signet-verify 0.6.1 → 0.7.1

package/README.md

@@ -2,6 +2,12 @@
 
 Add privacy-preserving age verification to any website. One script tag, one function call. No personal data collected.
 
+## Install
+
+```bash
+npm install signet-verify
+```
+
 ## Quick Start
 
 ```html
@@ -80,7 +86,7 @@ Past that point, this library stops listening and reports `expired` — show a c
 to it.
 
 ```ts
-import { waitForAuthResponse, AUTH_FRESHNESS_WINDOW_SEC } from 'signet-verify';
+import { waitForAuthResponse, AUTH_FRESHNESS_WINDOW_SEC, DEFAULT_RELAY_URL } from 'signet-verify';
 
 // Stamp this ONCE, when you mint the challenge and open the auth URL / show the QR.
 const issuedAt = Math.floor(Date.now() / 1000);
@@ -88,7 +94,7 @@ const expiresAt = issuedAt + AUTH_FRESHNESS_WINDOW_SEC; // show a countdown to t
 
 const result = await waitForAuthResponse({
   requestId: challenge,
-  relayUrl,
+  relayUrl: DEFAULT_RELAY_URL, // the Signet relay — must match the relay= in your auth URL
   sessionPrivKey,
   expectedOrigin: location.origin,
   issuedAt,          // ← pass on EVERY call for this sign-in, retries included
@@ -111,7 +117,7 @@ again. This was a real, 100%-reproducible failure before 0.5.2.
 | `denied` | The user rejected the request | Nothing; respect it |
 | `aborted` | You aborted via `abortSignal` | Nothing |
 | `relay-error` | The socket failed | A retry, anchored to the same `issuedAt` |
-| `relay-refused` | The relay closed the subscription — `err.reason` has its text (e.g. `auth-required`) | A relay that serves gift wraps to an unauthenticated reader. `relay.damus.io` currently does not; `relay.trotters.cc` (the Signet app's relay) does |
+| `relay-refused` | The relay closed the subscription — `err.reason` has its text (e.g. `auth-required`) | A relay that serves gift wraps to an unauthenticated reader. `relay.damus.io` currently does not; `nos.lol` (the default) does |
 | `invalid-issued-at` | `issuedAt` looks like the wrong unit (e.g. milliseconds) or is too far in the future | A bug in your code, not a retry — check you're passing unix **seconds** |
 
 The code is on both `err.message` and `err.code` — branch on either.
@@ -129,7 +135,7 @@ Returns `Promise<SignetVerifyResult>`
 
 | Option | Type | Default | Description |
 |--------|------|---------|-------------|
-| `relayUrl` | `string` | `wss://relay.damus.io` | Relay URL for cross-device communication |
+| `relayUrl` | `string` | `DEFAULT_RELAY_URL` (`wss://nos.lol`) | Relay URL for cross-device communication. Must serve kind-1059 gift wraps to an unauthenticated reader |
 | `theme` | `'light' \| 'dark' \| 'auto'` | `'auto'` | Modal colour scheme |
 | `timeout` | `number` | `120000` | Timeout in milliseconds |
 | `verifierCheckUrl` | `string \| null` | `'https://verify.signet.forgesworn.dev'` | Verification bot URL. Set to `null` to skip. |

package/dist/signet-verify.d.ts

@@ -29,7 +29,7 @@ export interface SignetVerifyResult {
 export interface SignetVerifyOptions {
     /** Required age range to verify (e.g., '18+', '13-17') */
     requiredAgeRange: string;
-    /** Relay URL for cross-device communication */
+    /** Relay URL for cross-device communication. Default: `DEFAULT_RELAY_URL` (wss://nos.lol). */
     relayUrl?: string;
     /** Callback URL for same-device flow */
     callbackUrl?: string;
@@ -65,6 +65,14 @@ export declare function verifyAge(requiredAgeRange: string, options?: Partial<Si
  * — instead of hardcoding 300 and drifting from this library.
  */
 export declare const AUTH_FRESHNESS_WINDOW_SEC = 300;
+/**
+ * The Signet relay — the one ForgeSworn operates and the Signet app publishes
+ * to. Use it unless you have a reason not to: a relay for this flow must serve
+ * kind-1059 gift wraps to an unauthenticated reader, and not all do.
+ * relay.damus.io, the previous default, refuses those reads and has AUTH
+ * misconfigured, so nothing can fetch a response from it.
+ */
+export declare const DEFAULT_RELAY_URL = "wss://nos.lol";
 /** Options for waiting on a cross-device Sign-in-with-Signet response. */
 export interface WaitForAuthOptions {
     /** The challenge (also the `requestId`) sent in the auth URL. 64-char hex. */

package/dist/signet-verify.iife.js

@@ -1,10 +1,10 @@
-"use strict";var Signet=(()=>{var yt=Object.defineProperty;var ts=Object.getOwnPropertyDescriptor;var ns=Object.getOwnPropertyNames;var rs=Object.prototype.hasOwnProperty;var os=(t,e,r)=>e in t?yt(t,e,{enumerable:!0,configurable:!0,writable:!0,value:r}):t[e]=r;var ss=(t,e)=>{for(var r in e)yt(t,r,{get:e[r],enumerable:!0})},is=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of ns(e))!rs.call(t,o)&&o!==r&&yt(t,o,{get:()=>e[o],enumerable:!(n=ts(e,o))||n.enumerable});return t};var cs=t=>is(yt({},"__esModule",{value:!0}),t);var m=(t,e,r)=>os(t,typeof e!="symbol"?e+"":e,r);var Gi={};ss(Gi,{AUTH_FRESHNESS_WINDOW_SEC:()=>ot,verifyAge:()=>Jo,waitForAuthResponse:()=>es});var fs=t=>t/2**32|0,as=t=>t>>>0;function er(t,e,r,n){let o=fs(r),s=as(r);t.setUint32(e,n?s:o,n),t.setUint32(e+4,n?o:s,n)}function wt(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in t&&t.BYTES_PER_ELEMENT===1}var Xt=t=>t?`"${t}" `:"";function st(t,e=""){if(typeof t!="number")throw new TypeError(Xt(e)+"expected number, got "+typeof t);if(!Number.isSafeInteger(t)||t<0)throw new RangeError(Xt(e)+"expected integer >= 0, got "+t);return t}function Se(t,e,r=""){if(wt(t)&&(e===void 0||t.length===e))return t;e!==void 0&&st(e,"length");let n=wt(t),o=e!==void 0?` of length ${e}`:"",s=n?`length=${t.length}`:`type=${typeof t}`,i=Xt(r)+"expected Uint8Array"+o+", got "+s;throw n?new RangeError(i):new TypeError(i)}var us=(t,e)=>{if(t===null||typeof t!="object"||Array.isArray(t))throw new TypeError((e==="object"?"":`"${e}" `)+"expected object, got type="+typeof t)},tr=(t,e)=>{us(t,e);let r=Object.getPrototypeOf(t);if(r!==Object.prototype&&r!==null)throw new TypeError(`"${e}" expected plain object`);if(Object.hasOwn(t,"__proto__"))throw new TypeError(`"${e}.__proto__" is not allowed`)};function Jt(t,e=!0){if(t.destroyed)throw new Error("hash was destroyed");if(e&&t.finished)throw new Error("digest() was already called")}function rr(t,e){Se(t,void 0,"output");let r=e.outputLen;if(!(t.length>=r))throw new RangeError('"output" expected length >= '+r)}function Qt(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function mt(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}function le(t,e){return t<<32-e|t>>>e}var or=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",ds=Array.from({length:256},(t,e)=>e.toString(16).padStart(2,"0"));function Re(t){if(Se(t),or)return t.toHex();let e="";for(let r=0;r<t.length;r++)e+=ds[t[r]];return e}function nr(t){return t>=48&&t<=57?t-48:t>=65&&t<=70?t-55:t>=97&&t<=102?t-87:void 0}function en(t){if(typeof t!