signet-verify 0.3.1 → 0.5.0

package/dist/signet-verify.d.ts

@@ -99,6 +99,13 @@ export interface SignetAuthResult {
      * — already sanitised here, but still escape on render per usual.
      */
     displayName?: string;
+    /**
+     * Optional `bunker://` URI for upgrading the auth-only session to a live signer.
+     * The signer device mints a one-shot pairing URI to its own NIP-46 server; the
+     * consumer connects to it (passthrough) to sign cross-device. Absent on
+     * auth-only flows — the consumer keeps the EphemeralSigner.
+     */
+    bunkerUri?: string;
     /** Unix timestamp the auth event was signed. */
     createdAt: number;
 }

package/dist/signet-verify.iife.js

@@ -1,10 +1,10 @@
-"use strict";var Signet=(()=>{var Le=Object.defineProperty;var Fo=Object.getOwnPropertyDescriptor;var ts=Object.getOwnPropertyNames;var es=Object.prototype.hasOwnProperty;var ns=(e,t,r)=>t in e?Le(e,t,{enumerable:!0,configurable:!0,writable:!0,value:r}):e[t]=r;var rs=(e,t)=>{for(var r in t)Le(e,r,{get:t[r],enumerable:!0})},os=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of ts(t))!es.call(e,o)&&o!==r&&Le(e,o,{get:()=>t[o],enumerable:!(n=Fo(t,o))||n.enumerable});return e};var ss=e=>os(Le({},"__esModule",{value:!0}),e);var T=(e,t,r)=>ns(e,typeof t!="symbol"?t+"":t,r);var Ti={};rs(Ti,{verifyAge:()=>Jo,waitForAuthResponse:()=>Qo});var qt=typeof globalThis=="object"&&"crypto"in globalThis?globalThis.crypto:void 0;function Ct(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"}function ue(e){if(!Number.isSafeInteger(e)||e<0)throw new Error("positive integer expected, got "+e)}function lt(e,...t){if(!Ct(e))throw new Error("Uint8Array expected");if(t.length>0&&!t.includes(e.length))throw new Error("Uint8Array expected of length "+t+", got length="+e.length)}function _e(e){if(typeof e!="function"||typeof e.create!="function")throw new Error("Hash should be wrapped by utils.createHasher");ue(e.outputLen),ue(e.blockLen)}function Yt(e,t=!0){if(e.destroyed)throw new Error("Hash instance has been destroyed");if(t&&e.finished)throw new Error("Hash#digest() has already been called")}function ar(e,t){lt(e);let r=t.outputLen;if(e.length<r)throw new Error("digestInto() expects output buffer of length at least "+r)}function Vt(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function Re(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function dt(e,t){return e<<32-t|e>>>t}var ur=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",is=Array.from({length:256},(e,t)=>t.toString(16).padStart(2,"0"));function st(e){if(lt(e),ur)return e.toHex();let t="";for(let r=0;r<e.length;r++)t+=is[e[r]];return t}var gt={_0:48,_9:57,A:65,F:70,a:97,f:102};function fr(e){if(e>=gt._0&&e<=gt._9)return e-gt._0;if(e>=gt.A&&e<=gt.F)return e-(gt.A-10);if(e>=gt.a&&e<=gt.f)return e-(gt.a-10)}function Dt(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);if(ur)return Uint8Array.fromHex(e);let t=e.length,r=t/2;if(t%2)throw new Error("hex string expected, got unpadded hex of length "+t);let n=new Uint8Array(r);for(let o=0,s=0;o<r;o++,s+=2){let i=fr(e.charCodeAt(s)),c=fr(e.charCodeAt(s+1));if(i===void 0||c===void 0){let f=e[s]+e[s+1];throw new Error('hex string expected, got non-hex character "'+f+'" at index '+s)}n[o]=i*16+c}return n}function Ue(e){if(typeof e!="string")throw new Error("string expected");return new Uint8Array(new TextEncoder().encode(e))}function le(e){return typeof e=="string"&&(e=Ue(e)),lt(e),e}function ot(...e){let t=0;for(let n=0;n<e.length;n++){let o=e[n];lt(o),t+=o.length}let r=new Uint8Array(t);for(let n=0,o=0;n<e.length;n++){let s=e[n];r.set(s,o),o+=s.length}return r}var zt=class{};function lr(e){let t=n=>e().update(le(n)).digest(),r=e();return t.outputLen=r.outputLen,t.blockLen=r.blockLen,t.create=()=>e(),t}function Mt(e=32){if(qt&&typeof qt.getRandomValues=="function")return qt.getRandomValues(new Uint8Array(e));if(qt&&typeof qt.randomBytes=="function")return Uint8Array.from(qt.randomBytes(e));throw new Error("crypto.getRandomValues must be defined")}function cs(e,t,r,n){if(typeof e.setBigUint64=="function")return e.setBigUint64(t,r,n);let o=BigInt(32),s=BigInt(4294967295),i=Number(r>>o&s),c=Number(r&s),f=n?4:0,l=n?0:4;e.setUint32(t+f,i,n),e.setUint32(t+l,c,n)}function dr(e,t,r){return e&t^~e&r}function hr(e,t,r){return e&t^e&r^t&r}var Oe=class extends zt{constructor(t,r,n,o){super(),this.finished=!1,this.length=0,this.pos=0,this.destroyed=!1,this.blockLen=t,this.outputLen=r,this.padOffset=n,this.isLE=o,this.buffer=new Uint8Array(t),this.view=Re(this.buffer)}update(t){Yt(this),t=le(t),lt(t);let{view:r,buffer:n,blockLen:o}=this,s=t.length;for(let i=0;i<s;){let c=Math.min(o-this.pos,s-i);if(c===o){let f=Re(t);for(;o<=s-i;i+=o)this.process(f,i);continue}n.set(t.subarray(i,i+c),this.pos),this.pos+=c,i+=c,this.pos===o&&(this.process(r,0),this.pos=0)}return this.length+=t.length,this.roundClean(),this}digestInto(t){Yt(this),ar(t,this),this.finished=!0;let{buffer:r,view:n,blockLen:o,isLE:s}=this,{pos:i}=this;r[i++]=128,Vt(this.buffer.subarray(i)),this.padOffset>o-i&&(this.process(n,0),i=0);for(let g=i;g<o;g++)r[g]=0;cs(n,o-8,BigInt(this.length*8),s),this.process(n,0);let c=Re(t),f=this.outputLen;if(f%4)throw new Error("_sha2: outputLen should be aligned to 32bit");let l=f/4,h=this.get();if(l>h.length)throw new Error("_sha2: outputLen bigger than state");for(let g=0;g<l;g++)c.setUint32(4*g,h[g],s)}digest(){let{buffer:t,outputLen:r}=this;this.digestInto(t);let n=t.slice(0,r);return this.destroy(),n}_cloneInto(t){t||(t=new this.constructor),t.set(...this.get());let{blockLen:r,buffer:n,length:o,finished:s,destroyed:i,pos:c}=this;return t.destroyed=i,t.finished=s,t.length=o,t.pos=c,o%r&&t.buffer.set(n),t}clone(){return this._cloneInto()}},xt=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var fs=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),_t=new Uint32Array(64),He=class extends Oe{constructor(t=32){super(64,t,8,!1),this.A=xt[0]|0,this.B=xt[1]|0,this.C=xt[2]|0,this.D=xt[3]|0,this.E=xt[4]|0,this.F=xt[5]|0,this.G=xt[6]|0,this.H=xt[7]|0}get(){let{A:t,B:r,C:n,D:o,E:s,F:i,G:c,H:f}=this;return[t,r,n,o,s,i,c,f]}set(t,r,n,o,s,i,c,f){this.A=t|0,this.B=r|0,this.C=n|0,this.D=o|0,this.E=s|0,this.F=i|0,this.G=c|0,this.H=f|0}process(t,r){for(let g=0;g<16;g++,r+=4)_t[g]=t.getUint32(r,!1);for(let g=16;g<64;g++){let b=_t[g-15],d=_t[g-2],y=dt(b,7)^dt(b,18)^b>>>3,B=dt(d,17)^dt(d,19)^d>>>10;_t[g]=B+_t[g-7]+y+_t[g-16]|0}let{A:n,B:o,C:s,D:i,E:c,F:f,G:l,H:h}=this;for(let g=0;g<64;g++){let b=dt(c,6)^dt(c,11)^dt(c,25),d=h+b+dr(c,f,l)+fs[g]+_t[g]|0,B=(dt(n,2)^dt(n,13)^dt(n,22))+hr(n,o,s)|0;h=l,l=f,f=c,c=i+d|0,i=s,s=o,o=n,n=d+B|0}n=n+this.A|0,o=o+this.B|0,s=s+this.C|0,i=i+this.D|0,c=c+this.E|0,f=f+this.F|0,l=l+this.G|0,h=h+this.H|0,this.set(n,o,s,i,c,f,l,h)}roundClean(){Vt(_t)}destroy(){this.set(0,0,0,0,0,0,0,0),Vt(this.buffer)}};var Wt=lr(()=>new He);var ke=class extends zt{constructor(t,r){super(),this.finished=!1,this.destroyed=!1,_e(t);let n=le(r);if(this.iHash=t.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let o=this.blockLen,s=new Uint8Array(o);s.set(n.length>o?t.create().update(n).digest():n);for(let i=0;i<s.length;i++)s[i]^=54;this.iHash.update(s),this.oHash=t.create();for(let i=0;i<s.length;i++)s[i]^=106;this.oHash.update(s),Vt(s)}update(t){return Yt(this),this.iHash.update(t),this}digestInto(t){Yt(this),lt(t,this.outputLen),this.finished=!0,this.iHash.digestInto(t),this.oHash.update(t),this.oHash.digestInto(t),this.destroy()}digest(){let t=new Uint8Array(this.oHash.outputLen);return this.digestInto(t),t}_cloneInto(t){t||(t=Object.create(Object.getPrototypeOf(this),{}));let{oHash:r,iHash:n,finished:o,destroyed:s,blockLen:i,outputLen:c}=this;return t=t,t.finished=o,t.destroyed=s,t.blockLen=i,t.outputLen=c,t.oHash=r._cloneInto(t.oHash),t.iHash=n._cloneInto(t.iHash),t}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},on=(e,t,r)=>new ke(e,t).update(r).digest();on.create=(e,t)=>new ke(e,t);var fn=BigInt(0),cn=BigInt(1);function de(e,t=""){if(typeof e!="boolean"){let r=t&&`"${t}"`;throw new Error(r+"expected boolean, got type="+typeof e)}return e}function Rt(e,t,r=""){let n=Ct(e),o=e?.length,s=t!==void 0;if(!n||s&&o!==t){let i=r&&`"${r}" `,c=s?` of length ${t}`:"",f=n?`length=${o}`:`type=${typeof e}`;throw new Error(i+"expected Uint8Array"+c+", got "+f)}return e}function he(e){let t=e.toString(16);return t.length&1?"0"+t:t}function br(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);return e===""?fn:BigInt("0x"+e)}function pt(e){return br(st(e))}function an(e){return lt(e),br(st(Uint8Array.from(e).reverse()))}function Xt(e,t){return Dt(e.toString(16).padStart(t*2,"0"))}function un(e,t){return Xt(e,t).reverse()}function X(e,t,r){let n;if(typeof t=="string")try{n=Dt(t)}catch(s){throw new Error(e+" must be hex string or Uint8Array, cause: "+s)}else if(Ct(t))n=Uint8Array.from(t);else throw new Error(e+" must be hex string or Uint8Array");let o=n.length;if(typeof r=="number"&&o!==r)throw new Error(e+" of length "+r+" expected, got "+o);return n}var sn=e=>typeof e=="bigint"&&fn<=e;function be(e,t,r){return sn(e)&&sn(t)&&sn(r)&&t<=e&&e<r}function gr(e,t,r,n){if(!be(t,r,n))throw new Error("expected valid "+e+": "+r+" <= n < "+n+", got "+t)}function Te(e){let t;for(t=0;e>fn;e>>=cn,t+=1);return t}var Ut=e=>(cn<<BigInt(e))-cn;function xr(e,t,r){if(typeof e!="number"||e<2)throw new Error("hashLen must be a number");if(typeof t!="number"||t<2)throw new Error("qByteLen must be a number");if(typeof r!="function")throw new Error("hmacFn must be a function");let n=d=>new Uint8Array(d),o=d=>Uint8Array.of(d),s=n(e),i=n(e),c=0,f=()=>{s.fill(1),i.fill(0),c=0},l=(...d)=>r(i,s,...d),h=(d=n(0))=>{i=l(o(0),d),s=l(),d.length!==0&&(i=l(o(1),d),s=l())},g=()=>{if(c++>=1e3)throw new Error("drbg: tried 1000 values");let d=0,y=[];for(;d<t;){s=l();let B=s.slice();y.push(B),d+=s.length}return ot(...y)};return(d,y)=>{f(),h(d);let B;for(;!(B=y(g()));)h();return f(),B}}function ge(e,t,r={}){if(!e||typeof e!="object")throw new Error("expected valid options object");function n(o,s,i){let c=e[o];if(i&&c===void 0)return;let f=typeof c;if(f!==s||c===null)throw new Error(`param "${o}" is invalid: expected ${s}, got ${f}`)}Object.entries(t).forEach(([o,s])=>n(o,s,!1)),Object.entries(r).forEach(([o,s])=>n(o,s,!0))}function ln(e){let t=new WeakMap;return(r,...n)=>{let o=t.get(r);if(o!==void 0)return o;let s=e(r,...n);return t.set(r,s),s}}var nt=BigInt(0),tt=BigInt(1),Zt=BigInt(2),wr=BigInt(3),mr=BigInt(4),Er=BigInt(5),as=BigInt(7),Br=BigInt(8),us=BigInt(9),vr=BigInt(16);function it(e,t){let r=e%t;return r>=nt?r:t+r}function ct(e,t,r){let n=e;for(;t-- >nt;)n*=n,n%=r;return n}function pr(e,t){if(e===nt)throw new Error("invert: expected non-zero number");if(t<=nt)throw new Error("invert: expected positive modulus, got "+t);let r=it(e,t),n=t,o=nt,s=tt,i=tt,c=nt;for(;r!==nt;){let l=n/r,h=n%r,g=o-i*l,b=s-c*l;n=r,r=h,o=i,s=c,i=g,c=b}if(n!==tt)throw new Error("invert: does not exist");return it(o,t)}function dn(e,t,r){if(!e.eql(e.sqr(t),r))throw new Error("Cannot find square root")}function Ar(e,t){let r=(e.ORDER+tt)/mr,n=e.pow(t,r);return dn(e,n,t),n}function ls(e,t){let r=(e.ORDER-Er)/Br,n=e.mul(t,Zt),o=e.pow(n,r),s=e.mul(t,o),i=e.mul(e.mul(s,Zt),o),c=e.mul(s,e.sub(i,e.ONE));return dn(e,c,t),c}function ds(e){let t=Ot(e),r=Sr(e),n=r(t,t.neg(t.ONE)),o=r(t,n),s=r(t,t.neg(n)),i=(e+as)/vr;return(c,f)=>{let l=c.pow(f,i),h=c.mul(l,n),g=c.mul(l,o),b=c.mul(l,s),d=c.eql(c.sqr(h),f),y=c.eql(c.sqr(g),f);l=c.cmov(l,h,d),h=c.cmov(b,g,y);let B=c.eql(c.sqr(h),f),S=c.cmov(l,h,B);return dn(c,S,f),S}}function Sr(e){if(e<wr)throw new Error("sqrt is not defined for small field");let t=e-tt,r=0;for(;t%Zt===nt;)t/=Zt,r++;let n=Zt,o=Ot(e);for(;yr(o,n)===1;)if(n++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(r===1)return Ar;let s=o.pow(n,t),i=(t+tt)/Zt;return function(f,l){if(f.is0(l))return l;if(yr(f,l)!==1)throw new Error("Cannot find square root");let h=r,g=f.mul(f.ONE,s),b=f.pow(l,t),d=f.pow(l,i);for(;!f.eql(b,f.ONE);){if(f.is0(b))return f.ZERO;let y=1,B=f.sqr(b);for(;!f.eql(B,f.ONE);)if(y++,B=f.sqr(B),y===h)throw new Error("Cannot find square root");let S=tt<<BigInt(h-y-1),_=f.pow(g,S);h=y,g=f.sqr(_),b=f.mul(b,g),d=f.mul(d,_)}return d}}function hs(e){return e%mr===wr?Ar:e%Br===Er?ls:e%vr===us?ds(e):Sr(e)}var bs=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function hn(e){let t={ORDER:"bigint",MASK:"bigint",BYTES:"number",BITS:"number"},r=bs.reduce((n,o)=>(n[o]="function",n),t);return ge(e,r),e}function gs(e,t,r){if(r<nt)throw new Error("invalid exponent, negatives unsupported");if(r===nt)return e.ONE;if(r===tt)return t;let n=e.ONE,o=t;for(;r>nt;)r&tt&&(n=e.mul(n,o)),o=e.sqr(o),r>>=tt;return n}function Ne(e,t,r=!1){let n=new Array(t.length).fill(r?e.ZERO:void 0),o=t.reduce((i,c,f)=>e.is0(c)?i:(n[f]=i,e.mul(i,c)),e.ONE),s=e.inv(o);return t.reduceRight((i,c,f)=>e.is0(c)?i:(n[f]=e.mul(i,n[f]),e.mul(i,c)),s),n}function yr(e,t){let r=(e.ORDER-tt)/Zt,n=e.pow(t,r),o=e.eql(n,e.ONE),s=e.eql(n,e.ZERO),i=e.eql(n,e.neg(e.ONE));if(!o&&!s&&!i)throw new Error("invalid Legendre symbol result");return o?1:s?0:-1}function qe(e,t){t!==void 0&&ue(t);let r=t!==void 0?t:e.toString(2).length,n=Math.ceil(r/8);return{nBitLength:r,nByteLength:n}}function Ot(e,t,r=!1,n={}){if(e<=nt)throw new Error("invalid field: expected ORDER > 0, got "+e);let o,s,i=!1,c;if(typeof t=="object"&&t!=null){if(n.sqrt||r)throw new Error("cannot specify opts in two arguments");let b=t;b.BITS&&(o=b.BITS),b.sqrt&&(s=b.sqrt),typeof b.isLE=="boolean"&&(r=b.isLE),typeof b.modFromBytes=="boolean"&&(i=b.modFromBytes),c=b.allowedLengths}else typeof t=="number"&&(o=t),n.sqrt&&(s=n.sqrt);let{nBitLength:f,nByteLength:l}=qe(e,o);if(l>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");let h,g=Object.freeze({ORDER:e,isLE:r,BITS:f,BYTES:l,MASK:Ut(f),ZERO:nt,ONE:tt,allowedLengths:c,create:b=>it(b,e),isValid:b=>{if(typeof b!="bigint")throw new Error("invalid field element: expected bigint, got "+typeof b);return nt<=b&&b<e},is0:b=>b===nt,isValidNot0:b=>!g.is0(b)&&g.isValid(b),isOdd:b=>(b&tt)===tt,neg:b=>it(-b,e),eql:(b,d)=>b===d,sqr:b=>it(b*b,e),add:(b,d)=>it(b+d,e),sub:(b,d)=>it(b-d,e),mul:(b,d)=>it(b*d,e),pow:(b,d)=>gs(g,b,d),div:(b,d)=>it(b*pr(d,e),e),sqrN:b=>b*b,addN:(b,d)=>b+d,subN:(b,d)=>b-d,mulN:(b,d)=>b*d,inv:b=>pr(b,e),sqrt:s||(b=>(h||(h=hs(e)),h(g,b))),toBytes:b=>r?un(b,l):Xt(b,l),fromBytes:(b,d=!0)=>{if(c){if(!c.includes(b.length)||b.length>l)throw new Error("Field.fromBytes: expected "+c+" bytes, got "+b.length);let B=new Uint8Array(l);B.set(b,r?0:B.length-b.length),b=B}if(b.length!==l)throw new Error("Field.fromBytes: expected "+l+" bytes, got "+b.length);let y=r?an(b):pt(b);if(i&&(y=it(y,e)),!d&&!g.isValid(y))throw new Error("invalid field element: outside of range 0..ORDER");return y},invertBatch:b=>Ne(g,b),cmov:(b,d,y)=>y?d:b});return Object.freeze(g)}function Ir(e){if(typeof e!="bigint")throw new Error("field order must be bigint");let t=e.toString(2).length;return Math.ceil(t/8)}function bn(e){let t=Ir(e);return t+Math.ceil(t/2)}function Ce(e,t,r=!1){let n=e.length,o=Ir(t),s=bn(t);if(n<16||n<s||n>1024)throw new Error("expected "+s+"-1024 bytes of input, got "+n);let i=r?an(e):pt(e),c=it(i,t-tt)+tt;return r?un(c,o):Xt(c,o)}var Jt=BigInt(0),jt=BigInt(1);function xe(e,t){let r=t.negate();return e?r:t}function De(e,t){let r=Ne(e.Fp,t.map(n=>n.Z));return t.map((n,o)=>e.fromAffine(n.toAffine(r[o])))}function Ur(e,t){if(!Number.isSafeInteger(e)||e<=0||e>t)throw new Error("invalid window size, expected [1.."+t+"], got W="+e)}function gn(e,t){Ur(e,t);let r=Math.ceil(t/e)+1,n=2**(e-1),o=2**e,s=Ut(e),i=BigInt(e);return{windows:r,windowSize:n,mask:s,maxNumber:o,shiftBy:i}}function Lr(e,t,r){let{windowSize:n,mask:o,maxNumber:s,shiftBy:i}=r,c=Number(e&o),f=e>>i;c>n&&(c-=s,f+=jt);let l=t*n,h=l+Math.abs(c)-1,g=c===0,b=c<0,d=t%2!==0;return{nextN:f,offset:h,isZero:g,isNeg:b,isNegF:d,offsetF:l}}function xs(e,t){if(!Array.isArray(e))throw new Error("array expected");e.forEach((r,n)=>{if(!(r instanceof t))throw new Error("invalid point at index "+n)})}function ps(e,t){if(!Array.isArray(e))throw new Error("array of scalars expected");e.forEach((r,n)=>{if(!t.isValid(r))throw new Error("invalid scalar at index "+n)})}var xn=new WeakMap,Or=new WeakMap;function pn(e){return Or.get(e)||1}function _r(e){if(e!==Jt)throw new Error("invalid wNAF")}var Ve=class{constructor(t,r){this.BASE=t.BASE,this.ZERO=t.ZERO,this.Fn=t.Fn,this.bits=r}_unsafeLadder(t,r,n=this.ZERO){let o=t;for(;r>Jt;)r&jt&&(n=n.add(o)),o=o.double(),r>>=jt;return n}precomputeWindow(t,r){let{windows:n,windowSize:o}=gn(r,this.bits),s=[],i=t,c=i;for(let f=0;f<n;f++){c=i,s.push(c);for(let l=1;l<o;l++)c=c.add(i),s.push(c);i=c.double()}return s}wNAF(t,r,n){if(!this.Fn.isValid(n))throw new Error("invalid scalar");let o=this.ZERO,s=this.BASE,i=gn(t,this.bits);for(let c=0;c<i.windows;c++){let{nextN:f,offset:l,isZero:h,isNeg:g,isNegF:b,offsetF:d}=Lr(n,c,i);n=f,h?s=s.add(xe(b,r[d])):o=o.add(xe(g,r[l]))}return _r(n),{p:o,f:s}}wNAFUnsafe(t,r,n,o=this.ZERO){let s=gn(t,this.bits);for(let i=0;i<s.windows&&n!==Jt;i++){let{nextN:c,offset:f,isZero:l,isNeg:h}=Lr(n,i,s);if(n=c,!l){let g=r[f];o=o.add(h?g.negate():g)}}return _r(n),o}getPrecomputes(t,r,n){let o=xn.get(r);return o||(o=this.precomputeWindow(r,t),t!==1&&(typeof n=="function"&&(o=n(o)),xn.set(r,o))),o}cached(t,r,n){let o=pn(t);return this.wNAF(o,this.getPrecomputes(o,t,n),r)}unsafe(t,r,n,o){let s=pn(t);return s===1?this._unsafeLadder(t,r,o):this.wNAFUnsafe(s,this.getPrecomputes(s,t,n),r,o)}createCache(t,r){Ur(r,this.bits),Or.set(t,r),xn.delete(t)}hasCache(t){return pn(t)!==1}};function Hr(e,t,r,n){let o=t,s=e.ZERO,i=e.ZERO;for(;r>Jt||n>Jt;)r&jt&&(s=s.add(o)),n&jt&&(i=i.add(o)),o=o.double(),r>>=jt,n>>=jt;return{p1:s,p2:i}}function kr(e,t,r,n){xs(r,e),ps(n,t);let o=r.length,s=n.length;if(o!==s)throw new Error("arrays of points and scalars must have equal length");let i=e.ZERO,c=Te(BigInt(o)),f=1;c>12?f=c-3:c>4?f=c-2:c>0&&(f=2);let l=Ut(f),h=new Array(Number(l)+1).fill(i),g=Math.floor((t.BITS-1)/f)*f,b=i;for(let d=g;d>=0;d-=f){h.fill(i);for(let B=0;B<s;B++){let S=n[B],_=Number(S>>BigInt(d)&l);h[_]=h[_].add(r[B])}let y=i;for(let B=h.length-1,S=i;B>0;B--)S=S.add(h[B]),y=y.add(S);if(b=b.add(y),d!==0)for(let B=0;B<f;B++)b=b.double()}return b}function Rr(e,t,r){if(t){if(t.ORDER!==e)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return hn(t),t}else return Ot(e,{isLE:r})}function Tr(e,t,r={},n){if(n===void 0&&(n=e==="edwards"),!t||typeof t!="object")throw new Error(`expected valid ${e} CURVE object`);for(let f of["p","n","h"]){let l=t[f];if(!(typeof l=="bigint"&&l>Jt))throw new Error(`CURVE.${f} must be positive bigint`)}let o=Rr(t.p,r.Fp,n),s=Rr(t.n,r.Fn,n),c=["Gx","Gy","a",e==="weierstrass"?"b":"d"];for(let f of c)if(!o.isValid(t[f]))throw new Error(`CURVE.${f} must be valid field element of CURVE.Fp`);return t=Object.freeze(Object.assign({},t)),{CURVE:t,Fp:o,Fn:s}}var Nr=(e,t)=>(e+(e>=0?t:-t)/qr)/t;function ys(e,t,r){let[[n,o],[s,i]]=t,c=Nr(i*e,r),f=Nr(-o*e,r),l=e-c*n-f*s,h=-c*o-f*i,g=l<wt,b=h<wt;g&&(l=-l),b&&(h=-h);let d=Ut(Math.ceil(Te(r)/2))+Qt;if(l<wt||l>=d||h<wt||h>=d)throw new Error("splitScalar (endomorphism): failed, k="+e);return{k1neg:g,k1:l,k2neg:b,k2:h}}function wn(e){if(!["compact","recovered","der"].includes(e))throw new Error('Signature format must be "compact", "recovered", or "der"');return e}function yn(e,t){let r={};for(let n of Object.keys(t))r[n]=e[n]===void 0?t[n]:e[n];return de(r.lowS,"lowS"),de(r.prehash,"prehash"),r.format!==void 0&&wn(r.format),r}var mn=class extends Error{constructor(t=""){super(t)}},yt={Err:mn,_tlv:{encode:(e,t)=>{let{Err:r}=yt;if(e<0||e>256)throw new r("tlv.encode: wrong tag");if(t.length&1)throw new r("tlv.encode: unpadded data");let n=t.length/2,o=he(n);if(o.length/2&128)throw new r("tlv.encode: long form length too big");let s=n>127?he(o.length/2|128):"";return he(e)+s+o+t},decode(e,t){let{Err:r}=yt,n=0;if(e<0||e>256)throw new r("tlv.encode: wrong tag");if(t.length<2||t[n++]!==e)throw new r("tlv.decode: wrong tlv");let o=t[n++],s=!!(o&128),i=0;if(!s)i=o;else{let f=o&127;if(!f)throw new r("tlv.decode(long): indefinite length not supported");if(f>4)throw new r("tlv.decode(long): byte length is too big");let l=t.subarray(n,n+f);if(l.length!==f)throw new r("tlv.decode: length bytes not complete");if(l[0]===0)throw new r("tlv.decode(long): zero leftmost byte");for(let h of l)i=i<<8|h;if(n+=f,i<128)throw new r("tlv.decode(long): not minimal encoding")}let c=t.subarray(n,n+i);if(c.length!==i)throw new r("tlv.decode: wrong value length");return{v:c,l:t.subarray(n+i)}}},_int:{encode(e){let{Err:t}=yt;if(e<wt)throw new t("integer: negative integers are not allowed");let r=he(e);if(Number.parseInt(r[0],16)&8&&(r="00"+r),r.length&1)throw new t("unexpected DER parsing assertion: unpadded hex");return r},decode(e){let{Err:t}=yt;if(e[0]&128)throw new t("invalid signature integer: negative");if(e[0]===0&&!(e[1]&128))throw new t("invalid signature integer: unnecessary leading zero");return pt(e)}},toSig(e){let{Err:t,_int:r,_tlv:n}=yt,o=X("signature",e),{v:s,l:i}=n.decode(48,o);if(i.length)throw new t("invalid signature: left bytes after parsing");let{v:c,l:f}=n.decode(2,s),{v:l,l:h}=n.decode(2,f);if(h.length)throw new t("invalid signature: left bytes after parsing");return{r:r.decode(c),s:r.decode(l)}},hexFromSig(e){let{_tlv:t,_int:r}=yt,n=t.encode(2,r.encode(e.r)),o=t.encode(2,r.encode(e.s)),s=n+o;return t.encode(48,s)}},wt=BigInt(0),Qt=BigInt(1),qr=BigInt(2),Me=BigInt(3),ws=BigInt(4);function Ht(e,t){let{BYTES:r}=e,n;if(typeof t=="bigint")n=t;else{let o=X("private key",t);try{n=e.fromBytes(o)}catch{throw new Error(`invalid private key: expected ui8a of size ${r}, got ${typeof t}`)}}if(!e.isValidNot0(n))throw new Error("invalid private key: out of range [1..N-1]");return n}function ms(e,t={}){let r=Tr("weierstrass",e,t),{Fp:n,Fn:o}=r,s=r.CURVE,{h:i,n:c}=s;ge(t,{},{allowInfinityPoint:"boolean",clearCofactor:"function",isTorsionFree:"function",fromBytes:"function",toBytes:"function",endo:"object",wrapPrivateKey:"boolean"});let{endo:f}=t;if(f&&(!n.is0(s.a)||typeof f.beta!="bigint"||!Array.isArray(f.basises)))throw new Error('invalid endo: expected "beta": bigint and "basises": array');let l=Vr(n,o);function h(){if(!n.isOdd)throw new Error("compression is not supported: Field does not have .isOdd()")}function g(L,w,a){let{x:u,y:x}=w.toAffine(),m=n.toBytes(u);if(de(a,"isCompressed"),a){h();let v=!n.isOdd(x);return ot(Cr(v),m)}else return ot(Uint8Array.of(4),m,n.toBytes(x))}function b(L){Rt(L,void 0,"Point");let{publicKey:w,publicKeyUncompressed:a}=l,u=L.length,x=L[0],m=L.subarray(1);if(u===w&&(x===2||x===3)){let v=n.fromBytes(m);if(!n.isValid(v))throw new Error("bad point: is not on curve, wrong x");let p=B(v),A;try{A=n.sqrt(p)}catch(O){let D=O instanceof Error?": "+O.message:"";throw new Error("bad point: is not on curve, sqrt error"+D)}h();let E=n.isOdd(A);return(x&1)===1!==E&&(A=n.neg(A)),{x:v,y:A}}else if(u===a&&x===4){let v=n.BYTES,p=n.fromBytes(m.subarray(0,v)),A=n.fromBytes(m.subarray(v,v*2));if(!S(p,A))throw new Error("bad point: is not on curve");return{x:p,y:A}}else throw new Error(`bad point: got length ${u}, expected compressed=${w} or uncompressed=${a}`)}let d=t.toBytes||g,y=t.fromBytes||b;function B(L){let w=n.sqr(L),a=n.mul(w,L);return n.add(n.add(a,n.mul(L,s.a)),s.b)}function S(L,w){let a=n.sqr(w),u=B(L);return n.eql(a,u)}if(!S(s.Gx,s.Gy))throw new Error("bad curve params: generator point");let _=n.mul(n.pow(s.a,Me),ws),V=n.mul(n.sqr(s.b),BigInt(27));if(n.is0(n.add(_,V)))throw new Error("bad curve params: a or b");function N(L,w,a=!1){if(!n.isValid(w)||a&&n.is0(w))throw new Error(`bad point coordinate ${L}`);return w}function q(L){if(!