey: TArg<PointBytes>,\n      blinded: TArg<PointBytes[]>,\n      rng?: RNG\n    ): TRet<OPRFBlindEvalBatch>;\n\n    /**\n     * (Client-side) The final step. The client verifies the server's proof, and if valid,\n     * unblinds the result to compute the final VOPRF output.\n     * @param input - The original private input.\n     * @param blind - The secret scalar from the `blind` step.\n     * @param evaluated - The evaluated element from the server.\n     * @param blinded - The blinded element sent to the server (needed for proof verification).\n     * @param publicKey - The server's public key against which the proof is verified.\n     * @param proof - The DLEQ proof from the server.\n     * @returns The final VOPRF output.\n     * @throws If the proof verification fails. {@link Error}\n     */\n    finalize(\n      input: TArg<Bytes>,\n      blind: TArg<ScalarBytes>,\n      evaluated: TArg<PointBytes>,\n      blinded: TArg<PointBytes>,\n      publicKey: TArg<PointBytes>,\n      proof: TArg<Bytes>\n    ): TRet<Bytes>;\n\n    /**\n     * (Client-side) The batch-aware version of `finalize`. It verifies a single batch proof\n     * against a list of corresponding inputs and outputs.\n     * @param items - An array of objects, each containing the parameters for a single finalization.\n     * @param publicKey - The server's public key.\n     * @param proof - The single DLEQ proof for the entire batch.\n     * @returns An array of final VOPRF outputs, one for each item in the input.\n     * @throws If the proof verification fails. {@link Error}\n     */\n    finalizeBatch(\n      items: TArg<OPRFFinalizeItem[]>,\n      publicKey: TArg<PointBytes>,\n      proof: TArg<Bytes>\n    ): TRet<Bytes[]>;\n  };\n\n  /**\n   * A factory for the Partially Oblivious Pseudorandom Function (POPRF) mode (mode 0x02).\n   * This mode extends VOPRF to include a public `info` parameter, known to both client and\n   * server, which is cryptographically bound to the final output.\n   * This is useful for domain separation at the application level.\n   * @param info - A public byte string to be mixed into the computation.\n   * @returns An object with the POPRF protocol functions.\n   */\n  readonly poprf: (info: TArg<Bytes>) => {\n    /** (Server-side) Generates a key pair for the POPRF mode. */\n    generateKeyPair(): TRet<OPRFKeys>;\n    /** (Server-side) Deterministically derives a key pair for the POPRF mode. */\n    deriveKeyPair(seed: TArg<Bytes>, keyInfo: TArg<Bytes>): TRet<OPRFKeys>;\n\n    /**\n     * (Client-side) Blinds the client's private input and computes the \"tweaked key\".\n     * The tweaked key is a public value derived from the server's public key and the public `info`.\n     * @param input - The client's private input.\n     * @param publicKey - The server's public key.\n     * @param rng - An optional cryptographically secure random number generator.\n     * @returns The `blind`, `blinded` element, and the `tweakedKey`\n     *   the client uses for verification.\n     */\n    blind(input: TArg<Bytes>, publicKey: TArg<PointBytes>, rng?: RNG): TRet<OPRFBlindTweaked>;\n\n    /**\n     * (Server-side) Evaluates the blinded element using a key derived from\n     * its secret key and the public `info`.\n     * It generates a DLEQ proof against the tweaked key.\n     * @param secretKey - The server's private key.\n     * @param blinded - The blinded element from the client.\n     * @param rng - An optional RNG for the proof.\n     * @returns The evaluated element and a proof of correct computation.\n     */\n    blindEvaluate(\n      secretKey: TArg<ScalarBytes>,\n      blinded: TArg<PointBytes>,\n      rng?: RNG\n    ): TRet<OPRFBlindEval>;\n\n    /**\n     * (Server-side) A batch-aware version of `blindEvaluate` for the POPRF mode.\n     * @param secretKey - The server's private key.\n     * @param blinded - An array of blinded elements.\n     * @param rng - An optional RNG for the proof.\n     * @returns An array of evaluated elements and a single proof for the batch.\n     */\n    blindEvaluateBatch(\n      secretKey: TArg<ScalarBytes>,\n      blinded: TArg<PointBytes[]>,\n      rng: RNG\n    ): TRet<OPRFBlindEvalBatch>;\n\n    /**\n     * (Client-side) A batch-aware version of `finalize` for the POPRF mode.\n     * It verifies the proof against the tweaked key.\n     * @param items - An array containing the parameters for each finalization.\n     * @param proof - The single DLEQ proof for the batch.\n     * @param tweakedKey - The tweaked key corresponding to the proof.\n     *   All items must share the same `info` and `publicKey`.\n     * @returns An array of final POPRF outputs.\n     * @throws If proof verification fails. {@link Error}\n     */\n    finalizeBatch(\n      items: TArg<OPRFFinalizeItem[]>,\n      proof: TArg<Bytes>,\n      tweakedKey: TArg<PointBytes>\n    ): TRet<Bytes[]>;\n\n    /**\n     * (Client-side) Finalizes the POPRF protocol. It verifies the server's proof against the\n     * `tweakedKey` computed in the `blind` step. The final output is bound to the public `info`.\n     * @param input - The original private input.\n     * @param blind - The secret scalar.\n     * @param evaluated - The evaluated element from the server.\n     * @param blinded - The blinded element sent to the server.\n     * @param proof - The DLEQ proof from the server.\n     * @param tweakedKey - The public tweaked key computed by the client during the `blind` step.\n     * @returns The final POPRF output.\n     * @throws If proof verification fails. {@link Error}\n     */\n    finalize(\n      input: TArg<Bytes>,\n      blind: TArg<ScalarBytes>,\n      evaluated: TArg<PointBytes>,\n      blinded: TArg<PointBytes>,\n      proof: TArg<Bytes>,\n      tweakedKey: TArg<PointBytes>\n    ): TRet<Bytes>;\n\n    /**\n     * A non-interactive evaluation function for an entity that knows all inputs.\n     * Computes the final POPRF output directly. Useful for testing or specific applications\n     * where the server needs to compute the output for a known input.\n     * @param secretKey - The server's private key.\n     * @param input - The client's private input.\n     * @returns The final POPRF output.\n     */\n    evaluate(secretKey: TArg<ScalarBytes>, input: TArg<Bytes>): TRet<Bytes>;\n  };\n};\n\n// welcome to generic hell\n/**\n * @param opts - OPRF ciphersuite options. See {@link OPRFOpts}.\n * @returns OPRF helper namespace.\n * @example\n * Instantiate an OPRF suite from curve-specific hashing hooks.\n *\n * ```ts\n * import { createOPRF } from '@noble/curves/abstract/oprf.js';\n * import { p256, p256_hasher } from '@noble/curves/nist.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const oprf = createOPRF({\n *   name: 'P256-SHA256',\n *   Point: p256.Point,\n *   hash: sha256,\n *   hashToGroup: p256_hasher.hashToCurve,\n *   hashToScalar: p256_hasher.hashToScalar,\n * });\n * const keys = oprf.oprf.generateKeyPair();\n * ```\n */\nexport function createOPRF<P extends CurvePoint<any, P>>(opts: OPRFOpts<P>): TRet<OPRF> {\n  validateObject(opts, {\n    name: 'string',\n    hash: 'function',\n    hashToScalar: 'function',\n    hashToGroup: 'function',\n  });\n  // Cheap constructor-surface sanity check only: this verifies the generic static hooks/fields that\n  // OPRF consumes, but it does not certify point semantics like BASE/ZERO correctness.\n  validatePointCons(opts.Point);\n  const { name, Point, hash } = opts;\n  const { Fn } = Point;\n\n  const hashToGroup = (msg: TArg<Uint8Array>, ctx: TArg<Uint8Array>) =>\n    opts.hashToGroup(msg, {\n      DST: concatBytes(asciiToBytes('HashToGroup-'), ctx),\n    }) as P;\n  const hashToScalarPrefixed = (msg: TArg<Uint8Array>, ctx: TArg<Uint8Array>) =>\n    opts.hashToScalar(msg, { DST: concatBytes(_DST_scalarBytes, ctx) });\n  const randomScalar = (rng: RNG = randomBytes) => {\n    // RFC 9497 §2.1 defines RandomScalar as nonzero; blind inversion and generated public keys\n    // both rely on keeping this helper in the `1..n-1` range.\n    const t = mapHashToField(rng(getMinHashLength(Fn.ORDER)), Fn.ORDER, Fn.isLE);\n    // We cannot use Fn.fromBytes here, because field\n    // can have different number of bytes (like ed448)\n    return Fn.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t);\n  };\n\n  const msm = (points: P[], scalars: bigint[]) => pippenger(Point, points, scalars);\n\n  const getCtx = (mode: number) =>\n    concatBytes(asciiToBytes('OPRFV1-'), new Uint8Array([mode]), asciiToBytes('-' + name));\n  const ctxOPRF = getCtx(0x00);\n  const ctxVOPRF = getCtx(0x01);\n  const ctxPOPRF = getCtx(0x02);\n\n  function encode(...args: TArg<(Uint8Array | number | string)[]>): TRet<Bytes> {\n    const res = [];\n    for (const a of args) {\n      if (typeof a === 'number') res.push(numberToBytesBE(a, 2));\n      else if (typeof a === 'string') res.push(asciiToBytes(a));\n      else {\n        abytes(a);\n        res.push(numberToBytesBE(a.length, 2), a);\n      }\n    }\n    // No wipe here, since will modify actual bytes\n    return concatBytes(...res) as TRet<Bytes>;\n  }\n  const inputBytes = (title: string, bytes: TArg<Uint8Array>) => {\n    abytes(bytes, undefined, title);\n    // RFC 9497 §1.2 limits PrivateInput/PublicInput to 2^16 - 1 bytes because these values are\n    // length-prefixed with two bytes before use throughout the protocol.\n    if (bytes.length > 0xffff)\n      throw new Error(\n        `\"${title}\" expected Uint8Array of length <= 65535, got length=${bytes.length}`\n      );\n    return bytes;\n  };\n  const hashInput = (...bytes: TArg<Uint8Array[]>): TRet<Bytes> =>\n    hash(encode(...bytes, 'Finalize')) as TRet<Bytes>;\n\n  function getTranscripts(B: P, C: P[], D: P[], ctx: TArg<Bytes>) {\n    const Bm = B.toBytes();\n    const seed = hash(encode(Bm, concatBytes(asciiToBytes('Seed-'), ctx)));\n    const res: bigint[] = [];\n    for (let i = 0; i < C.length; i++) {\n      const Ci = C[i].toBytes();\n      const Di = D[i].toBytes();\n      const di = hashToScalarPrefixed(encode(seed, i, Ci, Di, 'Composite'), ctx);\n      res.push(di);\n    }\n    return res;\n  }\n\n  function computeComposites(B: P, C: P[], D: P[], ctx: TArg<Bytes>) {\n    const T = getTranscripts(B, C, D, ctx);\n    const M = msm(C, T);\n    const Z = msm(D, T);\n    return { M, Z };\n  }\n\n  function computeCompositesFast(\n    k: bigint,\n    B: P,\n    C: P[],\n    D: P[],\n    ctx: TArg<Bytes>\n  ): { M: P; Z: P } {\n    const T = getTranscripts(B, C, D, ctx);\n    const M = msm(C, T);\n    // RFC 9497 §2.2.1 ComputeCompositesFast derives weights from both C and D in getTranscripts(),\n    // then uses the server shortcut Z = k * M instead of a second MSM over D.\n    const Z = M.multiply(k);\n    return { M, Z };\n  }\n\n  function challengeTranscript(B: P, M: P, Z: P, t2: P, t3: P, ctx: TArg<Bytes>) {\n    const [Bm, a0, a1, a2, a3] = [B, M, Z, t2, t3].map((i) => i.toBytes());\n    return hashToScalarPrefixed(encode(Bm, a0, a1, a2, a3, 'Challenge'), ctx);\n  }\n\n  function generateProof(ctx: TArg<Bytes>, k: bigint, B: P, C: P[], D: P[], rng: RNG): TRet<Bytes> {\n    const { M, Z } = computeCompositesFast(k, B, C, D, ctx);\n    const r = randomScalar(rng);\n    const t2 = Point.BASE.multiply(r);\n    const t3 = M.multiply(r);\n    const c = challengeTranscript(B, M, Z, t2, t3, ctx);\n    const s = Fn.sub(r, Fn.mul(c, k)); // r - c*k\n    return concatBytes(...[c, s].map((i) => Fn.toBytes(i))) as TRet<Bytes>;\n  }\n\n  function verifyProof(ctx: TArg<Bytes>, B: P, C: P[], D: P[], proof: TArg<Bytes>) {\n    abytes(proof, 2 * Fn.BYTES);\n    const { M, Z } = computeComposites(B, C, D, ctx);\n    const [c, s] = [proof.subarray(0, Fn.BYTES), proof.subarray(Fn.BYTES)].map((f) =>\n      Fn.fromBytes(f)\n    );\n    const t2 = Point.BASE.multiply(s).add(B.multiply(c)); // s*G + c*B\n    const t3 = M.multiply(s).add(Z.multiply(c)); // s*M + c*Z\n    const expectedC = challengeTranscript(B, M, Z, t2, t3, ctx);\n    if (!Fn.eql(c, expectedC)) throw new Error('proof verification failed');\n  }\n\n  function generateKeyPair(): TRet<OPRFKeys> {\n    const skS = randomScalar();\n    const pkS = Point.BASE.multiply(skS);\n    return { secretKey: Fn.toBytes(skS), publicKey: pkS.toBytes() } as TRet<OPRFKeys>;\n  }\n\n  function deriveKeyPair(ctx: TArg<Bytes>, seed: TArg<Bytes>, info: TArg<Bytes>): TRet<OPRFKeys> {\n    // RFC 9497 §3.2.1 defines `seed[32]`; reject other sizes here because this public API already\n    // documents a 32-byte seed instead of generic input keying material.\n    abytes(seed, 32, 'seed');\n    info = inputBytes('keyInfo', info);\n    const dst = concatBytes(asciiToBytes('DeriveKeyPair'), ctx);\n    const msg = concatBytes(seed, encode(info), Uint8Array.of(0));\n    for (let counter = 0; counter <= 255; counter++) {\n      msg[msg.length - 1] = counter;\n      const skS = opts.hashToScalar(msg, { DST: dst });\n      if (Fn.is0(skS)) continue; // should not happen\n      return {\n        secretKey: Fn.toBytes(skS),\n        publicKey: Point.BASE.multiply(skS).toBytes(),\n      } as TRet<OPRFKeys>;\n    }\n    throw new Error('Cannot derive key');\n  }\n  const wirePoint = (label: string, bytes: TArg<Uint8Array>) => {\n    const point = Point.fromBytes(bytes);\n    // RFC 9497 §3.3 says applications MUST reject group-identity Elements received over the wire\n    // after deserialization, even if the suite decoder itself accepts the identity encoding.