="string")throw new TypeError("hex string expected, got "+typeof t);if(or)try{return Uint8Array.fromHex(t)}catch(o){throw o instanceof SyntaxError?new RangeError(o.message):o}let e=t.length,r=e/2;if(e%2)throw new RangeError("hex string expected, got unpadded hex of length "+e);let n=new Uint8Array(r);for(let o=0,s=0;o<r;o++,s+=2){let i=nr(t.charCodeAt(s)),c=nr(t.charCodeAt(s+1));if(i===void 0||c===void 0){let f=t[s]+t[s+1];throw new RangeError('hex string expected, got non-hex character "'+f+'" at index '+s)}n[o]=i*16+c}return n}function sr(...t){let e=0;for(let n=0;n<t.length;n++){let o=t[n];Se(o),e+=o.length}let r=new Uint8Array(e);for(let n=0,o=0;n<t.length;n++){let s=t[n];r.set(s,o),o+=s.length}return r}function ls(t,e,r="opts"){return tr(t,"defaults"),e!==void 0&&tr(e,r),Object.assign(Object.create(null),t,e)}function ir(t,e={}){if(typeof t!="function")throw new TypeError('"hashCons" expected function, got type='+typeof t);e=ls({},e,"info");let r=(o,s)=>t(s).update(o).digest(),n=t(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.canXOF=n.canXOF,r.create=o=>t(o),Object.assign(r,e),Object.freeze(r)}function it(t=32){st(t,"bytesLength");let e=typeof globalThis=="object"?globalThis.crypto:null;if(typeof e?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");if(t>65536)throw new RangeError(`"bytesLength" expected <= 65536, got ${t}`);return e.getRandomValues(new Uint8Array(t))}var cr=t=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,t])});function fr(t,e,r){return t&e^~t&r}function ar(t,e,r){return t&e^t&r^e&r}var Et=class{constructor(e,r,n,o){m(this,"blockLen");m(this,"outputLen");m(this,"canXOF",!1);m(this,"padOffset");m(this,"isLE");m(this,"buffer");m(this,"view");m(this,"finished",!1);m(this,"length",0);m(this,"pos",0);m(this,"destroyed",!1);this.blockLen=e,this.outputLen=r,this.padOffset=n,this.isLE=o,this.buffer=new Uint8Array(e),this.view=mt(this.buffer)}update(e){Jt(this),Se(e);let{view:r,buffer:n,blockLen:o}=this,s=e.length,i=!1;for(let c=0;c<s;){let f=Math.min(o-this.pos,s-c);if(f===o){let a=mt(e);for(;o<=s-c;c+=o)this.process(a,c);i=!0;continue}n.set(c===0&&f===s?e:e.subarray(c,c+f),this.pos),this.pos+=f,c+=f,this.pos===o&&(this.process(r,0),this.pos=0,i=!0)}return this.length+=e.length,i&&this.roundClean(),this}digestInto(e){Jt(this),rr(e,this),this.finished=!0;let{buffer:r,view:n,blockLen:o,isLE:s}=this,{pos:i}=this;r[i++]=128,r.fill(0,i),this.padOffset>o-i&&(this.process(n,0),r.fill(0)),er(n,o-8,this.length*8,s),this.process(n,0),this.roundClean();let c=e===r?n:mt(e),f=this.outputLen,a=f/4,u=this.get();if(f%4||a>u.length)throw new Error("invalid outputLen");for(let d=0;d<a;d++)c.setUint32(4*d,u[d],s)}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}_cloneIntoMeta(e){let{buffer:r,length:n,finished:o,destroyed:s,pos:i}=this;return e.destroyed=s,e.finished=o,e.length=n,e.pos=i,i&&e.buffer.set(r),e}clone(){return this._cloneInto()}},ur=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var hs=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),Oe=new Uint32Array(64),tn=class extends Et{constructor(r,n){super(64,r,8,!1);m(this,"A",0);m(this,"B",0);m(this,"C",0);m(this,"D",0);m(this,"E",0);m(this,"F",0);m(this,"G",0);m(this,"H",0);this.A=n[0]|0,this.B=n[1]|0,this.C=n[2]|0,this.D=n[3]|0,this.E=n[4]|0,this.F=n[5]|0,this.G=n[6]|0,this.H=n[7]|0}get(){let{A:r,B:n,C:o,D:s,E:i,F:c,G:f,H:a}=this;return[r,n,o,s,i,c,f,a]}set(r,n,o,s,i,c,f,a){this.A=r|0,this.B=n|0,this.C=o|0,this.D=s|0,this.E=i|0,this.F=c|0,this.G=f|0,this.H=a|0}_cloneInto(r){return(r||(r=new this.constructor)).set(...this.get()),this._cloneIntoMeta(r)}process(r,n){for(let y=0;y<16;y++,n+=4)Oe[y]=r.getUint32(n,!1);for(let y=16;y<64;y++){let l=Oe[y-15],x=Oe[y-2],A=le(l,7)^le(l,18)^l>>>3,B=le(x,17)^le(x,19)^x>>>10;Oe[y]=B+Oe[y-7]+A+Oe[y-16]|0}let{A:o,B:s,C:i,D:c,E:f,F:a,G:u,H:d}=this;for(let y=0;y<64;y++){let l=le(f,6)^le(f,11)^le(f,25),x=d+l+fr(f,a,u)+hs[y]+Oe[y]|0,B=(le(o,2)^le(o,13)^le(o,22))+ar(o,s,i)|0;d=u,u=a,a=f,f=c+x|0,c=i,i=s,s=o,o=x+B|0}o=o+this.A|0,s=s+this.B|0,i=i+this.C|0,c=c+this.D|0,f=f+this.E|0,a=a+this.F|0,u=u+this.G|0,d=d+this.H|0,this.set(o,s,i,c,f,a,u,d)}roundClean(){Qt(Oe)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),Qt(this.buffer)}},nn=class extends tn{constructor(){super(32,ur)}};var $e=ir(()=>new nn,cr(1));function vt(t,e,r=()=>{}){if(!Array.isArray(t))throw new TypeError(`"${e}" expected array, got type=${typeof t}`);for(let n=0;n<t.length;n++)r(t[n],`${e}[${n}]`);return t}var se=(t,e,r)=>Se(t,e,r),rn=st;function Te(t,e="object"){if(t===null||typeof t!="object"||Array.isArray(t))throw new TypeError(e==="object"?"expected valid options object":`"${e}" expected object, got type=${typeof t}`);return t}function Ne(t,e){if(typeof t!="function")throw new TypeError(`"${e}" is invalid: expected function, got ${typeof t}`);return t}var lr=Re,Ze=(...t)=>sr(...t),hr=t=>en(t),At=wt,br=t=>it(t),Bt=BigInt(0),dr=BigInt(1),bs=t=>t?`"${t}" `:"";function Ie(t,e=""){if(typeof t!="boolean")throw new TypeError(bs(e)+"expected boolean, got type="+typeof t);return t}function ps(t){if(typeof t=="bigint"){if(!Le(t))throw new RangeError("positive bigint expected, got "+t)}else rn(t);return t}function St(t,e=""){if(typeof t!="number"){let r=e&&`"${e}" `;throw new TypeError(r+"expected number, got type="+typeof t)}if(!Number.isSafeInteger(t)){let r=e&&`"${e}" `;throw new RangeError(r+"expected safe integer, got "+t)}}function pr(t){if(typeof t!="string")throw new TypeError("hex string expected, got "+typeof t);return t===""?Bt:BigInt("0x"+t)}function Ue(t){return pr(Re(t))}function on(t){return pr(Re(cn(Se(t)).reverse()))}function Rt(t,e){if(st(e),e===0)throw new Error("zero output length is invalid");t=ps(t);let r=e*2,n=t.toString(16);if(n.length>r)throw new RangeError("number is too large");return en(n.padStart(r,"0"))}function sn(t,e){return Rt(t,e).reverse()}function cn(t){return Uint8Array.from(se(t))}function gr(t){if(typeof t!="string")throw new TypeError("ascii string expected, got "+typeof t);return Uint8Array.from(t,(e,r)=>{let n=e.charCodeAt(0);if(e.length!==1||n>127)throw new RangeError(`string contains non-ASCII character "${t[r]}" with code ${n} at position ${r}`);return n})}function Le(t){return typeof t=="bigint"&&Bt<=t}function fn(t,e,r){return Le(t)&&Le(e)&&Le(r)&&e<=t&&t<r}function xr(t,e,r,n){if(!fn(e,r,n))throw new RangeError("expected valid "+t+": "+r+" <= n < "+n+", got "+e)}function Pe(t){if(t<Bt)throw new Error("expected non-negative bigint, got "+t);return t===Bt?0:t.toString(2).length}var Ot=t=>(St(t,"n"),(dr<<BigInt(t))-dr);function Tt(t,e={},r={},n="object"){Te(t,n),Te(e,"fields"),Te(r,"optFields");function o(i,c,f){let a=n==="object"?`param "${String(i)}"`:`"${n}.${String(i)}"`,u=t[i];if(!Object.hasOwn(t,i)&&(f?u!==void 0:c!=="function"))throw new TypeError(`${a} is invalid: expected own property`);if(f&&u===void 0)return;let d=typeof u;if(d!==c||u===null)throw new TypeError(`${a} is invalid: expected ${c}, got ${d}`)}let s=(i,c)=>Object.entries(i).forEach(([f,a])=>o(f,a,c));s(e,!1),s(r,!0)}var Q=BigInt(0),X=BigInt(1),Ce=BigInt(2),Er=BigInt(3),an=BigInt(4),Br=BigInt(5),gs=BigInt(7),vr=BigInt(8),xs=BigInt(9),ys=BigInt(15),Ar=BigInt(16),ws=BigInt("0x10000000000000000");function he(t,e){if(e<=Q)throw new Error("mod: expected positive modulus, got "+e);let r=t%e;return r>=Q?r:e+r}function ms(t,e,r){if(r<=X)throw new Error("pow: expected modulus > 1, got "+r);if(typeof e!