(L instanceof R))throw new Error("ProjectivePoint expected")}function C(L){if(!f||!f.basises)throw new Error("no endo");return ys(L,f.basises,o.ORDER)}let P=ln((L,w)=>{let{X:a,Y:u,Z:x}=L;if(n.eql(x,n.ONE))return{x:a,y:u};let m=L.is0();w==null&&(w=m?n.ONE:n.inv(x));let v=n.mul(a,w),p=n.mul(u,w),A=n.mul(x,w);if(m)return{x:n.ZERO,y:n.ZERO};if(!n.eql(A,n.ONE))throw new Error("invZ was invalid");return{x:v,y:p}}),Y=ln(L=>{if(L.is0()){if(t.allowInfinityPoint&&!n.is0(L.Y))return;throw new Error("bad point: ZERO")}let{x:w,y:a}=L.toAffine();if(!n.isValid(w)||!n.isValid(a))throw new Error("bad point: x or y not field elements");if(!S(w,a))throw new Error("bad point: equation left != right");if(!L.isTorsionFree())throw new Error("bad point: not in prime-order subgroup");return!0});function z(L,w,a,u,x){return a=new R(n.mul(a.X,L),a.Y,a.Z),w=xe(u,w),a=xe(x,a),w.add(a)}class R{constructor(w,a,u){this.X=N("x",w),this.Y=N("y",a,!0),this.Z=N("z",u),Object.freeze(this)}static CURVE(){return s}static fromAffine(w){let{x:a,y:u}=w||{};if(!w||!n.isValid(a)||!n.isValid(u))throw new Error("invalid affine point");if(w instanceof R)throw new Error("projective point not allowed");return n.is0(a)&&n.is0(u)?R.ZERO:new R(a,u,n.ONE)}static fromBytes(w){let a=R.fromAffine(y(Rt(w,void 0,"point")));return a.assertValidity(),a}static fromHex(w){return R.fromBytes(X("pointHex",w))}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(w=8,a=!0){return M.createCache(this,w),a||this.multiply(Me),this}assertValidity(){Y(this)}hasEvenY(){let{y:w}=this.toAffine();if(!n.isOdd)throw new Error("Field doesn't support isOdd");return!n.isOdd(w)}equals(w){q(w);let{X:a,Y:u,Z:x}=this,{X:m,Y:v,Z:p}=w,A=n.eql(n.mul(a,p),n.mul(m,x)),E=n.eql(n.mul(u,p),n.mul(v,x));return A&&E}negate(){return new R(this.X,n.neg(this.Y),this.Z)}double(){let{a:w,b:a}=s,u=n.mul(a,Me),{X:x,Y:m,Z:v}=this,p=n.ZERO,A=n.ZERO,E=n.ZERO,I=n.mul(x,x),O=n.mul(m,m),D=n.mul(v,v),k=n.mul(x,m);return k=n.add(k,k),E=n.mul(x,v),E=n.add(E,E),p=n.mul(w,E),A=n.mul(u,D),A=n.add(p,A),p=n.sub(O,A),A=n.add(O,A),A=n.mul(p,A),p=n.mul(k,p),E=n.mul(u,E),D=n.mul(w,D),k=n.sub(I,D),k=n.mul(w,k),k=n.add(k,E),E=n.add(I,I),I=n.add(E,I),I=n.add(I,D),I=n.mul(I,k),A=n.add(A,I),D=n.mul(m,v),D=n.add(D,D),I=n.mul(D,k),p=n.sub(p,I),E=n.mul(D,O),E=n.add(E,E),E=n.add(E,E),new R(p,A,E)}add(w){q(w);let{X:a,Y:u,Z:x}=this,{X:m,Y:v,Z:p}=w,A=n.ZERO,E=n.ZERO,I=n.ZERO,O=s.a,D=n.mul(s.b,Me),k=n.mul(a,m),U=n.mul(u,v),Z=n.mul(x,p),G=n.add(a,u),j=n.add(m,v);G=n.mul(G,j),j=n.add(k,U),G=n.sub(G,j),j=n.add(a,x);let $=n.add(m,p);return j=n.mul(j,$),$=n.add(k,Z),j=n.sub(j,$),$=n.add(u,x),A=n.add(v,p),$=n.mul($,A),A=n.add(U,Z),$=n.sub($,A),I=n.mul(O,j),A=n.mul(D,Z),I=n.add(A,I),A=n.sub(U,I),I=n.add(U,I),E=n.mul(A,I),U=n.add(k,k),U=n.add(U,k),Z=n.mul(O,Z),j=n.mul(D,j),U=n.add(U,Z),Z=n.sub(k,Z),Z=n.mul(O,Z),j=n.add(j,Z),k=n.mul(U,j),E=n.add(E,k),k=n.mul($,j),A=n.mul(G,A),A=n.sub(A,k),k=n.mul(G,U),I=n.mul($,I),I=n.add(I,k),new R(A,E,I)}subtract(w){return this.add(w.negate())}is0(){return this.equals(R.ZERO)}multiply(w){let{endo:a}=t;if(!o.isValidNot0(w))throw new Error("invalid scalar: out of range");let u,x,m=v=>M.cached(this,v,p=>De(R,p));if(a){let{k1neg:v,k1:p,k2neg:A,k2:E}=C(w),{p:I,f:O}=m(p),{p:D,f:k}=m(E);x=O.add(k),u=z(a.beta,I,D,v,A)}else{let{p:v,f:p}=m(w);u=v,x=p}return De(R,[u,x])[0]}multiplyUnsafe(w){let{endo:a}=t,u=this;if(!o.isValid(w))throw new Error("invalid scalar: out of range");if(w===wt||u.is0())return R.ZERO;if(w===Qt)return u;if(M.hasCache(this))return this.multiply(w);if(a){let{k1neg:x,k1:m,k2neg:v,k2:p}=C(w),{p1:A,p2:E}=Hr(R,u,m,p);return z(a.beta,A,E,x,v)}else return M.unsafe(u,w)}multiplyAndAddUnsafe(w,a,u){let x=this.multiplyUnsafe(a).add(w.multiplyUnsafe(u));return x.is0()?void 0:x}toAffine(w){return P(this,w)}isTorsionFree(){let{isTorsionFree:w}=t;return i===Qt?!0:w?w(R,this):M.unsafe(this,c).is0()}clearCofactor(){let{clearCofactor:w}=t;return i===Qt?this:w?w(R,this):this.multiplyUnsafe(i)}isSmallOrder(){return this.multiplyUnsafe(i).is0()}toBytes(w=!0){return de(w,"isCompressed"),this.assertValidity(),d(R,this,w)}toHex(w=!0){return st(this.toBytes(w))}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}get px(){return this.X}get py(){return this.X}get pz(){return this.Z}toRawBytes(w=!0){return this.toBytes(w)}_setWindowSize(w){this.precompute(w)}static normalizeZ(w){return De(R,w)}static msm(w,a){return kr(R,o,w,a)}static fromPrivateKey(w){return R.BASE.multiply(Ht(o,w))}}R.BASE=new R(s.Gx,s.Gy,n.ONE),R.ZERO=new R(n.ZERO,n.ONE,n.ZERO),R.Fp=n,R.Fn=o;let K=o.BITS,M=new Ve(R,t.endo?Math.ceil(K/2):K);return R.BASE.precompute(8),R}function Cr(e){return Uint8Array.of(e?2:3)}function Vr(e,t){return{secretKey:t.BYTES,publicKey:1+e.BYTES,publicKeyUncompressed:1+2*e.BYTES,publicKeyHasPrefix:!0,signature:2*t.BYTES}}function Es(e,t={}){let{Fn:r}=e,n=t.randomBytes||Mt,o=Object.assign(Vr(e.Fp,r),{seed:bn(r.ORDER)});function s(d){try{return!!Ht(r,d)}catch{return!1}}function i(d,y){let{publicKey:B,publicKeyUncompressed:S}=o;try{let _=d.length;return y===!0&&_!==B||y===!1&&_!==S?!1:!!e.fromBytes(d)}catch{return!1}}function c(d=n(o.seed)){return Ce(Rt(d,o.seed,"seed"),r.ORDER)}function f(d,y=!0){return e.BASE.multiply(Ht(r,d)).toBytes(y)}function l(d){let y=c(d);return{secretKey:y,publicKey:f(y)}}function h(d){if(typeof d=="bigint")return!1;if(d instanceof e)return!0;let{secretKey:y,publicKey:B,publicKeyUncompressed:S}=o;if(r.allowedLengths||y===B)return;let _=X("key",d).length;return _===B||_===S}function g(d,y,B=!0){if(h(d)===!0)throw new Error("first arg must be private key");if(h(y)===!1)throw new Error("second arg must be public key");let S=Ht(r,d);return e.fromHex(y).multiply(S).toBytes(B)}return Object.freeze({getPublicKey:f,getSharedSecret:g,keygen:l,Point:e,utils:{isValidSecretKey:s,isValidPublicKey:i,randomSecretKey:c,isValidPrivateKey:s,randomPrivateKey:c,normPrivateKeyToScalar:d=>Ht(r,d),precompute(d=8,y=e.BASE){return y.precompute(d,!1)}},lengths:o})}function Bs(e,t,r={}){_e(t),ge(r,{},{hmac:"function",lowS:"boolean",randomBytes:"function",bits2int:"function",bits2int_modN:"function"});let n=r.randomBytes||Mt,o=r.hmac||((a,...u)=>on(t,a,ot(...u))),{Fp:s,Fn:i}=e,{ORDER:c,BITS:f}=i,{keygen:l,getPublicKey:h,getSharedSecret:g,utils:b,lengths:d}=Es(e,r),y={prehash:!1,lowS:typeof r.lowS=="boolean"?r.lowS:!1,format:void 0,extraEntropy:!1},B="compact";function S(a){let u=c>>Qt;return a>u}function _(a,u){if(!i.isValidNot0(u))throw new Error(`invalid signature ${a}: out of range 1..Point.Fn.ORDER`);return u}function V(a,u){wn(u);let x=d.signature,m=u==="compact"?x:u==="recovered"?x+1:void 0;return Rt(a,m,`${u} signature`)}class N{constructor(u,x,m){this.r=_("r",u),this.s=_("s",x),m!=null&&(this.recovery=m),Object.freeze(this)}static fromBytes(u,x=B){V(u,x);let m;if(x==="der"){let{r:E,s:I}=yt.toSig(Rt(u));return new N(E,I)}x==="recovered"&&(m=u[0],x="compact",u=u.subarray(1));let v=i.BYTES,p=u.subarray(0,v),A=u.subarray(v,v*2);return new N(i.fromBytes(p),i.fromBytes(A),m)}static fromHex(u,x){return this.fromBytes(Dt(u),x)}addRecoveryBit(u){return new N(this.r,this.s,u)}recoverPublicKey(u){let x=s.ORDER,{r:m,s:v,recovery:p}=this;if(p==null||![0,1,2,3].includes(p))throw new Error("recovery id invalid");if(c*qr<x&&p>1)throw new Error("recovery id is ambiguous for h>1 curve");let E=p===2||p===3?m+c:m;if(!s.isValid(E))throw new Error("recovery id 2 or 3 invalid");let I=s.toBytes(E),O=e.fromBytes(ot(Cr((p&1)===0),I)),D=i.inv(E),k=C(X("msgHash",u)),U=i.create(-k*D),Z=i.create(v*D),G=e.BASE.multiplyUnsafe(U).add(O.multiplyUnsafe(Z));if(G.is0())throw new Error("point at infinify");return G.assertValidity(),G}hasHighS(){return S(this.s)}toBytes(u=B){if(wn(u),u==="der")return Dt(yt.hexFromSig(this));let x=i.toBytes(this.r),m=i.toBytes(this.s);if(u==="recovered"){if(this.recovery==null)throw new Error("recovery bit must be present");return ot(Uint8Array.of(this.recovery),x,m)}return ot(x,m)}toHex(u){return st(this.toBytes(u))}assertValidity(){}static fromCompact(u){return N.fromBytes(X("sig",u),"compact")}static fromDER(u){return N.fromBytes(X("sig",u),"der")}normalizeS(){return this.hasHighS()?new N(this.r,i.neg(this.s),this.recovery):this}toDERRawBytes(){return this.toBytes("der")}toDERHex(){return st(this.toBytes("der"))}toCompactRawBytes(){return this.toBytes("compact")}toCompactHex(){return st(this.toBytes("compact"))}}let q=r.bits2int||function(u){if(u.length>8192)throw new Error("input is too large");let x=pt(u),m=u.length*8-f;return m>0?x>>BigInt(m):x},C=r.bits2int_modN||function(u){return i.create(q(u))},P=Ut(f);function Y(a){return gr("num < 2^"+f,a,wt,P),i.toBytes(a)}function z(a,u){return Rt(a,void 0,"message"),u?Rt(t(a),void 0,"prehashed message"):a}function R(a,u,x){if(["recovered","canonical"].some(U=>U in x))throw new Error("sign() legacy options not supported");let{lowS:m,prehash:v,extraEntropy:p}=yn(x,y);a=z(a,v);let A=C(a),E=Ht(i,u),I=[Y(E),Y(A)];if(p!=null&&p!==!1){let U=p===!0?n(d.secretKey):p;I.push(X("extraEntropy",U))}let O=ot(...I),D=A;function k(U){let Z=q(U);if(!i.isValidNot0(Z))return;let G=i.inv(Z),j=e.BASE.multiply(Z).toAffine(),$=i.create(j.x);if($===wt)return;let J=i.create(G*i.create(D+$*E));if(J===wt)return;let fe=(j.x===$?0:2)|Number(j.y&Qt),ae=J;return m&&S(J)&&(ae=i.neg(J),fe^=1),new N($,ae,fe)}return{seed:O,k2sig:k}}function K(a,u,x={}){a=X("message",a);let{seed:m,k2sig:v}=R(a,u,x);return xr(t.outputLen,i.BYTES,o)(m,v)}function M(a){let u,x=typeof a=="string"||Ct(a),m=!x&&a!==null&&typeof a=="object"&&typeof a.r=="bigint"&&typeof a.s=="bigint";if(!x&&!m)throw new Error("invalid signature, expected Uint8Array, hex string or Signature instance");if(m)u=new N(a.r,a.s);else if(x){try{u=N.fromBytes(X("sig",a),"der")}catch(v){if(!(v instanceof yt.Err))throw v}if(!u)try{u=N.fromBytes(X("sig",a),"compact")}catch{return!1}}return u||!1}function L(a,u,x,m={}){let{lowS:v,prehash:p,format:A}=yn(m,y);if(x=X("publicKey",x),u=z(X("message",u),p),"strict"in m)throw new Error("options.strict was renamed to lowS");let E=A===void 0?M(a):N.fromBytes(X("sig",a),A);if(E===!1)return!1;try{let I=e.fromBytes(x);if(v&&E.hasHighS())return!1;let{r:O,s:D}=E,k=C(u),U=i.inv(D),Z=i.create(k*U),G=i.create(O*U),j=e.BASE.multiplyUnsafe(Z).add(I.multiplyUnsafe(G));return j.is0()?!1:i.create(j.x)===O}catch{return!1}}function w(a,u,x={}){let{prehash:m}=yn(x,y);return u=z(u,m),N.fromBytes(a,"recovered").recoverPublicKey(u).toBytes()}return Object.freeze({keygen:l,getPublicKey:h,getSharedSecret:g,utils:b,lengths:d,Point:e,sign:K,verify:L,recoverPublicKey:w,Signature:N,hash:t})}function vs(e){let t={a:e.a,b:e.b,p:e.Fp.ORDER,n:e.n,h:e.h,Gx:e.Gx,Gy:e.Gy},r=e.Fp,n=e.allowedPrivateKeyLengths?Array.from(new Set(e.allowedPrivateKeyLengths.map(i=>Math.ceil(i/2)))):void 0,o=Ot(t.n,{BITS:e.nBitLength,allowedLengths:n,modFromBytes:e.wrapPrivateKey}),s={Fp:r,Fn:o,allowInfinityPoint:e.allowInfinityPoint,endo:e.endo,isTorsionFree:e.isTorsionFree,clearCofactor:e.clearCofactor,fromBytes:e.fromBytes,toBytes:e.toBytes};return{CURVE:t,curveOpts:s}}function As(e){let{CURVE:t,curveOpts:r}=vs(e),n={hmac:e.hmac,randomBytes:e.randomBytes,lowS:e.lowS,bits2int:e.bits2int,bits2int_modN:e.bits2int_modN};return{CURVE:t,curveOpts:r,hash:e.hash,ecdsaOpts:n}}function Ss(e,t){let r=t.Point;return Object.assign({},t,{ProjectivePoint:r,CURVE:Object.assign({},e,qe(r.Fn.ORDER,r.Fn.BITS))})}function Dr(e){let{CURVE:t,curveOpts:r,hash:n,ecdsaOpts:o}=As(e),s=ms(t,r),i=Bs(s,n,o);return Ss(e,i)}function Mr(e,t){let r=n=>Dr({...e,hash:n});return{...r(t),create:r}}var Ft={p:BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f"),n:BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"),h:BigInt(1),a:BigInt(0),b:BigInt(7),Gx:BigInt("0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"),Gy:BigInt("0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8")},Is={beta:BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),basises:[[BigInt("0x3086d221a7d46bcde86c90e49284eb15"),-BigInt("0xe4437ed6010e88286f547fa90abfe4c3")],[BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"),BigInt("0x3086d221a7d46bcde86c90e49284eb15")]]},Ls=BigInt(0),Zr=BigInt(1),En=BigInt(2);function _s(e){let t=Ft.p,r=BigInt(3),n=BigInt(6),o=BigInt(11),s=BigInt(22),i=BigInt(23),c=BigInt(44),f=BigInt(88),l=e*e*e%t,h=l*l*e%t,g=ct(h,r,t)*h%t,b=ct(g,r,t)*h%t,d=ct(b,En,t)*l%t,y=ct(d,o,t)*d%t,B=ct(y,s,t)*y%t,S=ct(B,c,t)*B%t,_=ct(S,f,t)*S%t,V=ct(_,c,t)*B%t,N=ct(V,r,t)*h%t,q=ct(N,i,t)*y%t,C=ct(q,n,t)*l%t,P=ct(C,En,t);if(!Ze.eql(Ze.sqr(P),e))throw new Error("Cannot find square root");return P}var Ze=Ot(Ft.p,{sqrt:_s}),$r=Mr({...Ft,Fp:Ze,lowS:!0,endo:Is},Wt),jr={};function je(e,...t){let r=jr[e];if(r===void 0){let n=Wt(Ue(e));r=ot(n,n),jr[e]=r}return Wt(ot(r,...t))}var vn=e=>e.toBytes(!0).slice(1),te=$r.Point,An=e=>e%En===Ls;function Bn(e){let{Fn:t,BASE:r}=te,n=Ht(t,e),o=r.multiply(n);return{scalar:An(o.y)?n:t.neg(n),bytes:vn(o)}}function Pr(e){let t=Ze;if(!t.isValidNot0(e))throw new Error("invalid x: Fail if x \u2265 p");let r=t.create(e*e),n=t.create(r*e+BigInt(7)),o=t.sqrt(n);An(o)||(o=t.neg(o));let s=te.fromAffine({x:e,y:o});return s.assertValidity(),s}var pe=pt;function Gr(...e){return te.Fn.create(pe(je("BIP0340/challenge",...e)))}function Kr(e){return Bn(e).bytes}function Rs(e,t,r=Mt(32)){let{Fn:n}=te,o=X("message",e),{bytes:s,scalar:i}=Bn(t),c=X("auxRand",r,32),f=n.toBytes(i^pe(je("BIP0340/aux",c))),l=je("BIP0340/nonce",f,s,o),{bytes:h,scalar:g}=Bn(l),b=Gr(h,s,o),d=new Uint8Array(64);if(d.set(h,0),d.set(n.toBytes(n.create(g+b*i)),32),!zr(d,o,s))throw new Error("sign: Invalid signature produced");return d}function zr(e,t,r){let{Fn:n,BASE:o}=te,s=X("signature",e,64),i=X("message",t),c=X("publicKey",r,32);try{let f=Pr(pe(c)),l=pe(s.subarray(0,32));if(!be(l,Zr,Ft.p))return!1;let h=pe(s.subarray(32,64));if(!be(h,Zr,Ft.n))return!1;let g=Gr(n.toBytes(l),vn(f),i),b=o.multiplyUnsafe(h).add(f.multiplyUnsafe(n.neg(g))),{x:d,y}=b.toAffine();return!(b.is0()||!An(y)||d!==l)}catch{return!1}}var ye=(()=>{let r=(o=Mt(48))=>Ce(o,Ft.n);$r.utils.randomSecretKey;function n(o){let s=r(o);return{secretKey:s,publicKey:Kr(s)}}return{keygen:n,getPublicKey:Kr,sign:Rs,verify:zr,Point:te,utils:{randomSecretKey:r,randomPrivateKey:r,taggedHash:je,lift_x:Pr,pointToBytes:vn,numberToBytesBE:Xt,bytesToNumberBE:pt,mod:it},lengths:{secretKey:32,publicKey:32,publicKeyHasPrefix:!1,signature:64,seed:48}}})();var Sn=Wt;function Us(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"}function Ke(e){if(typeof e!="boolean")throw new Error(`boolean expected, not ${e}`)}function $e(e){if(!Number.isSafeInteger(e)||e<0)throw new Error("positive integer expected, got "+e)}function Q(e,t,r=""){let n=Us(e),o=e?.length,s=t!==void 0;if(!n||s&&o!==t){let i=r&&`"${r}" `,c=s?` of length ${t}`:"",f=n?`length=${o}`:`type=${typeof e}`;throw new Error(i+"expected Uint8Array"+c+", got "+f)}return e}function In(e,t=!0){if(e.destroyed)throw new Error("Hash instance has been destroyed");if(t&&e.finished)throw new Error("Hash#digest() has already been called")}function Yr(e,t){Q(e,void 0,"output");let r=t.outputLen;if(e.length<r)throw new Error("digestInto() expects output buffer of length at least "+r)}function mt(e){return new Uint32Array(e.buffer,e.byteOffset,Math.floor(e.byteLength/4))}function Et(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function Os(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}var Hs=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function Wr(e,t){if(t==null||typeof t!="object")throw new Error("options must be defined");return Object.assign(e,t)}function Pe(e,t){if(e.length!==t.length)return!1;let r=0;for(let n=0;n<e.length;n++)r|=e[n]^t[n];return r===0}var Ln=(e,t)=>{function r(n,...o){if(Q(n,void 0,"key"),!Hs)throw new Error("Non little-endian hardware is not yet supported");if(e.nonceLength!==void 0){let h=o[0];Q(h,e.varSizeNonce?void 0:e.nonceLength,"nonce")}let s=e.tagLength;s&&o[1]!==void 0&&Q(o[1],void 0,"AAD");let i=t(n,...o),c=(h,g)=>{if(g!==void 0){if(h!==2)throw new Error("cipher output not supported");Q(g,void 0,"output")}},f=!1;return{encrypt(h,g){if(f)throw new Error("cannot encrypt() twice with same key + nonce");return f=!0,Q(h),c(i.encrypt.length,g),i.encrypt(h,g)},decrypt(h,g){if(Q(h),s&&h.length<s)throw new Error('"ciphertext" expected length bigger than tagLength='+s);return c(i.decrypt.length,g),i.decrypt(h,g)}}}return Object.assign(r,e),r};function _n(e,t,r=!0){if(t===void 0)return new Uint8Array(e);if(t.length!==e)throw new Error('"output" expected Uint8Array of length '+e+", got: "+t.length);if(r&&!ks(t))throw new Error("invalid output, must be aligned");return t}function Xr(e,t,r){Ke(r);let n=new Uint8Array(16),o=Os(n);return o.setBigUint64(0,BigInt(t),r),o.setBigUint64(8,BigInt(e),r),n}function ks(e){return e.byteOffset%4===0}function ee(e){return Uint8Array.from(e)}var Qr=e=>Uint8Array.from(e.split(""),t=>t.charCodeAt(0)),Ts=Qr("expand 16-byte k"),Ns=Qr("expand 32-byte k"),qs=mt(Ts),Cs=mt(Ns);function H(e,t){return e<<t|e>>>32-t}function Rn(e){return e.byteOffset%4===0}var Ge=64,Vs=16,Fr=2**32-1,Jr=Uint32Array.of();function Ds(e,t,r,n,o,s,i,c){let f=o.length,l=new Uint8Array(Ge),h=mt(l),g=Rn(o)&&Rn(s),b=g?mt(o):Jr,d=g?mt(s):Jr;for(let y=0;y<f;i++){if(e(t,r,n,h,i,c),i>=Fr)throw new Error("arx: counter overflow");let B=Math.min(Ge,f-y);if(g&&B===Ge){let S=y/4;if(y%4!==0)throw new Error("arx: invalid block position");for(let _=0,V;_<Vs;_++)V=S+_,d[V]=b[V]^h[_];y+=Ge;continue}for(let S=0,_;S<B;S++)_=y+S,s[_]=o[_]^l[S];y+=B}}function Un(e,t){let{allowShortKeys:r,extendNonceFn:n,counterLength:o,counterRight:s,rounds:i}=Wr({allowShortKeys:!1,counterLength:8,counterRight:!1,rounds:20},t);if(typeof e!="function")throw new Error("core must be a function");return $e(o),$e(i),Ke(s),Ke(r),(c,f,l,h,g=0)=>{Q(c,void 0,"key"),Q(f,void 0,"nonce"),Q(l,void 0,"data");let b=l.length;if(h===void 0&&(h=new Uint8Array(b)),Q(h,void 0,"output"),$e(g),g<0||g>=Fr)throw new Error("arx: counter overflow");if(h.length<b)throw new Error(`arx: output (${h.length}) is shorter than data (${b})`);let d=[],y=c.length,B,S;if(y===32)d.push(B=ee(c)),S=Cs;else if(y===16&&r)B=new Uint8Array(32),B.set(c),B.set(c,16),S=qs,d.push(B);else throw Q(c,32,"arx key"),new Error("invalid key size");Rn(f)||d.push(f=ee(f));let _=mt(B);if(n){if(f.length!==24)throw new Error("arx: extended nonce must be 24 bytes");n(S,_,mt(f.subarray(0,16)),_),f=f.subarray(16)}let V=16-o;if(V!==f.length)throw new Error(`arx: nonce must be ${V} or 16 bytes`);if(V!==12){let q=new Uint8Array(12);q.set(f,s?0:12-f.length),f=q,d.push(f)}let N=mt(f);return Ds(e,S,_,N,l,h,g,i),Et(...d),h}}function F(e,t){return e[t++]&255|(e[t++]&255)<<8}var On=class{constructor(t){T(this,"blockLen",16);T(this,"outputLen",16);T(this,"buffer",new Uint8Array(16));T(this,"r",new Uint16Array(10));T(this,"h",new Uint16Array(10));T(this,"pad",new Uint16Array(8));T(this,"pos",0);T(this,"finished",!1);t=ee(Q(t,32,"key"));let r=F(t,0),n=F(t,2),o=F(t,4),s=F(t,6),i=F(t,8),c=F(t,10),f=F(t,12),l=F(t,14);this.r[0]=r&8191,this.r[1]=(r>>>13|n<<3)&8191,this.r[2]=(n>>>10|o<<6)&7939,this.r[3]=(o>>>7|s<<9)&8191,this.r[4]=(s>>>4|i<<12)&255,this.r[5]=i>>>1&8190,this.r[6]=(i>>>14|c<<2)&8191,this.r[7]=(c>>>11|f<<5)&8065,this.r[8]=(f>>>8|l<<8)&8191,this.r[9]=l>>>5&127;for(let h=0;h<8;h++)this.pad[h]=F(t,16+2*h)}process(t,r,n=!1){let o=n?0:2048,{h:s,r:i}=this,c=i[0],f=i[1],l=i[2],h=i[3],g=i[4],b=i[5],d=i[6],y=i[7],B=i[8],S=i[9],_=F(t,r+0),V=F(t,r+2),N=F(t,r+4),q=F(t,r+6),C=F(t,r+8),P=F(t,r+10),Y=F(t,r+12),z=F(t,r+14),R=s[0]+(_&8191),K=s[1]+((_>>>13|V<<3)&8191),M=s[2]+((V>>>10|N<<6)&8191),L=s[3]+((N>>>7|q<<9)&8191),w=s[4]+((q>>>4|C<<12)&8191),a=s[5]+(C>>>1&8191),u=s[6]+((C>>>14|P<<2)&8191),x=s[7]+((P>>>11|Y<<5)&8191),m=s[8]+((Y>>>8|z<<8)&8191),v=s[9]+(z>>>5|o),p=0,A=p+R*c+K*(5*S)+M*(5*B)+L*(5*y)+w*(5*d);p=A>>>13,A&=8191,A+=a*(5*b)+u*(5*g)+x*(5*h)+m*(5*l)+v*(5*f),p+=A>>>13,A&=8191;let E=p+R*f+K*c+M*(5*S)+L*(5*B)+w*(5*y);p=E>>>13,E&=8191,E+=a*(5*d)+u*(5*b)+x*(5*g)+m*(5*h)+v*(5*l),p+=E>>>13,E&=8191;let I=p+R*l+K*f+M*c+L*(5*S)+w*(5*B);p=I>>>13,I&=8191,I+=a*(5*y)+u*(5*d)+x*(5*b)+m*(5*g)+v*(5*h),p+=I>>>13,I&=8191;let O=p+R*h+K*l+M*f+L*c+w*(5*S);p=O>>>13,O&=8191,O+=a*(5*B)+u*(5*y)+x*(5*d)+m*(5*b)+v*(5*g),p+=O>>>13,O&=8191;let D=p+R*g+K*h+M*l+L*f+w*c;p=D>>>13,D&=8191,D+=a*(5*S)+u*(5*B)+x*(5*y)+m*(5*d)+v*(5*b),p+=D>>>13,D&=8191;let k=p+R*b+K*g+M*h+L*l+w*f;p=k>>>13,k&=8191,k+=a*c+u*(5*S)+x*(5*B)+m*(5*y)+v*(5*d),p+=k>>>13,k&=8191;let U=p+R*d+K*b+M*g+L*h+w*l;p=U>>>13,U&=8191,U+=a*f+u*c+x*(5*S)+m*(5*B)+v*(5*y),p+=U>>>13,U&=8191;let Z=p+R*y+K*d+M*b+L*g+w*h;p=Z>>>13,Z&=8191,Z+=a*l+u*f+x*c+m*(5*S)+v*(5*B),p+=Z>>>13,Z&=8191;let G=p+R*B+K*y+M*d+L*b+w*g;p=G>>>13,G&=8191,G+=a*h+u*l+x*f+m*c+v*(5*S),p+=G>>>13,G&=8191;let j=p+R*S+K*B+M*y+L*d+w*b;p=j>>>13,j&=8191,j+=a*g+u*h+x*l+m*f+v*c,p+=j>>>13,j&=8191,p=(p<<2)+p|0,p=p+A|0,A=p&8191,p=p>>>13,E+=p,s[0]=A,s[1]=E,s[2]=I,s[3]=O,s[4]=D,s[5]=k,s[6]=U,s[7]=Z,s[8]=G,s[9]=j}finalize(){let{h:t,pad:r}=this,n=new Uint16Array(10),o=t[1]>>>13;t[1]&=8191;for(let c=2;c<10;c++)t[c]+=o,o=t[c]>>>13,t[c]&=8191;t[0]+=o*5,o=t[0]>>>13,t[0]&=8191,t[1]+=o,o=t[1]>>>13,t[1]&=8191,t[2]+=o,n[0]=t[0]+5,o=n[0]>>>13,n[0]&=8191;for(let c=1;c<10;c++)n[c]=t[c]+o,o=n[c]>>>13,n[c]&=8191;n[9]-=8192;let s=(o^1)-1;for(let c=0;c<10;c++)n[c]&=s;s=~s;for(let c=0;c<10;c++)t[c]=t[c]&s|n[c];t[0]=(t[0]|t[1]<<13)&65535,t[1]=(t[1]>>>3|t[2]<<10)&65535,t[2]=(t[2]>>>6|t[3]<<7)&65535,t[3]=(t[3]>>>9|t[4]<<4)&65535,t[4]=(t[4]>>>12|t[5]<<1|t[6]<<14)&65535,t[5]=(t[6]>>>2|t[7]<<11)&65535,t[6]=(t[7]>>>5|t[8]<<8)&65535,t[7]=(t[8]>>>8|t[9]<<5)&65535;let i=t[0]+r[0];t[0]=i&65535;for(let c=1;c<8;c++)i=(t[c]+r[c]|0)+(i>>>16)|0,t[c]=i&65535;Et(n)}update(t){In(this),Q(t),t=ee(t);let{buffer:r,blockLen:n}=this,o=t.length;for(let s=0;s<o;){let i=Math.min(n-this.pos,o-s);if(i===n){for(;n<=o-s;s+=n)this.process(t,s);continue}r.set(t.subarray(s,s+i),this.pos),this.pos+=i,s+=i,this.pos===n&&(this.process(r,0,!1),this.pos=0)}return this}destroy(){Et(this.h,this.r,this.buffer,this.pad)}digestInto(t){In(this),Yr(t,this),this.finished=!0;let{buffer:r,h:n}=this,{pos:o}=this;if(o){for(r[o++]=1;o<16;o++)r[o]=0;this.process(r,0,!0)}this.finalize();let s=0;for(let i=0;i<8;i++)t[s++]=n[i]>>>0,t[s++]=n[i]>>>8;return t}digest(){let{buffer:t,outputLen:r}=this;this.digestInto(t);let n=t.slice(0,r);return this.destroy(),n}};function Ms(e){let t=(n,o)=>e(o).update(n).digest(),r=e(new Uint8Array(32));return t.outputLen=r.outputLen,t.blockLen=r.blockLen,t.create=n=>e(n),t}var to=Ms(e=>new On(e));function ro(e,t,r,n,o,s=20){let i=e[0],c=e[1],f=e[2],l=e[3],h=t[0],g=t[1],b=t[2],d=t[3],y=t[4],B=t[5],S=t[6],_=t[7],V=o,N=r[0],q=r[1],C=r[2],P=i,Y=c,z=f,R=l,K=h,M=g,L=b,w=d,a=y,u=B,x=S,m=_,v=V,p=N,A=q,E=C;for(let O=0;O<s;O+=2)P=P+K|0,v=H(v^P,16),a=a+v|0,K=H(K^a,12),P=P+K|0,v=H(v^P,8),a=a+v|0,K=H(K^a,7),Y=Y+M|0,p=H(p^Y,16),u=u+p|0,M=H(M^u,12),Y=Y+M|0,p=H(p^Y,8),u=u+p|0,M=H(M^u,7),z=z+L|0,A=H(A^z,16),x=x+A|0,L=H(L^x,12),z=z+L|0,A=H(A^z,8),x=x+A|0,L=H(L^x,7),R=R+w|0,E=H(E^R,16),m=m+E|0,w=H(w^m,12),R=R+w|0,E=H(E^R,8),m=m+E|0,w=H(w^m,7),P=P+M|0,E=H(E^P,16),x=x+E|0,M=H(M^x,12),P=P+M|0,E=H(E^P,8),x=x+E|0,M=H(M^x,7),Y=Y+L|0,v=H(v^Y,16),m=m+v|0,L=H(L^m,12),Y=Y+L|0,v=H(v^Y,8),m=m+v|0,L=H(L^m,7),z=z+w|0,p=H(p^z,16),a=a+p|0,w=H(w^a,12),z=z+w|0,p=H(p^z,8),a=a+p|0,w=H(w^a,7),R=R+K|0,A=H(A^R,16),u=u+A|0,K=H(K^u,12),R=R+K|0,A=H(A^R,8),u=u+A|0,K=H(K^u,7);let I=0;n[I++]=i+P|0,n[I++]=c+Y|0,n[I++]=f+z|0,n[I++]=l+R|0,n[I++]=h+K|0,n[I++]=g+M|0,n[I++]=b+L|0,n[I++]=d+w|0,n[I++]=y+a|0,n[I++]=B+u|0,n[I++]=S+x|0,n[I++]=_+m|0,n[I++]=V+v|0,n[I++]=N+p|0,n[I++]=q+A|0,n[I++]=C+E|0}function Zs(e,t,r,n){let o=e[0],s=e[1],i=e[2],c=e[3],f=t[0],l=t[1],h=t[2],g=t[3],b=t[4],d=t[5],y=t[6],B=t[7],S=r[0],_=r[1],V=r[2],N=r[3];for(let C=0;C<20;C+=2)o=o+f|0,S=H(S^o,16),b=b+S|0,f=H(f^b,12),o=o+f|0,S=H(S^o,8),b=b+S|0,f=H(f^b,7),s=s+l|0,_=H(_^s,16),d=d+_|0,l=H(l^d,12),s=s+l|0,_=H(_^s,8),d=d+_|0,l=H(l^d,7),i=i+h|0,V=H(V^i,16),y=y+V|0,h=H(h^y,12),i=i+h|0,V=H(V^i,8),y=y+V|0,h=H(h^y,7),c=c+g|0,N=H(N^c,16),B=B+N|0,g=H(g^B,12),c=c+g|0,N=H(N^c,8),B=B+N|0,g=H(g^B,7),o=o+l|0,N=H(N^o,16),y=y+N|0,l=H(l^y,12),o=o+l|0,N=H(N^o,8),y=y+N|0,l=H(l^y,7),s=s+h|0,S=H(S^s,16),B=B+S|0,h=H(h^B,12),s=s+h|0,S=H(S^s,8),B=B+S|0,h=H(h^B,7),i=i+g|0,_=H(_^i,16),b=b+_|0,g=H(g^b,12),i=i+g|0,_=H(_^i,8),b=b+_|0,g=H(g^b,7),c=c+f|0,V=H(V^c,16),d=d+V|0,f=H(f^d,12),c=c+f|0,V=H(V^c,8),d=d+V|0,f=H(f^d,7);let q=0;n[q++]=o,n[q++]=s,n[q++]=i,n[q++]=c,n[q++]=S,n[q++]=_,n[q++]=V,n[q++]=N}var Hn=Un(ro,{counterRight:!1,counterLength:4,allowShortKeys:!1}),js=Un(ro,{counterRight:!1,counterLength:8,extendNonceFn:Zs,allowShortKeys:!1});var Ks=new Uint8Array(16),eo=(e,t)=>{e.update(t);let r=t.length%16;r&&e.update(Ks.subarray(r))},$s=new Uint8Array(32);function no(e,t,r,n,o){o!