\n    if (point.equals(Point.ZERO)) throw new Error(label + ' point at infinity');\n    return point;\n  };\n  function blind(\n    ctx: TArg<Bytes>,\n    input: TArg<Uint8Array>,\n    rng: RNG = randomBytes\n  ): TRet<OPRFBlind> {\n    input = inputBytes('input', input);\n    const blind = randomScalar(rng);\n    const inputPoint = hashToGroup(input, ctx);\n    if (inputPoint.equals(Point.ZERO)) throw new Error('Input point at infinity');\n    const blinded = inputPoint.multiply(blind);\n    return { blind: Fn.toBytes(blind), blinded: blinded.toBytes() } as TRet<OPRFBlind>;\n  }\n  function evaluate(\n    ctx: TArg<Bytes>,\n    secretKey: TArg<ScalarBytes>,\n    input: TArg<Bytes>\n  ): TRet<Bytes> {\n    input = inputBytes('input', input);\n    const skS = Fn.fromBytes(secretKey);\n    const inputPoint = hashToGroup(input, ctx);\n    if (inputPoint.equals(Point.ZERO)) throw new Error('Input point at infinity');\n    const unblinded = inputPoint.multiply(skS).toBytes();\n    return hashInput(input, unblinded);\n  }\n  const oprf = Object.freeze({\n    generateKeyPair,\n    deriveKeyPair: (seed: TArg<Bytes>, keyInfo: TArg<Bytes>) =>\n      deriveKeyPair(ctxOPRF, seed, keyInfo),\n    blind: (input: TArg<Bytes>, rng: RNG = randomBytes) => blind(ctxOPRF, input, rng),\n    blindEvaluate(secretKey: TArg<ScalarBytes>, blindedPoint: TArg<PointBytes>): TRet<PointBytes> {\n      const skS = Fn.fromBytes(secretKey);\n      const elm = wirePoint('blinded', blindedPoint);\n      return elm.multiply(skS).toBytes() as TRet<PointBytes>;\n    },\n    finalize(\n      input: TArg<Bytes>,\n      blindBytes: TArg<ScalarBytes>,\n      evaluatedBytes: TArg<PointBytes>\n    ): TRet<Bytes> {\n      input = inputBytes('input', input);\n      const blind = Fn.fromBytes(blindBytes);\n      const evalPoint = wirePoint('evaluated', evaluatedBytes);\n      const unblinded = evalPoint.multiply(Fn.inv(blind)).toBytes();\n      return hashInput(input, unblinded);\n    },\n    evaluate: (secretKey: TArg<ScalarBytes>, input: TArg<Bytes>) =>\n      evaluate(ctxOPRF, secretKey, input),\n  });\n\n  const voprf = Object.freeze({\n    generateKeyPair,\n    deriveKeyPair: (seed: TArg<Bytes>, keyInfo: TArg<Bytes>) =>\n      deriveKeyPair(ctxVOPRF, seed, keyInfo),\n    blind: (input: TArg<Bytes>, rng: RNG = randomBytes) => blind(ctxVOPRF, input, rng),\n    blindEvaluateBatch(\n      secretKey: TArg<ScalarBytes>,\n      publicKey: TArg<PointBytes>,\n      blinded: TArg<PointBytes[]>,\n      rng: RNG = randomBytes\n    ): TRet<OPRFBlindEvalBatch> {\n      if (!Array.isArray(blinded)) throw new Error('expected array');\n      const skS = Fn.fromBytes(secretKey);\n      const pkS = wirePoint('public key', publicKey);\n      const blindedPoints = blinded.map((i) => wirePoint('blinded', i));\n      const evaluated = blindedPoints.map((i) => i.multiply(skS));\n      const proof = generateProof(ctxVOPRF, skS, pkS, blindedPoints, evaluated, rng);\n      return { evaluated: evaluated.map((i) => i.toBytes()), proof } as TRet<OPRFBlindEvalBatch>;\n    },\n    blindEvaluate(\n      secretKey: TArg<ScalarBytes>,\n      publicKey: TArg<PointBytes>,\n      blinded: TArg<PointBytes>,\n      rng: RNG = randomBytes\n    ): TRet<OPRFBlindEval> {\n      const res = this.blindEvaluateBatch(secretKey, publicKey, [blinded], rng);\n      return { evaluated: res.evaluated[0], proof: res.proof } as TRet<OPRFBlindEval>;\n    },\n    finalizeBatch(\n      items: TArg<OPRFFinalizeItem[]>,\n      publicKey: TArg<PointBytes>,\n      proof: TArg<Bytes>\n    ): TRet<Bytes[]> {\n      if (!Array.isArray(items)) throw new Error('expected array');\n      const pkS = wirePoint('public key', publicKey);\n      const blindedPoints = items.map((i) => wirePoint('blinded', i.blinded));\n      const evalPoints = items.map((i) => wirePoint('evaluated', i.evaluated));\n      verifyProof(ctxVOPRF, pkS, blindedPoints, evalPoints, proof);\n      return items.map((i) => oprf.finalize(i.input, i.blind, i.evaluated)) as TRet<Bytes[]>;\n    },\n    finalize(\n      input: TArg<Bytes>,\n      blind: TArg<ScalarBytes>,\n      evaluated: TArg<PointBytes>,\n      blinded: TArg<PointBytes>,\n      publicKey: TArg<PointBytes>,\n      proof: TArg<Bytes>\n    ): TRet<Bytes> {\n      return this.finalizeBatch([{ input, blind, evaluated, blinded }], publicKey, proof)[0];\n    },\n    evaluate: (secretKey: TArg<ScalarBytes>, input: TArg<Bytes>) =>\n      evaluate(ctxVOPRF, secretKey, input),\n  });\n  // NOTE: info is domain separation\n  const poprf = (info: TArg<Bytes>) => {\n    info = inputBytes('info', info);\n    const m = hashToScalarPrefixed(encode('Info', info), ctxPOPRF);\n    const T = Point.BASE.multiply(m);\n    return Object.freeze({\n      generateKeyPair,\n      deriveKeyPair: (seed: TArg<Bytes>, keyInfo: TArg<Bytes>) =>\n        deriveKeyPair(ctxPOPRF, seed, keyInfo),\n      blind(\n        input: TArg<Bytes>,\n        publicKey: TArg<PointBytes>,\n        rng: RNG = randomBytes\n      ): TRet<OPRFBlindTweaked> {\n        input = inputBytes('input', input);\n        const pkS = wirePoint('public key', publicKey);\n        const tweakedKey = T.add(pkS);\n        if (tweakedKey.equals(Point.ZERO)) throw new Error('tweakedKey point at infinity');\n        const blind = randomScalar(rng);\n        const inputPoint = hashToGroup(input, ctxPOPRF);\n        if (inputPoint.equals(Point.ZERO)) throw new Error('Input point at infinity');\n        const blindedPoint = inputPoint.multiply(blind);\n        return {\n          blind: Fn.toBytes(blind),\n          blinded: blindedPoint.toBytes(),\n          tweakedKey: tweakedKey.toBytes(),\n        } as TRet<OPRFBlindTweaked>;\n      },\n      blindEvaluateBatch(\n        secretKey: TArg<ScalarBytes>,\n        blinded: TArg<PointBytes[]>,\n        rng: RNG = randomBytes\n      ): TRet<OPRFBlindEvalBatch> {\n        if (!Array.isArray(blinded)) throw new Error('expected array');\n        const skS = Fn.fromBytes(secretKey);\n        const t = Fn.add(skS, m);\n        // \"Hence, this error can be a signal for the server to replace its\n        // private key\". We throw inside; this should be impossible.\n        const invT = Fn.inv(t);\n        const blindedPoints = blinded.map((i) => wirePoint('blinded', i));\n        const evalPoints = blindedPoints.map((i) => i.multiply(invT));\n        const tweakedKey = Point.BASE.multiply(t);\n        const proof = generateProof(ctxPOPRF, t, tweakedKey, evalPoints, blindedPoints, rng);\n        return { evaluated: evalPoints.map((i) => i.toBytes()), proof } as TRet<OPRFBlindEvalBatch>;\n      },\n      blindEvaluate(\n        secretKey: TArg<ScalarBytes>,\n        blinded: TArg<PointBytes>,\n        rng: RNG = randomBytes\n      ): TRet<OPRFBlindEval> {\n        const res = this.blindEvaluateBatch(secretKey, [blinded], rng);\n        return { evaluated: res.evaluated[0], proof: res.proof } as TRet<OPRFBlindEval>;\n      },\n      finalizeBatch(\n        items: TArg<OPRFFinalizeItem[]>,\n        proof: TArg<Bytes>,\n        tweakedKey: TArg<PointBytes>\n      ): TRet<Bytes[]> {\n        if (!Array.isArray(items)) throw new Error('expected array');\n        const inputs = items.map((i) => inputBytes('input', i.input));\n        const evalPoints = items.map((i) => wirePoint('evaluated', i.evaluated));\n        verifyProof(\n          ctxPOPRF,\n          wirePoint('tweakedKey', tweakedKey),\n          evalPoints,\n          items.map((i) => wirePoint('blinded', i.blinded)),\n          proof\n        );\n        return items.map((i, j) => {\n          const blind = Fn.fromBytes(i.blind);\n          const point = evalPoints[j].multiply(Fn.inv(blind)).toBytes();\n          return hashInput(inputs[j], info, point);\n        }) as TRet<Bytes[]>;\n      },\n      finalize(\n        input: TArg<Bytes>,\n        blind: TArg<ScalarBytes>,\n        evaluated: TArg<PointBytes>,\n        blinded: TArg<PointBytes>,\n        proof: TArg<Bytes>,\n        tweakedKey: TArg<PointBytes>\n      ): TRet<Bytes> {\n        return this.finalizeBatch([{ input, blind, evaluated, blinded }], proof, tweakedKey)[0];\n      },\n      evaluate(secretKey: TArg<ScalarBytes>, input: TArg<Bytes>): TRet<Bytes> {\n        input = inputBytes('input', input);\n        const skS = Fn.fromBytes(secretKey);\n        const inputPoint = hashToGroup(input, ctxPOPRF);\n        if (inputPoint.equals(Point.ZERO)) throw new Error('Input point at infinity');\n        const t = Fn.add(skS, m);\n        const invT = Fn.inv(t);\n        const unblinded = inputPoint.multiply(invT).toBytes();\n        return hashInput(input, info, unblinded);\n      },\n    });\n  };\n  const res = { name, oprf, voprf, poprf, __tests: Object.freeze({ Fn }) };\n  return Object.freeze(res) as TRet<OPRF>;\n}\n","/**\n * ed25519 Twisted Edwards curve with following addons:\n * - X25519 ECDH\n * - Ristretto cofactor elimination\n * - Elligator hash-to-group / point indistinguishability\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha512 } from '@noble/hashes/sha2.js';\nimport { abytes, concatBytes, hexToBytes } from '@noble/hashes/utils.js';\nimport { type AffinePoint } from './abstract/curve.ts';\nimport {\n  eddsa,\n  edwards,\n  PrimeEdwardsPoint,\n  type EdDSA,\n  type EdDSAOpts,\n  type EdwardsOpts,\n  type EdwardsPoint,\n  type EdwardsPointCons,\n} from './abstract/edwards.ts';\nimport { createFROST, type FROST } from './abstract/frost.ts';\nimport {\n  _DST_scalar,\n  createHasher,\n  expand_message_xmd,\n  type H2CDSTOpts,\n  type H2CHasher,\n  type H2CHasherBase,\n} from './abstract/hash-to-curve.ts';\nimport {\n  FpInvertBatch,\n  FpSqrtEven,\n  isNegativeLE,\n  mod,\n  pow2,\n  type IField,\n} from './abstract/modular.ts';\nimport { montgomery, type MontgomeryECDH } from './abstract/montgomery.ts';\nimport { createOPRF, type OPRF } from './abstract/oprf.ts';\nimport { asciiToBytes, bytesToNumberLE, equalBytes, type TArg, type TRet } from './utils.ts';\n\n// prettier-ignore\nconst _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _3n = /* @__PURE__ */ BigInt(3);\n// prettier-ignore\nconst _5n = /* @__PURE__ */ BigInt(5), _8n = /* @__PURE__ */ BigInt(8);\n\n// P = 2n**255n - 19n\nconst ed25519_CURVE_p = /* @__PURE__ */ BigInt(\n  '0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed'\n);\n// N = 2n**252n + 27742317777372353535851937790883648493n\n// a = Fp.create(BigInt(-1))\n// d = -121665/121666 a.k.a. Fp.neg(121665 * Fp.inv(121666))\nconst ed25519_CURVE: EdwardsOpts = /* @__PURE__ */ (() => ({\n  p: ed25519_CURVE_p,\n  n: BigInt('0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed'),\n  h: _8n,\n  a: BigInt('0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec'),\n  d: BigInt('0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3'),\n  Gx: BigInt('0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a'),\n  Gy: BigInt('0x6666666666666666666666666666666666666666666666666666666666666658'),\n}))();\n\nfunction ed25519_pow_2_252_3(x: bigint) {\n  // prettier-ignore\n  const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);\n  const P = ed25519_CURVE_p;\n  const x2 = (x * x) % P;\n  const b2 = (x2 * x) % P; // x^3, 11\n  const b4 = (pow2(b2, _2n, P) * b2) % P; // x^15, 1111\n  const b5 = (pow2(b4, _1n, P) * x) % P; // x^31\n  const b10 = (pow2(b5, _5n, P) * b5) % P;\n  const b20 = (pow2(b10, _10n, P) * b10) % P;\n  const b40 = (pow2(b20, _20n, P) * b20) % P;\n  const b80 = (pow2(b40, _40n, P) * b40) % P;\n  const b160 = (pow2(b80, _80n, P) * b80) % P;\n  const b240 = (pow2(b160, _80n, P) * b80) % P;\n  const b250 = (pow2(b240, _10n, P) * b10) % P;\n  const pow_p_5_8 = (pow2(b250, _2n, P) * x) % P;\n  // ^ This is x^((p-5)/8); multiply by x once more to get x^((p+3)/8).\n  return { pow_p_5_8, b2 };\n}\n\n// Mutates and returns the provided 32-byte buffer in place.\nfunction adjustScalarBytes(bytes: TArg<Uint8Array>): TRet<Uint8Array> {\n  // Section 5: For X25519, in order to decode 32 random bytes as an integer scalar,\n  // set the three least significant bits of the first byte\n  bytes[0] &= 248; // 0b1111_1000\n  // and the most significant bit of the last to zero,\n  bytes[31] &= 127; // 0b0111_1111\n  // set the second most significant bit of the last byte to 1\n  bytes[31] |= 64; // 0b0100_0000\n  return bytes as TRet<Uint8Array>;\n}\n\n// √(-1) aka √(a) aka 2^((p-1)/4)\n// Fp.sqrt(Fp.neg(1))\nconst ED25519_SQRT_M1 = /* @__PURE__ */ BigInt(\n  '19681161376707505956807079304988542015446066515923890162744021073123829784752'\n);\n// sqrt(u/v). Returns `{ isValid, value }`; on non-squares `value` is still a\n// dummy root-shaped field element so callers can stay constant-time.