@unicitylabs/sphere-sdk 0.14.0-dev.1 → 0.14.0-dev.2

package/dist/impl/wallet-api-v2/index.cjs

@@ -0,0 +1,4366 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod2) => __copyProps(__defProp({}, "__esModule", { value: true }), mod2);
+
+// impl/wallet-api-v2/index.ts
+var wallet_api_v2_exports = {};
+__export(wallet_api_v2_exports, {
+  DEFAULT_SESSION_TIMING: () => DEFAULT_SESSION_TIMING,
+  JwtGenerationCell: () => JwtGenerationCell,
+  WAKE_STREAMS: () => WAKE_STREAMS,
+  WalletApiDeliveryPort: () => WalletApiDeliveryPort,
+  WalletApiHttpError: () => WalletApiHttpError,
+  WalletApiSession: () => WalletApiSession,
+  WalletApiSplitCheckpointStore: () => WalletApiSplitCheckpointStore,
+  WalletApiStoragePort: () => WalletApiStoragePort,
+  WalletApiV2Client: () => WalletApiV2Client,
+  assertSecureBaseUrl: () => assertSecureBaseUrl,
+  createWalletApiHttp: () => createWalletApiHttp,
+  isWalletApiHttpError: () => isWalletApiHttpError,
+  refreshTokenKey: () => refreshTokenKey
+});
+module.exports = __toCommonJS(wallet_api_v2_exports);
+
+// impl/wallet-api-v2/http.ts
+var WalletApiHttpError = class extends Error {
+  status;
+  code;
+  /** Milliseconds, parsed from a Retry-After header when present. */
+  retryAfter;
+  constructor(status, code, message, retryAfter) {
+    super(message);
+    this.name = "WalletApiHttpError";
+    this.status = status;
+    this.code = code;
+    if (retryAfter !== void 0) this.retryAfter = retryAfter;
+  }
+};
+function isWalletApiHttpError(err, status) {
+  return err instanceof WalletApiHttpError && (status === void 0 || err.status === status);
+}
+function isLoopbackHost(hostname) {
+  return hostname === "localhost" || hostname.endsWith(".localhost") || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname) || hostname === "::1" || hostname === "[::1]";
+}
+function assertSecureBaseUrl(baseUrl) {
+  let url;
+  try {
+    url = new URL(baseUrl);
+  } catch {
+    throw new Error(`Invalid wallet-api base URL: ${baseUrl}`);
+  }
+  const httpLoopback = url.protocol === "http:" && isLoopbackHost(url.hostname);
+  if (url.protocol !== "https:" && !httpLoopback) {
+    throw new Error("wallet-api base URL must be https (plain http is allowed only on loopback)");
+  }
+  return url.toString().replace(/\/$/, "");
+}
+function parseRetryAfter(res) {
+  const raw = res.headers?.get("retry-after");
+  if (!raw) return void 0;
+  const seconds = Number(raw);
+  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+  const when = Date.parse(raw);
+  return Number.isNaN(when) ? void 0 : Math.max(0, when - Date.now());
+}
+async function readBodyText(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "";
+  }
+}
+async function toHttpError(res, what) {
+  let code = `HTTP_${res.status}`;
+  let message = `${what} failed with status ${res.status}`;
+  const text = await readBodyText(res);
+  if (text !== "") {
+    try {
+      const parsed = JSON.parse(text);
+      if (parsed?.error?.code) code = parsed.error.code;
+      if (parsed?.error?.message) message = `${what}: ${parsed.error.message}`;
+    } catch {
+    }
+  }
+  return new WalletApiHttpError(res.status, code, message, parseRetryAfter(res));
+}
+function parseJsonBody(text, what, status) {
+  if (text === "") return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new WalletApiHttpError(status, "PROTOCOL", `${what}: response is not JSON`);
+  }
+}
+function createWalletApiHttp(config) {
+  const baseUrl = assertSecureBaseUrl(config.baseUrl);
+  const { fetchFn, getToken } = config;
+  const fetchRaw = async (url, init) => {
+    try {
+      return await fetchFn(url, init);
+    } catch (err) {
+      throw new WalletApiHttpError(
+        0,
+        "NETWORK",
+        `wallet-api request failed: ${init.method} ${url}: ${String(err)}`
+      );
+    }
+  };
+  const request = async (method, path, body, opts) => {
+    const headers = {};
+    if (body !== void 0) headers["content-type"] = "application/json";
+    if (opts?.auth !== false) {
+      const token = getToken();
+      if (token !== null) headers["authorization"] = `Bearer ${token}`;
+    }
+    const res = await fetchRaw(`${baseUrl}${path}`, {
+      method,
+      headers,
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    });
+    const what = `${method} ${path}`;
+    if (res.status === 204) return null;
+    if (!res.ok) throw await toHttpError(res, what);
+    return parseJsonBody(await readBodyText(res), what, res.status);
+  };
+  return { baseUrl, request, fetchRaw };
+}
+
+// node_modules/@noble/hashes/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+function anumber(n, title = "") {
+  if (typeof n !== "number") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(`${prefix}expected number, got ${typeof n}`);
+  }
+  if (!Number.isSafeInteger(n) || n < 0) {
+    const prefix = title && `"${title}" `;
+    throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);
+  }
+}
+function abytes(value, length, title = "") {
+  const bytes = isBytes(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+    if (!bytes)
+      throw new TypeError(message);
+    throw new RangeError(message);
+  }
+  return value;
+}
+function ahash(h) {
+  if (typeof h !== "function" || typeof h.create !== "function")
+    throw new TypeError("Hash must wrapped by utils.createHasher");
+  anumber(h.outputLen);
+  anumber(h.blockLen);
+  if (h.outputLen < 1)
+    throw new Error('"outputLen" must be >= 1');
+  if (h.blockLen < 1)
+    throw new Error('"blockLen" must be >= 1');
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput(out, instance) {
+  abytes(out, void 0, "digestInto() output");
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new RangeError('"digestInto() output" expected to be of length >=' + min);
+  }
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+function rotr(word, shift) {
+  return word << 32 - shift | word >>> shift;
+}
+var hasHexBuiltin = /* @__PURE__ */ (() => (
+  // @ts-ignore
+  typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function"
+))();
+var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
+function bytesToHex(bytes) {
+  abytes(bytes);
+  if (hasHexBuiltin)
+    return bytes.toHex();
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) {
+    hex += hexes[bytes[i]];
+  }
+  return hex;
+}
+var asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
+function asciiToBase16(ch) {
+  if (ch >= asciis._0 && ch <= asciis._9)
+    return ch - asciis._0;
+  if (ch >= asciis.A && ch <= asciis.F)
+    return ch - (asciis.A - 10);
+  if (ch >= asciis.a && ch <= asciis.f)
+    return ch - (asciis.a - 10);
+  return;
+}
+function hexToBytes(hex) {
+  if (typeof hex !== "string")
+    throw new TypeError("hex string expected, got " + typeof hex);
+  if (hasHexBuiltin) {
+    try {
+      return Uint8Array.fromHex(hex);
+    } catch (error) {
+      if (error instanceof SyntaxError)
+        throw new RangeError(error.message);
+      throw error;
+    }
+  }
+  const hl = hex.length;
+  const al = hl / 2;
+  if (hl % 2)
+    throw new RangeError("hex string expected, got unpadded hex of length " + hl);
+  const array = new Uint8Array(al);
+  for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
+    const n1 = asciiToBase16(hex.charCodeAt(hi));
+    const n2 = asciiToBase16(hex.charCodeAt(hi + 1));
+    if (n1 === void 0 || n2 === void 0) {
+      const char = hex[hi] + hex[hi + 1];
+      throw new RangeError('hex string expected, got non-hex character "' + char + '" at index ' + hi);
+    }
+    array[ai] = n1 * 16 + n2;
+  }
+  return array;
+}
+function concatBytes(...arrays) {
+  let sum = 0;
+  for (let i = 0; i < arrays.length; i++) {
+    const a = arrays[i];
+    abytes(a);
+    sum += a.length;
+  }
+  const res = new Uint8Array(sum);
+  for (let i = 0, pad = 0; i < arrays.length; i++) {
+    const a = arrays[i];
+    res.set(a, pad);
+    pad += a.length;
+  }
+  return res;
+}
+function createHasher(hashCons, info = {}) {
+  const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+  const tmp = hashCons(void 0);
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.canXOF = tmp.canXOF;
+  hashC.create = (opts) => hashCons(opts);
+  Object.assign(hashC, info);
+  return Object.freeze(hashC);
+}
+function randomBytes(bytesLength = 32) {
+  anumber(bytesLength, "bytesLength");
+  const cr = typeof globalThis === "object" ? globalThis.crypto : null;
+  if (typeof cr?.getRandomValues !== "function")
+    throw new Error("crypto.getRandomValues must be defined");
+  if (bytesLength > 65536)
+    throw new RangeError(`"bytesLength" expected <= 65536, got ${bytesLength}`);
+  return cr.getRandomValues(new Uint8Array(bytesLength));
+}
+var oidNist = (suffix) => ({
+  // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+  // Larger suffix values would need base-128 OID encoding and a different length byte.
+  oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
+});
+
+// node_modules/@noble/hashes/_md.js
+function Chi(a, b, c) {
+  return a & b ^ ~a & c;
+}
+function Maj(a, b, c) {
+  return a & b ^ a & c ^ b & c;
+}
+var HashMD = class {
+  blockLen;
+  outputLen;
+  canXOF = false;
+  padOffset;
+  isLE;
+  // For partial updates less than block size
+  buffer;
+  view;
+  finished = false;
+  length = 0;
+  pos = 0;
+  destroyed = false;
+  constructor(blockLen, outputLen, padOffset, isLE2) {
+    this.blockLen = blockLen;
+    this.outputLen = outputLen;
+    this.padOffset = padOffset;
+    this.isLE = isLE2;
+    this.buffer = new Uint8Array(blockLen);
+    this.view = createView(this.buffer);
+  }
+  update(data) {
+    aexists(this);
+    abytes(data);
+    const { view, buffer, blockLen } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      if (take === blockLen) {
+        const dataView = createView(data);
+        for (; blockLen <= len - pos; pos += blockLen)
+          this.process(dataView, pos);
+        continue;
+      }
+      buffer.set(data.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(view, 0);
+        this.pos = 0;
+      }
+    }
+    this.length += data.length;
+    this.roundClean();
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const { buffer, view, blockLen, isLE: isLE2 } = this;
+    let { pos } = this;
+    buffer[pos++] = 128;
+    clean(this.buffer.subarray(pos));
+    if (this.padOffset > blockLen - pos) {
+      this.process(view, 0);
+      pos = 0;
+    }
+    for (let i = pos; i < blockLen; i++)
+      buffer[i] = 0;
+    view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE2);
+    this.process(view, 0);
+    const oview = createView(out);
+    const len = this.outputLen;
+    if (len % 4)
+      throw new Error("_sha2: outputLen must be aligned to 32bit");
+    const outLen = len / 4;
+    const state = this.get();
+    if (outLen > state.length)
+      throw new Error("_sha2: outputLen bigger than state");
+    for (let i = 0; i < outLen; i++)
+      oview.setUint32(4 * i, state[i], isLE2);
+  }
+  digest() {
+    const { buffer, outputLen } = this;
+    this.digestInto(buffer);
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res;
+  }
+  _cloneInto(to) {
+    to ||= new this.constructor();
+    to.set(...this.get());
+    const { blockLen, buffer, length, finished, destroyed, pos } = this;
+    to.destroyed = destroyed;
+    to.finished = finished;
+    to.length = length;
+    to.pos = pos;
+    if (length % blockLen)
+      to.buffer.set(buffer);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+};
+var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+
+// node_modules/@noble/hashes/sha2.js
+var SHA256_K = /* @__PURE__ */ Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+var SHA2_32B = class extends HashMD {
+  constructor(outputLen) {
+    super(64, outputLen, 8, false);
+  }
+  get() {
+    const { A, B, C, D, E, F, G, H } = this;
+    return [A, B, C, D, E, F, G, H];
+  }
+  // prettier-ignore
+  set(A, B, C, D, E, F, G, H) {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D | 0;
+    this.E = E | 0;
+    this.F = F | 0;
+    this.G = G | 0;
+    this.H = H | 0;
+  }
+  process(view, offset) {
+    for (let i = 0; i < 16; i++, offset += 4)
+      SHA256_W[i] = view.getUint32(offset, false);
+    for (let i = 16; i < 64; i++) {
+      const W15 = SHA256_W[i - 15];
+      const W2 = SHA256_W[i - 2];
+      const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+      const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
+      SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
+    }
+    let { A, B, C, D, E, F, G, H } = this;
+    for (let i = 0; i < 64; i++) {
+      const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+      const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
+      const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
+      const T2 = sigma0 + Maj(A, B, C) | 0;
+      H = G;
+      G = F;
+      F = E;
+      E = D + T1 | 0;
+      D = C;
+      C = B;
+      B = A;
+      A = T1 + T2 | 0;
+    }
+    A = A + this.A | 0;
+    B = B + this.B | 0;
+    C = C + this.C | 0;
+    D = D + this.D | 0;
+    E = E + this.E | 0;
+    F = F + this.F | 0;
+    G = G + this.G | 0;
+    H = H + this.H | 0;
+    this.set(A, B, C, D, E, F, G, H);
+  }
+  roundClean() {
+    clean(SHA256_W);
+  }
+  destroy() {
+    this.destroyed = true;
+    this.set(0, 0, 0, 0, 0, 0, 0, 0);
+    clean(this.buffer);
+  }
+};
+var _SHA256 = class extends SHA2_32B {
+  // We cannot use array here since array allows indexing by variable
+  // which means optimizer/compiler cannot use registers.
+  A = SHA256_IV[0] | 0;
+  B = SHA256_IV[1] | 0;
+  C = SHA256_IV[2] | 0;
+  D = SHA256_IV[3] | 0;
+  E = SHA256_IV[4] | 0;
+  F = SHA256_IV[5] | 0;
+  G = SHA256_IV[6] | 0;
+  H = SHA256_IV[7] | 0;
+  constructor() {
+    super(32);
+  }
+};
+var sha256 = /* @__PURE__ */ createHasher(
+  () => new _SHA256(),
+  /* @__PURE__ */ oidNist(1)
+);
+
+// impl/wallet-api-v2/client.ts
+function bytesToBase64(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
+}
+var WalletApiV2Client = class {
+  constructor(http) {
+    this.http = http;
+  }
+  get baseUrl() {
+    return this.http.baseUrl;
+  }
+  // ── auth ─────────────────────────────────────────────────────────────────
+  authChallenge(pubkey) {
+    return this.http.request("POST", "/v1/auth/challenge", { pubkey }, { auth: false });
+  }
+  authVerify(input) {
+    return this.http.request("POST", "/v1/auth/verify", input, { auth: false });
+  }
+  authRefresh(refreshToken) {
+    return this.http.request("POST", "/v1/auth/refresh", { refreshToken }, { auth: false });
+  }
+  async authLogout() {
+    await this.http.request("POST", "/v1/auth/logout", {});
+  }
+  // ── inventory / blobs ────────────────────────────────────────────────────
+  listInventory(since) {
+    const query = since !== void 0 ? `?since=${since}` : "";
+    return this.http.request("GET", `/v1/inventory${query}`);
+  }
+  async balances() {
+    const body = await this.http.request("GET", "/v1/balances");
+    return body.balances;
+  }
+  async blobUrls(tokenIds) {
+    const body = await this.http.request("POST", "/v1/tokens/blob-urls", { tokenIds });
+    return body.urls;
+  }
+  async uploadUrls(blobs) {
+    const body = await this.http.request("POST", "/v1/tokens/upload-urls", { blobs });
+    return body.urls;
+  }
+  apply(delta) {
+    return this.http.request("POST", "/v1/inventory/apply", delta);
+  }
+  async fetchBlob(getUrl) {
+    const res = await this.http.fetchRaw(getUrl, { method: "GET" });
+    if (!res.ok) {
+      throw new WalletApiHttpError(res.status, "BLOB_DOWNLOAD", `blob download failed with status ${res.status}`);
+    }
+    return new Uint8Array(await res.arrayBuffer());
+  }
+  /**
+   * PUT to a presigned S3 URL. `x-amz-checksum-sha256` (base64) and
+   * `If-None-Match: *` are SIGNED headers — sent verbatim. S3 412 = the
+   * identical blob already exists = success.