==void 0&&Q(o,void 0,"AAD");let s=e(t,r,$s),i=Xr(n.length,o?o.length:0,!0),c=to.create(s);o&&eo(c,o),eo(c,n),c.update(i);let f=c.digest();return Et(s,i),f}var oo=e=>(t,r,n)=>({encrypt(s,i){let c=s.length;i=_n(c+16,i,!1),i.set(s);let f=i.subarray(0,-16);e(t,r,f,f,1);let l=no(e,t,r,f,n);return i.set(l,c),Et(l),i},decrypt(s,i){i=_n(s.length-16,i,!1);let c=s.subarray(0,-16),f=s.subarray(-16),l=no(e,t,r,c,n);if(!Pe(f,l))throw new Error("invalid tag");return i.set(s.subarray(0,-16)),e(t,r,i,i,1),Et(l),i}}),Zc=Ln({blockSize:64,nonceLength:12,tagLength:16},oo(Hn)),jc=Ln({blockSize:64,nonceLength:24,tagLength:16},oo(js));function we(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"}function ut(e,t=""){if(!Number.isSafeInteger(e)||e<0){let r=t&&`"${t}" `;throw new Error(`${r}expected integer >= 0, got ${e}`)}}function W(e,t,r=""){let n=we(e),o=e?.length,s=t!==void 0;if(!n||s&&o!==t){let i=r&&`"${r}" `,c=s?` of length ${t}`:"",f=n?`length=${o}`:`type=${typeof e}`;throw new Error(i+"expected Uint8Array"+c+", got "+f)}return e}function Kt(e){if(typeof e!="function"||typeof e.create!="function")throw new Error("Hash must wrapped by utils.createHasher");ut(e.outputLen),ut(e.blockLen)}function ne(e,t=!0){if(e.destroyed)throw new Error("Hash instance has been destroyed");if(t&&e.finished)throw new Error("Hash#digest() has already been called")}function io(e,t){W(e,void 0,"digestInto() output");let r=t.outputLen;if(e.length<r)throw new Error('"digestInto() output" expected to be of length >='+r)}function vt(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function ze(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function ht(e,t){return e<<32-t|e>>>t}var co=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",Ps=Array.from({length:256},(e,t)=>t.toString(16).padStart(2,"0"));function $t(e){if(W(e),co)return e.toHex();let t="";for(let r=0;r<e.length;r++)t+=Ps[e[r]];return t}var Bt={_0:48,_9:57,A:65,F:70,a:97,f:102};function so(e){if(e>=Bt._0&&e<=Bt._9)return e-Bt._0;if(e>=Bt.A&&e<=Bt.F)return e-(Bt.A-10);if(e>=Bt.a&&e<=Bt.f)return e-(Bt.a-10)}function At(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);if(co)return Uint8Array.fromHex(e);let t=e.length,r=t/2;if(t%2)throw new Error("hex string expected, got unpadded hex of length "+t);let n=new Uint8Array(r);for(let o=0,s=0;o<r;o++,s+=2){let i=so(e.charCodeAt(s)),c=so(e.charCodeAt(s+1));if(i===void 0||c===void 0){let f=e[s]+e[s+1];throw new Error('hex string expected, got non-hex character "'+f+'" at index '+s)}n[o]=i*16+c}return n}function ft(...e){let t=0;for(let n=0;n<e.length;n++){let o=e[n];W(o),t+=o.length}let r=new Uint8Array(t);for(let n=0,o=0;n<e.length;n++){let s=e[n];r.set(s,o),o+=s.length}return r}function fo(e,t={}){let r=(o,s)=>e(s).update(o).digest(),n=e(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.create=o=>e(o),Object.assign(r,t),Object.freeze(r)}function me(e=32){let t=typeof globalThis=="object"?globalThis.crypto:null;if(typeof t?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");return t.getRandomValues(new Uint8Array(e))}var ao=e=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,e])});function uo(e,t,r){return e&t^~e&r}function lo(e,t,r){return e&t^e&r^t&r}var Ye=class{constructor(t,r,n,o){T(this,"blockLen");T(this,"outputLen");T(this,"padOffset");T(this,"isLE");T(this,"buffer");T(this,"view");T(this,"finished",!1);T(this,"length",0);T(this,"pos",0);T(this,"destroyed",!1);this.blockLen=t,this.outputLen=r,this.padOffset=n,this.isLE=o,this.buffer=new Uint8Array(t),this.view=ze(this.buffer)}update(t){ne(this),W(t);let{view:r,buffer:n,blockLen:o}=this,s=t.length;for(let i=0;i<s;){let c=Math.min(o-this.pos,s-i);if(c===o){let f=ze(t);for(;o<=s-i;i+=o)this.process(f,i);continue}n.set(t.subarray(i,i+c),this.pos),this.pos+=c,i+=c,this.pos===o&&(this.process(r,0),this.pos=0)}return this.length+=t.length,this.roundClean(),this}digestInto(t){ne(this),io(t,this),this.finished=!0;let{buffer:r,view:n,blockLen:o,isLE:s}=this,{pos:i}=this;r[i++]=128,vt(this.buffer.subarray(i)),this.padOffset>o-i&&(this.process(n,0),i=0);for(let g=i;g<o;g++)r[g]=0;n.setBigUint64(o-8,BigInt(this.length*8),s),this.process(n,0);let c=ze(t),f=this.outputLen;if(f%4)throw new Error("_sha2: outputLen must be aligned to 32bit");let l=f/4,h=this.get();if(l>h.length)throw new Error("_sha2: outputLen bigger than state");for(let g=0;g<l;g++)c.setUint32(4*g,h[g],s)}digest(){let{buffer:t,outputLen:r}=this;this.digestInto(t);let n=t.slice(0,r);return this.destroy(),n}_cloneInto(t){t||(t=new this.constructor),t.set(...this.get());let{blockLen:r,buffer:n,length:o,finished:s,destroyed:i,pos:c}=this;return t.destroyed=i,t.finished=s,t.length=o,t.pos=c,o%r&&t.buffer.set(n),t}clone(){return this._cloneInto()}},St=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var Gs=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),kt=new Uint32Array(64),kn=class extends Ye{constructor(t){super(64,t,8,!1)}get(){let{A:t,B:r,C:n,D:o,E:s,F:i,G:c,H:f}=this;return[t,r,n,o,s,i,c,f]}set(t,r,n,o,s,i,c,f){this.A=t|0,this.B=r|0,this.C=n|0,this.D=o|0,this.E=s|0,this.F=i|0,this.G=c|0,this.H=f|0}process(t,r){for(let g=0;g<16;g++,r+=4)kt[g]=t.getUint32(r,!1);for(let g=16;g<64;g++){let b=kt[g-15],d=kt[g-2],y=ht(b,7)^ht(b,18)^b>>>3,B=ht(d,17)^ht(d,19)^d>>>10;kt[g]=B+kt[g-7]+y+kt[g-16]|0}let{A:n,B:o,C:s,D:i,E:c,F:f,G:l,H:h}=this;for(let g=0;g<64;g++){let b=ht(c,6)^ht(c,11)^ht(c,25),d=h+b+uo(c,f,l)+Gs[g]+kt[g]|0,B=(ht(n,2)^ht(n,13)^ht(n,22))+lo(n,o,s)|0;h=l,l=f,f=c,c=i+d|0,i=s,s=o,o=n,n=d+B|0}n=n+this.A|0,o=o+this.B|0,s=s+this.C|0,i=i+this.D|0,c=c+this.E|0,f=f+this.F|0,l=l+this.G|0,h=h+this.H|0,this.set(n,o,s,i,c,f,l,h)}roundClean(){vt(kt)}destroy(){this.set(0,0,0,0,0,0,0,0),vt(this.buffer)}},Tn=class extends kn{constructor(){super(32);T(this,"A",St[0]|0);T(this,"B",St[1]|0);T(this,"C",St[2]|0);T(this,"D",St[3]|0);T(this,"E",St[4]|0);T(this,"F",St[5]|0);T(this,"G",St[6]|0);T(this,"H",St[7]|0)}};var re=fo(()=>new Tn,ao(1));var qn=BigInt(0),Nn=BigInt(1);function Ee(e,t=""){if(typeof e!="boolean"){let r=t&&`"${t}" `;throw new Error(r+"expected boolean, got type="+typeof e)}return e}function ho(e){if(typeof e=="bigint"){if(!We(e))throw new Error("positive bigint expected, got "+e)}else ut(e);return e}function Be(e){let t=ho(e).toString(16);return t.length&1?"0"+t:t}function bo(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);return e===""?qn:BigInt("0x"+e)}function oe(e){return bo($t(e))}function Cn(e){return bo($t(zs(W(e)).reverse()))}function Xe(e,t){ut(t),e=ho(e);let r=At(e.toString(16).padStart(t*2,"0"));if(r.length!==t)throw new Error("number too large");return r}function Vn(e,t){return Xe(e,t).reverse()}function zs(e){return Uint8Array.from(e)}var We=e=>typeof e=="bigint"&&qn<=e;function Ys(e,t,r){return We(e)&&We(t)&&We(r)&&t<=e&&e<r}function go(e,t,r,n){if(!Ys(t,r,n))throw new Error("expected valid "+e+": "+r+" <= n < "+n+", got "+t)}function Dn(e){let t;for(t=0;e>qn;e>>=Nn,t+=1);return t}var ve=e=>(Nn<<BigInt(e))-Nn;function xo(e,t,r){if(ut(e,"hashLen"),ut(t,"qByteLen"),typeof r!="function")throw new Error("hmacFn must be a function");let n=S=>new Uint8Array(S),o=Uint8Array.of(),s=Uint8Array.of(0),i=Uint8Array.of(1),c=1e3,f=n(e),l=n(e),h=0,g=()=>{f.fill(1),l.fill(0),h=0},b=(...S)=>r(l,ft(f,...S)),d=(S=o)=>{l=b(s,S),f=b(),S.length!==0&&(l=b(i,S),f=b())},y=()=>{if(h++>=c)throw new Error("drbg: tried max amount of iterations");let S=0,_=[];for(;S<t;){f=b();let V=f.slice();_.push(V),S+=f.length}return ft(..._)};return(S,_)=>{g(),d(S);let V;for(;!(V=_(y()));)d();return g(),V}}function Ae(e,t={},r={}){if(!e||typeof e!="object")throw new Error("expected valid options object");function n(s,i,c){let f=e[s];if(c&&f===void 0)return;let l=typeof f;if(l!==i||f===null)throw new Error(`param "${s}" is invalid: expected ${i}, got ${l}`)}let o=(s,i)=>Object.entries(s).forEach(([c,f])=>n(c,f,i));o(t,!1),o(r,!0)}function Mn(e){let t=new WeakMap;return(r,...n)=>{let o=t.get(r);if(o!==void 0)return o;let s=e(r,...n);return t.set(r,s),s}}var rt=BigInt(0),et=BigInt(1),Pt=BigInt(2),wo=BigInt(3),mo=BigInt(4),Eo=BigInt(5),Ws=BigInt(7),Bo=BigInt(8),Xs=BigInt(9),vo=BigInt(16);function bt(e,t){let r=e%t;return r>=rt?r:t+r}function at(e,t,r){let n=e;for(;t-- >rt;)n*=n,n%=r;return n}function po(e,t){if(e===rt)throw new Error("invert: expected non-zero number");if(t<=rt)throw new Error("invert: expected positive modulus, got "+t);let r=bt(e,t),n=t,o=rt,s=et,i=et,c=rt;for(;r!==rt;){let l=n/r,h=n%r,g=o-i*l,b=s-c*l;n=r,r=h,o=i,s=c,i=g,c=b}if(n!==et)throw new Error("invert: does not exist");return bt(o,t)}function jn(e,t,r){if(!e.eql(e.sqr(t),r))throw new Error("Cannot find square root")}function Ao(e,t){let r=(e.ORDER+et)/mo,n=e.pow(t,r);return jn(e,n,t),n}function Js(e,t){let r=(e.ORDER-Eo)/Bo,n=e.mul(t,Pt),o=e.pow(n,r),s=e.mul(t,o),i=e.mul(e.mul(s,Pt),o),c=e.mul(s,e.sub(i,e.ONE));return jn(e,c,t),c}function Qs(e){let t=se(e),r=So(e),n=r(t,t.neg(t.ONE)),o=r(t,n),s=r(t,t.neg(n)),i=(e+Ws)/vo;return(c,f)=>{let l=c.pow(f,i),h=c.mul(l,n),g=c.mul(l,o),b=c.mul(l,s),d=c.eql(c.sqr(h),f),y=c.eql(c.sqr(g),f);l=c.cmov(l,h,d),h=c.cmov(b,g,y);let B=c.eql(c.sqr(h),f),S=c.cmov(l,h,B);return jn(c,S,f),S}}function So(e){if(e<wo)throw new Error("sqrt is not defined for small field");let t=e-et,r=0;for(;t%Pt===rt;)t/=Pt,r++;let n=Pt,o=se(e);for(;yo(o,n)===1;)if(n++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(r===1)return Ao;let s=o.pow(n,t),i=(t+et)/Pt;return function(f,l){if(f.is0(l))return l;if(yo(f,l)!==1)throw new Error("Cannot find square root");let h=r,g=f.mul(f.ONE,s),b=f.pow(l,t),d=f.pow(l,i);for(;!f.eql(b,f.ONE);){if(f.is0(b))return f.ZERO;let y=1,B=f.sqr(b);for(;!f.eql(B,f.ONE);)if(y++,B=f.sqr(B),y===h)throw new Error("Cannot find square root");let S=et<<BigInt(h-y-1),_=f.pow(g,S);h=y,g=f.sqr(_),b=f.mul(b,g),d=f.mul(d,_)}return d}}function Fs(e){return e%mo===wo?Ao:e%Bo===Eo?Js:e%vo===Xs?Qs(e):So(e)}var ti=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function Kn(e){let t={ORDER:"bigint",BYTES:"number",BITS:"number"},r=ti.reduce((n,o)=>(n[o]="function",n),t);return Ae(e,r),e}function ei(e,t,r){if(r<rt)throw new Error("invalid exponent, negatives unsupported");if(r===rt)return e.ONE;if(r===et)return t;let n=e.ONE,o=t;for(;r>rt;)r&et&&(n=e.mul(n,o)),o=e.sqr(o),r>>=et;return n}function Je(e,t,r=!1){let n=new Array(t.length).fill(r?e.ZERO:void 0),o=t.reduce((i,c,f)=>e.is0(c)?i:(n[f]=i,e.mul(i,c)),e.ONE),s=e.inv(o);return t.reduceRight((i,c,f)=>e.is0(c)?i:(n[f]=e.mul(i,n[f]),e.mul(i,c)),s),n}function yo(e,t){let r=(e.ORDER-et)/Pt,n=e.pow(t,r),o=e.eql(n,e.ONE),s=e.eql(n,e.ZERO),i=e.eql(n,e.neg(e.ONE));if(!o&&!s&&!i)throw new Error("invalid Legendre symbol result");return o?1:s?0:-1}function ni(e,t){t!==void 0&&ut(t);let r=t!==void 0?t:e.toString(2).length,n=Math.ceil(r/8);return{nBitLength:r,nByteLength:n}}var Zn=class{constructor(t,r={}){T(this,"ORDER");T(this,"BITS");T(this,"BYTES");T(this,"isLE");T(this,"ZERO",rt);T(this,"ONE",et);T(this,"_lengths");T(this,"_sqrt");T(this,"_mod");if(t<=rt)throw new Error("invalid field: expected ORDER > 0, got "+t);let n;this.isLE=!1,r!=null&&typeof r=="object"&&(typeof r.BITS=="number"&&(n=r.BITS),typeof r.sqrt=="function"&&(this.sqrt=r.sqrt),typeof r.isLE=="boolean"&&(this.isLE=r.isLE),r.allowedLengths&&(this._lengths=r.allowedLengths?.slice()),typeof r.modFromBytes=="boolean"&&(this._mod=r.modFromBytes));let{nBitLength:o,nByteLength:s}=ni(t,n);if(s>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");this.ORDER=t,this.BITS=o,this.BYTES=s,this._sqrt=void 0,Object.preventExtensions(this)}create(t){return bt(t,this.ORDER)}isValid(t){if(typeof t!="bigint")throw new Error("invalid field element: expected bigint, got "+typeof t);return rt<=t&&t<this.ORDER}is0(t){return t===rt}isValidNot0(t){return!this.is0(t)&&this.isValid(t)}isOdd(t){return(t&et)===et}neg(t){return bt(-t,this.ORDER)}eql(t,r){return t===r}sqr(t){return bt(t*t,this.ORDER)}add(t,r){return bt(t+r,this.ORDER)}sub(t,r){return bt(t-r,this.ORDER)}mul(t,r){return bt(t*r,this.ORDER)}pow(t,r){return ei(this,t,r)}div(t,r){return bt(t*po(r,this.ORDER),this.ORDER)}sqrN(t){return t*t}addN(t,r){return t+r}subN(t,r){return t-r}mulN(t,r){return t*r}inv(t){return po(t,this.ORDER)}sqrt(t){return this._sqrt||(this._sqrt=Fs(this.ORDER)),this._sqrt(this,t)}toBytes(t){return this.isLE?Vn(t,this.BYTES):Xe(t,this.BYTES)}fromBytes(t,r=!1){W(t);let{_lengths:n,BYTES:o,isLE:s,ORDER:i,_mod:c}=this;if(n){if(!n.includes(t.length)||t.length>o)throw new Error("Field.fromBytes: expected "+n+" bytes, got "+t.length);let l=new Uint8Array(o);l.set(t,s?0:l.length-t.length),t=l}if(t.length!==o)throw new Error("Field.fromBytes: expected "+o+" bytes, got "+t.length);let f=s?Cn(t):oe(t);if(c&&(f=bt(f,i)),!r&&!this.isValid(f))throw new Error("invalid field element: outside of range 0..ORDER");return f}invertBatch(t){return Je(this,t)}cmov(t,r,n){return n?r:t}};function se(e,t={}){return new Zn(e,t)}function Io(e){if(typeof e!="bigint")throw new Error("field order must be bigint");let t=e.toString(2).length;return Math.ceil(t/8)}function $n(e){let t=Io(e);return t+Math.ceil(t/2)}function Pn(e,t,r=!1){W(e);let n=e.length,o=Io(t),s=$n(t);if(n<16||n<s||n>1024)throw new Error("expected "+s+"-1024 bytes of input, got "+n);let i=r?Cn(e):oe(e),c=bt(i,t-et)+et;return r?Vn(c,o):Xe(c,o)}var ie=BigInt(0),Gt=BigInt(1);function Se(e,t){let r=t.negate();return e?r:t}function Wn(e,t){let r=Je(e.Fp,t.map(n=>n.Z));return t.map((n,o)=>e.fromAffine(n.toAffine(r[o])))}function Uo(e,t){if(!Number.isSafeInteger(e)||e<=0||e>t)throw new Error("invalid window size, expected [1.."+t+"], got W="+e)}function Gn(e,t){Uo(e,t);let r=Math.ceil(t/e)+1,n=2**(e-1),o=2**e,s=ve(e),i=BigInt(e);return{windows:r,windowSize:n,mask:s,maxNumber:o,shiftBy:i}}function Lo(e,t,r){let{windowSize:n,mask:o,maxNumber:s,shiftBy:i}=r,c=Number(e&o),f=e>>i;c>n&&(c-=s,f+=Gt);let l=t*n,h=l+Math.abs(c)-1,g=c===0,b=c<0,d=t%2!==0;return{nextN:f,offset:h,isZero:g,isNeg:b,isNegF:d,offsetF:l}}var zn=new WeakMap,Oo=new WeakMap;function Yn(e){return Oo.get(e)||1}function _o(e){if(e!==ie)throw new Error("invalid wNAF")}var Qe=class{constructor(t,r){T(this,"BASE");T(this,"ZERO");T(this,"Fn");T(this,"bits");this.BASE=t.BASE,this.ZERO=t.ZERO,this.Fn=t.Fn,this.bits=r}_unsafeLadder(t,r,n=this.ZERO){let o=t;for(;r>ie;)r&Gt&&(n=n.add(o)),o=o.double(),r>>=Gt;return n}precomputeWindow(t,r){let{windows:n,windowSize:o}=Gn(r,this.bits),s=[],i=t,c=i;for(let f=0;f<n;f++){c=i,s.push(c);for(let l=1;l<o;l++)c=c.add(i),s.push(c);i=c.double()}return s}wNAF(t,r,n){if(!this.Fn.isValid(n))throw new Error("invalid scalar");let o=this.ZERO,s=this.BASE,i=Gn(t,this.bits);for(let c=0;c<i.windows;c++){let{nextN:f,offset:l,isZero:h,isNeg:g,isNegF:b,offsetF:d}=Lo(n,c,i);n=f,h?s=s.add(Se(b,r[d])):o=o.add(Se(g,r[l]))}return _o(n),{p:o,f:s}}wNAFUnsafe(t,r,n,o=this.ZERO){let s=Gn(t,this.bits);for(let i=0;i<s.windows&&n!==ie;i++){let{nextN:c,offset:f,isZero:l,isNeg:h}=Lo(n,i,s);if(n=c,!l){let g=r[f];o=o.add(h?g.negate():g)}}return _o(n),o}getPrecomputes(t,r,n){let o=zn.get(r);return o||(o=this.precomputeWindow(r,t),t!==1&&(typeof n=="function"&&(o=n(o)),zn.set(r,o))),o}cached(t,r,n){let o=Yn(t);return this.wNAF(o,this.getPrecomputes(o,t,n),r)}unsafe(t,r,n,o){let s=Yn(t);return s===1?this._unsafeLadder(t,r,o):this.wNAFUnsafe(s,this.getPrecomputes(s,t,n),r,o)}createCache(t,r){Uo(r,this.bits),Oo.set(t,r),zn.delete(t)}hasCache(t){return Yn(t)!==1}};function Ho(e,t,r,n){let o=t,s=e.ZERO,i=e.ZERO;for(;r>ie||n>ie;)r&Gt&&(s=s.add(o)),n&Gt&&(i=i.add(o)),o=o.double(),r>>=Gt,n>>=Gt;return{p1:s,p2:i}}function Ro(e,t,r){if(t){if(t.ORDER!==e)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return Kn(t),t}else return se(e,{isLE:r})}function ko(e,t,r={},n){if(n===void 0&&(n=e==="edwards"),!t||typeof t!="object")throw new Error(`expected valid ${e} CURVE object`);for(let f of["p","n","h"]){let l=t[f];if(!(typeof l=="bigint"&&l>ie))throw new Error(`CURVE.${f} must be positive bigint`)}let o=Ro(t.p,r.Fp,n),s=Ro(t.n,r.Fn,n),c=["Gx","Gy","a",e==="weierstrass"?"b":"d"];for(let f of c)if(!o.isValid(t[f]))throw new Error(`CURVE.${f} must be valid field element of CURVE.Fp`);return t=Object.freeze(Object.assign({},t)),{CURVE:t,Fp:o,Fn:s}}function To(e,t){return function(n){let o=e(n);return{secretKey:o,publicKey:t(o)}}}var Fe=class{constructor(t,r){T(this,"oHash");T(this,"iHash");T(this,"blockLen");T(this,"outputLen");T(this,"finished",!1);T(this,"destroyed",!1);if(Kt(t),W(r,void 0,"key"),this.iHash=t.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let n=this.blockLen,o=new Uint8Array(n);o.set(r.length>n?t.create().update(r).digest():r);for(let s=0;s<o.length;s++)o[s]^=54;this.iHash.update(o),this.oHash=t.create();for(let s=0;s<o.length;s++)o[s]^=106;this.oHash.update(o),vt(o)}update(t){return ne(this),this.iHash.update(t),this}digestInto(t){ne(this),W(t,this.outputLen,"output"),this.finished=!0,this.iHash.digestInto(t),this.oHash.update(t),this.oHash.digestInto(t),this.destroy()}digest(){let t=new Uint8Array(this.oHash.outputLen);return this.digestInto(t),t}_cloneInto(t){t||(t=Object.create(Object.getPrototypeOf(this),{}));let{oHash:r,iHash:n,finished:o,destroyed:s,blockLen:i,outputLen:c}=this;return t=t,t.finished=o,t.destroyed=s,t.blockLen=i,t.outputLen=c,t.oHash=r._cloneInto(t.oHash),t.iHash=n._cloneInto(t.iHash),t}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},Tt=(e,t,r)=>new Fe(e,t).update(r).digest();Tt.create=(e,t)=>new Fe(e,t);var No=(e,t)=>(e+(e>=0?t:-t)/qo)/t;function ri(e,t,r){let[[n,o],[s,i]]=t,c=No(i*e,r),f=No(-o*e,r),l=e-c*n-f*s,h=-c*o-f*i,g=l<It,b=h<It;g&&(l=-l),b&&(h=-h);let d=ve(Math.ceil(Dn(r)/2))+ce;if(l<It||l>=d||h<It||h>=d)throw new Error("splitScalar (endomorphism): failed, k="+e);return{k1neg:g,k1:l,k2neg:b,k2:h}}function Jn(e){if(!["compact","recovered","der"].includes(e))throw new Error('Signature format must be "compact", "recovered", or "der"');return e}function Xn(e,t){let r={};for(let n of Object.keys(t))r[n]=e[n]===void 0?t[n]:e[n];return Ee(r.lowS,"lowS"),Ee(r.prehash,"prehash"),r.format!==void 0&&Jn(r.format),r}var Qn=class extends Error{constructor(t=""){super(t)}},Nt={Err:Qn,_tlv:{encode:(e,t)=>{let{Err:r}=Nt;if(e<0||e>256)throw new r("tlv.encode: wrong tag");if(t.length&1)throw new r("tlv.encode: unpadded data");let n=t.length/2,o=Be(n);if(o.length/2&128)throw new r("tlv.encode: long form length too big");let s=n>127?Be(o.length/2|128):"";return Be(e)+s+o+t},decode(e,t){let{Err:r}=Nt,n=0;if(e<0||e>256)throw new r("tlv.encode: wrong tag");if(t.length<2||t[n++]!==e)throw new r("tlv.decode: wrong tlv");let o=t[n++],s=!!(o&128),i=0;if(!s)i=o;else{let f=o&127;if(!f)throw new r("tlv.decode(long): indefinite length not supported");if(f>4)throw new r("tlv.decode(long): byte length is too big");let l=t.subarray(n,n+f);if(l.length!==f)throw new r("tlv.decode: length bytes not complete");if(l[0]===0)throw new r("tlv.decode(long): zero leftmost byte");for(let h of l)i=i<<8|h;if(n+=f,i<128)throw new r("tlv.decode(long): not minimal encoding")}let c=t.subarray(n,n+i);if(c.length!==i)throw new r("tlv.decode: wrong value length");return{v:c,l:t.subarray(n+i)}}},_int:{encode(e){let{Err:t}=Nt;if(e<It)throw new t("integer: negative integers are not allowed");let r=Be(e);if(Number.parseInt(r[0],16)&8&&(r="00"+r),r.length&1)throw new t("unexpected DER parsing assertion: unpadded hex");return r},decode(e){let{Err:t}=Nt;if(e[0]&128)throw new t("invalid signature integer: negative");if(e[0]===0&&!(e[1]&128))throw new t("invalid signature integer: unnecessary leading zero");return oe(e)}},toSig(e){let{Err:t,_int:r,_tlv:n}=Nt,o=W(e,void 0,"signature"),{v:s,l:i}=n.decode(48,o);if(i.length)throw new t("invalid signature: left bytes after parsing");let{v:c,l:f}=n.decode(2,s),{v:l,l:h}=n.decode(2,f);if(h.length)throw new t("invalid signature: left bytes after parsing");return{r:r.decode(c),s:r.decode(l)}},hexFromSig(e){let{_tlv:t,_int:r}=Nt,n=t.encode(2,r.encode(e.r)),o=t.encode(2,r.encode(e.s)),s=n+o;return t.encode(48,s)}},It=BigInt(0),ce=BigInt(1),qo=BigInt(2),tn=BigInt(3),oi=BigInt(4);function Co(e,t={}){let r=ko("weierstrass",e,t),{Fp:n,Fn:o}=r,s=r.CURVE,{h:i,n:c}=s;Ae(t,{},{allowInfinityPoint:"boolean",clearCofactor:"function",isTorsionFree:"function",fromBytes:"function",toBytes:"function",endo:"object"});let{endo:f}=t;if(f&&(!n.is0(s.a)||typeof f.beta!="bigint"||!Array.isArray(f.basises)))throw new Error('invalid endo: expected "beta": bigint and "basises": array');let l=Do(n,o);function h(){if(!n.isOdd)throw new Error("compression is not supported: Field does not have .isOdd()")}function g(w,a,u){let{x,y:m}=a.toAffine(),v=n.toBytes(x);if(Ee(u,"isCompressed"),u){h();let p=!n.isOdd(m);return ft(Vo(p),v)}else return ft(Uint8Array.of(4),v,n.toBytes(m))}function b(w){W(w,void 0,"Point");let{publicKey:a,publicKeyUncompressed:u}=l,x=w.length,m=w[0],v=w.subarray(1);if(x===a&&(m===2||m===3)){let p=n.fromBytes(v);if(!n.isValid(p))throw new Error("bad point: is not on curve, wrong x");let A=B(p),E;try{E=n.sqrt(A)}catch(D){let k=D instanceof Error?": "+D.message:"";throw new Error("bad point: is not on curve, sqrt error"+k)}h();let I=n.isOdd(E);return(m&1)===1!==I&&(E=n.neg(E)),{x:p,y:E}}else if(x===u&&m===4){let p=n.BYTES,A=n.fromBytes(v.subarray(0,p)),E=n.fromBytes(v.subarray(p,p*2));if(!S(A,E))throw new Error("bad point: is not on curve");return{x:A,y:E}}else throw new Error(`bad point: got length ${x}, expected compressed=${a} or uncompressed=${u}`)}let d=t.toBytes||g,y=t.fromBytes||b;function B(w){let a=n.sqr(w),u=n.mul(a,w);return n.add(n.add(u,n.mul(w,s.a)),s.b)}function S(w,a){let u=n.sqr(a),x=B(w);return n.eql(u,x)}if(!S(s.Gx,s.Gy))throw new Error("bad curve params: generator point");let _=n.mul(n.pow(s.a,tn),oi),V=n.mul(n.sqr(s.b),BigInt(27));if(n.is0(n.add(_,V)))throw new Error("bad curve params: a or b");function N(w,a,u=!1){if(!n.isValid(a)||u&&n.is0(a))throw new Error(`bad point coordinate ${w}`);return a}function q(w){if(!