\nfunction uvRatio(u: bigint, v: bigint): { isValid: boolean; value: bigint } {\n  const P = ed25519_CURVE_p;\n  const v3 = mod(v * v * v, P); // v³\n  const v7 = mod(v3 * v3 * v, P); // v⁷\n  // (p+3)/8 and (p-5)/8\n  const pow = ed25519_pow_2_252_3(u * v7).pow_p_5_8;\n  let x = mod(u * v3 * pow, P); // (uv³)(uv⁷)^(p-5)/8\n  const vx2 = mod(v * x * x, P); // vx²\n  const root1 = x; // First root candidate\n  const root2 = mod(x * ED25519_SQRT_M1, P); // Second root candidate\n  const useRoot1 = vx2 === u; // If vx² = u (mod p), x is a square root\n  const useRoot2 = vx2 === mod(-u, P); // If vx² = -u, set x <-- x * 2^((p-1)/4)\n  const noRoot = vx2 === mod(-u * ED25519_SQRT_M1, P); // There is no valid root, vx² = -u√(-1)\n  if (useRoot1) x = root1;\n  if (useRoot2 || noRoot) x = root2; // We return root2 anyway, for const-time\n  if (isNegativeLE(x, P)) x = mod(-x, P);\n  return { isValid: useRoot1 || useRoot2, value: x };\n}\n\nconst ed25519_Point = /* @__PURE__ */ edwards(ed25519_CURVE, { uvRatio });\n// Public field alias stays stricter than the RFC 8032 Appendix A sample code:\n// `Fp.inv(0)` throws instead of returning `0`.\nconst Fp = /* @__PURE__ */ (() => ed25519_Point.Fp)();\nconst Fn = /* @__PURE__ */ (() => ed25519_Point.Fn)();\n\n// RFC 8032 `dom2` helper for ctx/ph variants only. Plain Ed25519 keeps the\n// empty-domain path in `ed()` and would be wrong if routed through this helper.\nfunction ed25519_domain(\n  data: TArg<Uint8Array>,\n  ctx: TArg<Uint8Array>,\n  phflag: boolean\n): TRet<Uint8Array> {\n  if (ctx.length > 255) throw new Error('Context is too big');\n  return concatBytes(\n    asciiToBytes('SigEd25519 no Ed25519 collisions'),\n    new Uint8Array([phflag ? 1 : 0, ctx.length]),\n    ctx,\n    data\n  ) as TRet<Uint8Array>;\n}\n\nfunction ed(opts: TArg<EdDSAOpts>) {\n  // Ed25519 keeps ZIP-215 default verification semantics for consensus compatibility.\n  return eddsa(\n    ed25519_Point,\n    sha512,\n    Object.assign({ adjustScalarBytes, zip215: true }, opts as EdDSAOpts)\n  );\n}\n\n/**\n * ed25519 curve with EdDSA signatures.\n * Seeded `keygen(seed)` / `utils.randomSecretKey(seed)` reuse the provided\n * 32-byte seed buffer instead of copying it.\n * @example\n * Generate one Ed25519 keypair, sign a message, and verify it.\n *\n * ```js\n * import { ed25519 } from '@noble/curves/ed25519.js';\n * const { secretKey, publicKey } = ed25519.keygen();\n * // const publicKey = ed25519.getPublicKey(secretKey);\n * const msg = new TextEncoder().encode('hello noble');\n * const sig = ed25519.sign(msg, secretKey);\n * const isValid = ed25519.verify(sig, msg, publicKey); // ZIP215\n * // RFC8032 / FIPS 186-5\n * const isValid2 = ed25519.verify(sig, msg, publicKey, { zip215: false });\n * ```\n */\nexport const ed25519: EdDSA = /* @__PURE__ */ ed({});\n/**\n * Context version of ed25519 (ctx for domain separation). See {@link ed25519}\n * Seeded `keygen(seed)` / `utils.randomSecretKey(seed)` reuse the provided\n * 32-byte seed buffer instead of copying it.\n * @example\n * Sign and verify with Ed25519ctx under one explicit context.\n *\n * ```ts\n * const context = new TextEncoder().encode('docs');\n * const { secretKey, publicKey } = ed25519ctx.keygen();\n * const msg = new TextEncoder().encode('hello noble');\n * const sig = ed25519ctx.sign(msg, secretKey, { context });\n * const isValid = ed25519ctx.verify(sig, msg, publicKey, { context });\n * ```\n */\nexport const ed25519ctx: EdDSA = /* @__PURE__ */ ed({ domain: ed25519_domain });\n/**\n * Prehashed version of ed25519. See {@link ed25519}\n * Seeded `keygen(seed)` / `utils.randomSecretKey(seed)` reuse the provided\n * 32-byte seed buffer instead of copying it.\n * @example\n * Use the prehashed Ed25519 variant for one message.\n *\n * ```ts\n * const { secretKey, publicKey } = ed25519ph.keygen();\n * const msg = new TextEncoder().encode('hello noble');\n * const sig = ed25519ph.sign(msg, secretKey);\n * const isValid = ed25519ph.verify(sig, msg, publicKey);\n * ```\n */\nexport const ed25519ph: EdDSA = /* @__PURE__ */ ed({ domain: ed25519_domain, prehash: sha512 });\n/**\n * FROST threshold signatures over ed25519. RFC 9591.\n * @example\n * Create one trusted-dealer package for 2-of-3 ed25519 signing.\n *\n * ```ts\n * const alice = ed25519_FROST.Identifier.derive('alice@example.com');\n * const bob = ed25519_FROST.Identifier.derive('bob@example.com');\n * const carol = ed25519_FROST.Identifier.derive('carol@example.com');\n * const deal = ed25519_FROST.trustedDealer({ min: 2, max: 3 }, [alice, bob, carol]);\n * ```\n */\nexport const ed25519_FROST: TRet<FROST> = /* @__PURE__ */ (() =>\n  createFROST({\n    name: 'FROST-ED25519-SHA512-v1',\n    Point: ed25519_Point,\n    validatePoint: (p) => {\n      p.assertValidity();\n      if (!p.isTorsionFree()) throw new Error('bad point: not torsion-free');\n    },\n    hash: sha512,\n    // RFC 9591 keeps H2 undecorated here for RFC 8032 compatibility. In createFROST(),\n    // `H2: ''` becomes an empty DST prefix; the built-in hashToScalar fallback treats\n    // that the same as omitted DST, even though custom hooks can still observe the empty bag.\n    H2: '',\n  }))();\n\n/**\n * ECDH using curve25519 aka x25519.\n * `getSharedSecret()` rejects low-order peer inputs by default, and seeded\n * `keygen(seed)` reuses the provided 32-byte seed buffer instead of copying it.\n * @example\n * Derive one shared secret between two X25519 peers.\n *\n * ```js\n * import { x25519 } from '@noble/curves/ed25519.js';\n * const alice = x25519.keygen();\n * const bob = x25519.keygen();\n * const shared = x25519.getSharedSecret(alice.secretKey, bob.publicKey);\n * ```\n */\nexport const x25519: TRet<MontgomeryECDH> = /* @__PURE__ */ (() => {\n  const P = ed25519_CURVE_p;\n  return montgomery({\n    P,\n    type: 'x25519',\n    powPminus2: (x: bigint): bigint => {\n      // x^(p-2) aka x^(2^255-21)\n      const { pow_p_5_8, b2 } = ed25519_pow_2_252_3(x);\n      return mod(pow2(pow_p_5_8, _3n, P) * b2, P);\n    },\n    adjustScalarBytes,\n  });\n})();\n\n// Hash To Curve Elligator2 Map (NOTE: different from ristretto255 elligator)\n// RFC 9380 Appendix G.2.2 / Err4730 requires `sgn0(c1) = 0` for the Edwards\n// map constant below, so use the even root explicitly.\n// 1. c1 = (q + 3) / 8 # Integer arithmetic\nconst ELL2_C1 = /* @__PURE__ */ (() => (ed25519_CURVE_p + _3n) / _8n)();\nconst ELL2_C2 = /* @__PURE__ */ (() => Fp.pow(_2n, ELL2_C1))(); // 2. c2 = 2^c1\nconst ELL2_C3 = /* @__PURE__ */ (() => Fp.sqrt(Fp.neg(Fp.ONE)))(); // 3. c3 = sqrt(-1)\n\n/**\n * RFC 9380 method `map_to_curve_elligator2_curve25519`. Experimental name: may be renamed later.\n * @private\n */\n// prettier-ignore\nexport function _map_to_curve_elligator2_curve25519(u: bigint): {\n  xMn: bigint, xMd: bigint, yMn: bigint, yMd: bigint\n} {\n  const ELL2_C4 = (ed25519_CURVE_p - _5n) / _8n; // 4. c4 = (q - 5) / 8       # Integer arithmetic\n  const ELL2_J = BigInt(486662);\n\n  let tv1 = Fp.sqr(u);          //  1.  tv1 = u^2\n  tv1 = Fp.mul(tv1, _2n);       //  2.  tv1 = 2 * tv1\n  // 3. xd = tv1 + 1 # Nonzero: -1 is square (mod p), tv1 is not\n  let xd = Fp.add(tv1, Fp.ONE);\n  let x1n = Fp.neg(ELL2_J);     //  4.  x1n = -J              # x1 = x1n / xd = -J / (1 + 2 * u^2)\n  let tv2 = Fp.sqr(xd);         //  5.  tv2 = xd^2\n  let gxd = Fp.mul(tv2, xd);    //  6.  gxd = tv2 * xd        # gxd = xd^3\n  let gx1 = Fp.mul(tv1, ELL2_J);//  7.  gx1 = J * tv1         # x1n + J * xd\n  gx1 = Fp.mul(gx1, x1n);       //  8.  gx1 = gx1 * x1n       # x1n^2 + J * x1n * xd\n  gx1 = Fp.add(gx1, tv2);       //  9.  gx1 = gx1 + tv2       # x1n^2 + J * x1n * xd + xd^2\n  gx1 = Fp.mul(gx1, x1n);       //  10. gx1 = gx1 * x1n       # x1n^3 + J * x1n^2 * xd + x1n * xd^2\n  let tv3 = Fp.sqr(gxd);        //  11. tv3 = gxd^2\n  tv2 = Fp.sqr(tv3);            //  12. tv2 = tv3^2           # gxd^4\n  tv3 = Fp.mul(tv3, gxd);       //  13. tv3 = tv3 * gxd       # gxd^3\n  tv3 = Fp.mul(tv3, gx1);       //  14. tv3 = tv3 * gx1       # gx1 * gxd^3\n  tv2 = Fp.mul(tv2, tv3);       //  15. tv2 = tv2 * tv3       # gx1 * gxd^7\n  let y11 = Fp.pow(tv2, ELL2_C4); //  16. y11 = tv2^c4        # (gx1 * gxd^7)^((p - 5) / 8)\n  y11 = Fp.mul(y11, tv3);       //  17. y11 = y11 * tv3       # gx1*gxd^3*(gx1*gxd^7)^((p-5)/8)\n  let y12 = Fp.mul(y11, ELL2_C3); //  18. y12 = y11 * c3\n  tv2 = Fp.sqr(y11);            //  19. tv2 = y11^2\n  tv2 = Fp.mul(tv2, gxd);       //  20. tv2 = tv2 * gxd\n  let e1 = Fp.eql(tv2, gx1);    //  21.  e1 = tv2 == gx1\n  // 22. y1 = CMOV(y12, y11, e1) # If g(x1) is square, this is its sqrt\n  let y1 = Fp.cmov(y12, y11, e1);\n  let x2n = Fp.mul(x1n, tv1);   //  23. x2n = x1n * tv1       # x2 = x2n / xd = 2 * u^2 * x1n / xd\n  let y21 = Fp.mul(y11, u);     //  24. y21 = y11 * u\n  y21 = Fp.mul(y21, ELL2_C2);   //  25. y21 = y21 * c2\n  let y22 = Fp.mul(y21, ELL2_C3); //  26. y22 = y21 * c3\n  let gx2 = Fp.mul(gx1, tv1);   //  27. gx2 = gx1 * tv1       # g(x2) = gx2 / gxd = 2 * u^2 * g(x1)\n  tv2 = Fp.sqr(y21);            //  28. tv2 = y21^2\n  tv2 = Fp.mul(tv2, gxd);       //  29. tv2 = tv2 * gxd\n  let e2 = Fp.eql(tv2, gx2);    //  30.  e2 = tv2 == gx2\n  // 31. y2 = CMOV(y22, y21, e2) # If g(x2) is square, this is its sqrt\n  let y2 = Fp.cmov(y22, y21, e2);\n  tv2 = Fp.sqr(y1);             //  32. tv2 = y1^2\n  tv2 = Fp.mul(tv2, gxd);       //  33. tv2 = tv2 * gxd\n  let e3 = Fp.eql(tv2, gx1);    //  34.  e3 = tv2 == gx1\n  let xn = Fp.cmov(x2n, x1n, e3); //  35.  xn = CMOV(x2n, x1n, e3)  # If e3, x = x1, else x = x2\n  let y = Fp.cmov(y2, y1, e3);  //  36.   y = CMOV(y2, y1, e3)    # If e3, y = y1, else y = y2\n  let e4 = Fp.isOdd!(y);         //  37.  e4 = sgn0(y) == 1        # Fix sign of y\n  y = Fp.cmov(y, Fp.neg(y), e3 !== e4); //  38.   y = CMOV(y, -y, e3 XOR e4)\n  return { xMn: xn, xMd: xd, yMn: y, yMd: _1n }; //  39. return (xn, xd, y, 1)\n}\n\n// sgn0(c1) MUST equal 0\nconst ELL2_C1_EDWARDS = /* @__PURE__ */ (() => FpSqrtEven(Fp, Fp.neg(BigInt(486664))))();\nfunction map_to_curve_elligator2_edwards25519(u: bigint) {\n  // 1. (xMn, xMd, yMn, yMd) = map_to_curve_elligator2_curve25519(u)\n  const { xMn, xMd, yMn, yMd } = _map_to_curve_elligator2_curve25519(u);\n  // map_to_curve_elligator2_curve25519(u)\n  let xn = Fp.mul(xMn, yMd); //  2.  xn = xMn * yMd\n  xn = Fp.mul(xn, ELL2_C1_EDWARDS); //  3.  xn = xn * c1\n  let xd = Fp.mul(xMd, yMn); //  4.  xd = xMd * yMn    # xn / xd = c1 * xM / yM\n  let yn = Fp.sub(xMn, xMd); //  5.  yn = xMn - xMd\n  // 6. yd = xMn + xMd # (n / d - 1) / (n / d + 1) = (n - d) / (n + d)\n  let yd = Fp.add(xMn, xMd);\n  let tv1 = Fp.mul(xd, yd); //  7. tv1 = xd * yd\n  let e = Fp.eql(tv1, Fp.ZERO); //  8.   e = tv1 == 0\n  xn = Fp.cmov(xn, Fp.ZERO, e); //  9.  xn = CMOV(xn, 0, e)\n  xd = Fp.cmov(xd, Fp.ONE, e); //  10. xd = CMOV(xd, 1, e)\n  yn = Fp.cmov(yn, Fp.ONE, e); //  11. yn = CMOV(yn, 1, e)\n  yd = Fp.cmov(yd, Fp.ONE, e); //  12. yd = CMOV(yd, 1, e)\n  const [xd_inv, yd_inv] = FpInvertBatch(Fp, [xd, yd], true); // batch division\n  // Noble normalizes the RFC rational representation to affine `{ x, y }`\n  // before returning from the internal helper.\n  return { x: Fp.mul(xn, xd_inv), y: Fp.mul(yn, yd_inv) }; //  13. return (xn, xd, yn, yd)\n}\n\n/**\n * Hashing to ed25519 points / field. RFC 9380 methods.\n * Public `mapToCurve()` returns the cofactor-cleared subgroup point; the\n * internal map callback below consumes one field element bigint, not `[bigint]`.\n * @example\n * Hash one message onto the ed25519 curve.\n *\n * ```ts\n * const point = ed25519_hasher.hashToCurve(new TextEncoder().encode('hello noble'));\n * ```\n */\nexport const ed25519_hasher: H2CHasher<EdwardsPointCons> = /* @__PURE__ */ (() =>\n  createHasher(\n    ed25519_Point,\n    (scalars: bigint[]) => map_to_curve_elligator2_edwards25519(scalars[0]),\n    {\n      DST: 'edwards25519_XMD:SHA-512_ELL2_RO_',\n      encodeDST: 'edwards25519_XMD:SHA-512_ELL2_NU_',\n      p: ed25519_CURVE_p,\n      m: 1,\n      k: 128,\n      expand: 'xmd',\n      hash: sha512,\n    }\n  ))();\n\n// √(-1) aka √(a) aka 2^((p-1)/4)\nconst SQRT_M1 = ED25519_SQRT_M1;\n// √(ad - 1)\nconst SQRT_AD_MINUS_ONE = /* @__PURE__ */ BigInt(\n  '25063068953384623474111414158702152701244531502492656460079210482610430750235'\n);\n// 1 / √(a-d)\nconst INVSQRT_A_MINUS_D = /* @__PURE__ */ BigInt(\n  '54469307008909316920995813868745141605393597292927456921205312896311721017578'\n);\n// 1-d²\nconst ONE_MINUS_D_SQ = /* @__PURE__ */ BigInt(\n  '1159843021668779879193775521855586647937357759715417654439879720876111806838'\n);\n// (d-1)²\nconst D_MINUS_ONE_SQ = /* @__PURE__ */ BigInt(\n  '40440834346308536858101042469323190826248399146238708352240133220865137265952'\n);\n// `SQRT_RATIO_M1(1, number)` specialization. Returns `{ isValid, value }`,\n// where non-squares get the nonnegative `sqrt(SQRT_M1 / number)` branch.