="bigint")throw new TypeError("invalid exponent: expected bigint, got "+typeof e);if(e<Q)throw new Error("invalid exponent, negatives unsupported");if(e===Q)return X;if(e===X)return t;let n=t%r;if(n<Q&&(n+=r),e<ws){let c=X;for(;e>Q;)e&X&&(c=c*n%r),n=n*n%r,e>>=X;return c}let o=[];for(;e>Q;)o.push(Number(e&ys)),e>>=an;let s=new Array(16);s[0]=X,s[1]=n;for(let c=2;c<16;c++)s[c]=s[c-1]*n%r;let i=s[o[o.length-1]];for(let c=o.length-2;c>=0;c--){i=i*i%r,i=i*i%r,i=i*i%r,i=i*i%r;let f=o[c];f!==0&&(i=i*s[f]%r)}return i}function ce(t,e,r){if(r<=X)throw new Error("pow2: expected modulus > 1, got "+r);if(e<Q)throw new Error("pow2: expected non-negative exponent, got "+e);let n=t;for(;e-- >Q;)n*=n,n%=r;return n}function yr(t,e){if(t===Q)throw new Error("invert: expected non-zero number");if(e<=X)throw new Error("invert: expected modulus > 1, got "+e);let r=he(t,e),n=e,o=Q,s=X;for(;r!==Q;){let c=n/r,f=n-r*c,a=o-s*c;n=r,r=f,o=s,s=a}if(n!==X)throw new Error("invert: does not exist");return he(o,e)}function un(t,e,r){let n=t;if(!n.eql(n.sqr(e),r))throw new Error("Cannot find square root")}function dn(t,e){if((t&X)===Q)throw new Error(e+": expected odd modulus, got "+t)}function Sr(t,e){let r=t,n=(r.ORDER+X)/an,o=r.pow(e,n);return un(r,o,e),o}function Es(t,e){let r=t,n=(r.ORDER-Br)/vr,o=r.mul(e,Ce),s=r.pow(o,n),i=r.mul(e,s),c=r.mul(r.mul(i,Ce),s),f=r.mul(i,r.sub(c,r.ONE));return un(r,f,e),f}function Bs(t){let e=Ke(t),r=Rr(t),n=r(e,e.neg(e.ONE)),o=r(e,n),s=r(e,e.neg(n)),i=(t+gs)/Ar;return((c,f)=>{let a=c,u=a.pow(f,i),d=a.mul(u,n),y=a.mul(u,o),l=a.mul(u,s),x=a.eql(a.sqr(d),f),A=a.eql(a.sqr(y),f);u=a.cmov(u,d,x),d=a.cmov(l,y,A);let B=a.eql(a.sqr(d),f),L=a.cmov(u,d,B);return un(a,L,f),L})}function Rr(t){if(t<Er)throw new Error("sqrt is not defined for small field");dn(t,"tonelliShanks");let e=t-X,r=0;for(;e%Ce===Q;)e/=Ce,r++;let n=Ce,o=Ke(t);for(;wr(o,n)===1;)if(n++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(r===1)return Sr;let s=o.pow(n,e),i=(e+X)/Ce;return function(f,a){let u=f;if(u.is0(a))return a;if(wr(u,a)!==1)throw new Error("Cannot find square root");let d=r,y=u.mul(u.ONE,s),l=u.pow(a,e),x=u.pow(a,i);for(;!u.eql(l,u.ONE);){if(u.is0(l))throw new Error("Cannot find square root: probably non-prime P");let A=1,B=u.sqr(l);for(;!u.eql(B,u.ONE);)if(A++,B=u.sqr(B),A===d)throw new Error("Cannot find square root");let L=X<<BigInt(d-A-1),D=u.pow(y,L);d=A,y=u.sqr(D),l=u.mul(l,y),x=u.mul(x,D)}return x}}function vs(t){return dn(t,"Fp.sqrt"),t%an===Er?Sr:t%vr===Br?Es:t%Ar===xs?Bs(t):Rr(t)}var As=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function Fe(t){if(Te(t,"field"),typeof t.ORDER!="bigint")throw new TypeError('param "ORDER" is invalid: expected bigint, got '+typeof t.ORDER);St(t.BYTES,"BYTES"),St(t.BITS,"BITS");for(let e of As)Ne(t[e],"field."+e);if(t.BYTES<1||t.BITS<1)throw new Error("invalid field: expected BYTES/BITS > 0");if(t.ORDER<=X)throw new Error("invalid field: expected ORDER > 1, got "+t.ORDER);return t}function ln(t,e,r=!1){Fe(t),vt(e,"nums"),Ie(r,"passZero");let n=t,o=new Array(e.length).fill(r?n.ZERO:void 0),s=e.reduce((c,f,a)=>n.is0(f)?c:(o[a]=c,n.mul(c,f)),n.ONE),i=n.inv(s);return e.reduceRight((c,f,a)=>n.is0(f)?c:(o[a]=n.mul(c,o[a]),n.mul(c,f)),i),o}function wr(t,e){Fe(t);let r=t;dn(r.ORDER,"FpLegendre");let n=(r.ORDER-X)/Ce,o=r.pow(e,n),s=r.eql(o,r.ONE),i=r.eql(o,r.ZERO),c=r.eql(o,r.neg(r.ONE));if(!s&&!i&&!c)throw new Error("invalid Legendre symbol result");return s?1:i?0:-1}function Ss(t,e){if(e!==void 0&&rn(e),t<=Q)throw new Error("invalid n length: expected positive n, got "+t);if(e!==void 0&&e<1)throw new Error("invalid n length: expected positive bit length, got "+e);let r=Pe(t);if(e!==void 0&&e<r)throw new Error(`invalid n length: expected nBitLength (${e}) >= bitLen(n) (${r})`);let n=e!==void 0?e:r,o=Math.ceil(n/8);return{nBitLength:n,nByteLength:o}}var mr=new WeakMap,Lt=class{constructor(e,r={}){m(this,"ORDER");m(this,"BITS");m(this,"BYTES");m(this,"isLE");m(this,"ZERO",Q);m(this,"ONE",X);m(this,"_lengths");m(this,"_mod");if(e<=X)throw new Error("invalid field: expected ORDER > 1, got "+e);let n;this.isLE=!1,r!=null&&typeof r=="object"&&(typeof r.BITS=="number"&&(n=r.BITS),typeof r.sqrt=="function"&&Object.defineProperty(this,"sqrt",{value:r.sqrt,enumerable:!0}),typeof r.isLE=="boolean"&&(this.isLE=r.isLE),r.allowedLengths&&(this._lengths=Object.freeze(r.allowedLengths.slice())),typeof r.modFromBytes=="boolean"&&(this._mod=r.modFromBytes));let{nBitLength:o,nByteLength:s}=Ss(e,n);if(s>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");this.ORDER=e,this.BITS=o,this.BYTES=s,Object.freeze(this)}create(e){return he(e,this.ORDER)}isValid(e){if(typeof e!="bigint")throw new TypeError("invalid field element: expected bigint, got "+typeof e);return Q<=e&&e<this.ORDER}is0(e){return e===Q}isValidNot0(e){return!this.is0(e)&&this.isValid(e)}isOdd(e){return(e&X)===X}neg(e){return he(-e,this.ORDER)}eql(e,r){return e===r}sqr(e){return he(e*e,this.ORDER)}add(e,r){return he(e+r,this.ORDER)}sub(e,r){return he(e-r,this.ORDER)}mul(e,r){return he(e*r,this.ORDER)}pow(e,r){return ms(e,r,this.ORDER)}div(e,r){return he(e*yr(r,this.ORDER),this.ORDER)}sqrN(e){return e*e}addN(e,r){return e+r}subN(e,r){return e-r}mulN(e,r){return e*r}inv(e){return yr(e,this.ORDER)}sqrt(e){let r=mr.get(this);return r||mr.set(this,r=vs(this.ORDER)),r(this,e)}toBytes(e){return this.isLE?sn(e,this.BYTES):Rt(e,this.BYTES)}fromBytes(e,r=!1){se(e);let{_lengths:n,BYTES:o,isLE:s,ORDER:i,_mod:c}=this;if(n){if(e.length<1||!n.includes(e.length)||e.length>o)throw new Error("Field.fromBytes: expected "+n+" bytes, got "+e.length);let a=new Uint8Array(o);a.set(e,s?0:a.length-e.length),e=a}if(e.length!==o)throw new Error("Field.fromBytes: expected "+o+" bytes, got "+e.length);let f=s?on(e):Ue(e);if(c&&(f=he(f,i)),!r&&!this.isValid(f))throw new Error("invalid field element: outside of range 0..ORDER");return f}invertBatch(e){return ln(this,e,!0)}cmov(e,r,n){return Ie(n,"condition"),n?r:e}};function Ke(t,e={}){return Object.freeze(Lt.prototype),new Lt(t,e)}function Or(t){if(typeof t!="bigint")throw new Error("field order must be bigint");if(t<=X)throw new Error("field order must be greater than 1");let e=Pe(t-X);return Math.ceil(e/8)}function Rs(t){let e=Or(t);return e+Math.ceil(e/2)}function Tr(t,e,r=!1){se(t);let n=t.length,o=Or(e),s=Math.max(Rs(e),16);if(n<s||n>1024)throw new Error("expected "+s+"-1024 bytes of input, got "+n);let i=r?on(t):Ue(t),c=he(i,e-X)+X;return r?sn(c,o):Rt(c,o)}var pn=BigInt(0),ct=BigInt(1),Os=BigInt(4),hn=16,Lr=128,Ts=5,Ir=2**31;function Ut(t){let e=t;if(typeof e!="function")throw new TypeError('"Point" expected constructor, got type='+typeof t);Ne(e.fromAffine,"Point.fromAffine"),Ne(e.fromBytes,"Point.fromBytes"),Ne(e.fromHex,"Point.fromHex"),Te(e.BASE,"Point.BASE"),Te(e.ZERO,"Point.ZERO"),Fe(e.Fp),Fe(e.Fn)}function _r(t,e){Ut(t),Hr(e,t);let r=ln(t.Fp,e.map(n=>n.Z));return e.map((n,o)=>t.fromAffine(n.toAffine(r[o])))}function Ls(t,e,r=1){if(!Number.isSafeInteger(t)||t<r||t>e)throw new Error("invalid window size, expected ["+r+".."