(w instanceof R))throw new Error("Weierstrass Point expected")}function C(w){if(!f||!f.basises)throw new Error("no endo");return ri(w,f.basises,o.ORDER)}let P=Mn((w,a)=>{let{X:u,Y:x,Z:m}=w;if(n.eql(m,n.ONE))return{x:u,y:x};let v=w.is0();a==null&&(a=v?n.ONE:n.inv(m));let p=n.mul(u,a),A=n.mul(x,a),E=n.mul(m,a);if(v)return{x:n.ZERO,y:n.ZERO};if(!n.eql(E,n.ONE))throw new Error("invZ was invalid");return{x:p,y:A}}),Y=Mn(w=>{if(w.is0()){if(t.allowInfinityPoint&&!n.is0(w.Y))return;throw new Error("bad point: ZERO")}let{x:a,y:u}=w.toAffine();if(!n.isValid(a)||!n.isValid(u))throw new Error("bad point: x or y not field elements");if(!S(a,u))throw new Error("bad point: equation left != right");if(!w.isTorsionFree())throw new Error("bad point: not in prime-order subgroup");return!0});function z(w,a,u,x,m){return u=new R(n.mul(u.X,w),u.Y,u.Z),a=Se(x,a),u=Se(m,u),a.add(u)}let L=class L{constructor(a,u,x){T(this,"X");T(this,"Y");T(this,"Z");this.X=N("x",a),this.Y=N("y",u,!0),this.Z=N("z",x),Object.freeze(this)}static CURVE(){return s}static fromAffine(a){let{x:u,y:x}=a||{};if(!a||!n.isValid(u)||!n.isValid(x))throw new Error("invalid affine point");if(a instanceof L)throw new Error("projective point not allowed");return n.is0(u)&&n.is0(x)?L.ZERO:new L(u,x,n.ONE)}static fromBytes(a){let u=L.fromAffine(y(W(a,void 0,"point")));return u.assertValidity(),u}static fromHex(a){return L.fromBytes(At(a))}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(a=8,u=!0){return M.createCache(this,a),u||this.multiply(tn),this}assertValidity(){Y(this)}hasEvenY(){let{y:a}=this.toAffine();if(!n.isOdd)throw new Error("Field doesn't support isOdd");return!n.isOdd(a)}equals(a){q(a);let{X:u,Y:x,Z:m}=this,{X:v,Y:p,Z:A}=a,E=n.eql(n.mul(u,A),n.mul(v,m)),I=n.eql(n.mul(x,A),n.mul(p,m));return E&&I}negate(){return new L(this.X,n.neg(this.Y),this.Z)}double(){let{a,b:u}=s,x=n.mul(u,tn),{X:m,Y:v,Z:p}=this,A=n.ZERO,E=n.ZERO,I=n.ZERO,O=n.mul(m,m),D=n.mul(v,v),k=n.mul(p,p),U=n.mul(m,v);return U=n.add(U,U),I=n.mul(m,p),I=n.add(I,I),A=n.mul(a,I),E=n.mul(x,k),E=n.add(A,E),A=n.sub(D,E),E=n.add(D,E),E=n.mul(A,E),A=n.mul(U,A),I=n.mul(x,I),k=n.mul(a,k),U=n.sub(O,k),U=n.mul(a,U),U=n.add(U,I),I=n.add(O,O),O=n.add(I,O),O=n.add(O,k),O=n.mul(O,U),E=n.add(E,O),k=n.mul(v,p),k=n.add(k,k),O=n.mul(k,U),A=n.sub(A,O),I=n.mul(k,D),I=n.add(I,I),I=n.add(I,I),new L(A,E,I)}add(a){q(a);let{X:u,Y:x,Z:m}=this,{X:v,Y:p,Z:A}=a,E=n.ZERO,I=n.ZERO,O=n.ZERO,D=s.a,k=n.mul(s.b,tn),U=n.mul(u,v),Z=n.mul(x,p),G=n.mul(m,A),j=n.add(u,x),$=n.add(v,p);j=n.mul(j,$),$=n.add(U,Z),j=n.sub(j,$),$=n.add(u,m);let J=n.add(v,A);return $=n.mul($,J),J=n.add(U,G),$=n.sub($,J),J=n.add(x,m),E=n.add(p,A),J=n.mul(J,E),E=n.add(Z,G),J=n.sub(J,E),O=n.mul(D,$),E=n.mul(k,G),O=n.add(E,O),E=n.sub(Z,O),O=n.add(Z,O),I=n.mul(E,O),Z=n.add(U,U),Z=n.add(Z,U),G=n.mul(D,G),$=n.mul(k,$),Z=n.add(Z,G),G=n.sub(U,G),G=n.mul(D,G),$=n.add($,G),U=n.mul(Z,$),I=n.add(I,U),U=n.mul(J,$),E=n.mul(j,E),E=n.sub(E,U),U=n.mul(j,Z),O=n.mul(J,O),O=n.add(O,U),new L(E,I,O)}subtract(a){return this.add(a.negate())}is0(){return this.equals(L.ZERO)}multiply(a){let{endo:u}=t;if(!o.isValidNot0(a))throw new Error("invalid scalar: out of range");let x,m,v=p=>M.cached(this,p,A=>Wn(L,A));if(u){let{k1neg:p,k1:A,k2neg:E,k2:I}=C(a),{p:O,f:D}=v(A),{p:k,f:U}=v(I);m=D.add(U),x=z(u.beta,O,k,p,E)}else{let{p,f:A}=v(a);x=p,m=A}return Wn(L,[x,m])[0]}multiplyUnsafe(a){let{endo:u}=t,x=this;if(!o.isValid(a))throw new Error("invalid scalar: out of range");if(a===It||x.is0())return L.ZERO;if(a===ce)return x;if(M.hasCache(this))return this.multiply(a);if(u){let{k1neg:m,k1:v,k2neg:p,k2:A}=C(a),{p1:E,p2:I}=Ho(L,x,v,A);return z(u.beta,E,I,m,p)}else return M.unsafe(x,a)}toAffine(a){return P(this,a)}isTorsionFree(){let{isTorsionFree:a}=t;return i===ce?!0:a?a(L,this):M.unsafe(this,c).is0()}clearCofactor(){let{clearCofactor:a}=t;return i===ce?this:a?a(L,this):this.multiplyUnsafe(i)}isSmallOrder(){return this.multiplyUnsafe(i).is0()}toBytes(a=!0){return Ee(a,"isCompressed"),this.assertValidity(),d(L,this,a)}toHex(a=!0){return $t(this.toBytes(a))}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}};T(L,"BASE",new L(s.Gx,s.Gy,n.ONE)),T(L,"ZERO",new L(n.ZERO,n.ONE,n.ZERO)),T(L,"Fp",n),T(L,"Fn",o);let R=L,K=o.BITS,M=new Qe(R,t.endo?Math.ceil(K/2):K);return R.BASE.precompute(8),R}function Vo(e){return Uint8Array.of(e?2:3)}function Do(e,t){return{secretKey:t.BYTES,publicKey:1+e.BYTES,publicKeyUncompressed:1+2*e.BYTES,publicKeyHasPrefix:!0,signature:2*t.BYTES}}function si(e,t={}){let{Fn:r}=e,n=t.randomBytes||me,o=Object.assign(Do(e.Fp,r),{seed:$n(r.ORDER)});function s(d){try{let y=r.fromBytes(d);return r.isValidNot0(y)}catch{return!1}}function i(d,y){let{publicKey:B,publicKeyUncompressed:S}=o;try{let _=d.length;return y===!0&&_!==B||y===!1&&_!==S?!1:!!e.fromBytes(d)}catch{return!1}}function c(d=n(o.seed)){return Pn(W(d,o.seed,"seed"),r.ORDER)}function f(d,y=!0){return e.BASE.multiply(r.fromBytes(d)).toBytes(y)}function l(d){let{secretKey:y,publicKey:B,publicKeyUncompressed:S}=o;if(!we(d)||"_lengths"in r&&r._lengths||y===B)return;let _=W(d,void 0,"key").length;return _===B||_===S}function h(d,y,B=!0){if(l(d)===!0)throw new Error("first arg must be private key");if(l(y)===!1)throw new Error("second arg must be public key");let S=r.fromBytes(d);return e.fromBytes(y).multiply(S).toBytes(B)}let g={isValidSecretKey:s,isValidPublicKey:i,randomSecretKey:c},b=To(c,f);return Object.freeze({getPublicKey:f,getSharedSecret:h,keygen:b,Point:e,utils:g,lengths:o})}function Mo(e,t,r={}){Kt(t),Ae(r,{},{hmac:"function",lowS:"boolean",randomBytes:"function",bits2int:"function",bits2int_modN:"function"}),r=Object.assign({},r);let n=r.randomBytes||me,o=r.hmac||((a,u)=>Tt(t,a,u)),{Fp:s,Fn:i}=e,{ORDER:c,BITS:f}=i,{keygen:l,getPublicKey:h,getSharedSecret:g,utils:b,lengths:d}=si(e,r),y={prehash:!0,lowS:typeof r.lowS=="boolean"?r.lowS:!0,format:"compact",extraEntropy:!1},B=c*qo<s.ORDER;function S(a){let u=c>>ce;return a>u}function _(a,u){if(!i.isValidNot0(u))throw new Error(`invalid signature ${a}: out of range 1..Point.Fn.ORDER`);return u}function V(){if(B)throw new Error('"recovered" sig type is not supported for cofactor >2 curves')}function N(a,u){Jn(u);let x=d.signature,m=u==="compact"?x:u==="recovered"?x+1:void 0;return W(a,m)}class q{constructor(u,x,m){T(this,"r");T(this,"s");T(this,"recovery");if(this.r=_("r",u),this.s=_("s",x),m!=null){if(V(),![0,1,2,3].includes(m))throw new Error("invalid recovery id");this.recovery=m}Object.freeze(this)}static fromBytes(u,x=y.format){N(u,x);let m;if(x==="der"){let{r:E,s:I}=Nt.toSig(W(u));return new q(E,I)}x==="recovered"&&(m=u[0],x="compact",u=u.subarray(1));let v=d.signature/2,p=u.subarray(0,v),A=u.subarray(v,v*2);return new q(i.fromBytes(p),i.fromBytes(A),m)}static fromHex(u,x){return this.fromBytes(At(u),x)}assertRecovery(){let{recovery:u}=this;if(u==null)throw new Error("invalid recovery id: must be present");return u}addRecoveryBit(u){return new q(this.r,this.s,u)}recoverPublicKey(u){let{r:x,s:m}=this,v=this.assertRecovery(),p=v===2||v===3?x+c:x;if(!s.isValid(p))throw new Error("invalid recovery id: sig.r+curve.n != R.x");let A=s.toBytes(p),E=e.fromBytes(ft(Vo((v&1)===0),A)),I=i.inv(p),O=P(W(u,void 0,"msgHash")),D=i.create(-O*I),k=i.create(m*I),U=e.BASE.multiplyUnsafe(D).add(E.multiplyUnsafe(k));if(U.is0())throw new Error("invalid recovery: point at infinify");return U.assertValidity(),U}hasHighS(){return S(this.s)}toBytes(u=y.format){if(Jn(u),u==="der")return At(Nt.hexFromSig(this));let{r:x,s:m}=this,v=i.toBytes(x),p=i.toBytes(m);return u==="recovered"?(V(),ft(Uint8Array.of(this.assertRecovery()),v,p)):ft(v,p)}toHex(u){return $t(this.toBytes(u))}}let C=r.bits2int||function(u){if(u.length>8192)throw new Error("input is too large");let x=oe(u),m=u.length*8-f;return m>0?x>>BigInt(m):x},P=r.bits2int_modN||function(u){return i.create(C(u))},Y=ve(f);function z(a){return go("num < 2^"+f,a,It,Y),i.toBytes(a)}function R(a,u){return W(a,void 0,"message"),u?W(t(a),void 0,"prehashed message"):a}function K(a,u,x){let{lowS:m,prehash:v,extraEntropy:p}=Xn(x,y);a=R(a,v);let A=P(a),E=i.fromBytes(u);if(!i.isValidNot0(E))throw new Error("invalid private key");let I=[z(E),z(A)];if(p!=null&&p!==!1){let U=p===!0?n(d.secretKey):p;I.push(W(U,void 0,"extraEntropy"))}let O=ft(...I),D=A;function k(U){let Z=C(U);if(!i.isValidNot0(Z))return;let G=i.inv(Z),j=e.BASE.multiply(Z).toAffine(),$=i.create(j.x);if($===It)return;let J=i.create(G*i.create(D+$*E));if(J===It)return;let fe=(j.x===$?0:2)|Number(j.y&ce),ae=J;return m&&S(J)&&(ae=i.neg(J),fe^=1),new q($,ae,B?void 0:fe)}return{seed:O,k2sig:k}}function M(a,u,x={}){let{seed:m,k2sig:v}=K(a,u,x);return xo(t.outputLen,i.BYTES,o)(m,v).toBytes(x.format)}function L(a,u,x,m={}){let{lowS:v,prehash:p,format:A}=Xn(m,y);if(x=W(x,void 0,"publicKey"),u=R(u,p),!we(a)){let E=a instanceof q?", use sig.toBytes()":"";throw new Error("verify expects Uint8Array signature"+E)}N(a,A);try{let E=q.fromBytes(a,A),I=e.fromBytes(x);if(v&&E.hasHighS())return!1;let{r:O,s:D}=E,k=P(u),U=i.inv(D),Z=i.create(k*U),G=i.create(O*U),j=e.BASE.multiplyUnsafe(Z).add(I.multiplyUnsafe(G));return j.is0()?!1:i.create(j.x)===O}catch{return!1}}function w(a,u,x={}){let{prehash:m}=Xn(x,y);return u=R(u,m),q.fromBytes(a,"recovered").recoverPublicKey(u).toBytes()}return Object.freeze({keygen:l,getPublicKey:h,getSharedSecret:g,utils:b,lengths:d,Point:e,sign:M,verify:L,recoverPublicKey:w,Signature:q,hash:t})}var tr={p:BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f"),n:BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"),h:BigInt(1),a:BigInt(0),b:BigInt(7),Gx:BigInt("0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"),Gy:BigInt("0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8")},ii={beta:BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),basises:[[BigInt("0x3086d221a7d46bcde86c90e49284eb15"),-BigInt("0xe4437ed6010e88286f547fa90abfe4c3")],[BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"),BigInt("0x3086d221a7d46bcde86c90e49284eb15")]]};var Zo=BigInt(2);function ci(e){let t=tr.p,r=BigInt(3),n=BigInt(6),o=BigInt(11),s=BigInt(22),i=BigInt(23),c=BigInt(44),f=BigInt(88),l=e*e*e%t,h=l*l*e%t,g=at(h,r,t)*h%t,b=at(g,r,t)*h%t,d=at(b,Zo,t)*l%t,y=at(d,o,t)*d%t,B=at(y,s,t)*y%t,S=at(B,c,t)*B%t,_=at(S,f,t)*S%t,V=at(_,c,t)*B%t,N=at(V,r,t)*h%t,q=at(N,i,t)*y%t,C=at(q,n,t)*l%t,P=at(C,Zo,t);if(!Fn.eql(Fn.sqr(P),e))throw new Error("Cannot find square root");return P}var Fn=se(tr.p,{sqrt:ci}),fi=Co(tr,{Fp:Fn,endo:ii}),jo=Mo(fi,re);function $o(e,t,r){return Kt(e),r===void 0&&(r=new Uint8Array(e.outputLen)),Tt(e,r,t)}var er=Uint8Array.of(0),Ko=Uint8Array.of();function Po(e,t,r,n=32){Kt(e),ut(n,"length");let o=e.outputLen;if(n>255*o)throw new Error("Length must be <= 255*HashLen");let s=Math.ceil(n/o);r===void 0?r=Ko:W(r,void 0,"info");let i=new Uint8Array(s*o),c=Tt.create(e,t),f=c._cloneInto(),l=new Uint8Array(c.outputLen);for(let h=0;h<s;h++)er[0]=h+1,f.update(h===0?Ko:l).update(r).update(er).digestInto(l),i.set(l,o*h),c._cloneInto(f);return c.destroy(),f.destroy(),vt(l,er),i.slice(0,n)}function zo(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"}function ai(e){if(!zo(e))throw new Error("Uint8Array expected")}function Yo(e,t){return Array.isArray(t)?t.length===0?!0:e?t.every(r=>typeof r=="string"):t.every(r=>Number.isSafeInteger(r)):!1}function Ie(e,t){if(typeof t!="string")throw new Error(`${e}: string expected`);return!0}function or(e){if(!Number.isSafeInteger(e))throw new Error(`invalid integer: ${e}`)}function rr(e){if(!Array.isArray(e))throw new Error("array expected")}function en(e,t){if(!Yo(!0,t))throw new Error(`${e}: array of strings expected`)}function ui(e,t){if(!Yo(!1,t))throw new Error(`${e}: array of numbers expected`)}function li(...e){let t=s=>s,r=(s,i)=>c=>s(i(c)),n=e.map(s=>s.encode).reduceRight(r,t),o=e.map(s=>s.decode).reduce(r,t);return{encode:n,decode:o}}function di(e){let t=typeof e=="string"?e.split(""):e,r=t.length;en("alphabet",t);let n=new Map(t.map((o,s)=>[o,s]));return{encode:o=>(rr(o),o.map(s=>{if(!Number.isSafeInteger(s)||s<0||s>=r)throw new Error(`alphabet.encode: digit index outside alphabet "${s}". Allowed: ${e}`);return t[s]})),decode:o=>(rr(o),o.map(s=>{Ie("alphabet.decode",s);let i=n.get(s);if(i===void 0)throw new Error(`Unknown letter: "${s}". Allowed: ${e}`);return i}))}}function hi(e=""){return Ie("join",e),{encode:t=>(en("join.decode",t),t.join(e)),decode:t=>(Ie("join.decode",t),t.split(e))}}function bi(e,t="="){return or(e),Ie("padding",t),{encode(r){for(en("padding.encode",r);r.length*e%8;)r.push(t);return r},decode(r){en("padding.decode",r);let n=r.length;if(n*e%8)throw new Error("padding: invalid, string should have whole number of bytes");for(;n>0&&r[n-1]===t;n--)if((n-1)*e%8===0)throw new Error("padding: invalid, string has too much padding");return r.slice(0,n)}}}var Wo=(e,t)=>t===0?e:Wo(t,e%t),nn=(e,t)=>e+(t-Wo(e,t)),nr=(()=>{let e=[];for(let t=0;t<40;t++)e.push(2**t);return e})();function Go(e,t,r,n){if(rr(e),t<=0||t>32)throw new Error(`convertRadix2: wrong from=${t}`);if(r<=0||r>32)throw new Error(`convertRadix2: wrong to=${r}`);if(nn(t,r)>32)throw new Error(`convertRadix2: carry overflow from=${t} to=${r} carryBits=${nn(t,r)}`);let o=0,s=0,i=nr[t],c=nr[r]-1,f=[];for(let l of e){if(or(l),l>=i)throw new Error(`convertRadix2: invalid data word=${l} from=${t}`);if(o=o<<t|l,s+t>32)throw new Error(`convertRadix2: carry overflow pos=${s} from=${t}`);for(s+=t;s>=r;s-=r)f.push((o>>s-r&c)>>>0);let h=nr[s];if(h===void 0)throw new Error("invalid carry");o&=h-1}if(o=o<<r-s&c,!n&&s>=t)throw new Error("Excess padding");if(!n&&o>0)throw new Error(`Non-zero padding: ${o}`);return n&&s>0&&f.push(o>>>0),f}function gi(e,t=!1){if(or(e),e<=0||e>32)throw new Error("radix2: bits should be in (0..32]");if(nn(8,e)>32||nn(e,8)>32)throw new Error("radix2: carry overflow");return{encode:r=>{if(!zo(r))throw new Error("radix2.encode input should be Uint8Array");return Go(Array.from(r),8,e,!t)},decode:r=>(ui("radix2.decode",r),Uint8Array.from(Go(r,e,8,t)))}}var xi=typeof Uint8Array.from([]).toBase64=="function"&&typeof Uint8Array.fromBase64=="function",pi=(e,t)=>{Ie("base64",e);let r=t?/^[A-Za-z0-9=_-]+$/:/^[A-Za-z0-9=+/]+$/,n=t?"base64url":"base64";if(e.length>0&&!r.test(e))throw new Error("invalid base64");return Uint8Array.fromBase64(e,{alphabet:n,lastChunkHandling:"strict"})},Xo=xi?{encode(e){return ai(e),e.toBase64()},decode(e){return pi(e,!1)}}:li(gi(6),di("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"),bi(6),hi(""));var yi=new TextDecoder("utf-8"),wi=new TextEncoder,mi=1,Ei=65535;function sr(e,t){let r=jo.getSharedSecret(e,At("02"+t)).subarray(1,33);return $o(re,r,wi.encode("nip44-v2"))}function Bi(e,t){let r=Po(re,e,t,76);return{chacha_key:r.subarray(0,32),chacha_nonce:r.subarray(32,44),hmac_key:r.subarray(44,76)}}function vi(e){if(!Number.isSafeInteger(e)||e<1)throw new Error("expected positive integer");if(e<=32)return 32;let t=1<<Math.floor(Math.log2(e-1))+1,r=t<=256?32:t/8;return r*(Math.floor((e-1)/r)+1)}function Ai(e){let t=new DataView(e.buffer).getUint16(0),r=e.subarray(2,2+t);if(t<mi||t>Ei||r.length!==t||e.length!==2+vi(t))throw new Error("invalid padding");return yi.decode(r)}function Si(e,t,r){if(r.length!==32)throw new Error("AAD associated data must be 32 bytes");let n=ft(r,t);return Tt(re,e,n)}function Ii(e){if(typeof e!="string")throw new Error("payload must be a valid string");let t=e.length;if(t<132||t>87472)throw new Error("invalid payload length: "+t);if(e[0]==="#")throw new Error("unknown encryption version");let r;try{r=Xo.decode(e)}catch(s){throw new Error("invalid base64: "+s.message)}let n=r.length;if(n<99||n>65603)throw new Error("invalid data length: "+n);let o=r[0];if(o!==2)throw new Error("unknown encryption version "+o);return{nonce:r.subarray(1,33),ciphertext:r.subarray(33,-32),mac:r.subarray(-32)}}function ir(e,t){let{nonce:r,ciphertext:n,mac:o}=Ii(e),{chacha_key:s,chacha_nonce:i,hmac_key:c}=Bi(t,r),f=Si(c,n,r);if(!Pe(f,o))throw new Error("invalid MAC");let l=Hn(s,i,n);return Ai(l)}function Li(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function _i(){let e=new Uint8Array(16);return crypto.getRandomValues(e),Array.from(e,t=>t.toString(16).padStart(2,"0")).join("")}function rn(e,t){let r=e.find(n=>n[0]===t);return r?r[1]:void 0}function Lt(e){let t=new Uint8Array(e.length/2);for(let r=0;r<t.length;r++)t[r]=parseInt(e.substr(r*2,2),16);return t}async function Ri(e){if(!e.id||!e.pubkey||!e.sig||!e.tags||e.kind!==30470||!/^[0-9a-f]{128}$/i.test(e.sig)||!/^[0-9a-f]{64}$/i.test(e.pubkey)||!/^[0-9a-f]{64}$/i.test(e.id)||e.tags.length>100||e.content.length>65536||e.tags.some(i=>i.some(c=>c.length>1024)))return!1;let t=e.tags.map(i=>i[0]);if(!t.includes("tier")||!t.includes("age-range")||!t.includes("entity-type"))return!1;let r=JSON.stringify([0,e.pubkey,e.created_at,e.kind,e.tags,e.content]),n=new TextEncoder,o=Sn(n.encode(r));if(st(o)!==e.id.toLowerCase())return!1;try{let i=Lt(e.sig),c=Lt(e.id),f=Lt(e.pubkey);return ye.verify(i,c,f)}catch{return!1}}function Ui(e,t){if(e===t||e==="18+"&&t==="18+")return!0;let r=["0-3","4-7","8-12","13-17","18+"],n=r.indexOf(e),o=r.indexOf(t);return n===-1||o===-1?!1:t==="18+"?e==="18+":e===t}async function Oi(e,t){if(t==null||!/^https:\/\//i.test(t)||!/^[0-9a-f]{64}$/i.test(e))return null;try{let r=await fetch(`${t}/status/${e}`,{signal:AbortSignal.timeout(5e3)});if(!r.ok)return null;let n=await r.json();if(typeof n!="object"||n===null)return null;let o=n;return{confirmed:o.confirmed===!0,method:["A","B","C","D"].includes(o.method)?o.method:null,profession:typeof o.profession=="string"?o.profession:void 0,jurisdiction:typeof o.jurisdiction=="string"?o.jurisdiction:void 0}}catch{return null}}async function Jo(e,t){if(!["0-3","4-7","8-12","13-17","18+"].includes(e))return{verified:!1,ageRange:null,tier:null,entityType:null,credentialId:null,verifierPubkey:null,verifierConfirmed:null,verifierMethod:null,issuedAt:null,expiresAt:null,error:"invalid-age-range"};let n={requiredAgeRange:e,relayUrl:t?.relayUrl||"wss://relay.damus.io",theme:t?.theme||"auto",timeout:t?.timeout||12e4,verifierCheckUrl:t?.verifierCheckUrl!==void 0?t.verifierCheckUrl:"https://verify.signet.forgesworn.dev",acceptUnconfirmed:t?.acceptUnconfirmed||!1,...t};n.timeout=Math.max(5e3,Math.min(n.timeout??12e4,6e5));let o=_i(),s={type:"signet-verify-request",requestId:o,requiredAgeRange:n.requiredAgeRange,relayUrl:n.relayUrl,timestamp:Math.floor(Date.now()/1e3)},i=JSON.stringify(s),c=btoa(i);return new Promise(f=>{let l=document.createElement("style");l.textContent="#signet-verify-dialog::backdrop{background:rgba(0,0,0,0.7)}",document.head.appendChild(l);let h=n.theme==="dark"||n.theme==="auto"&&window.matchMedia("(prefers-color-scheme: dark)").matches,g=h?"#1a1a2e":"#ffffff",b=h?"#e0e0e0":"#1a1a2e",d=h?"#888":"#666",y=document.createElement("dialog");y.id="signet-verify-dialog",y.style.cssText=`border:none;border-radius:16px;padding:32px;max-width:380px;width:90%;text-align:center;box-shadow:0 20px 60px rgba(0,0,0,0.3);background:${g};color:${b};font-family:system-ui,-apple-system,sans-serif;`,y.innerHTML=`
+"use strict";var Signet=(()=>{var Le=Object.defineProperty;var Fo=Object.getOwnPropertyDescriptor;var ts=Object.getOwnPropertyNames;var es=Object.prototype.hasOwnProperty;var ns=(e,t,r)=>t in e?Le(e,t,{enumerable:!0,configurable:!0,writable:!0,value:r}):e[t]=r;var rs=(e,t)=>{for(var r in t)Le(e,r,{get:t[r],enumerable:!0})},os=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of ts(t))!es.call(e,o)&&o!==r&&Le(e,o,{get:()=>t[o],enumerable:!(n=Fo(t,o))||n.enumerable});return e};var ss=e=>os(Le({},"__esModule",{value:!0}),e);var T=(e,t,r)=>ns(e,typeof t!="symbol"?t+"":t,r);var Ni={};rs(Ni,{verifyAge:()=>Jo,waitForAuthResponse:()=>Qo});var qt=typeof globalThis=="object"&&"crypto"in globalThis?globalThis.crypto:void 0;function Ct(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"}function ue(e){if(!Number.isSafeInteger(e)||e<0)throw new Error("positive integer expected, got "+e)}function lt(e,...t){if(!Ct(e))throw new Error("Uint8Array expected");if(t.length>0&&!t.includes(e.length))throw new Error("Uint8Array expected of length "+t+", got length="+e.length)}function _e(e){if(typeof e!="function"||typeof e.create!="function")throw new Error("Hash should be wrapped by utils.createHasher");ue(e.outputLen),ue(e.blockLen)}function Yt(e,t=!0){if(e.destroyed)throw new Error("Hash instance has been destroyed");if(t&&e.finished)throw new Error("Hash#digest() has already been called")}function ar(e,t){lt(e);let r=t.outputLen;if(e.length<r)throw new Error("digestInto() expects output buffer of length at least "+r)}function Vt(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function Ue(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function dt(e,t){return e<<32-t|e>>>t}var ur=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",is=Array.from({length:256},(e,t)=>t.toString(16).padStart(2,"0"));function st(e){if(lt(e),ur)return e.toHex();let t="";for(let r=0;r<e.length;r++)t+=is[e[r]];return t}var gt={_0:48,_9:57,A:65,F:70,a:97,f:102};function fr(e){if(e>=gt._0&&e<=gt._9)return e-gt._0;if(e>=gt.A&&e<=gt.F)return e-(gt.A-10);if(e>=gt.a&&e<=gt.f)return e-(gt.a-10)}function Dt(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);if(ur)return Uint8Array.fromHex(e);let t=e.length,r=t/2;if(t%2)throw new Error("hex string expected, got unpadded hex of length "+t);let n=new Uint8Array(r);for(let o=0,s=0;o<r;o++,s+=2){let i=fr(e.charCodeAt(s)),c=fr(e.charCodeAt(s+1));if(i===void 0||c===void 0){let f=e[s]+e[s+1];throw new Error('hex string expected, got non-hex character "'+f+'" at index '+s)}n[o]=i*16+c}return n}function Re(e){if(typeof e!="string")throw new Error("string expected");return new Uint8Array(new TextEncoder().encode(e))}function le(e){return typeof e=="string"&&(e=Re(e)),lt(e),e}function ot(...e){let t=0;for(let n=0;n<e.length;n++){let o=e[n];lt(o),t+=o.length}let r=new Uint8Array(t);for(let n=0,o=0;n<e.length;n++){let s=e[n];r.set(s,o),o+=s.length}return r}var zt=class{};function lr(e){let t=n=>e().update(le(n)).digest(),r=e();return t.outputLen=r.outputLen,t.blockLen=r.blockLen,t.create=()=>e(),t}function Mt(e=32){if(qt&&typeof qt.getRandomValues=="function")return qt.getRandomValues(new Uint8Array(e));if(qt&&typeof qt.randomBytes=="function")return Uint8Array.from(qt.randomBytes(e));throw new Error("crypto.getRandomValues must be defined")}function cs(e,t,r,n){if(typeof e.setBigUint64=="function")return e.setBigUint64(t,r,n);let o=BigInt(32),s=BigInt(4294967295),i=Number(r>>o&s),c=Number(r&s),f=n?4:0,u=n?0:4;e.setUint32(t+f,i,n),e.setUint32(t+u,c,n)}function dr(e,t,r){return e&t^~e&r}function hr(e,t,r){return e&t^e&r^t&r}var Oe=class extends zt{constructor(t,r,n,o){super(),this.finished=!1,this.length=0,this.pos=0,this.destroyed=!1,this.blockLen=t,this.outputLen=r,this.padOffset=n,this.isLE=o,this.buffer=new Uint8Array(t),this.view=Ue(this.buffer)}update(t){Yt(this),t=le(t),lt(t);let{view:r,buffer:n,blockLen:o}=this,s=t.length;for(let i=0;i<s;){let c=Math.min(o-this.pos,s-i);if(c===o){let f=Ue(t);for(;o<=s-i;i+=o)this.process(f,i);continue}n.set(t.subarray(i,i+c),this.pos),this.pos+=c,i+=c,this.pos===o&&(this.process(r,0),this.pos=0)}return this.length+=t.length,this.roundClean(),this}digestInto(t){Yt(this),ar(t,this),this.finished=!0;let{buffer:r,view:n,blockLen:o,isLE:s}=this,{pos:i}=this;r[i++]=128,Vt(this.buffer.subarray(i)),this.padOffset>o-i&&(this.process(n,0),i=0);for(let g=i;g<o;g++)r[g]=0;cs(n,o-8,BigInt(this.length*8),s),this.process(n,0);let c=Ue(t),f=this.outputLen;if(f%4)throw new Error("_sha2: outputLen should be aligned to 32bit");let u=f/4,h=this.get();if(u>h.length)throw new Error("_sha2: outputLen bigger than state");for(let g=0;g<u;g++)c.setUint32(4*g,h[g],s)}digest(){let{buffer:t,outputLen:r}=this;this.digestInto(t);let n=t.slice(0,r);return this.destroy(),n}_cloneInto(t){t||(t=new this.constructor),t.set(...this.get());let{blockLen:r,buffer:n,length:o,finished:s,destroyed:i,pos:c}=this;return t.destroyed=i,t.finished=s,t.length=o,t.pos=c,o%r&&t.buffer.set(n),t}clone(){return this._cloneInto()}},xt=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var fs=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),_t=new Uint32Array(64),He=class extends Oe{constructor(t=32){super(64,t,8,!1),this.A=xt[0]|0,this.B=xt[1]|0,this.C=xt[2]|0,this.D=xt[3]|0,this.E=xt[4]|0,this.F=xt[5]|0,this.G=xt[6]|0,this.H=xt[7]|0}get(){let{A:t,B:r,C:n,D:o,E:s,F:i,G:c,H:f}=this;return[t,r,n,o,s,i,c,f]}set(t,r,n,o,s,i,c,f){this.A=t|0,this.B=r|0,this.C=n|0,this.D=o|0,this.E=s|0,this.F=i|0,this.G=c|0,this.H=f|0}process(t,r){for(let g=0;g<16;g++,r+=4)_t[g]=t.getUint32(r,!1);for(let g=16;g<64;g++){let b=_t[g-15],d=_t[g-2],y=dt(b,7)^dt(b,18)^b>>>3,B=dt(d,17)^dt(d,19)^d>>>10;_t[g]=B+_t[g-7]+y+_t[g-16]|0}let{A:n,B:o,C:s,D:i,E:c,F:f,G:u,H:h}=this;for(let g=0;g<64;g++){let b=dt(c,6)^dt(c,11)^dt(c,25),d=h+b+dr(c,f,u)+fs[g]+_t[g]|0,B=(dt(n,2)^dt(n,13)^dt(n,22))+hr(n,o,s)|0;h=u,u=f,f=c,c=i+d|0,i=s,s=o,o=n,n=d+B|0}n=n+this.A|0,o=o+this.B|0,s=s+this.C|0,i=i+this.D|0,c=c+this.E|0,f=f+this.F|0,u=u+this.G|0,h=h+this.H|0,this.set(n,o,s,i,c,f,u,h)}roundClean(){Vt(_t)}destroy(){this.set(0,0,0,0,0,0,0,0),Vt(this.buffer)}};var Wt=lr(()=>new He);var ke=class extends zt{constructor(t,r){super(),this.finished=!1,this.destroyed=!1,_e(t);let n=le(r);if(this.iHash=t.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let o=this.blockLen,s=new Uint8Array(o);s.set(n.length>o?t.create().update(n).digest():n);for(let i=0;i<s.length;i++)s[i]^=54;this.iHash.update(s),this.oHash=t.create();for(let i=0;i<s.length;i++)s[i]^=106;this.oHash.update(s),Vt(s)}update(t){return Yt(this),this.iHash.update(t),this}digestInto(t){Yt(this),lt(t,this.outputLen),this.finished=!0,this.iHash.digestInto(t),this.oHash.update(t),this.oHash.digestInto(t),this.destroy()}digest(){let t=new Uint8Array(this.oHash.outputLen);return this.digestInto(t),t}_cloneInto(t){t||(t=Object.create(Object.getPrototypeOf(this),{}));let{oHash:r,iHash:n,finished:o,destroyed:s,blockLen:i,outputLen:c}=this;return t=t,t.finished=o,t.destroyed=s,t.blockLen=i,t.outputLen=c,t.oHash=r._cloneInto(t.oHash),t.iHash=n._cloneInto(t.iHash),t}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},on=(e,t,r)=>new ke(e,t).update(r).digest();on.create=(e,t)=>new ke(e,t);var fn=BigInt(0),cn=BigInt(1);function de(e,t=""){if(typeof e!="boolean"){let r=t&&`"${t}"`;throw new Error(r+"expected boolean, got type="+typeof e)}return e}function Ut(e,t,r=""){let n=Ct(e),o=e?.length,s=t!