+   */
+  async uploadBlob(putUrl, bytes) {
+    const res = await this.http.fetchRaw(putUrl, {
+      method: "PUT",
+      headers: {
+        "content-type": "application/octet-stream",
+        "x-amz-checksum-sha256": bytesToBase64(sha256(bytes)),
+        "if-none-match": "*"
+      },
+      body: bytes
+    });
+    if (res.ok || res.status === 412) return;
+    throw new WalletApiHttpError(res.status, "BLOB_UPLOAD", `blob upload failed with status ${res.status}`);
+  }
+  // ── intents ──────────────────────────────────────────────────────────────
+  async putIntent(transferId, payloadEnvelope, requiresSeedClose = false) {
+    const body = requiresSeedClose ? { payload: payloadEnvelope, requiresSeedClose: true } : { payload: payloadEnvelope };
+    await this.http.request("PUT", `/v1/intents/${transferId}`, body);
+  }
+  async listIntents(status = "open") {
+    const body = await this.http.request("GET", `/v1/intents?status=${status}`);
+    return body.intents;
+  }
+  async abortIntent(transferId) {
+    await this.http.request("POST", `/v1/intents/${transferId}/abort`);
+  }
+  async completeIntent(transferId, signature) {
+    await this.http.request(
+      "POST",
+      `/v1/intents/${transferId}/complete`,
+      signature !== void 0 ? { signature } : void 0
+    );
+  }
+  async postProgress(transferId, opIndex, payloadEnvelope, signature) {
+    const body = await this.http.request("POST", `/v1/intents/${transferId}/progress`, {
+      opIndex,
+      payload: payloadEnvelope,
+      signature
+    });
+    return body.record;
+  }
+  async getProgress(transferId) {
+    const body = await this.http.request("GET", `/v1/intents/${transferId}/progress`);
+    return body.records;
+  }
+  // ── mailbox ──────────────────────────────────────────────────────────────
+  async deposit(entry) {
+    const body = await this.http.request("POST", "/v1/mailbox", entry);
+    return body.entryId;
+  }
+  async depositBatch(entries) {
+    const body = await this.http.request("POST", "/v1/mailbox/batch", { entries });
+    return body.entries;
+  }
+  listMailbox(since) {
+    const query = since !== void 0 ? `?since=${since}` : "";
+    return this.http.request("GET", `/v1/mailbox${query}`);
+  }
+  claim(entryIds, intoInventory) {
+    return this.http.request("POST", "/v1/mailbox/claim", { entryIds, intoInventory });
+  }
+  async reject(entryIds, reason, detail) {
+    const body = await this.http.request("POST", "/v1/mailbox/reject", {
+      entryIds,
+      ...reason !== void 0 ? { reason } : {},
+      ...detail !== void 0 ? { detail } : {}
+    });
+    return body.rejected;
+  }
+  // ── history ──────────────────────────────────────────────────────────────
+  async postHistory(records) {
+    return await this.http.request("POST", "/v1/history", { records });
+  }
+  listHistory(options = {}) {
+    const params = new URLSearchParams();
+    if (options.before !== void 0) params.set("before", options.before);
+    if (options.limit !== void 0) params.set("limit", String(options.limit));
+    const qs = params.toString();
+    return this.http.request("GET", `/v1/history${qs ? `?${qs}` : ""}`);
+  }
+  // ── payment requests ─────────────────────────────────────────────────────
+  createPaymentRequest(input) {
+    return this.http.request("POST", "/v1/payment-requests", input);
+  }
+  listPaymentRequests(params) {
+    const query = new URLSearchParams();
+    query.set("role", params.role);
+    if (params.status !== void 0) query.set("status", params.status);
+    if (params.role === "incoming") {
+      if (params.since !== void 0) query.set("since", String(params.since));
+    } else if (params.before !== void 0) {
+      query.set("before", params.before);
+    }
+    return this.http.request("GET", `/v1/payment-requests?${query.toString()}`);
+  }
+  respondPaymentRequest(id, response) {
+    return this.http.request("POST", `/v1/payment-requests/${id}/respond`, response);
+  }
+  // ── realtime ─────────────────────────────────────────────────────────────
+  async wsTicket() {
+    const body = await this.http.request("POST", "/v1/ws-ticket");
+    return body.ticket;
+  }
+};
+
+// modules/payments-v2/stores.ts
+var STORE_KEYS = {
+  intentBackstop: "intents",
+  checkpointCache: "checkpoints",
+  deliveryJournal: "delivery-journal",
+  mintJournal: "mint-journal",
+  shortfalls: "shortfalls",
+  settlingLinks: "settling",
+  streamCursor: (s) => `cursor:${s}`,
+  epochLatch: "epoch-latch"
+};
+
+// impl/wallet-api-v2/session.ts
+var AUTH_CHALLENGE_PREFIX = "unicity:wallet-api:auth:v1\n";
+var MAX_CHALLENGE_WINDOW_MS = 60 * 60 * 1e3;
+var ChallengeTemplateError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ChallengeTemplateError";
+  }
+};
+function parseChallengeFields(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    throw new ChallengeTemplateError("challenge body is not the single-line JSON object the backend emits");
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new ChallengeTemplateError("challenge body must be a JSON object");
+  }
+  const fields = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    if (typeof value !== "string" || value === "") {
+      throw new ChallengeTemplateError(`challenge field "${key}" must be a non-empty string`);
+    }
+    fields[key] = value;
+  }
+  return fields;
+}
+function requireChallengeField(fields, key) {
+  const value = fields[key];
+  if (value === void 0) throw new ChallengeTemplateError(`challenge is missing the "${key}" field`);
+  return value;
+}
+function verifyChallengeTemplate(challenge, expect) {
+  if (!challenge.startsWith(AUTH_CHALLENGE_PREFIX)) {
+    throw new ChallengeTemplateError("challenge does not start with the unicity:wallet-api:auth:v1 prefix");
+  }
+  const fields = parseChallengeFields(challenge.slice(AUTH_CHALLENGE_PREFIX.length));
+  if (requireChallengeField(fields, "pubkey").toLowerCase() !== expect.pubkey.toLowerCase()) {
+    throw new ChallengeTemplateError("challenge embeds a different pubkey than this wallet");
+  }
+  if (requireChallengeField(fields, "nonce") !== expect.nonce) {
+    throw new ChallengeTemplateError("challenge nonce does not echo the nonce issued with it");
+  }
+  if (requireChallengeField(fields, "network") !== expect.network) {
+    throw new ChallengeTemplateError("challenge is for a different network than this session");
+  }
+  const issuedAt = Date.parse(requireChallengeField(fields, "issuedAt"));
+  const expiresAt = Date.parse(requireChallengeField(fields, "expiresAt"));
+  if (Number.isNaN(issuedAt) || Number.isNaN(expiresAt)) {
+    throw new ChallengeTemplateError("challenge timestamps are not parseable");
+  }
+  if (expiresAt <= issuedAt || expiresAt - issuedAt > MAX_CHALLENGE_WINDOW_MS) {
+    throw new ChallengeTemplateError("challenge validity window is implausible");
+  }
+}
+var JwtGenerationCell = class {
+  gen = 0;
+  jwt = null;
+  get generation() {
+    return this.gen;
+  }
+  token() {
+    return this.jwt;
+  }
+  install(generation, jwt) {
+    if (generation !== this.gen) return false;
+    this.jwt = jwt;
+    return true;
+  }
+  /** authGone(G) is a no-op when the cell moved to G+1 (F14). */
+  clearIfCurrent(generation) {
+    if (generation !== this.gen || this.jwt === null) return false;
+    this.jwt = null;
+    return true;
+  }
+  dropIfMatches(generation, jwt) {
+    if (generation === this.gen && this.jwt === jwt) this.jwt = null;
+  }
+  bump() {
+    this.gen += 1;
+    this.jwt = null;
+    return this.gen;
+  }
+};
+var WAKE_STREAMS = ["inventory", "mailbox", "payment_requests"];
+var DEFAULT_SESSION_TIMING = {
+  pullIntervalMs: 3e4,
+  reconnectBaseMs: 1e3,
+  reconnectCapMs: 3e4,
+  heartbeatTimeoutMs: 12e4,
+  offlineAfterFailures: 3
+};
+function refreshTokenKey(deviceId) {
+  return `auth:refresh:${deviceId}`;
+}
+var WS_CLOSE_AUTH_GONE = 4401;
+function parseWakeFrame(data) {
+  if (typeof data !== "string") return null;
+  let json;
+  try {
+    json = JSON.parse(data);
+  } catch {
+    return null;
+  }
+  const frame = json;
+  if (frame.type !== "wake") return null;
+  if (!WAKE_STREAMS.includes(frame.stream)) return null;
+  if (typeof frame.syncEpoch !== "number" && typeof frame.syncEpoch !== "string") return null;
+  return { stream: frame.stream, syncEpoch: String(frame.syncEpoch) };
+}
+var GLOBAL_TIMERS = {
+  setTimeout: (cb, ms) => setTimeout(cb, ms),
+  clearTimeout: (h) => clearTimeout(h),
+  setInterval: (cb, ms) => setInterval(cb, ms),
+  clearInterval: (h) => clearInterval(h)
+};
+var WalletApiSession = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.timing = { ...DEFAULT_SESSION_TIMING, ...deps.timing };
+    this.timers = deps.timers ?? GLOBAL_TIMERS;
+    this.random = deps.random ?? Math.random;
+    this.refreshKey = refreshTokenKey(deps.deviceId);
+  }
+  timing;
+  timers;
+  random;
+  refreshKey;
+  authFlight = null;
+  epochLatch = null;
+  reseedChain = Promise.resolve();
+  reseedsPending = 0;
+  handlers = /* @__PURE__ */ new Map();
+  socket = null;
+  started = false;
+  stopped = false;
+  reconnectAttempts = 0;
+  reconnectTimer = null;
+  heartbeatTimer = null;
+  pullTimers = [];
+  lastStatus = null;
+  // ── lifecycle ─────────────────────────────────────────────────────────────
+  async start() {
+    if (this.started) return;
+    this.started = true;
+    this.epochLatch = await this.deps.kv.get(STORE_KEYS.epochLatch);
+    this.startPullTimers();
+    void this.connect();
+  }
+  async stop() {
+    this.stopped = true;
+    for (const t of this.pullTimers) this.timers.clearInterval(t);
+    this.pullTimers = [];
+    if (this.reconnectTimer !== null) this.timers.clearTimeout(this.reconnectTimer);
+    this.reconnectTimer = null;
+    this.clearHeartbeat();
+    const ws = this.socket;
+    this.socket = null;
+    ws?.close();
+    await this.reseedChain;
+  }
+  // ── auth cell (F8/F14) ────────────────────────────────────────────────────
+  token() {
+    return this.deps.cell.token();
+  }
+  /** Identity switch / lock / logout: supersede every in-flight auth continuation. */
+  invalidate() {
+    this.deps.cell.bump();
+    this.authFlight = null;
+  }
+  async ensureAuthenticated() {
+    const existing = this.deps.cell.token();
+    if (existing !== null) return existing;
+    await this.runAuthSingleFlight();
+    const fresh = this.deps.cell.token();
+    if (fresh === null) {
+      throw new WalletApiHttpError(401, "AUTH_SUPERSEDED", "authentication superseded before completion");
+    }
+    return fresh;
+  }
+  /** Run an authenticated op; one 401 → single-flight re-auth → one retry. */
+  async withAuth(op) {
+    const jwt = await this.ensureAuthenticated();
+    const generation = this.deps.cell.generation;
+    try {
+      return await op(jwt);
+    } catch (err) {
+      if (!(err instanceof WalletApiHttpError && err.status === 401)) throw err;
+      this.deps.cell.dropIfMatches(generation, jwt);
+      return op(await this.ensureAuthenticated());
+    }
+  }
+  runAuthSingleFlight() {
+    if (this.authFlight !== null) return this.authFlight;
+    const generation = this.deps.cell.generation;
+    const flight = this.authenticate(generation).finally(() => {
+      if (this.authFlight === flight) this.authFlight = null;
+    });
+    this.authFlight = flight;
+    return flight;
+  }
+  async authenticate(generation) {
+    if (await this.tryRefresh(generation)) return;
+    if (this.deps.cell.generation !== generation) return;
+    await this.challengeSignIn(generation);
+  }
+  async tryRefresh(generation) {
+    const stored = await this.deps.kv.get(this.refreshKey);
+    if (stored === null) return false;
+    let tokens;
+    try {
+      tokens = await this.deps.client.authRefresh(stored);
+    } catch (err) {
+      if (err instanceof WalletApiHttpError && err.status >= 400 && err.status < 500) {
+        if (this.deps.cell.generation === generation) await this.deps.kv.remove(this.refreshKey);
+        return false;
+      }
+      throw err;
+    }
+    if (!this.deps.cell.install(generation, tokens.jwt)) return true;
+    await this.deps.kv.set(this.refreshKey, tokens.refreshToken);
+    return true;
+  }
+  async challengeSignIn(generation) {
+    const { pubkey, network } = this.deps.signer;
+    const { nonce, challenge } = await this.deps.client.authChallenge(pubkey);
+    verifyChallengeTemplate(challenge, { pubkey, nonce, network });
+    const signature = await this.deps.signer.sign(challenge);
+    const tokens = await this.deps.client.authVerify({ nonce, signature, deviceId: this.deps.deviceId });
+    if (!this.deps.cell.install(generation, tokens.jwt)) return;
+    await this.deps.kv.set(this.refreshKey, tokens.refreshToken);
+  }
+  // ── epoch latch (F12) ─────────────────────────────────────────────────────
+  noteEpoch(epoch) {
+    if (this.epochLatch === epoch) return;
+    const previous = this.epochLatch;
+    this.epochLatch = epoch;
+    if (previous === null) {
+      void this.deps.kv.set(STORE_KEYS.epochLatch, epoch).catch(() => void 0);
+      return;
+    }
+    this.reseedsPending += 1;
+    this.reseedChain = this.reseedChain.then(() => this.runReseed(epoch, previous));
+  }
+  async runReseed(epoch, previous) {
+    try {
+      await this.deps.onEpochChange(epoch);
+      await this.deps.kv.set(STORE_KEYS.epochLatch, epoch);
+    } catch {
+      if (this.epochLatch === epoch) this.epochLatch = previous;
+    } finally {
+      this.reseedsPending -= 1;
+      if (this.reseedsPending === 0) this.nudgeAllStreams();
+    }
+  }
+  // ── streams ───────────────────────────────────────────────────────────────
+  subscribeStream(stream, handler) {
+    let set = this.handlers.get(stream);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      this.handlers.set(stream, set);
+    }
+    set.add(handler);
+    return () => set.delete(handler);
+  }
+  dispatch(stream) {
+    if (this.reseedsPending > 0) return;
+    const set = this.handlers.get(stream);
+    if (!set) return;
+    for (const handler of set) handler();
+  }
+  nudgeAllStreams() {
+    for (const stream of WAKE_STREAMS) this.dispatch(stream);
+  }
+  startPullTimers() {
+    for (const stream of WAKE_STREAMS) {
+      this.pullTimers.push(this.timers.setInterval(() => this.dispatch(stream), this.timing.pullIntervalMs));
+    }
+  }
+  // ── wake socket ───────────────────────────────────────────────────────────
+  status() {
+    return this.lastStatus ?? "offline";
+  }
+  emitStatus(status) {
+    if (this.stopped || this.lastStatus === status) return;
+    this.lastStatus = status;
+    this.deps.emitStatus(status);
+  }
+  async connect() {
+    if (this.stopped) return;
+    try {
+      const ticket = await this.withAuth(() => this.deps.client.wsTicket());
+      if (this.stopped) return;
+      this.openSocket(ticket, this.deps.cell.generation);
+    } catch {
+      this.scheduleReconnect();
+    }
+  }
+  openSocket(ticket, generation) {
+    const wsBase = this.deps.client.baseUrl.replace(/^http/, "ws");
+    const ws = this.deps.webSocketFactory(`${wsBase}/v1/ws?ticket=${encodeURIComponent(ticket)}`);
+    this.socket = ws;
+    ws.onopen = () => this.handleOpen(ws);
+    ws.onmessage = (ev) => this.handleMessage(ws, ev.data);
+    ws.onclose = (ev) => this.handleClose(ws, generation, ev?.code);
+    ws.onerror = () => void 0;
+  }
+  handleOpen(ws) {
+    if (ws !== this.socket) return;
+    this.reconnectAttempts = 0;
+    this.emitStatus("connected");
+    this.armHeartbeat(ws);
+    this.nudgeAllStreams();
+  }
+  handleMessage(ws, data) {
+    if (ws !== this.socket) return;
+    this.armHeartbeat(ws);
+    const frame = parseWakeFrame(data);
+    if (frame === null) return;
+    this.noteEpoch(frame.syncEpoch);
+    this.dispatch(frame.stream);
+  }
+  handleClose(ws, generation, code) {
+    if (ws !== this.socket) return;
+    this.socket = null;
+    this.clearHeartbeat();
+    if (this.stopped) return;
+    if (code === WS_CLOSE_AUTH_GONE) {
+      this.deps.cell.clearIfCurrent(generation);
+      this.emitStatus("degraded");
+      void this.connect();
+      return;
+    }
+    this.scheduleReconnect();
+  }
+  scheduleReconnect() {
+    if (this.stopped) return;
+    this.reconnectAttempts += 1;
+    this.emitStatus(this.reconnectAttempts >= this.timing.offlineAfterFailures ? "offline" : "degraded");
+    const capped = Math.min(
+      this.timing.reconnectCapMs,
+      this.timing.reconnectBaseMs * 2 ** (this.reconnectAttempts - 1)
+    );
+    const delay = Math.floor(this.random() * capped);
+    this.reconnectTimer = this.timers.setTimeout(() => void this.connect(), delay);
+  }
+  armHeartbeat(ws) {
+    this.clearHeartbeat();
+    this.heartbeatTimer = this.timers.setTimeout(() => {
+      if (ws === this.socket) ws.close();
+    }, this.timing.heartbeatTimeoutMs);
+  }
+  clearHeartbeat() {
+    if (this.heartbeatTimer !== null) this.timers.clearTimeout(this.heartbeatTimer);
+    this.heartbeatTimer = null;
+  }
+};
+
+// impl/wallet-api-v2/storage.ts
+var WALLET_API_V2_FANOUT_WIDTH = 8;
+var DeltaConflictError = class extends Error {
+  constructor(message, cause) {
+    super(message);
+    this.cause = cause;
+    this.name = "DeltaConflictError";
+  }
+  code = "DELTA_CONFLICT";
+};
+var DeltaValidationError = class extends Error {
+  constructor(message, cause) {
+    super(message);
+    this.cause = cause;
+    this.name = "DeltaValidationError";
+  }
+  code = "DELTA_VALIDATION";
+};
+var StoragePortProtocolError = class extends Error {
+  code = "PROTOCOL";
+  constructor(message) {
+    super(message);
+    this.name = "StoragePortProtocolError";
+  }
+};
+async function mapBounded(items, width, fn) {
+  const out = new Array(items.length);
+  let next = 0;
+  let failed = false;
+  const worker = async () => {
+    for (; ; ) {
+      if (failed) return;
+      const index = next;
+      next += 1;
+      if (index >= items.length) return;
+      try {
+        out[index] = await fn(items[index], index);
+      } catch (err) {
+        failed = true;
+        throw err;
+      }
+    }
+  };
+  const workers = Array.from({ length: Math.max(1, Math.min(width, items.length)) }, worker);
+  await Promise.all(workers);
+  return out;
+}
+var WalletApiStoragePort = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async listInventory(since) {
+    const page = await this.client.listInventory(since);
+    return {
+      cursor: page.cursor,
+      syncEpoch: String(page.syncEpoch),
+      more: page.more,
+      items: page.items
+    };
+  }
+  balances() {
+    return this.client.balances();
+  }
+  async getBlobs(tokenIds) {
+    if (tokenIds.length === 0) return /* @__PURE__ */ new Map();
+    const urls = await this.client.blobUrls(tokenIds);
+    const bytes = await mapBounded(urls, WALLET_API_V2_FANOUT_WIDTH, (u) => this.client.fetchBlob(u.getUrl));
+    const result = /* @__PURE__ */ new Map();
+    for (const [i, url] of urls.entries()) {
+      const blob = bytes[i];
+      if (blob !== void 0) result.set(url.tokenId, blob);
+    }
+    return result;
+  }
+  async uploadBlobs(blobs) {
+    if (blobs.length === 0) return /* @__PURE__ */ new Map();
+    const urls = await this.client.uploadUrls(blobs.map((b) => ({ sha256: b.sha256, size: b.bytes.length })));
+    const urlBySha = new Map(urls.map((u) => [u.sha256, u]));
+    const uploads = blobs.map((blob) => {
+      const url = urlBySha.get(blob.sha256);
+      if (url === void 0) {
+        throw new StoragePortProtocolError(`upload-urls response missing sha256 ${blob.sha256}`);
+      }
+      return { blob, url };
+    });
+    await mapBounded(
+      uploads,