\nconst invertSqrt = (number: bigint) => uvRatio(_1n, number);\n\nconst MAX_255B = /* @__PURE__ */ BigInt(\n  '0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'\n);\n// RFC 9496 §4.3.4 MAP parser: masks bit 255 and reduces modulo p for element\n// derivation. The decode path has the opposite contract and rejects that bit.\nconst bytes255ToNumberLE = (bytes: TArg<Uint8Array>) =>\n  Fp.create(bytesToNumberLE(bytes) & MAX_255B);\n\n/**\n * Computes Elligator map for Ristretto255.\n * Primary formula source is RFC 9496 §4.3.4 MAP; RFC 9380 Appendix B builds\n * `hash_to_ristretto255` on top of this helper.\n * Returns an internal Edwards representative, not a public `_RistrettoPoint`.\n */\nfunction calcElligatorRistrettoMap(r0: bigint): EdwardsPoint {\n  const { d } = ed25519_CURVE;\n  const P = ed25519_CURVE_p;\n  const mod = (n: bigint) => Fp.create(n);\n  const r = mod(SQRT_M1 * r0 * r0); // 1\n  const Ns = mod((r + _1n) * ONE_MINUS_D_SQ); // 2\n  let c = BigInt(-1); // 3\n  const D = mod((c - d * r) * mod(r + d)); // 4\n  let { isValid: Ns_D_is_sq, value: s } = uvRatio(Ns, D); // 5\n  let s_ = mod(s * r0); // 6\n  if (!isNegativeLE(s_, P)) s_ = mod(-s_);\n  if (!Ns_D_is_sq) s = s_; // 7\n  if (!Ns_D_is_sq) c = r; // 8\n  const Nt = mod(c * (r - _1n) * D_MINUS_ONE_SQ - D); // 9\n  const s2 = s * s;\n  const W0 = mod((s + s) * D); // 10\n  const W1 = mod(Nt * SQRT_AD_MINUS_ONE); // 11\n  const W2 = mod(_1n - s2); // 12\n  const W3 = mod(_1n + s2); // 13\n  return new ed25519_Point(mod(W0 * W3), mod(W2 * W1), mod(W1 * W3), mod(W0 * W2));\n}\n\n/**\n * Wrapper over Edwards Point for ristretto255.\n *\n * Each ed25519/EdwardsPoint has 8 different equivalent points. This can be\n * a source of bugs for protocols like ring signatures. Ristretto was created to solve this.\n * Ristretto point operates in X:Y:Z:T extended coordinates like EdwardsPoint,\n * but it should work in its own namespace: do not combine those two.\n * See [RFC9496](https://www.rfc-editor.org/rfc/rfc9496).\n */\nclass _RistrettoPoint extends PrimeEdwardsPoint<_RistrettoPoint> {\n  // Do NOT change syntax: the following gymnastics is done,\n  // because typescript strips comments, which makes bundlers disable tree-shaking.\n  // prettier-ignore\n  static BASE: _RistrettoPoint =\n    /* @__PURE__ */ (() => new _RistrettoPoint(ed25519_Point.BASE))();\n  // prettier-ignore\n  static ZERO: _RistrettoPoint =\n    /* @__PURE__ */ (() => new _RistrettoPoint(ed25519_Point.ZERO))();\n  // prettier-ignore\n  static Fp: IField<bigint> =\n    /* @__PURE__ */ (() => Fp)();\n  // prettier-ignore\n  static Fn: IField<bigint> =\n    /* @__PURE__ */ (() => Fn)();\n\n  constructor(ep: EdwardsPoint) {\n    super(ep);\n  }\n\n  /**\n   * Create one Ristretto255 point from affine Edwards coordinates.\n   * This wraps the internal Edwards representative directly and is not a\n   * canonical ristretto255 decoding path.\n   * Use `toBytes()` / `fromBytes()` if canonical ristretto255 bytes matter.\n   */\n  static fromAffine(ap: AffinePoint<bigint>): _RistrettoPoint {\n    return new _RistrettoPoint(ed25519_Point.fromAffine(ap));\n  }\n\n  protected assertSame(other: _RistrettoPoint): void {\n    if (!(other instanceof _RistrettoPoint)) throw new Error('RistrettoPoint expected');\n  }\n\n  protected init(ep: EdwardsPoint): _RistrettoPoint {\n    return new _RistrettoPoint(ep);\n  }\n\n  static fromBytes(bytes: TArg<Uint8Array>): _RistrettoPoint {\n    abytes(bytes, 32);\n    const { a, d } = ed25519_CURVE;\n    const P = ed25519_CURVE_p;\n    const mod = (n: bigint) => Fp.create(n);\n    const s = bytes255ToNumberLE(bytes);\n    // 1. Check that s_bytes is the canonical encoding of a field element, or else abort.\n    // 3. Check that s is non-negative, or else abort\n    if (!equalBytes(Fp.toBytes(s), bytes) || isNegativeLE(s, P))\n      throw new Error('invalid ristretto255 encoding 1');\n    const s2 = mod(s * s);\n    const u1 = mod(_1n + a * s2); // 4 (a is -1)\n    const u2 = mod(_1n - a * s2); // 5\n    const u1_2 = mod(u1 * u1);\n    const u2_2 = mod(u2 * u2);\n    const v = mod(a * d * u1_2 - u2_2); // 6\n    const { isValid, value: I } = invertSqrt(mod(v * u2_2)); // 7\n    const Dx = mod(I * u2); // 8\n    const Dy = mod(I * Dx * v); // 9\n    let x = mod((s + s) * Dx); // 10\n    if (isNegativeLE(x, P)) x = mod(-x); // 10\n    const y = mod(u1 * Dy); // 11\n    const t = mod(x * y); // 12\n    if (!isValid || isNegativeLE(t, P) || y === _0n)\n      throw new Error('invalid ristretto255 encoding 2');\n    return new _RistrettoPoint(new ed25519_Point(x, y, _1n, t));\n  }\n\n  /**\n   * Converts ristretto-encoded string to ristretto point.\n   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).\n   * @param hex - Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding\n   */\n  static fromHex(hex: string): _RistrettoPoint {\n    return _RistrettoPoint.fromBytes(hexToBytes(hex));\n  }\n\n  /**\n   * Encodes ristretto point to Uint8Array.\n   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode).\n   */\n  toBytes(): TRet<Uint8Array> {\n    let { X, Y, Z, T } = this.ep;\n    const P = ed25519_CURVE_p;\n    const mod = (n: bigint) => Fp.create(n);\n    const u1 = mod(mod(Z + Y) * mod(Z - Y)); // 1\n    const u2 = mod(X * Y); // 2\n    // Square root always exists\n    const u2sq = mod(u2 * u2);\n    const { value: invsqrt } = invertSqrt(mod(u1 * u2sq)); // 3\n    const D1 = mod(invsqrt * u1); // 4\n    const D2 = mod(invsqrt * u2); // 5\n    const zInv = mod(D1 * D2 * T); // 6\n    let D: bigint; // 7\n    if (isNegativeLE(T * zInv, P)) {\n      let _x = mod(Y * SQRT_M1);\n      let _y = mod(X * SQRT_M1);\n      X = _x;\n      Y = _y;\n      D = mod(D1 * INVSQRT_A_MINUS_D);\n    } else {\n      D = D2; // 8\n    }\n    if (isNegativeLE(X * zInv, P)) Y = mod(-Y); // 9\n    let s = mod((Z - Y) * D); // 10 (check footer's note, no sqrt(-a))\n    if (isNegativeLE(s, P)) s = mod(-s);\n    return Fp.toBytes(s) as TRet<Uint8Array>; // 11\n  }\n\n  /**\n   * Compares two Ristretto points.\n   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals).\n   */\n  equals(other: _RistrettoPoint): boolean {\n    this.assertSame(other);\n    const { X: X1, Y: Y1 } = this.ep;\n    const { X: X2, Y: Y2 } = other.ep;\n    const mod = (n: bigint) => Fp.create(n);\n    // (x1 * y2 == y1 * x2) | (y1 * y2 == x1 * x2)\n    const one = mod(X1 * Y2) === mod(Y1 * X2);\n    const two = mod(Y1 * Y2) === mod(X1 * X2);\n    return one || two;\n  }\n\n  is0(): boolean {\n    return this.equals(_RistrettoPoint.ZERO);\n  }\n}\nObject.freeze(_RistrettoPoint.BASE);\nObject.freeze(_RistrettoPoint.ZERO);\nObject.freeze(_RistrettoPoint.prototype);\nObject.freeze(_RistrettoPoint);\n\n/** Prime-order Ristretto255 group bundle. */\nexport const ristretto255: {\n  Point: typeof _RistrettoPoint;\n} = /* @__PURE__ */ Object.freeze({ Point: _RistrettoPoint });\n\n/**\n * Hashing to ristretto255 points / field. RFC 9380 methods.\n * `hashToCurve()` is RFC 9380 Appendix B, `deriveToCurve()` is the RFC 9496\n * §4.3.4 element-derivation building block, and `hashToScalar()` is a\n * library-specific helper for OPRF-style use.\n * @example\n * Hash one message onto ristretto255.\n *\n * ```ts\n * const point = ristretto255_hasher.hashToCurve(new TextEncoder().encode('hello noble'));\n * ```\n */\nexport const ristretto255_hasher: H2CHasherBase<typeof _RistrettoPoint> = Object.freeze({\n  Point: _RistrettoPoint,\n  /**\n  * Spec: https://www.rfc-editor.org/rfc/rfc9380.html#name-hashing-to-ristretto255. Caveats:\n  * * There are no test vectors\n  * * encodeToCurve / mapToCurve is undefined\n  * * mapToCurve would be `calcElligatorRistrettoMap(scalars[0])`, not ristretto255_map!\n  * * hashToScalar is undefined too, so we just use OPRF implementation\n  * * We cannot re-use 'createHasher', because ristretto255_map is different algorithm/RFC\n    (os2ip -> bytes255ToNumberLE)\n  * * mapToCurve == calcElligatorRistrettoMap, hashToCurve == ristretto255_map\n  * * hashToScalar is undefined in RFC9380 for ristretto, so we use the OPRF\n    version here. Using `bytes255ToNumblerLE` will create a different result\n    if we use `bytes255ToNumberLE` as os2ip\n  * * current version is closest to spec.\n  */\n  hashToCurve(msg: TArg<Uint8Array>, options?: TArg<H2CDSTOpts>): _RistrettoPoint {\n    // == 'hash_to_ristretto255'\n    // Preserve explicit empty/invalid DST overrides so expand_message_xmd() can reject them.\n    const DST = options?.DST === undefined ? 'ristretto255_XMD:SHA-512_R255MAP_RO_' : options.DST;\n    const xmd = expand_message_xmd(msg, DST, 64, sha512);\n    // NOTE: RFC 9380 incorrectly calls this function `ristretto255_map`.\n    // In RFC 9496, `map` was the per-point function inside the construction.\n    // That also led to confusion that `ristretto255_map` is `mapToCurve`.\n    // It is not: it is the older hash-to-curve construction.\n    return ristretto255_hasher.deriveToCurve!(xmd);\n  },\n  hashToScalar(msg: TArg<Uint8Array>, options: TArg<H2CDSTOpts> = { DST: _DST_scalar }) {\n    const xmd = expand_message_xmd(msg, options.DST, 64, sha512);\n    return Fn.create(bytesToNumberLE(xmd));\n  },\n  /**\n   * HashToCurve-like construction based on RFC 9496 (Element Derivation).\n   * Converts 64 uniform random bytes into a curve point.\n   *\n   * WARNING: This represents an older hash-to-curve construction from before\n   * RFC 9380 was finalized.\n   * It was later reused as a component in the newer\n   * `hash_to_ristretto255` function defined in RFC 9380.\n   */\n  deriveToCurve(bytes: TArg<Uint8Array>): _RistrettoPoint {\n    // https://www.rfc-editor.org/rfc/rfc9496.html#name-element-derivation\n    abytes(bytes, 64);\n    const r1 = bytes255ToNumberLE(bytes.subarray(0, 32));\n    const R1 = calcElligatorRistrettoMap(r1);\n    const r2 = bytes255ToNumberLE(bytes.subarray(32, 64));\n    const R2 = calcElligatorRistrettoMap(r2);\n    return new _RistrettoPoint(R1.add(R2));\n  },\n});\n\n/**\n * ristretto255 OPRF/VOPRF/POPRF bundle, defined in RFC 9497.\n * @example\n * Run one blind/evaluate/finalize OPRF round over ristretto255.\n *\n * ```ts\n * const input = new TextEncoder().encode('hello noble');\n * const keys = ristretto255_oprf.oprf.generateKeyPair();\n * const blind = ristretto255_oprf.oprf.blind(input);\n * const evaluated = ristretto255_oprf.oprf.blindEvaluate(keys.secretKey, blind.blinded);\n * const output = ristretto255_oprf.oprf.finalize(input, blind.blind, evaluated);\n * ```\n */\nexport const ristretto255_oprf: TRet<OPRF> = /* @__PURE__ */ (() =>\n  createOPRF({\n    name: 'ristretto255-SHA512',\n    Point: _RistrettoPoint,\n    hash: sha512,\n    hashToGroup: ristretto255_hasher.hashToCurve,\n    hashToScalar: ristretto255_hasher.hashToScalar,\n  }))();\n/**\n * FROST threshold signatures over ristretto255. RFC 9591.\n * @example\n * Create one trusted-dealer package for 2-of-3 ristretto255 signing.\n *\n * ```ts\n * const alice = ristretto255_FROST.Identifier.derive('alice@example.com');\n * const bob = ristretto255_FROST.Identifier.derive('bob@example.com');\n * const carol = ristretto255_FROST.Identifier.derive('carol@example.com');\n * const deal = ristretto255_FROST.trustedDealer({ min: 2, max: 3 }, [alice, bob, carol]);\n * ```\n */\nexport const ristretto255_FROST: TRet<FROST> = /* @__PURE__ */ (() =>\n  createFROST({\n    name: 'FROST-RISTRETTO255-SHA512-v1',\n    Point: _RistrettoPoint,\n    validatePoint: (p) => {\n      // Prime-order wrappers are torsion-free at the abstract-group level.\n      p.assertValidity();\n    },\n    hash: sha512,\n  }))();\n\n/**\n * Weird / bogus points, useful for debugging.\n * All 8 ed25519 points of 8-torsion subgroup can be generated from the point\n * T = `26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05`.\n * The subgroup generated by `T` is `{ O, T, 2T, 3T, 4T, 5T, 6T, 7T }`; the\n * array below is that set, not the powers in that exact index order.\n * @example\n * Decode one known torsion point for debugging.