+e+"], got W="+t)}function Is(t,e){let r=t*(4*e+128);if(r>Ir)throw new Error("invalid window size: table would need ~"+Math.ceil(r/2**20)+" MiB, max "+Ir/2**20+" MiB")}function kr(t,e){if(t!==void 0){Ne(t,"randomBytes");try{let r=t(e);if(!At(r)||r.length!==e)return}catch{return}return t}}function Hr(t,e){vt(t,"points"),t.forEach((r,n)=>{if(!(r instanceof e))throw new Error("invalid point at index "+n)})}function Us(t,e,r){if(!Array.isArray(t))throw new Error("array of scalars expected");t.forEach((n,o)=>{if(!(r===void 0?e.isValid(n):Le(n)&&n<r))throw new Error("invalid scalar at index "+o)})}var Nr=new WeakMap;function bn(t){return Nr.get(t)||1}function _s(t,e){let r=t.double(),n=[t];for(let o=1;o<e;o++)n.push(n[o-1].add(r));return n}function ks(t,e){let r=2**e,n=r/2,o=BigInt(r-1),s=[];for(;t>pn;){let i=0;t&ct&&(i=Number(t&o),i>=n&&(i-=r),t-=BigInt(i)),s.push(i),t>>=ct}return s}function Hs(t,e,r){let n=2**e,o=n/2,s=BigInt(n-1),i=BigInt(e),c=[];for(let f=0;f<r;f++){let a=Number(t&s);t>>=i,a>o&&(a-=n,t+=ct),c.push(a)}if(t!==pn)throw new Error("invalid wnaf");return c}function Ns(t,e,r){let n=0;for(let s of r)n=Math.max(n,s.length);let o=t;for(let s=n-1;s>=0;s--){s!==n-1&&(o=o.double());for(let i=0;i<r.length;i++){let c=r[i][s];if(c){let f=e[i][Math.abs(c)-1>>1];o=o.add(c<0?f.negate():f)}}}return o}var It=class{constructor(e,r){m(this,"Point");m(this,"BASE");m(this,"ZERO");m(this,"randomBytes");m(this,"wnafPrecomputes",new WeakMap);m(this,"baseCanBeBlinded");m(this,"bits");Ut(e),this.randomBytes=kr(r,hn),this.Point=e,this.BASE=e.BASE,this.ZERO=e.ZERO,this.bits=e.Fn.BITS}buildWnafTable(e,r,n){let o=Math.ceil(n/r)+1,s=2**(r-1),i=[],c=e;for(let f=0;f<o;f++){let a=c;for(let u=0;u<s;u++)i.push(a),a=a.add(c);c=i[i.length-1].double()}return{W:r,bits:n,windows:o,comp:i}}wnafCachedCT(e,r){let{W:n,windows:o,comp:s}=e,i=2**(n-1),c=Hs(r,n,o),f=this.ZERO,a=this.BASE;for(let u=0;u<o;u++){let d=c[u],y=u*i,l=Math.abs(d)-1,x=s[y];for(let B=1;B<i;B++)x=B===l?s[y+B]:x;let A=x.negate();d===0?a=a.add(s[y]):f=f.add(d<0?A:x)}return{p:f,f:a}}getWnafPrecomputes(e,r,n,o){let s=this.wnafPrecomputes.get(r),i=s?.find(c=>c.W===e&&c.bits===n);return i||(i=this.buildWnafTable(r,e,n),typeof o=="function"&&(i={...i,comp:o(i.comp)}),s||(s=[],this.wnafPrecomputes.set(r,s)),s.push(i)),i}assertPoint(e){if(!(e instanceof this.Point))throw new TypeError('"point" expected Point instance, got type='+typeof e)}validateMulInput(e,r){if(this.assertPoint(e),!fn(r,ct,this.Point.Fn.ORDER))throw new Error("invalid scalar")}runCT(e,r,n,o){let s=bn(e);return s===1?this.fixedWindowCT(e,r,n):this.wnafCachedCT(this.getWnafPrecomputes(s,e,n,o),r)}mulCT(e,r,n){return this.validateMulInput(e,r),this.runCT(e,r,this.bits,n)}mulCTBlinded(e,r,n){if(this.validateMulInput(e,r),this.randomBytes===void 0)throw new Error("randomBytes is required for scalar blinding");let o=this.Point.Fn.BITS+Lr,s=this.randomBytes(hn);if(!At(s)||s.length!==hn)throw new Error("randomBytes returned invalid byte array");s[0]=s[0]&63|128;let i=r+Ue(s)*this.Point.Fn.ORDER;return this.runCT(e,i,o,n)}fixedWindowCT(e,r,n){let o=Ts,s=1<<o,i=Ot(o),c=new Array(s);c[0]=this.ZERO;for(let u=1;u<s;u++)c[u]=c[u-1].add(e);let f=Math.ceil(n/o),a=this.ZERO;for(let u=f-1;u>=0;u--){if(u!==f-1)for(let l=0;l<o;l++)a=a.double();let d=Number(r>>BigInt(u*o)&i),y=c[0];for(let l=1;l<s;l++)y=l===d?c[l]:y;a=a.add(y)}return{p:a,f:a}}shouldBlind(e,r){return this.randomBytes===void 0?!1:r===ct?!0:e!==this.BASE?!1:(this.baseCanBeBlinded===void 0&&(this.baseCanBeBlinded=this.mulUnsafe(this.BASE,this.Point.Fn.ORDER).is0()),this.baseCanBeBlinded)}mulSecret(e,r,n,o){return this.shouldBlind(e,n)?this.mulCTBlinded(e,r,o):this.mulCT(e,r,o)}mulUnsafe(e,r,n){if(this.assertPoint(e),!Le(r))throw new Error("invalid scalar");let o=bn(e);if(o===1||r>=this.Point.Fn.ORDER)return _t(this.Point,[e],[r],!0);let s=this.getWnafPrecomputes(o,e,this.bits,n);return this.wnafCachedCT(s,r).p}setWindowSize(e,r){this.assertPoint(e),Ls(r,this.bits);let n=Math.ceil((this.bits+Lr)/r)+1;Is(n*2**(r-1),this.Point.Fp.BYTES),Nr.set(e,r),this.wnafPrecomputes.delete(e)}hasWindowSize(e){return bn(e)!==1}};function _t(t,e,r,n=!1){if(Ut(t),Hr(e,t),Ie(n,"allowOversized"),Us(r,t.Fn,n?t.Fn.ORDER**Os:void 0),e.length!==r.length)throw new Error("arrays of points and scalars must have equal length");let o=e.map(i=>_s(i,4)),s=r.map(i=>ks(i,4));return Ns(t.ZERO,o,s)}function Ur(t,e,r){if(e){if(e.ORDER!==t)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return Fe(e),e}else return Ke(t,{isLE:r})}function Cr(t,e,r={},n){if(t!=="weierstrass"&&t!=="edwards")throw new Error('expected curve type "weierstrass" or "edwards"');if(n===void 0&&(n=t==="edwards"),!e||typeof e!="object")throw new Error(`expected valid ${t} CURVE object`);Tt(r);for(let f of["p","n","h"]){let a=e[f];if(!(Le(a)&&a!==pn))throw new Error(`CURVE.${f} must be positive bigint`)}let o=Ur(e.p,r.Fp,n),s=Ur(e.n,r.Fn,n),c=["Gx","Gy","a",t==="weierstrass"?"b":"d"];for(let f of c)if(!o.isValid(e[f]))throw new Error(`CURVE.${f} must be valid field element of CURVE.Fp`);return e=Object.freeze(Object.assign({},e)),{CURVE:e,Fp:o,Fn:s}}function gn(t,e){return function(n){let o=t(n);return{secretKey:o,publicKey:e(o)}}}var qr=(t,e)=>(t+(t>=0?e:-e)/qs)/e;function Cs(t,e,r){xr("scalar",t,ze,r);let[[n,o],[s,i]]=e,c=qr(i*t,r),f=qr(-o*t,r),a=t-c*n-f*s,u=-c*o-f*i,d=a<ze,y=u<ze;d&&(a=-a),y&&(u=-u);let l=Ot(Math.ceil(Pe(r)/2))+ft;if(a<ze||a>=l||u<ze||u>=l)throw new Error("splitScalar (endomorphism): failed for k");return{k1neg:d,k1:a,k2neg:y,k2:u}}var ze=BigInt(0),ft=BigInt(1),qs=BigInt(2),xn=BigInt(3),Ds=BigInt(4);function Dr(t,e={}){let r=Cr("weierstrass",t,e),n=r.Fp,o=r.Fn,s=r.CURVE,{h:i,n:c}=s;Tt(e,{},{allowInfinityPoint:"boolean",clearCofactor:"function",isTorsionFree:"function",fromBytes:"function",toBytes:"function",endo:"object",randomBytes:"function"});let{endo:f,allowInfinityPoint:a,clearCofactor:u,isTorsionFree:d,fromBytes:y,toBytes:l}=e,x=e.randomBytes===void 0?br:e.randomBytes;if(f&&(!n.is0(s.a)||typeof f.beta!="bigint"||!Array.isArray(f.basises)))throw new Error('invalid endo: expected "beta": bigint and "basises": array');let A=f?{beta:f.beta,basises:f.basises.map(w=>[...w])}:void 0,B=js(n,o);function L(){if(!n.isOdd)throw new Error("compression is not supported: Field does not have .isOdd()")}function D(w,g,E){if(g.is0()){if(!a)throw new Error("bad point: ZERO");return Uint8Array.of(0)}let{x:I,y:_}=g.toAffine(),T=n.toBytes(I);if(Ie(E,"isCompressed"),E){L();let k=!n.isOdd(_);return Ze(Ms(k),T)}else return Ze(Uint8Array.of(4),T,n.toBytes(_))}function P(w){se(w,void 0,"Point");let{publicKey:g,publicKeyUncompressed:E}=B,I=w.length,_=w[0],T=w.subarray(1);if(a&&I===1&&_===0)return{x:n.ZERO,y:n.ZERO};if(I===g&&(_===2||_===3)){let k=n.fromBytes(T);if(!n.isValid(k))throw new Error("bad point: is not on curve, wrong x");let q=Y(k),U;try{U=n.sqrt(q)}catch(J){let ne=J instanceof Error?": "+J.message:"";throw new Error("bad point: is not on curve, sqrt error"+ne)}L();let V=n.isOdd(U);return(_&1)===1!==V&&(U=n.neg(U)),{x:k,y:U}}else if(I===E&&_===4){let k=n.BYTES,q=n.fromBytes(T.subarray(0,k)),U=n.fromBytes(T.subarray(k,k*2));if(!