==void 0;if(!n||s&&o!==t){let i=r&&`"${r}" `,c=s?` of length ${t}`:"",f=n?`length=${o}`:`type=${typeof e}`;throw new Error(i+"expected Uint8Array"+c+", got "+f)}return e}function he(e){let t=e.toString(16);return t.length&1?"0"+t:t}function br(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);return e===""?fn:BigInt("0x"+e)}function pt(e){return br(st(e))}function an(e){return lt(e),br(st(Uint8Array.from(e).reverse()))}function Xt(e,t){return Dt(e.toString(16).padStart(t*2,"0"))}function un(e,t){return Xt(e,t).reverse()}function X(e,t,r){let n;if(typeof t=="string")try{n=Dt(t)}catch(s){throw new Error(e+" must be hex string or Uint8Array, cause: "+s)}else if(Ct(t))n=Uint8Array.from(t);else throw new Error(e+" must be hex string or Uint8Array");let o=n.length;if(typeof r=="number"&&o!==r)throw new Error(e+" of length "+r+" expected, got "+o);return n}var sn=e=>typeof e=="bigint"&&fn<=e;function be(e,t,r){return sn(e)&&sn(t)&&sn(r)&&t<=e&&e<r}function gr(e,t,r,n){if(!be(t,r,n))throw new Error("expected valid "+e+": "+r+" <= n < "+n+", got "+t)}function Te(e){let t;for(t=0;e>fn;e>>=cn,t+=1);return t}var Rt=e=>(cn<<BigInt(e))-cn;function xr(e,t,r){if(typeof e!="number"||e<2)throw new Error("hashLen must be a number");if(typeof t!="number"||t<2)throw new Error("qByteLen must be a number");if(typeof r!="function")throw new Error("hmacFn must be a function");let n=d=>new Uint8Array(d),o=d=>Uint8Array.of(d),s=n(e),i=n(e),c=0,f=()=>{s.fill(1),i.fill(0),c=0},u=(...d)=>r(i,s,...d),h=(d=n(0))=>{i=u(o(0),d),s=u(),d.length!==0&&(i=u(o(1),d),s=u())},g=()=>{if(c++>=1e3)throw new Error("drbg: tried 1000 values");let d=0,y=[];for(;d<t;){s=u();let B=s.slice();y.push(B),d+=s.length}return ot(...y)};return(d,y)=>{f(),h(d);let B;for(;!(B=y(g()));)h();return f(),B}}function ge(e,t,r={}){if(!e||typeof e!="object")throw new Error("expected valid options object");function n(o,s,i){let c=e[o];if(i&&c===void 0)return;let f=typeof c;if(f!==s||c===null)throw new Error(`param "${o}" is invalid: expected ${s}, got ${f}`)}Object.entries(t).forEach(([o,s])=>n(o,s,!1)),Object.entries(r).forEach(([o,s])=>n(o,s,!0))}function ln(e){let t=new WeakMap;return(r,...n)=>{let o=t.get(r);if(o!==void 0)return o;let s=e(r,...n);return t.set(r,s),s}}var nt=BigInt(0),tt=BigInt(1),Zt=BigInt(2),wr=BigInt(3),mr=BigInt(4),Er=BigInt(5),as=BigInt(7),Br=BigInt(8),us=BigInt(9),vr=BigInt(16);function it(e,t){let r=e%t;return r>=nt?r:t+r}function ct(e,t,r){let n=e;for(;t-- >nt;)n*=n,n%=r;return n}function pr(e,t){if(e===nt)throw new Error("invert: expected non-zero number");if(t<=nt)throw new Error("invert: expected positive modulus, got "+t);let r=it(e,t),n=t,o=nt,s=tt,i=tt,c=nt;for(;r!==nt;){let u=n/r,h=n%r,g=o-i*u,b=s-c*u;n=r,r=h,o=i,s=c,i=g,c=b}if(n!==tt)throw new Error("invert: does not exist");return it(o,t)}function dn(e,t,r){if(!e.eql(e.sqr(t),r))throw new Error("Cannot find square root")}function Ar(e,t){let r=(e.ORDER+tt)/mr,n=e.pow(t,r);return dn(e,n,t),n}function ls(e,t){let r=(e.ORDER-Er)/Br,n=e.mul(t,Zt),o=e.pow(n,r),s=e.mul(t,o),i=e.mul(e.mul(s,Zt),o),c=e.mul(s,e.sub(i,e.ONE));return dn(e,c,t),c}function ds(e){let t=Ot(e),r=Sr(e),n=r(t,t.neg(t.ONE)),o=r(t,n),s=r(t,t.neg(n)),i=(e+as)/vr;return(c,f)=>{let u=c.pow(f,i),h=c.mul(u,n),g=c.mul(u,o),b=c.mul(u,s),d=c.eql(c.sqr(h),f),y=c.eql(c.sqr(g),f);u=c.cmov(u,h,d),h=c.cmov(b,g,y);let B=c.eql(c.sqr(h),f),S=c.cmov(u,h,B);return dn(c,S,f),S}}function Sr(e){if(e<wr)throw new Error("sqrt is not defined for small field");let t=e-tt,r=0;for(;t%Zt===nt;)t/=Zt,r++;let n=Zt,o=Ot(e);for(;yr(o,n)===1;)if(n++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(r===1)return Ar;let s=o.pow(n,t),i=(t+tt)/Zt;return function(f,u){if(f.is0(u))return u;if(yr(f,u)!==1)throw new Error("Cannot find square root");let h=r,g=f.mul(f.ONE,s),b=f.pow(u,t),d=f.pow(u,i);for(;!f.eql(b,f.ONE);){if(f.is0(b))return f.ZERO;let y=1,B=f.sqr(b);for(;!f.eql(B,f.ONE);)if(y++,B=f.sqr(B),y===h)throw new Error("Cannot find square root");let S=tt<<BigInt(h-y-1),_=f.pow(g,S);h=y,g=f.sqr(_),b=f.mul(b,g),d=f.mul(d,_)}return d}}function hs(e){return e%mr===wr?Ar:e%Br===Er?ls:e%vr===us?ds(e):Sr(e)}var bs=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function hn(e){let t={ORDER:"bigint",MASK:"bigint",BYTES:"number",BITS:"number"},r=bs.reduce((n,o)=>(n[o]="function",n),t);return ge(e,r),e}function gs(e,t,r){if(r<nt)throw new Error("invalid exponent, negatives unsupported");if(r===nt)return e.ONE;if(r===tt)return t;let n=e.ONE,o=t;for(;r>nt;)r&tt&&(n=e.mul(n,o)),o=e.sqr(o),r>>=tt;return n}function Ne(e,t,r=!1){let n=new Array(t.length).fill(r?e.ZERO:void 0),o=t.reduce((i,c,f)=>e.is0(c)?i:(n[f]=i,e.mul(i,c)),e.ONE),s=e.inv(o);return t.reduceRight((i,c,f)=>e.is0(c)?i:(n[f]=e.mul(i,n[f]),e.mul(i,c)),s),n}function yr(e,t){let r=(e.ORDER-tt)/Zt,n=e.pow(t,r),o=e.eql(n,e.ONE),s=e.eql(n,e.ZERO),i=e.eql(n,e.neg(e.ONE));if(!o&&!s&&!i)throw new Error("invalid Legendre symbol result");return o?1:s?0:-1}function qe(e,t){t!==void 0&&ue(t);let r=t!==void 0?t:e.toString(2).length,n=Math.ceil(r/8);return{nBitLength:r,nByteLength:n}}function Ot(e,t,r=!1,n={}){if(e<=nt)throw new Error("invalid field: expected ORDER > 0, got "+e);let o,s,i=!1,c;if(typeof t=="object"&&t!=null){if(n.sqrt||r)throw new Error("cannot specify opts in two arguments");let b=t;b.BITS&&(o=b.BITS),b.sqrt&&(s=b.sqrt),typeof b.isLE=="boolean"&&(r=b.isLE),typeof b.modFromBytes=="boolean"&&(i=b.modFromBytes),c=b.allowedLengths}else typeof t=="number"&&(o=t),n.sqrt&&(s=n.sqrt);let{nBitLength:f,nByteLength:u}=qe(e,o);if(u>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");let h,g=Object.freeze({ORDER:e,isLE:r,BITS:f,BYTES:u,MASK:Rt(f),ZERO:nt,ONE:tt,allowedLengths:c,create:b=>it(b,e),isValid:b=>{if(typeof b!="bigint")throw new Error("invalid field element: expected bigint, got "+typeof b);return nt<=b&&b<e},is0:b=>b===nt,isValidNot0:b=>!g.is0(b)&&g.isValid(b),isOdd:b=>(b&tt)===tt,neg:b=>it(-b,e),eql:(b,d)=>b===d,sqr:b=>it(b*b,e),add:(b,d)=>it(b+d,e),sub:(b,d)=>it(b-d,e),mul:(b,d)=>it(b*d,e),pow:(b,d)=>gs(g,b,d),div:(b,d)=>it(b*pr(d,e),e),sqrN:b=>b*b,addN:(b,d)=>b+d,subN:(b,d)=>b-d,mulN:(b,d)=>b*d,inv:b=>pr(b,e),sqrt:s||(b=>(h||(h=hs(e)),h(g,b))),toBytes:b=>r?un(b,u):Xt(b,u),fromBytes:(b,d=!0)=>{if(c){if(!c.includes(b.length)||b.length>u)throw new Error("Field.fromBytes: expected "+c+" bytes, got "+b.length);let B=new Uint8Array(u);B.set(b,r?0:B.length-b.length),b=B}if(b.length!==u)throw new Error("Field.fromBytes: expected "+u+" bytes, got "+b.length);let y=r?an(b):pt(b);if(i&&(y=it(y,e)),!d&&!g.isValid(y))throw new Error("invalid field element: outside of range 0..ORDER");return y},invertBatch:b=>Ne(g,b),cmov:(b,d,y)=>y?d:b});return Object.freeze(g)}function Ir(e){if(typeof e!="bigint")throw new Error("field order must be bigint");let t=e.toString(2).length;return Math.ceil(t/8)}function bn(e){let t=Ir(e);return t+Math.ceil(t/2)}function Ce(e,t,r=!1){let n=e.length,o=Ir(t),s=bn(t);if(n<16||n<s||n>1024)throw new Error("expected "+s+"-1024 bytes of input, got "+n);let i=r?an(e):pt(e),c=it(i,t-tt)+tt;return r?un(c,o):Xt(c,o)}var Jt=BigInt(0),jt=BigInt(1);function xe(e,t){let r=t.negate();return e?r:t}function De(e,t){let r=Ne(e.Fp,t.map(n=>n.Z));return t.map((n,o)=>e.fromAffine(n.toAffine(r[o])))}function Rr(e,t){if(!Number.isSafeInteger(e)||e<=0||e>t)throw new Error("invalid window size, expected [1.."+t+"], got W="+e)}function gn(e,t){Rr(e,t);let r=Math.ceil(t/e)+1,n=2**(e-1),o=2**e,s=Rt(e),i=BigInt(e);return{windows:r,windowSize:n,mask:s,maxNumber:o,shiftBy:i}}function Lr(e,t,r){let{windowSize:n,mask:o,maxNumber:s,shiftBy:i}=r,c=Number(e&o),f=e>>i;c>n&&(c-=s,f+=jt);let u=t*n,h=u+Math.abs(c)-1,g=c===0,b=c<0,d=t%2!==0;return{nextN:f,offset:h,isZero:g,isNeg:b,isNegF:d,offsetF:u}}function xs(e,t){if(!Array.isArray(e))throw new Error("array expected");e.forEach((r,n)=>{if(!(r instanceof t))throw new Error("invalid point at index "+n)})}function ps(e,t){if(!Array.isArray(e))throw new Error("array of scalars expected");e.forEach((r,n)=>{if(!t.isValid(r))throw new Error("invalid scalar at index "+n)})}var xn=new WeakMap,Or=new WeakMap;function pn(e){return Or.get(e)||1}function _r(e){if(e!==Jt)throw new Error("invalid wNAF")}var Ve=class{constructor(t,r){this.BASE=t.BASE,this.ZERO=t.ZERO,this.Fn=t.Fn,this.bits=r}_unsafeLadder(t,r,n=this.ZERO){let o=t;for(;r>Jt;)r&jt&&(n=n.add(o)),o=o.double(),r>>=jt;return n}precomputeWindow(t,r){let{windows:n,windowSize:o}=gn(r,this.bits),s=[],i=t,c=i;for(let f=0;f<n;f++){c=i,s.push(c);for(let u=1;u<o;u++)c=c.add(i),s.push(c);i=c.double()}return s}wNAF(t,r,n){if(!this.Fn.isValid(n))throw new Error("invalid scalar");let o=this.ZERO,s=this.BASE,i=gn(t,this.bits);for(let c=0;c<i.windows;c++){let{nextN:f,offset:u,isZero:h,isNeg:g,isNegF:b,offsetF:d}=Lr(n,c,i);n=f,h?s=s.add(xe(b,r[d])):o=o.add(xe(g,r[u]))}return _r(n),{p:o,f:s}}wNAFUnsafe(t,r,n,o=this.ZERO){let s=gn(t,this.bits);for(let i=0;i<s.windows&&n!==Jt;i++){let{nextN:c,offset:f,isZero:u,isNeg:h}=Lr(n,i,s);if(n=c,!u){let g=r[f];o=o.add(h?g.negate():g)}}return _r(n),o}getPrecomputes(t,r,n){let o=xn.get(r);return o||(o=this.precomputeWindow(r,t),t!==1&&(typeof n=="function"&&(o=n(o)),xn.set(r,o))),o}cached(t,r,n){let o=pn(t);return this.wNAF(o,this.getPrecomputes(o,t,n),r)}unsafe(t,r,n,o){let s=pn(t);return s===1?this._unsafeLadder(t,r,o):this.wNAFUnsafe(s,this.getPrecomputes(s,t,n),r,o)}createCache(t,r){Rr(r,this.bits),Or.set(t,r),xn.delete(t)}hasCache(t){return pn(t)!==1}};function Hr(e,t,r,n){let o=t,s=e.ZERO,i=e.ZERO;for(;r>Jt||n>Jt;)r&jt&&(s=s.add(o)),n&jt&&(i=i.add(o)),o=o.double(),r>>=jt,n>>=jt;return{p1:s,p2:i}}function kr(e,t,r,n){xs(r,e),ps(n,t);let o=r.length,s=n.length;if(o!==s)throw new Error("arrays of points and scalars must have equal length");let i=e.ZERO,c=Te(BigInt(o)),f=1;c>12?f=c-3:c>4?f=c-2:c>0&&(f=2);let u=Rt(f),h=new Array(Number(u)+1).fill(i),g=Math.floor((t.BITS-1)/f)*f,b=i;for(let d=g;d>=0;d-=f){h.fill(i);for(let B=0;B<s;B++){let S=n[B],_=Number(S>>BigInt(d)&u);h[_]=h[_].add(r[B])}let y=i;for(let B=h.length-1,S=i;B>0;B--)S=S.add(h[B]),y=y.add(S);if(b=b.add(y),d!==0)for(let B=0;B<f;B++)b=b.double()}return b}function Ur(e,t,r){if(t){if(t.ORDER!==e)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return hn(t),t}else return Ot(e,{isLE:r})}function Tr(e,t,r={},n){if(n===void 0&&(n=e==="edwards"),!t||typeof t!="object")throw new Error(`expected valid ${e} CURVE object`);for(let f of["p","n","h"]){let u=t[f];if(!(typeof u=="bigint"&&u>Jt))throw new Error(`CURVE.${f} must be positive bigint`)}let o=Ur(t.p,r.Fp,n),s=Ur(t.n,r.Fn,n),c=["Gx","Gy","a",e==="weierstrass"?"b":"d"];for(let f of c)if(!o.isValid(t[f]))throw new Error(`CURVE.${f} must be valid field element of CURVE.Fp`);return t=Object.freeze(Object.assign({},t)),{CURVE:t,Fp:o,Fn:s}}var Nr=(e,t)=>(e+(e>=0?t:-t)/qr)/t;function ys(e,t,r){let[[n,o],[s,i]]=t,c=Nr(i*e,r),f=Nr(-o*e,r),u=e-c*n-f*s,h=-c*o-f*i,g=u<wt,b=h<wt;g&&(u=-u),b&&(h=-h);let d=Rt(Math.ceil(Te(r)/2))+Qt;if(u<wt||u>=d||h<wt||h>=d)throw new Error("splitScalar (endomorphism): failed, k="+e);return{k1neg:g,k1:u,k2neg:b,k2:h}}function wn(e){if(!["compact","recovered","der"].includes(e))throw new Error('Signature format must be "compact", "recovered", or "der"');return e}function yn(e,t){let r={};for(let n of Object.keys(t))r[n]=e[n]===void 0?t[n]:e[n];return de(r.lowS,"lowS"),de(r.prehash,"prehash"),r.format!==void 0&&wn(r.format),r}var mn=class extends Error{constructor(t=""){super(t)}},yt={Err:mn,_tlv:{encode:(e,t)=>{let{Err:r}=yt;if(e<0||e>256)throw new r("tlv.encode: wrong tag");if(t.length&1)throw new r("tlv.encode: unpadded data");let n=t.length/2,o=he(n);if(o.length/2&128)throw new r("tlv.encode: long form length too big");let s=n>127?he(o.length/2|128):"";return he(e)+s+o+t},decode(e,t){let{Err:r}=yt,n=0;if(e<0||e>256)throw new r("tlv.encode: wrong tag");if(t.length<2||t[n++]!==e)throw new r("tlv.decode: wrong tlv");let o=t[n++],s=!!(o&128),i=0;if(!s)i=o;else{let f=o&127;if(!f)throw new r("tlv.decode(long): indefinite length not supported");if(f>4)throw new r("tlv.decode(long): byte length is too big");let u=t.subarray(n,n+f);if(u.length!==f)throw new r("tlv.decode: length bytes not complete");if(u[0]===0)throw new r("tlv.decode(long): zero leftmost byte");for(let h of u)i=i<<8|h;if(n+=f,i<128)throw new r("tlv.decode(long): not minimal encoding")}let c=t.subarray(n,n+i);if(c.length!==i)throw new r("tlv.decode: wrong value length");return{v:c,l:t.subarray(n+i)}}},_int:{encode(e){let{Err:t}=yt;if(e<wt)throw new t("integer: negative integers are not allowed");let r=he(e);if(Number.parseInt(r[0],16)&8&&(r="00"+r),r.length&1)throw new t("unexpected DER parsing assertion: unpadded hex");return r},decode(e){let{Err:t}=yt;if(e[0]&128)throw new t("invalid signature integer: negative");if(e[0]===0&&!(e[1]&128))throw new t("invalid signature integer: unnecessary leading zero");return pt(e)}},toSig(e){let{Err:t,_int:r,_tlv:n}=yt,o=X("signature",e),{v:s,l:i}=n.decode(48,o);if(i.length)throw new t("invalid signature: left bytes after parsing");let{v:c,l:f}=n.decode(2,s),{v:u,l:h}=n.decode(2,f);if(h.length)throw new t("invalid signature: left bytes after parsing");return{r:r.decode(c),s:r.decode(u)}},hexFromSig(e){let{_tlv:t,_int:r}=yt,n=t.encode(2,r.encode(e.r)),o=t.encode(2,r.encode(e.s)),s=n+o;return t.encode(48,s)}},wt=BigInt(0),Qt=BigInt(1),qr=BigInt(2),Me=BigInt(3),ws=BigInt(4);function Ht(e,t){let{BYTES:r}=e,n;if(typeof t=="bigint")n=t;else{let o=X("private key",t);try{n=e.fromBytes(o)}catch{throw new Error(`invalid private key: expected ui8a of size ${r}, got ${typeof t}`)}}if(!e.isValidNot0(n))throw new Error("invalid private key: out of range [1..N-1]");return n}function ms(e,t={}){let r=Tr("weierstrass",e,t),{Fp:n,Fn:o}=r,s=r.CURVE,{h:i,n:c}=s;ge(t,{},{allowInfinityPoint:"boolean",clearCofactor:"function",isTorsionFree:"function",fromBytes:"function",toBytes:"function",endo:"object",wrapPrivateKey:"boolean"});let{endo:f}=t;if(f&&(!n.is0(s.a)||typeof f.beta!="bigint"||!Array.isArray(f.basises)))throw new Error('invalid endo: expected "beta": bigint and "basises": array');let u=Vr(n,o);function h(){if(!n.isOdd)throw new Error("compression is not supported: Field does not have .isOdd()")}function g(L,w,l){let{x:a,y:x}=w.toAffine(),m=n.toBytes(a);if(de(l,"isCompressed"),l){h();let v=!n.isOdd(x);return ot(Cr(v),m)}else return ot(Uint8Array.of(4),m,n.toBytes(x))}function b(L){Ut(L,void 0,"Point");let{publicKey:w,publicKeyUncompressed:l}=u,a=L.length,x=L[0],m=L.subarray(1);if(a===w&&(x===2||x===3)){let v=n.fromBytes(m);if(!n.isValid(v))throw new Error("bad point: is not on curve, wrong x");let p=B(v),A;try{A=n.sqrt(p)}catch(O){let D=O instanceof Error?": "+O.message:"";throw new Error("bad point: is not on curve, sqrt error"+D)}h();let E=n.isOdd(A);return(x&1)===1!==E&&(A=n.neg(A)),{x:v,y:A}}else if(a===l&&x===4){let v=n.BYTES,p=n.fromBytes(m.subarray(0,v)),A=n.fromBytes(m.subarray(v,v*2));if(!S(p,A))throw new Error("bad point: is not on curve");return{x:p,y:A}}else throw new Error(`bad point: got length ${a}, expected compressed=${w} or uncompressed=${l}`)}let d=t.toBytes||g,y=t.fromBytes||b;function B(L){let w=n.sqr(L),l=n.mul(w,L);return n.add(n.add(l,n.mul(L,s.a)),s.b)}function S(L,w){let l=n.sqr(w),a=B(L);return n.eql(l,a)}if(!S(s.Gx,s.Gy))throw new Error("bad curve params: generator point");let _=n.mul(n.pow(s.a,Me),ws),V=n.mul(n.sqr(s.b),BigInt(27));if(n.is0(n.add(_,V)))throw new Error("bad curve params: a or b");function q(L,w,l=!1){if(!n.isValid(w)||l&&n.is0(w))throw new Error(`bad point coordinate ${L}`);return w}function N(L){if(!(L instanceof U))throw new Error("ProjectivePoint expected")}function C(L){if(!f||!f.basises)throw new Error("no endo");return ys(L,f.basises,o.ORDER)}let P=ln((L,w)=>{let{X:l,Y:a,Z:x}=L;if(n.eql(x,n.ONE))return{x:l,y:a};let m=L.is0();w==null&&(w=m?n.ONE:n.inv(x));let v=n.mul(l,w),p=n.mul(a,w),A=n.mul(x,w);if(m)return{x:n.ZERO,y:n.ZERO};if(!n.eql(A,n.ONE))throw new Error("invZ was invalid");return{x:v,y:p}}),Y=ln(L=>{if(L.is0()){if(t.allowInfinityPoint&&!n.is0(L.Y))return;throw new Error("bad point: ZERO")}let{x:w,y:l}=L.toAffine();if(!n.isValid(w)||!n.isValid(l))throw new Error("bad point: x or y not field elements");if(!S(w,l))throw new Error("bad point: equation left != right");if(!L.isTorsionFree())throw new Error("bad point: not in prime-order subgroup");return!0});function z(L,w,l,a,x){return l=new U(n.mul(l.X,L),l.Y,l.Z),w=xe(a,w),l=xe(x,l),w.add(l)}class U{constructor(w,l,a){this.X=q("x",w),this.Y=q("y",l,!0),this.Z=q("z",a),Object.freeze(this)}static CURVE(){return s}static fromAffine(w){let{x:l,y:a}=w||{};if(!w||!n.isValid(l)||!n.isValid(a))throw new Error("invalid affine point");if(w instanceof U)throw new Error("projective point not allowed");return n.is0(l)&&n.is0(a)?U.ZERO:new U(l,a,n.ONE)}static fromBytes(w){let l=U.fromAffine(y(Ut(w,void 0,"point")));return l.assertValidity(),l}static fromHex(w){return U.fromBytes(X("pointHex",w))}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(w=8,l=!0){return M.createCache(this,w),l||this.multiply(Me),this}assertValidity(){Y(this)}hasEvenY(){let{y:w}=this.toAffine();if(!n.isOdd)throw new Error("Field doesn't support isOdd");return!n.isOdd(w)}equals(w){N(w);let{X:l,Y:a,Z:x}=this,{X:m,Y:v,Z:p}=w,A=n.eql(n.mul(l,p),n.mul(m,x)),E=n.eql(n.mul(a,p),n.mul(v,x));return A&&E}negate(){return new U(this.X,n.neg(this.Y),this.Z)}double(){let{a:w,b:l}=s,a=n.mul(l,Me),{X:x,Y:m,Z:v}=this,p=n.ZERO,A=n.ZERO,E=n.ZERO,I=n.mul(x,x),O=n.mul(m,m),D=n.mul(v,v),k=n.mul(x,m);return k=n.add(k,k),E=n.mul(x,v),E=n.add(E,E),p=n.mul(w,E),A=n.mul(a,D),A=n.add(p,A),p=n.sub(O,A),A=n.add(O,A),A=n.mul(p,A),p=n.mul(k,p),E=n.mul(a,E),D=n.mul(w,D),k=n.sub(I,D),k=n.mul(w,k),k=n.add(k,E),E=n.add(I,I),I=n.add(E,I),I=n.add(I,D),I=n.mul(I,k),A=n.add(A,I),D=n.mul(m,v),D=n.add(D,D),I=n.mul(D,k),p=n.sub(p,I),E=n.mul(D,O),E=n.add(E,E),E=n.add(E,E),new U(p,A,E)}add(w){N(w);let{X:l,Y:a,Z:x}=this,{X:m,Y:v,Z:p}=w,A=n.ZERO,E=n.ZERO,I=n.ZERO,O=s.a,D=n.mul(s.b,Me),k=n.mul(l,m),R=n.mul(a,v),Z=n.mul(x,p),G=n.add(l,a),j=n.add(m,v);G=n.mul(G,j),j=n.add(k,R),G=n.sub(G,j),j=n.add(l,x);let $=n.add(m,p);return j=n.mul(j,$),$=n.add(k,Z),j=n.sub(j,$),$=n.add(a,x),A=n.add(v,p),$=n.mul($,A),A=n.add(R,Z),$=n.sub($,A),I=n.mul(O,j),A=n.mul(D,Z),I=n.add(A,I),A=n.sub(R,I),I=n.add(R,I),E=n.mul(A,I),R=n.add(k,k),R=n.add(R,k),Z=n.mul(O,Z),j=n.mul(D,j),R=n.add(R,Z),Z=n.sub(k,Z),Z=n.mul(O,Z),j=n.add(j,Z),k=n.mul(R,j),E=n.add(E,k),k=n.mul($,j),A=n.mul(G,A),A=n.sub(A,k),k=n.mul(G,R),I=n.mul($,I),I=n.add(I,k),new U(A,E,I)}subtract(w){return this.add(w.negate())}is0(){return this.equals(U.ZERO)}multiply(w){let{endo:l}=t;if(!o.isValidNot0(w))throw new Error("invalid scalar: out of range");let a,x,m=v=>M.cached(this,v,p=>De(U,p));if(l){let{k1neg:v,k1:p,k2neg:A,k2:E}=C(w),{p:I,f:O}=m(p),{p:D,f:k}=m(E);x=O.add(k),a=z(l.beta,I,D,v,A)}else{let{p:v,f:p}=m(w);a=v,x=p}return De(U,[a,x])[0]}multiplyUnsafe(w){let{endo:l}=t,a=this;if(!o.isValid(w))throw new Error("invalid scalar: out of range");if(w===wt||a.is0())return U.ZERO;if(w===Qt)return a;if(M.hasCache(this))return this.multiply(w);if(l){let{k1neg:x,k1:m,k2neg:v,k2:p}=C(w),{p1:A,p2:E}=Hr(U,a,m,p);return z(l.beta,A,E,x,v)}else return M.unsafe(a,w)}multiplyAndAddUnsafe(w,l,a){let x=this.multiplyUnsafe(l).add(w.multiplyUnsafe(a));return x.is0()?void 0:x}toAffine(w){return P(this,w)}isTorsionFree(){let{isTorsionFree:w}=t;return i===Qt?!0:w?w(U,this):M.unsafe(this,c).is0()}clearCofactor(){let{clearCofactor:w}=t;return i===Qt?this:w?w(U,this):this.multiplyUnsafe(i)}isSmallOrder(){return this.multiplyUnsafe(i).is0()}toBytes(w=!0){return de(w,"isCompressed"),this.assertValidity(),d(U,this,w)}toHex(w=!0){return st(this.toBytes(w))}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}get px(){return this.X}get py(){return this.X}get pz(){return this.Z}toRawBytes(w=!0){return this.toBytes(w)}_setWindowSize(w){this.precompute(w)}static normalizeZ(w){return De(U,w)}static msm(w,l){return kr(U,o,w,l)}static fromPrivateKey(w){return U.BASE.multiply(Ht(o,w))}}U.BASE=new U(s.Gx,s.Gy,n.ONE),U.ZERO=new U(n.ZERO,n.ONE,n.ZERO),U.Fp=n,U.Fn=o;let K=o.BITS,M=new Ve(U,t.endo?Math.ceil(K/2):K);return U.BASE.precompute(8),U}function Cr(e){return Uint8Array.of(e?2:3)}function Vr(e,t){return{secretKey:t.BYTES,publicKey:1+e.BYTES,publicKeyUncompressed:1+2*e.BYTES,publicKeyHasPrefix:!0,signature:2*t.BYTES}}function Es(e,t={}){let{Fn:r}=e,n=t.randomBytes||Mt,o=Object.assign(Vr(e.Fp,r),{seed:bn(r.ORDER)});function s(d){try{return!!Ht(r,d)}catch{return!1}}function i(d,y){let{publicKey:B,publicKeyUncompressed:S}=o;try{let _=d.length;return y===!0&&_!==B||y===!1&&_!==S?!1:!!e.fromBytes(d)}catch{return!1}}function c(d=n(o.seed)){return Ce(Ut(d,o.seed,"seed"),r.ORDER)}function f(d,y=!0){return e.BASE.multiply(Ht(r,d)).toBytes(y)}function u(d){let y=c(d);return{secretKey:y,publicKey:f(y)}}function h(d){if(typeof d=="bigint")return!1;if(d instanceof e)return!0;let{secretKey:y,publicKey:B,publicKeyUncompressed:S}=o;if(r.allowedLengths||y===B)return;let _=X("key",d).length;return _===B||_===S}function g(d,y,B=!0){if(h(d)===!0)throw new Error("first arg must be private key");if(h(y)===!1)throw new Error("second arg must be public key");let S=Ht(r,d);return e.fromHex(y).multiply(S).toBytes(B)}return Object.freeze({getPublicKey:f,getSharedSecret:g,keygen:u,Point:e,utils:{isValidSecretKey:s,isValidPublicKey:i,randomSecretKey:c,isValidPrivateKey:s,randomPrivateKey:c,normPrivateKeyToScalar:d=>Ht(r,d),precompute(d=8,y=e.BASE){return y.precompute(d,!1)}},lengths:o})}function Bs(e,t,r={}){_e(t),ge(r,{},{hmac:"function",lowS:"boolean",randomBytes:"function",bits2int:"function",bits2int_modN:"function"});let n=r.randomBytes||Mt,o=r.hmac||((l,...a)=>on(t,l,ot(...a))),{Fp:s,Fn:i}=e,{ORDER:c,BITS:f}=i,{keygen:u,getPublicKey:h,getSharedSecret:g,utils:b,lengths:d}=Es(e,r),y={prehash:!1,lowS:typeof r.lowS=="boolean"?r.lowS:!1,format:void 0,extraEntropy:!1},B="compact";function S(l){let a=c>>Qt;return l>a}function _(l,a){if(!i.isValidNot0(a))throw new Error(`invalid signature ${l}: out of range 1..Point.Fn.ORDER`);return a}function V(l,a){wn(a);let x=d.signature,m=a==="compact"?x:a==="recovered"?x+1:void 0;return Ut(l,m,`${a} signature`)}class q{constructor(a,x,m){this.r=_("r",a),this.s=_("s",x),m!=null&&(this.recovery=m),Object.freeze(this)}static fromBytes(a,x=B){V(a,x);let m;if(x==="der"){let{r:E,s:I}=yt.toSig(Ut(a));return new q(E,I)}x==="recovered"&&(m=a[0],x="compact",a=a.subarray(1));let v=i.BYTES,p=a.subarray(0,v),A=a.subarray(v,v*2);return new q(i.fromBytes(p),i.fromBytes(A),m)}static fromHex(a,x){return this.fromBytes(Dt(a),x)}addRecoveryBit(a){return new q(this.r,this.s,a)}recoverPublicKey(a){let x=s.ORDER,{r:m,s:v,recovery:p}=this;if(p==null||![0,1,2,3].includes(p))throw new Error("recovery id invalid");if(c*qr<x&&p>1)throw new Error("recovery id is ambiguous for h>1 curve");let E=p===2||p===3?m+c:m;if(!s.isValid(E))throw new Error("recovery id 2 or 3 invalid");let I=s.toBytes(E),O=e.fromBytes(ot(Cr((p&1)===0),I)),D=i.inv(E),k=C(X("msgHash",a)),R=i.create(-k*D),Z=i.create(v*D),G=e.BASE.multiplyUnsafe(R).add(O.multiplyUnsafe(Z));if(G.is0())throw new Error("point at infinify");return G.assertValidity(),G}hasHighS(){return S(this.s)}toBytes(a=B){if(wn(a),a==="der")return Dt(yt.hexFromSig(this));let x=i.toBytes(this.r),m=i.toBytes(this.s);if(a==="recovered"){if(this.recovery==null)throw new Error("recovery bit must be present");return ot(Uint8Array.of(this.recovery),x,m)}return ot(x,m)}toHex(a){return st(this.toBytes(a))}assertValidity(){}static fromCompact(a){return q.fromBytes(X("sig",a),"compact")}static fromDER(a){return q.fromBytes(X("sig",a),"der")}normalizeS(){return this.hasHighS()?new q(this.r,i.neg(this.s),this.recovery):this}toDERRawBytes(){return this.toBytes("der")}toDERHex(){return st(this.toBytes("der"))}toCompactRawBytes(){return this.toBytes("compact")}toCompactHex(){return st(this.toBytes("compact"))}}let N=r.bits2int||function(a){if(a.length>8192)throw new Error("input is too large");let x=pt(a),m=a.length*8-f;return m>0?x>>BigInt(m):x},C=r.bits2int_modN||function(a){return i.create(N(a))},P=Rt(f);function Y(l){return gr("num < 2^"+f,l,wt,P),i.toBytes(l)}function z(l,a){return Ut(l,void 0,"message"),a?Ut(t(l),void 0,"prehashed message"):l}function U(l,a,x){if(["recovered","canonical"].some(R=>R in x))throw new Error("sign() legacy options not supported");let{lowS:m,prehash:v,extraEntropy:p}=yn(x,y);l=z(l,v);let A=C(l),E=Ht(i,a),I=[Y(E),Y(A)];if(p!