\n *\n * ```ts\n * import { ED25519_TORSION_SUBGROUP, ed25519 } from '@noble/curves/ed25519.js';\n * const point = ed25519.Point.fromHex(ED25519_TORSION_SUBGROUP[1]);\n * ```\n */\nexport const ED25519_TORSION_SUBGROUP: readonly string[] = /* @__PURE__ */ Object.freeze([\n  '0100000000000000000000000000000000000000000000000000000000000000',\n  'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a',\n  '0000000000000000000000000000000000000000000000000000000000000080',\n  '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05',\n  'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',\n  '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85',\n  '0000000000000000000000000000000000000000000000000000000000000000',\n  'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',\n]);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAM,MAAsB,uBAAO,CAAC;AAApC,IAAuC,MAAsB,uBAAO,CAAC;AAArE,IAAwE,MAAsB,uBAAO,CAAC;AAAtG,IAAyG,MAAsB,uBAAO,CAAC;AAwNvI,SAAS,YAAYA,KAA0B,OAAoB,GAAW,GAAS;AACrF,QAAM,KAAKA,IAAG,IAAI,CAAC;AACnB,QAAM,KAAKA,IAAG,IAAI,CAAC;AACnB,QAAM,OAAOA,IAAG,IAAIA,IAAG,IAAI,MAAM,GAAG,EAAE,GAAG,EAAE;AAC3C,QAAM,QAAQA,IAAG,IAAIA,IAAG,KAAKA,IAAG,IAAI,MAAM,GAAGA,IAAG,IAAI,IAAI,EAAE,CAAC,CAAC;AAC5D,SAAOA,IAAG,IAAI,MAAM,KAAK;AAC3B;AAuBM,SAAU,QACd,QACA,YAAoC,CAAA,GAAE;AAEtC,QAAM,OAAO;AACb,QAAM,YAAY,kBAAkB,WAAW,QAAuB,MAAM,KAAK,MAAM;AACvF,QAAM,EAAE,IAAAA,KAAI,IAAAC,IAAE,IAAK;AACnB,MAAI,QAAQ,UAAU;AACtB,QAAM,EAAE,GAAG,SAAQ,IAAK;AACxB,iBAAe,MAAM,CAAA,GAAI,EAAE,SAAS,WAAU,CAAE;AAMhD,QAAM,OAAO,OAAQ,OAAOA,IAAG,QAAQ,CAAC,IAAI;AAC5C,QAAM,OAAO,CAAC,MAAcD,IAAG,OAAO,CAAC;AAGvC,QAAME,WACJ,KAAK,YAAY,SACb,CAAC,GAAW,MAAa;AACvB,QAAI;AACF,aAAO,EAAE,SAAS,MAAM,OAAOF,IAAG,KAAKA,IAAG,IAAI,GAAG,CAAC,CAAC,EAAC;IACtD,SAAS,GAAG;AACV,aAAO,EAAE,SAAS,OAAO,OAAO,IAAG;IACrC;EACF,IACA,KAAK;AAIX,MAAI,CAAC,YAAYA,KAAI,OAAO,MAAM,IAAI,MAAM,EAAE;AAC5C,UAAM,IAAI,MAAM,mCAAmC;AAMrD,WAAS,OAAO,OAAe,GAAW,UAAU,OAAK;AACvD,UAAM,MAAM,UAAU,MAAM;AAC5B,aAAS,gBAAgB,OAAO,GAAG,KAAK,IAAI;AAC5C,WAAO;EACT;AAEA,WAAS,SAAS,OAAc;AAC9B,QAAI,EAAE,iBAAiB;AAAQ,YAAM,IAAI,MAAM,uBAAuB;EACxE;EAIA,MAAM,MAAK;;IAET,OAAgB,OAAO,IAAI,MAAM,MAAM,IAAI,MAAM,IAAI,KAAK,KAAK,MAAM,KAAK,MAAM,EAAE,CAAC;;IAEnF,OAAgB,OAAO,IAAI,MAAM,KAAK,KAAK,KAAK,GAAG;;;IAEnD,OAAgB,KAAKA;;IAErB,OAAgB,KAAKC;IAEZ;IACA;IACA;IACA;IAET,YAAY,GAAW,GAAW,GAAW,GAAS;AACpD,WAAK,IAAI,OAAO,KAAK,CAAC;AACtB,WAAK,IAAI,OAAO,KAAK,CAAC;AACtB,WAAK,IAAI,OAAO,KAAK,GAAG,IAAI;AAC5B,WAAK,IAAI,OAAO,KAAK,CAAC;AACtB,aAAO,OAAO,IAAI;IACpB;IAEA,OAAO,QAAK;AACV,aAAO;IACT;;;;;;IAOA,OAAO,WAAW,GAAsB;AACtC,UAAI,aAAa;AAAO,cAAM,IAAI,MAAM,4BAA4B;AACpE,YAAM,EAAE,GAAG,EAAC,IAAK,KAAK,CAAA;AACtB,aAAO,KAAK,CAAC;AACb,aAAO,KAAK,CAAC;AACb,aAAO,IAAI,MAAM,GAAG,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC;IACzC;;IAGA,OAAO,UAAU,OAAmB,SAAS,OAAK;AAChD,YAAM,MAAMD,IAAG;AACf,YAAM,EAAE,GAAG,EAAC,IAAK;AACjB,cAAQ,UAAUG,QAAO,OAAO,KAAK,OAAO,CAAC;AAC7C,YAAM,QAAQ,QAAQ;AACtB,YAAM,SAAS,UAAU,KAAK;AAC9B,YAAM,WAAW,MAAM,MAAM,CAAC;AAC9B,aAAO,MAAM,CAAC,IAAI,WAAW,CAAC;AAC9B,YAAM,IAAI,gBAAgB,MAAM;AAMhC,YAAM,MAAM,SAAS,OAAOH,IAAG;AAC/B,eAAS,WAAW,GAAG,KAAK,GAAG;AAI/B,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,IAAI,KAAK,KAAK,GAAG;AACvB,YAAM,IAAI,KAAK,IAAI,KAAK,CAAC;AACzB,UAAI,EAAE,SAAS,OAAO,EAAC,IAAKE,SAAQ,GAAG,CAAC;AACxC,UAAI,CAAC;AAAS,cAAM,IAAI,MAAM,iCAAiC;AAC/D,YAAM,UAAU,IAAI,SAAS;AAC7B,YAAM,iBAAiB,WAAW,SAAU;AAC5C,UAAI,CAAC,UAAU,MAAM,OAAO;AAE1B,cAAM,IAAI,MAAM,0BAA0B;AAC5C,UAAI,kBAAkB;AAAQ,YAAI,KAAK,CAAC,CAAC;AACzC,aAAO,MAAM,WAAW,EAAE,GAAG,EAAC,CAAE;IAClC;IAEA,OAAO,QAAQ,KAAa,SAAS,OAAK;AACxC,aAAO,MAAM,UAAUE,YAAW,GAAG,GAAG,MAAM;IAChD;IAEA,IAAI,IAAC;AACH,aAAO,KAAK,SAAQ,EAAG;IACzB;IACA,IAAI,IAAC;AACH,aAAO,KAAK,SAAQ,EAAG;IACzB;IAEA,WAAW,aAAqB,GAAG,SAAS,MAAI;AAC9C,WAAK,YAAY,MAAM,UAAU;AACjC,UAAI,CAAC;AAAQ,aAAK,SAAS,GAAG;AAC9B,aAAO;IACT;;IAGA,iBAAc;AACZ,YAAM,IAAI;AACV,YAAM,EAAE,GAAG,EAAC,IAAK;AAKjB,UAAI,EAAE,IAAG;AAAI,cAAM,IAAI,MAAM,iBAAiB;AAG9C,YAAM,EAAE,GAAG,GAAG,GAAG,EAAC,IAAK;AACvB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,KAAK,EAAE;AACvB,YAAM,MAAM,KAAK,KAAK,CAAC;AACvB,YAAM,OAAO,KAAK,KAAK,KAAK,MAAM,EAAE,CAAC;AACrC,YAAM,QAAQ,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;AAC/C,UAAI,SAAS;AAAO,cAAM,IAAI,MAAM,uCAAuC;AAE3E,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,UAAI,OAAO;AAAI,cAAM,IAAI,MAAM,uCAAuC;IACxE;;IAGA,OAAO,OAAY;AACjB,eAAS,KAAK;AACd,YAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,GAAE,IAAK;AAChC,YAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,GAAE,IAAK;AAChC,YAAM,OAAO,KAAK,KAAK,EAAE;AACzB,YAAM,OAAO,KAAK,KAAK,EAAE;AACzB,YAAM,OAAO,KAAK,KAAK,EAAE;AACzB,YAAM,OAAO,KAAK,KAAK,EAAE;AACzB,aAAO,SAAS,QAAQ,SAAS;IACnC;IAEA,MAAG;AACD,aAAO,KAAK,OAAO,MAAM,IAAI;IAC/B;IAEA,SAAM;AAEJ,aAAO,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D;;;;IAKA,SAAM;AACJ,YAAM,EAAE,EAAC,IAAK;AACd,YAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,GAAE,IAAK;AAChC,YAAM,IAAI,KAAK,KAAK,EAAE;AACtB,YAAM,IAAI,KAAK,KAAK,EAAE;AACtB,YAAM,IAAI,KAAK,MAAM,KAAK,KAAK,EAAE,CAAC;AAClC,YAAM,IAAI,KAAK,IAAI,CAAC;AACpB,YAAM,OAAO,KAAK;AAClB,YAAM,IAAI,KAAK,KAAK,OAAO,IAAI,IAAI,IAAI,CAAC;AACxC,YAAM,IAAI,IAAI;AACd,YAAM,IAAI,IAAI;AACd,YAAM,IAAI,IAAI;AACd,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,aAAO,IAAI,MAAM,IAAI,IAAI,IAAI,EAAE;IACjC;;;;IAKA,IAAI,OAAY;AACd,eAAS,KAAK;AACd,YAAM,EAAE,GAAG,EAAC,IAAK;AACjB,YAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,GAAE,IAAK;AACvC,YAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,GAAE,IAAK;AACvC,YAAM,IAAI,KAAK,KAAK,EAAE;AACtB,YAAM,IAAI,KAAK,KAAK,EAAE;AACtB,YAAM,IAAI,KAAK,KAAK,IAAI,EAAE;AAC1B,YAAM,IAAI,KAAK,KAAK,EAAE;AACtB,YAAM,IAAI,MAAM,KAAK,OAAO,KAAK,MAAM,IAAI,CAAC;AAC5C,YAAM,IAAI,IAAI;AACd,YAAM,IAAI,IAAI;AACd,YAAM,IAAI,KAAK,IAAI,IAAI,CAAC;AACxB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,aAAO,IAAI,MAAM,IAAI,IAAI,IAAI,EAAE;IACjC;IAEA,SAAS,OAAY;AAGnB,eAAS,KAAK;AACd,aAAO,KAAK,IAAI,MAAM,OAAM,CAAE;IAChC;;IAGA,SAAS,QAAc;AAKrB,UAAI,CAACH,IAAG,YAAY,MAAM;AACxB,cAAM,IAAI,WAAW,4CAA4C;AACnE,YAAM,EAAE,GAAG,EAAC,IAAK,KAAK,OAAO,MAAM,QAAQ,CAACI,OAAM,WAAW,OAAOA,EAAC,CAAC;AACtE,aAAO,WAAW,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IACpC;;;;;;IAOA,eAAe,QAAc;AAE3B,UAAI,CAACJ,IAAG,QAAQ,MAAM;AAAG,cAAM,IAAI,WAAW,4CAA4C;AAC1F,UAAI,WAAW;AAAK,eAAO,MAAM;AACjC,UAAI,KAAK,IAAG,KAAM,WAAW;AAAK,eAAO;AACzC,aAAO,KAAK,OAAO,MAAM,QAAQ,CAAC,MAAM,WAAW,OAAO,CAAC,CAAC;IAC9D;;;;;IAMA,eAAY;AACV,aAAO,KAAK,cAAa,EAAG,IAAG;IACjC;;;IAIA,gBAAa;AACX,aAAO,KAAK,OAAO,MAAM,MAAM,CAAC,EAAE,IAAG;IACvC;;;IAIA,SAAS,WAAkB;AACzB,YAAM,IAAI;AACV,UAAI,KAAK;AACT,YAAM,EAAE,GAAG,GAAG,EAAC,IAAK;AACpB,YAAM,MAAM,EAAE,IAAG;AACjB,UAAI,MAAM;AAAM,aAAK,MAAM,MAAOD,IAAG,IAAI,CAAC;AAC1C,YAAM,IAAI,KAAK,IAAI,EAAE;AACrB,YAAM,IAAI,KAAK,IAAI,EAAE;AACrB,YAAM,KAAKA,IAAG,IAAI,GAAG,EAAE;AACvB,UAAI;AAAK,eAAO,EAAE,GAAG,KAAK,GAAG,IAAG;AAChC,UAAI,OAAO;AAAK,cAAM,IAAI,MAAM,kBAAkB;AAClD,aAAO,EAAE,GAAG,EAAC;IACf;IAEA,gBAAa;AACX,UAAI,aAAa;AAAK,eAAO;AAC7B,aAAO,KAAK,eAAe,QAAQ;IACrC;IAEA,UAAO;AACL,YAAM,EAAE,GAAG,EAAC,IAAK,KAAK,SAAQ;AAE9B,YAAM,QAAQA,IAAG,QAAQ,CAAC;AAG1B,YAAM,MAAM,SAAS,CAAC,KAAK,IAAI,MAAM,MAAO;AAC5C,aAAO;IACT;IACA,QAAK;AACH,aAAO,WAAW,KAAK,QAAO,CAAE;IAClC;IAEA,WAAQ;AACN,aAAO,UAAU,KAAK,IAAG,IAAK,SAAS,KAAK,MAAK,CAAE;IACrD;;AAEF,QAAM,OAAO,IAAI,KAAK,OAAOC,IAAG,IAAI;AAYpC,MAAIA,IAAG,QAAQ;AAAG,UAAM,KAAK,WAAW,CAAC;AACzC,SAAO,OAAO,MAAM,SAAS;AAC7B,SAAO,OAAO,KAAK;AACnB,SAAO;AACT;AAiBM,IAAgB,oBAAhB,MAAiC;EAGrC,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EAEY;;;;;;EAOnB,YAAY,IAAgB;AAC1B,SAAK,KAAK;EACZ;;EAOA,OAAO,UAAU,QAAkB;AACjC,mBAAc;EAChB;EAEA,OAAO,QAAQ,MAAY;AACzB,mBAAc;EAChB;EAEA,IAAI,IAAC;AACH,WAAO,KAAK,SAAQ,EAAG;EACzB;EACA,IAAI,IAAC;AACH,WAAO,KAAK,SAAQ,EAAG;EACzB;;EAGA,gBAAa;AAGX,WAAO;EACT;EAEA,iBAAc;AAIZ,SAAK,GAAG,eAAc;EACxB;;;;;;;EAQA,SAAS,WAAkB;AACzB,WAAO,KAAK,GAAG,SAAS,SAAS;EACnC;EAEA,QAAK;AACH,WAAO,WAAW,KAAK,QAAO,CAAE;EAClC;EAEA,WAAQ;AACN,WAAO,KAAK,MAAK;EACnB;EAEA,gBAAa;AAGX,WAAO;EACT;EAEA,eAAY;AACV,WAAO;EACT;EAEA,IAAI,OAAQ;AACV,SAAK,WAAW,KAAK;AACrB,WAAO,KAAK,KAAK,KAAK,GAAG,IAAI,MAAM,EAAE,CAAC;EACxC;EAEA,SAAS,OAAQ;AACf,SAAK,WAAW,KAAK;AACrB,WAAO,KAAK,KAAK,KAAK,GAAG,SAAS,MAAM,EAAE,CAAC;EAC7C;EAEA,SAAS,QAAc;AACrB,WAAO,KAAK,KAAK,KAAK,GAAG,SAAS,MAAM,CAAC;EAC3C;EAEA,eAAe,QAAc;AAC3B,WAAO,KAAK,KAAK,KAAK,GAAG,eAAe,MAAM,CAAC;EACjD;EAEA,SAAM;AACJ,WAAO,KAAK,KAAK,KAAK,GAAG,OAAM,CAAE;EACnC;EAEA,SAAM;AACJ,WAAO,KAAK,KAAK,KAAK,GAAG,OAAM,CAAE;EACnC;EAEA,WAAW,YAAqB,QAAgB;AAC9C,SAAK,GAAG,WAAW,YAAY,MAAM;AAGrC,WAAO;EACT;;AA6BI,SAAU,MACd,OACA,OACA,YAA6B,CAAA,GAAE;AAE/B,MAAI,OAAO,UAAU;AAAY,UAAM,IAAI,MAAM,mCAAmC;AACpF,QAAM,OAAO;AACb,QAAM,OAAO;AACb,iBACE,MACA,CAAA,GACA;IACE,mBAAmB;IACnB,aAAa;IACb,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,YAAY;GACb;AAGH,QAAM,EAAE,QAAO,IAAK;AACpB,QAAM,EAAE,MAAM,IAAAD,KAAI,IAAAC,IAAE,IAAK;AACzB,QAAM,YAAa,KAAwC;AAC3D,QAAM,cAAc,IAAID,IAAG;AAG3B,MAAI,cAAc,QAAW;AAC3B,gBAAY,WAAW,gBAAgB;AACvC,QAAI,cAAc;AAChB,YAAM,IAAI,MAAM,0BAA0B,WAAW,SAAS,SAAS,EAAE;EAC7E;AAEA,QAAMM,eAAc,KAAK,gBAAgB,SAAY,cAAgB,KAAK;AAC1E,QAAMC,qBACJ,KAAK,sBAAsB,SACvB,CAAC,UAA4B,QAC7B,KAAK;AACX,QAAM,SACJ,KAAK,WAAW,SACZ,CAAC,MAAwB,KAAuB,WAAmB;AACjE,UAAM,QAAQ,QAAQ;AACtB,QAAI,IAAI,UAAU;AAAQ,YAAM,IAAI,MAAM,qCAAqC;AAC/E,WAAO;EACT,IACA,KAAK;AAGX,WAAS,QAAQC,OAAsB;AACrC,WAAOP,IAAG,OAAO,gBAAgBO,KAAI,CAAC;EACxC;AAGA,WAAS,iBAAiB,KAAqB;AAC7C,UAAM,MAAM,QAAQ;AACpB,IAAAL,QAAO,KAAK,QAAQ,WAAW,WAAW;AAG1C,UAAM,SAASA,QAAO,KAAK,GAAG,GAAG,IAAI,KAAK,iBAAiB;AAE3D,UAAM,OAAOI,mBAAkB,OAAO,MAAM,GAAG,GAAG,CAAC;AACnD,UAAM,SAAS,OAAO,MAAM,KAAK,IAAI,GAAG;AACxC,UAAM,SAAS,QAAQ,IAAI;AAC3B,WAAO,EAAE,MAAM,QAAQ,OAAM;EAC/B;AAKA,WAAS,qBAAqB,WAA2B;AACvD,UAAM,EAAE,MAAM,QAAQ,OAAM,IAAK,iBAAiB,SAAS;AAC3D,UAAM,QAAQ,KAAK,SAAS,MAAM;AAClC,UAAM,aAAa,MAAM,QAAO;AAChC,WAAO,EAAE,MAAM,QAAQ,QAAQ,OAAO,WAAU;EAClD;AAGA,WAAS,aAAa,WAA2B;AAC/C,WAAO,qBAAqB,SAAS,EAAE;EACzC;AAGA,WAAS,mBACP,UAA4B,WAAW,GAAE,MACtC,MAAwB;AAE3B,UAAM,MAAME,aAAY,GAAG,IAAI;AAC/B,WAAO,QAAQ,KAAK,OAAO,KAAKN,QAAO,SAAS,QAAW,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;EACpF;AAGA,WAAS,KACP,KACA,WACA,UAA0C,CAAA,GAAE;AAE5C,UAAMA,QAAO,KAAK,QAAW,SAAS;AACtC,QAAI;AAAS,YAAM,QAAQ,GAAG;AAC9B,UAAM,EAAE,QAAQ,QAAQ,WAAU,IAAK,qBAAqB,SAAS;AACrE,UAAM,IAAI,mBAAmB,QAAQ,SAAS,QAAQ,GAAG;AAKzD,UAAM,IAAI,KAAK,SAAS,CAAC,EAAE,QAAO;AAClC,UAAM,IAAI,mBAAmB,QAAQ,SAAS,GAAG,YAAY,GAAG;AAChE,UAAM,IAAIF,IAAG,OAAO,IAAI,IAAI,MAAM;AAClC,QAAI,CAACA,IAAG,QAAQ,CAAC;AAAG,YAAM,IAAI,MAAM,wBAAwB;AAC5D,UAAM,KAAKQ,aAAY,GAAGR,IAAG,QAAQ,CAAC,CAAC;AACvC,WAAOE,QAAO,IAAI,QAAQ,WAAW,QAAQ;EAC/C;AAIA,QAAM,aAA+D;IACnE,QAAQ,KAAK;;AAOf,WAAS,OACP,KACA,KACA,WACA,UAAU,YAAU;AAGpB,UAAM,EAAE,QAAO,IAAK;AACpB,UAAM,SAAS,QAAQ,WAAW,SAAY,CAAC,CAAC,WAAW,SAAS,QAAQ;AAC5E,UAAM,MAAM,QAAQ;AACpB,UAAMA,QAAO,KAAK,KAAK,WAAW;AAClC,UAAMA,QAAO,KAAK,QAAW,SAAS;AACtC,gBAAYA,QAAO,WAAW,QAAQ,WAAW,WAAW;AAC5D,QAAI,WAAW;AAAW,YAAM,QAAQ,QAAQ;AAChD,QAAI;AAAS,YAAM,QAAQ,GAAG;AAE9B,UAAM,MAAM,MAAM;AAClB,UAAM,IAAI,IAAI,SAAS,GAAG,GAAG;AAC7B,UAAM,IAAI,gBAAgB,IAAI,SAAS,KAAK,GAAG,CAAC;AAChD,QAAI,GAAG,GAAG;AACV,QAAI;AAKF,UAAI,MAAM,UAAU,WAAW,MAAM;AACrC,UAAI,MAAM,UAAU,GAAG,MAAM;AAC7B,WAAK,KAAK,eAAe,CAAC;IAC5B,SAAS,OAAO;AACd,aAAO;IACT;AAMA,QAAI,CAAC,UAAU,EAAE,aAAY;AAAI,aAAO;AAIxC,UAAM,IAAI,mBAAmB,SAAS,GAAG,WAAW,GAAG;AACvD,UAAM,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AAGrC,WAAO,IAAI,SAAS,EAAE,EAAE,cAAa,EAAG,IAAG;EAC7C;AAEA,QAAM,QAAQH,IAAG;AACjB,QAAM,UAAU;IACd,WAAW;IACX,WAAW;IACX,WAAW,IAAI;IACf,MAAM;;AAER,WAAS,gBAAgB,MAAuB;AAC9C,WAAO,SAAS,SAAYM,aAAY,QAAQ,IAAI,IAAI;AACxD,WAAOH,QAAO,MAAM,QAAQ,MAAM,MAAM;EAC1C;AAEA,WAAS,iBAAiB,KAAqB;AAC7C,WAAO,QAAQ,GAAG,KAAK,IAAI,WAAW,QAAQ;EAChD;AAEA,WAAS,iBAAiB,KAAuB,QAAgB;AAC/D,QAAI;AAEF,aAAO,CAAC,CAAC,MAAM,UAAU,KAAK,WAAW,SAAY,WAAW,SAAS,MAAM;IACjF,SAAS,OAAO;AACd,aAAO;IACT;EACF;AAEA,QAAM,QAAQ;IACZ;IACA;IACA;IACA;;;;;;;;;;IAUA,aAAa,WAA2B;AACtC,YAAM,EAAE,EAAC,IAAK,MAAM,UAAU,SAAS;AACvC,YAAM,OAAO,QAAQ;AACrB,YAAM,UAAU,SAAS;AACzB,UAAI,CAAC,WAAW,SAAS;AAAI,cAAM,IAAI,MAAM,gCAAgC;AAC7E,YAAM,IAAI,UAAUH,IAAG,IAAI,MAAM,GAAG,MAAM,CAAC,IAAIA,IAAG,IAAI,IAAI,KAAK,IAAI,GAAG;AACtE,aAAOA,IAAG,QAAQ,CAAC;IACrB;IACA,mBAAmB,WAA2B;AAC5C,YAAM,OAAO,QAAQ;AACrB,MAAAG,QAAO,WAAW,IAAI;AACtB,YAAM,SAAS,KAAK,UAAU,SAAS,GAAG,IAAI,CAAC;AAC/C,aAAOI,mBAAkB,MAAM,EAAE,SAAS,GAAG,IAAI;IACnD;;AAEF,SAAO,OAAO,OAAO;AACrB,SAAO,OAAO,KAAK;AAEnB,SAAO,OAAO,OAAO;IACnB,QAAQ,aAAa,iBAAiB,YAAY;IAClD;IACA;IACA;IACA;IACA;IACA;GACD;AACH;;;AC99BA,IAAMG,OAAM,OAAO,CAAC;AACpB,IAAMC,OAAM,OAAO,CAAC;AACpB,IAAMC,OAAM,OAAO,CAAC;AA4EpB,SAAS,aAAa,OAA2B;AAI/C,iBACE,OACA;IACE,GAAG;IACH,MAAM;IACN,mBAAmB;IACnB,YAAY;KAEd;IACE,aAAa;GACd;AAEH,SAAO,OAAO,OAAO,EAAE,GAAG,MAAK,CAAW;AAC5C;AAeM,SAAU,WAAW,UAA8B;AACvD,QAAM,QAAQ,aAAa,QAAQ;AACnC,QAAM,EAAE,GAAG,MAAM,mBAAAC,oBAAmB,YAAY,aAAa,KAAI,IAAK;AACtE,QAAM,UAAU,SAAS;AACzB,MAAI,CAAC,WAAW,SAAS;AAAQ,UAAM,IAAI,MAAM,cAAc;AAC/D,QAAM,eAAe,SAAS,SAAY,cAAc;AAExD,QAAM,iBAAiB,UAAU,MAAM;AACvC,QAAM,WAAW,UAAU,KAAK;AAChC,QAAM,KAAK,UAAU,OAAO,CAAC,IAAI,OAAO,CAAC;AAKzC,QAAM,MAAM,UAAU,OAAO,MAAM,IAAI,OAAO,KAAK;AAInD,QAAM,YAAY,UAAUD,QAAO,OAAO,GAAG,IAAIA,QAAO,OAAO,GAAG;AAClE,QAAM,WAAW,UACb,OAAO,CAAC,IAAIA,QAAO,OAAO,GAAG,IAAID,OACjC,OAAO,CAAC,IAAIC,QAAO,OAAO,GAAG,IAAID;AACrC,QAAM,YAAY,YAAY,WAAWA;AACzC,QAAM,OAAO,CAAC,MAAc,IAAI,GAAG,CAAC;AACpC,QAAM,UAAU,QAAQ,EAAE;AAC1B,WAAS,QAAQ,GAAS;AACxB,WAAO,gBAAgB,KAAK,CAAC,GAAG,QAAQ;EAC1C;AACA,WAAS,QAAQ,GAAmB;AAClC,UAAM,KAAK,UAAUG,QAAO,GAAG,UAAU,aAAa,CAAC;AAGvD,QAAI;AAAS,SAAG,EAAE,KAAK;AAKvB,WAAO,KAAK,gBAAgB,EAAE,CAAC;EACjC;AACA,WAAS,aAAa,QAAwB;AAC5C,WAAO,gBAAgBD,mBAAkB,UAAUC,QAAO,QAAQ,UAAU,QAAQ,CAAC,CAAC,CAAC;EACzF;AACA,WAAS,WAAW,QAA0B,GAAmB;AAC/D,UAAM,KAAK,iBAAiB,QAAQ,CAAC,GAAG,aAAa,MAAM,CAAC;AAI5D,QAAI,OAAOJ;AAAK,YAAM,IAAI,MAAM,wCAAwC;AACxE,WAAO,QAAQ,EAAE;EACnB;AAEA,WAAS,eAAe,QAAwB;AAC9C,WAAO,WAAW,QAAQ,OAAO;EACnC;AACA,QAAM,eAAe;AACrB,QAAM,kBAAkB;AAGxB,WAAS,MAAM,MAAc,KAAa,KAAW;AAInD,UAAM,QAAQ,KAAK,QAAQ,MAAM,IAAI;AACrC,UAAM,KAAK,MAAM,KAAK;AACtB,UAAM,KAAK,MAAM,KAAK;AACtB,WAAO,EAAE,KAAK,IAAG;EACnB;AAQA,WAAS,iBAAiB,GAAW,QAAc;AACjD,aAAS,KAAK,GAAGA,MAAK,CAAC;AACvB,aAAS,UAAU,QAAQ,WAAW,SAAS;AAC/C,UAAM,IAAI;AACV,UAAM,MAAM;AACZ,QAAI,MAAMC;AACV,QAAI,MAAMD;AACV,QAAI,MAAM;AACV,QAAI,MAAMC;AACV,QAAI,OAAOD;AACX,aAAS,IAAI,OAAO,iBAAiB,CAAC,GAAG,KAAKA,MAAK,KAAK;AACtD,YAAM,MAAO,KAAK,IAAKC;AACvB,cAAQ;AACR,OAAC,EAAE,KAAK,IAAG,IAAK,MAAM,MAAM,KAAK,GAAG;AACpC,OAAC,EAAE,KAAK,KAAK,KAAK,IAAG,IAAK,MAAM,MAAM,KAAK,GAAG;AAC9C,aAAO;AAEP,YAAM,IAAI,MAAM;AAChB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,IAAI,MAAM;AAChB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,IAAI,KAAK;AACf,YAAM,IAAI,MAAM;AAChB,YAAM,IAAI,MAAM;AAChB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