$(q,U))throw new Error("bad point: is not on curve");return{x:q,y:U}}else throw new Error(`bad point: got length ${I}, expected compressed=${g} or uncompressed=${E}`)}let j=l===void 0?D:l,G=y===void 0?P:y,K=n.mul(s.b,xn),z=n.is0(s.a)?w=>n.ZERO:w=>n.mul(s.a,w);function Y(w){let g=n.sqr(w),E=n.mul(g,w);return n.add(n.add(E,n.mul(w,s.a)),s.b)}function $(w,g){let E=n.sqr(g),I=Y(w);return n.eql(E,I)}if(!$(s.Gx,s.Gy))throw new Error("bad curve params: generator point");let F=n.mul(n.pow(s.a,xn),Ds),M=n.mul(n.sqr(s.b),BigInt(27));if(n.is0(n.add(F,M)))throw new Error("bad curve params: a or b");function C(w,g,E=!1){if(!n.isValid(g)||E&&n.is0(g))throw new Error(`bad point coordinate ${w}`);return typeof g=="object"&&g!==null?n.create(g):g}function H(w){if(!(w instanceof S))throw new Error("Weierstrass Point expected")}function h(w){if(!A||!A.basises)throw new Error("no endo");return Cs(w,A.basises,o.ORDER)}function b(w,g,E,I){if(!o.isValid(I))throw new RangeError("invalid scalar: out of range");if(A){let{k1neg:_,k1:T,k2neg:k,k2:q}=h(I),U=new S(n.mul(E.X,A.beta),E.Y,E.Z);w.push(_?E.negate():E,k?U.negate():U),g.push(T,q)}else w.push(E),g.push(I)}let v=new WeakSet,R=class R{constructor(g,E,I){m(this,"X");m(this,"Y");m(this,"Z");this.X=C("x",g),this.Y=C("y",E,!0),this.Z=C("z",I),Object.freeze(this)}static CURVE(){return s}static fromAffine(g){let{x:E,y:I}=g||{};if(!g||!n.isValid(E)||!n.isValid(I))throw new Error("invalid affine point");if(g instanceof R)throw new Error("projective point not allowed");return n.is0(E)&&n.is0(I)?R.ZERO:new R(E,I,n.ONE)}static fromBytes(g){let E=R.fromAffine(G(se(g,void 0,"point")));return E.assertValidity(),E}static fromHex(g){return R.fromBytes(hr(g))}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(g=6,E=!0){return p.setWindowSize(this,g),E||this.multiply(xn),this}assertValidity(){let g=this;if(g.is0()){if(a&&n.is0(g.X)&&n.eql(g.Y,n.ONE)&&n.is0(g.Z))return;throw new Error("bad point: ZERO")}if(v.has(g))return;let{x:E,y:I}=g.toAffine();if(!n.isValid(E)||!n.isValid(I))throw new Error("bad point: x or y not field elements");if(!$(E,I))throw new Error("bad point: equation left != right");if(!g.isTorsionFree())throw new Error("bad point: not in prime-order subgroup");v.add(g)}hasEvenY(){let{y:g}=this.toAffine();if(!n.isOdd)throw new Error("Field doesn't support isOdd");return!n.isOdd(g)}equals(g){H(g);let{X:E,Y:I,Z:_}=this,{X:T,Y:k,Z:q}=g,U=n.eql(n.mul(E,q),n.mul(T,_)),V=n.eql(n.mul(I,q),n.mul(k,_));return U&&V}negate(){return new R(this.X,n.neg(this.Y),this.Z)}double(){let{X:g,Y:E,Z:I}=this,_=n.ZERO,T=n.ZERO,k=n.ZERO,q=n.mul(g,g),U=n.mul(E,E),V=n.mul(I,I),Z=n.mul(g,E);return Z=n.add(Z,Z),k=n.mul(g,I),k=n.add(k,k),_=z(k),T=n.mul(K,V),T=n.add(_,T),_=n.sub(U,T),T=n.add(U,T),T=n.mul(_,T),_=n.mul(Z,_),k=n.mul(K,k),V=z(V),Z=n.sub(q,V),Z=z(Z),Z=n.add(Z,k),k=n.add(q,q),q=n.add(k,q),q=n.add(q,V),q=n.mul(q,Z),T=n.add(T,q),V=n.mul(E,I),V=n.add(V,V),q=n.mul(V,Z),_=n.sub(_,q),k=n.mul(V,U),k=n.add(k,k),k=n.add(k,k),new R(_,T,k)}add(g){H(g);let{X:E,Y:I,Z:_}=this,{X:T,Y:k,Z:q}=g,U=n.ZERO,V=n.ZERO,Z=n.ZERO,J=n.mul(E,T),ne=n.mul(I,k),de=n.mul(_,q),Ve=n.add(E,I),oe=n.add(T,k);Ve=n.mul(Ve,oe),oe=n.add(J,ne),Ve=n.sub(Ve,oe),oe=n.add(E,_);let ge=n.add(T,q);return oe=n.mul(oe,ge),ge=n.add(J,de),oe=n.sub(oe,ge),ge=n.add(I,_),U=n.add(k,q),ge=n.mul(ge,U),U=n.add(ne,de),ge=n.sub(ge,U),Z=z(oe),U=n.mul(K,de),Z=n.add(U,Z),U=n.sub(ne,Z),Z=n.add(ne,Z),V=n.mul(U,Z),ne=n.add(J,J),ne=n.add(ne,J),de=z(de),oe=n.mul(K,oe),ne=n.add(ne,de),de=n.sub(J,de),de=z(de),oe=n.add(oe,de),J=n.mul(ne,oe),V=n.add(V,J),J=n.mul(ge,oe),U=n.mul(Ve,U),U=n.sub(U,J),J=n.mul(Ve,ne),Z=n.mul(ge,Z),Z=n.add(Z,J),new R(U,V,Z)}subtract(g){return H(g),this.add(g.negate())}is0(){return this.equals(R.ZERO)}multiply(g){if(!o.isValidNot0(g))throw new RangeError("invalid scalar: out of range");let{p:E,f:I}=p.mulSecret(this,g,i,O);return O([E,I])[0]}multiplyUnsafe(g){let E=this,I=g;if(!o.isValid(I))throw new RangeError("invalid scalar: out of range");if(I===ze||E.is0())return R.ZERO;if(I===ft)return E;if(p.hasWindowSize(this))return p.mulUnsafe(E,I,O);let _=[],T=[];return b(_,T,E,I),_t(R,_,T)}mulAddUnsafe(g,E,I){H(E);let _=[],T=[];return b(_,T,this,g),b(_,T,E,I),_t(R,_,T)}toAffine(g){let E=this,I=g;if(I!=null&&!n.isValid(I))throw new RangeError('"invertedZ" expected valid field element');let{X:_,Y:T,Z:k}=E;if(n.eql(k,n.ONE))return{x:_,y:T};let q=E.is0();I==null&&(I=q?n.ONE:n.inv(k));let U=n.mul(_,I),V=n.mul(T,I),Z=n.mul(k,I);if(q)return{x:n.ZERO,y:n.ZERO};if(!n.eql(Z,n.ONE))throw new Error("invZ was invalid");return{x:U,y:V}}isTorsionFree(){return i===ft?!0:d?d(R,this):p.mulUnsafe(this,c).is0()}clearCofactor(){return i===ft?this:u?u(R,this):this.multiplyUnsafe(i)}isSmallOrder(){return i===ft?this.is0():this.clearCofactor().is0()}toBytes(g=!0){return Ie(g,"isCompressed"),this.assertValidity(),j(R,this,g)}toHex(g=!0){return lr(this.toBytes(g))}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}};m(R,"BASE",new R(s.Gx,s.Gy,n.ONE)),m(R,"ZERO",new R(n.ZERO,n.ONE,n.ZERO)),m(R,"Fp",n),m(R,"Fn",o);let S=R,O=w=>_r(S,w),p=new It(S,x);return p.bits>=6&&S.BASE.precompute(6),Object.freeze(S.prototype),Object.freeze(S),S}function Ms(t){return Uint8Array.of(t?2:3)}function js(t,e){return{secretKey:e.BYTES,publicKey:1+t.BYTES,publicKeyUncompressed:1+2*t.BYTES,publicKeyHasPrefix:!0,signature:2*e.BYTES}}var Ht={p:BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f"),n:BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"),h:BigInt(1),a:BigInt(0),b:BigInt(7),Gx:BigInt("0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"),Gy:BigInt("0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8")},Vs={beta:BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),basises:[[BigInt("0x3086d221a7d46bcde86c90e49284eb15"),-BigInt("0xe4437ed6010e88286f547fa90abfe4c3")],[BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"),BigInt("0x3086d221a7d46bcde86c90e49284eb15")]]},$s=BigInt(0),Mr=BigInt(2);function Zs(t){let e=Ht.p,r=BigInt(3),n=BigInt(6),o=BigInt(11),s=BigInt(22),i=BigInt(23),c=BigInt(44),f=BigInt(88),a=t*t*t%e,u=a*a*t%e,d=ce(u,r,e)*u%e,y=ce(d,r,e)*u%e,l=ce(y,Mr,e)*a%e,x=ce(l,o,e)*l%e,A=ce(x,s,e)*x%e,B=ce(A,c,e)*A%e,L=ce(B,f,e)*B%e,D=ce(L,c,e)*A%e,P=ce(D,r,e)*u%e,j=ce(P,i,e)*x%e,G=ce(j,n,e)*a%e,K=ce(G,Mr,e);if(!We.eql(We.sqr(K),t))throw new Error("Cannot find square root");return K}var We=Ke(Ht.p,{sqrt:Zs}),Ge=Dr(Ht,{Fp:We,endo:Vs});var jr=Object.create(null);function kt(t,...e){let r=jr[t];if(r===void 0){let n=$e(gr(t));r=Ze(n,n),jr[t]=r}return $e(Ze(r,...e))}var $r=t=>t.toBytes(!0).slice(1),Zr=({x:t})=>We.toBytes(t),Nt=t=>!We.isOdd(t);function Pr(t){let{Fn:e,BASE:r}=Ge,n=e.fromBytes(se(t,32,"secretKey")),s=r.multiply(n).toAffine();return{scalar:Nt(s.y)?n:e.neg(n),bytes:Zr(s)}}function Fr(t){let e=We;if(!e.isValidNot0(t))throw new Error("invalid x: Fail if x \u2265 p");let r=e.sqr(t),n=e.add(e.mulN(r,t),BigInt(7)),o=e.sqrt(n);Nt(o)||(o=e.neg(o));let s=Ge.fromAffine({x:t,y:o});return s.assertValidity(),s}var Ye=Ue;function Kr(...t){return Ge.Fn.create(Ye(kt("BIP0340/challenge",...t)))}function Vr(t){return Pr(t).bytes}function Ps(t,e,r=it(32)){let{Fn:n,BASE:o}=Ge,s=cn(se(t,void 0,"message")),{bytes:i,scalar:c}=Pr(e),f=se(r,32,"auxRand"),a=n.toBytes(c^Ye(kt("BIP0340/aux",f))),u=kt("BIP0340/nonce",a,i,s),d=n.create(Ye(u));if(d===$s)throw new Error("sign failed: k is zero");let l=o.multiply(d).toAffine(),x=Nt(l.y)?d:n.neg(d),A=Zr(l),B=Kr(A,i,s),L=new Uint8Array(64);if(L.set(A,0),L.set(n.toBytes(n.create(x+B*c)),32),!zr(L,s,i))throw new Error("sign: Invalid signature produced");return L}function zr(t,e,r){let{Fp:n,Fn:o,BASE:s}=Ge,i=se(t,64,"signature"),c=se(e,void 0,"message"),f=se(r,32,"publicKey");try{let a=Fr(Ye(f)),u=i.subarray(0,32),d=Ye(u);if(!n.isValidNot0(d))return!1;let y=Ye(i.subarray(32,64));if(!o.isValidNot0(y))return!1;let l=Kr(u,$r(a),c),x=s.mulAddUnsafe(y,a,o.neg(l)),{x:A,y:B}=x.toAffine();return!