+      WALLET_API_V2_FANOUT_WIDTH,
+      ({ blob, url }) => this.client.uploadBlob(url.putUrl, blob.bytes)
+    );
+    return new Map(uploads.map(({ blob, url }) => [blob.sha256, url.key]));
+  }
+  async applyDelta(delta) {
+    try {
+      const result = await this.client.apply(delta);
+      return { cursor: result.cursor, syncEpoch: String(result.syncEpoch) };
+    } catch (err) {
+      if (isWalletApiHttpError(err, 409)) throw new DeltaConflictError(err.message, err);
+      if (isWalletApiHttpError(err, 422)) throw new DeltaValidationError(err.message, err);
+      throw err;
+    }
+  }
+};
+
+// node_modules/@noble/hashes/hmac.js
+var _HMAC = class {
+  oHash;
+  iHash;
+  blockLen;
+  outputLen;
+  canXOF = false;
+  finished = false;
+  destroyed = false;
+  constructor(hash, key) {
+    ahash(hash);
+    abytes(key, void 0, "key");
+    this.iHash = hash.create();
+    if (typeof this.iHash.update !== "function")
+      throw new Error("Expected instance of class which extends utils.Hash");
+    this.blockLen = this.iHash.blockLen;
+    this.outputLen = this.iHash.outputLen;
+    const blockLen = this.blockLen;
+    const pad = new Uint8Array(blockLen);
+    pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+    for (let i = 0; i < pad.length; i++)
+      pad[i] ^= 54;
+    this.iHash.update(pad);
+    this.oHash = hash.create();
+    for (let i = 0; i < pad.length; i++)
+      pad[i] ^= 54 ^ 92;
+    this.oHash.update(pad);
+    clean(pad);
+  }
+  update(buf) {
+    aexists(this);
+    this.iHash.update(buf);
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const buf = out.subarray(0, this.outputLen);
+    this.iHash.digestInto(buf);
+    this.oHash.update(buf);
+    this.oHash.digestInto(buf);
+    this.destroy();
+  }
+  digest() {
+    const out = new Uint8Array(this.oHash.outputLen);
+    this.digestInto(out);
+    return out;
+  }
+  _cloneInto(to) {
+    to ||= Object.create(Object.getPrototypeOf(this), {});
+    const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+    to = to;
+    to.finished = finished;
+    to.destroyed = destroyed;
+    to.blockLen = blockLen;
+    to.outputLen = outputLen;
+    to.oHash = oHash._cloneInto(to.oHash);
+    to.iHash = iHash._cloneInto(to.iHash);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  destroy() {
+    this.destroyed = true;
+    this.oHash.destroy();
+    this.iHash.destroy();
+  }
+};
+var hmac = /* @__PURE__ */ (() => {
+  const hmac_ = ((hash, key, message) => new _HMAC(hash, key).update(message).digest());
+  hmac_.create = (hash, key) => new _HMAC(hash, key);
+  return hmac_;
+})();
+
+// node_modules/@noble/hashes/hkdf.js
+function extract(hash, ikm, salt) {
+  ahash(hash);
+  if (salt === void 0)
+    salt = new Uint8Array(hash.outputLen);
+  return hmac(hash, salt, ikm);
+}
+var HKDF_COUNTER = /* @__PURE__ */ Uint8Array.of(0);
+var EMPTY_BUFFER = /* @__PURE__ */ Uint8Array.of();
+function expand(hash, prk, info, length = 32) {
+  ahash(hash);
+  anumber(length, "length");
+  abytes(prk, void 0, "prk");
+  const olen = hash.outputLen;
+  if (prk.length < olen)
+    throw new Error('"prk" must be at least HashLen octets');
+  if (length > 255 * olen)
+    throw new Error("Length must be <= 255*HashLen");
+  const blocks = Math.ceil(length / olen);
+  if (info === void 0)
+    info = EMPTY_BUFFER;
+  else
+    abytes(info, void 0, "info");
+  const okm = new Uint8Array(blocks * olen);
+  const HMAC = hmac.create(hash, prk);
+  const HMACTmp = HMAC._cloneInto();
+  const T = new Uint8Array(HMAC.outputLen);
+  for (let counter = 0; counter < blocks; counter++) {
+    HKDF_COUNTER[0] = counter + 1;
+    HMACTmp.update(counter === 0 ? EMPTY_BUFFER : T).update(info).update(HKDF_COUNTER).digestInto(T);
+    okm.set(T, olen * counter);
+    HMAC._cloneInto(HMACTmp);
+  }
+  HMAC.destroy();
+  HMACTmp.destroy();
+  clean(T, HKDF_COUNTER);
+  return okm.slice(0, length);
+}
+var hkdf = (hash, ikm, salt, info, length) => expand(hash, extract(hash, ikm, salt), info, length);
+
+// node_modules/@noble/curves/utils.js
+var abytes2 = (value, length, title) => abytes(value, length, title);
+var anumber2 = anumber;
+var bytesToHex2 = bytesToHex;
+var concatBytes2 = (...arrays) => concatBytes(...arrays);
+var hexToBytes2 = (hex) => hexToBytes(hex);
+var isBytes2 = isBytes;
+var randomBytes2 = (bytesLength) => randomBytes(bytesLength);
+var _0n = /* @__PURE__ */ BigInt(0);
+var _1n = /* @__PURE__ */ BigInt(1);
+function abool(value, title = "") {
+  if (typeof value !== "boolean") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(prefix + "expected boolean, got type=" + typeof value);
+  }
+  return value;
+}
+function abignumber(n) {
+  if (typeof n === "bigint") {
+    if (!isPosBig(n))
+      throw new RangeError("positive bigint expected, got " + n);
+  } else
+    anumber2(n);
+  return n;
+}
+function asafenumber(value, title = "") {
+  if (typeof value !== "number") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(prefix + "expected number, got type=" + typeof value);
+  }
+  if (!Number.isSafeInteger(value)) {
+    const prefix = title && `"${title}" `;
+    throw new RangeError(prefix + "expected safe integer, got " + value);
+  }
+}
+function numberToHexUnpadded(num) {
+  const hex = abignumber(num).toString(16);
+  return hex.length & 1 ? "0" + hex : hex;
+}
+function hexToNumber(hex) {
+  if (typeof hex !== "string")
+    throw new TypeError("hex string expected, got " + typeof hex);
+  return hex === "" ? _0n : BigInt("0x" + hex);
+}
+function bytesToNumberBE(bytes) {
+  return hexToNumber(bytesToHex(bytes));
+}
+function bytesToNumberLE(bytes) {
+  return hexToNumber(bytesToHex(copyBytes(abytes(bytes)).reverse()));
+}
+function numberToBytesBE(n, len) {
+  anumber(len);
+  if (len === 0)
+    throw new RangeError("zero length");
+  n = abignumber(n);
+  const hex = n.toString(16);
+  if (hex.length > len * 2)
+    throw new RangeError("number too large");
+  return hexToBytes(hex.padStart(len * 2, "0"));
+}
+function numberToBytesLE(n, len) {
+  return numberToBytesBE(n, len).reverse();
+}
+function copyBytes(bytes) {
+  return Uint8Array.from(abytes2(bytes));
+}
+var isPosBig = (n) => typeof n === "bigint" && _0n <= n;
+function inRange(n, min, max) {
+  return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;
+}
+function aInRange(title, n, min, max) {
+  if (!inRange(n, min, max))
+    throw new RangeError("expected valid " + title + ": " + min + " <= n < " + max + ", got " + n);
+}
+function bitLen(n) {
+  if (n < _0n)
+    throw new Error("expected non-negative bigint, got " + n);
+  let len;
+  for (len = 0; n > _0n; n >>= _1n, len += 1)
+    ;
+  return len;
+}
+var bitMask = (n) => (_1n << BigInt(n)) - _1n;
+function createHmacDrbg(hashLen, qByteLen, hmacFn) {
+  anumber(hashLen, "hashLen");
+  anumber(qByteLen, "qByteLen");
+  if (typeof hmacFn !== "function")
+    throw new TypeError("hmacFn must be a function");
+  const u8n = (len) => new Uint8Array(len);
+  const NULL = Uint8Array.of();
+  const byte0 = Uint8Array.of(0);
+  const byte1 = Uint8Array.of(1);
+  const _maxDrbgIters = 1e3;
+  let v = u8n(hashLen);
+  let k = u8n(hashLen);
+  let i = 0;
+  const reset = () => {
+    v.fill(1);
+    k.fill(0);
+    i = 0;
+  };
+  const h = (...msgs) => hmacFn(k, concatBytes2(v, ...msgs));
+  const reseed = (seed = NULL) => {
+    k = h(byte0, seed);
+    v = h();
+    if (seed.length === 0)
+      return;
+    k = h(byte1, seed);
+    v = h();
+  };
+  const gen = () => {
+    if (i++ >= _maxDrbgIters)
+      throw new Error("drbg: tried max amount of iterations");
+    let len = 0;
+    const out = [];
+    while (len < qByteLen) {
+      v = h();
+      const sl = v.slice();
+      out.push(sl);
+      len += v.length;
+    }
+    return concatBytes2(...out);
+  };
+  const genUntil = (seed, pred) => {
+    reset();
+    reseed(seed);
+    let res = void 0;
+    while ((res = pred(gen())) === void 0)
+      reseed();
+    reset();
+    return res;
+  };
+  return genUntil;
+}
+function validateObject(object, fields = {}, optFields = {}) {
+  if (Object.prototype.toString.call(object) !== "[object Object]")
+    throw new TypeError("expected valid options object");
+  function checkField(fieldName, expectedType, isOpt) {
+    if (!isOpt && expectedType !== "function" && !Object.hasOwn(object, fieldName))
+      throw new TypeError(`param "${fieldName}" is invalid: expected own property`);
+    const val = object[fieldName];
+    if (isOpt && val === void 0)
+      return;
+    const current = typeof val;
+    if (current !== expectedType || val === null)
+      throw new TypeError(`param "${fieldName}" is invalid: expected ${expectedType}, got ${current}`);
+  }
+  const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));
+  iter(fields, false);
+  iter(optFields, true);
+}
+
+// node_modules/@noble/curves/abstract/modular.js
+var _0n2 = /* @__PURE__ */ BigInt(0);
+var _1n2 = /* @__PURE__ */ BigInt(1);
+var _2n = /* @__PURE__ */ BigInt(2);
+var _3n = /* @__PURE__ */ BigInt(3);
+var _4n = /* @__PURE__ */ BigInt(4);
+var _5n = /* @__PURE__ */ BigInt(5);
+var _7n = /* @__PURE__ */ BigInt(7);
+var _8n = /* @__PURE__ */ BigInt(8);
+var _9n = /* @__PURE__ */ BigInt(9);
+var _16n = /* @__PURE__ */ BigInt(16);
+function mod(a, b) {
+  if (b <= _0n2)
+    throw new Error("mod: expected positive modulus, got " + b);
+  const result = a % b;
+  return result >= _0n2 ? result : b + result;
+}
+function pow2(x, power, modulo) {
+  if (power < _0n2)
+    throw new Error("pow2: expected non-negative exponent, got " + power);
+  let res = x;
+  while (power-- > _0n2) {
+    res *= res;
+    res %= modulo;
+  }
+  return res;
+}
+function invert(number, modulo) {
+  if (number === _0n2)
+    throw new Error("invert: expected non-zero number");
+  if (modulo <= _0n2)
+    throw new Error("invert: expected positive modulus, got " + modulo);
+  let a = mod(number, modulo);
+  let b = modulo;
+  let x = _0n2, y = _1n2, u = _1n2, v = _0n2;
+  while (a !== _0n2) {
+    const q = b / a;
+    const r = b - a * q;
+    const m = x - u * q;
+    const n = y - v * q;
+    b = a, a = r, x = u, y = v, u = m, v = n;
+  }
+  const gcd = b;
+  if (gcd !== _1n2)
+    throw new Error("invert: does not exist");
+  return mod(x, modulo);
+}
+function assertIsSquare(Fp, root, n) {
+  const F = Fp;
+  if (!F.eql(F.sqr(root), n))
+    throw new Error("Cannot find square root");
+}
+function sqrt3mod4(Fp, n) {
+  const F = Fp;
+  const p1div4 = (F.ORDER + _1n2) / _4n;
+  const root = F.pow(n, p1div4);
+  assertIsSquare(F, root, n);
+  return root;
+}
+function sqrt5mod8(Fp, n) {
+  const F = Fp;
+  const p5div8 = (F.ORDER - _5n) / _8n;
+  const n2 = F.mul(n, _2n);
+  const v = F.pow(n2, p5div8);
+  const nv = F.mul(n, v);
+  const i = F.mul(F.mul(nv, _2n), v);
+  const root = F.mul(nv, F.sub(i, F.ONE));
+  assertIsSquare(F, root, n);
+  return root;
+}
+function sqrt9mod16(P) {
+  const Fp_ = Field(P);
+  const tn = tonelliShanks(P);
+  const c1 = tn(Fp_, Fp_.neg(Fp_.ONE));
+  const c2 = tn(Fp_, c1);
+  const c3 = tn(Fp_, Fp_.neg(c1));
+  const c4 = (P + _7n) / _16n;
+  return ((Fp, n) => {
+    const F = Fp;
+    let tv1 = F.pow(n, c4);
+    let tv2 = F.mul(tv1, c1);
+    const tv3 = F.mul(tv1, c2);
+    const tv4 = F.mul(tv1, c3);
+    const e1 = F.eql(F.sqr(tv2), n);
+    const e2 = F.eql(F.sqr(tv3), n);
+    tv1 = F.cmov(tv1, tv2, e1);
+    tv2 = F.cmov(tv4, tv3, e2);
+    const e3 = F.eql(F.sqr(tv2), n);
+    const root = F.cmov(tv1, tv2, e3);
+    assertIsSquare(F, root, n);
+    return root;
+  });
+}
+function tonelliShanks(P) {
+  if (P < _3n)
+    throw new Error("sqrt is not defined for small field");
+  let Q = P - _1n2;
+  let S = 0;
+  while (Q % _2n === _0n2) {
+    Q /= _2n;
+    S++;
+  }
+  let Z = _2n;
+  const _Fp = Field(P);
+  while (FpLegendre(_Fp, Z) === 1) {
+    if (Z++ > 1e3)
+      throw new Error("Cannot find square root: probably non-prime P");
+  }
+  if (S === 1)
+    return sqrt3mod4;
+  let cc = _Fp.pow(Z, Q);
+  const Q1div2 = (Q + _1n2) / _2n;
+  return function tonelliSlow(Fp, n) {
+    const F = Fp;
+    if (F.is0(n))
+      return n;
+    if (FpLegendre(F, n) !== 1)
+      throw new Error("Cannot find square root");
+    let M = S;
+    let c = F.mul(F.ONE, cc);
+    let t = F.pow(n, Q);
+    let R = F.pow(n, Q1div2);
+    while (!F.eql(t, F.ONE)) {
+      if (F.is0(t))
+        return F.ZERO;
+      let i = 1;
+      let t_tmp = F.sqr(t);
+      while (!F.eql(t_tmp, F.ONE)) {
+        i++;
+        t_tmp = F.sqr(t_tmp);
+        if (i === M)
+          throw new Error("Cannot find square root");
+      }
+      const exponent = _1n2 << BigInt(M - i - 1);
+      const b = F.pow(c, exponent);
+      M = i;
+      c = F.sqr(b);
+      t = F.mul(t, c);
+      R = F.mul(R, b);
+    }
+    return R;
+  };
+}
+function FpSqrt(P) {
+  if (P % _4n === _3n)
+    return sqrt3mod4;
+  if (P % _8n === _5n)
+    return sqrt5mod8;
+  if (P % _16n === _9n)
+    return sqrt9mod16(P);
+  return tonelliShanks(P);
+}
+var FIELD_FIELDS = [
+  "create",
+  "isValid",
+  "is0",
+  "neg",
+  "inv",
+  "sqrt",
+  "sqr",
+  "eql",
+  "add",
+  "sub",
+  "mul",
+  "pow",
+  "div",
+  "addN",
+  "subN",
+  "mulN",
+  "sqrN"
+];
+function validateField(field) {
+  const initial = {
+    ORDER: "bigint",
+    BYTES: "number",
+    BITS: "number"
+  };
+  const opts = FIELD_FIELDS.reduce((map, val) => {
+    map[val] = "function";
+    return map;
+  }, initial);
+  validateObject(field, opts);
+  asafenumber(field.BYTES, "BYTES");
+  asafenumber(field.BITS, "BITS");
+  if (field.BYTES < 1 || field.BITS < 1)
+    throw new Error("invalid field: expected BYTES/BITS > 0");
+  if (field.ORDER <= _1n2)
+    throw new Error("invalid field: expected ORDER > 1, got " + field.ORDER);
+  return field;
+}
+function FpPow(Fp, num, power) {
+  const F = Fp;
+  if (power < _0n2)
+    throw new Error("invalid exponent, negatives unsupported");
+  if (power === _0n2)
+    return F.ONE;
+  if (power === _1n2)
+    return num;
+  let p = F.ONE;
+  let d = num;
+  while (power > _0n2) {
+    if (power & _1n2)
+      p = F.mul(p, d);
+    d = F.sqr(d);
+    power >>= _1n2;
+  }
+  return p;
+}
+function FpInvertBatch(Fp, nums, passZero = false) {
+  const F = Fp;
+  const inverted = new Array(nums.length).fill(passZero ? F.ZERO : void 0);
+  const multipliedAcc = nums.reduce((acc, num, i) => {
+    if (F.is0(num))
+      return acc;
+    inverted[i] = acc;
+    return F.mul(acc, num);
+  }, F.ONE);
+  const invertedAcc = F.inv(multipliedAcc);
+  nums.reduceRight((acc, num, i) => {
+    if (F.is0(num))
+      return acc;
+    inverted[i] = F.mul(acc, inverted[i]);
+    return F.mul(acc, num);
+  }, invertedAcc);
+  return inverted;
+}
+function FpLegendre(Fp, n) {
+  const F = Fp;
+  const p1mod2 = (F.ORDER - _1n2) / _2n;
+  const powered = F.pow(n, p1mod2);
+  const yes = F.eql(powered, F.ONE);
+  const zero = F.eql(powered, F.ZERO);
+  const no = F.eql(powered, F.neg(F.ONE));
+  if (!yes && !zero && !no)
+    throw new Error("invalid Legendre symbol result");
+  return yes ? 1 : zero ? 0 : -1;
+}
+function nLength(n, nBitLength) {
+  if (nBitLength !== void 0)
+    anumber2(nBitLength);
+  if (n <= _0n2)
+    throw new Error("invalid n length: expected positive n, got " + n);
+  if (nBitLength !== void 0 && nBitLength < 1)
+    throw new Error("invalid n length: expected positive bit length, got " + nBitLength);
+  const bits = bitLen(n);
+  if (nBitLength !== void 0 && nBitLength < bits)
+    throw new Error(`invalid n length: expected bit length (${bits}) >= n.length (${nBitLength})`);
+  const _nBitLength = nBitLength !== void 0 ? nBitLength : bits;
+  const nByteLength = Math.ceil(_nBitLength / 8);
+  return { nBitLength: _nBitLength, nByteLength };
+}
+var FIELD_SQRT = /* @__PURE__ */ new WeakMap();
+var _Field = class {
+  ORDER;
+  BITS;
+  BYTES;
+  isLE;
+  ZERO = _0n2;
+  ONE = _1n2;
+  _lengths;
+  _mod;
+  constructor(ORDER, opts = {}) {
+    if (ORDER <= _1n2)
+      throw new Error("invalid field: expected ORDER > 1, got " + ORDER);
+    let _nbitLength = void 0;
+    this.isLE = false;
+    if (opts != null && typeof opts === "object") {
+      if (typeof opts.BITS === "number")
+        _nbitLength = opts.BITS;
+      if (typeof opts.sqrt === "function")
+        Object.defineProperty(this, "sqrt", { value: opts.sqrt, enumerable: true });
+      if (typeof opts.isLE === "boolean")
+        this.isLE = opts.isLE;
+      if (opts.allowedLengths)
+        this._lengths = Object.freeze(opts.allowedLengths.slice());
+      if (typeof opts.modFromBytes === "boolean")
+        this._mod = opts.modFromBytes;
+    }
+    const { nBitLength, nByteLength } = nLength(ORDER, _nbitLength);
+    if (nByteLength > 2048)
+      throw new Error("invalid field: expected ORDER of <= 2048 bytes");
+    this.ORDER = ORDER;
+    this.BITS = nBitLength;
+    this.BYTES = nByteLength;
+    Object.freeze(this);
+  }
+  create(num) {
+    return mod(num, this.ORDER);
+  }
+  isValid(num) {
+    if (typeof num !== "bigint")
+      throw new TypeError("invalid field element: expected bigint, got " + typeof num);
+    return _0n2 <= num && num < this.ORDER;
+  }
+  is0(num) {
+    return num === _0n2;
+  }
+  // is valid and invertible
+  isValidNot0(num) {
+    return !this.is0(num) && this.isValid(num);
+  }
+  isOdd(num) {
+    return (num & _1n2) === _1n2;
+  }
+  neg(num) {
+    return mod(-num, this.ORDER);
+  }
+  eql(lhs, rhs) {
+    return lhs === rhs;
+  }
+  sqr(num) {
+    return mod(num * num, this.ORDER);
+  }
+  add(lhs, rhs) {
+    return mod(lhs + rhs, this.ORDER);
+  }
+  sub(lhs, rhs) {
+    return mod(lhs - rhs, this.ORDER);
+  }
+  mul(lhs, rhs) {
+    return mod(lhs * rhs, this.ORDER);
+  }
+  pow(num, power) {
+    return FpPow(this, num, power);
+  }
+  div(lhs, rhs) {
+    return mod(lhs * invert(rhs, this.ORDER), this.ORDER);
+  }
+  // Same as above, but doesn't normalize
+  sqrN(num) {
+    return num * num;
+  }
+  addN(lhs, rhs) {
+    return lhs + rhs;
+  }
+  subN(lhs, rhs) {
+    return lhs - rhs;
+  }
+  mulN(lhs, rhs) {
+    return lhs * rhs;
+  }
+  inv(num) {
+    return invert(num, this.ORDER);
+  }
+  sqrt(num) {
+    let sqrt = FIELD_SQRT.get(this);
+    if (!sqrt)
+      FIELD_SQRT.set(this, sqrt = FpSqrt(this.ORDER));
+    return sqrt(this, num);
+  }
+  toBytes(num) {
+    return this.isLE ? numberToBytesLE(num, this.BYTES) : numberToBytesBE(num, this.BYTES);
+  }
+  fromBytes(bytes, skipValidation = false) {
+    abytes2(bytes);
+    const { _lengths: allowedLengths, BYTES, isLE: isLE2, ORDER, _mod: modFromBytes } = this;
+    if (allowedLengths) {
+      if (bytes.length < 1 || !allowedLengths.includes(bytes.length) || bytes.length > BYTES) {
+        throw new Error("Field.fromBytes: expected " + allowedLengths + " bytes, got " + bytes.length);
+      }
+      const padded = new Uint8Array(BYTES);
+      padded.set(bytes, isLE2 ? 0 : padded.length - bytes.length);
+      bytes = padded;
+    }
+    if (bytes.length !== BYTES)
+      throw new Error("Field.fromBytes: expected " + BYTES + " bytes, got " + bytes.length);
+    let scalar = isLE2 ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);
+    if (modFromBytes)
+      scalar = mod(scalar, ORDER);
+    if (!skipValidation) {
+      if (!this.isValid(scalar))
+        throw new Error("invalid field element: outside of range 0..ORDER");
+    }
+    return scalar;
+  }
+  // TODO: we don't need it here, move out to separate fn
+  invertBatch(lst) {
+    return FpInvertBatch(this, lst);
+  }
+  // We can't move this out because Fp6, Fp12 implement it
+  // and it's unclear what to return in there.