=null&&p!==!1){let R=p===!0?n(d.secretKey):p;I.push(X("extraEntropy",R))}let O=ot(...I),D=A;function k(R){let Z=N(R);if(!i.isValidNot0(Z))return;let G=i.inv(Z),j=e.BASE.multiply(Z).toAffine(),$=i.create(j.x);if($===wt)return;let J=i.create(G*i.create(D+$*E));if(J===wt)return;let fe=(j.x===$?0:2)|Number(j.y&Qt),ae=J;return m&&S(J)&&(ae=i.neg(J),fe^=1),new q($,ae,fe)}return{seed:O,k2sig:k}}function K(l,a,x={}){l=X("message",l);let{seed:m,k2sig:v}=U(l,a,x);return xr(t.outputLen,i.BYTES,o)(m,v)}function M(l){let a,x=typeof l=="string"||Ct(l),m=!x&&l!==null&&typeof l=="object"&&typeof l.r=="bigint"&&typeof l.s=="bigint";if(!x&&!m)throw new Error("invalid signature, expected Uint8Array, hex string or Signature instance");if(m)a=new q(l.r,l.s);else if(x){try{a=q.fromBytes(X("sig",l),"der")}catch(v){if(!(v instanceof yt.Err))throw v}if(!a)try{a=q.fromBytes(X("sig",l),"compact")}catch{return!1}}return a||!1}function L(l,a,x,m={}){let{lowS:v,prehash:p,format:A}=yn(m,y);if(x=X("publicKey",x),a=z(X("message",a),p),"strict"in m)throw new Error("options.strict was renamed to lowS");let E=A===void 0?M(l):q.fromBytes(X("sig",l),A);if(E===!1)return!1;try{let I=e.fromBytes(x);if(v&&E.hasHighS())return!1;let{r:O,s:D}=E,k=C(a),R=i.inv(D),Z=i.create(k*R),G=i.create(O*R),j=e.BASE.multiplyUnsafe(Z).add(I.multiplyUnsafe(G));return j.is0()?!1:i.create(j.x)===O}catch{return!1}}function w(l,a,x={}){let{prehash:m}=yn(x,y);return a=z(a,m),q.fromBytes(l,"recovered").recoverPublicKey(a).toBytes()}return Object.freeze({keygen:u,getPublicKey:h,getSharedSecret:g,utils:b,lengths:d,Point:e,sign:K,verify:L,recoverPublicKey:w,Signature:q,hash:t})}function vs(e){let t={a:e.a,b:e.b,p:e.Fp.ORDER,n:e.n,h:e.h,Gx:e.Gx,Gy:e.Gy},r=e.Fp,n=e.allowedPrivateKeyLengths?Array.from(new Set(e.allowedPrivateKeyLengths.map(i=>Math.ceil(i/2)))):void 0,o=Ot(t.n,{BITS:e.nBitLength,allowedLengths:n,modFromBytes:e.wrapPrivateKey}),s={Fp:r,Fn:o,allowInfinityPoint:e.allowInfinityPoint,endo:e.endo,isTorsionFree:e.isTorsionFree,clearCofactor:e.clearCofactor,fromBytes:e.fromBytes,toBytes:e.toBytes};return{CURVE:t,curveOpts:s}}function As(e){let{CURVE:t,curveOpts:r}=vs(e),n={hmac:e.hmac,randomBytes:e.randomBytes,lowS:e.lowS,bits2int:e.bits2int,bits2int_modN:e.bits2int_modN};return{CURVE:t,curveOpts:r,hash:e.hash,ecdsaOpts:n}}function Ss(e,t){let r=t.Point;return Object.assign({},t,{ProjectivePoint:r,CURVE:Object.assign({},e,qe(r.Fn.ORDER,r.Fn.BITS))})}function Dr(e){let{CURVE:t,curveOpts:r,hash:n,ecdsaOpts:o}=As(e),s=ms(t,r),i=Bs(s,n,o);return Ss(e,i)}function Mr(e,t){let r=n=>Dr({...e,hash:n});return{...r(t),create:r}}var Ft={p:BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f"),n:BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"),h:BigInt(1),a:BigInt(0),b:BigInt(7),Gx:BigInt("0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"),Gy:BigInt("0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8")},Is={beta:BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),basises:[[BigInt("0x3086d221a7d46bcde86c90e49284eb15"),-BigInt("0xe4437ed6010e88286f547fa90abfe4c3")],[BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"),BigInt("0x3086d221a7d46bcde86c90e49284eb15")]]},Ls=BigInt(0),Zr=BigInt(1),En=BigInt(2);function _s(e){let t=Ft.p,r=BigInt(3),n=BigInt(6),o=BigInt(11),s=BigInt(22),i=BigInt(23),c=BigInt(44),f=BigInt(88),u=e*e*e%t,h=u*u*e%t,g=ct(h,r,t)*h%t,b=ct(g,r,t)*h%t,d=ct(b,En,t)*u%t,y=ct(d,o,t)*d%t,B=ct(y,s,t)*y%t,S=ct(B,c,t)*B%t,_=ct(S,f,t)*S%t,V=ct(_,c,t)*B%t,q=ct(V,r,t)*h%t,N=ct(q,i,t)*y%t,C=ct(N,n,t)*u%t,P=ct(C,En,t);if(!Ze.eql(Ze.sqr(P),e))throw new Error("Cannot find square root");return P}var Ze=Ot(Ft.p,{sqrt:_s}),$r=Mr({...Ft,Fp:Ze,lowS:!0,endo:Is},Wt),jr={};function je(e,...t){let r=jr[e];if(r===void 0){let n=Wt(Re(e));r=ot(n,n),jr[e]=r}return Wt(ot(r,...t))}var vn=e=>e.toBytes(!0).slice(1),te=$r.Point,An=e=>e%En===Ls;function Bn(e){let{Fn:t,BASE:r}=te,n=Ht(t,e),o=r.multiply(n);return{scalar:An(o.y)?n:t.neg(n),bytes:vn(o)}}function Pr(e){let t=Ze;if(!t.isValidNot0(e))throw new Error("invalid x: Fail if x \u2265 p");let r=t.create(e*e),n=t.create(r*e+BigInt(7)),o=t.sqrt(n);An(o)||(o=t.neg(o));let s=te.fromAffine({x:e,y:o});return s.assertValidity(),s}var pe=pt;function Gr(...e){return te.Fn.create(pe(je("BIP0340/challenge",...e)))}function Kr(e){return Bn(e).bytes}function Us(e,t,r=Mt(32)){let{Fn:n}=te,o=X("message",e),{bytes:s,scalar:i}=Bn(t),c=X("auxRand",r,32),f=n.toBytes(i^pe(je("BIP0340/aux",c))),u=je("BIP0340/nonce",f,s,o),{bytes:h,scalar:g}=Bn(u),b=Gr(h,s,o),d=new Uint8Array(64);if(d.set(h,0),d.set(n.toBytes(n.create(g+b*i)),32),!zr(d,o,s))throw new Error("sign: Invalid signature produced");return d}function zr(e,t,r){let{Fn:n,BASE:o}=te,s=X("signature",e,64),i=X("message",t),c=X("publicKey",r,32);try{let f=Pr(pe(c)),u=pe(s.subarray(0,32));if(!be(u,Zr,Ft.p))return!1;let h=pe(s.subarray(32,64));if(!be(h,Zr,Ft.n))return!1;let g=Gr(n.toBytes(u),vn(f),i),b=o.multiplyUnsafe(h).add(f.multiplyUnsafe(n.neg(g))),{x:d,y}=b.toAffine();return!(b.is0()||!An(y)||d!==u)}catch{return!1}}var ye=(()=>{let r=(o=Mt(48))=>Ce(o,Ft.n);$r.utils.randomSecretKey;function n(o){let s=r(o);return{secretKey:s,publicKey:Kr(s)}}return{keygen:n,getPublicKey:Kr,sign:Us,verify:zr,Point:te,utils:{randomSecretKey:r,randomPrivateKey:r,taggedHash:je,lift_x:Pr,pointToBytes:vn,numberToBytesBE:Xt,bytesToNumberBE:pt,mod:it},lengths:{secretKey:32,publicKey:32,publicKeyHasPrefix:!1,signature:64,seed:48}}})();var Sn=Wt;function Rs(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"}function Ke(e){if(typeof e!="boolean")throw new Error(`boolean expected, not ${e}`)}function $e(e){if(!Number.isSafeInteger(e)||e<0)throw new Error("positive integer expected, got "+e)}function Q(e,t,r=""){let n=Rs(e),o=e?.length,s=t!==void 0;if(!n||s&&o!==t){let i=r&&`"${r}" `,c=s?` of length ${t}`:"",f=n?`length=${o}`:`type=${typeof e}`;throw new Error(i+"expected Uint8Array"+c+", got "+f)}return e}function In(e,t=!0){if(e.destroyed)throw new Error("Hash instance has been destroyed");if(t&&e.finished)throw new Error("Hash#digest() has already been called")}function Yr(e,t){Q(e,void 0,"output");let r=t.outputLen;if(e.length<r)throw new Error("digestInto() expects output buffer of length at least "+r)}function mt(e){return new Uint32Array(e.buffer,e.byteOffset,Math.floor(e.byteLength/4))}function Et(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function Os(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}var Hs=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function Wr(e,t){if(t==null||typeof t!="object")throw new Error("options must be defined");return Object.assign(e,t)}function Pe(e,t){if(e.length!==t.length)return!1;let r=0;for(let n=0;n<e.length;n++)r|=e[n]^t[n];return r===0}var Ln=(e,t)=>{function r(n,...o){if(Q(n,void 0,"key"),!Hs)throw new Error("Non little-endian hardware is not yet supported");if(e.nonceLength!==void 0){let h=o[0];Q(h,e.varSizeNonce?void 0:e.nonceLength,"nonce")}let s=e.tagLength;s&&o[1]!==void 0&&Q(o[1],void 0,"AAD");let i=t(n,...o),c=(h,g)=>{if(g!==void 0){if(h!==2)throw new Error("cipher output not supported");Q(g,void 0,"output")}},f=!1;return{encrypt(h,g){if(f)throw new Error("cannot encrypt() twice with same key + nonce");return f=!0,Q(h),c(i.encrypt.length,g),i.encrypt(h,g)},decrypt(h,g){if(Q(h),s&&h.length<s)throw new Error('"ciphertext" expected length bigger than tagLength='+s);return c(i.decrypt.length,g),i.decrypt(h,g)}}}return Object.assign(r,e),r};function _n(e,t,r=!0){if(t===void 0)return new Uint8Array(e);if(t.length!==e)throw new Error('"output" expected Uint8Array of length '+e+", got: "+t.length);if(r&&!ks(t))throw new Error("invalid output, must be aligned");return t}function Xr(e,t,r){Ke(r);let n=new Uint8Array(16),o=Os(n);return o.setBigUint64(0,BigInt(t),r),o.setBigUint64(8,BigInt(e),r),n}function ks(e){return e.byteOffset%4===0}function ee(e){return Uint8Array.from(e)}var Qr=e=>Uint8Array.from(e.split(""),t=>t.charCodeAt(0)),Ts=Qr("expand 16-byte k"),Ns=Qr("expand 32-byte k"),qs=mt(Ts),Cs=mt(Ns);function H(e,t){return e<<t|e>>>32-t}function Un(e){return e.byteOffset%4===0}var Ge=64,Vs=16,Fr=2**32-1,Jr=Uint32Array.of();function Ds(e,t,r,n,o,s,i,c){let f=o.length,u=new Uint8Array(Ge),h=mt(u),g=Un(o)&&Un(s),b=g?mt(o):Jr,d=g?mt(s):Jr;for(let y=0;y<f;i++){if(e(t,r,n,h,i,c),i>=Fr)throw new Error("arx: counter overflow");let B=Math.min(Ge,f-y);if(g&&B===Ge){let S=y/4;if(y%4!==0)throw new Error("arx: invalid block position");for(let _=0,V;_<Vs;_++)V=S+_,d[V]=b[V]^h[_];y+=Ge;continue}for(let S=0,_;S<B;S++)_=y+S,s[_]=o[_]^u[S];y+=B}}function Rn(e,t){let{allowShortKeys:r,extendNonceFn:n,counterLength:o,counterRight:s,rounds:i}=Wr({allowShortKeys:!1,counterLength:8,counterRight:!1,rounds:20},t);if(typeof e!="function")throw new Error("core must be a function");return $e(o),$e(i),Ke(s),Ke(r),(c,f,u,h,g=0)=>{Q(c,void 0,"key"),Q(f,void 0,"nonce"),Q(u,void 0,"data");let b=u.length;if(h===void 0&&(h=new Uint8Array(b)),Q(h,void 0,"output"),$e(g),g<0||g>=Fr)throw new Error("arx: counter overflow");if(h.length<b)throw new Error(`arx: output (${h.length}) is shorter than data (${b})`);let d=[],y=c.length,B,S;if(y===32)d.push(B=ee(c)),S=Cs;else if(y===16&&r)B=new Uint8Array(32),B.set(c),B.set(c,16),S=qs,d.push(B);else throw Q(c,32,"arx key"),new Error("invalid key size");Un(f)||d.push(f=ee(f));let _=mt(B);if(n){if(f.length!==24)throw new Error("arx: extended nonce must be 24 bytes");n(S,_,mt(f.subarray(0,16)),_),f=f.subarray(16)}let V=16-o;if(V!==f.length)throw new Error(`arx: nonce must be ${V} or 16 bytes`);if(V!==12){let N=new Uint8Array(12);N.set(f,s?0:12-f.length),f=N,d.push(f)}let q=mt(f);return Ds(e,S,_,q,u,h,g,i),Et(...d),h}}function F(e,t){return e[t++]&255|(e[t++]&255)<<8}var On=class{constructor(t){T(this,"blockLen",16);T(this,"outputLen",16);T(this,"buffer",new Uint8Array(16));T(this,"r",new Uint16Array(10));T(this,"h",new Uint16Array(10));T(this,"pad",new Uint16Array(8));T(this,"pos",0);T(this,"finished",!1);t=ee(Q(t,32,"key"));let r=F(t,0),n=F(t,2),o=F(t,4),s=F(t,6),i=F(t,8),c=F(t,10),f=F(t,12),u=F(t,14);this.r[0]=r&8191,this.r[1]=(r>>>13|n<<3)&8191,this.r[2]=(n>>>10|o<<6)&7939,this.r[3]=(o>>>7|s<<9)&8191,this.r[4]=(s>>>4|i<<12)&255,this.r[5]=i>>>1&8190,this.r[6]=(i>>>14|c<<2)&8191,this.r[7]=(c>>>11|f<<5)&8065,this.r[8]=(f>>>8|u<<8)&8191,this.r[9]=u>>>5&127;for(let h=0;h<8;h++)this.pad[h]=F(t,16+2*h)}process(t,r,n=!1){let o=n?0:2048,{h:s,r:i}=this,c=i[0],f=i[1],u=i[2],h=i[3],g=i[4],b=i[5],d=i[6],y=i[7],B=i[8],S=i[9],_=F(t,r+0),V=F(t,r+2),q=F(t,r+4),N=F(t,r+6),C=F(t,r+8),P=F(t,r+10),Y=F(t,r+12),z=F(t,r+14),U=s[0]+(_&8191),K=s[1]+((_>>>13|V<<3)&8191),M=s[2]+((V>>>10|q<<6)&8191),L=s[3]+((q>>>7|N<<9)&8191),w=s[4]+((N>>>4|C<<12)&8191),l=s[5]+(C>>>1&8191),a=s[6]+((C>>>14|P<<2)&8191),x=s[7]+((P>>>11|Y<<5)&8191),m=s[8]+((Y>>>8|z<<8)&8191),v=s[9]+(z>>>5|o),p=0,A=p+U*c+K*(5*S)+M*(5*B)+L*(5*y)+w*(5*d);p=A>>>13,A&=8191,A+=l*(5*b)+a*(5*g)+x*(5*h)+m*(5*u)+v*(5*f),p+=A>>>13,A&=8191;let E=p+U*f+K*c+M*(5*S)+L*(5*B)+w*(5*y);p=E>>>13,E&=8191,E+=l*(5*d)+a*(5*b)+x*(5*g)+m*(5*h)+v*(5*u),p+=E>>>13,E&=8191;let I=p+U*u+K*f+M*c+L*(5*S)+w*(5*B);p=I>>>13,I&=8191,I+=l*(5*y)+a*(5*d)+x*(5*b)+m*(5*g)+v*(5*h),p+=I>>>13,I&=8191;let O=p+U*h+K*u+M*f+L*c+w*(5*S);p=O>>>13,O&=8191,O+=l*(5*B)+a*(5*y)+x*(5*d)+m*(5*b)+v*(5*g),p+=O>>>13,O&=8191;let D=p+U*g+K*h+M*u+L*f+w*c;p=D>>>13,D&=8191,D+=l*(5*S)+a*(5*B)+x*(5*y)+m*(5*d)+v*(5*b),p+=D>>>13,D&=8191;let k=p+U*b+K*g+M*h+L*u+w*f;p=k>>>13,k&=8191,k+=l*c+a*(5*S)+x*(5*B)+m*(5*y)+v*(5*d),p+=k>>>13,k&=8191;let R=p+U*d+K*b+M*g+L*h+w*u;p=R>>>13,R&=8191,R+=l*f+a*c+x*(5*S)+m*(5*B)+v*(5*y),p+=R>>>13,R&=8191;let Z=p+U*y+K*d+M*b+L*g+w*h;p=Z>>>13,Z&=8191,Z+=l*u+a*f+x*c+m*(5*S)+v*(5*B),p+=Z>>>13,Z&=8191;let G=p+U*B+K*y+M*d+L*b+w*g;p=G>>>13,G&=8191,G+=l*h+a*u+x*f+m*c+v*(5*S),p+=G>>>13,G&=8191;let j=p+U*S+K*B+M*y+L*d+w*b;p=j>>>13,j&=8191,j+=l*g+a*h+x*u+m*f+v*c,p+=j>>>13,j&=8191,p=(p<<2)+p|0,p=p+A|0,A=p&8191,p=p>>>13,E+=p,s[0]=A,s[1]=E,s[2]=I,s[3]=O,s[4]=D,s[5]=k,s[6]=R,s[7]=Z,s[8]=G,s[9]=j}finalize(){let{h:t,pad:r}=this,n=new Uint16Array(10),o=t[1]>>>13;t[1]&=8191;for(let c=2;c<10;c++)t[c]+=o,o=t[c]>>>13,t[c]&=8191;t[0]+=o*5,o=t[0]>>>13,t[0]&=8191,t[1]+=o,o=t[1]>>>13,t[1]&=8191,t[2]+=o,n[0]=t[0]+5,o=n[0]>>>13,n[0]&=8191;for(let c=1;c<10;c++)n[c]=t[c]+o,o=n[c]>>>13,n[c]&=8191;n[9]-=8192;let s=(o^1)-1;for(let c=0;c<10;c++)n[c]&=s;s=~s;for(let c=0;c<10;c++)t[c]=t[c]&s|n[c];t[0]=(t[0]|t[1]<<13)&65535,t[1]=(t[1]>>>3|t[2]<<10)&65535,t[2]=(t[2]>>>6|t[3]<<7)&65535,t[3]=(t[3]>>>9|t[4]<<4)&65535,t[4]=(t[4]>>>12|t[5]<<1|t[6]<<14)&65535,t[5]=(t[6]>>>2|t[7]<<11)&65535,t[6]=(t[7]>>>5|t[8]<<8)&65535,t[7]=(t[8]>>>8|t[9]<<5)&65535;let i=t[0]+r[0];t[0]=i&65535;for(let c=1;c<8;c++)i=(t[c]+r[c]|0)+(i>>>16)|0,t[c]=i&65535;Et(n)}update(t){In(this),Q(t),t=ee(t);let{buffer:r,blockLen:n}=this,o=t.length;for(let s=0;s<o;){let i=Math.min(n-this.pos,o-s);if(i===n){for(;n<=o-s;s+=n)this.process(t,s);continue}r.set(t.subarray(s,s+i),this.pos),this.pos+=i,s+=i,this.pos===n&&(this.process(r,0,!1),this.pos=0)}return this}destroy(){Et(this.h,this.r,this.buffer,this.pad)}digestInto(t){In(this),Yr(t,this),this.finished=!0;let{buffer:r,h:n}=this,{pos:o}=this;if(o){for(r[o++]=1;o<16;o++)r[o]=0;this.process(r,0,!0)}this.finalize();let s=0;for(let i=0;i<8;i++)t[s++]=n[i]>>>0,t[s++]=n[i]>>>8;return t}digest(){let{buffer:t,outputLen:r}=this;this.digestInto(t);let n=t.slice(0,r);return this.destroy(),n}};function Ms(e){let t=(n,o)=>e(o).update(n).digest(),r=e(new Uint8Array(32));return t.outputLen=r.outputLen,t.blockLen=r.blockLen,t.create=n=>e(n),t}var to=Ms(e=>new On(e));function ro(e,t,r,n,o,s=20){let i=e[0],c=e[1],f=e[2],u=e[3],h=t[0],g=t[1],b=t[2],d=t[3],y=t[4],B=t[5],S=t[6],_=t[7],V=o,q=r[0],N=r[1],C=r[2],P=i,Y=c,z=f,U=u,K=h,M=g,L=b,w=d,l=y,a=B,x=S,m=_,v=V,p=q,A=N,E=C;for(let O=0;O<s;O+=2)P=P+K|0,v=H(v^P,16),l=l+v|0,K=H(K^l,12),P=P+K|0,v=H(v^P,8),l=l+v|0,K=H(K^l,7),Y=Y+M|0,p=H(p^Y,16),a=a+p|0,M=H(M^a,12),Y=Y+M|0,p=H(p^Y,8),a=a+p|0,M=H(M^a,7),z=z+L|0,A=H(A^z,16),x=x+A|0,L=H(L^x,12),z=z+L|0,A=H(A^z,8),x=x+A|0,L=H(L^x,7),U=U+w|0,E=H(E^U,16),m=m+E|0,w=H(w^m,12),U=U+w|0,E=H(E^U,8),m=m+E|0,w=H(w^m,7),P=P+M|0,E=H(E^P,16),x=x+E|0,M=H(M^x,12),P=P+M|0,E=H(E^P,8),x=x+E|0,M=H(M^x,7),Y=Y+L|0,v=H(v^Y,16),m=m+v|0,L=H(L^m,12),Y=Y+L|0,v=H(v^Y,8),m=m+v|0,L=H(L^m,7),z=z+w|0,p=H(p^z,16),l=l+p|0,w=H(w^l,12),z=z+w|0,p=H(p^z,8),l=l+p|0,w=H(w^l,7),U=U+K|0,A=H(A^U,16),a=a+A|0,K=H(K^a,12),U=U+K|0,A=H(A^U,8),a=a+A|0,K=H(K^a,7);let I=0;n[I++]=i+P|0,n[I++]=c+Y|0,n[I++]=f+z|0,n[I++]=u+U|0,n[I++]=h+K|0,n[I++]=g+M|0,n[I++]=b+L|0,n[I++]=d+w|0,n[I++]=y+l|0,n[I++]=B+a|0,n[I++]=S+x|0,n[I++]=_+m|0,n[I++]=V+v|0,n[I++]=q+p|0,n[I++]=N+A|0,n[I++]=C+E|0}function Zs(e,t,r,n){let o=e[0],s=e[1],i=e[2],c=e[3],f=t[0],u=t[1],h=t[2],g=t[3],b=t[4],d=t[5],y=t[6],B=t[7],S=r[0],_=r[1],V=r[2],q=r[3];for(let C=0;C<20;C+=2)o=o+f|0,S=H(S^o,16),b=b+S|0,f=H(f^b,12),o=o+f|0,S=H(S^o,8),b=b+S|0,f=H(f^b,7),s=s+u|0,_=H(_^s,16),d=d+_|0,u=H(u^d,12),s=s+u|0,_=H(_^s,8),d=d+_|0,u=H(u^d,7),i=i+h|0,V=H(V^i,16),y=y+V|0,h=H(h^y,12),i=i+h|0,V=H(V^i,8),y=y+V|0,h=H(h^y,7),c=c+g|0,q=H(q^c,16),B=B+q|0,g=H(g^B,12),c=c+g|0,q=H(q^c,8),B=B+q|0,g=H(g^B,7),o=o+u|0,q=H(q^o,16),y=y+q|0,u=H(u^y,12),o=o+u|0,q=H(q^o,8),y=y+q|0,u=H(u^y,7),s=s+h|0,S=H(S^s,16),B=B+S|0,h=H(h^B,12),s=s+h|0,S=H(S^s,8),B=B+S|0,h=H(h^B,7),i=i+g|0,_=H(_^i,16),b=b+_|0,g=H(g^b,12),i=i+g|0,_=H(_^i,8),b=b+_|0,g=H(g^b,7),c=c+f|0,V=H(V^c,16),d=d+V|0,f=H(f^d,12),c=c+f|0,V=H(V^c,8),d=d+V|0,f=H(f^d,7);let N=0;n[N++]=o,n[N++]=s,n[N++]=i,n[N++]=c,n[N++]=S,n[N++]=_,n[N++]=V,n[N++]=q}var Hn=Rn(ro,{counterRight:!1,counterLength:4,allowShortKeys:!1}),js=Rn(ro,{counterRight:!1,counterLength:8,extendNonceFn:Zs,allowShortKeys:!1});var Ks=new Uint8Array(16),eo=(e,t)=>{e.update(t);let r=t.length%16;r&&e.update(Ks.subarray(r))},$s=new Uint8Array(32);function no(e,t,r,n,o){o!==void 0&&Q(o,void 0,"AAD");let s=e(t,r,$s),i=Xr(n.length,o?o.length:0,!0),c=to.create(s);o&&eo(c,o),eo(c,n),c.update(i);let f=c.digest();return Et(s,i),f}var oo=e=>(t,r,n)=>({encrypt(s,i){let c=s.length;i=_n(c+16,i,!1),i.set(s);let f=i.subarray(0,-16);e(t,r,f,f,1);let u=no(e,t,r,f,n);return i.set(u,c),Et(u),i},decrypt(s,i){i=_n(s.length-16,i,!1);let c=s.subarray(0,-16),f=s.subarray(-16),u=no(e,t,r,c,n);if(!Pe(f,u))throw new Error("invalid tag");return i.set(s.subarray(0,-16)),e(t,r,i,i,1),Et(u),i}}),jc=Ln({blockSize:64,nonceLength:12,tagLength:16},oo(Hn)),Kc=Ln({blockSize:64,nonceLength:24,tagLength:16},oo(js));function we(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"}function ut(e,t=""){if(!Number.isSafeInteger(e)||e<0){let r=t&&`"${t}" `;throw new Error(`${r}expected integer >= 0, got ${e}`)}}function W(e,t,r=""){let n=we(e),o=e?.length,s=t!==void 0;if(!n||s&&o!==t){let i=r&&`"${r}" `,c=s?` of length ${t}`:"",f=n?`length=${o}`:`type=${typeof e}`;throw new Error(i+"expected Uint8Array"+c+", got "+f)}return e}function Kt(e){if(typeof e!="function"||typeof e.create!="function")throw new Error("Hash must wrapped by utils.createHasher");ut(e.outputLen),ut(e.blockLen)}function ne(e,t=!0){if(e.destroyed)throw new Error("Hash instance has been destroyed");if(t&&e.finished)throw new Error("Hash#digest() has already been called")}function io(e,t){W(e,void 0,"digestInto() output");let r=t.outputLen;if(e.length<r)throw new Error('"digestInto() output" expected to be of length >='+r)}function vt(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function ze(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function ht(e,t){return e<<32-t|e>>>t}var co=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",Ps=Array.from({length:256},(e,t)=>t.toString(16).padStart(2,"0"));function $t(e){if(W(e),co)return e.toHex();let t="";for(let r=0;r<e.length;r++)t+=Ps[e[r]];return t}var Bt={_0:48,_9:57,A:65,F:70,a:97,f:102};function so(e){if(e>=Bt._0&&e<=Bt._9)return e-Bt._0;if(e>=Bt.A&&e<=Bt.F)return e-(Bt.A-10);if(e>=Bt.a&&e<=Bt.f)return e-(Bt.a-10)}function At(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);if(co)return Uint8Array.fromHex(e);let t=e.length,r=t/2;if(t%2)throw new Error("hex string expected, got unpadded hex of length "+t);let n=new Uint8Array(r);for(let o=0,s=0;o<r;o++,s+=2){let i=so(e.charCodeAt(s)),c=so(e.charCodeAt(s+1));if(i===void 0||c===void 0){let f=e[s]+e[s+1];throw new Error('hex string expected, got non-hex character "'+f+'" at index '+s)}n[o]=i*16+c}return n}function ft(...e){let t=0;for(let n=0;n<e.length;n++){let o=e[n];W(o),t+=o.length}let r=new Uint8Array(t);for(let n=0,o=0;n<e.length;n++){let s=e[n];r.set(s,o),o+=s.length}return r}function fo(e,t={}){let r=(o,s)=>e(s).update(o).digest(),n=e(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.create=o=>e(o),Object.assign(r,t),Object.freeze(r)}function me(e=32){let t=typeof globalThis=="object"?globalThis.crypto:null;if(typeof t?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");return t.getRandomValues(new Uint8Array(e))}var ao=e=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,e])});function uo(e,t,r){return e&t^~e&r}function lo(e,t,r){return e&t^e&r^t&r}var Ye=class{constructor(t,r,n,o){T(this,"blockLen");T(this,"outputLen");T(this,"padOffset");T(this,"isLE");T(this,"buffer");T(this,"view");T(this,"finished",!1);T(this,"length",0);T(this,"pos",0);T(this,"destroyed",!1);this.blockLen=t,this.outputLen=r,this.padOffset=n,this.isLE=o,this.buffer=new Uint8Array(t),this.view=ze(this.buffer)}update(t){ne(this),W(t);let{view:r,buffer:n,blockLen:o}=this,s=t.length;for(let i=0;i<s;){let c=Math.min(o-this.pos,s-i);if(c===o){let f=ze(t);for(;o<=s-i;i+=o)this.process(f,i);continue}n.set(t.subarray(i,i+c),this.pos),this.pos+=c,i+=c,this.pos===o&&(this.process(r,0),this.pos=0)}return this.length+=t.length,this.roundClean(),this}digestInto(t){ne(this),io(t,this),this.finished=!0;let{buffer:r,view:n,blockLen:o,isLE:s}=this,{pos:i}=this;r[i++]=128,vt(this.buffer.subarray(i)),this.padOffset>o-i&&(this.process(n,0),i=0);for(let g=i;g<o;g++)r[g]=0;n.setBigUint64(o-8,BigInt(this.length*8),s),this.process(n,0);let c=ze(t),f=this.outputLen;if(f%4)throw new Error("_sha2: outputLen must be aligned to 32bit");let u=f/4,h=this.get();if(u>h.length)throw new Error("_sha2: outputLen bigger than state");for(let g=0;g<u;g++)c.setUint32(4*g,h[g],s)}digest(){let{buffer:t,outputLen:r}=this;this.digestInto(t);let n=t.slice(0,r);return this.destroy(),n}_cloneInto(t){t||(t=new this.constructor),t.set(...this.get());let{blockLen:r,buffer:n,length:o,finished:s,destroyed:i,pos:c}=this;return t.destroyed=i,t.finished=s,t.length=o,t.pos=c,o%r&&t.buffer.set(n),t}clone(){return this._cloneInto()}},St=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var Gs=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),kt=new Uint32Array(64),kn=class extends Ye{constructor(t){super(64,t,8,!1)}get(){let{A:t,B:r,C:n,D:o,E:s,F:i,G:c,H:f}=this;return[t,r,n,o,s,i,c,f]}set(t,r,n,o,s,i,c,f){this.A=t|0,this.B=r|0,this.C=n|0,this.D=o|0,this.E=s|0,this.F=i|0,this.G=c|0,this.H=f|0}process(t,r){for(let g=0;g<16;g++,r+=4)kt[g]=t.getUint32(r,!1);for(let g=16;g<64;g++){let b=kt[g-15],d=kt[g-2],y=ht(b,7)^ht(b,18)^b>>>3,B=ht(d,17)^ht(d,19)^d>>>10;kt[g]=B+kt[g-7]+y+kt[g-16]|0}let{A:n,B:o,C:s,D:i,E:c,F:f,G:u,H:h}=this;for(let g=0;g<64;g++){let b=ht(c,6)^ht(c,11)^ht(c,25),d=h+b+uo(c,f,u)+Gs[g]+kt[g]|0,B=(ht(n,2)^ht(n,13)^ht(n,22))+lo(n,o,s)|0;h=u,u=f,f=c,c=i+d|0,i=s,s=o,o=n,n=d+B|0}n=n+this.A|0,o=o+this.B|0,s=s+this.C|0,i=i+this.D|0,c=c+this.E|0,f=f+this.F|0,u=u+this.G|0,h=h+this.H|0,this.set(n,o,s,i,c,f,u,h)}roundClean(){vt(kt)}destroy(){this.set(0,0,0,0,0,0,0,0),vt(this.buffer)}},Tn=class extends kn{constructor(){super(32);T(this,"A",St[0]|0);T(this,"B",St[1]|0);T(this,"C",St[2]|0);T(this,"D",St[3]|0);T(this,"E",St[4]|0);T(this,"F",St[5]|0);T(this,"G",St[6]|0);T(this,"H",St[7]|0)}};var re=fo(()=>new Tn,ao(1));var qn=BigInt(0),Nn=BigInt(1);function Ee(e,t=""){if(typeof e!="boolean"){let r=t&&`"${t}" `;throw new Error(r+"expected boolean, got type="+typeof e)}return e}function ho(e){if(typeof e=="bigint"){if(!We(e))throw new Error("positive bigint expected, got "+e)}else ut(e);return e}function Be(e){let t=ho(e).toString(16);return t.length&1?"0"+t:t}function bo(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);return e===""?qn:BigInt("0x"+e)}function oe(e){return bo($t(e))}function Cn(e){return bo($t(zs(W(e)).reverse()))}function Xe(e,t){ut(t),e=ho(e);let r=At(e.toString(16).padStart(t*2,"0"));if(r.length!==t)throw new Error("number too large");return r}function Vn(e,t){return Xe(e,t).reverse()}function zs(e){return Uint8Array.from(e)}var We=e=>typeof e=="bigint"&&qn<=e;function Ys(e,t,r){return We(e)&&We(t)&&We(r)&&t<=e&&e<r}function go(e,t,r,n){if(!Ys(t,r,n))throw new Error("expected valid "+e+": "+r+" <= n < "+n+", got "+t)}function Dn(e){let t;for(t=0;e>qn;e>>=Nn,t+=1);return t}var ve=e=>(Nn<<BigInt(e))-Nn;function xo(e,t,r){if(ut(e,"hashLen"),ut(t,"qByteLen"),typeof r!="function")throw new Error("hmacFn must be a function");let n=S=>new Uint8Array(S),o=Uint8Array.of(),s=Uint8Array.of(0),i=Uint8Array.of(1),c=1e3,f=n(e),u=n(e),h=0,g=()=>{f.fill(1),u.fill(0),h=0},b=(...S)=>r(u,ft(f,...S)),d=(S=o)=>{u=b(s,S),f=b(),S.length!==0&&(u=b(i,S),f=b())},y=()=>{if(h++>=c)throw new Error("drbg: tried max amount of iterations");let S=0,_=[];for(;S<t;){f=b();let V=f.slice();_.push(V),S+=f.length}return ft(..._)};return(S,_)=>{g(),d(S);let V;for(;!(V=_(y()));)d();return g(),V}}function Ae(e,t={},r={}){if(!e||typeof e!="object")throw new Error("expected valid options object");function n(s,i,c){let f=e[s];if(c&&f===void 0)return;let u=typeof f;if(u!==i||f===null)throw new Error(`param "${s}" is invalid: expected ${i}, got ${u}`)}let o=(s,i)=>Object.entries(s).forEach(([c,f])=>n(c,f,i));o(t,!1),o(r,!0)}function Mn(e){let t=new WeakMap;return(r,...n)=>{let o=t.get(r);if(o!