(x.is0()||!Nt(B)||!n.eql(A,d))}catch{return!1}}var at=(()=>{let r=n=>(n=n===void 0?it(48):n,Tr(se(n,48,"seed"),Ht.n));return Object.freeze({keygen:gn(r,Vr),getPublicKey:Vr,sign:Ps,verify:zr,Point:Ge,utils:Object.freeze({randomSecretKey:r,taggedHash:kt,lift_x:Fr,pointToBytes:$r}),lengths:Object.freeze({secretKey:32,publicKey:32,publicKeyHasPrefix:!1,signature:64,seed:48})})})();function Fs(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"}function Ct(t){if(typeof t!="boolean")throw new Error(`boolean expected, not ${t}`)}function qt(t){if(!Number.isSafeInteger(t)||t<0)throw new Error("positive integer expected, got "+t)}function ee(t,e,r=""){let n=Fs(t),o=t?.length,s=e!==void 0;if(!n||s&&o!==e){let i=r&&`"${r}" `,c=s?` of length ${e}`:"",f=n?`length=${o}`:`type=${typeof t}`;throw new Error(i+"expected Uint8Array"+c+", got "+f)}return t}function yn(t,e=!0){if(t.destroyed)throw new Error("Hash instance has been destroyed");if(e&&t.finished)throw new Error("Hash#digest() has already been called")}function Yr(t,e){ee(t,void 0,"output");let r=e.outputLen;if(t.length<r)throw new Error("digestInto() expects output buffer of length at least "+r)}function xe(t){return new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4))}function ye(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function Ks(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}var zs=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function Wr(t,e){if(e==null||typeof e!="object")throw new Error("options must be defined");return Object.assign(t,e)}function Dt(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t[n]^e[n];return r===0}var wn=(t,e)=>{function r(n,...o){if(ee(n,void 0,"key"),!zs)throw new Error("Non little-endian hardware is not yet supported");if(t.nonceLength!==void 0){let u=o[0];ee(u,t.varSizeNonce?void 0:t.nonceLength,"nonce")}let s=t.tagLength;s&&o[1]!==void 0&&ee(o[1],void 0,"AAD");let i=e(n,...o),c=(u,d)=>{if(d!==void 0){if(u!==2)throw new Error("cipher output not supported");ee(d,void 0,"output")}},f=!1;return{encrypt(u,d){if(f)throw new Error("cannot encrypt() twice with same key + nonce");return f=!0,ee(u),c(i.encrypt.length,d),i.encrypt(u,d)},decrypt(u,d){if(ee(u),s&&u.length<s)throw new Error('"ciphertext" expected length bigger than tagLength='+s);return c(i.decrypt.length,d),i.decrypt(u,d)}}}return Object.assign(r,t),r};function mn(t,e,r=!0){if(e===void 0)return new Uint8Array(t);if(e.length!==t)throw new Error('"output" expected Uint8Array of length '+t+", got: "+e.length);if(r&&!Ys(e))throw new Error("invalid output, must be aligned");return e}function Gr(t,e,r){Ct(r);let n=new Uint8Array(16),o=Ks(n);return o.setBigUint64(0,BigInt(e),r),o.setBigUint64(8,BigInt(t),r),n}function Ys(t){return t.byteOffset%4===0}function Xe(t){return Uint8Array.from(t)}var Jr=t=>Uint8Array.from(t.split(""),e=>e.charCodeAt(0)),Ws=Jr("expand 16-byte k"),Gs=Jr("expand 32-byte k"),Xs=xe(Ws),Js=xe(Gs);function N(t,e){return t<<e|t>>>32-e}function En(t){return t.byteOffset%4===0}var Mt=64,Qs=16,Qr=2**32-1,Xr=Uint32Array.of();function ei(t,e,r,n,o,s,i,c){let f=o.length,a=new Uint8Array(Mt),u=xe(a),d=En(o)&&En(s),y=d?xe(o):Xr,l=d?xe(s):Xr;for(let x=0;x<f;i++){if(t(e,r,n,u,i,c),i>=Qr)throw new Error("arx: counter overflow");let A=Math.min(Mt,f-x);if(d&&A===Mt){let B=x/4;if(x%4!==0)throw new Error("arx: invalid block position");for(let L=0,D;L<Qs;L++)D=B+L,l[D]=y[D]^u[L];x+=Mt;continue}for(let B=0,L;B<A;B++)L=x+B,s[L]=o[L]^a[B];x+=A}}function Bn(t,e){let{allowShortKeys:r,extendNonceFn:n,counterLength:o,counterRight:s,rounds:i}=Wr({allowShortKeys:!1,counterLength:8,counterRight:!1,rounds:20},e);if(typeof t!="function")throw new Error("core must be a function");return qt(o),qt(i),Ct(s),Ct(r),(c,f,a,u,d=0)=>{ee(c,void 0,"key"),ee(f,void 0,"nonce"),ee(a,void 0,"data");let y=a.length;if(u===void 0&&(u=new Uint8Array(y)),ee(u,void 0,"output"),qt(d),d<0||d>=Qr)throw new Error("arx: counter overflow");if(u.length<y)throw new Error(`arx: output (${u.length}) is shorter than data (${y})`);let l=[],x=c.length,A,B;if(x===32)l.push(A=Xe(c)),B=Js;else if(x===16&&r)A=new Uint8Array(32),A.set(c),A.set(c,16),B=Xs,l.push(A);else throw ee(c,32,"arx key"),new Error("invalid key size");En(f)||l.push(f=Xe(f));let L=xe(A);if(n){if(f.length!==24)throw new Error("arx: extended nonce must be 24 bytes");n(B,L,xe(f.subarray(0,16)),L),f=f.subarray(16)}let D=16-o;if(D!==f.length)throw new Error(`arx: nonce must be ${D} or 16 bytes`);if(D!==12){let j=new Uint8Array(12);j.set(f,s?0:12-f.length),f=j,l.push(f)}let P=xe(f);return ei(t,B,L,P,a,u,d,i),ye(...l),u}}function te(t,e){return t[e++]&255|(t[e++]&255)<<8}var vn=class{constructor(e){m(this,"blockLen",16);m(this,"outputLen",16);m(this,"buffer",new Uint8Array(16));m(this,"r",new Uint16Array(10));m(this,"h",new Uint16Array(10));m(this,"pad",new Uint16Array(8));m(this,"pos",0);m(this,"finished",!1);e=Xe(ee(e,32,"key"));let r=te(e,0),n=te(e,2),o=te(e,4),s=te(e,6),i=te(e,8),c=te(e,10),f=te(e,12),a=te(e,14);this.r[0]=r&8191,this.r[1]=(r>>>13|n<<3)&8191,this.r[2]=(n>>>10|o<<6)&7939,this.r[3]=(o>>>7|s<<9)&8191,this.r[4]=(s>>>4|i<<12)&255,this.r[5]=i>>>1&8190,this.r[6]=(i>>>14|c<<2)&8191,this.r[7]=(c>>>11|f<<5)&8065,this.r[8]=(f>>>8|a<<8)&8191,this.r[9]=a>>>5&127;for(let u=0;u<8;u++)this.pad[u]=te(e,16+2*u)}process(e,r,n=!1){let o=n?0:2048,{h:s,r:i}=this,c=i[0],f=i[1],a=i[2],u=i[3],d=i[4],y=i[5],l=i[6],x=i[7],A=i[8],B=i[9],L=te(e,r+0),D=te(e,r+2),P=te(e,r+4),j=te(e,r+6),G=te(e,r+8),K=te(e,r+10),z=te(e,r+12),Y=te(e,r+14),$=s[0]+(L&8191),F=s[1]+((L>>>13|D<<3)&8191),M=s[2]+((D>>>10|P<<6)&8191),C=s[3]+((P>>>7|j<<9)&8191),H=s[4]+((j>>>4|G<<12)&8191),h=s[5]+(G>>>1&8191),b=s[6]+((G>>>14|K<<2)&8191),v=s[7]+((K>>>11|z<<5)&8191),S=s[8]+((z>>>8|Y<<8)&8191),O=s[9]+(Y>>>5|o),p=0,R=p+$*c+F*(5*B)+M*(5*A)+C*(5*x)+H*(5*l);p=R>>>13,R&=8191,R+=h*(5*y)+b*(5*d)+v*(5*u)+S*(5*a)+O*(5*f),p+=R>>>13,R&=8191;let w=p+$*f+F*c+M*(5*B)+C*(5*A)+H*(5*x);p=w>>>13,w&=8191,w+=h*(5*l)+b*(5*y)+v*(5*d)+S*(5*u)+O*(5*a),p+=w>>>13,w&=8191;let g=p+$*a+F*f+M*c+C*(5*B)+H*(5*A);p=g>>>13,g&=8191,g+=h*(5*x)+b*(5*l)+v*(5*y)+S*(5*d)+O*(5*u),p+=g>>>13,g&=8191;let E=p+$*u+F*a+M*f+C*c+H*(5*B);p=E>>>13,E&=8191,E+=h*(5*A)+b*(5*x)+v*(5*l)+S*(5*y)+O*(5*d),p+=E>>>13,E&=8191;let I=p+$*d+F*u+M*a+C*f+H*c;p=I>>>13,I&=8191,I+=h*(5*B)+b*(5*A)+v*(5*x)+S*(5*l)+O*(5*y),p+=I>>>13,I&=8191;let _=p+$*y+F*d+M*u+C*a+H*f;p=_>>>13,_&=8191,_+=h*c+b*(5*B)+v*(5*A)+S*(5*x)+O*(5*l),p+=_>>>13,_&=8191;let T=p+$*l+F*y+M*d+C*u+H*a;p=T>>>13,T&=8191,T+=h*f+b*c+v*(5*B)+S*(5*A)+O*(5*x),p+=T>>>13,T&=8191;let k=p+$*x+F*l+M*y+C*d+H*u;p=k>>>13,k&=8191,k+=h*a+b*f+v*c+S*(5*B)+O*(5*A),p+=k>>>13,k&=8191;let q=p+$*A+F*x+M*l+C*y+H*d;p=q>>>13,q&=8191,q+=h*u+b*a+v*f+S*c+O*(5*B),p+=q>>>13,q&=8191;let U=p+$*B+F*A+M*x+C*l+H*y;p=U>>>13,U&=8191,U+=h*d+b*u+v*a+S*f+O*c,p+=U>>>13,U&=8191,p=(p<<2)+p|0,p=p+R|0,R=p&8191,p=p>>>13,w+=p,s[0]=R,s[1]=w,s[2]=g,s[3]=E,s[4]=I,s[5]=_,s[6]=T,s[7]=k,s[8]=q,s[9]=U}finalize(){let{h:e,pad:r}=this,n=new Uint16Array(10),o=e[1]>>>13;e[1]&=8191;for(let c=2;c<10;c++)e[c]+=o,o=e[c]>>>13,e[c]&=8191;e[0]+=o*5,o=e[0]>>>13,e[0]&=8191,e[1]+=o,o=e[1]>>>13,e[1]&=8191,e[2]+=o,n[0]=e[0]+5,o=n[0]>>>13,n[0]&=8191;for(let c=1;c<10;c++)n[c]=e[c]+o,o=n[c]>>>13,n[c]&=8191;n[9]-=8192;let s=(o^1)-1;for(let c=0;c<10;c++)n[c]&=s;s=~s;for(let c=0;c<10;c++)e[c]=e[c]&s|n[c];e[0]=(e[0]|e[1]<<13)&65535,e[1]=(e[1]>>>3|e[2]<<10)&65535,e[2]=(e[2]>>>6|e[3]<<7)&65535,e[3]=(e[3]>>>9|e[4]<<4)&65535,e[4]=(e[4]>>>12|e[5]<<1|e[6]<<14)&65535,e[5]=(e[6]>>>2|e[7]<<11)&65535,e[6]=(e[7]>>>5|e[8]<<8)&65535,e[7]=(e[8]>>>8|e[9]<<5)&65535;let i=e[0]+r[0];e[0]=i&65535;for(let c=1;c<8;c++)i=(e[c]+r[c]|0)+(i>>>16)|0,e[c]=i&65535;ye(n)}update(e){yn(this),ee(e),e=Xe(e);let{buffer:r,blockLen:n}=this,o=e.length;for(let s=0;s<o;){let i=Math.min(n-this.pos,o-s);if(i===n){for(;n<=o-s;s+=n)this.process(e,s);continue}r.set(e.subarray(s,s+i),this.pos),this.pos+=i,s+=i,this.pos===n&&(this.process(r,0,!1),this.pos=0)}return this}destroy(){ye(this.h,this.r,this.buffer,this.pad)}digestInto(e){yn(this),Yr(e,this),this.finished=!0;let{buffer:r,h:n}=this,{pos:o}=this;if(o){for(r[o++]=1;o<16;o++)r[o]=0;this.process(r,0,!0)}this.finalize();let s=0;for(let i=0;i<8;i++)e[s++]=n[i]>>>0,e[s++]=n[i]>>>8;return e}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}};function ti(t){let e=(n,o)=>t(o).update(n).digest(),r=t(new Uint8Array(32));return e.outputLen=r.outputLen,e.blockLen=r.blockLen,e.create=n=>t(n),e}var eo=ti(t=>new vn(t));function ro(t,e,r,n,o,s=20){let i=t[0],c=t[1],f=t[2],a=t[3],u=e[0],d=e[1],y=e[2],l=e[3],x=e[4],A=e[5],B=e[6],L=e[7],D=o,P=r[0],j=r[1],G=r[2],K=i,z=c,Y=f,$=a,F=u,M=d,C=y,H=l,h=x,b=A,v=B,S=L,O=D,p=P,R=j,w=G;for(let E=0;E<s;E+=2)K=K+F|0,O=N(O^K,16),h=h+O|0,F=N(F^h,12),K=K+F|0,O=N(O^K,8),h=h+O|0,F=N(F^h,7),z=z+M|0,p=N(p^z,16),b=b+p|0,M=N(M^b,12),z=z+M|0,p=N(p^z,8),b=b+p|0,M=N(M^b,7),Y=Y+C|0,R=N(R^Y,16),v=v+R|0,C=N(C^v,12),Y=Y+C|0,R=N(R^Y,8),v=v+R|0,C=N(C^v,7),$=$+H|0,w=N(w^$,16),S=S+w|0,H=N(H^S,12),$=$+H|0,w=N(w^$,8),S=S+w|0,H=N(H^S,7),K=K+M|0,w=N(w^K,16),v=v+w|0,M=N(M^v,12),K=K+M|0,w=N(w^K,8),v=v+w|0,M=N(M^v,7),z=z+C|0,O=N(O^z,16),S=S+O|0,C=N(C^S,12),z=z+C|0,O=N(O^z,8),S=S+O|0,C=N(C^S,7),Y=Y+H|0,p=N(p^Y,16),h=h+p|0,H=N(H^h,12),Y=Y+H|0,p=N(p^Y,8),h=h+p|0,H=N(H^h,7),$=$+F|0,R=N(R^$,16),b=b+R|0,F=N(F^b,12),$=$+F|0,R=N(R^$,8),b=b+R|0,F=N(F^b,7);let g=0;n[g++]=i+K|0,n[g++]=c+z|0,n[g++]=f+Y|0,n[g++]=a+$|0,n[g++]=u+F|0,n[g++]=d+M|0,n[g++]=y+C|0,n[g++]=l+H|0,n[g++]=x+h|0,n[g++]=A+b|0,n[g++]=B+v|0,n[g++]=L+S|0,n[g++]=D+O|0,n[g++]=P+p|0,n[g++]=j+R|0,n[g++]=G+w|0}function ni(t,e,r,n){let o=t[0],s=t[1],i=t[2],c=t[3],f=e[0],a=e[1],u=e[2],d=e[3],y=e[4],l=e[5],x=e[6],A=e[7],B=r[0],L=r[1],D=r[2],P=r[3];for(let G=0;G<20;G+=2)o=o+f|0,B=N(B^o,16),y=y+B|0,f=N(f^y,12),o=o+f|0,B=N(B^o,8),y=y+B|0,f=N(f^y,7),s=s+a|0,L=N(L^s,16),l=l+L|0,a=N(a^l,12),s=s+a|0,L=N(L^s,8),l=l+L|0,a=N(a^l,7),i=i+u|0,D=N(D^i,16),x=x+D|0,u=N(u^x,12),i=i+u|0,D=N(D^i,8),x=x+D|0,u=N(u^x,7),c=c+d|0,P=N(P^c,16),A=A+P|0,d=N(d^A,12),c=c+d|0,P=N(P^c,8),A=A+P|0,d=N(d^A,7),o=o+a|0,P=N(P^o,16),x=x+P|0,a=N(a^x,12),o=o+a|0,P=N(P^o,8),x=x+P|0,a=N(a^x,7),s=s+u|0,B=N(B^s,16),A=A+B|0,u=N(u^A,12),s=s+u|0,B=N(B^s,8),A=A+B|0,u=N(u^A,7),i=i+d|0,L=N(L^i,16),y=y+L|0,d=N(d^y,12),i=i+d|0,L=N(L^i,8),y=y+L|0,d=N(d^y,7),c=c+f|0,D=N(D^c,16),l=l+D|0,f=N(f^l,12),c=c+f|0,D=N(D^c,8),l=l+D|0,f=N(f^l,7);let j=0;n[j++]=o,n[j++]=s,n[j++]=i,n[j++]=c,n[j++]=B,n[j++]=L,n[j++]=D,n[j++]=P}var An=Bn(ro,{counterRight:!1,counterLength:4,allowShortKeys:!1}),ri=Bn(ro,{counterRight:!1,counterLength:8,extendNonceFn:ni,allowShortKeys:!1});var oi=new Uint8Array(16),to=(t,e)=>{t.update(e);let r=e.length%16;r&&t.update(oi.subarray(r))},si=new Uint8Array(32);function no(t,e,r,n,o){o!==void 0&&ee(o,void 0,"AAD");let s=t(e,r,si),i=Gr(n.length,o?o.length:0,!0),c=eo.create(s);o&&to(c,o),to(c,n),c.update(i);let f=c.digest();return ye(s,i),f}var oo=t=>(e,r,n)=>({encrypt(s,i){let c=s.length;i=mn(c+16,i,!1),i.set(s);let f=i.subarray(0,-16);t(e,r,f,f,1);let a=no(t,e,r,f,n);return i.set(a,c),ye(a),i},decrypt(s,i){i=mn(s.length-16,i,!1);let c=s.subarray(0,-16),f=s.subarray(-16),a=no(t,e,r,c,n);if(!Dt(f,a))throw new Error("invalid tag");return i.set(s.subarray(0,-16)),t(e,r,i,i,1),ye(a),i}}),Wc=wn({blockSize:64,nonceLength:12,tagLength:16},oo(An)),Gc=wn({blockSize:64,nonceLength:24,tagLength:16},oo(ri));function ut(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"}function ue(t,e=""){if(!Number.isSafeInteger(t)||t<0){let r=e&&`"${e}" `;throw new Error(`${r}expected integer >= 0, got ${t}`)}}function W(t,e,r=""){let n=ut(t),o=t?.length,s=e!==void 0;if(!n||s&&o!==e){let i=r&&`"${r}" `,c=s?` of length ${e}`:"",f=n?`length=${o}`:`type=${typeof t}`;throw new Error(i+"expected Uint8Array"+c+", got "+f)}return t}function qe(t){if(typeof t!="function"||typeof t.create!="function")throw new Error("Hash must wrapped by utils.createHasher");ue(t.outputLen),ue(t.blockLen)}function Je(t,e=!0){if(t.destroyed)throw new Error("Hash instance has been destroyed");if(e&&t.finished)throw new Error("Hash#digest() has already been called")}function io(t,e){W(t,void 0,"digestInto() output");let r=e.outputLen;if(t.length<r)throw new Error('"digestInto() output" expected to be of length >='+r)}function me(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function jt(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}function be(t,e){return t<<32-e|t>>>e}var co=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",ii=Array.from({length:256},(t,e)=>e.toString(16).padStart(2,"0"));function De(t){if(W(t),co)return t.toHex();let e="";for(let r=0;r<t.length;r++)e+=ii[t[r]];return e}var we={_0:48,_9:57,A:65,F:70,a:97,f:102};function so(t){if(t>=we._0&&t<=we._9)return t-we._0;if(t>=we.A&&t<=we.F)return t-(we.A-10);if(t>=we.a&&t<=we.f)return t-(we.a-10)}function Ee(t){if(typeof t!="string")throw new Error("hex string expected, got "+typeof t);if(co)return Uint8Array.fromHex(t);let e=t.length,r=e/2;if(e%2)throw new Error("hex string expected, got unpadded hex of length "+e);let n=new Uint8Array(r);for(let o=0,s=0;o<r;o++,s+=2){let i=so(t.charCodeAt(s)),c=so(t.charCodeAt(s+1));if(i===void 0||c===void 0){let f=t[s]+t[s+1];throw new Error('hex string expected, got non-hex character "'+f+'" at index '+s)}n[o]=i*16+c}return n}function fe(...t){let e=0;for(let n=0;n<t.length;n++){let o=t[n];W(o),e+=o.length}let r=new Uint8Array(e);for(let n=0,o=0;n<t.length;n++){let s=t[n];r.set(s,o),o+=s.length}return r}function fo(t,e={}){let r=(o,s)=>t(s).update(o).digest(),n=t(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.create=o=>t(o),Object.assign(r,e),Object.freeze(r)}function dt(t=32){let e=typeof globalThis=="object"?globalThis.crypto:null;if(typeof e?