+  cmov(a, b, condition) {
+    abool(condition, "condition");
+    return condition ? b : a;
+  }
+};
+Object.freeze(_Field.prototype);
+function Field(ORDER, opts = {}) {
+  return new _Field(ORDER, opts);
+}
+function getFieldBytesLength(fieldOrder) {
+  if (typeof fieldOrder !== "bigint")
+    throw new Error("field order must be bigint");
+  if (fieldOrder <= _1n2)
+    throw new Error("field order must be greater than 1");
+  const bitLength = bitLen(fieldOrder - _1n2);
+  return Math.ceil(bitLength / 8);
+}
+function getMinHashLength(fieldOrder) {
+  const length = getFieldBytesLength(fieldOrder);
+  return length + Math.ceil(length / 2);
+}
+function mapHashToField(key, fieldOrder, isLE2 = false) {
+  abytes2(key);
+  const len = key.length;
+  const fieldLen = getFieldBytesLength(fieldOrder);
+  const minLen = Math.max(getMinHashLength(fieldOrder), 16);
+  if (len < minLen || len > 1024)
+    throw new Error("expected " + minLen + "-1024 bytes of input, got " + len);
+  const num = isLE2 ? bytesToNumberLE(key) : bytesToNumberBE(key);
+  const reduced = mod(num, fieldOrder - _1n2) + _1n2;
+  return isLE2 ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
+}
+
+// node_modules/@noble/curves/abstract/curve.js
+var _0n3 = /* @__PURE__ */ BigInt(0);
+var _1n3 = /* @__PURE__ */ BigInt(1);
+function negateCt(condition, item) {
+  const neg = item.negate();
+  return condition ? neg : item;
+}
+function normalizeZ(c, points) {
+  const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));
+  return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));
+}
+function validateW(W, bits) {
+  if (!Number.isSafeInteger(W) || W <= 0 || W > bits)
+    throw new Error("invalid window size, expected [1.." + bits + "], got W=" + W);
+}
+function calcWOpts(W, scalarBits) {
+  validateW(W, scalarBits);
+  const windows = Math.ceil(scalarBits / W) + 1;
+  const windowSize = 2 ** (W - 1);
+  const maxNumber = 2 ** W;
+  const mask = bitMask(W);
+  const shiftBy = BigInt(W);
+  return { windows, windowSize, mask, maxNumber, shiftBy };
+}
+function calcOffsets(n, window, wOpts) {
+  const { windowSize, mask, maxNumber, shiftBy } = wOpts;
+  let wbits = Number(n & mask);
+  let nextN = n >> shiftBy;
+  if (wbits > windowSize) {
+    wbits -= maxNumber;
+    nextN += _1n3;
+  }
+  const offsetStart = window * windowSize;
+  const offset = offsetStart + Math.abs(wbits) - 1;
+  const isZero = wbits === 0;
+  const isNeg = wbits < 0;
+  const isNegF = window % 2 !== 0;
+  const offsetF = offsetStart;
+  return { nextN, offset, isZero, isNeg, isNegF, offsetF };
+}
+var pointPrecomputes = /* @__PURE__ */ new WeakMap();
+var pointWindowSizes = /* @__PURE__ */ new WeakMap();
+function getW(P) {
+  return pointWindowSizes.get(P) || 1;
+}
+function assert0(n) {
+  if (n !== _0n3)
+    throw new Error("invalid wNAF");
+}
+var wNAF = class {
+  BASE;
+  ZERO;
+  Fn;
+  bits;
+  // Parametrized with a given Point class (not individual point)
+  constructor(Point, bits) {
+    this.BASE = Point.BASE;
+    this.ZERO = Point.ZERO;
+    this.Fn = Point.Fn;
+    this.bits = bits;
+  }
+  // non-const time multiplication ladder
+  _unsafeLadder(elm, n, p = this.ZERO) {
+    let d = elm;
+    while (n > _0n3) {
+      if (n & _1n3)
+        p = p.add(d);
+      d = d.double();
+      n >>= _1n3;
+    }
+    return p;
+  }
+  /**
+   * Creates a wNAF precomputation window. Used for caching.
+   * Default window size is set by `utils.precompute()` and is equal to 8.
+   * Number of precomputed points depends on the curve size:
+   * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+   * - 𝑊 is the window size
+   * - 𝑛 is the bitlength of the curve order.
+   * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+   * @param point - Point instance
+   * @param W - window size
+   * @returns precomputed point tables flattened to a single array
+   */
+  precomputeWindow(point, W) {
+    const { windows, windowSize } = calcWOpts(W, this.bits);
+    const points = [];
+    let p = point;
+    let base = p;
+    for (let window = 0; window < windows; window++) {
+      base = p;
+      points.push(base);
+      for (let i = 1; i < windowSize; i++) {
+        base = base.add(p);
+        points.push(base);
+      }
+      p = base.double();
+    }
+    return points;
+  }
+  /**
+   * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
+   * More compact implementation:
+   * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541
+   * @returns real and fake (for const-time) points
+   */
+  wNAF(W, precomputes, n) {
+    if (!this.Fn.isValid(n))
+      throw new Error("invalid scalar");
+    let p = this.ZERO;
+    let f = this.BASE;
+    const wo = calcWOpts(W, this.bits);
+    for (let window = 0; window < wo.windows; window++) {
+      const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);
+      n = nextN;
+      if (isZero) {
+        f = f.add(negateCt(isNegF, precomputes[offsetF]));
+      } else {
+        p = p.add(negateCt(isNeg, precomputes[offset]));
+      }
+    }
+    assert0(n);
+    return { p, f };
+  }
+  /**
+   * Implements unsafe EC multiplication using precomputed tables
+   * and w-ary non-adjacent form.
+   * @param acc - accumulator point to add result of multiplication
+   * @returns point
+   */
+  wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {
+    const wo = calcWOpts(W, this.bits);
+    for (let window = 0; window < wo.windows; window++) {
+      if (n === _0n3)
+        break;
+      const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);
+      n = nextN;
+      if (isZero) {
+        continue;
+      } else {
+        const item = precomputes[offset];
+        acc = acc.add(isNeg ? item.negate() : item);
+      }
+    }
+    assert0(n);
+    return acc;
+  }
+  getPrecomputes(W, point, transform) {
+    let comp = pointPrecomputes.get(point);
+    if (!comp) {
+      comp = this.precomputeWindow(point, W);
+      if (W !== 1) {
+        if (typeof transform === "function")
+          comp = transform(comp);
+        pointPrecomputes.set(point, comp);
+      }
+    }
+    return comp;
+  }
+  cached(point, scalar, transform) {
+    const W = getW(point);
+    return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);
+  }
+  unsafe(point, scalar, transform, prev) {
+    const W = getW(point);
+    if (W === 1)
+      return this._unsafeLadder(point, scalar, prev);
+    return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);
+  }
+  // We calculate precomputes for elliptic curve point multiplication
+  // using windowed method. This specifies window size and
+  // stores precomputed values. Usually only base point would be precomputed.
+  createCache(P, W) {
+    validateW(W, this.bits);
+    pointWindowSizes.set(P, W);
+    pointPrecomputes.delete(P);
+  }
+  hasCache(elm) {
+    return getW(elm) !== 1;
+  }
+};
+function mulEndoUnsafe(Point, point, k1, k2) {
+  let acc = point;
+  let p1 = Point.ZERO;
+  let p2 = Point.ZERO;
+  while (k1 > _0n3 || k2 > _0n3) {
+    if (k1 & _1n3)
+      p1 = p1.add(acc);
+    if (k2 & _1n3)
+      p2 = p2.add(acc);
+    acc = acc.double();
+    k1 >>= _1n3;
+    k2 >>= _1n3;
+  }
+  return { p1, p2 };
+}
+function createField(order, field, isLE2) {
+  if (field) {
+    if (field.ORDER !== order)
+      throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
+    validateField(field);
+    return field;
+  } else {
+    return Field(order, { isLE: isLE2 });
+  }
+}
+function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
+  if (FpFnLE === void 0)
+    FpFnLE = type === "edwards";
+  if (!CURVE || typeof CURVE !== "object")
+    throw new Error(`expected valid ${type} CURVE object`);
+  for (const p of ["p", "n", "h"]) {
+    const val = CURVE[p];
+    if (!(typeof val === "bigint" && val > _0n3))
+      throw new Error(`CURVE.${p} must be positive bigint`);
+  }
+  const Fp = createField(CURVE.p, curveOpts.Fp, FpFnLE);
+  const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);
+  const _b = type === "weierstrass" ? "b" : "d";
+  const params = ["Gx", "Gy", "a", _b];
+  for (const p of params) {
+    if (!Fp.isValid(CURVE[p]))
+      throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);
+  }
+  CURVE = Object.freeze(Object.assign({}, CURVE));
+  return { CURVE, Fp, Fn };
+}
+function createKeygen(randomSecretKey, getPublicKey) {
+  return function keygen(seed) {
+    const secretKey = randomSecretKey(seed);
+    return { secretKey, publicKey: getPublicKey(secretKey) };
+  };
+}
+
+// node_modules/@noble/curves/abstract/weierstrass.js
+var divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n2) / den;
+function _splitEndoScalar(k, basis, n) {
+  aInRange("scalar", k, _0n4, n);
+  const [[a1, b1], [a2, b2]] = basis;
+  const c1 = divNearest(b2 * k, n);
+  const c2 = divNearest(-b1 * k, n);
+  let k1 = k - c1 * a1 - c2 * a2;
+  let k2 = -c1 * b1 - c2 * b2;
+  const k1neg = k1 < _0n4;
+  const k2neg = k2 < _0n4;
+  if (k1neg)
+    k1 = -k1;
+  if (k2neg)
+    k2 = -k2;
+  const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n4;
+  if (k1 < _0n4 || k1 >= MAX_NUM || k2 < _0n4 || k2 >= MAX_NUM) {
+    throw new Error("splitScalar (endomorphism): failed for k");
+  }
+  return { k1neg, k1, k2neg, k2 };
+}
+function validateSigFormat(format) {
+  if (!["compact", "recovered", "der"].includes(format))
+    throw new Error('Signature format must be "compact", "recovered", or "der"');
+  return format;
+}
+function validateSigOpts(opts, def) {
+  validateObject(opts);
+  const optsn = {};
+  for (let optName of Object.keys(def)) {
+    optsn[optName] = opts[optName] === void 0 ? def[optName] : opts[optName];
+  }
+  abool(optsn.lowS, "lowS");
+  abool(optsn.prehash, "prehash");
+  if (optsn.format !== void 0)
+    validateSigFormat(optsn.format);
+  return optsn;
+}
+var DERErr = class extends Error {
+  constructor(m = "") {
+    super(m);
+  }
+};
+var DER = {
+  // asn.1 DER encoding utils
+  Err: DERErr,
+  // Basic building block is TLV (Tag-Length-Value)
+  _tlv: {
+    encode: (tag, data) => {
+      const { Err: E } = DER;
+      asafenumber(tag, "tag");
+      if (tag < 0 || tag > 255)
+        throw new E("tlv.encode: wrong tag");
+      if (typeof data !== "string")
+        throw new TypeError('"data" expected string, got type=' + typeof data);
+      if (data.length & 1)
+        throw new E("tlv.encode: unpadded data");
+      const dataLen = data.length / 2;
+      const len = numberToHexUnpadded(dataLen);
+      if (len.length / 2 & 128)
+        throw new E("tlv.encode: long form length too big");
+      const lenLen = dataLen > 127 ? numberToHexUnpadded(len.length / 2 | 128) : "";
+      const t = numberToHexUnpadded(tag);
+      return t + lenLen + len + data;
+    },
+    // v - value, l - left bytes (unparsed)
+    decode(tag, data) {
+      const { Err: E } = DER;
+      data = abytes2(data, void 0, "DER data");
+      let pos = 0;
+      if (tag < 0 || tag > 255)
+        throw new E("tlv.encode: wrong tag");
+      if (data.length < 2 || data[pos++] !== tag)
+        throw new E("tlv.decode: wrong tlv");
+      const first = data[pos++];
+      const isLong = !!(first & 128);
+      let length = 0;
+      if (!isLong)
+        length = first;
+      else {
+        const lenLen = first & 127;
+        if (!lenLen)
+          throw new E("tlv.decode(long): indefinite length not supported");
+        if (lenLen > 4)
+          throw new E("tlv.decode(long): byte length is too big");
+        const lengthBytes = data.subarray(pos, pos + lenLen);
+        if (lengthBytes.length !== lenLen)
+          throw new E("tlv.decode: length bytes not complete");
+        if (lengthBytes[0] === 0)
+          throw new E("tlv.decode(long): zero leftmost byte");
+        for (const b of lengthBytes)
+          length = length << 8 | b;
+        pos += lenLen;
+        if (length < 128)
+          throw new E("tlv.decode(long): not minimal encoding");
+      }
+      const v = data.subarray(pos, pos + length);
+      if (v.length !== length)
+        throw new E("tlv.decode: wrong value length");
+      return { v, l: data.subarray(pos + length) };
+    }
+  },
+  // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,
+  // since we always use positive integers here. It must always be empty:
+  // - add zero byte if exists
+  // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)
+  _int: {
+    encode(num) {
+      const { Err: E } = DER;
+      abignumber(num);
+      if (num < _0n4)
+        throw new E("integer: negative integers are not allowed");
+      let hex = numberToHexUnpadded(num);
+      if (Number.parseInt(hex[0], 16) & 8)
+        hex = "00" + hex;
+      if (hex.length & 1)
+        throw new E("unexpected DER parsing assertion: unpadded hex");
+      return hex;
+    },
+    decode(data) {
+      const { Err: E } = DER;
+      if (data.length < 1)
+        throw new E("invalid signature integer: empty");
+      if (data[0] & 128)
+        throw new E("invalid signature integer: negative");
+      if (data.length > 1 && data[0] === 0 && !(data[1] & 128))
+        throw new E("invalid signature integer: unnecessary leading zero");
+      return bytesToNumberBE(data);
+    }
+  },
+  toSig(bytes) {
+    const { Err: E, _int: int, _tlv: tlv } = DER;
+    const data = abytes2(bytes, void 0, "signature");
+    const { v: seqBytes, l: seqLeftBytes } = tlv.decode(48, data);
+    if (seqLeftBytes.length)
+      throw new E("invalid signature: left bytes after parsing");
+    const { v: rBytes, l: rLeftBytes } = tlv.decode(2, seqBytes);
+    const { v: sBytes, l: sLeftBytes } = tlv.decode(2, rLeftBytes);
+    if (sLeftBytes.length)
+      throw new E("invalid signature: left bytes after parsing");
+    return { r: int.decode(rBytes), s: int.decode(sBytes) };
+  },
+  hexFromSig(sig) {
+    const { _tlv: tlv, _int: int } = DER;
+    const rs = tlv.encode(2, int.encode(sig.r));
+    const ss = tlv.encode(2, int.encode(sig.s));
+    const seq = rs + ss;
+    return tlv.encode(48, seq);
+  }
+};
+Object.freeze(DER._tlv);
+Object.freeze(DER._int);
+Object.freeze(DER);
+var _0n4 = /* @__PURE__ */ BigInt(0);
+var _1n4 = /* @__PURE__ */ BigInt(1);
+var _2n2 = /* @__PURE__ */ BigInt(2);
+var _3n2 = /* @__PURE__ */ BigInt(3);
+var _4n2 = /* @__PURE__ */ BigInt(4);
+function weierstrass(params, extraOpts = {}) {
+  const validated = createCurveFields("weierstrass", params, extraOpts);
+  const Fp = validated.Fp;
+  const Fn = validated.Fn;
+  let CURVE = validated.CURVE;
+  const { h: cofactor, n: CURVE_ORDER } = CURVE;
+  validateObject(extraOpts, {}, {
+    allowInfinityPoint: "boolean",
+    clearCofactor: "function",
+    isTorsionFree: "function",
+    fromBytes: "function",
+    toBytes: "function",
+    endo: "object"
+  });
+  const { endo, allowInfinityPoint } = extraOpts;
+  if (endo) {
+    if (!Fp.is0(CURVE.a) || typeof endo.beta !== "bigint" || !Array.isArray(endo.basises)) {
+      throw new Error('invalid endo: expected "beta": bigint and "basises": array');
+    }
+  }
+  const lengths = getWLengths(Fp, Fn);
+  function assertCompressionIsSupported() {
+    if (!Fp.isOdd)
+      throw new Error("compression is not supported: Field does not have .isOdd()");
+  }
+  function pointToBytes(_c, point, isCompressed) {
+    if (allowInfinityPoint && point.is0())
+      return Uint8Array.of(0);
+    const { x, y } = point.toAffine();
+    const bx = Fp.toBytes(x);
+    abool(isCompressed, "isCompressed");
+    if (isCompressed) {
+      assertCompressionIsSupported();
+      const hasEvenY = !Fp.isOdd(y);
+      return concatBytes2(pprefix(hasEvenY), bx);
+    } else {
+      return concatBytes2(Uint8Array.of(4), bx, Fp.toBytes(y));
+    }
+  }
+  function pointFromBytes(bytes) {
+    abytes2(bytes, void 0, "Point");
+    const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths;
+    const length = bytes.length;
+    const head = bytes[0];
+    const tail = bytes.subarray(1);
+    if (allowInfinityPoint && length === 1 && head === 0)
+      return { x: Fp.ZERO, y: Fp.ZERO };
+    if (length === comp && (head === 2 || head === 3)) {
+      const x = Fp.fromBytes(tail);
+      if (!Fp.isValid(x))
+        throw new Error("bad point: is not on curve, wrong x");
+      const y2 = weierstrassEquation(x);
+      let y;
+      try {
+        y = Fp.sqrt(y2);
+      } catch (sqrtError) {
+        const err = sqrtError instanceof Error ? ": " + sqrtError.message : "";
+        throw new Error("bad point: is not on curve, sqrt error" + err);
+      }
+      assertCompressionIsSupported();
+      const evenY = Fp.isOdd(y);
+      const evenH = (head & 1) === 1;
+      if (evenH !== evenY)
+        y = Fp.neg(y);
+      return { x, y };
+    } else if (length === uncomp && head === 4) {
+      const L = Fp.BYTES;
+      const x = Fp.fromBytes(tail.subarray(0, L));
+      const y = Fp.fromBytes(tail.subarray(L, L * 2));
+      if (!isValidXY(x, y))
+        throw new Error("bad point: is not on curve");
+      return { x, y };
+    } else {
+      throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);
+    }
+  }
+  const encodePoint = extraOpts.toBytes === void 0 ? pointToBytes : extraOpts.toBytes;
+  const decodePoint = extraOpts.fromBytes === void 0 ? pointFromBytes : extraOpts.fromBytes;
+  function weierstrassEquation(x) {
+    const x2 = Fp.sqr(x);
+    const x3 = Fp.mul(x2, x);
+    return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b);
+  }
+  function isValidXY(x, y) {
+    const left = Fp.sqr(y);
+    const right = weierstrassEquation(x);
+    return Fp.eql(left, right);
+  }
+  if (!isValidXY(CURVE.Gx, CURVE.Gy))
+    throw new Error("bad curve params: generator point");
+  const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n2), _4n2);
+  const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));
+  if (Fp.is0(Fp.add(_4a3, _27b2)))
+    throw new Error("bad curve params: a or b");
+  function acoord(title, n, banZero = false) {
+    if (!Fp.isValid(n) || banZero && Fp.is0(n))
+      throw new Error(`bad point coordinate ${title}`);
+    return n;
+  }
+  function aprjpoint(other) {
+    if (!(other instanceof Point))
+      throw new Error("Weierstrass Point expected");
+  }
+  function splitEndoScalarN(k) {
+    if (!endo || !endo.basises)
+      throw new Error("no endo");
+    return _splitEndoScalar(k, endo.basises, Fn.ORDER);
+  }
+  function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {
+    k2p = new Point(Fp.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);
+    k1p = negateCt(k1neg, k1p);
+    k2p = negateCt(k2neg, k2p);
+    return k1p.add(k2p);
+  }
+  class Point {
+    // base / generator point
+    static BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);
+    // zero / infinity / identity point
+    static ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO);
+    // 0, 1, 0
+    // math field
+    static Fp = Fp;
+    // scalar field
+    static Fn = Fn;
+    X;
+    Y;
+    Z;
+    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
+    constructor(X, Y, Z) {
+      this.X = acoord("x", X);
+      this.Y = acoord("y", Y, true);
+      this.Z = acoord("z", Z);
+      Object.freeze(this);
+    }
+    static CURVE() {
+      return CURVE;
+    }
+    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
+    static fromAffine(p) {
+      const { x, y } = p || {};
+      if (!p || !Fp.isValid(x) || !Fp.isValid(y))
+        throw new Error("invalid affine point");
+      if (p instanceof Point)
+        throw new Error("projective point not allowed");
+      if (Fp.is0(x) && Fp.is0(y))
+        return Point.ZERO;
+      return new Point(x, y, Fp.ONE);
+    }
+    static fromBytes(bytes) {
+      const P = Point.fromAffine(decodePoint(abytes2(bytes, void 0, "point")));
+      P.assertValidity();
+      return P;
+    }
+    static fromHex(hex) {
+      return Point.fromBytes(hexToBytes2(hex));
+    }
+    get x() {
+      return this.toAffine().x;
+    }
+    get y() {
+      return this.toAffine().y;
+    }
+    /**
+     *
+     * @param windowSize
+     * @param isLazy - true will defer table computation until the first multiplication
+     * @returns
+     */
+    precompute(windowSize = 8, isLazy = true) {
+      wnaf.createCache(this, windowSize);
+      if (!isLazy)
+        this.multiply(_3n2);
+      return this;
+    }
+    // TODO: return `this`
+    /** A point on curve is valid if it conforms to equation. */
+    assertValidity() {
+      const p = this;
+      if (p.is0()) {
+        if (extraOpts.allowInfinityPoint && Fp.is0(p.X) && Fp.eql(p.Y, Fp.ONE) && Fp.is0(p.Z))
+          return;
+        throw new Error("bad point: ZERO");
+      }
+      const { x, y } = p.toAffine();
+      if (!Fp.isValid(x) || !Fp.isValid(y))
+        throw new Error("bad point: x or y not field elements");
+      if (!isValidXY(x, y))
+        throw new Error("bad point: equation left != right");
+      if (!p.isTorsionFree())
+        throw new Error("bad point: not in prime-order subgroup");
+    }
+    hasEvenY() {
+      const { y } = this.toAffine();
+      if (!Fp.isOdd)
+        throw new Error("Field doesn't support isOdd");
+      return !Fp.isOdd(y);
+    }
+    /** Compare one point to another. */
+    equals(other) {
+      aprjpoint(other);
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      const { X: X2, Y: Y2, Z: Z2 } = other;
+      const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));
+      const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));
+      return U1 && U2;
+    }
+    /** Flips point to one corresponding to (x, -y) in Affine coordinates. */
+    negate() {
+      return new Point(this.X, Fp.neg(this.Y), this.Z);
+    }
+    // Renes-Costello-Batina exception-free doubling formula.