,OAAO,KAAK;AAClB,YAAM,QAAQ,KAAK;AACnB,YAAM,KAAK,OAAO,IAAI;AACtB,YAAM,KAAK,MAAM,KAAK,QAAQ,KAAK,CAAC;AACpC,YAAM,KAAK,KAAK,EAAE;AAClB,YAAM,KAAK,KAAK,KAAK,KAAK,MAAM,CAAC,EAAE;IACrC;AACA,KAAC,EAAE,KAAK,IAAG,IAAK,MAAM,MAAM,KAAK,GAAG;AACpC,KAAC,EAAE,KAAK,KAAK,KAAK,IAAG,IAAK,MAAM,MAAM,KAAK,GAAG;AAC9C,UAAM,KAAK,WAAW,GAAG;AACzB,WAAO,KAAK,MAAM,EAAE;EACtB;AACA,QAAM,UAAU;IACd,WAAW;IACX,WAAW;IACX,MAAM;;AAER,QAAM,kBAAkB,CAAC,SAA6C;AACpE,WAAO,SAAS,SAAY,aAAa,QAAQ,IAAI;AACrD,IAAAG,QAAO,MAAM,QAAQ,MAAM,MAAM;AAGjC,WAAO;EACT;AACA,QAAM,QAAQ,EAAE,gBAAe;AAC/B,SAAO,OAAO,OAAO;AACrB,SAAO,OAAO,KAAK;AAEnB,SAAO,OAAO,OAAO;IACnB,QAAQ,aAAa,iBAAiB,YAAY;IAClD;IACA;IACA;IACA;IACA;IACA,SAAS,QAAQ,MAAK;IACtB;GACD;AACH;;;AClMA,IAAM,mBAAmC,6BAAa,WAAW;AAqW3D,SAAU,WAAyC,MAAiB;AACxE,iBAAe,MAAM;IACnB,MAAM;IACN,MAAM;IACN,cAAc;IACd,aAAa;GACd;AAGD,oBAAkB,KAAK,KAAK;AAC5B,QAAM,EAAE,MAAM,OAAO,KAAI,IAAK;AAC9B,QAAM,EAAE,IAAAC,IAAE,IAAK;AAEf,QAAM,cAAc,CAAC,KAAuB,QAC1C,KAAK,YAAY,KAAK;IACpB,KAAKC,aAAY,aAAa,cAAc,GAAG,GAAG;GACnD;AACH,QAAM,uBAAuB,CAAC,KAAuB,QACnD,KAAK,aAAa,KAAK,EAAE,KAAKA,aAAY,kBAAkB,GAAG,EAAC,CAAE;AACpE,QAAM,eAAe,CAAC,MAAW,gBAAe;AAG9C,UAAM,IAAI,eAAe,IAAI,iBAAiBD,IAAG,KAAK,CAAC,GAAGA,IAAG,OAAOA,IAAG,IAAI;AAG3E,WAAOA,IAAG,OAAO,gBAAgB,CAAC,IAAI,gBAAgB,CAAC;EACzD;AAEA,QAAM,MAAM,CAAC,QAAa,YAAsB,UAAU,OAAO,QAAQ,OAAO;AAEhF,QAAM,SAAS,CAAC,SACdC,aAAY,aAAa,SAAS,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,aAAa,MAAM,IAAI,CAAC;AACvF,QAAM,UAAU,OAAO,CAAI;AAC3B,QAAM,WAAW,OAAO,CAAI;AAC5B,QAAM,WAAW,OAAO,CAAI;AAE5B,WAAS,UAAU,MAA4C;AAC7D,UAAMC,OAAM,CAAA;AACZ,eAAW,KAAK,MAAM;AACpB,UAAI,OAAO,MAAM;AAAU,QAAAA,KAAI,KAAK,gBAAgB,GAAG,CAAC,CAAC;eAChD,OAAO,MAAM;AAAU,QAAAA,KAAI,KAAK,aAAa,CAAC,CAAC;WACnD;AACH,QAAAC,QAAO,CAAC;AACR,QAAAD,KAAI,KAAK,gBAAgB,EAAE,QAAQ,CAAC,GAAG,CAAC;MAC1C;IACF;AAEA,WAAOD,aAAY,GAAGC,IAAG;EAC3B;AACA,QAAM,aAAa,CAAC,OAAe,UAA2B;AAC5D,IAAAC,QAAO,OAAO,QAAW,KAAK;AAG9B,QAAI,MAAM,SAAS;AACjB,YAAM,IAAI,MACR,IAAI,KAAK,wDAAwD,MAAM,MAAM,EAAE;AAEnF,WAAO;EACT;AACA,QAAM,YAAY,IAAI,UACpB,KAAK,OAAO,GAAG,OAAO,UAAU,CAAC;AAEnC,WAAS,eAAe,GAAM,GAAQ,GAAQ,KAAgB;AAC5D,UAAM,KAAK,EAAE,QAAO;AACpB,UAAM,OAAO,KAAK,OAAO,IAAIF,aAAY,aAAa,OAAO,GAAG,GAAG,CAAC,CAAC;AACrE,UAAMC,OAAgB,CAAA;AACtB,aAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,YAAM,KAAK,EAAE,CAAC,EAAE,QAAO;AACvB,YAAM,KAAK,EAAE,CAAC,EAAE,QAAO;AACvB,YAAM,KAAK,qBAAqB,OAAO,MAAM,GAAG,IAAI,IAAI,WAAW,GAAG,GAAG;AACzE,MAAAA,KAAI,KAAK,EAAE;IACb;AACA,WAAOA;EACT;AAEA,WAAS,kBAAkB,GAAM,GAAQ,GAAQ,KAAgB;AAC/D,UAAM,IAAI,eAAe,GAAG,GAAG,GAAG,GAAG;AACrC,UAAM,IAAI,IAAI,GAAG,CAAC;AAClB,UAAM,IAAI,IAAI,GAAG,CAAC;AAClB,WAAO,EAAE,GAAG,EAAC;EACf;AAEA,WAAS,sBACP,GACA,GACA,GACA,GACA,KAAgB;AAEhB,UAAM,IAAI,eAAe,GAAG,GAAG,GAAG,GAAG;AACrC,UAAM,IAAI,IAAI,GAAG,CAAC;AAGlB,UAAM,IAAI,EAAE,SAAS,CAAC;AACtB,WAAO,EAAE,GAAG,EAAC;EACf;AAEA,WAAS,oBAAoB,GAAM,GAAM,GAAM,IAAO,IAAO,KAAgB;AAC3E,UAAM,CAAC,IAAI,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,QAAO,CAAE;AACrE,WAAO,qBAAqB,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,WAAW,GAAG,GAAG;EAC1E;AAEA,WAAS,cAAc,KAAkB,GAAW,GAAM,GAAQ,GAAQ,KAAQ;AAChF,UAAM,EAAE,GAAG,EAAC,IAAK,sBAAsB,GAAG,GAAG,GAAG,GAAG,GAAG;AACtD,UAAM,IAAI,aAAa,GAAG;AAC1B,UAAM,KAAK,MAAM,KAAK,SAAS,CAAC;AAChC,UAAM,KAAK,EAAE,SAAS,CAAC;AACvB,UAAM,IAAI,oBAAoB,GAAG,GAAG,GAAG,IAAI,IAAI,GAAG;AAClD,UAAM,IAAIF,IAAG,IAAI,GAAGA,IAAG,IAAI,GAAG,CAAC,CAAC;AAChC,WAAOC,aAAY,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAMD,IAAG,QAAQ,CAAC,CAAC,CAAC;EACxD;AAEA,WAAS,YAAY,KAAkB,GAAM,GAAQ,GAAQ,OAAkB;AAC7E,IAAAG,QAAO,OAAO,IAAIH,IAAG,KAAK;AAC1B,UAAM,EAAE,GAAG,EAAC,IAAK,kBAAkB,GAAG,GAAG,GAAG,GAAG;AAC/C,UAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,SAAS,GAAGA,IAAG,KAAK,GAAG,MAAM,SAASA,IAAG,KAAK,CAAC,EAAE,IAAI,CAAC,MAC1EA,IAAG,UAAU,CAAC,CAAC;AAEjB,UAAM,KAAK,MAAM,KAAK,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AACnD,UAAM,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAC1C,UAAM,YAAY,oBAAoB,GAAG,GAAG,GAAG,IAAI,IAAI,GAAG;AAC1D,QAAI,CAACA,IAAG,IAAI,GAAG,SAAS;AAAG,YAAM,IAAI,MAAM,2BAA2B;EACxE;AAEA,WAAS,kBAAe;AACtB,UAAM,MAAM,aAAY;AACxB,UAAM,MAAM,MAAM,KAAK,SAAS,GAAG;AACnC,WAAO,EAAE,WAAWA,IAAG,QAAQ,GAAG,GAAG,WAAW,IAAI,QAAO,EAAE;EAC/D;AAEA,WAAS,cAAc,KAAkB,MAAmB,MAAiB;AAG3E,IAAAG,QAAO,MAAM,IAAI,MAAM;AACvB,WAAO,WAAW,WAAW,IAAI;AACjC,UAAM,MAAMF,aAAY,aAAa,eAAe,GAAG,GAAG;AAC1D,UAAM,MAAMA,aAAY,MAAM,OAAO,IAAI,GAAG,WAAW,GAAG,CAAC,CAAC;AAC5D,aAAS,UAAU,GAAG,WAAW,KAAK,WAAW;AAC/C,UAAI,IAAI,SAAS,CAAC,IAAI;AACtB,YAAM,MAAM,KAAK,aAAa,KAAK,EAAE,KAAK,IAAG,CAAE;AAC/C,UAAID,IAAG,IAAI,GAAG;AAAG;AACjB,aAAO;QACL,WAAWA,IAAG,QAAQ,GAAG;QACzB,WAAW,MAAM,KAAK,SAAS,GAAG,EAAE,QAAO;;IAE/C;AACA,UAAM,IAAI,MAAM,mBAAmB;EACrC;AACA,QAAM,YAAY,CAAC,OAAe,UAA2B;AAC3D,UAAM,QAAQ,MAAM,UAAU,KAAK;AAGnC,QAAI,MAAM,OAAO,MAAM,IAAI;AAAG,YAAM,IAAI,MAAM,QAAQ,oBAAoB;AAC1E,WAAO;EACT;AACA,WAAS,MACP,KACA,OACA,MAAW,aAAW;AAEtB,YAAQ,WAAW,SAAS,KAAK;AACjC,UAAMI,SAAQ,aAAa,GAAG;AAC9B,UAAM,aAAa,YAAY,OAAO,GAAG;AACzC,QAAI,WAAW,OAAO,MAAM,IAAI;AAAG,YAAM,IAAI,MAAM,yBAAyB;AAC5E,UAAM,UAAU,WAAW,SAASA,MAAK;AACzC,WAAO,EAAE,OAAOJ,IAAG,QAAQI,MAAK,GAAG,SAAS,QAAQ,QAAO,EAAE;EAC/D;AACA,WAAS,SACP,KACA,WACA,OAAkB;AAElB,YAAQ,WAAW,SAAS,KAAK;AACjC,UAAM,MAAMJ,IAAG,UAAU,SAAS;AAClC,UAAM,aAAa,YAAY,OAAO,GAAG;AACzC,QAAI,WAAW,OAAO,MAAM,IAAI;AAAG,YAAM,IAAI,MAAM,yBAAyB;AAC5E,UAAM,YAAY,WAAW,SAAS,GAAG,EAAE,QAAO;AAClD,WAAO,UAAU,OAAO,SAAS;EACnC;AACA,QAAM,OAAO,OAAO,OAAO;IACzB;IACA,eAAe,CAAC,MAAmB,YACjC,cAAc,SAAS,MAAM,OAAO;IACtC,OAAO,CAAC,OAAoB,MAAW,gBAAgB,MAAM,SAAS,OAAO,GAAG;IAChF,cAAc,WAA8B,cAA8B;AACxE,YAAM,MAAMA,IAAG,UAAU,SAAS;AAClC,YAAM,MAAM,UAAU,WAAW,YAAY;AAC7C,aAAO,IAAI,SAAS,GAAG,EAAE,QAAO;IAClC;IACA,SACE,OACA,YACA,gBAAgC;AAEhC,cAAQ,WAAW,SAAS,KAAK;AACjC,YAAMI,SAAQJ,IAAG,UAAU,UAAU;AACrC,YAAM,YAAY,UAAU,aAAa,cAAc;AACvD,YAAM,YAAY,UAAU,SAASA,IAAG,IAAII,MAAK,CAAC,EAAE,QAAO;AAC3D,aAAO,UAAU,OAAO,SAAS;IACnC;IACA,UAAU,CAAC,WAA8B,UACvC,SAAS,SAAS,WAAW,KAAK;GACrC;AAED,QAAM,QAAQ,OAAO,OAAO;IAC1B;IACA,eAAe,CAAC,MAAmB,YACjC,cAAc,UAAU,MAAM,OAAO;IACvC,OAAO,CAAC,OAAoB,MAAW,gBAAgB,MAAM,UAAU,OAAO,GAAG;IACjF,mBACE,WACA,WACA,SACA,MAAW,aAAW;AAEtB,UAAI,CAAC,MAAM,QAAQ,OAAO;AAAG,cAAM,IAAI,MAAM,gBAAgB;AAC7D,YAAM,MAAMJ,IAAG,UAAU,SAAS;AAClC,YAAM,MAAM,UAAU,cAAc,SAAS;AAC7C,YAAM,gBAAgB,QAAQ,IAAI,CAAC,MAAM,UAAU,WAAW,CAAC,CAAC;AAChE,YAAM,YAAY,cAAc,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,CAAC;AAC1D,YAAM,QAAQ,cAAc,UAAU,KAAK,KAAK,eAAe,WAAW,GAAG;AAC7E,aAAO,EAAE,WAAW,UAAU,IAAI,CAAC,MAAM,EAAE,QAAO,CAAE,GAAG,MAAK;IAC9D;IACA,cACE,WACA,WACA,SACA,MAAW,aAAW;AAEtB,YAAME,OAAM,KAAK,mBAAmB,WAAW,WAAW,CAAC,OAAO,GAAG,GAAG;AACxE,aAAO,EAAE,WAAWA,KAAI,UAAU,CAAC,GAAG,OAAOA,KAAI,MAAK;IACxD;IACA,cACE,OACA,WACA,OAAkB;AAElB,UAAI,CAAC,MAAM,QAAQ,KAAK;AAAG,cAAM,IAAI,MAAM,gBAAgB;AAC3D,YAAM,MAAM,UAAU,cAAc,SAAS;AAC7C,YAAM,gBAAgB,MAAM,IAAI,CAAC,MAAM,UAAU,WAAW,EAAE,OAAO,CAAC;AACtE,YAAM,aAAa,MAAM,IAAI,CAAC,MAAM,UAAU,aAAa,EAAE,SAAS,CAAC;AACvE,kBAAY,UAAU,KAAK,eAAe,YAAY,KAAK;AAC3D,aAAO,MAAM,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC;IACtE;IACA,SACE,OACAE,QACA,WACA,SACA,WACA,OAAkB;AAElB,aAAO,KAAK,cAAc,CAAC,EAAE,OAAO,OAAAA,QAAO,WAAW,QAAO,CAAE,GAAG,WAAW,KAAK,EAAE,CAAC;IACvF;IACA,UAAU,CAAC,WAA8B,UACvC,SAAS,UAAU,WAAW,KAAK;GACtC;AAED,QAAM,QAAQ,CAAC,SAAqB;AAClC,WAAO,WAAW,QAAQ,IAAI;AAC9B,UAAM,IAAI,qBAAqB,OAAO,QAAQ,IAAI,GAAG,QAAQ;AAC7D,UAAM,IAAI,MAAM,KAAK,SAAS,CAAC;AAC/B,WAAO,OAAO,OAAO;MACnB;MACA,eAAe,CAAC,MAAmB,YACjC,cAAc,UAAU,MAAM,OAAO;MACvC,MACE,OACA,WACA,MAAW,aAAW;AAEtB,gBAAQ,WAAW,SAAS,KAAK;AACjC,cAAM,MAAM,UAAU,cAAc,SAAS;AAC7C,cAAM,aAAa,EAAE,IAAI,GAAG;AAC5B,YAAI,WAAW,OAAO,MAAM,IAAI;AAAG,gBAAM,IAAI,MAAM,8BAA8B;AACjF,cAAMA,SAAQ,aAAa,GAAG;AAC9B,cAAM,aAAa,YAAY,OAAO,QAAQ;AAC9C,YAAI,WAAW,OAAO,MAAM,IAAI;AAAG,gBAAM,IAAI,MAAM,yBAAyB;AAC5E,cAAM,eAAe,WAAW,SAASA,MAAK;AAC9C,eAAO;UACL,OAAOJ,IAAG,QAAQI,MAAK;UACvB,SAAS,aAAa,QAAO;UAC7B,YAAY,WAAW,QAAO;;MAElC;MACA,mBACE,WACA,SACA,MAAW,aAAW;AAEtB,YAAI,CAAC,MAAM,QAAQ,OAAO;AAAG,gBAAM,IAAI,MAAM,gBAAgB;AAC7D,cAAM,MAAMJ,IAAG,UAAU,SAAS;AAClC,cAAM,IAAIA,IAAG,IAAI,KAAK,CAAC;AAGvB,cAAM,OAAOA,IAAG,IAAI,CAAC;AACrB,cAAM,gBAAgB,QAAQ,IAAI,CAAC,MAAM,UAAU,WAAW,CAAC,CAAC;AAChE,cAAM,aAAa,cAAc,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC;AAC5D,cAAM,aAAa,MAAM,KAAK,SAAS,CAAC;AACxC,cAAM,QAAQ,cAAc,UAAU,GAAG,YAAY,YAAY,eAAe,GAAG;AACnF,eAAO,EAAE,WAAW,WAAW,IAAI,CAAC,MAAM,EAAE,QAAO,CAAE,GAAG,MAAK;MAC/D;MACA,cACE,WACA,SACA,MAAW,aAAW;AAEtB,cAAME,OAAM,KAAK,mBAAmB,WAAW,CAAC,OAAO,GAAG,GAAG;AAC7D,eAAO,EAAE,WAAWA,KAAI,UAAU,CAAC,GAAG,OAAOA,KAAI,MAAK;MACxD;MACA,cACE,OACA,OACA,YAA4B;AAE5B,YAAI,CAAC,MAAM,QAAQ,KAAK;AAAG,gBAAM,IAAI,MAAM,gBAAgB;AAC3D,cAAM,SAAS,MAAM,IAAI,CAAC,MAAM,WAAW,SAAS,EAAE,KAAK,CAAC;AAC5D,cAAM,aAAa,MAAM,IAAI,CAAC,MAAM,UAAU,aAAa,EAAE,SAAS,CAAC;AACvE,oBACE,UACA,UAAU,cAAc,UAAU,GAClC,YACA,MAAM,IAAI,CAAC,MAAM,UAAU,WAAW,EAAE,OAAO,CAAC,GAChD,KAAK;AAEP,eAAO,MAAM,IAAI,CAAC,GAAG,MAAK;AACxB,gBAAME,SAAQJ,IAAG,UAAU,EAAE,KAAK;AAClC,gBAAM,QAAQ,WAAW,CAAC,EAAE,SAASA,IAAG,IAAII,MAAK,CAAC,EAAE,QAAO;AAC3D,iBAAO,UAAU,OAAO,CAAC,GAAG,MAAM,KAAK;QACzC,CAAC;MACH;MACA,SACE,OACAA,QACA,WACA,SACA,OACA,YAA4B;AAE5B,eAAO,KAAK,cAAc,CAAC,EAAE,OAAO,OAAAA,QAAO,WAAW,QAAO,CAAE,GAAG,OAAO,UAAU,EAAE,CAAC;MACxF;MACA,SAAS,WAA8B,OAAkB;AACvD,gBAAQ,WAAW,SAAS,KAAK;AACjC,cAAM,MAAMJ,IAAG,UAAU,SAAS;AAClC,cAAM,aAAa,YAAY,OAAO,QAAQ;AAC9C,YAAI,WAAW,OAAO,MAAM,IAAI;AAAG,gBAAM,IAAI,MAAM,yBAAyB;AAC5E,cAAM,IAAIA,IAAG,IAAI,KAAK,CAAC;AACvB,cAAM,OAAOA,IAAG,IAAI,CAAC;AACrB,cAAM,YAAY,WAAW,SAAS,IAAI,EAAE,QAAO;AACnD,eAAO,UAAU,OAAO,MAAM,SAAS;MACzC;KACD;EACH;AACA,QAAM,MAAM,EAAE,MAAM,MAAM,OAAO,OAAO,SAAS,OAAO,OAAO,EAAE,IAAAA,IAAE,CAAE,EAAC;AACtE,SAAO,OAAO,OAAO,GAAG;AAC1B;;;ACzuBA,IAAMK,OAAsB,uBAAO,CAAC;AAApC,IAAuCC,OAAsB,uBAAO,CAAC;AAArE,IAAwEC,OAAsB,uBAAO,CAAC;AAAtG,IAAyG,MAAsB,uBAAO,CAAC;AAEvI,IAAM,MAAsB,uBAAO,CAAC;AAApC,IAAuCC,OAAsB,uBAAO,CAAC;AAGrE,IAAM,kBAAkC,uBACtC,oEAAoE;AAKtE,IAAM,gBAA8C,wBAAO;EACzD,GAAG;EACH,GAAG,OAAO,oEAAoE;EAC9E,GAAGA;EACH,GAAG,OAAO,oEAAoE;EAC9E,GAAG,OAAO,oEAAoE;EAC9E,IAAI,OAAO,oEAAoE;EAC/E,IAAI,OAAO,oEAAoE;IAC9E;AAEH,SAAS,oBAAoB,GAAS;AAEpC,QAAM,OAAO,OAAO,EAAE,GAAG,OAAO,OAAO,EAAE,GAAG,OAAO,OAAO,EAAE,GAAG,OAAO,OAAO,EAAE;AAC/E,QAAM,IAAI;AACV,QAAM,KAAM,IAAI,IAAK;AACrB,QAAM,KAAM,KAAK,IAAK;AACtB,QAAM,KAAM,KAAK,IAAID,MAAK,CAAC,IAAI,KAAM;AACrC,QAAM,KAAM,KAAK,IAAID,MAAK,CAAC,IAAI,IAAK;AACpC,QAAM,MAAO,KAAK,IAAI,KAAK,CAAC,IAAI,KAAM;AACtC,QAAM,MAAO,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO;AACzC,QAAM,MAAO,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO;AACzC,QAAM,MAAO,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO;AACzC,QAAM,OAAQ,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO;AAC1C,QAAM,OAAQ,KAAK,MAAM,MAAM,CAAC,IAAI,MAAO;AAC3C,QAAM,OAAQ,KAAK,MAAM,MAAM,CAAC,IAAI,MAAO;AAC3C,QAAM,YAAa,KAAK,MAAMC,MAAK,CAAC,IAAI,IAAK;AAE7C,SAAO,EAAE,WAAW,GAAE;AACxB;AAGA,SAAS,kBAAkB,OAAuB;AAGhD,QAAM,CAAC,KAAK;AAEZ,QAAM,EAAE,KAAK;AAEb,QAAM,EAAE,KAAK;AACb,SAAO;AACT;AAIA,IAAM,kBAAkC,uBACtC,+EAA+E;AAIjF,SAAS,QAAQ,GAAW,GAAS;AACnC,QAAM,IAAI;AACV,QAAM,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC;AAC3B,QAAM,KAAK,IAAI,KAAK,KAAK,GAAG,CAAC;AAE7B,QAAM,MAAM,oBAAoB,IAAI,EAAE,EAAE;AACxC,MAAI,IAAI,IAAI,IAAI,KAAK,KAAK,CAAC;AAC3B,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC;AAC5B,QAAM,QAAQ;AACd,QAAM,QAAQ,IAAI,IAAI,iBAAiB,CAAC;AACxC,QAAM,WAAW,QAAQ;AACzB,QAAM,WAAW,QAAQ,IAAI,CAAC,GAAG,CAAC;AAClC,QAAM,SAAS,QAAQ,IAAI,CAAC,IAAI,iBAAiB,CAAC;AAClD,MAAI;AAAU,QAAI;AAClB,MAAI,YAAY;AAAQ,QAAI;AAC5B,MAAI,aAAa,GAAG,CAAC;AAAG,QAAI,IAAI,CAAC,GAAG,CAAC;AACrC,SAAO,EAAE,SAAS,YAAY,UAAU,OAAO,EAAC;AAClD;AAEA,IAAM,gBAAgC,wBAAQ,eAAe,EAAE,QAAO,CAAE;AAGxE,IAAM,KAAsB,uBAAM,cAAc,IAAG;AACnD,IAAM,KAAsB,uBAAM,cAAc,IAAG;AAInD,SAAS,eACP,MACA,KACA,QAAe;AAEf,MAAI,IAAI,SAAS;AAAK,UAAM,IAAI,MAAM,oBAAoB;AAC1D,SAAO,YACL,aAAa,kCAAkC,GAC/C,IAAI,WAAW,CAAC,SAAS,IAAI,GAAG,IAAI,MAAM,CAAC,GAC3C,KACA,IAAI;AAER;AAEA,SAAS,GAAG,MAAqB;AAE/B,SAAO,MACL,eACA,QACA,OAAO,OAAO,EAAE,mBAAmB,QAAQ,KAAI,GAAI,IAAiB,CAAC;AAEzE;AAoBO,IAAM,UAAiC,mBAAG,CAAA,CAAE;AAgB5C,IAAM,aAAoC,mBAAG,EAAE,QAAQ,eAAc,CAAE;AAevE,IAAM,YAAmC,mBAAG,EAAE,QAAQ,gBAAgB,SAAS,OAAM,CAAE;AAavF,IAAM,gBAA8C,uBACzD,YAAY;EACV,MAAM;EACN,OAAO;EACP,eAAe,CAAC,MAAK;AACnB,MAAE,eAAc;AAChB,QAAI,CAAC,EAAE,cAAa;AAAI,YAAM,IAAI,MAAM,6BAA6B;EACvE;EACA,MAAM;;;;EAIN,IAAI;CACL,GAAE;AAgBE,IAAM,SAAgD,uBAAK;AAChE,QAAM,IAAI;AACV,SAAO,WAAW;IAChB;IACA,MAAM;IACN,YAAY,CAAC,MAAqB;AAEhC,YAAM,EAAE,WAAW,GAAE,IAAK,oBAAoB,CAAC;AAC/C,aAAO,IAAI,KAAK,WAAW,KAAK,CAAC,IAAI,IAAI,CAAC;IAC5C;IACA;GACD;AACH,GAAE;AAMF,IAAM,UAA2B,wBAAO,kBAAkB,OAAOC,MAAI;AACrE,IAAM,UAA2B,uBAAM,GAAG,IAAID,MAAK,OAAO,GAAE;AAC5D,IAAM,UAA2B,uBAAM,GAAG,KAAK,GAAG,IAAI,GAAG,GAAG,CAAC,GAAE;AAOzD,SAAU,oCAAoC,GAAS;AAG3D,QAAM,WAAW,kBAAkB,OAAOC;AAC1C,QAAM,SAAS,OAAO,MAAM;AAE5B,MAAI,MAAM,GAAG,IAAI,CAAC;AAClB,QAAM,GAAG,IAAI,KAAKD,IAAG;AAErB,MAAI,KAAK,GAAG,IAAI,KAAK,GAAG,GAAG;AAC3B,MAAI,MAAM,GAAG,IAAI,MAAM;AACvB,MAAI,MAAM,GAAG,IAAI,EAAE;AACnB,MAAI,MAAM,GAAG,IAAI,KAAK,EAAE;AACxB,MAAI,MAAM,GAAG,IAAI,KAAK,MAAM;AAC5B,QAAM,GAAG,IAAI,KAAK,GAAG;AACrB,QAAM,GAAG,IAAI,KAAK,GAAG;AACrB,QAAM,GAAG,IAAI,KAAK,GAAG;AACrB,MAAI,MAAM,GAAG,IAAI,GAAG;AACpB,QAAM,GAAG,IAAI,GAAG;AAChB,QAAM,GAAG,IAAI,KAAK,GAAG;AACrB,QAAM,GAAG,IAAI,KAAK,GAAG;AACrB,QAAM,GAAG,IAAI,KAAK,GAAG;AACrB,MAAI,MAAM,GAAG,IAAI,KAAK,OAAO;AAC7B,QAAM,GAAG,IAAI,KAAK,GAAG;AACrB,MAAI,MAAM,GAAG,IAAI,KAAK,OAAO;AAC7B,QAAM,GAAG,IAAI,GAAG;AAChB,QAAM,GAAG,IAAI,KAAK,GAAG;AACrB,MAAI,KAAK,GAAG,IAAI,KAAK,GAAG;AAExB,MAAI,KAAK,GAAG,KAAK,KAAK,KAAK,EAAE;AAC7B,MAAI,MAAM,GAAG,IAAI,KAAK,GAAG;AACzB,MAAI,MAAM,GAAG,IAAI,KAAK,CAAC;AACvB,QAAM,GAAG,IAAI,KAAK,OAAO;AACzB,MAAI,MAAM,GAAG,IAAI,KAAK,OAAO;AAC7B,MAAI,MAAM,GAAG,IAAI,KAAK,GAAG;AACzB,QAAM,GAAG,IAAI,GAAG;AAChB,QAAM,GAAG,IAAI,KAAK,GAAG;AACrB,MAAI,KAAK,GAAG,IAAI,KAAK,GAAG;AAExB,MAAI,KAAK,GAAG,KAAK,KAAK,KAAK,EAAE;AAC7B,QAAM,GAAG,IAAI,EAAE;AACf,QAAM,GAAG,IAAI,KAAK,GAAG;AACrB,MAAI,KAAK,GAAG,IAAI,KAAK,GAAG;AACxB,MAAI,KAAK,GAAG,KAAK,KAAK,KAAK,EAAE;AAC7B,MAAI,IAAI,GAAG,KAAK,IAAI,IAAI,EAAE;AAC1B,MAAI,KAAK,GAAG,MAAO,CAAC;AACpB,MAAI,GAAG,KAAK,GAAG,GAAG,IAAI,CAAC,GAAG,OAAO,EAAE;AACnC,SAAO,EAAE,KAAK,IAAI,KAAK,IAAI,KAAK,GAAG,KAAKD,KAAG;AAC7C;AAGA,IAAM,kBAAmC,uBAAM,WAAW,IAAI,GAAG,IAAI,OAAO,MAAM,CAAC,CAAC,GAAE;AACtF,SAAS,qCAAqC,GAAS;AAErD,QAAM,EAAE,KAAK,KAAK,KAAK,IAAG,IAAK,oCAAoC,CAAC;AAEpE,MAAI,KAAK,GAAG,IAAI,KAAK,GAAG;AACxB,OAAK,GAAG,IAAI,IAAI,eAAe;AAC/B,MAAI,KAAK,GAAG,IAAI,KAAK,GAAG;AACxB,MAAI,KAAK,GAAG,IAAI,KAAK,GAAG;AAExB,MAAI,KAAK,GAAG,IAAI,KAAK,GAAG;AACxB,MAAI,MAAM,GAAG,IAAI,IAAI,EAAE;AACvB,MAAI,IAAI,GAAG,IAAI,KAAK,GAAG,IAAI;AAC3B,OAAK,GAAG,KAAK,IAAI,GAAG,MAAM,CAAC;AAC3B,OAAK,GAAG,KAAK,IAAI,GAAG,KAAK,CAAC;AAC1B,OAAK,GAAG,KAAK,IAAI,GAAG,KAAK,CAAC;AAC1B,OAAK,GAAG,KAAK,IAAI,GAAG,KAAK,CAAC;AAC1B,QAAM,CAAC,QAAQ,MAAM,IAAI,cAAc,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI;AAGzD,SAAO,EAAE,GAAG,GAAG,IAAI,IAAI,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,MAAM,EAAC;AACvD;AAaO,IAAM,iBAA+D,uBAC1E,aACE,eACA,CAAC,YAAsB,qCAAqC,QAAQ,CAAC,CAAC,GACtE;EACE,KAAK;EACL,WAAW;EACX,GAAG;EACH,GAAG;EACH,GAAG;EACH,QAAQ;EACR,MAAM;CACP,GACD;AAGJ,IAAM,UAAU;AAEhB,IAAM,oBAAoC,uBACxC,+EAA+E;AAGjF,IAAM,oBAAoC,uBACxC,+EAA+E;AAGjF,IAAM,iBAAiC,uBACrC,8EAA8E;AAGhF,IAAM,iBAAiC,uBACrC,+EAA+E;AAIjF,IAAM,aAAa,CAAC,WAAmB,QAAQA,MAAK,MAAM;AAE1D,IAAM,WAA2B,uBAC/B,oEAAoE;AAItE,IAAM,qBAAqB,CAAC,UAC1B,GAAG,OAAO,gBAAgB,KAAK,IAAI,QAAQ;AAQ7C,SAAS,0BAA0B,IAAU;AAC3C,QAAM,EAAE,EAAC,IAAK;AACd,QAAM,IAAI;AACV,QAAMG,OAAM,CAAC,MAAc,GAAG,OAAO,CAAC;AACtC,QAAM,IAAIA,KAAI,UAAU,KAAK,EAAE;AAC/B,QAAM,KAAKA,MAAK,IAAIH,QAAO,cAAc;AACzC,MAAI,IAAI,OAAO,EAAE;AACjB,QAAM,IAAIG,MAAK,IAAI,IAAI,KAAKA,KAAI,IAAI,CAAC,CAAC;AACtC,MAAI,EAAE,SAAS,YAAY,OAAO,EAAC,IAAK,QAAQ,IAAI,CAAC;AACrD,MAAI,KAAKA,KAAI,IAAI,EAAE;AACnB,MAAI,CAAC,aAAa,IAAI,CAAC;AAAG,SAAKA,KAAI,CAAC,EAAE;AACtC,MAAI,CAAC;AAAY,QAAI;AACrB,MAAI,CAAC;AAAY,QAAI;AACrB,QAAM,KAAKA,KAAI,KAAK,IAAIH,QAAO,iBAAiB,CAAC;AACjD,QAAM,KAAK,IAAI;AACf,QAAM,KAAKG,MAAK,IAAI,KAAK,CAAC;AAC1B,QAAM,KAAKA,KAAI,KAAK,iBAAiB;AACrC,QAAM,KAAKA,KAAIH,OAAM,EAAE;AACvB,QAAM,KAAKG,KAAIH,OAAM,EAAE;AACvB,SAAO,IAAI,cAAcG,KAAI,KAAK,EAAE,GAAGA,KAAI,KAAK,EAAE,GAAGA,KAAI,KAAK,EAAE,GAAGA,KAAI,KAAK,EAAE,CAAC;AACjF;AAWA,IAAM,kBAAN,MAAM,yBAAwB,kBAAkC;;;;EAI9D,OAAO,OACY,uBAAM,IAAI,iBAAgB,cAAc,IAAI,GAAE;;EAEjE,OAAO,OACY,uBAAM,IAAI,iBAAgB,cAAc,IAAI,GAAE;;EAEjE,OAAO,KACY,uBAAM,IAAG;;EAE5B,OAAO,KACY,uBAAM,IAAG;EAE5B,YAAY,IAAgB;AAC1B,UAAM,EAAE;EACV;;;;;;;EAQA,OAAO,WAAW,IAAuB;AACvC,WAAO,IAAI,iBAAgB,cAAc,WAAW,EAAE,CAAC;EACzD;EAEU,WAAW,OAAsB;AACzC,QAAI,EAAE,iBAAiB;AAAkB,YAAM,IAAI,MAAM,yBAAyB;EACpF;EAEU,KAAK,IAAgB;AAC7B,WAAO,IAAI,iBAAgB,EAAE;EAC/B;EAEA,OAAO,UAAU,OAAuB;AACtC,WAAO,OAAO,EAAE;AAChB,UAAM,EAAE,GAAG,EAAC,IAAK;AACjB,UAAM,IAAI;AACV,UAAMA,OAAM,CAAC,MAAc,GAAG,OAAO,CAAC;AACtC,UAAM,IAAI,mBAAmB,KAAK;AAGlC,QAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,GAAG,KAAK,KAAK,aAAa,GAAG,CAAC;AACxD,YAAM,IAAI,MAAM,iCAAiC;AACnD,UAAM,KAAKA,KAAI,IAAI,CAAC;AACpB,UAAM,KAAKA,KAAIH,OAAM,IAAI,EAAE;AAC3B,UAAM,KAAKG,KAAIH,OAAM,IAAI,EAAE;AAC3B,UAAM,OAAOG,KAAI,KAAK,EAAE;AACxB,UAAM,OAAOA,KAAI,KAAK,EAAE;AACxB,UAAM,IAAIA,KAAI,IAAI,IAAI,OAAO,IAAI;AACjC,UAAM,EAAE,SAAS,OAAO,EAAC,IAAK,WAAWA,KAAI,IAAI,IAAI,CAAC;AACtD,UAAM,KAAKA,KAAI,IAAI,EAAE;AACrB,UAAM,KAAKA,KAAI,IAAI,KAAK,CAAC;AACzB,QAAI,IAAIA,MAAK,IAAI,KAAK,EAAE;AACxB,QAAI,aAAa,GAAG,CAAC;AAAG,UAAIA,KAAI,CAAC,CAAC;AAClC,UAAM,IAAIA,KAAI,KAAK,EAAE;AACrB,UAAM,IAAIA,KAAI,IAAI,CAAC;AACnB,QAAI,CAAC,WAAW,aAAa,GAAG,CAAC,KAAK,MAAMJ;AAC1C,YAAM,IAAI,MAAM,iCAAiC;AACnD,WAAO,IAAI,iBAAgB,IAAI,cAAc,GAAG,GAAGC,MAAK,CAAC,CAAC;EAC5D;;;;;;EAOA,OAAO,QAAQ,KAAW;AACxB,WAAO,iBAAgB,UAAU,WAAW,GAAG,CAAC;EAClD;;;;;EAMA,UAAO;AACL,QAAI,EAAE,GAAG,GAAG,GAAG,EAAC,IAAK,KAAK;AAC1B,UAAM,IAAI;AACV,UAAMG,OAAM,CAAC,MAAc,GAAG,OAAO,CAAC;AACtC,UAAM,KAAKA,KAAIA,KAAI,IAAI,CAAC,IAAIA,KAAI,IAAI,CAAC,CAAC;AACtC,UAAM,KAAKA,KAAI,IAAI,CAAC;AAEpB,UAAM,OAAOA,KAAI,KAAK,EAAE;AACxB,UAAM,EAAE,OAAO,QAAO,IAAK,WAAWA,KAAI,KAAK,IAAI,CAAC;AACpD,UAAM,KAAKA,KAAI,UAAU,EAAE;AAC3B,UAAM,KAAKA,KAAI,UAAU,EAAE;AAC3B,UAAM,OAAOA,KAAI,KAAK,KAAK,CAAC;AAC5B,QAAI;AACJ,QAAI,aAAa,IAAI,MAAM,CAAC,GAAG;AAC7B,UAAI,KAAKA,KAAI,IAAI,OAAO;AACxB,UAAI,KAAKA,KAAI,IAAI,OAAO;AACxB,UAAI;AACJ,UAAI;AACJ,UAAIA,KAAI,KAAK,iBAAiB;IAChC,OAAO;AACL,UAAI;IACN;AACA,QAAI,aAAa,IAAI,MAAM,CAAC;AAAG,UAAIA,KAAI,CAAC,CAAC;AACzC,QAAI,IAAIA,MAAK,IAAI,KAAK,CAAC;AACvB,QAAI,aAAa,GAAG,CAAC;AAAG,UAAIA,KAAI,CAAC,CAAC;AAClC,WAAO,GAAG,QAAQ,CAAC;EACrB;;;;;EAMA,OAAO,OAAsB;AAC3B,SAAK,WAAW,KAAK;AACrB,UAAM,EAAE,GAAG,IAAI,GAAG,GAAE,IAAK,KAAK;AAC9B,UAAM,EAAE,GAAG,IAAI,GAAG,GAAE,IAAK,MAAM;AAC/B,UAAMA,OAAM,CAAC,MAAc,GAAG,OAAO,CAAC;AAEtC,UAAM,MAAMA,KAAI,KAAK,EAAE,MAAMA,KAAI,KAAK,EAAE;AACxC,UAAM,MAAMA,KAAI,KAAK,EAAE,MAAMA,KAAI,KAAK,EAAE;AACxC,WAAO,OAAO;EAChB;EAEA,MAAG;AACD,WAAO,KAAK,OAAO,iBAAgB,IAAI;EACzC;;AAEF,OAAO,OAAO,gBAAgB,IAAI;AAClC,OAAO,OAAO,gBAAgB,IAAI;AAClC,OAAO,OAAO,gBAAgB,SAAS;AACvC,OAAO,OAAO,eAAe;AAGtB,IAAM,eAEO,uBAAO,OAAO,EAAE,OAAO,gBAAe,CAAE;AAcrD,IAAM,sBAA6D,OAAO,OAAO;EACtF,OAAO;;;;;;;;;;;;;;;EAeP,YAAY,KAAuB,SAA0B;AAG3D,UAAM,MAAM,SAAS,QAAQ,SAAY,yCAAyC,QAAQ;AAC1F,UAAM,MAAM,mBAAmB,KAAK,KAAK,IAAI,MAAM;AAKnD,WAAO,oBAAoB,cAAe,GAAG;EAC/C;EACA,aAAa,KAAuB,UAA4B,EAAE,KAAK,YAAW,GAAE;AAClF,UAAM,MAAM,mBAAmB,KAAK,QAAQ,KAAK,IAAI,MAAM;AAC3D,WAAO,GAAG,OAAO,gBAAgB,GAAG,CAAC;EACvC;;;;;;;;;;EAUA,cAAc,OAAuB;AAEnC,WAAO,OAAO,EAAE;AAChB,UAAM,KAAK,mBAAmB,MAAM,SAAS,GAAG,EAAE,CAAC;AACnD,UAAM,KAAK,0BAA0B,EAAE;AACvC,UAAM,KAAK,mBAAmB,MAAM,SAAS,IAAI,EAAE,CAAC;AACpD,UAAM,KAAK,0BAA0B,EAAE;AACvC,WAAO,IAAI,gBAAgB,GAAG,IAAI,EAAE,CAAC;EACvC;CACD;AAeM,IAAM,oBAAiD,uBAC5D,WAAW;EACT,MAAM;EACN,OAAO;EACP,MAAM;EACN,aAAa,oBAAoB;EACjC,cAAc,oBAAoB;CACnC,GAAE;AAaE,IAAM,qBAAmD,uBAC9D,YAAY;EACV,MAAM;EACN,OAAO;EACP,eAAe,CAAC,MAAK;AAEnB,MAAE,eAAc;EAClB;EACA,MAAM;CACP,GAAE;AAgBE,IAAM,2BAA8D,uBAAO,OAAO;EACvF;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACD;","names":["Fp","Fn","uvRatio","abytes","hexToBytes","p","randomBytes","adjustScalarBytes","hash","concatBytes","_0n","_1n","_2n","adjustScalarBytes","abytes","Fn","concatBytes","res","abytes","blind","_0n","_1n","_2n","_8n","mod"]}

package/dist/daemon.js

@@ -4,7 +4,7 @@ import {
   ClientRunner,
   registerRoutes,
   scaffoldFirstRun
-} from "./chunk-WS3GVRQJ.js";
+} from "./chunk-TGIKIMXO.js";
 import {
   ControlClient,
   ToonClient,
@@ -17,12 +17,14 @@ import {
   resolveConfig,
   spawnDaemonDetached,
   waitForReady
-} from "./chunk-UPIAVE44.js";
-import "./chunk-IAOKAQLA.js";
+} from "./chunk-JFDVE4IA.js";
+import "./chunk-FDUYHYB2.js";
 import "./chunk-HMD5EVQI.js";
+import "./chunk-IYPIOSEF.js";
 import "./chunk-T3WCTWRP.js";
 import "./chunk-3DDN4CJQ.js";
-import "./chunk-LN2OF264.js";
+import "./chunk-V7D5HJBT.js";
+import "./chunk-6GXZ4KRO.js";
 import "./chunk-NL7NYWPC.js";
 import "./chunk-I7TGLGN6.js";
 

package/dist/daemon.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/daemon.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * `toon-clientd` — the always-on, detached TOON client daemon. It owns the two\n * long-lived connections that cannot live in an ephemeral agent session:\n *   • a BTP session to the apex/connector (paid writes), and\n *   • a persistent relay Nostr-WS subscription (free reads),\n * plus the payment channels (with a persisted nonce watermark) and the signer.\n *\n * Subcommands:\n *   toon-clientd run      Run the daemon in the foreground (used internally by\n *                         the detached spawn; logs to stdout).\n *   toon-clientd start    Spawn the daemon detached and wait until reachable.\n *   toon-clientd stop     Stop a running daemon (SIGTERM the locked PID).\n *   toon-clientd status   Print the daemon status as JSON.\n */\n\nimport Fastify from 'fastify';\nimport { ToonClient } from '@toon-protocol/client';\nimport {\n  defaultConfigPath,\n  readConfigFile,\n  resolveConfig,\n  type ResolvedDaemonConfig,\n} from './daemon/config.js';\nimport { scaffoldFirstRun } from './daemon/first-run.js';\nimport { ClientRunner, type ToonClientLike } from './daemon/client-runner.js';\nimport { registerRoutes } from './daemon/routes.js';\nimport {\n  acquireLock,\n  isProcessAlive,\n  readPid,\n  releaseLock,\n  spawnDaemonDetached,\n  waitForReady,\n} from './daemon/lifecycle.js';\nimport { ControlClient } from './control-client.js';\n\nfunction baseUrl(config: ResolvedDaemonConfig): string {\n  return `http://127.0.0.1:${config.httpPort}`;\n}\n\nfunction loadResolvedConfig(): ResolvedDaemonConfig {\n  const path = process.env['TOON_CLIENT_CONFIG'] ?? defaultConfigPath();\n  return resolveConfig(readConfigFile(path));\n}\n\n/** Run the daemon in the foreground (the detached child's actual work). */\nasync function runForeground(): Promise<void> {\n  acquireLock();\n  const config = loadResolvedConfig();\n  const log = (msg: string): void => console.error(msg);\n\n  const runner = new ClientRunner({\n    config,\n    createClient: (clientConfig) =>\n      new ToonClient(clientConfig) as unknown as ToonClientLike,\n    logger: log,\n  });\n\n  const app = Fastify({\n    logger: false,\n    // Keep idle keep-alive sockets open longer than the MCP-side undici client\n    // would ever pool one (its keepAliveMaxTimeout default is 600s). The client\n    // calls this localhost control API infrequently, so with Node's default\n    // 5s keep-alive the daemon was reaping sockets the client still held —\n    // causing the next request to fail with ECONNRESET (\"daemon not reachable\")\n    // until a retry opened a fresh socket (toon-client#186). Outliving the\n    // client's pool removes that race for non-retried (POST) requests too; the\n    // client-side retry covers the residual. Localhost-only listener, so a\n    // long-lived idle socket is harmless.\n    keepAliveTimeout: 650_000,\n  });\n  registerRoutes(app, runner);\n\n  // Begin bootstrap (non-blocking) before listening so /status is immediately\n  // reachable and reports `bootstrapping: true` while anon/BTP come up.\n  runner.start();\n\n  await app.listen({ host: '127.0.0.1', port: config.httpPort });\n  log(`[toon-clientd] listening on ${baseUrl(config)}`);\n\n  let shuttingDown = false;\n  const shutdown = async (signal: string): Promise<void> => {\n    if (shuttingDown) return;\n    shuttingDown = true;\n    log(`[toon-clientd] received ${signal}, shutting down`);\n    try {\n      await app.close();\n    } catch {\n      /* ignore */\n    }\n    await runner.stop();\n    releaseLock();\n    setTimeout(() => process.exit(0), 500).unref();\n  };\n  process.on('SIGTERM', () => void shutdown('SIGTERM'));\n  process.on('SIGINT', () => void shutdown('SIGINT'));\n}\n\n/** Spawn the daemon detached and wait until the control API responds. */\nasync function start(): Promise<void> {\n  const config = loadResolvedConfig();\n  const url = baseUrl(config);\n  const existing = readPid();\n  if (existing !== null && isProcessAlive(existing)) {\n    console.log(`toon-clientd already running (pid ${existing}) at ${url}`);\n    return;\n  }\n  const pid = spawnDaemonDetached();\n  const ok = await waitForReady(url, 20_000);\n  if (ok) {\n    console.log(`toon-clientd started (pid ${pid}) at ${url}`);\n  } else {\n    console.error(\n      `toon-clientd spawned (pid ${pid}) but did not become reachable at ${url} in time. ` +\n        `Check the daemon log.`\n    );\n    process.exitCode = 1;\n  }\n}\n\n/** Stop a running daemon via SIGTERM on the locked PID. */\nasync function stop(): Promise<void> {\n  const pid = readPid();\n  if (pid === null || !isProcessAlive(pid)) {\n    console.log('toon-clientd is not running');\n    releaseLock();\n    return;\n  }\n  process.kill(pid, 'SIGTERM');\n  // Wait briefly for the process to exit.\n  for (let i = 0; i < 40; i++) {\n    if (!isProcessAlive(pid)) break;\n    await new Promise((r) => setTimeout(r, 100));\n  }\n  console.log(`toon-clientd stopped (pid ${pid})`);\n}\n\n/** Print the daemon status JSON. */\nasync function status(): Promise<void> {\n  const config = loadResolvedConfig();\n  const client = new ControlClient({ baseUrl: baseUrl(config) });\n  try {\n    const s = await client.status();\n    console.log(JSON.stringify(s, null, 2));\n  } catch {\n    console.log(JSON.stringify({ running: false }, null, 2));\n    process.exitCode = 1;\n  }\n}\n\nasync function main(): Promise<void> {\n  const cmd = process.argv[2] ?? 'run';\n  switch (cmd) {\n    case 'run':\n      // First-run onboarding (#251): mint + persist an identity and scaffold\n      // the transport config so a fresh install starts with no manual setup.