==void 0)return o;let s=e(r,...n);return t.set(r,s),s}}var rt=BigInt(0),et=BigInt(1),Pt=BigInt(2),wo=BigInt(3),mo=BigInt(4),Eo=BigInt(5),Ws=BigInt(7),Bo=BigInt(8),Xs=BigInt(9),vo=BigInt(16);function bt(e,t){let r=e%t;return r>=rt?r:t+r}function at(e,t,r){let n=e;for(;t-- >rt;)n*=n,n%=r;return n}function po(e,t){if(e===rt)throw new Error("invert: expected non-zero number");if(t<=rt)throw new Error("invert: expected positive modulus, got "+t);let r=bt(e,t),n=t,o=rt,s=et,i=et,c=rt;for(;r!==rt;){let u=n/r,h=n%r,g=o-i*u,b=s-c*u;n=r,r=h,o=i,s=c,i=g,c=b}if(n!==et)throw new Error("invert: does not exist");return bt(o,t)}function jn(e,t,r){if(!e.eql(e.sqr(t),r))throw new Error("Cannot find square root")}function Ao(e,t){let r=(e.ORDER+et)/mo,n=e.pow(t,r);return jn(e,n,t),n}function Js(e,t){let r=(e.ORDER-Eo)/Bo,n=e.mul(t,Pt),o=e.pow(n,r),s=e.mul(t,o),i=e.mul(e.mul(s,Pt),o),c=e.mul(s,e.sub(i,e.ONE));return jn(e,c,t),c}function Qs(e){let t=se(e),r=So(e),n=r(t,t.neg(t.ONE)),o=r(t,n),s=r(t,t.neg(n)),i=(e+Ws)/vo;return(c,f)=>{let u=c.pow(f,i),h=c.mul(u,n),g=c.mul(u,o),b=c.mul(u,s),d=c.eql(c.sqr(h),f),y=c.eql(c.sqr(g),f);u=c.cmov(u,h,d),h=c.cmov(b,g,y);let B=c.eql(c.sqr(h),f),S=c.cmov(u,h,B);return jn(c,S,f),S}}function So(e){if(e<wo)throw new Error("sqrt is not defined for small field");let t=e-et,r=0;for(;t%Pt===rt;)t/=Pt,r++;let n=Pt,o=se(e);for(;yo(o,n)===1;)if(n++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(r===1)return Ao;let s=o.pow(n,t),i=(t+et)/Pt;return function(f,u){if(f.is0(u))return u;if(yo(f,u)!==1)throw new Error("Cannot find square root");let h=r,g=f.mul(f.ONE,s),b=f.pow(u,t),d=f.pow(u,i);for(;!f.eql(b,f.ONE);){if(f.is0(b))return f.ZERO;let y=1,B=f.sqr(b);for(;!f.eql(B,f.ONE);)if(y++,B=f.sqr(B),y===h)throw new Error("Cannot find square root");let S=et<<BigInt(h-y-1),_=f.pow(g,S);h=y,g=f.sqr(_),b=f.mul(b,g),d=f.mul(d,_)}return d}}function Fs(e){return e%mo===wo?Ao:e%Bo===Eo?Js:e%vo===Xs?Qs(e):So(e)}var ti=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function Kn(e){let t={ORDER:"bigint",BYTES:"number",BITS:"number"},r=ti.reduce((n,o)=>(n[o]="function",n),t);return Ae(e,r),e}function ei(e,t,r){if(r<rt)throw new Error("invalid exponent, negatives unsupported");if(r===rt)return e.ONE;if(r===et)return t;let n=e.ONE,o=t;for(;r>rt;)r&et&&(n=e.mul(n,o)),o=e.sqr(o),r>>=et;return n}function Je(e,t,r=!1){let n=new Array(t.length).fill(r?e.ZERO:void 0),o=t.reduce((i,c,f)=>e.is0(c)?i:(n[f]=i,e.mul(i,c)),e.ONE),s=e.inv(o);return t.reduceRight((i,c,f)=>e.is0(c)?i:(n[f]=e.mul(i,n[f]),e.mul(i,c)),s),n}function yo(e,t){let r=(e.ORDER-et)/Pt,n=e.pow(t,r),o=e.eql(n,e.ONE),s=e.eql(n,e.ZERO),i=e.eql(n,e.neg(e.ONE));if(!o&&!s&&!i)throw new Error("invalid Legendre symbol result");return o?1:s?0:-1}function ni(e,t){t!==void 0&&ut(t);let r=t!==void 0?t:e.toString(2).length,n=Math.ceil(r/8);return{nBitLength:r,nByteLength:n}}var Zn=class{constructor(t,r={}){T(this,"ORDER");T(this,"BITS");T(this,"BYTES");T(this,"isLE");T(this,"ZERO",rt);T(this,"ONE",et);T(this,"_lengths");T(this,"_sqrt");T(this,"_mod");if(t<=rt)throw new Error("invalid field: expected ORDER > 0, got "+t);let n;this.isLE=!1,r!=null&&typeof r=="object"&&(typeof r.BITS=="number"&&(n=r.BITS),typeof r.sqrt=="function"&&(this.sqrt=r.sqrt),typeof r.isLE=="boolean"&&(this.isLE=r.isLE),r.allowedLengths&&(this._lengths=r.allowedLengths?.slice()),typeof r.modFromBytes=="boolean"&&(this._mod=r.modFromBytes));let{nBitLength:o,nByteLength:s}=ni(t,n);if(s>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");this.ORDER=t,this.BITS=o,this.BYTES=s,this._sqrt=void 0,Object.preventExtensions(this)}create(t){return bt(t,this.ORDER)}isValid(t){if(typeof t!="bigint")throw new Error("invalid field element: expected bigint, got "+typeof t);return rt<=t&&t<this.ORDER}is0(t){return t===rt}isValidNot0(t){return!this.is0(t)&&this.isValid(t)}isOdd(t){return(t&et)===et}neg(t){return bt(-t,this.ORDER)}eql(t,r){return t===r}sqr(t){return bt(t*t,this.ORDER)}add(t,r){return bt(t+r,this.ORDER)}sub(t,r){return bt(t-r,this.ORDER)}mul(t,r){return bt(t*r,this.ORDER)}pow(t,r){return ei(this,t,r)}div(t,r){return bt(t*po(r,this.ORDER),this.ORDER)}sqrN(t){return t*t}addN(t,r){return t+r}subN(t,r){return t-r}mulN(t,r){return t*r}inv(t){return po(t,this.ORDER)}sqrt(t){return this._sqrt||(this._sqrt=Fs(this.ORDER)),this._sqrt(this,t)}toBytes(t){return this.isLE?Vn(t,this.BYTES):Xe(t,this.BYTES)}fromBytes(t,r=!1){W(t);let{_lengths:n,BYTES:o,isLE:s,ORDER:i,_mod:c}=this;if(n){if(!n.includes(t.length)||t.length>o)throw new Error("Field.fromBytes: expected "+n+" bytes, got "+t.length);let u=new Uint8Array(o);u.set(t,s?0:u.length-t.length),t=u}if(t.length!==o)throw new Error("Field.fromBytes: expected "+o+" bytes, got "+t.length);let f=s?Cn(t):oe(t);if(c&&(f=bt(f,i)),!r&&!this.isValid(f))throw new Error("invalid field element: outside of range 0..ORDER");return f}invertBatch(t){return Je(this,t)}cmov(t,r,n){return n?r:t}};function se(e,t={}){return new Zn(e,t)}function Io(e){if(typeof e!="bigint")throw new Error("field order must be bigint");let t=e.toString(2).length;return Math.ceil(t/8)}function $n(e){let t=Io(e);return t+Math.ceil(t/2)}function Pn(e,t,r=!1){W(e);let n=e.length,o=Io(t),s=$n(t);if(n<16||n<s||n>1024)throw new Error("expected "+s+"-1024 bytes of input, got "+n);let i=r?Cn(e):oe(e),c=bt(i,t-et)+et;return r?Vn(c,o):Xe(c,o)}var ie=BigInt(0),Gt=BigInt(1);function Se(e,t){let r=t.negate();return e?r:t}function Wn(e,t){let r=Je(e.Fp,t.map(n=>n.Z));return t.map((n,o)=>e.fromAffine(n.toAffine(r[o])))}function Ro(e,t){if(!Number.isSafeInteger(e)||e<=0||e>t)throw new Error("invalid window size, expected [1.."+t+"], got W="+e)}function Gn(e,t){Ro(e,t);let r=Math.ceil(t/e)+1,n=2**(e-1),o=2**e,s=ve(e),i=BigInt(e);return{windows:r,windowSize:n,mask:s,maxNumber:o,shiftBy:i}}function Lo(e,t,r){let{windowSize:n,mask:o,maxNumber:s,shiftBy:i}=r,c=Number(e&o),f=e>>i;c>n&&(c-=s,f+=Gt);let u=t*n,h=u+Math.abs(c)-1,g=c===0,b=c<0,d=t%2!==0;return{nextN:f,offset:h,isZero:g,isNeg:b,isNegF:d,offsetF:u}}var zn=new WeakMap,Oo=new WeakMap;function Yn(e){return Oo.get(e)||1}function _o(e){if(e!==ie)throw new Error("invalid wNAF")}var Qe=class{constructor(t,r){T(this,"BASE");T(this,"ZERO");T(this,"Fn");T(this,"bits");this.BASE=t.BASE,this.ZERO=t.ZERO,this.Fn=t.Fn,this.bits=r}_unsafeLadder(t,r,n=this.ZERO){let o=t;for(;r>ie;)r&Gt&&(n=n.add(o)),o=o.double(),r>>=Gt;return n}precomputeWindow(t,r){let{windows:n,windowSize:o}=Gn(r,this.bits),s=[],i=t,c=i;for(let f=0;f<n;f++){c=i,s.push(c);for(let u=1;u<o;u++)c=c.add(i),s.push(c);i=c.double()}return s}wNAF(t,r,n){if(!this.Fn.isValid(n))throw new Error("invalid scalar");let o=this.ZERO,s=this.BASE,i=Gn(t,this.bits);for(let c=0;c<i.windows;c++){let{nextN:f,offset:u,isZero:h,isNeg:g,isNegF:b,offsetF:d}=Lo(n,c,i);n=f,h?s=s.add(Se(b,r[d])):o=o.add(Se(g,r[u]))}return _o(n),{p:o,f:s}}wNAFUnsafe(t,r,n,o=this.ZERO){let s=Gn(t,this.bits);for(let i=0;i<s.windows&&n!==ie;i++){let{nextN:c,offset:f,isZero:u,isNeg:h}=Lo(n,i,s);if(n=c,!u){let g=r[f];o=o.add(h?g.negate():g)}}return _o(n),o}getPrecomputes(t,r,n){let o=zn.get(r);return o||(o=this.precomputeWindow(r,t),t!==1&&(typeof n=="function"&&(o=n(o)),zn.set(r,o))),o}cached(t,r,n){let o=Yn(t);return this.wNAF(o,this.getPrecomputes(o,t,n),r)}unsafe(t,r,n,o){let s=Yn(t);return s===1?this._unsafeLadder(t,r,o):this.wNAFUnsafe(s,this.getPrecomputes(s,t,n),r,o)}createCache(t,r){Ro(r,this.bits),Oo.set(t,r),zn.delete(t)}hasCache(t){return Yn(t)!==1}};function Ho(e,t,r,n){let o=t,s=e.ZERO,i=e.ZERO;for(;r>ie||n>ie;)r&Gt&&(s=s.add(o)),n&Gt&&(i=i.add(o)),o=o.double(),r>>=Gt,n>>=Gt;return{p1:s,p2:i}}function Uo(e,t,r){if(t){if(t.ORDER!==e)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return Kn(t),t}else return se(e,{isLE:r})}function ko(e,t,r={},n){if(n===void 0&&(n=e==="edwards"),!t||typeof t!="object")throw new Error(`expected valid ${e} CURVE object`);for(let f of["p","n","h"]){let u=t[f];if(!(typeof u=="bigint"&&u>ie))throw new Error(`CURVE.${f} must be positive bigint`)}let o=Uo(t.p,r.Fp,n),s=Uo(t.n,r.Fn,n),c=["Gx","Gy","a",e==="weierstrass"?"b":"d"];for(let f of c)if(!o.isValid(t[f]))throw new Error(`CURVE.${f} must be valid field element of CURVE.Fp`);return t=Object.freeze(Object.assign({},t)),{CURVE:t,Fp:o,Fn:s}}function To(e,t){return function(n){let o=e(n);return{secretKey:o,publicKey:t(o)}}}var Fe=class{constructor(t,r){T(this,"oHash");T(this,"iHash");T(this,"blockLen");T(this,"outputLen");T(this,"finished",!1);T(this,"destroyed",!1);if(Kt(t),W(r,void 0,"key"),this.iHash=t.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let n=this.blockLen,o=new Uint8Array(n);o.set(r.length>n?t.create().update(r).digest():r);for(let s=0;s<o.length;s++)o[s]^=54;this.iHash.update(o),this.oHash=t.create();for(let s=0;s<o.length;s++)o[s]^=106;this.oHash.update(o),vt(o)}update(t){return ne(this),this.iHash.update(t),this}digestInto(t){ne(this),W(t,this.outputLen,"output"),this.finished=!0,this.iHash.digestInto(t),this.oHash.update(t),this.oHash.digestInto(t),this.destroy()}digest(){let t=new Uint8Array(this.oHash.outputLen);return this.digestInto(t),t}_cloneInto(t){t||(t=Object.create(Object.getPrototypeOf(this),{}));let{oHash:r,iHash:n,finished:o,destroyed:s,blockLen:i,outputLen:c}=this;return t=t,t.finished=o,t.destroyed=s,t.blockLen=i,t.outputLen=c,t.oHash=r._cloneInto(t.oHash),t.iHash=n._cloneInto(t.iHash),t}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},Tt=(e,t,r)=>new Fe(e,t).update(r).digest();Tt.create=(e,t)=>new Fe(e,t);var No=(e,t)=>(e+(e>=0?t:-t)/qo)/t;function ri(e,t,r){let[[n,o],[s,i]]=t,c=No(i*e,r),f=No(-o*e,r),u=e-c*n-f*s,h=-c*o-f*i,g=u<It,b=h<It;g&&(u=-u),b&&(h=-h);let d=ve(Math.ceil(Dn(r)/2))+ce;if(u<It||u>=d||h<It||h>=d)throw new Error("splitScalar (endomorphism): failed, k="+e);return{k1neg:g,k1:u,k2neg:b,k2:h}}function Jn(e){if(!["compact","recovered","der"].includes(e))throw new Error('Signature format must be "compact", "recovered", or "der"');return e}function Xn(e,t){let r={};for(let n of Object.keys(t))r[n]=e[n]===void 0?t[n]:e[n];return Ee(r.lowS,"lowS"),Ee(r.prehash,"prehash"),r.format!==void 0&&Jn(r.format),r}var Qn=class extends Error{constructor(t=""){super(t)}},Nt={Err:Qn,_tlv:{encode:(e,t)=>{let{Err:r}=Nt;if(e<0||e>256)throw new r("tlv.encode: wrong tag");if(t.length&1)throw new r("tlv.encode: unpadded data");let n=t.length/2,o=Be(n);if(o.length/2&128)throw new r("tlv.encode: long form length too big");let s=n>127?Be(o.length/2|128):"";return Be(e)+s+o+t},decode(e,t){let{Err:r}=Nt,n=0;if(e<0||e>256)throw new r("tlv.encode: wrong tag");if(t.length<2||t[n++]!==e)throw new r("tlv.decode: wrong tlv");let o=t[n++],s=!!(o&128),i=0;if(!s)i=o;else{let f=o&127;if(!f)throw new r("tlv.decode(long): indefinite length not supported");if(f>4)throw new r("tlv.decode(long): byte length is too big");let u=t.subarray(n,n+f);if(u.length!==f)throw new r("tlv.decode: length bytes not complete");if(u[0]===0)throw new r("tlv.decode(long): zero leftmost byte");for(let h of u)i=i<<8|h;if(n+=f,i<128)throw new r("tlv.decode(long): not minimal encoding")}let c=t.subarray(n,n+i);if(c.length!==i)throw new r("tlv.decode: wrong value length");return{v:c,l:t.subarray(n+i)}}},_int:{encode(e){let{Err:t}=Nt;if(e<It)throw new t("integer: negative integers are not allowed");let r=Be(e);if(Number.parseInt(r[0],16)&8&&(r="00"+r),r.length&1)throw new t("unexpected DER parsing assertion: unpadded hex");return r},decode(e){let{Err:t}=Nt;if(e[0]&128)throw new t("invalid signature integer: negative");if(e[0]===0&&!(e[1]&128))throw new t("invalid signature integer: unnecessary leading zero");return oe(e)}},toSig(e){let{Err:t,_int:r,_tlv:n}=Nt,o=W(e,void 0,"signature"),{v:s,l:i}=n.decode(48,o);if(i.length)throw new t("invalid signature: left bytes after parsing");let{v:c,l:f}=n.decode(2,s),{v:u,l:h}=n.decode(2,f);if(h.length)throw new t("invalid signature: left bytes after parsing");return{r:r.decode(c),s:r.decode(u)}},hexFromSig(e){let{_tlv:t,_int:r}=Nt,n=t.encode(2,r.encode(e.r)),o=t.encode(2,r.encode(e.s)),s=n+o;return t.encode(48,s)}},It=BigInt(0),ce=BigInt(1),qo=BigInt(2),tn=BigInt(3),oi=BigInt(4);function Co(e,t={}){let r=ko("weierstrass",e,t),{Fp:n,Fn:o}=r,s=r.CURVE,{h:i,n:c}=s;Ae(t,{},{allowInfinityPoint:"boolean",clearCofactor:"function",isTorsionFree:"function",fromBytes:"function",toBytes:"function",endo:"object"});let{endo:f}=t;if(f&&(!n.is0(s.a)||typeof f.beta!="bigint"||!Array.isArray(f.basises)))throw new Error('invalid endo: expected "beta": bigint and "basises": array');let u=Do(n,o);function h(){if(!n.isOdd)throw new Error("compression is not supported: Field does not have .isOdd()")}function g(w,l,a){let{x,y:m}=l.toAffine(),v=n.toBytes(x);if(Ee(a,"isCompressed"),a){h();let p=!n.isOdd(m);return ft(Vo(p),v)}else return ft(Uint8Array.of(4),v,n.toBytes(m))}function b(w){W(w,void 0,"Point");let{publicKey:l,publicKeyUncompressed:a}=u,x=w.length,m=w[0],v=w.subarray(1);if(x===l&&(m===2||m===3)){let p=n.fromBytes(v);if(!n.isValid(p))throw new Error("bad point: is not on curve, wrong x");let A=B(p),E;try{E=n.sqrt(A)}catch(D){let k=D instanceof Error?": "+D.message:"";throw new Error("bad point: is not on curve, sqrt error"+k)}h();let I=n.isOdd(E);return(m&1)===1!==I&&(E=n.neg(E)),{x:p,y:E}}else if(x===a&&m===4){let p=n.BYTES,A=n.fromBytes(v.subarray(0,p)),E=n.fromBytes(v.subarray(p,p*2));if(!S(A,E))throw new Error("bad point: is not on curve");return{x:A,y:E}}else throw new Error(`bad point: got length ${x}, expected compressed=${l} or uncompressed=${a}`)}let d=t.toBytes||g,y=t.fromBytes||b;function B(w){let l=n.sqr(w),a=n.mul(l,w);return n.add(n.add(a,n.mul(w,s.a)),s.b)}function S(w,l){let a=n.sqr(l),x=B(w);return n.eql(a,x)}if(!S(s.Gx,s.Gy))throw new Error("bad curve params: generator point");let _=n.mul(n.pow(s.a,tn),oi),V=n.mul(n.sqr(s.b),BigInt(27));if(n.is0(n.add(_,V)))throw new Error("bad curve params: a or b");function q(w,l,a=!1){if(!n.isValid(l)||a&&n.is0(l))throw new Error(`bad point coordinate ${w}`);return l}function N(w){if(!(w instanceof U))throw new Error("Weierstrass Point expected")}function C(w){if(!f||!f.basises)throw new Error("no endo");return ri(w,f.basises,o.ORDER)}let P=Mn((w,l)=>{let{X:a,Y:x,Z:m}=w;if(n.eql(m,n.ONE))return{x:a,y:x};let v=w.is0();l==null&&(l=v?n.ONE:n.inv(m));let p=n.mul(a,l),A=n.mul(x,l),E=n.mul(m,l);if(v)return{x:n.ZERO,y:n.ZERO};if(!n.eql(E,n.ONE))throw new Error("invZ was invalid");return{x:p,y:A}}),Y=Mn(w=>{if(w.is0()){if(t.allowInfinityPoint&&!n.is0(w.Y))return;throw new Error("bad point: ZERO")}let{x:l,y:a}=w.toAffine();if(!n.isValid(l)||!n.isValid(a))throw new Error("bad point: x or y not field elements");if(!S(l,a))throw new Error("bad point: equation left != right");if(!w.isTorsionFree())throw new Error("bad point: not in prime-order subgroup");return!0});function z(w,l,a,x,m){return a=new U(n.mul(a.X,w),a.Y,a.Z),l=Se(x,l),a=Se(m,a),l.add(a)}let L=class L{constructor(l,a,x){T(this,"X");T(this,"Y");T(this,"Z");this.X=q("x",l),this.Y=q("y",a,!0),this.Z=q("z",x),Object.freeze(this)}static CURVE(){return s}static fromAffine(l){let{x:a,y:x}=l||{};if(!l||!n.isValid(a)||!n.isValid(x))throw new Error("invalid affine point");if(l instanceof L)throw new Error("projective point not allowed");return n.is0(a)&&n.is0(x)?L.ZERO:new L(a,x,n.ONE)}static fromBytes(l){let a=L.fromAffine(y(W(l,void 0,"point")));return a.assertValidity(),a}static fromHex(l){return L.fromBytes(At(l))}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(l=8,a=!0){return M.createCache(this,l),a||this.multiply(tn),this}assertValidity(){Y(this)}hasEvenY(){let{y:l}=this.toAffine();if(!n.isOdd)throw new Error("Field doesn't support isOdd");return!n.isOdd(l)}equals(l){N(l);let{X:a,Y:x,Z:m}=this,{X:v,Y:p,Z:A}=l,E=n.eql(n.mul(a,A),n.mul(v,m)),I=n.eql(n.mul(x,A),n.mul(p,m));return E&&I}negate(){return new L(this.X,n.neg(this.Y),this.Z)}double(){let{a:l,b:a}=s,x=n.mul(a,tn),{X:m,Y:v,Z:p}=this,A=n.ZERO,E=n.ZERO,I=n.ZERO,O=n.mul(m,m),D=n.mul(v,v),k=n.mul(p,p),R=n.mul(m,v);return R=n.add(R,R),I=n.mul(m,p),I=n.add(I,I),A=n.mul(l,I),E=n.mul(x,k),E=n.add(A,E),A=n.sub(D,E),E=n.add(D,E),E=n.mul(A,E),A=n.mul(R,A),I=n.mul(x,I),k=n.mul(l,k),R=n.sub(O,k),R=n.mul(l,R),R=n.add(R,I),I=n.add(O,O),O=n.add(I,O),O=n.add(O,k),O=n.mul(O,R),E=n.add(E,O),k=n.mul(v,p),k=n.add(k,k),O=n.mul(k,R),A=n.sub(A,O),I=n.mul(k,D),I=n.add(I,I),I=n.add(I,I),new L(A,E,I)}add(l){N(l);let{X:a,Y:x,Z:m}=this,{X:v,Y:p,Z:A}=l,E=n.ZERO,I=n.ZERO,O=n.ZERO,D=s.a,k=n.mul(s.b,tn),R=n.mul(a,v),Z=n.mul(x,p),G=n.mul(m,A),j=n.add(a,x),$=n.add(v,p);j=n.mul(j,$),$=n.add(R,Z),j=n.sub(j,$),$=n.add(a,m);let J=n.add(v,A);return $=n.mul($,J),J=n.add(R,G),$=n.sub($,J),J=n.add(x,m),E=n.add(p,A),J=n.mul(J,E),E=n.add(Z,G),J=n.sub(J,E),O=n.mul(D,$),E=n.mul(k,G),O=n.add(E,O),E=n.sub(Z,O),O=n.add(Z,O),I=n.mul(E,O),Z=n.add(R,R),Z=n.add(Z,R),G=n.mul(D,G),$=n.mul(k,$),Z=n.add(Z,G),G=n.sub(R,G),G=n.mul(D,G),$=n.add($,G),R=n.mul(Z,$),I=n.add(I,R),R=n.mul(J,$),E=n.mul(j,E),E=n.sub(E,R),R=n.mul(j,Z),O=n.mul(J,O),O=n.add(O,R),new L(E,I,O)}subtract(l){return this.add(l.negate())}is0(){return this.equals(L.ZERO)}multiply(l){let{endo:a}=t;if(!o.isValidNot0(l))throw new Error("invalid scalar: out of range");let x,m,v=p=>M.cached(this,p,A=>Wn(L,A));if(a){let{k1neg:p,k1:A,k2neg:E,k2:I}=C(l),{p:O,f:D}=v(A),{p:k,f:R}=v(I);m=D.add(R),x=z(a.beta,O,k,p,E)}else{let{p,f:A}=v(l);x=p,m=A}return Wn(L,[x,m])[0]}multiplyUnsafe(l){let{endo:a}=t,x=this;if(!o.isValid(l))throw new Error("invalid scalar: out of range");if(l===It||x.is0())return L.ZERO;if(l===ce)return x;if(M.hasCache(this))return this.multiply(l);if(a){let{k1neg:m,k1:v,k2neg:p,k2:A}=C(l),{p1:E,p2:I}=Ho(L,x,v,A);return z(a.beta,E,I,m,p)}else return M.unsafe(x,l)}toAffine(l){return P(this,l)}isTorsionFree(){let{isTorsionFree:l}=t;return i===ce?!0:l?l(L,this):M.unsafe(this,c).is0()}clearCofactor(){let{clearCofactor:l}=t;return i===ce?this:l?l(L,this):this.multiplyUnsafe(i)}isSmallOrder(){return this.multiplyUnsafe(i).is0()}toBytes(l=!0){return Ee(l,"isCompressed"),this.assertValidity(),d(L,this,l)}toHex(l=!0){return $t(this.toBytes(l))}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}};T(L,"BASE",new L(s.Gx,s.Gy,n.ONE)),T(L,"ZERO",new L(n.ZERO,n.ONE,n.ZERO)),T(L,"Fp",n),T(L,"Fn",o);let U=L,K=o.BITS,M=new Qe(U,t.endo?Math.ceil(K/2):K);return U.BASE.precompute(8),U}function Vo(e){return Uint8Array.of(e?2:3)}function Do(e,t){return{secretKey:t.BYTES,publicKey:1+e.BYTES,publicKeyUncompressed:1+2*e.BYTES,publicKeyHasPrefix:!0,signature:2*t.BYTES}}function si(e,t={}){let{Fn:r}=e,n=t.randomBytes||me,o=Object.assign(Do(e.Fp,r),{seed:$n(r.ORDER)});function s(d){try{let y=r.fromBytes(d);return r.isValidNot0(y)}catch{return!1}}function i(d,y){let{publicKey:B,publicKeyUncompressed:S}=o;try{let _=d.length;return y===!0&&_!==B||y===!1&&_!==S?!1:!!e.fromBytes(d)}catch{return!1}}function c(d=n(o.seed)){return Pn(W(d,o.seed,"seed"),r.ORDER)}function f(d,y=!0){return e.BASE.multiply(r.fromBytes(d)).toBytes(y)}function u(d){let{secretKey:y,publicKey:B,publicKeyUncompressed:S}=o;if(!we(d)||"_lengths"in r&&r._lengths||y===B)return;let _=W(d,void 0,"key").length;return _===B||_===S}function h(d,y,B=!0){if(u(d)===!0)throw new Error("first arg must be private key");if(u(y)===!1)throw new Error("second arg must be public key");let S=r.fromBytes(d);return e.fromBytes(y).multiply(S).toBytes(B)}let g={isValidSecretKey:s,isValidPublicKey:i,randomSecretKey:c},b=To(c,f);return Object.freeze({getPublicKey:f,getSharedSecret:h,keygen:b,Point:e,utils:g,lengths:o})}function Mo(e,t,r={}){Kt(t),Ae(r,{},{hmac:"function",lowS:"boolean",randomBytes:"function",bits2int:"function",bits2int_modN:"function"}),r=Object.assign({},r);let n=r.randomBytes||me,o=r.hmac||((l,a)=>Tt(t,l,a)),{Fp:s,Fn:i}=e,{ORDER:c,BITS:f}=i,{keygen:u,getPublicKey:h,getSharedSecret:g,utils:b,lengths:d}=si(e,r),y={prehash:!0,lowS:typeof r.lowS=="boolean"?r.lowS:!0,format:"compact",extraEntropy:!1},B=c*qo<s.ORDER;function S(l){let a=c>>ce;return l>a}function _(l,a){if(!i.isValidNot0(a))throw new Error(`invalid signature ${l}: out of range 1..Point.Fn.ORDER`);return a}function V(){if(B)throw new Error('"recovered" sig type is not supported for cofactor >2 curves')}function q(l,a){Jn(a);let x=d.signature,m=a==="compact"?x:a==="recovered"?x+1:void 0;return W(l,m)}class N{constructor(a,x,m){T(this,"r");T(this,"s");T(this,"recovery");if(this.r=_("r",a),this.s=_("s",x),m!=null){if(V(),![0,1,2,3].includes(m))throw new Error("invalid recovery id");this.recovery=m}Object.freeze(this)}static fromBytes(a,x=y.format){q(a,x);let m;if(x==="der"){let{r:E,s:I}=Nt.toSig(W(a));return new N(E,I)}x==="recovered"&&(m=a[0],x="compact",a=a.subarray(1));let v=d.signature/2,p=a.subarray(0,v),A=a.subarray(v,v*2);return new N(i.fromBytes(p),i.fromBytes(A),m)}static fromHex(a,x){return this.fromBytes(At(a),x)}assertRecovery(){let{recovery:a}=this;if(a==null)throw new Error("invalid recovery id: must be present");return a}addRecoveryBit(a){return new N(this.r,this.s,a)}recoverPublicKey(a){let{r:x,s:m}=this,v=this.assertRecovery(),p=v===2||v===3?x+c:x;if(!s.isValid(p))throw new Error("invalid recovery id: sig.r+curve.n != R.x");let A=s.toBytes(p),E=e.fromBytes(ft(Vo((v&1)===0),A)),I=i.inv(p),O=P(W(a,void 0,"msgHash")),D=i.create(-O*I),k=i.create(m*I),R=e.BASE.multiplyUnsafe(D).add(E.multiplyUnsafe(k));if(R.is0())throw new Error("invalid recovery: point at infinify");return R.assertValidity(),R}hasHighS(){return S(this.s)}toBytes(a=y.format){if(Jn(a),a==="der")return At(Nt.hexFromSig(this));let{r:x,s:m}=this,v=i.toBytes(x),p=i.toBytes(m);return a==="recovered"?(V(),ft(Uint8Array.of(this.assertRecovery()),v,p)):ft(v,p)}toHex(a){return $t(this.toBytes(a))}}let C=r.bits2int||function(a){if(a.length>8192)throw new Error("input is too large");let x=oe(a),m=a.length*8-f;return m>0?x>>BigInt(m):x},P=r.bits2int_modN||function(a){return i.create(C(a))},Y=ve(f);function z(l){return go("num < 2^"+f,l,It,Y),i.toBytes(l)}function U(l,a){return W(l,void 0,"message"),a?W(t(l),void 0,"prehashed message"):l}function K(l,a,x){let{lowS:m,prehash:v,extraEntropy:p}=Xn(x,y);l=U(l,v);let A=P(l),E=i.fromBytes(a);if(!i.isValidNot0(E))throw new Error("invalid private key");let I=[z(E),z(A)];if(p!=null&&p!==!1){let R=p===!0?n(d.secretKey):p;I.push(W(R,void 0,"extraEntropy"))}let O=ft(...I),D=A;function k(R){let Z=C(R);if(!i.isValidNot0(Z))return;let G=i.inv(Z),j=e.BASE.multiply(Z).toAffine(),$=i.create(j.x);if($===It)return;let J=i.create(G*i.create(D+$*E));if(J===It)return;let fe=(j.x===$?0:2)|Number(j.y&ce),ae=J;return m&&S(J)&&(ae=i.neg(J),fe^=1),new N($,ae,B?void 0:fe)}return{seed:O,k2sig:k}}function M(l,a,x={}){let{seed:m,k2sig:v}=K(l,a,x);return xo(t.outputLen,i.BYTES,o)(m,v).toBytes(x.format)}function L(l,a,x,m={}){let{lowS:v,prehash:p,format:A}=Xn(m,y);if(x=W(x,void 0,"publicKey"),a=U(a,p),!we(l)){let E=l instanceof N?", use sig.toBytes()":"";throw new Error("verify expects Uint8Array signature"+E)}q(l,A);try{let E=N.fromBytes(l,A),I=e.fromBytes(x);if(v&&E.hasHighS())return!1;let{r:O,s:D}=E,k=P(a),R=i.inv(D),Z=i.create(k*R),G=i.create(O*R),j=e.BASE.multiplyUnsafe(Z).add(I.multiplyUnsafe(G));return j.is0()?!1:i.create(j.x)===O}catch{return!1}}function w(l,a,x={}){let{prehash:m}=Xn(x,y);return a=U(a,m),N.fromBytes(l,"recovered").recoverPublicKey(a).toBytes()}return Object.freeze({keygen:u,getPublicKey:h,getSharedSecret:g,utils:b,lengths:d,Point:e,sign:M,verify:L,recoverPublicKey:w,Signature:N,hash:t})}var tr={p:BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f"),n:BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"),h:BigInt(1),a:BigInt(0),b:BigInt(7),Gx:BigInt("0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"),Gy:BigInt("0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8")},ii={beta:BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),basises:[[BigInt("0x3086d221a7d46bcde86c90e49284eb15"),-BigInt("0xe4437ed6010e88286f547fa90abfe4c3")],[BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"),BigInt("0x3086d221a7d46bcde86c90e49284eb15")]]};var Zo=BigInt(2);function ci(e){let t=tr.p,r=BigInt(3),n=BigInt(6),o=BigInt(11),s=BigInt(22),i=BigInt(23),c=BigInt(44),f=BigInt(88),u=e*e*e%t,h=u*u*e%t,g=at(h,r,t)*h%t,b=at(g,r,t)*h%t,d=at(b,Zo,t)*u%t,y=at(d,o,t)*d%t,B=at(y,s,t)*y%t,S=at(B,c,t)*B%t,_=at(S,f,t)*S%t,V=at(_,c,t)*B%t,q=at(V,r,t)*h%t,N=at(q,i,t)*y%t,C=at(N,n,t)*u%t,P=at(C,Zo,t);if(!Fn.eql(Fn.sqr(P),e))throw new Error("Cannot find square root");return P}var Fn=se(tr.p,{sqrt:ci}),fi=Co(tr,{Fp:Fn,endo:ii}),jo=Mo(fi,re);function $o(e,t,r){return Kt(e),r===void 0&&(r=new Uint8Array(e.outputLen)),Tt(e,r,t)}var er=Uint8Array.of(0),Ko=Uint8Array.of();function Po(e,t,r,n=32){Kt(e),ut(n,"length");let o=e.outputLen;if(n>255*o)throw new Error("Length must be <= 255*HashLen");let s=Math.ceil(n/o);r===void 0?r=Ko:W(r,void 0,"info");let i=new Uint8Array(s*o),c=Tt.create(e,t),f=c._cloneInto(),u=new Uint8Array(c.outputLen);for(let h=0;h<s;h++)er[0]=h+1,f.update(h===0?Ko:u).update(r).update(er).digestInto(u),i.set(u,o*h),c._cloneInto(f);return c.destroy(),f.destroy(),vt(u,er),i.slice(0,n)}function zo(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"}function ai(e){if(!zo(e))throw new Error("Uint8Array expected")}function Yo(e,t){return Array.isArray(t)?t.length===0?!0:e?t.every(r=>typeof r=="string"):t.every(r=>Number.isSafeInteger(r)):!1}function Ie(e,t){if(typeof t!