+    // There is 30% faster Jacobian formula, but it is not complete.
+    // https://eprint.iacr.org/2015/1060, algorithm 3
+    // Cost: 8M + 3S + 3*a + 2*b3 + 15add.
+    double() {
+      const { a, b } = CURVE;
+      const b3 = Fp.mul(b, _3n2);
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO;
+      let t0 = Fp.mul(X1, X1);
+      let t1 = Fp.mul(Y1, Y1);
+      let t2 = Fp.mul(Z1, Z1);
+      let t3 = Fp.mul(X1, Y1);
+      t3 = Fp.add(t3, t3);
+      Z3 = Fp.mul(X1, Z1);
+      Z3 = Fp.add(Z3, Z3);
+      X3 = Fp.mul(a, Z3);
+      Y3 = Fp.mul(b3, t2);
+      Y3 = Fp.add(X3, Y3);
+      X3 = Fp.sub(t1, Y3);
+      Y3 = Fp.add(t1, Y3);
+      Y3 = Fp.mul(X3, Y3);
+      X3 = Fp.mul(t3, X3);
+      Z3 = Fp.mul(b3, Z3);
+      t2 = Fp.mul(a, t2);
+      t3 = Fp.sub(t0, t2);
+      t3 = Fp.mul(a, t3);
+      t3 = Fp.add(t3, Z3);
+      Z3 = Fp.add(t0, t0);
+      t0 = Fp.add(Z3, t0);
+      t0 = Fp.add(t0, t2);
+      t0 = Fp.mul(t0, t3);
+      Y3 = Fp.add(Y3, t0);
+      t2 = Fp.mul(Y1, Z1);
+      t2 = Fp.add(t2, t2);
+      t0 = Fp.mul(t2, t3);
+      X3 = Fp.sub(X3, t0);
+      Z3 = Fp.mul(t2, t1);
+      Z3 = Fp.add(Z3, Z3);
+      Z3 = Fp.add(Z3, Z3);
+      return new Point(X3, Y3, Z3);
+    }
+    // Renes-Costello-Batina exception-free addition formula.
+    // There is 30% faster Jacobian formula, but it is not complete.
+    // https://eprint.iacr.org/2015/1060, algorithm 1
+    // Cost: 12M + 0S + 3*a + 3*b3 + 23add.
+    add(other) {
+      aprjpoint(other);
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      const { X: X2, Y: Y2, Z: Z2 } = other;
+      let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO;
+      const a = CURVE.a;
+      const b3 = Fp.mul(CURVE.b, _3n2);
+      let t0 = Fp.mul(X1, X2);
+      let t1 = Fp.mul(Y1, Y2);
+      let t2 = Fp.mul(Z1, Z2);
+      let t3 = Fp.add(X1, Y1);
+      let t4 = Fp.add(X2, Y2);
+      t3 = Fp.mul(t3, t4);
+      t4 = Fp.add(t0, t1);
+      t3 = Fp.sub(t3, t4);
+      t4 = Fp.add(X1, Z1);
+      let t5 = Fp.add(X2, Z2);
+      t4 = Fp.mul(t4, t5);
+      t5 = Fp.add(t0, t2);
+      t4 = Fp.sub(t4, t5);
+      t5 = Fp.add(Y1, Z1);
+      X3 = Fp.add(Y2, Z2);
+      t5 = Fp.mul(t5, X3);
+      X3 = Fp.add(t1, t2);
+      t5 = Fp.sub(t5, X3);
+      Z3 = Fp.mul(a, t4);
+      X3 = Fp.mul(b3, t2);
+      Z3 = Fp.add(X3, Z3);
+      X3 = Fp.sub(t1, Z3);
+      Z3 = Fp.add(t1, Z3);
+      Y3 = Fp.mul(X3, Z3);
+      t1 = Fp.add(t0, t0);
+      t1 = Fp.add(t1, t0);
+      t2 = Fp.mul(a, t2);
+      t4 = Fp.mul(b3, t4);
+      t1 = Fp.add(t1, t2);
+      t2 = Fp.sub(t0, t2);
+      t2 = Fp.mul(a, t2);
+      t4 = Fp.add(t4, t2);
+      t0 = Fp.mul(t1, t4);
+      Y3 = Fp.add(Y3, t0);
+      t0 = Fp.mul(t5, t4);
+      X3 = Fp.mul(t3, X3);
+      X3 = Fp.sub(X3, t0);
+      t0 = Fp.mul(t3, t1);
+      Z3 = Fp.mul(t5, Z3);
+      Z3 = Fp.add(Z3, t0);
+      return new Point(X3, Y3, Z3);
+    }
+    subtract(other) {
+      aprjpoint(other);
+      return this.add(other.negate());
+    }
+    is0() {
+      return this.equals(Point.ZERO);
+    }
+    /**
+     * Constant time multiplication.
+     * Uses wNAF method. Windowed method may be 10% faster,
+     * but takes 2x longer to generate and consumes 2x memory.
+     * Uses precomputes when available.
+     * Uses endomorphism for Koblitz curves.
+     * @param scalar - by which the point would be multiplied
+     * @returns New point
+     */
+    multiply(scalar) {
+      const { endo: endo2 } = extraOpts;
+      if (!Fn.isValidNot0(scalar))
+        throw new RangeError("invalid scalar: out of range");
+      let point, fake;
+      const mul = (n) => wnaf.cached(this, n, (p) => normalizeZ(Point, p));
+      if (endo2) {
+        const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(scalar);
+        const { p: k1p, f: k1f } = mul(k1);
+        const { p: k2p, f: k2f } = mul(k2);
+        fake = k1f.add(k2f);
+        point = finishEndo(endo2.beta, k1p, k2p, k1neg, k2neg);
+      } else {
+        const { p, f } = mul(scalar);
+        point = p;
+        fake = f;
+      }
+      return normalizeZ(Point, [point, fake])[0];
+    }
+    /**
+     * Non-constant-time multiplication. Uses double-and-add algorithm.
+     * It's faster, but should only be used when you don't care about
+     * an exposed secret key e.g. sig verification, which works over *public* keys.
+     */
+    multiplyUnsafe(scalar) {
+      const { endo: endo2 } = extraOpts;
+      const p = this;
+      const sc = scalar;
+      if (!Fn.isValid(sc))
+        throw new RangeError("invalid scalar: out of range");
+      if (sc === _0n4 || p.is0())
+        return Point.ZERO;
+      if (sc === _1n4)
+        return p;
+      if (wnaf.hasCache(this))
+        return this.multiply(sc);
+      if (endo2) {
+        const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(sc);
+        const { p1, p2 } = mulEndoUnsafe(Point, p, k1, k2);
+        return finishEndo(endo2.beta, p1, p2, k1neg, k2neg);
+      } else {
+        return wnaf.unsafe(p, sc);
+      }
+    }
+    /**
+     * Converts Projective point to affine (x, y) coordinates.
+     * (X, Y, Z) ∋ (x=X/Z, y=Y/Z).
+     * @param invertedZ - Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch
+     */
+    toAffine(invertedZ) {
+      const p = this;
+      let iz = invertedZ;
+      const { X, Y, Z } = p;
+      if (Fp.eql(Z, Fp.ONE))
+        return { x: X, y: Y };
+      const is0 = p.is0();
+      if (iz == null)
+        iz = is0 ? Fp.ONE : Fp.inv(Z);
+      const x = Fp.mul(X, iz);
+      const y = Fp.mul(Y, iz);
+      const zz = Fp.mul(Z, iz);
+      if (is0)
+        return { x: Fp.ZERO, y: Fp.ZERO };
+      if (!Fp.eql(zz, Fp.ONE))
+        throw new Error("invZ was invalid");
+      return { x, y };
+    }
+    /**
+     * Checks whether Point is free of torsion elements (is in prime subgroup).
+     * Always torsion-free for cofactor=1 curves.
+     */
+    isTorsionFree() {
+      const { isTorsionFree } = extraOpts;
+      if (cofactor === _1n4)
+        return true;
+      if (isTorsionFree)
+        return isTorsionFree(Point, this);
+      return wnaf.unsafe(this, CURVE_ORDER).is0();
+    }
+    clearCofactor() {
+      const { clearCofactor } = extraOpts;
+      if (cofactor === _1n4)
+        return this;
+      if (clearCofactor)
+        return clearCofactor(Point, this);
+      return this.multiplyUnsafe(cofactor);
+    }
+    isSmallOrder() {
+      if (cofactor === _1n4)
+        return this.is0();
+      return this.clearCofactor().is0();
+    }
+    toBytes(isCompressed = true) {
+      abool(isCompressed, "isCompressed");
+      this.assertValidity();
+      return encodePoint(Point, this, isCompressed);
+    }
+    toHex(isCompressed = true) {
+      return bytesToHex2(this.toBytes(isCompressed));
+    }
+    toString() {
+      return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
+    }
+  }
+  const bits = Fn.BITS;
+  const wnaf = new wNAF(Point, extraOpts.endo ? Math.ceil(bits / 2) : bits);
+  if (bits >= 8)
+    Point.BASE.precompute(8);
+  Object.freeze(Point.prototype);
+  Object.freeze(Point);
+  return Point;
+}
+function pprefix(hasEvenY) {
+  return Uint8Array.of(hasEvenY ? 2 : 3);
+}
+function getWLengths(Fp, Fn) {
+  return {
+    secretKey: Fn.BYTES,
+    publicKey: 1 + Fp.BYTES,
+    publicKeyUncompressed: 1 + 2 * Fp.BYTES,
+    publicKeyHasPrefix: true,
+    // Raw compact `(r || s)` signature width; DER and recovered signatures use
+    // different lengths outside this helper.
+    signature: 2 * Fn.BYTES
+  };
+}
+function ecdh(Point, ecdhOpts = {}) {
+  const { Fn } = Point;
+  const randomBytes_ = ecdhOpts.randomBytes === void 0 ? randomBytes2 : ecdhOpts.randomBytes;
+  const lengths = Object.assign(getWLengths(Point.Fp, Fn), {
+    seed: Math.max(getMinHashLength(Fn.ORDER), 16)
+  });
+  function isValidSecretKey(secretKey) {
+    try {
+      const num = Fn.fromBytes(secretKey);
+      return Fn.isValidNot0(num);
+    } catch (error) {
+      return false;
+    }
+  }
+  function isValidPublicKey(publicKey, isCompressed) {
+    const { publicKey: comp, publicKeyUncompressed } = lengths;
+    try {
+      const l = publicKey.length;
+      if (isCompressed === true && l !== comp)
+        return false;
+      if (isCompressed === false && l !== publicKeyUncompressed)
+        return false;
+      return !!Point.fromBytes(publicKey);
+    } catch (error) {
+      return false;
+    }
+  }
+  function randomSecretKey(seed) {
+    seed = seed === void 0 ? randomBytes_(lengths.seed) : seed;
+    return mapHashToField(abytes2(seed, lengths.seed, "seed"), Fn.ORDER);
+  }
+  function getPublicKey(secretKey, isCompressed = true) {
+    return Point.BASE.multiply(Fn.fromBytes(secretKey)).toBytes(isCompressed);
+  }
+  function isProbPub(item) {
+    const { secretKey, publicKey, publicKeyUncompressed } = lengths;
+    const allowedLengths = Fn._lengths;
+    if (!isBytes2(item))
+      return void 0;
+    const l = abytes2(item, void 0, "key").length;
+    const isPub = l === publicKey || l === publicKeyUncompressed;
+    const isSec = l === secretKey || !!allowedLengths?.includes(l);
+    if (isPub && isSec)
+      return void 0;
+    return isPub;
+  }
+  function getSharedSecret(secretKeyA, publicKeyB, isCompressed = true) {
+    if (isProbPub(secretKeyA) === true)
+      throw new Error("first arg must be private key");
+    if (isProbPub(publicKeyB) === false)
+      throw new Error("second arg must be public key");
+    const s = Fn.fromBytes(secretKeyA);
+    const b = Point.fromBytes(publicKeyB);
+    return b.multiply(s).toBytes(isCompressed);
+  }
+  const utils = {
+    isValidSecretKey,
+    isValidPublicKey,
+    randomSecretKey
+  };
+  const keygen = createKeygen(randomSecretKey, getPublicKey);
+  Object.freeze(utils);
+  Object.freeze(lengths);
+  return Object.freeze({ getPublicKey, getSharedSecret, keygen, Point, utils, lengths });
+}
+function ecdsa(Point, hash, ecdsaOpts = {}) {
+  const hash_ = hash;
+  ahash(hash_);
+  validateObject(ecdsaOpts, {}, {
+    hmac: "function",
+    lowS: "boolean",
+    randomBytes: "function",
+    bits2int: "function",
+    bits2int_modN: "function"
+  });
+  ecdsaOpts = Object.assign({}, ecdsaOpts);
+  const randomBytes4 = ecdsaOpts.randomBytes === void 0 ? randomBytes2 : ecdsaOpts.randomBytes;
+  const hmac2 = ecdsaOpts.hmac === void 0 ? (key, msg) => hmac(hash_, key, msg) : ecdsaOpts.hmac;
+  const { Fp, Fn } = Point;
+  const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
+  const { keygen, getPublicKey, getSharedSecret, utils, lengths } = ecdh(Point, ecdsaOpts);
+  const defaultSigOpts = {
+    prehash: true,
+    lowS: typeof ecdsaOpts.lowS === "boolean" ? ecdsaOpts.lowS : true,
+    format: "compact",
+    extraEntropy: false
+  };
+  const hasLargeRecoveryLifts = CURVE_ORDER * _2n2 + _1n4 < Fp.ORDER;
+  function isBiggerThanHalfOrder(number) {
+    const HALF = CURVE_ORDER >> _1n4;
+    return number > HALF;
+  }
+  function validateRS(title, num) {
+    if (!Fn.isValidNot0(num))
+      throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);
+    return num;
+  }
+  function assertRecoverableCurve() {
+    if (hasLargeRecoveryLifts)
+      throw new Error('"recovered" sig type is not supported for cofactor >2 curves');
+  }
+  function validateSigLength(bytes, format) {
+    validateSigFormat(format);
+    const size = lengths.signature;
+    const sizer = format === "compact" ? size : format === "recovered" ? size + 1 : void 0;
+    return abytes2(bytes, sizer);
+  }
+  class Signature2 {
+    r;
+    s;
+    recovery;
+    constructor(r, s, recovery) {
+      this.r = validateRS("r", r);
+      this.s = validateRS("s", s);
+      if (recovery != null) {
+        assertRecoverableCurve();
+        if (![0, 1, 2, 3].includes(recovery))
+          throw new Error("invalid recovery id");
+        this.recovery = recovery;
+      }
+      Object.freeze(this);
+    }
+    static fromBytes(bytes, format = defaultSigOpts.format) {
+      validateSigLength(bytes, format);
+      let recid;
+      if (format === "der") {
+        const { r: r2, s: s2 } = DER.toSig(abytes2(bytes));
+        return new Signature2(r2, s2);
+      }
+      if (format === "recovered") {
+        recid = bytes[0];
+        format = "compact";
+        bytes = bytes.subarray(1);
+      }
+      const L = lengths.signature / 2;
+      const r = bytes.subarray(0, L);
+      const s = bytes.subarray(L, L * 2);
+      return new Signature2(Fn.fromBytes(r), Fn.fromBytes(s), recid);
+    }
+    static fromHex(hex, format) {
+      return this.fromBytes(hexToBytes2(hex), format);
+    }
+    assertRecovery() {
+      const { recovery } = this;
+      if (recovery == null)
+        throw new Error("invalid recovery id: must be present");
+      return recovery;
+    }
+    addRecoveryBit(recovery) {
+      return new Signature2(this.r, this.s, recovery);
+    }
+    // Unlike the top-level helper below, this method expects a digest that has
+    // already been hashed to the curve's message representative.
+    recoverPublicKey(messageHash) {
+      const { r, s } = this;
+      const recovery = this.assertRecovery();
+      const radj = recovery === 2 || recovery === 3 ? r + CURVE_ORDER : r;
+      if (!Fp.isValid(radj))
+        throw new Error("invalid recovery id: sig.r+curve.n != R.x");
+      const x = Fp.toBytes(radj);
+      const R = Point.fromBytes(concatBytes2(pprefix((recovery & 1) === 0), x));
+      const ir = Fn.inv(radj);
+      const h = bits2int_modN(abytes2(messageHash, void 0, "msgHash"));
+      const u1 = Fn.create(-h * ir);
+      const u2 = Fn.create(s * ir);
+      const Q = Point.BASE.multiplyUnsafe(u1).add(R.multiplyUnsafe(u2));
+      if (Q.is0())
+        throw new Error("invalid recovery: point at infinify");
+      Q.assertValidity();
+      return Q;
+    }
+    // Signatures should be low-s, to prevent malleability.