\n      await scaffoldFirstRun();\n      await runForeground();\n      break;\n    case 'start':\n      await scaffoldFirstRun();\n      await start();\n      break;\n    case 'stop':\n      await stop();\n      break;\n    case 'status':\n      await status();\n      break;\n    default:\n      console.error(\n        `Unknown command \"${cmd}\". Usage: toon-clientd <run|start|stop|status>`\n      );\n      process.exitCode = 1;\n  }\n}\n\nmain().catch((err) => {\n  console.error(\n    err instanceof Error ? (err.stack ?? err.message) : String(err)\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA,OAAO,aAAa;AAqBpB,SAAS,QAAQ,QAAsC;AACrD,SAAO,oBAAoB,OAAO,QAAQ;AAC5C;AAEA,SAAS,qBAA2C;AAClD,QAAM,OAAO,QAAQ,IAAI,oBAAoB,KAAK,kBAAkB;AACpE,SAAO,cAAc,eAAe,IAAI,CAAC;AAC3C;AAGA,eAAe,gBAA+B;AAC5C,cAAY;AACZ,QAAM,SAAS,mBAAmB;AAClC,QAAM,MAAM,CAAC,QAAsB,QAAQ,MAAM,GAAG;AAEpD,QAAM,SAAS,IAAI,aAAa;AAAA,IAC9B;AAAA,IACA,cAAc,CAAC,iBACb,IAAI,WAAW,YAAY;AAAA,IAC7B,QAAQ;AAAA,EACV,CAAC;AAED,QAAM,MAAM,QAAQ;AAAA,IAClB,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUR,kBAAkB;AAAA,EACpB,CAAC;AACD,iBAAe,KAAK,MAAM;AAI1B,SAAO,MAAM;AAEb,QAAM,IAAI,OAAO,EAAE,MAAM,aAAa,MAAM,OAAO,SAAS,CAAC;AAC7D,MAAI,+BAA+B,QAAQ,MAAM,CAAC,EAAE;AAEpD,MAAI,eAAe;AACnB,QAAM,WAAW,OAAO,WAAkC;AACxD,QAAI,aAAc;AAClB,mBAAe;AACf,QAAI,2BAA2B,MAAM,iBAAiB;AACtD,QAAI;AACF,YAAM,IAAI,MAAM;AAAA,IAClB,QAAQ;AAAA,IAER;AACA,UAAM,OAAO,KAAK;AAClB,gBAAY;AACZ,eAAW,MAAM,QAAQ,KAAK,CAAC,GAAG,GAAG,EAAE,MAAM;AAAA,EAC/C;AACA,UAAQ,GAAG,WAAW,MAAM,KAAK,SAAS,SAAS,CAAC;AACpD,UAAQ,GAAG,UAAU,MAAM,KAAK,SAAS,QAAQ,CAAC;AACpD;AAGA,eAAe,QAAuB;AACpC,QAAM,SAAS,mBAAmB;AAClC,QAAM,MAAM,QAAQ,MAAM;AAC1B,QAAM,WAAW,QAAQ;AACzB,MAAI,aAAa,QAAQ,eAAe,QAAQ,GAAG;AACjD,YAAQ,IAAI,qCAAqC,QAAQ,QAAQ,GAAG,EAAE;AACtE;AAAA,EACF;AACA,QAAM,MAAM,oBAAoB;AAChC,QAAM,KAAK,MAAM,aAAa,KAAK,GAAM;AACzC,MAAI,IAAI;AACN,YAAQ,IAAI,6BAA6B,GAAG,QAAQ,GAAG,EAAE;AAAA,EAC3D,OAAO;AACL,YAAQ;AAAA,MACN,6BAA6B,GAAG,qCAAqC,GAAG;AAAA,IAE1E;AACA,YAAQ,WAAW;AAAA,EACrB;AACF;AAGA,eAAe,OAAsB;AACnC,QAAM,MAAM,QAAQ;AACpB,MAAI,QAAQ,QAAQ,CAAC,eAAe,GAAG,GAAG;AACxC,YAAQ,IAAI,6BAA6B;AACzC,gBAAY;AACZ;AAAA,EACF;AACA,UAAQ,KAAK,KAAK,SAAS;AAE3B,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,QAAI,CAAC,eAAe,GAAG,EAAG;AAC1B,UAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC;AAAA,EAC7C;AACA,UAAQ,IAAI,6BAA6B,GAAG,GAAG;AACjD;AAGA,eAAe,SAAwB;AACrC,QAAM,SAAS,mBAAmB;AAClC,QAAM,SAAS,IAAI,cAAc,EAAE,SAAS,QAAQ,MAAM,EAAE,CAAC;AAC7D,MAAI;AACF,UAAM,IAAI,MAAM,OAAO,OAAO;AAC9B,YAAQ,IAAI,KAAK,UAAU,GAAG,MAAM,CAAC,CAAC;AAAA,EACxC,QAAQ;AACN,YAAQ,IAAI,KAAK,UAAU,EAAE,SAAS,MAAM,GAAG,MAAM,CAAC,CAAC;AACvD,YAAQ,WAAW;AAAA,EACrB;AACF;AAEA,eAAe,OAAsB;AACnC,QAAM,MAAM,QAAQ,KAAK,CAAC,KAAK;AAC/B,UAAQ,KAAK;AAAA,IACX,KAAK;AAGH,YAAM,iBAAiB;AACvB,YAAM,cAAc;AACpB;AAAA,IACF,KAAK;AACH,YAAM,iBAAiB;AACvB,YAAM,MAAM;AACZ;AAAA,IACF,KAAK;AACH,YAAM,KAAK;AACX;AAAA,IACF,KAAK;AACH,YAAM,OAAO;AACb;AAAA,IACF;AACE,cAAQ;AAAA,QACN,oBAAoB,GAAG;AAAA,MACzB;AACA,cAAQ,WAAW;AAAA,EACvB;AACF;AAEA,KAAK,EAAE,MAAM,CAAC,QAAQ;AACpB,UAAQ;AAAA,IACN,eAAe,QAAS,IAAI,SAAS,IAAI,UAAW,OAAO,GAAG;AAAA,EAChE;AACA,UAAQ,WAAW;AACrB,CAAC;","names":[]}
+{"version":3,"sources":["../src/daemon.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * `toon-clientd` — the always-on, detached TOON client daemon. It owns the two\n * long-lived connections that cannot live in an ephemeral agent session:\n *   • a BTP session to the apex/connector (paid writes), and\n *   • a persistent relay Nostr-WS subscription (free reads),\n * plus the payment channels (with a persisted nonce watermark) and the signer.\n *\n * Subcommands:\n *   toon-clientd run      Run the daemon in the foreground (used internally by\n *                         the detached spawn; logs to stdout).\n *   toon-clientd start    Spawn the daemon detached and wait until reachable.\n *   toon-clientd stop     Stop a running daemon (SIGTERM the locked PID).\n *   toon-clientd status   Print the daemon status as JSON.\n */\n\nimport Fastify from 'fastify';\nimport { ToonClient } from '@toon-protocol/client';\nimport {\n  defaultConfigPath,\n  readConfigFile,\n  resolveConfig,\n  type ResolvedDaemonConfig,\n} from './daemon/config.js';\nimport { scaffoldFirstRun } from './daemon/first-run.js';\nimport { ClientRunner, type ToonClientLike } from './daemon/client-runner.js';\nimport { registerRoutes } from './daemon/routes.js';\nimport {\n  acquireLock,\n  isProcessAlive,\n  readPid,\n  releaseLock,\n  spawnDaemonDetached,\n  waitForReady,\n} from './daemon/lifecycle.js';\nimport { ControlClient } from './control-client.js';\n\nfunction baseUrl(config: ResolvedDaemonConfig): string {\n  return `http://127.0.0.1:${config.httpPort}`;\n}\n\nfunction loadResolvedConfig(): ResolvedDaemonConfig {\n  const path = process.env['TOON_CLIENT_CONFIG'] ?? defaultConfigPath();\n  return resolveConfig(readConfigFile(path));\n}\n\n/** Run the daemon in the foreground (the detached child's actual work). */\nasync function runForeground(): Promise<void> {\n  acquireLock();\n  const config = loadResolvedConfig();\n  const log = (msg: string): void => console.error(msg);\n\n  const runner = new ClientRunner({\n    config,\n    createClient: (clientConfig) =>\n      new ToonClient(clientConfig) as unknown as ToonClientLike,\n    logger: log,\n  });\n\n  const app = Fastify({\n    logger: false,\n    // Keep idle keep-alive sockets open longer than the MCP-side undici client\n    // would ever pool one (its keepAliveMaxTimeout default is 600s). The client\n    // calls this localhost control API infrequently, so with Node's default\n    // 5s keep-alive the daemon was reaping sockets the client still held —\n    // causing the next request to fail with ECONNRESET (\"daemon not reachable\")\n    // until a retry opened a fresh socket (toon-client#186). Outliving the\n    // client's pool removes that race for non-retried (POST) requests too; the\n    // client-side retry covers the residual. Localhost-only listener, so a\n    // long-lived idle socket is harmless.\n    keepAliveTimeout: 650_000,\n  });\n  registerRoutes(app, runner);\n\n  // Begin bootstrap (non-blocking) before listening so /status is immediately\n  // reachable and reports `bootstrapping: true` while anon/BTP come up.\n  runner.start();\n\n  await app.listen({ host: '127.0.0.1', port: config.httpPort });\n  log(`[toon-clientd] listening on ${baseUrl(config)}`);\n\n  let shuttingDown = false;\n  const shutdown = async (signal: string): Promise<void> => {\n    if (shuttingDown) return;\n    shuttingDown = true;\n    log(`[toon-clientd] received ${signal}, shutting down`);\n    try {\n      await app.close();\n    } catch {\n      /* ignore */\n    }\n    await runner.stop();\n    releaseLock();\n    setTimeout(() => process.exit(0), 500).unref();\n  };\n  process.on('SIGTERM', () => void shutdown('SIGTERM'));\n  process.on('SIGINT', () => void shutdown('SIGINT'));\n}\n\n/** Spawn the daemon detached and wait until the control API responds. */\nasync function start(): Promise<void> {\n  const config = loadResolvedConfig();\n  const url = baseUrl(config);\n  const existing = readPid();\n  if (existing !== null && isProcessAlive(existing)) {\n    console.log(`toon-clientd already running (pid ${existing}) at ${url}`);\n    return;\n  }\n  const pid = spawnDaemonDetached();\n  const ok = await waitForReady(url, 20_000);\n  if (ok) {\n    console.log(`toon-clientd started (pid ${pid}) at ${url}`);\n  } else {\n    console.error(\n      `toon-clientd spawned (pid ${pid}) but did not become reachable at ${url} in time. ` +\n        `Check the daemon log.`\n    );\n    process.exitCode = 1;\n  }\n}\n\n/** Stop a running daemon via SIGTERM on the locked PID. */\nasync function stop(): Promise<void> {\n  const pid = readPid();\n  if (pid === null || !isProcessAlive(pid)) {\n    console.log('toon-clientd is not running');\n    releaseLock();\n    return;\n  }\n  process.kill(pid, 'SIGTERM');\n  // Wait briefly for the process to exit.\n  for (let i = 0; i < 40; i++) {\n    if (!isProcessAlive(pid)) break;\n    await new Promise((r) => setTimeout(r, 100));\n  }\n  console.log(`toon-clientd stopped (pid ${pid})`);\n}\n\n/** Print the daemon status JSON. */\nasync function status(): Promise<void> {\n  const config = loadResolvedConfig();\n  const client = new ControlClient({ baseUrl: baseUrl(config) });\n  try {\n    const s = await client.status();\n    console.log(JSON.stringify(s, null, 2));\n  } catch {\n    console.log(JSON.stringify({ running: false }, null, 2));\n    process.exitCode = 1;\n  }\n}\n\nasync function main(): Promise<void> {\n  const cmd = process.argv[2] ?? 'run';\n  switch (cmd) {\n    case 'run':\n      // First-run onboarding (#251): mint + persist an identity and scaffold\n      // the transport config so a fresh install starts with no manual setup.\n      await scaffoldFirstRun();\n      await runForeground();\n      break;\n    case 'start':\n      await scaffoldFirstRun();\n      await start();\n      break;\n    case 'stop':\n      await stop();\n      break;\n    case 'status':\n      await status();\n      break;\n    default:\n      console.error(\n        `Unknown command \"${cmd}\". Usage: toon-clientd <run|start|stop|status>`\n      );\n      process.exitCode = 1;\n  }\n}\n\nmain().catch((err) => {\n  console.error(\n    err instanceof Error ? (err.stack ?? err.message) : String(err)\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA,OAAO,aAAa;AAqBpB,SAAS,QAAQ,QAAsC;AACrD,SAAO,oBAAoB,OAAO,QAAQ;AAC5C;AAEA,SAAS,qBAA2C;AAClD,QAAM,OAAO,QAAQ,IAAI,oBAAoB,KAAK,kBAAkB;AACpE,SAAO,cAAc,eAAe,IAAI,CAAC;AAC3C;AAGA,eAAe,gBAA+B;AAC5C,cAAY;AACZ,QAAM,SAAS,mBAAmB;AAClC,QAAM,MAAM,CAAC,QAAsB,QAAQ,MAAM,GAAG;AAEpD,QAAM,SAAS,IAAI,aAAa;AAAA,IAC9B;AAAA,IACA,cAAc,CAAC,iBACb,IAAI,WAAW,YAAY;AAAA,IAC7B,QAAQ;AAAA,EACV,CAAC;AAED,QAAM,MAAM,QAAQ;AAAA,IAClB,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUR,kBAAkB;AAAA,EACpB,CAAC;AACD,iBAAe,KAAK,MAAM;AAI1B,SAAO,MAAM;AAEb,QAAM,IAAI,OAAO,EAAE,MAAM,aAAa,MAAM,OAAO,SAAS,CAAC;AAC7D,MAAI,+BAA+B,QAAQ,MAAM,CAAC,EAAE;AAEpD,MAAI,eAAe;AACnB,QAAM,WAAW,OAAO,WAAkC;AACxD,QAAI,aAAc;AAClB,mBAAe;AACf,QAAI,2BAA2B,MAAM,iBAAiB;AACtD,QAAI;AACF,YAAM,IAAI,MAAM;AAAA,IAClB,QAAQ;AAAA,IAER;AACA,UAAM,OAAO,KAAK;AAClB,gBAAY;AACZ,eAAW,MAAM,QAAQ,KAAK,CAAC,GAAG,GAAG,EAAE,MAAM;AAAA,EAC/C;AACA,UAAQ,GAAG,WAAW,MAAM,KAAK,SAAS,SAAS,CAAC;AACpD,UAAQ,GAAG,UAAU,MAAM,KAAK,SAAS,QAAQ,CAAC;AACpD;AAGA,eAAe,QAAuB;AACpC,QAAM,SAAS,mBAAmB;AAClC,QAAM,MAAM,QAAQ,MAAM;AAC1B,QAAM,WAAW,QAAQ;AACzB,MAAI,aAAa,QAAQ,eAAe,QAAQ,GAAG;AACjD,YAAQ,IAAI,qCAAqC,QAAQ,QAAQ,GAAG,EAAE;AACtE;AAAA,EACF;AACA,QAAM,MAAM,oBAAoB;AAChC,QAAM,KAAK,MAAM,aAAa,KAAK,GAAM;AACzC,MAAI,IAAI;AACN,YAAQ,IAAI,6BAA6B,GAAG,QAAQ,GAAG,EAAE;AAAA,EAC3D,OAAO;AACL,YAAQ;AAAA,MACN,6BAA6B,GAAG,qCAAqC,GAAG;AAAA,IAE1E;AACA,YAAQ,WAAW;AAAA,EACrB;AACF;AAGA,eAAe,OAAsB;AACnC,QAAM,MAAM,QAAQ;AACpB,MAAI,QAAQ,QAAQ,CAAC,eAAe,GAAG,GAAG;AACxC,YAAQ,IAAI,6BAA6B;AACzC,gBAAY;AACZ;AAAA,EACF;AACA,UAAQ,KAAK,KAAK,SAAS;AAE3B,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,QAAI,CAAC,eAAe,GAAG,EAAG;AAC1B,UAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC;AAAA,EAC7C;AACA,UAAQ,IAAI,6BAA6B,GAAG,GAAG;AACjD;AAGA,eAAe,SAAwB;AACrC,QAAM,SAAS,mBAAmB;AAClC,QAAM,SAAS,IAAI,cAAc,EAAE,SAAS,QAAQ,MAAM,EAAE,CAAC;AAC7D,MAAI;AACF,UAAM,IAAI,MAAM,OAAO,OAAO;AAC9B,YAAQ,IAAI,KAAK,UAAU,GAAG,MAAM,CAAC,CAAC;AAAA,EACxC,QAAQ;AACN,YAAQ,IAAI,KAAK,UAAU,EAAE,SAAS,MAAM,GAAG,MAAM,CAAC,CAAC;AACvD,YAAQ,WAAW;AAAA,EACrB;AACF;AAEA,eAAe,OAAsB;AACnC,QAAM,MAAM,QAAQ,KAAK,CAAC,KAAK;AAC/B,UAAQ,KAAK;AAAA,IACX,KAAK;AAGH,YAAM,iBAAiB;AACvB,YAAM,cAAc;AACpB;AAAA,IACF,KAAK;AACH,YAAM,iBAAiB;AACvB,YAAM,MAAM;AACZ;AAAA,IACF,KAAK;AACH,YAAM,KAAK;AACX;AAAA,IACF,KAAK;AACH,YAAM,OAAO;AACb;AAAA,IACF;AACE,cAAQ;AAAA,QACN,oBAAoB,GAAG;AAAA,MACzB;AACA,cAAQ,WAAW;AAAA,EACvB;AACF;AAEA,KAAK,EAAE,MAAM,CAAC,QAAQ;AACpB,UAAQ;AAAA,IACN,eAAe,QAAS,IAAI,SAAS,IAAI,UAAW,OAAO,GAAG;AAAA,EAChE;AACA,UAAQ,WAAW;AACrB,CAAC;","names":[]}

package/dist/{ed25519-VBPL32VX.js → ed25519-U6LNJH4K.js}

@@ -12,7 +12,8 @@ import {
   ristretto255_hasher,
   ristretto255_oprf,
   x25519
-} from "./chunk-LN2OF264.js";
+} from "./chunk-V7D5HJBT.js";
+import "./chunk-6GXZ4KRO.js";
 import "./chunk-I7TGLGN6.js";
 export {
   ED25519_TORSION_SUBGROUP,
@@ -28,4 +29,4 @@ export {
   ristretto255_oprf,
   x25519
 };
-//# sourceMappingURL=ed25519-VBPL32VX.js.map
+//# sourceMappingURL=ed25519-U6LNJH4K.js.map

package/dist/index.js

@@ -8,7 +8,7 @@ import {
   hasConfiguredIdentity,
   registerRoutes,
   scaffoldFirstRun
-} from "./chunk-WS3GVRQJ.js";
+} from "./chunk-TGIKIMXO.js";
 import {
   PUBLISH_TOOL,
   TOOL_DEFINITIONS,
@@ -18,7 +18,7 @@ import {
   buildFollowListFilter,
   buildProfileFilter,
   dispatchTool
-} from "./chunk-ZKSFO7M3.js";
+} from "./chunk-F3XAIOGQ.js";
 import {
   ControlApiError,
   ControlClient,
@@ -36,12 +36,14 @@ import {
   resolveMnemonic,
   spawnDaemonDetached,
   waitForReady
-} from "./chunk-UPIAVE44.js";
-import "./chunk-IAOKAQLA.js";
+} from "./chunk-JFDVE4IA.js";
+import "./chunk-FDUYHYB2.js";
 import "./chunk-HMD5EVQI.js";
+import "./chunk-IYPIOSEF.js";
 import "./chunk-T3WCTWRP.js";
 import "./chunk-3DDN4CJQ.js";
-import "./chunk-LN2OF264.js";
+import "./chunk-V7D5HJBT.js";
+import "./chunk-6GXZ4KRO.js";
 import "./chunk-NL7NYWPC.js";
 import "./chunk-I7TGLGN6.js";