="string")throw new Error(`${e}: string expected`);return!0}function or(e){if(!Number.isSafeInteger(e))throw new Error(`invalid integer: ${e}`)}function rr(e){if(!Array.isArray(e))throw new Error("array expected")}function en(e,t){if(!Yo(!0,t))throw new Error(`${e}: array of strings expected`)}function ui(e,t){if(!Yo(!1,t))throw new Error(`${e}: array of numbers expected`)}function li(...e){let t=s=>s,r=(s,i)=>c=>s(i(c)),n=e.map(s=>s.encode).reduceRight(r,t),o=e.map(s=>s.decode).reduce(r,t);return{encode:n,decode:o}}function di(e){let t=typeof e=="string"?e.split(""):e,r=t.length;en("alphabet",t);let n=new Map(t.map((o,s)=>[o,s]));return{encode:o=>(rr(o),o.map(s=>{if(!Number.isSafeInteger(s)||s<0||s>=r)throw new Error(`alphabet.encode: digit index outside alphabet "${s}". Allowed: ${e}`);return t[s]})),decode:o=>(rr(o),o.map(s=>{Ie("alphabet.decode",s);let i=n.get(s);if(i===void 0)throw new Error(`Unknown letter: "${s}". Allowed: ${e}`);return i}))}}function hi(e=""){return Ie("join",e),{encode:t=>(en("join.decode",t),t.join(e)),decode:t=>(Ie("join.decode",t),t.split(e))}}function bi(e,t="="){return or(e),Ie("padding",t),{encode(r){for(en("padding.encode",r);r.length*e%8;)r.push(t);return r},decode(r){en("padding.decode",r);let n=r.length;if(n*e%8)throw new Error("padding: invalid, string should have whole number of bytes");for(;n>0&&r[n-1]===t;n--)if((n-1)*e%8===0)throw new Error("padding: invalid, string has too much padding");return r.slice(0,n)}}}var Wo=(e,t)=>t===0?e:Wo(t,e%t),nn=(e,t)=>e+(t-Wo(e,t)),nr=(()=>{let e=[];for(let t=0;t<40;t++)e.push(2**t);return e})();function Go(e,t,r,n){if(rr(e),t<=0||t>32)throw new Error(`convertRadix2: wrong from=${t}`);if(r<=0||r>32)throw new Error(`convertRadix2: wrong to=${r}`);if(nn(t,r)>32)throw new Error(`convertRadix2: carry overflow from=${t} to=${r} carryBits=${nn(t,r)}`);let o=0,s=0,i=nr[t],c=nr[r]-1,f=[];for(let u of e){if(or(u),u>=i)throw new Error(`convertRadix2: invalid data word=${u} from=${t}`);if(o=o<<t|u,s+t>32)throw new Error(`convertRadix2: carry overflow pos=${s} from=${t}`);for(s+=t;s>=r;s-=r)f.push((o>>s-r&c)>>>0);let h=nr[s];if(h===void 0)throw new Error("invalid carry");o&=h-1}if(o=o<<r-s&c,!n&&s>=t)throw new Error("Excess padding");if(!n&&o>0)throw new Error(`Non-zero padding: ${o}`);return n&&s>0&&f.push(o>>>0),f}function gi(e,t=!1){if(or(e),e<=0||e>32)throw new Error("radix2: bits should be in (0..32]");if(nn(8,e)>32||nn(e,8)>32)throw new Error("radix2: carry overflow");return{encode:r=>{if(!zo(r))throw new Error("radix2.encode input should be Uint8Array");return Go(Array.from(r),8,e,!t)},decode:r=>(ui("radix2.decode",r),Uint8Array.from(Go(r,e,8,t)))}}var xi=typeof Uint8Array.from([]).toBase64=="function"&&typeof Uint8Array.fromBase64=="function",pi=(e,t)=>{Ie("base64",e);let r=t?/^[A-Za-z0-9=_-]+$/:/^[A-Za-z0-9=+/]+$/,n=t?"base64url":"base64";if(e.length>0&&!r.test(e))throw new Error("invalid base64");return Uint8Array.fromBase64(e,{alphabet:n,lastChunkHandling:"strict"})},Xo=xi?{encode(e){return ai(e),e.toBase64()},decode(e){return pi(e,!1)}}:li(gi(6),di("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"),bi(6),hi(""));var yi=new TextDecoder("utf-8"),wi=new TextEncoder,mi=1,Ei=4294967295,Bi=65536;function sr(e,t){let r=jo.getSharedSecret(e,At("02"+t)).subarray(1,33);return $o(re,r,wi.encode("nip44-v2"))}function vi(e,t){let r=Po(re,e,t,76);return{chacha_key:r.subarray(0,32),chacha_nonce:r.subarray(32,44),hmac_key:r.subarray(44,76)}}function Ai(e){if(!Number.isSafeInteger(e)||e<1)throw new Error("expected positive integer");if(e<=32)return 32;let t=2**(Math.floor(Math.log2(e-1))+1),r=t<=256?32:t/8;return r*(Math.floor((e-1)/r)+1)}function Si(e){let t=new DataView(e.buffer,e.byteOffset,e.byteLength),r=t.getUint16(0),n,o;if(r===0){if(n=t.getUint32(2),n<Bi)throw new Error("invalid padding");o=6}else n=r,o=2;let s=e.subarray(o,o+n);if(n<mi||n>Ei||s.length!==n||e.length!==o+Ai(n))throw new Error("invalid padding");return yi.decode(s)}function Ii(e,t,r){if(r.length!==32)throw new Error("AAD associated data must be 32 bytes");let n=ft(r,t);return Tt(re,e,n)}function Li(e){if(typeof e!="string")throw new Error("payload must be a valid string");let t=e.length;if(t<132)throw new Error("invalid payload length: "+t);if(e[0]==="#")throw new Error("unknown encryption version");let r;try{r=Xo.decode(e)}catch(s){throw new Error("invalid base64: "+s.message)}let n=r.length;if(n<99)throw new Error("invalid data length: "+n);let o=r[0];if(o!==2)throw new Error("unknown encryption version "+o);return{nonce:r.subarray(1,33),ciphertext:r.subarray(33,-32),mac:r.subarray(-32)}}function ir(e,t){let{nonce:r,ciphertext:n,mac:o}=Li(e),{chacha_key:s,chacha_nonce:i,hmac_key:c}=vi(t,r),f=Ii(c,n,r);if(!Pe(f,o))throw new Error("invalid MAC");let u=Hn(s,i,n);return Si(u)}function _i(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function Ui(){let e=new Uint8Array(16);return crypto.getRandomValues(e),Array.from(e,t=>t.toString(16).padStart(2,"0")).join("")}function rn(e,t){let r=e.find(n=>n[0]===t);return r?r[1]:void 0}function Lt(e){let t=new Uint8Array(e.length/2);for(let r=0;r<t.length;r++)t[r]=parseInt(e.substr(r*2,2),16);return t}async function Ri(e){if(!e.id||!e.pubkey||!e.sig||!e.tags||e.kind!==30470||!/^[0-9a-f]{128}$/i.test(e.sig)||!/^[0-9a-f]{64}$/i.test(e.pubkey)||!/^[0-9a-f]{64}$/i.test(e.id)||e.tags.length>100||e.content.length>65536||e.tags.some(i=>i.some(c=>c.length>1024)))return!1;let t=e.tags.map(i=>i[0]);if(!t.includes("tier")||!t.includes("age-range")||!t.includes("entity-type"))return!1;let r=JSON.stringify([0,e.pubkey,e.created_at,e.kind,e.tags,e.content]),n=new TextEncoder,o=Sn(n.encode(r));if(st(o)!==e.id.toLowerCase())return!1;try{let i=Lt(e.sig),c=Lt(e.id),f=Lt(e.pubkey);return ye.verify(i,c,f)}catch{return!1}}function Oi(e,t){if(e===t||e==="18+"&&t==="18+")return!0;let r=["0-3","4-7","8-12","13-17","18+"],n=r.indexOf(e),o=r.indexOf(t);return n===-1||o===-1?!1:t==="18+"?e==="18+":e===t}async function Hi(e,t){if(t==null||!/^https:\/\//i.test(t)||!/^[0-9a-f]{64}$/i.test(e))return null;try{let r=await fetch(`${t}/status/${e}`,{signal:AbortSignal.timeout(5e3)});if(!r.ok)return null;let n=await r.json();if(typeof n!="object"||n===null)return null;let o=n;return{confirmed:o.confirmed===!0,method:["A","B","C","D"].includes(o.method)?o.method:null,profession:typeof o.profession=="string"?o.profession:void 0,jurisdiction:typeof o.jurisdiction=="string"?o.jurisdiction:void 0}}catch{return null}}async function Jo(e,t){if(!["0-3","4-7","8-12","13-17","18+"].includes(e))return{verified:!1,ageRange:null,tier:null,entityType:null,credentialId:null,verifierPubkey:null,verifierConfirmed:null,verifierMethod:null,issuedAt:null,expiresAt:null,error:"invalid-age-range"};let n={requiredAgeRange:e,relayUrl:t?.relayUrl||"wss://relay.damus.io",theme:t?.theme||"auto",timeout:t?.timeout||12e4,verifierCheckUrl:t?.verifierCheckUrl!==void 0?t.verifierCheckUrl:"https://verify.signet.forgesworn.dev",acceptUnconfirmed:t?.acceptUnconfirmed||!1,...t};n.timeout=Math.max(5e3,Math.min(n.timeout??12e4,6e5));let o=Ui(),s={type:"signet-verify-request",requestId:o,requiredAgeRange:n.requiredAgeRange,relayUrl:n.relayUrl,timestamp:Math.floor(Date.now()/1e3)},i=JSON.stringify(s),c=btoa(i);return new Promise(f=>{let u=document.createElement("style");u.textContent="#signet-verify-dialog::backdrop{background:rgba(0,0,0,0.7)}",document.head.appendChild(u);let h=n.theme==="dark"||n.theme==="auto"&&window.matchMedia("(prefers-color-scheme: dark)").matches,g=h?"#1a1a2e":"#ffffff",b=h?"#e0e0e0":"#1a1a2e",d=h?"#888":"#666",y=document.createElement("dialog");y.id="signet-verify-dialog",y.style.cssText=`border:none;border-radius:16px;padding:32px;max-width:380px;width:90%;text-align:center;box-shadow:0 20px 60px rgba(0,0,0,0.3);background:${g};color:${b};font-family:system-ui,-apple-system,sans-serif;`,y.innerHTML=`
       <h2 style="margin:0 0 8px;font-size:1.3rem;">Verify your age with Signet</h2>
-      <p style="margin:0 0 24px;color:${d};font-size:0.9rem;">Scan this QR code with your Signet app to prove you are ${Li(e)}. No personal data is shared.</p>
+      <p style="margin:0 0 24px;color:${d};font-size:0.9rem;">Scan this QR code with your Signet app to prove you are ${_i(e)}. No personal data is shared.</p>
       <div id="signet-qr" style="display:flex;justify-content:center;margin-bottom:24px;"></div>
       <p style="margin:0 0 16px;color:${d};font-size:0.8rem;">Waiting for verification...</p>
       <button id="signet-cancel" style="background:none;border:1px solid ${d};color:${b};padding:10px 24px;border-radius:8px;cursor:pointer;font-size:0.9rem;">Cancel</button>
-    `,document.body.appendChild(y),y.showModal();let B=y.querySelector("#signet-qr");if(B){let _=document.createElement("div");_.style.cssText=`width:200px;height:200px;background:${h?"#2a2a3e":"#f0f0f0"};border-radius:8px;display:flex;align-items:center;justify-content:center;font-size:0.75rem;color:${d};word-break:break-all;padding:12px;`,_.textContent=`signet:verify:${c.slice(0,40)}...`,B.appendChild(_)}let S=new BroadcastChannel("signet-verify-"+o);y.querySelector("#signet-cancel")?.addEventListener("click",()=>{S.close(),y.close(),y.remove(),l.remove(),f({verified:!1,ageRange:null,tier:null,entityType:null,credentialId:null,verifierPubkey:null,verifierConfirmed:null,verifierMethod:null,issuedAt:null,expiresAt:null,error:"cancelled"})}),S.onmessage=async _=>{let V=_.data;if(typeof V!="object"||V===null)return;let N=V;if(N.type!=="signet-verify-response"||N.requestId!==o||!N.credential||typeof N.credential!="object"||!Array.isArray(N.credential.tags))return;let q=N.credential,C=await Ri(q),P=rn(q.tags,"age-range"),Y=rn(q.tags,"tier"),z=rn(q.tags,"entity-type"),R=rn(q.tags,"expires"),K=P?Ui(P,n.requiredAgeRange):!1,M=await Oi(q.pubkey,n.verifierCheckUrl),L=M?.confirmed??null,w=M?.method??null,a=n.acceptUnconfirmed||L===!0;y.close(),y.remove(),l.remove(),S.close();let u=Y?parseInt(Y,10):null,x=R?parseInt(R,10):null,m=Math.floor(Date.now()/1e3),v=x===null||!isNaN(x)&&x>m,p;C?v?K?a||(p=L===!1?"verifier-not-confirmed":"verifier-check-unavailable"):p="age-range-not-met":p="credential-expired":p="invalid-credential",f({verified:C&&v&&K&&a,ageRange:P||null,tier:u!==null&&!isNaN(u)?u:null,entityType:z||null,credentialId:q.id,verifierPubkey:q.pubkey,verifierConfirmed:L,verifierMethod:w,issuedAt:q.created_at,expiresAt:x!==null&&!isNaN(x)?x:null,error:p})},setTimeout(()=>{y.close(),y.remove(),l.remove(),S.close(),f({verified:!1,ageRange:null,tier:null,entityType:null,credentialId:null,verifierPubkey:null,verifierConfirmed:null,verifierMethod:null,issuedAt:null,expiresAt:null,error:"timeout"})},n.timeout)})}function cr(e){let t=JSON.stringify([0,e.pubkey,e.created_at,e.kind,e.tags,e.content]),r=Sn(new TextEncoder().encode(t));return st(r)}async function Hi(e,t){try{let r=sr(t,e.pubkey),n=ir(e.content,r),o=JSON.parse(n);if(typeof o!="object"||o===null)return null;let s=o;if(s.kind!==13||typeof s.pubkey!="string"||!/^[0-9a-f]{64}$/i.test(s.pubkey)||typeof s.created_at!="number"||!Array.isArray(s.tags)||typeof s.content!="string"||typeof s.id!="string"||!/^[0-9a-f]{64}$/i.test(s.id)||typeof s.sig!="string"||!/^[0-9a-f]{128}$/i.test(s.sig)||cr({pubkey:s.pubkey,created_at:s.created_at,kind:13,tags:s.tags,content:s.content})!==s.id.toLowerCase())return null;let c=Lt(s.sig),f=Lt(s.id),l=Lt(s.pubkey);if(!ye.verify(c,f,l))return null;let h=sr(t,s.pubkey),g=ir(s.content,h),b=JSON.parse(g);if(typeof b!="object"||b===null)return null;let d=b;if(typeof d.pubkey!="string"||d.pubkey!==s.pubkey||typeof d.kind!="number"||typeof d.created_at!="number"||!Array.isArray(d.tags)||typeof d.content!="string")return null;let y=typeof d.id=="string"?d.id:cr({pubkey:d.pubkey,created_at:d.created_at,kind:d.kind,tags:d.tags,content:d.content});return{pubkey:d.pubkey,id:y,kind:d.kind,created_at:d.created_at,tags:d.tags,content:d.content}}catch{return null}}function ki(e){if(typeof e!="string")return;let t=e.replace(/[\x00-\x1f\x7f-\x9f\u200b-\u200f\u2028-\u202e\u2066-\u2069]/g,"").trim().slice(0,64);return t.length>0?t:void 0}async function Qo(e){if(!/^[0-9a-f]{64}$/i.test(e.requestId))throw new Error("invalid-request-id");if(!(e.sessionPrivKey instanceof Uint8Array)||e.sessionPrivKey.length!==32)throw new Error("invalid-session-privkey");if(!/^wss:\/\//i.test(e.relayUrl)&&!/^ws:\/\/(localhost|127\.0\.0\.1)([:\/]|$)/i.test(e.relayUrl))throw new Error("invalid-relay-url");if(typeof e.expectedOrigin!="string"||e.expectedOrigin.length===0)throw new Error("invalid-expected-origin");let t=st(ye.getPublicKey(e.sessionPrivKey)),r=Math.max(5e3,Math.min(e.timeout??12e4,6e5)),n=e.requestId.toLowerCase(),o=e.expectedOrigin;return new Promise((s,i)=>{let c=`sa-${Math.random().toString(36).slice(2,12)}`,f=!1,l;try{l=new WebSocket(e.relayUrl)}catch{i(new Error("relay-error"));return}let h=b=>{if(!f){f=!0,clearTimeout(g);try{l.close()}catch{}b()}},g=setTimeout(()=>{h(()=>i(new Error("timeout")))},r);l.onopen=()=>{let b=Math.floor(Date.now()/1e3)-60;l.send(JSON.stringify(["REQ",c,{kinds:[1059],"#p":[t],since:b}]))},l.onmessage=async b=>{if(f)return;let d;try{d=JSON.parse(typeof b.data=="string"?b.data:"")}catch{return}if(!Array.isArray(d)||d[0]!=="EVENT"||d[1]!==c)return;let y=d[2];if(typeof y!="object"||y===null)return;let B=y;if(B.kind!==1059||typeof B.pubkey!="string"||typeof B.content!="string")return;let S=await Hi({pubkey:B.pubkey,content:B.content},e.sessionPrivKey);if(!S||S.kind!==29999)return;let _=S.tags.find(a=>a[0]==="session");if(!_||_[1]!==n)return;let V=S.tags.find(a=>a[0]==="status");if(V?.[1]==="rejected"){h(()=>i(new Error("denied")));return}if(V?.[1]!=="approved"||Math.abs(Date.now()/1e3-S.created_at)>300)return;let q;try{let a=JSON.parse(S.content);if(typeof a!="object"||a===null)return;q=a}catch{return}if(q.type!=="signet-auth-response"||q.requestId!==n||typeof q.authEvent!="object"||q.authEvent===null)return;let C=q.authEvent;if(typeof C.id!="string"||!/^[0-9a-f]{64}$/i.test(C.id)||typeof C.pubkey!="string"||!/^[0-9a-f]{64}$/i.test(C.pubkey)||typeof C.sig!="string"||!/^[0-9a-f]{128}$/i.test(C.sig)||C.kind!==21236||typeof C.created_at!="number"||!Array.isArray(C.tags)||typeof C.content!="string"||C.pubkey.toLowerCase()!==S.pubkey.toLowerCase()||cr({pubkey:C.pubkey,created_at:C.created_at,kind:21236,tags:C.tags,content:C.content})!==C.id.toLowerCase())return;let Y=!1;try{let a=Lt(C.sig),u=Lt(C.id),x=Lt(C.pubkey);Y=ye.verify(a,u,x)}catch{Y=!1}if(!Y)return;let z=C.tags,R=z.find(a=>Array.isArray(a)&&a[0]==="challenge");if(!R||typeof R[1]!="string"||R[1].toLowerCase()!==n)return;let K=z.find(a=>Array.isArray(a)&&a[0]==="origin");if(!K||K[1]!==o||Math.abs(Date.now()/1e3-C.created_at)>300)return;let L={id:C.id.toLowerCase(),pubkey:C.pubkey.toLowerCase(),kind:21236,created_at:C.created_at,tags:z,content:C.content,sig:C.sig},w=ki(q.displayName);h(()=>s({pubkey:L.pubkey,authEvent:L,credential:q.credential,...w!==void 0?{displayName:w}:{},createdAt:L.created_at}))},l.onerror=()=>{h(()=>i(new Error("relay-error")))}})}typeof window<"u"&&(window.Signet={verifyAge:Jo,waitForAuthResponse:Qo});return ss(Ti);})();
+    `,document.body.appendChild(y),y.showModal();let B=y.querySelector("#signet-qr");if(B){let _=document.createElement("div");_.style.cssText=`width:200px;height:200px;background:${h?"#2a2a3e":"#f0f0f0"};border-radius:8px;display:flex;align-items:center;justify-content:center;font-size:0.75rem;color:${d};word-break:break-all;padding:12px;`,_.textContent=`signet:verify:${c.slice(0,40)}...`,B.appendChild(_)}let S=new BroadcastChannel("signet-verify-"+o);y.querySelector("#signet-cancel")?.addEventListener("click",()=>{S.close(),y.close(),y.remove(),u.remove(),f({verified:!1,ageRange:null,tier:null,entityType:null,credentialId:null,verifierPubkey:null,verifierConfirmed:null,verifierMethod:null,issuedAt:null,expiresAt:null,error:"cancelled"})}),S.onmessage=async _=>{let V=_.data;if(typeof V!="object"||V===null)return;let q=V;if(q.type!=="signet-verify-response"||q.requestId!==o||!q.credential||typeof q.credential!="object"||!Array.isArray(q.credential.tags))return;let N=q.credential,C=await Ri(N),P=rn(N.tags,"age-range"),Y=rn(N.tags,"tier"),z=rn(N.tags,"entity-type"),U=rn(N.tags,"expires"),K=P?Oi(P,n.requiredAgeRange):!1,M=await Hi(N.pubkey,n.verifierCheckUrl),L=M?.confirmed??null,w=M?.method??null,l=n.acceptUnconfirmed||L===!0;y.close(),y.remove(),u.remove(),S.close();let a=Y?parseInt(Y,10):null,x=U?parseInt(U,10):null,m=Math.floor(Date.now()/1e3),v=x===null||!isNaN(x)&&x>m,p;C?v?K?l||(p=L===!1?"verifier-not-confirmed":"verifier-check-unavailable"):p="age-range-not-met":p="credential-expired":p="invalid-credential",f({verified:C&&v&&K&&l,ageRange:P||null,tier:a!==null&&!isNaN(a)?a:null,entityType:z||null,credentialId:N.id,verifierPubkey:N.pubkey,verifierConfirmed:L,verifierMethod:w,issuedAt:N.created_at,expiresAt:x!==null&&!isNaN(x)?x:null,error:p})},setTimeout(()=>{y.close(),y.remove(),u.remove(),S.close(),f({verified:!1,ageRange:null,tier:null,entityType:null,credentialId:null,verifierPubkey:null,verifierConfirmed:null,verifierMethod:null,issuedAt:null,expiresAt:null,error:"timeout"})},n.timeout)})}function cr(e){let t=JSON.stringify([0,e.pubkey,e.created_at,e.kind,e.tags,e.content]),r=Sn(new TextEncoder().encode(t));return st(r)}async function ki(e,t){try{let r=sr(t,e.pubkey),n=ir(e.content,r),o=JSON.parse(n);if(typeof o!="object"||o===null)return null;let s=o;if(s.kind!==13||typeof s.pubkey!="string"||!/^[0-9a-f]{64}$/i.test(s.pubkey)||typeof s.created_at!="number"||!Array.isArray(s.tags)||typeof s.content!="string"||typeof s.id!="string"||!/^[0-9a-f]{64}$/i.test(s.id)||typeof s.sig!="string"||!/^[0-9a-f]{128}$/i.test(s.sig)||cr({pubkey:s.pubkey,created_at:s.created_at,kind:13,tags:s.tags,content:s.content})!==s.id.toLowerCase())return null;let c=Lt(s.sig),f=Lt(s.id),u=Lt(s.pubkey);if(!ye.verify(c,f,u))return null;let h=sr(t,s.pubkey),g=ir(s.content,h),b=JSON.parse(g);if(typeof b!="object"||b===null)return null;let d=b;if(typeof d.pubkey!="string"||d.pubkey!==s.pubkey||typeof d.kind!="number"||typeof d.created_at!="number"||!Array.isArray(d.tags)||typeof d.content!="string")return null;let y=typeof d.id=="string"?d.id:cr({pubkey:d.pubkey,created_at:d.created_at,kind:d.kind,tags:d.tags,content:d.content});return{pubkey:d.pubkey,id:y,kind:d.kind,created_at:d.created_at,tags:d.tags,content:d.content}}catch{return null}}function Ti(e){if(typeof e!="string")return;let t=e.replace(/[\x00-\x1f\x7f-\x9f\u200b-\u200f\u2028-\u202e\u2066-\u2069]/g,"").trim().slice(0,64);return t.length>0?t:void 0}async function Qo(e){if(!/^[0-9a-f]{64}$/i.test(e.requestId))throw new Error("invalid-request-id");if(!(e.sessionPrivKey instanceof Uint8Array)||e.sessionPrivKey.length!==32)throw new Error("invalid-session-privkey");if(!/^wss:\/\//i.test(e.relayUrl)&&!/^ws:\/\/(localhost|127\.0\.0\.1)([:\/]|$)/i.test(e.relayUrl))throw new Error("invalid-relay-url");if(typeof e.expectedOrigin!="string"||e.expectedOrigin.length===0)throw new Error("invalid-expected-origin");let t=st(ye.getPublicKey(e.sessionPrivKey)),r=Math.max(5e3,Math.min(e.timeout??12e4,6e5)),n=e.requestId.toLowerCase(),o=e.expectedOrigin;return new Promise((s,i)=>{let c=`sa-${Math.random().toString(36).slice(2,12)}`,f=!1,u;try{u=new WebSocket(e.relayUrl)}catch{i(new Error("relay-error"));return}let h=b=>{if(!f){f=!0,clearTimeout(g);try{u.close()}catch{}b()}},g=setTimeout(()=>{h(()=>i(new Error("timeout")))},r);u.onopen=()=>{let b=Math.floor(Date.now()/1e3)-60;u.send(JSON.stringify(["REQ",c,{kinds:[1059],"#p":[t],since:b}]))},u.onmessage=async b=>{if(f)return;let d;try{d=JSON.parse(typeof b.data=="string"?b.data:"")}catch{return}if(!Array.isArray(d)||d[0]!=="EVENT"||d[1]!==c)return;let y=d[2];if(typeof y!="object"||y===null)return;let B=y;if(B.kind!==1059||typeof B.pubkey!="string"||typeof B.content!="string")return;let S=await ki({pubkey:B.pubkey,content:B.content},e.sessionPrivKey);if(!S||S.kind!==29999)return;let _=S.tags.find(a=>a[0]==="session");if(!_||_[1]!==n)return;let V=S.tags.find(a=>a[0]==="status");if(V?.[1]==="rejected"){h(()=>i(new Error("denied")));return}if(V?.[1]!=="approved"||Math.abs(Date.now()/1e3-S.created_at)>300)return;let N;try{let a=JSON.parse(S.content);if(typeof a!="object"||a===null)return;N=a}catch{return}if(N.type!=="signet-auth-response"||N.requestId!==n||typeof N.authEvent!="object"||N.authEvent===null)return;let C=N.authEvent;if(typeof C.id!="string"||!/^[0-9a-f]{64}$/i.test(C.id)||typeof C.pubkey!="string"||!/^[0-9a-f]{64}$/i.test(C.pubkey)||typeof C.sig!="string"||!/^[0-9a-f]{128}$/i.test(C.sig)||C.kind!==21236||typeof C.created_at!="number"||!Array.isArray(C.tags)||typeof C.content!="string"||C.pubkey.toLowerCase()!==S.pubkey.toLowerCase()||cr({pubkey:C.pubkey,created_at:C.created_at,kind:21236,tags:C.tags,content:C.content})!==C.id.toLowerCase())return;let Y=!1;try{let a=Lt(C.sig),x=Lt(C.id),m=Lt(C.pubkey);Y=ye.verify(a,x,m)}catch{Y=!1}if(!Y)return;let z=C.tags,U=z.find(a=>Array.isArray(a)&&a[0]==="challenge");if(!U||typeof U[1]!="string"||U[1].toLowerCase()!==n)return;let K=z.find(a=>Array.isArray(a)&&a[0]==="origin");if(!K||K[1]!==o||Math.abs(Date.now()/1e3-C.created_at)>300)return;let L={id:C.id.toLowerCase(),pubkey:C.pubkey.toLowerCase(),kind:21236,created_at:C.created_at,tags:z,content:C.content,sig:C.sig},w=Ti(N.displayName),l=typeof N.bunkerUri=="string"&&/^bunker:\/\//i.test(N.bunkerUri)?N.bunkerUri:void 0;h(()=>s({pubkey:L.pubkey,authEvent:L,credential:N.credential,...w!==void 0?{displayName:w}:{},...l!==void 0?{bunkerUri:l}:{},createdAt:L.created_at}))},u.onerror=()=>{h(()=>i(new Error("relay-error")))}})}typeof window<"u"&&(window.Signet={verifyAge:Jo,waitForAuthResponse:Qo});return ss(Ni);})();
 /*! Bundled license information:
 
 @noble/hashes/esm/utils.js:

package/dist/signet-verify.js

@@ -566,11 +566,20 @@ export async function waitForAuthResponse(options) {
                 sig: ae.sig,
             };
             const sanitisedDisplayName = sanitiseDisplayName(inner.displayName);
+            // Optional bunker:// URI for the auth-only → live-signer upgrade. The signer
+            // device mints a one-shot pairing URI to its own NIP-46 server; the consumer
+            // connects to it (signer passthrough) to gain signing capability cross-device.
+            // Accept only a well-formed bunker URI; anything else is ignored (stays
+            // auth-only, exactly as before this field existed).
+            const bunkerUri = (typeof inner.bunkerUri === 'string' && /^bunker:\/\//i.test(inner.bunkerUri))
+                ? inner.bunkerUri
+                : undefined;
             settle(() => resolve({
                 pubkey: verifiedAuthEvent.pubkey,
                 authEvent: verifiedAuthEvent,
                 credential: inner.credential,
                 ...(sanitisedDisplayName !== undefined ? { displayName: sanitisedDisplayName } : {}),
+                ...(bunkerUri !== undefined ? { bunkerUri } : {}),
                 createdAt: verifiedAuthEvent.created_at,
             }));
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "signet-verify",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "Signet SDK — website age verification and cross-device Sign-in-with-Signet",
   "type": "module",
   "main": "./dist/signet-verify.js",