+    hasHighS() {
+      return isBiggerThanHalfOrder(this.s);
+    }
+    toBytes(format = defaultSigOpts.format) {
+      validateSigFormat(format);
+      if (format === "der")
+        return hexToBytes2(DER.hexFromSig(this));
+      const { r, s } = this;
+      const rb = Fn.toBytes(r);
+      const sb = Fn.toBytes(s);
+      if (format === "recovered") {
+        assertRecoverableCurve();
+        return concatBytes2(Uint8Array.of(this.assertRecovery()), rb, sb);
+      }
+      return concatBytes2(rb, sb);
+    }
+    toHex(format) {
+      return bytesToHex2(this.toBytes(format));
+    }
+  }
+  Object.freeze(Signature2.prototype);
+  Object.freeze(Signature2);
+  const bits2int = ecdsaOpts.bits2int === void 0 ? function bits2int_def(bytes) {
+    if (bytes.length > 8192)
+      throw new Error("input is too large");
+    const num = bytesToNumberBE(bytes);
+    const delta = bytes.length * 8 - fnBits;
+    return delta > 0 ? num >> BigInt(delta) : num;
+  } : ecdsaOpts.bits2int;
+  const bits2int_modN = ecdsaOpts.bits2int_modN === void 0 ? function bits2int_modN_def(bytes) {
+    return Fn.create(bits2int(bytes));
+  } : ecdsaOpts.bits2int_modN;
+  const ORDER_MASK = bitMask(fnBits);
+  function int2octets(num) {
+    aInRange("num < 2^" + fnBits, num, _0n4, ORDER_MASK);
+    return Fn.toBytes(num);
+  }
+  function validateMsgAndHash(message, prehash) {
+    abytes2(message, void 0, "message");
+    return prehash ? abytes2(hash_(message), void 0, "prehashed message") : message;
+  }
+  function prepSig(message, secretKey, opts) {
+    const { lowS, prehash, extraEntropy } = validateSigOpts(opts, defaultSigOpts);
+    message = validateMsgAndHash(message, prehash);
+    const h1int = bits2int_modN(message);
+    const d = Fn.fromBytes(secretKey);
+    if (!Fn.isValidNot0(d))
+      throw new Error("invalid private key");
+    const seedArgs = [int2octets(d), int2octets(h1int)];
+    if (extraEntropy != null && extraEntropy !== false) {
+      const e = extraEntropy === true ? randomBytes4(lengths.secretKey) : extraEntropy;
+      seedArgs.push(abytes2(e, void 0, "extraEntropy"));
+    }
+    const seed = concatBytes2(...seedArgs);
+    const m = h1int;
+    function k2sig(kBytes) {
+      const k = bits2int(kBytes);
+      if (!Fn.isValidNot0(k))
+        return;
+      const ik = Fn.inv(k);
+      const q = Point.BASE.multiply(k).toAffine();
+      const r = Fn.create(q.x);
+      if (r === _0n4)
+        return;
+      const s = Fn.create(ik * Fn.create(m + r * d));
+      if (s === _0n4)
+        return;
+      let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n4);
+      let normS = s;
+      if (lowS && isBiggerThanHalfOrder(s)) {
+        normS = Fn.neg(s);
+        recovery ^= 1;
+      }
+      return new Signature2(r, normS, hasLargeRecoveryLifts ? void 0 : recovery);
+    }
+    return { seed, k2sig };
+  }
+  function sign(message, secretKey, opts = {}) {
+    const { seed, k2sig } = prepSig(message, secretKey, opts);
+    const drbg = createHmacDrbg(hash_.outputLen, Fn.BYTES, hmac2);
+    const sig = drbg(seed, k2sig);
+    return sig.toBytes(opts.format);
+  }
+  function verify(signature, message, publicKey, opts = {}) {
+    const { lowS, prehash, format } = validateSigOpts(opts, defaultSigOpts);
+    publicKey = abytes2(publicKey, void 0, "publicKey");
+    message = validateMsgAndHash(message, prehash);
+    if (!isBytes2(signature)) {
+      const end = signature instanceof Signature2 ? ", use sig.toBytes()" : "";
+      throw new Error("verify expects Uint8Array signature" + end);
+    }
+    validateSigLength(signature, format);
+    try {
+      const sig = Signature2.fromBytes(signature, format);
+      const P = Point.fromBytes(publicKey);
+      if (lowS && sig.hasHighS())
+        return false;
+      const { r, s } = sig;
+      const h = bits2int_modN(message);
+      const is = Fn.inv(s);
+      const u1 = Fn.create(h * is);
+      const u2 = Fn.create(r * is);
+      const R = Point.BASE.multiplyUnsafe(u1).add(P.multiplyUnsafe(u2));
+      if (R.is0())
+        return false;
+      const v = Fn.create(R.x);
+      return v === r;
+    } catch (e) {
+      return false;
+    }
+  }
+  function recoverPublicKey(signature, message, opts = {}) {
+    const { prehash } = validateSigOpts(opts, defaultSigOpts);
+    message = validateMsgAndHash(message, prehash);
+    return Signature2.fromBytes(signature, "recovered").recoverPublicKey(message).toBytes();
+  }
+  return Object.freeze({
+    keygen,
+    getPublicKey,
+    getSharedSecret,
+    utils,
+    lengths,
+    Point,
+    sign,
+    verify,
+    recoverPublicKey,
+    Signature: Signature2,
+    hash: hash_
+  });
+}
+
+// node_modules/@noble/curves/secp256k1.js
+var secp256k1_CURVE = {
+  p: BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f"),
+  n: BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"),
+  h: BigInt(1),
+  a: BigInt(0),
+  b: BigInt(7),
+  Gx: BigInt("0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"),
+  Gy: BigInt("0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8")
+};
+var secp256k1_ENDO = {
+  beta: BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),
+  basises: [
+    [BigInt("0x3086d221a7d46bcde86c90e49284eb15"), -BigInt("0xe4437ed6010e88286f547fa90abfe4c3")],
+    [BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"), BigInt("0x3086d221a7d46bcde86c90e49284eb15")]
+  ]
+};
+var _2n3 = /* @__PURE__ */ BigInt(2);
+function sqrtMod(y) {
+  const P = secp256k1_CURVE.p;
+  const _3n3 = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);
+  const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);
+  const b2 = y * y * y % P;
+  const b3 = b2 * b2 * y % P;
+  const b6 = pow2(b3, _3n3, P) * b3 % P;
+  const b9 = pow2(b6, _3n3, P) * b3 % P;
+  const b11 = pow2(b9, _2n3, P) * b2 % P;
+  const b22 = pow2(b11, _11n, P) * b11 % P;
+  const b44 = pow2(b22, _22n, P) * b22 % P;
+  const b88 = pow2(b44, _44n, P) * b44 % P;
+  const b176 = pow2(b88, _88n, P) * b88 % P;
+  const b220 = pow2(b176, _44n, P) * b44 % P;
+  const b223 = pow2(b220, _3n3, P) * b3 % P;
+  const t1 = pow2(b223, _23n, P) * b22 % P;
+  const t2 = pow2(t1, _6n, P) * b2 % P;
+  const root = pow2(t2, _2n3, P);
+  if (!Fpk1.eql(Fpk1.sqr(root), y))
+    throw new Error("Cannot find square root");
+  return root;
+}
+var Fpk1 = Field(secp256k1_CURVE.p, { sqrt: sqrtMod });
+var Pointk1 = /* @__PURE__ */ weierstrass(secp256k1_CURVE, {
+  Fp: Fpk1,
+  endo: secp256k1_ENDO
+});
+var secp256k1 = /* @__PURE__ */ ecdsa(Pointk1, sha256);
+
+// node_modules/@noble/ciphers/utils.js
+function isBytes3(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+function abool2(b) {
+  if (typeof b !== "boolean")
+    throw new TypeError(`boolean expected, not ${b}`);
+}
+function anumber3(n) {
+  if (typeof n !== "number")
+    throw new TypeError("number expected, got " + typeof n);
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new RangeError("positive integer expected, got " + n);
+}
+function abytes3(value, length, title = "") {
+  const bytes = isBytes3(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+    if (!bytes)
+      throw new TypeError(message);
+    throw new RangeError(message);
+  }
+  return value;
+}
+function aexists2(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput2(out, instance, onlyAligned = false) {
+  abytes3(out, void 0, "output");
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new RangeError("digestInto() expects output buffer of length at least " + min);
+  }
+  if (onlyAligned && !isAligned32(out))
+    throw new Error("invalid output, must be aligned");
+}
+function u32(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+function clean2(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView2(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+var byteSwap = (word) => word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
+var swap8IfBE = isLE ? (n) => n : (n) => byteSwap(n) >>> 0;
+var byteSwap32 = (arr) => {
+  for (let i = 0; i < arr.length; i++)
+    arr[i] = byteSwap(arr[i]);
+  return arr;
+};
+var swap32IfBE = isLE ? (u) => u : byteSwap32;
+function checkOpts(defaults, opts) {
+  if (opts == null || typeof opts !== "object")
+    throw new Error("options must be defined");
+  const merged = Object.assign(defaults, opts);
+  return merged;
+}
+function equalBytes(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++)
+    diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function wrapMacConstructor(keyLen, macCons, fromMsg) {
+  const mac = macCons;
+  const getArgs = fromMsg || (() => []);
+  const macC = (msg, key) => mac(key, ...getArgs(msg)).update(msg).digest();
+  const tmp = mac(new Uint8Array(keyLen), ...getArgs(new Uint8Array(0)));
+  macC.outputLen = tmp.outputLen;
+  macC.blockLen = tmp.blockLen;
+  macC.create = (key, ...args) => mac(key, ...args);
+  return macC;
+}
+var wrapCipher = /* @__NO_SIDE_EFFECTS__ */ (params, constructor) => {
+  function wrappedCipher(key, ...args) {
+    abytes3(key, void 0, "key");
+    if (params.nonceLength !== void 0) {
+      const nonce = args[0];
+      abytes3(nonce, params.varSizeNonce ? void 0 : params.nonceLength, "nonce");
+    }
+    const tagl = params.tagLength;
+    if (tagl && args[1] !== void 0)
+      abytes3(args[1], void 0, "AAD");
+    const cipher = constructor(key, ...args);
+    const checkOutput = (fnLength, output) => {
+      if (output !== void 0) {
+        if (fnLength !== 2)
+          throw new Error("cipher output not supported");
+        abytes3(output, void 0, "output");
+      }
+    };
+    let called = false;
+    const wrCipher = {
+      encrypt(data, output) {
+        if (called)
+          throw new Error("cannot encrypt() twice with same key + nonce");
+        called = true;
+        abytes3(data);
+        checkOutput(cipher.encrypt.length, output);
+        return cipher.encrypt(data, output);
+      },
+      decrypt(data, output) {
+        abytes3(data);
+        if (tagl && data.length < tagl)
+          throw new Error('"ciphertext" expected length bigger than tagLength=' + tagl);
+        checkOutput(cipher.decrypt.length, output);
+        return cipher.decrypt(data, output);
+      }
+    };
+    return wrCipher;
+  }
+  Object.assign(wrappedCipher, params);
+  return wrappedCipher;
+};
+function getOutput(expectedLength, out, onlyAligned = true) {
+  if (out === void 0)
+    return new Uint8Array(expectedLength);
+  abytes3(out, void 0, "output");
+  if (out.length !== expectedLength)
+    throw new Error('"output" expected Uint8Array of length ' + expectedLength + ", got: " + out.length);
+  if (onlyAligned && !isAligned32(out))
+    throw new Error("invalid output, must be aligned");
+  return out;
+}
+function u64Lengths(dataLength, aadLength, isLE2) {
+  anumber3(dataLength);
+  anumber3(aadLength);
+  abool2(isLE2);
+  const num = new Uint8Array(16);
+  const view = createView2(num);
+  view.setBigUint64(0, BigInt(aadLength), isLE2);
+  view.setBigUint64(8, BigInt(dataLength), isLE2);
+  return num;
+}
+function isAligned32(bytes) {
+  return bytes.byteOffset % 4 === 0;
+}
+function copyBytes2(bytes) {
+  return Uint8Array.from(abytes3(bytes));
+}
+function randomBytes3(bytesLength = 32) {
+  anumber3(bytesLength);
+  const cr = typeof globalThis === "object" ? globalThis.crypto : null;
+  if (typeof cr?.getRandomValues !== "function")
+    throw new Error("crypto.getRandomValues must be defined");
+  return cr.getRandomValues(new Uint8Array(bytesLength));
+}
+
+// node_modules/@noble/ciphers/_arx.js
+var encodeStr = (str) => Uint8Array.from(str.split(""), (c) => c.charCodeAt(0));
+var sigma16_32 = /* @__PURE__ */ (() => swap32IfBE(u32(encodeStr("expand 16-byte k"))))();
+var sigma32_32 = /* @__PURE__ */ (() => swap32IfBE(u32(encodeStr("expand 32-byte k"))))();
+function rotl(a, b) {
+  return a << b | a >>> 32 - b;
+}
+var BLOCK_LEN = 64;
+var BLOCK_LEN32 = 16;
+var MAX_COUNTER = /* @__PURE__ */ (() => 2 ** 32 - 1)();
+var U32_EMPTY = /* @__PURE__ */ Uint32Array.of();
+function runCipher(core, sigma, key, nonce, data, output, counter, rounds) {
+  const len = data.length;
+  const block = new Uint8Array(BLOCK_LEN);
+  const b32 = u32(block);
+  const isAligned = isLE && isAligned32(data) && isAligned32(output);
+  const d32 = isAligned ? u32(data) : U32_EMPTY;
+  const o32 = isAligned ? u32(output) : U32_EMPTY;
+  if (!isLE) {
+    for (let pos = 0; pos < len; counter++) {
+      core(sigma, key, nonce, b32, counter, rounds);
+      swap32IfBE(b32);
+      if (counter >= MAX_COUNTER)
+        throw new Error("arx: counter overflow");
+      const take = Math.min(BLOCK_LEN, len - pos);
+      for (let j = 0, posj; j < take; j++) {
+        posj = pos + j;
+        output[posj] = data[posj] ^ block[j];
+      }
+      pos += take;
+    }
+    return;
+  }
+  for (let pos = 0; pos < len; counter++) {
+    core(sigma, key, nonce, b32, counter, rounds);
+    if (counter >= MAX_COUNTER)
+      throw new Error("arx: counter overflow");
+    const take = Math.min(BLOCK_LEN, len - pos);
+    if (isAligned && take === BLOCK_LEN) {
+      const pos32 = pos / 4;
+      if (pos % 4 !== 0)
+        throw new Error("arx: invalid block position");
+      for (let j = 0, posj; j < BLOCK_LEN32; j++) {
+        posj = pos32 + j;
+        o32[posj] = d32[posj] ^ b32[j];
+      }
+      pos += BLOCK_LEN;
+      continue;
+    }
+    for (let j = 0, posj; j < take; j++) {
+      posj = pos + j;
+      output[posj] = data[posj] ^ block[j];
+    }
+    pos += take;
+  }
+}
+function createCipher(core, opts) {
+  const { allowShortKeys, extendNonceFn, counterLength, counterRight, rounds } = checkOpts({ allowShortKeys: false, counterLength: 8, counterRight: false, rounds: 20 }, opts);
+  if (typeof core !== "function")
+    throw new Error("core must be a function");
+  anumber3(counterLength);
+  anumber3(rounds);
+  abool2(counterRight);
+  abool2(allowShortKeys);
+  return (key, nonce, data, output, counter = 0) => {
+    abytes3(key, void 0, "key");
+    abytes3(nonce, void 0, "nonce");
+    abytes3(data, void 0, "data");
+    const len = data.length;
+    output = getOutput(len, output, false);
+    anumber3(counter);
+    if (counter < 0 || counter >= MAX_COUNTER)
+      throw new Error("arx: counter overflow");
+    const toClean = [];
+    let l = key.length;
+    let k;
+    let sigma;
+    if (l === 32) {
+      toClean.push(k = copyBytes2(key));
+      sigma = sigma32_32;
+    } else if (l === 16 && allowShortKeys) {
+      k = new Uint8Array(32);
+      k.set(key);
+      k.set(key, 16);
+      sigma = sigma16_32;
+      toClean.push(k);
+    } else {
+      abytes3(key, 32, "arx key");
+      throw new Error("invalid key size");
+    }
+    if (!isLE || !isAligned32(nonce))
+      toClean.push(nonce = copyBytes2(nonce));
+    let k32 = u32(k);
+    if (extendNonceFn) {
+      if (nonce.length !== 24)
+        throw new Error(`arx: extended nonce must be 24 bytes`);
+      const n16 = nonce.subarray(0, 16);
+      if (isLE)
+        extendNonceFn(sigma, k32, u32(n16), k32);
+      else {
+        const sigmaRaw = swap32IfBE(Uint32Array.from(sigma));
+        extendNonceFn(sigmaRaw, k32, u32(n16), k32);
+        clean2(sigmaRaw);
+        swap32IfBE(k32);
+      }
+      nonce = nonce.subarray(16);
+    } else if (!isLE)
+      swap32IfBE(k32);
+    const nonceNcLen = 16 - counterLength;
+    if (nonceNcLen !== nonce.length)
+      throw new Error(`arx: nonce must be ${nonceNcLen} or 16 bytes`);
+    if (nonceNcLen !== 12) {
+      const nc = new Uint8Array(12);
+      nc.set(nonce, counterRight ? 0 : 12 - nonce.length);
+      nonce = nc;
+      toClean.push(nonce);
+    }
+    const n32 = swap32IfBE(u32(nonce));
+    try {
+      runCipher(core, sigma, k32, n32, data, output, counter, rounds);
+      return output;
+    } finally {
+      clean2(...toClean);
+    }
+  };
+}
+
+// node_modules/@noble/ciphers/_poly1305.js
+function u8to16(a, i) {
+  return a[i++] & 255 | (a[i++] & 255) << 8;
+}
+var Poly1305 = class {
+  blockLen = 16;
+  outputLen = 16;
+  buffer = new Uint8Array(16);
+  r = new Uint16Array(10);
+  // Allocating 1 array with .subarray() here is slower than 3
+  h = new Uint16Array(10);
+  pad = new Uint16Array(8);
+  pos = 0;
+  finished = false;
+  destroyed = false;
+  // Can be speed-up using BigUint64Array, at the cost of complexity
+  constructor(key) {
+    key = copyBytes2(abytes3(key, 32, "key"));
+    const t0 = u8to16(key, 0);
+    const t1 = u8to16(key, 2);
+    const t2 = u8to16(key, 4);
+    const t3 = u8to16(key, 6);
+    const t4 = u8to16(key, 8);
+    const t5 = u8to16(key, 10);
+    const t6 = u8to16(key, 12);
+    const t7 = u8to16(key, 14);
+    this.r[0] = t0 & 8191;
+    this.r[1] = (t0 >>> 13 | t1 << 3) & 8191;
+    this.r[2] = (t1 >>> 10 | t2 << 6) & 7939;
+    this.r[3] = (t2 >>> 7 | t3 << 9) & 8191;
+    this.r[4] = (t3 >>> 4 | t4 << 12) & 255;
+    this.r[5] = t4 >>> 1 & 8190;
+    this.r[6] = (t4 >>> 14 | t5 << 2) & 8191;
+    this.r[7] = (t5 >>> 11 | t6 << 5) & 8065;
+    this.r[8] = (t6 >>> 8 | t7 << 8) & 8191;
+    this.r[9] = t7 >>> 5 & 127;
+    for (let i = 0; i < 8; i++)
+      this.pad[i] = u8to16(key, 16 + 2 * i);
+  }
+  process(data, offset, isLast = false) {
+    const hibit = isLast ? 0 : 1 << 11;
+    const { h, r } = this;
+    const r0 = r[0];
+    const r1 = r[1];
+    const r2 = r[2];
+    const r3 = r[3];
+    const r4 = r[4];
+    const r5 = r[5];
+    const r6 = r[6];
+    const r7 = r[7];
+    const r8 = r[8];
+    const r9 = r[9];
+    const t0 = u8to16(data, offset + 0);
+    const t1 = u8to16(data, offset + 2);
+    const t2 = u8to16(data, offset + 4);
+    const t3 = u8to16(data, offset + 6);
+    const t4 = u8to16(data, offset + 8);
+    const t5 = u8to16(data, offset + 10);
+    const t6 = u8to16(data, offset + 12);
+    const t7 = u8to16(data, offset + 14);
+    let h0 = h[0] + (t0 & 8191);
+    let h1 = h[1] + ((t0 >>> 13 | t1 << 3) & 8191);
+    let h2 = h[2] + ((t1 >>> 10 | t2 << 6) & 8191);
+    let h3 = h[3] + ((t2 >>> 7 | t3 << 9) & 8191);
+    let h4 = h[4] + ((t3 >>> 4 | t4 << 12) & 8191);
+    let h5 = h[5] + (t4 >>> 1 & 8191);
+    let h6 = h[6] + ((t4 >>> 14 | t5 << 2) & 8191);
+    let h7 = h[7] + ((t5 >>> 11 | t6 << 5) & 8191);
+    let h8 = h[8] + ((t6 >>> 8 | t7 << 8) & 8191);
+    let h9 = h[9] + (t7 >>> 5 | hibit);
+    let c = 0;
+    let d0 = c + h0 * r0 + h1 * (5 * r9) + h2 * (5 * r8) + h3 * (5 * r7) + h4 * (5 * r6);
+    c = d0 >>> 13;
+    d0 &= 8191;
+    d0 += h5 * (5 * r5) + h6 * (5 * r4) + h7 * (5 * r3) + h8 * (5 * r2) + h9 * (5 * r1);
+    c += d0 >>> 13;
+    d0 &= 8191;
+    let d1 = c + h0 * r1 + h1 * r0 + h2 * (5 * r9) + h3 * (5 * r8) + h4 * (5 * r7);
+    c = d1 >>> 13;
+    d1 &= 8191;
+    d1 += h5 * (5 * r6) + h6 * (5 * r5) + h7 * (5 * r4) + h8 * (5 * r3) + h9 * (5 * r2);
+    c += d1 >>> 13;
+    d1 &= 8191;
+    let d2 = c + h0 * r2 + h1 * r1 + h2 * r0 + h3 * (5 * r9) + h4 * (5 * r8);
+    c = d2 >>> 13;
+    d2 &= 8191;
+    d2 += h5 * (5 * r7) + h6 * (5 * r6) + h7 * (5 * r5) + h8 * (5 * r4) + h9 * (5 * r3);
+    c += d2 >>> 13;
+    d2 &= 8191;
+    let d3 = c + h0 * r3 + h1 * r2 + h2 * r1 + h3 * r0 + h4 * (5 * r9);
+    c = d3 >>> 13;
+    d3 &= 8191;
+    d3 += h5 * (5 * r8) + h6 * (5 * r7) + h7 * (5 * r6) + h8 * (5 * r5) + h9 * (5 * r4);
+    c += d3 >>> 13;
+    d3 &= 8191;
+    let d4 = c + h0 * r4 + h1 * r3 + h2 * r2 + h3 * r1 + h4 * r0;
+    c = d4 >>> 13;
+    d4 &= 8191;
+    d4 += h5 * (5 * r9) + h6 * (5 * r8) + h7 * (5 * r7) + h8 * (5 * r6) + h9 * (5 * r5);
+    c += d4 >>> 13;
+    d4 &= 8191;
+    let d5 = c + h0 * r5 + h1 * r4 + h2 * r3 + h3 * r2 + h4 * r1;
+    c = d5 >>> 13;
+    d5 &= 8191;
+    d5 += h5 * r0 + h6 * (5 * r9) + h7 * (5 * r8) + h8 * (5 * r7) + h9 * (5 * r6);
+    c += d5 >>> 13;
+    d5 &= 8191;
+    let d6 = c + h0 * r6 + h1 * r5 + h2 * r4 + h3 * r3 + h4 * r2;
+    c = d6 >>> 13;
+    d6 &= 8191;
+    d6 += h5 * r1 + h6 * r0 + h7 * (5 * r9) + h8 * (5 * r8) + h9 * (5 * r7);
+    c += d6 >>> 13;
+    d6 &= 8191;
+    let d7 = c + h0 * r7 + h1 * r6 + h2 * r5 + h3 * r4 + h4 * r3;
+    c = d7 >>> 13;
+    d7 &= 8191;
+    d7 += h5 * r2 + h6 * r1 + h7 * r0 + h8 * (5 * r9) + h9 * (5 * r8);
+    c += d7 >>> 13;
+    d7 &= 8191;
+    let d8 = c + h0 * r8 + h1 * r7 + h2 * r6 + h3 * r5 + h4 * r4;
+    c = d8 >>> 13;
+    d8 &= 8191;
+    d8 += h5 * r3 + h6 * r2 + h7 * r1 + h8 * r0 + h9 * (5 * r9);
+    c += d8 >>> 13;
+    d8 &= 8191;
+    let d9 = c + h0 * r9 + h1 * r8 + h2 * r7 + h3 * r6 + h4 * r5;
+    c = d9 >>> 13;
+    d9 &= 8191;
+    d9 += h5 * r4 + h6 * r3 + h7 * r2 + h8 * r1 + h9 * r0;
+    c += d9 >>> 13;
+    d9 &= 8191;
+    c = (c << 2) + c | 0;
+    c = c + d0 | 0;
+    d0 = c & 8191;
+    c = c >>> 13;
+    d1 += c;
+    h[0] = d0;
+    h[1] = d1;
+    h[2] = d2;
+    h[3] = d3;
+    h[4] = d4;
+    h[5] = d5;
+    h[6] = d6;
+    h[7] = d7;
+    h[8] = d8;
+    h[9] = d9;
+  }
+  finalize() {
+    const { h, pad } = this;
+    const g = new Uint16Array(10);
+    let c = h[1] >>> 13;
+    h[1] &= 8191;
+    for (let i = 2; i < 10; i++) {
+      h[i] += c;
+      c = h[i] >>> 13;
+      h[i] &= 8191;
+    }
+    h[0] += c * 5;
+    c = h[0] >>> 13;
+    h[0] &= 8191;
+    h[1] += c;
+    c = h[1] >>> 13;
+    h[1] &= 8191;
+    h[2] += c;
+    g[0] = h[0] + 5;
+    c = g[0] >>> 13;
+    g[0] &= 8191;
+    for (let i = 1; i < 10; i++) {
+      g[i] = h[i] + c;
+      c = g[i] >>> 13;
+      g[i] &= 8191;
+    }
+    g[9] -= 1 << 13;
+    let mask = (c ^ 1) - 1;
+    for (let i = 0; i < 10; i++)
+      g[i] &= mask;
+    mask = ~mask;
+    for (let i = 0; i < 10; i++)
+      h[i] = h[i] & mask | g[i];
+    h[0] = (h[0] | h[1] << 13) & 65535;
+    h[1] = (h[1] >>> 3 | h[2] << 10) & 65535;
+    h[2] = (h[2] >>> 6 | h[3] << 7) & 65535;
+    h[3] = (h[3] >>> 9 | h[4] << 4) & 65535;
+    h[4] = (h[4] >>> 12 | h[5] << 1 | h[6] << 14) & 65535;
+    h[5] = (h[6] >>> 2 | h[7] << 11) & 65535;
+    h[6] = (h[7] >>> 5 | h[8] << 8) & 65535;
+    h[7] = (h[8] >>> 8 | h[9] << 5) & 65535;
+    let f = h[0] + pad[0];
+    h[0] = f & 65535;
+    for (let i = 1; i < 8; i++) {
+      f = (h[i] + pad[i] | 0) + (f >>> 16) | 0;
+      h[i] = f & 65535;
+    }
+    clean2(g);
+  }
+  update(data) {
+    aexists2(this);
+    abytes3(data);
+    data = copyBytes2(data);
+    const { buffer, blockLen } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      if (take === blockLen) {
+        for (; blockLen <= len - pos; pos += blockLen)
+          this.process(data, pos);
+        continue;
+      }
+      buffer.set(data.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(buffer, 0, false);
+        this.pos = 0;
+      }
+    }
+    return this;
+  }
+  destroy() {
+    this.destroyed = true;
+    clean2(this.h, this.r, this.buffer, this.pad);
+  }
+  digestInto(out) {
+    aexists2(this);
+    aoutput2(out, this);
+    this.finished = true;
+    const { buffer, h } = this;
+    let { pos } = this;
+    if (pos) {
+      buffer[pos++] = 1;
+      for (; pos < 16; pos++)
+        buffer[pos] = 0;
+      this.process(buffer, 0, true);
+    }
+    this.finalize();
+    let opos = 0;
+    for (let i = 0; i < 8; i++) {
+      out[opos++] = h[i] >>> 0;
+      out[opos++] = h[i] >>> 8;
+    }
+  }
+  digest() {
+    const { buffer, outputLen } = this;
+    this.digestInto(buffer);
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res;
+  }
+};
+var poly1305 = /* @__PURE__ */ wrapMacConstructor(32, (key) => new Poly1305(key));
+
+// node_modules/@noble/ciphers/chacha.js
+function chachaCore(s, k, n, out, cnt, rounds = 20) {
+  let y00 = s[0], y01 = s[1], y02 = s[2], y03 = s[3], y04 = k[0], y05 = k[1], y06 = k[2], y07 = k[3], y08 = k[4], y09 = k[5], y10 = k[6], y11 = k[7], y12 = cnt, y13 = n[0], y14 = n[1], y15 = n[2];
+  let x00 = y00, x01 = y01, x02 = y02, x03 = y03, x04 = y04, x05 = y05, x06 = y06, x07 = y07, x08 = y08, x09 = y09, x10 = y10, x11 = y11, x12 = y12, x13 = y13, x14 = y14, x15 = y15;
+  for (let r = 0; r < rounds; r += 2) {
+    x00 = x00 + x04 | 0;
+    x12 = rotl(x12 ^ x00, 16);
+    x08 = x08 + x12 | 0;
+    x04 = rotl(x04 ^ x08, 12);
+    x00 = x00 + x04 | 0;
+    x12 = rotl(x12 ^ x00, 8);
+    x08 = x08 + x12 | 0;
+    x04 = rotl(x04 ^ x08, 7);
+    x01 = x01 + x05 | 0;
+    x13 = rotl(x13 ^ x01, 16);
+    x09 = x09 + x13 | 0;
+    x05 = rotl(x05 ^ x09, 12);
+    x01 = x01 + x05 | 0;
+    x13 = rotl(x13 ^ x01, 8);
+    x09 = x09 + x13 | 0;
+    x05 = rotl(x05 ^ x09, 7);
+    x02 = x02 + x06 | 0;
+    x14 = rotl(x14 ^ x02, 16);
+    x10 = x10 + x14 | 0;
+    x06 = rotl(x06 ^ x10, 12);
+    x02 = x02 + x06 | 0;
+    x14 = rotl(x14 ^ x02, 8);
+    x10 = x10 + x14 | 0;
+    x06 = rotl(x06 ^ x10, 7);
+    x03 = x03 + x07 | 0;
+    x15 = rotl(x15 ^ x03, 16);
+    x11 = x11 + x15 | 0;
+    x07 = rotl(x07 ^ x11, 12);
+    x03 = x03 + x07 | 0;
+    x15 = rotl(x15 ^ x03, 8);
+    x11 = x11 + x15 | 0;
+    x07 = rotl(x07 ^ x11, 7);
+    x00 = x00 + x05 | 0;
+    x15 = rotl(x15 ^ x00, 16);
+    x10 = x10 + x15 | 0;
+    x05 = rotl(x05 ^ x10, 12);
+    x00 = x00 + x05 | 0;
+    x15 = rotl(x15 ^ x00, 8);
+    x10 = x10 + x15 | 0;
+    x05 = rotl(x05 ^ x10, 7);
+    x01 = x01 + x06 | 0;
+    x12 = rotl(x12 ^ x01, 16);
+    x11 = x11 + x12 | 0;
+    x06 = rotl(x06 ^ x11, 12);
+    x01 = x01 + x06 | 0;
+    x12 = rotl(x12 ^ x01, 8);
+    x11 = x11 + x12 | 0;
+    x06 = rotl(x06 ^ x11, 7);
+    x02 = x02 + x07 | 0;
+    x13 = rotl(x13 ^ x02, 16);
+    x08 = x08 + x13 | 0;
+    x07 = rotl(x07 ^ x08, 12);
+    x02 = x02 + x07 | 0;
+    x13 = rotl(x13 ^ x02, 8);
+    x08 = x08 + x13 | 0;
+    x07 = rotl(x07 ^ x08, 7);
+    x03 = x03 + x04 | 0;
+    x14 = rotl(x14 ^ x03, 16);
+    x09 = x09 + x14 | 0;
+    x04 = rotl(x04 ^ x09, 12);
+    x03 = x03 + x04 | 0;
+    x14 = rotl(x14 ^ x03, 8);
+    x09 = x09 + x14 | 0;
+    x04 = rotl(x04 ^ x09, 7);
+  }
+  let oi = 0;
+  out[oi++] = y00 + x00 | 0;
+  out[oi++] = y01 + x01 | 0;
+  out[oi++] = y02 + x02 | 0;
+  out[oi++] = y03 + x03 | 0;
+  out[oi++] = y04 + x04 | 0;
+  out[oi++] = y05 + x05 | 0;
+  out[oi++] = y06 + x06 | 0;
+  out[oi++] = y07 + x07 | 0;
+  out[oi++] = y08 + x08 | 0;
+  out[oi++] = y09 + x09 | 0;
+  out[oi++] = y10 + x10 | 0;
+  out[oi++] = y11 + x11 | 0;
+  out[oi++] = y12 + x12 | 0;
+  out[oi++] = y13 + x13 | 0;
+  out[oi++] = y14 + x14 | 0;
+  out[oi++] = y15 + x15 | 0;
+}
+function hchacha(s, k, i, out) {
+  let x00 = swap8IfBE(s[0]), x01 = swap8IfBE(s[1]), x02 = swap8IfBE(s[2]), x03 = swap8IfBE(s[3]), x04 = swap8IfBE(k[0]), x05 = swap8IfBE(k[1]), x06 = swap8IfBE(k[2]), x07 = swap8IfBE(k[3]), x08 = swap8IfBE(k[4]), x09 = swap8IfBE(k[5]), x10 = swap8IfBE(k[6]), x11 = swap8IfBE(k[7]), x12 = swap8IfBE(i[0]), x13 = swap8IfBE(i[1]), x14 = swap8IfBE(i[2]), x15 = swap8IfBE(i[3]);
+  for (let r = 0; r < 20; r += 2) {
+    x00 = x00 + x04 | 0;
+    x12 = rotl(x12 ^ x00, 16);
+    x08 = x08 + x12 | 0;
+    x04 = rotl(x04 ^ x08, 12);
+    x00 = x00 + x04 | 0;
+    x12 = rotl(x12 ^ x00, 8);
+    x08 = x08 + x12 | 0;
+    x04 = rotl(x04 ^ x08, 7);
+    x01 = x01 + x05 | 0;
+    x13 = rotl(x13 ^ x01, 16);
+    x09 = x09 + x13 | 0;
+    x05 = rotl(x05 ^ x09, 12);
+    x01 = x01 + x05 | 0;
+    x13 = rotl(x13 ^ x01, 8);
+    x09 = x09 + x13 | 0;
+    x05 = rotl(x05 ^ x09, 7);
+    x02 = x02 + x06 | 0;
+    x14 = rotl(x14 ^ x02, 16);
+    x10 = x10 + x14 | 0;
+    x06 = rotl(x06 ^ x10, 12);
+    x02 = x02 + x06 | 0;
+    x14 = rotl(x14 ^ x02, 8);
+    x10 = x10 + x14 | 0;
+    x06 = rotl(x06 ^ x10, 7);
+    x03 = x03 + x07 | 0;
+    x15 = rotl(x15 ^ x03, 16);
+    x11 = x11 + x15 | 0;
+    x07 = rotl(x07 ^ x11, 12);
+    x03 = x03 + x07 | 0;
+    x15 = rotl(x15 ^ x03, 8);
+    x11 = x11 + x15 | 0;
+    x07 = rotl(x07 ^ x11, 7);
+    x00 = x00 + x05 | 0;
+    x15 = rotl(x15 ^ x00, 16);
+    x10 = x10 + x15 | 0;
+    x05 = rotl(x05 ^ x10, 12);
+    x00 = x00 + x05 | 0;
+    x15 = rotl(x15 ^ x00, 8);
+    x10 = x10 + x15 | 0;
+    x05 = rotl(x05 ^ x10, 7);
+    x01 = x01 + x06 | 0;
+    x12 = rotl(x12 ^ x01, 16);
+    x11 = x11 + x12 | 0;
+    x06 = rotl(x06 ^ x11, 12);
+    x01 = x01 + x06 | 0;
+    x12 = rotl(x12 ^ x01, 8);
+    x11 = x11 + x12 | 0;
+    x06 = rotl(x06 ^ x11, 7);
+    x02 = x02 + x07 | 0;
+    x13 = rotl(x13 ^ x02, 16);
+    x08 = x08 + x13 | 0;
+    x07 = rotl(x07 ^ x08, 12);
+    x02 = x02 + x07 | 0;
+    x13 = rotl(x13 ^ x02, 8);
+    x08 = x08 + x13 | 0;
+    x07 = rotl(x07 ^ x08, 7);
+    x03 = x03 + x04 | 0;
+    x14 = rotl(x14 ^ x03, 16);
+    x09 = x09 + x14 | 0;
+    x04 = rotl(x04 ^ x09, 12);
+    x03 = x03 + x04 | 0;
+    x14 = rotl(x14 ^ x03, 8);
+    x09 = x09 + x14 | 0;
+    x04 = rotl(x04 ^ x09, 7);
+  }
+  let oi = 0;
+  out[oi++] = x00;
+  out[oi++] = x01;
+  out[oi++] = x02;
+  out[oi++] = x03;
+  out[oi++] = x12;
+  out[oi++] = x13;
+  out[oi++] = x14;
+  out[oi++] = x15;
+  swap32IfBE(out);
+}
+var xchacha20 = /* @__PURE__ */ createCipher(chachaCore, {
+  counterRight: false,
+  counterLength: 8,
+  extendNonceFn: hchacha,
+  allowShortKeys: false
+});
+var ZEROS16 = /* @__PURE__ */ new Uint8Array(16);
+var updatePadded = (h, msg) => {
+  h.update(msg);
+  const leftover = msg.length % 16;
+  if (leftover)
+    h.update(ZEROS16.subarray(leftover));
+};
+var ZEROS32 = /* @__PURE__ */ new Uint8Array(32);
+function computeTag(fn, key, nonce, ciphertext, AAD) {
+  if (AAD !== void 0)
+    abytes3(AAD, void 0, "AAD");
+  const authKey = fn(key, nonce, ZEROS32);
+  const lengths = u64Lengths(ciphertext.length, AAD ? AAD.length : 0, true);
+  const h = poly1305.create(authKey);
+  if (AAD)
+    updatePadded(h, AAD);
+  updatePadded(h, ciphertext);
+  h.update(lengths);
+  const res = h.digest();
+  clean2(authKey, lengths);
+  return res;
+}
+var _poly1305_aead = (xorStream) => (key, nonce, AAD) => {
+  const tagLength = 16;
+  return {
+    encrypt(plaintext, output) {
+      const plength = plaintext.length;
+      output = getOutput(plength + tagLength, output, false);
+      output.set(plaintext);
+      const oPlain = output.subarray(0, -tagLength);
+      xorStream(key, nonce, oPlain, oPlain, 1);
+      const tag = computeTag(xorStream, key, nonce, oPlain, AAD);
+      output.set(tag, plength);
+      clean2(tag);
+      return output;
+    },
+    decrypt(ciphertext, output) {
+      output = getOutput(ciphertext.length - tagLength, output, false);
+      const data = ciphertext.subarray(0, -tagLength);
+      const passedTag = ciphertext.subarray(-tagLength);
+      const tag = computeTag(xorStream, key, nonce, data, AAD);
+      if (!equalBytes(passedTag, tag)) {
+        clean2(tag);
+        throw new Error("invalid tag");
+      }
+      output.set(ciphertext.subarray(0, -tagLength));
+      xorStream(key, nonce, output, output, 1);
+      clean2(tag);
+      return output;
+    }
+  };
+};
+var xchacha20poly1305 = /* @__PURE__ */ wrapCipher(
+  { blockSize: 64, nonceLength: 24, tagLength: 16 },
+  /* @__PURE__ */ _poly1305_aead(xchacha20)
+);
+
+// core/errors.ts
+var SphereError = class extends Error {
+  code;
+  cause;
+  /**
+   * #441 deferred-paid linkage: the transferId of the possibly-committed send,
+   * stamped by `sendOnce` before the error leaves so a payment-request consumer
+   * can durably journal request→transfer and resolve 'paid' only when that
+   * transfer actually completes (never optimistically). Present ONLY on
+   * possibly-committed outcomes ({@link isPossiblyCommittedSendOutcome}).
+   */
+  transferId;
+  constructor(message, code, cause) {
+    super(message);
+    this.name = "SphereError";
+    this.code = code;
+    this.cause = cause;
+  }
+};
+
+// core/field-encryption.ts
+var FIELD_ENVELOPE_PREFIX = "enc1.";
+var FIELD_ENVELOPE_NONCE_BYTES = 24;
+var POLY1305_TAG_BYTES = 16;
+var B64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var B64_LOOKUP = {};
+for (let i = 0; i < B64_ALPHABET.length; i++) B64_LOOKUP[B64_ALPHABET[i]] = i;
+function base64Encode(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i];
+    const b1 = i + 1 < bytes.length ? bytes[i + 1] : 0;
+    const b2 = i + 2 < bytes.length ? bytes[i + 2] : 0;
+    out += B64_ALPHABET[b0 >> 2];
+    out += B64_ALPHABET[(b0 & 3) << 4 | b1 >> 4];
+    out += i + 1 < bytes.length ? B64_ALPHABET[(b1 & 15) << 2 | b2 >> 6] : "=";
+    out += i + 2 < bytes.length ? B64_ALPHABET[b2 & 63] : "=";
+  }
+  return out;
+}
+function base64Decode(s) {
+  if (s.length % 4 !== 0) {
+    throw new SphereError("Invalid field envelope: base64 length not a multiple of 4", "DECRYPTION_ERROR");
+  }
+  let padding = 0;
+  if (s.endsWith("==")) padding = 2;
+  else if (s.endsWith("=")) padding = 1;
+  const body = s.slice(0, s.length - padding);
+  if (body.includes("=")) {
+    throw new SphereError("Invalid field envelope: misplaced base64 padding", "DECRYPTION_ERROR");
+  }
+  const out = new Uint8Array(s.length / 4 * 3 - padding);
+  let o = 0;
+  for (let i = 0; i < body.length; i += 4) {
+    const n0 = B64_LOOKUP[body[i]];
+    const n1 = B64_LOOKUP[body[i + 1]];
+    const n2 = body[i + 2] !== void 0 ? B64_LOOKUP[body[i + 2]] : 0;
+    const n3 = body[i + 3] !== void 0 ? B64_LOOKUP[body[i + 3]] : 0;
+    if (n0 === void 0 || n1 === void 0 || n2 === void 0 || n3 === void 0) {
+      throw new SphereError("Invalid field envelope: non-base64 character", "DECRYPTION_ERROR");
+    }
+    const triple = n0 << 18 | n1 << 12 | n2 << 6 | n3;
+    if (o < out.length) out[o++] = triple >> 16 & 255;
+    if (o < out.length) out[o++] = triple >> 8 & 255;
+    if (o < out.length) out[o++] = triple & 255;
+  }
+  return out;
+}
+function encryptFieldBytes(key, plaintext, aad) {
+  const nonce = randomBytes3(FIELD_ENVELOPE_NONCE_BYTES);
+  const ciphertext = xchacha20poly1305(key, nonce, aad).encrypt(plaintext);
+  const packed = new Uint8Array(nonce.length + ciphertext.length);
+  packed.set(nonce, 0);
+  packed.set(ciphertext, nonce.length);
+  return FIELD_ENVELOPE_PREFIX + base64Encode(packed);
+}
+function decryptFieldBytes(key, envelope, aad) {
+  if (typeof envelope !== "string" || !envelope.startsWith(FIELD_ENVELOPE_PREFIX)) {
+    throw new SphereError('Invalid field envelope: missing "enc1." prefix', "DECRYPTION_ERROR");
+  }
+  const packed = base64Decode(envelope.slice(FIELD_ENVELOPE_PREFIX.length));
+  if (packed.length < FIELD_ENVELOPE_NONCE_BYTES + POLY1305_TAG_BYTES) {
+    throw new SphereError("Invalid field envelope: too short for nonce + tag", "DECRYPTION_ERROR");
+  }
+  const nonce = packed.slice(0, FIELD_ENVELOPE_NONCE_BYTES);
+  const ciphertext = packed.slice(FIELD_ENVELOPE_NONCE_BYTES);
+  try {
+    return xchacha20poly1305(key, nonce, aad).decrypt(ciphertext);
+  } catch (err) {
+    throw new SphereError("Field envelope authentication failed (tampered, wrong key, or wrong AAD)", "DECRYPTION_ERROR", err);
+  }
+}
+function encryptField(key, plaintext) {
+  return encryptFieldBytes(key, new TextEncoder().encode(plaintext));
+}
+function decryptField(key, envelope) {
+  return new TextDecoder().decode(decryptFieldBytes(key, envelope));
+}
+
+// core/delivery-envelope.ts
+var DELIVERY_ENCRYPTION_HKDF_INFO = "sphere-deliveryenc-v1";
+function hexToBytesStrict(hex, what) {
+  if (hex.length === 0 || hex.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(hex)) {
+    throw new SphereError(`Invalid ${what} hex for delivery-envelope key derivation`, "INVALID_CONFIG");
+  }
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+function deriveDeliveryEncryptionKey(privKeyHex, peerPubkeyHex) {
+  const priv = hexToBytesStrict(privKeyHex, "private key");
+  const peerPub = hexToBytesStrict(peerPubkeyHex, "peer public key");
+  const shared = secp256k1.getSharedSecret(priv, peerPub);
+  const info = new TextEncoder().encode(DELIVERY_ENCRYPTION_HKDF_INFO);
+  return hkdf(sha256, shared, void 0, info, 32);
+}
+function encryptDeliveryBundle(key, bundle) {
+  const compact = {};
+  if (bundle.senderNametag !== void 0 && bundle.senderNametag !== "") compact.n = bundle.senderNametag;
+  if (bundle.memo !== void 0 && bundle.memo !== "") compact.t = bundle.memo;
+  if (compact.n === void 0 && compact.t === void 0) return void 0;
+  return encryptField(key, JSON.stringify(compact));
+}
+function decryptDeliveryBundle(key, envelope) {
+  const plaintext = decryptField(key, envelope);
+  let parsed;
+  try {
+    parsed = JSON.parse(plaintext);
+  } catch (err) {
+    throw new SphereError("Delivery envelope payload is not valid JSON", "DECRYPTION_ERROR", err);
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new SphereError("Delivery envelope payload is not an object", "DECRYPTION_ERROR");
+  }
+  const obj = parsed;
+  const bundle = {};
+  if (typeof obj.n === "string") bundle.senderNametag = obj.n;
+  if (typeof obj.t === "string") bundle.memo = obj.t;
+  return bundle;
+}
+
+// impl/wallet-api-v2/mailbox.ts
+var DeliveryKeysUnboundError = class extends Error {
+  code = "DELIVERY_KEYS_UNBOUND";
+  constructor() {
+    super("deliveryKeys derivation not bound \u2014 bindDeliveryKeys(engine.deliveryKeys) must run first (S7)");
+    this.name = "DeliveryKeysUnboundError";
+  }
+};
+var MailboxClaimFailedError = class extends Error {
+  constructor(deliveryId, failureCode) {
+    super(`mailbox claim failed for ${deliveryId}: ${failureCode}`);
+    this.failureCode = failureCode;
+    this.name = "MailboxClaimFailedError";
+  }
+  code = "MAILBOX_CLAIM_FAILED";
+};
+var DeliveryProtocolError = class extends Error {
+  code = "PROTOCOL";
+  constructor(message) {
+    super(message);
+    this.name = "DeliveryProtocolError";
+  }
+};
+function hexToBytes3(hex) {
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+function bytesToHex4(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function computeDeliveryId(tokenIdHex, stateHashHex) {
+  const tokenId = hexToBytes3(tokenIdHex);
+  const stateHash = hexToBytes3(stateHashHex);
+  const joined = new Uint8Array(tokenId.length + stateHash.length);
+  joined.set(tokenId, 0);
+  joined.set(stateHash, tokenId.length);
+  return bytesToHex4(sha256(joined));
+}
+var DELIVERY_SEEN_KEY = "delivery:seen";
+var WalletApiDeliveryPort = class {
+  custody;
+  client;
+  kv;
+  identity;
+  wake;
+  deriveFn;
+  seenChain = Promise.resolve();
+  constructor(config) {
+    this.client = config.client;
+    this.kv = config.kv;
+    this.identity = config.identity;
+    this.custody = config.custody;
+    this.wake = config.wake ?? null;
+    this.deriveFn = config.deliveryKeys ?? null;
+  }
+  bindDeliveryKeys(derive) {
+    this.deriveFn = derive;
+  }
+  deriveKeys(blob) {
+    if (this.deriveFn === null) throw new DeliveryKeysUnboundError();
+    return this.deriveFn(blob);
+  }
+  // ── deliver ────────────────────────────────────────────────────────────────
+  async deliver(recipientPubkey, blob, options) {
+    const receipts = await this.deliverBatch(recipientPubkey, [blob], options);
+    const first = receipts[0];
+    if (first === void 0) throw new DeliveryProtocolError("deliver produced no receipt");
+    return first;
+  }
+  async deliverBatch(recipientPubkey, blobs, options) {
+    if (blobs.length === 0) return [];
+    const prepared = await Promise.all(blobs.map(async (bytes) => this.prepare(bytes)));
+    const envelope = this.buildEnvelope(recipientPubkey, options);
+    const keyBySha = await this.upload(prepared);
+    const entries = prepared.map((p) => {
+      const key = keyBySha.get(p.sha);
+      if (key === void 0) throw new DeliveryProtocolError(`upload returned no key for sha256 ${p.sha}`);
+      return {
+        recipientPubkey,
+        key,
+        transferId: options.transferId,
+        tokenId: p.tokenId,
+        stateHash: p.stateHash,
+        ...envelope !== void 0 ? { memo: envelope } : {}
+      };
+    });
+    return this.depositAll(entries, prepared.map((p) => p.deliveryId));
+  }
+  async prepare(bytes) {
+    const keys = await this.deriveKeys(bytes);
+    return {
+      bytes,
+      tokenId: keys.tokenId,
+      stateHash: keys.stateHash,
+      deliveryId: computeDeliveryId(keys.tokenId, keys.stateHash),
+      sha: bytesToHex4(sha256(bytes))
+    };
+  }
+  buildEnvelope(recipientPubkey, options) {
+    const key = deriveDeliveryEncryptionKey(this.identity.privateKey, recipientPubkey);
+    return encryptDeliveryBundle(key, {
+      senderNametag: options.senderNametag ?? this.identity.nametag,
+      memo: options.memo
+    });
+  }
+  async upload(prepared) {
+    const urls = await this.client.uploadUrls(prepared.map((p) => ({ sha256: p.sha, size: p.bytes.length })));
+    const urlBySha = new Map(urls.map((u) => [u.sha256, u]));
+    const uploads = prepared.map((p) => {
+      const url = urlBySha.get(p.sha);
+      if (url === void 0) throw new DeliveryProtocolError(`upload-urls response missing sha256 ${p.sha}`);
+      return { p, url };
+    });
+    await mapBounded(uploads, WALLET_API_V2_FANOUT_WIDTH, ({ p, url }) => this.client.uploadBlob(url.putUrl, p.bytes));
+    return new Map(uploads.map(({ url }) => [url.sha256, url.key]));
+  }
+  async depositAll(entries, deliveryIds) {
+    if (entries.length > 1) {
+      try {
+        const results = await this.client.depositBatch(entries);
+        if (results.length !== entries.length) {
+          throw new DeliveryProtocolError(
+            `mailbox batch deposit returned ${String(results.length)} entries for ${String(entries.length)}`
+          );
+        }
+        return deliveryIds.map((deliveryId) => ({ deliveryId }));
+      } catch (err) {
+        if (!isWalletApiHttpError(err, 409)) throw err;
+      }
+    }
+    const receipts = [];
+    for (const [i, entry] of entries.entries()) {
+      receipts.push(await this.depositOne(entry, deliveryIds[i]));
+    }
+    return receipts;
+  }
+  async depositOne(entry, deliveryId) {
+    try {
+      await this.client.deposit(entry);
+    } catch (err) {
+      if (!isWalletApiHttpError(err, 409)) throw err;
+    }
+    return { deliveryId };
+  }
+  // ── incoming ───────────────────────────────────────────────────────────────
+  async *incoming(sinceCursor) {
+    const seen = await this.readSeen();
+    let page = await this.client.listMailbox(sinceCursor === void 0 ? 0 : Number(sinceCursor));
+    for (; ; ) {
+      for (const entry of page.entries) {
+        if (entry.status !== "unclaimed") continue;
+        if (seen.has(entry.entryId)) continue;
+        yield this.toIncoming(entry);
+      }
+      if (!page.more) return;
+      page = await this.client.listMailbox(page.cursor);
+    }
+  }
+  toIncoming(entry) {
+    const bundle = this.openEnvelope(entry);
+    return {
+      deliveryId: entry.entryId,
+      ...entry.transferId !== "" ? { transferId: entry.transferId } : {},
+      ...entry.senderPubkey !== "" ? { senderPubkey: entry.senderPubkey } : {},
+      ...bundle.senderNametag !== void 0 ? { senderNametag: bundle.senderNametag } : {},
+      ...bundle.memo !== void 0 ? { memo: bundle.memo } : {},
+      cursor: String(entry.seq),
+      fetchBlob: () => this.fetchVerified(entry)
+    };
+  }
+  openEnvelope(entry) {
+    if (entry.memo === void 0 || entry.senderPubkey === "") return {};
+    try {
+      const key = deriveDeliveryEncryptionKey(this.identity.privateKey, entry.senderPubkey);
+      return decryptDeliveryBundle(key, entry.memo);
+    } catch {
+      return {};
+    }
+  }
+  async fetchVerified(entry) {
+    if (entry.blobCollected === true || entry.getUrl === void 0) {
+      throw new DeliveryProtocolError(`mailbox entry ${entry.entryId} has no fetchable blob (blobCollected)`);
+    }
+    const bytes = await this.client.fetchBlob(entry.getUrl);
+    const keys = await this.deriveKeys(bytes);
+    const derived = computeDeliveryId(keys.tokenId, keys.stateHash);
+    if (derived !== entry.entryId) {
+      throw new DeliveryProtocolError(
+        `mailbox blob does not match its entry id (expected ${entry.entryId}, bytes derive ${derived})`
+      );
+    }
+    return bytes;
+  }
+  // ── ack ────────────────────────────────────────────────────────────────────
+  async ack(deliveryId, disposition, reason) {
+    if (disposition === "claimed") {
+      const result = await this.client.claim([deliveryId], this.custody === "inventory");
+      const failed = result.failed.find((f) => f.entryId === deliveryId);
+      if (failed !== void 0) throw new MailboxClaimFailedError(deliveryId, failed.code);
+    } else {
+      await this.client.reject([deliveryId], reason);
+    }
+    await this.addSeen(deliveryId);
+  }
+  onWake(cb) {
+    if (this.wake === null) return () => void 0;
+    return this.wake.subscribeStream("mailbox", cb);
+  }
+  // ── seen-set (S7) ──────────────────────────────────────────────────────────
+  async readSeen() {
+    const raw = await this.kv.get(DELIVERY_SEEN_KEY);
+    return new Set(raw ?? []);
+  }
+  addSeen(deliveryId) {
+    this.seenChain = this.seenChain.then(async () => {
+      const seen = await this.readSeen();
+      seen.add(deliveryId);
+      await this.kv.set(DELIVERY_SEEN_KEY, [...seen]);
+    });
+    return this.seenChain;
+  }
+};
+
+// token-engine/sdk.ts
+var import_StateTransitionClient = require("@unicitylabs/state-transition-sdk/lib/StateTransitionClient.js");
+var import_AggregatorClient = require("@unicitylabs/state-transition-sdk/lib/api/AggregatorClient.js");
+var import_NetworkId = require("@unicitylabs/state-transition-sdk/lib/api/NetworkId.js");
+var import_CertificationData = require("@unicitylabs/state-transition-sdk/lib/api/CertificationData.js");
+var import_CertificationResponse = require("@unicitylabs/state-transition-sdk/lib/api/CertificationResponse.js");
+var import_StateId = require("@unicitylabs/state-transition-sdk/lib/api/StateId.js");
+var import_InclusionProof = require("@unicitylabs/state-transition-sdk/lib/api/InclusionProof.js");
+var import_InclusionProofResponse = require("@unicitylabs/state-transition-sdk/lib/api/InclusionProofResponse.js");
+var import_RootTrustBase = require("@unicitylabs/state-transition-sdk/lib/api/bft/RootTrustBase.js");
+var import_InclusionProofUtils = require("@unicitylabs/state-transition-sdk/lib/util/InclusionProofUtils.js");
+var import_InclusionProofVerificationRule = require("@unicitylabs/state-transition-sdk/lib/transaction/verification/rule/InclusionProofVerificationRule.js");
+var import_Token = require("@unicitylabs/state-transition-sdk/lib/transaction/Token.js");
+var import_MintTransaction = require("@unicitylabs/state-transition-sdk/lib/transaction/MintTransaction.js");
+var import_TransferTransaction = require("@unicitylabs/state-transition-sdk/lib/transaction/TransferTransaction.js");
+var import_CertifiedMintTransaction = require("@unicitylabs/state-transition-sdk/lib/transaction/CertifiedMintTransaction.js");
+var import_CertifiedTransferTransaction = require("@unicitylabs/state-transition-sdk/lib/transaction/CertifiedTransferTransaction.js");
+var import_TokenId = require("@unicitylabs/state-transition-sdk/lib/transaction/TokenId.js");
+var import_TokenType = require("@unicitylabs/state-transition-sdk/lib/transaction/TokenType.js");
+var import_TokenSalt = require("@unicitylabs/state-transition-sdk/lib/transaction/TokenSalt.js");
+var import_StateMask = require("@unicitylabs/state-transition-sdk/lib/transaction/StateMask.js");
+var import_MintJustificationVerifierService = require("@unicitylabs/state-transition-sdk/lib/transaction/verification/MintJustificationVerifierService.js");
+var import_TokenIssuanceVerifierService = require("@unicitylabs/state-transition-sdk/lib/transaction/verification/TokenIssuanceVerifierService.js");
+var import_VerificationContext = require("@unicitylabs/state-transition-sdk/lib/transaction/verification/VerificationContext.js");
+var import_WorkerTokenVerifier = require("@unicitylabs/state-transition-sdk/lib/transaction/verification/worker/WorkerTokenVerifier.js");
+var import_EncodedPredicate = require("@unicitylabs/state-transition-sdk/lib/predicate/EncodedPredicate.js");
+var import_SignaturePredicate = require("@unicitylabs/state-transition-sdk/lib/predicate/builtin/SignaturePredicate.js");
+var import_SignaturePredicateUnlockScript = require("@unicitylabs/state-transition-sdk/lib/predicate/builtin/SignaturePredicateUnlockScript.js");
+var import_BurnPredicate = require("@unicitylabs/state-transition-sdk/lib/predicate/builtin/BurnPredicate.js");
+var import_PredicateVerifierService = require("@unicitylabs/state-transition-sdk/lib/predicate/verification/PredicateVerifierService.js");
+var import_SigningService = require("@unicitylabs/state-transition-sdk/lib/crypto/secp256k1/SigningService.js");
+var import_Signature = require("@unicitylabs/state-transition-sdk/lib/crypto/secp256k1/Signature.js");
+var import_MintSigningService = require("@unicitylabs/state-transition-sdk/lib/crypto/MintSigningService.js");
+var import_HashAlgorithm = require("@unicitylabs/state-transition-sdk/lib/crypto/hash/HashAlgorithm.js");
+var import_DataHash = require("@unicitylabs/state-transition-sdk/lib/crypto/hash/DataHash.js");
+var import_DataHasher = require("@unicitylabs/state-transition-sdk/lib/crypto/hash/DataHasher.js");
+var import_DataHasherFactory = require("@unicitylabs/state-transition-sdk/lib/crypto/hash/DataHasherFactory.js");
+var import_CborSerializer = require("@unicitylabs/state-transition-sdk/lib/serialization/cbor/CborSerializer.js");
+var import_CborDeserializer = require("@unicitylabs/state-transition-sdk/lib/serialization/cbor/CborDeserializer.js");
+var import_CborError = require("@unicitylabs/state-transition-sdk/lib/serialization/cbor/CborError.js");
+var import_Asset = require("@unicitylabs/state-transition-sdk/lib/payment/asset/Asset.js");
+var import_AssetId = require("@unicitylabs/state-transition-sdk/lib/payment/asset/AssetId.js");
+var import_PaymentAssetCollection = require("@unicitylabs/state-transition-sdk/lib/payment/asset/PaymentAssetCollection.js");
+var import_TokenSplit = require("@unicitylabs/state-transition-sdk/lib/payment/TokenSplit.js");
+var import_SplitTokenRequest = require("@unicitylabs/state-transition-sdk/lib/payment/SplitTokenRequest.js");
+var import_SplitToken = require("@unicitylabs/state-transition-sdk/lib/payment/SplitToken.js");
+var import_SplitAllocationProof = require("@unicitylabs/state-transition-sdk/lib/payment/SplitAllocationProof.js");
+var import_SplitMintJustification = require("@unicitylabs/state-transition-sdk/lib/payment/SplitMintJustification.js");
+var import_SplitMintJustificationVerifier = require("@unicitylabs/state-transition-sdk/lib/payment/SplitMintJustificationVerifier.js");
+var import_VerificationStatus = require("@unicitylabs/state-transition-sdk/lib/verification/VerificationStatus.js");
+var import_VerificationResult = require("@unicitylabs/state-transition-sdk/lib/verification/VerificationResult.js");
+var import_HexConverter = require("@unicitylabs/state-transition-sdk/lib/util/HexConverter.js");
+var import_BigintConverter = require("@unicitylabs/state-transition-sdk/lib/util/BigintConverter.js");
+var import_BitString = require("@unicitylabs/state-transition-sdk/lib/util/BitString.js");
+
+// token-engine/identity.ts
+var SHA256_IMPRINT_PREFIX = new Uint8Array([0, 0]);
+
+// token-engine/errors.ts
+var SplitCheckpointLostError = class extends SphereError {
+  constructor(message, cause) {
+    super(message, "SPLIT_CHECKPOINT_LOST", cause);
+    this.name = "SplitCheckpointLostError";
+  }
+};
+
+// token-engine/SphereTokenEngine.ts
+var CLEAN_REJECT_STATUSES = /* @__PURE__ */ new Set([
+  import_CertificationResponse.CertificationStatus.STATE_ID_MISMATCH,
+  import_CertificationResponse.CertificationStatus.SIGNATURE_VERIFICATION_FAILED,
+  import_CertificationResponse.CertificationStatus.INVALID_SIGNATURE_FORMAT,
+  import_CertificationResponse.CertificationStatus.INVALID_PUBLIC_KEY_FORMAT,
+  import_CertificationResponse.CertificationStatus.INVALID_SOURCE_STATE_HASH_FORMAT,
+  import_CertificationResponse.CertificationStatus.INVALID_TRANSACTION_HASH_FORMAT,
+  import_CertificationResponse.CertificationStatus.UNSUPPORTED_ALGORITHM,
+  import_CertificationResponse.CertificationStatus.INVALID_SHARD
+]);
+
+// impl/wallet-api-v2/checkpoints.ts
+var PROGRESS_SIGNATURE_PREFIX = "wallet-api.progress.v1";
+var utf8 = (text) => new TextEncoder().encode(text);
+function sha256Hex(bytes) {
+  return Array.from(sha256(bytes), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function progressMessage(transferId, opIndex, envelope) {
+  return `${PROGRESS_SIGNATURE_PREFIX}:${transferId}:${String(opIndex)}:${sha256Hex(utf8(envelope))}`;
+}
+var WalletApiSplitCheckpointStore = class {
+  constructor(config) {
+    this.config = config;
+  }
+  cacheKey(transferId, opIndex) {
+    return `${STORE_KEYS.checkpointCache}:${transferId}:${String(opIndex)}`;
+  }
+  aad(transferId, opIndex) {
+    return utf8(`${transferId}:${String(opIndex)}`);
+  }
+  async put(transferId, opIndex, bytes) {
+    const { client, kv, fieldKey, signProgress } = this.config;
+    const aad = this.aad(transferId, opIndex);
+    const cacheKey = this.cacheKey(transferId, opIndex);
+    let envelope = await kv.get(cacheKey);
+    if (envelope === null) {
+      envelope = encryptFieldBytes(fieldKey, bytes, aad);
+      await kv.set(cacheKey, envelope);
+    }
+    const signature = await signProgress(progressMessage(transferId, opIndex, envelope));
+    const record = await client.postProgress(transferId, opIndex, envelope, signature);
+    return this.open(record.payload, aad);
+  }
+  async get(transferId, opIndex) {
+    const records = await this.config.client.getProgress(transferId);
+    const record = records.find((r) => r.opIndex === opIndex);
+    if (record === void 0) return null;
+    return this.open(record.payload, this.aad(transferId, opIndex));
+  }
+  open(envelope, aad) {
+    try {
+      return decryptFieldBytes(this.config.fieldKey, envelope, aad);
+    } catch (err) {
+      if (err instanceof SphereError && err.code === "DECRYPTION_ERROR") {
+        throw new SplitCheckpointLostError(
+          "split checkpoint record could not be decrypted (tampered or mis-served)",
+          err
+        );
+      }
+      throw err;
+    }
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_SESSION_TIMING,
+  JwtGenerationCell,
+  WAKE_STREAMS,
+  WalletApiDeliveryPort,
+  WalletApiHttpError,
+  WalletApiSession,
+  WalletApiSplitCheckpointStore,
+  WalletApiStoragePort,
+  WalletApiV2Client,
+  assertSecureBaseUrl,
+  createWalletApiHttp,
+  isWalletApiHttpError,
+  refreshTokenKey
+});
+/*! Bundled license information:
+
+@noble/curves/utils.js:
+@noble/curves/abstract/modular.js:
+@noble/curves/abstract/curve.js:
+@noble/curves/abstract/weierstrass.js:
+@noble/curves/secp256k1.js:
+  (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
+
+@noble/ciphers/utils.js:
+  (*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) *)
+*/
+//# sourceMappingURL=index.cjs.map