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");return e.getRandomValues(new Uint8Array(t))}var ao=t=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,t])});function uo(t,e,r){return t&e^~t&r}function lo(t,e,r){return t&e^t&r^e&r}var Vt=class{constructor(e,r,n,o){m(this,"blockLen");m(this,"outputLen");m(this,"padOffset");m(this,"isLE");m(this,"buffer");m(this,"view");m(this,"finished",!1);m(this,"length",0);m(this,"pos",0);m(this,"destroyed",!1);this.blockLen=e,this.outputLen=r,this.padOffset=n,this.isLE=o,this.buffer=new Uint8Array(e),this.view=jt(this.buffer)}update(e){Je(this),W(e);let{view:r,buffer:n,blockLen:o}=this,s=e.length;for(let i=0;i<s;){let c=Math.min(o-this.pos,s-i);if(c===o){let f=jt(e);for(;o<=s-i;i+=o)this.process(f,i);continue}n.set(e.subarray(i,i+c),this.pos),this.pos+=c,i+=c,this.pos===o&&(this.process(r,0),this.pos=0)}return this.length+=e.length,this.roundClean(),this}digestInto(e){Je(this),io(e,this),this.finished=!0;let{buffer:r,view:n,blockLen:o,isLE:s}=this,{pos:i}=this;r[i++]=128,me(this.buffer.subarray(i)),this.padOffset>o-i&&(this.process(n,0),i=0);for(let d=i;d<o;d++)r[d]=0;n.setBigUint64(o-8,BigInt(this.length*8),s),this.process(n,0);let c=jt(e),f=this.outputLen;if(f%4)throw new Error("_sha2: outputLen must be aligned to 32bit");let a=f/4,u=this.get();if(a>u.length)throw new Error("_sha2: outputLen bigger than state");for(let d=0;d<a;d++)c.setUint32(4*d,u[d],s)}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}_cloneInto(e){e||(e=new this.constructor),e.set(...this.get());let{blockLen:r,buffer:n,length:o,finished:s,destroyed:i,pos:c}=this;return e.destroyed=i,e.finished=s,e.length=o,e.pos=c,o%r&&e.buffer.set(n),e}clone(){return this._cloneInto()}},Be=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var ci=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),_e=new Uint32Array(64),Sn=class extends Vt{constructor(e){super(64,e,8,!1)}get(){let{A:e,B:r,C:n,D:o,E:s,F:i,G:c,H:f}=this;return[e,r,n,o,s,i,c,f]}set(e,r,n,o,s,i,c,f){this.A=e|0,this.B=r|0,this.C=n|0,this.D=o|0,this.E=s|0,this.F=i|0,this.G=c|0,this.H=f|0}process(e,r){for(let d=0;d<16;d++,r+=4)_e[d]=e.getUint32(r,!1);for(let d=16;d<64;d++){let y=_e[d-15],l=_e[d-2],x=be(y,7)^be(y,18)^y>>>3,A=be(l,17)^be(l,19)^l>>>10;_e[d]=A+_e[d-7]+x+_e[d-16]|0}let{A:n,B:o,C:s,D:i,E:c,F:f,G:a,H:u}=this;for(let d=0;d<64;d++){let y=be(c,6)^be(c,11)^be(c,25),l=u+y+uo(c,f,a)+ci[d]+_e[d]|0,A=(be(n,2)^be(n,13)^be(n,22))+lo(n,o,s)|0;u=a,a=f,f=c,c=i+l|0,i=s,s=o,o=n,n=l+A|0}n=n+this.A|0,o=o+this.B|0,s=s+this.C|0,i=i+this.D|0,c=c+this.E|0,f=f+this.F|0,a=a+this.G|0,u=u+this.H|0,this.set(n,o,s,i,c,f,a,u)}roundClean(){me(_e)}destroy(){this.set(0,0,0,0,0,0,0,0),me(this.buffer)}},Rn=class extends Sn{constructor(){super(32);m(this,"A",Be[0]|0);m(this,"B",Be[1]|0);m(this,"C",Be[2]|0);m(this,"D",Be[3]|0);m(this,"E",Be[4]|0);m(this,"F",Be[5]|0);m(this,"G",Be[6]|0);m(this,"H",Be[7]|0)}};var Qe=fo(()=>new Rn,ao(1));var Tn=BigInt(0),On=BigInt(1);function lt(t,e=""){if(typeof t!="boolean"){let r=e&&`"${e}" `;throw new Error(r+"expected boolean, got type="+typeof t)}return t}function ho(t){if(typeof t=="bigint"){if(!$t(t))throw new Error("positive bigint expected, got "+t)}else ue(t);return t}function ht(t){let e=ho(t).toString(16);return e.length&1?"0"+e:e}function bo(t){if(typeof t!="string")throw new Error("hex string expected, got "+typeof t);return t===""?Tn:BigInt("0x"+t)}function et(t){return bo(De(t))}function Ln(t){return bo(De(fi(W(t)).reverse()))}function Zt(t,e){ue(e),t=ho(t);let r=Ee(t.toString(16).padStart(e*2,"0"));if(r.length!==e)throw new Error("number too large");return r}function In(t,e){return Zt(t,e).reverse()}function fi(t){return Uint8Array.from(t)}var $t=t=>typeof t=="bigint"&&Tn<=t;function ai(t,e,r){return $t(t)&&$t(e)&&$t(r)&&e<=t&&t<r}function po(t,e,r,n){if(!ai(e,r,n))throw new Error("expected valid "+t+": "+r+" <= n < "+n+", got "+e)}function Un(t){let e;for(e=0;t>Tn;t>>=On,e+=1);return e}var bt=t=>(On<<BigInt(t))-On;function go(t,e,r){if(ue(t,"hashLen"),ue(e,"qByteLen"),typeof r!="function")throw new Error("hmacFn must be a function");let n=B=>new Uint8Array(B),o=Uint8Array.of(),s=Uint8Array.of(0),i=Uint8Array.of(1),c=1e3,f=n(t),a=n(t),u=0,d=()=>{f.fill(1),a.fill(0),u=0},y=(...B)=>r(a,fe(f,...B)),l=(B=o)=>{a=y(s,B),f=y(),B.length!==0&&(a=y(i,B),f=y())},x=()=>{if(u++>=c)throw new Error("drbg: tried max amount of iterations");let B=0,L=[];for(;B<e;){f=y();let D=f.slice();L.push(D),B+=f.length}return fe(...L)};return(B,L)=>{d(),l(B);let D;for(;!(D=L(x()));)l();return d(),D}}function pt(t,e={},r={}){if(!t||typeof t!="object")throw new Error("expected valid options object");function n(s,i,c){let f=t[s];if(c&&f===void 0)return;let a=typeof f;if(a!==i||f===null)throw new Error(`param "${s}" is invalid: expected ${i}, got ${a}`)}let o=(s,i)=>Object.entries(s).forEach(([c,f])=>n(c,f,i));o(e,!1),o(r,!0)}function _n(t){let e=new WeakMap;return(r,...n)=>{let o=e.get(r);if(o!==void 0)return o;let s=t(r,...n);return e.set(r,s),s}}var ie=BigInt(0),re=BigInt(1),Me=BigInt(2),wo=BigInt(3),mo=BigInt(4),Eo=BigInt(5),ui=BigInt(7),Bo=BigInt(8),di=BigInt(9),vo=BigInt(16);function pe(t,e){let r=t%e;return r>=ie?r:e+r}function ae(t,e,r){let n=t;for(;e-- >ie;)n*=n,n%=r;return n}function xo(t,e){if(t===ie)throw new Error("invert: expected non-zero number");if(e<=ie)throw new Error("invert: expected positive modulus, got "+e);let r=pe(t,e),n=e,o=ie,s=re,i=re,c=ie;for(;r!==ie;){let a=n/r,u=n%r,d=o-i*a,y=s-c*a;n=r,r=u,o=i,s=c,i=d,c=y}if(n!==re)throw new Error("invert: does not exist");return pe(o,e)}function Hn(t,e,r){if(!t.eql(t.sqr(e),r))throw new Error("Cannot find square root")}function Ao(t,e){let r=(t.ORDER+re)/mo,n=t.pow(e,r);return Hn(t,n,e),n}function li(t,e){let r=(t.ORDER-Eo)/Bo,n=t.mul(e,Me),o=t.pow(n,r),s=t.mul(e,o),i=t.mul(t.mul(s,Me),o),c=t.mul(s,t.sub(i,t.ONE));return Hn(t,c,e),c}function hi(t){let e=tt(t),r=So(t),n=r(e,e.neg(e.ONE)),o=r(e,n),s=r(e,e.neg(n)),i=(t+ui)/vo;return(c,f)=>{let a=c.pow(f,i),u=c.mul(a,n),d=c.mul(a,o),y=c.mul(a,s),l=c.eql(c.sqr(u),f),x=c.eql(c.sqr(d),f);a=c.cmov(a,u,l),u=c.cmov(y,d,x);let A=c.eql(c.sqr(u),f),B=c.cmov(a,u,A);return Hn(c,B,f),B}}function So(t){if(t<wo)throw new Error("sqrt is not defined for small field");let e=t-re,r=0;for(;e%Me===ie;)e/=Me,r++;let n=Me,o=tt(t);for(;yo(o,n)===1;)if(n++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(r===1)return Ao;let s=o.pow(n,e),i=(e+re)/Me;return function(f,a){if(f.is0(a))return a;if(yo(f,a)!==1)throw new Error("Cannot find square root");let u=r,d=f.mul(f.ONE,s),y=f.pow(a,e),l=f.pow(a,i);for(;!f.eql(y,f.ONE);){if(f.is0(y))return f.ZERO;let x=1,A=f.sqr(y);for(;!f.eql(A,f.ONE);)if(x++,A=f.sqr(A),x===u)throw new Error("Cannot find square root");let B=re<<BigInt(u-x-1),L=f.pow(d,B);u=x,d=f.sqr(L),y=f.mul(y,d),l=f.mul(l,L)}return l}}function bi(t){return t%mo===wo?Ao:t%Bo===Eo?li:t%vo===di?hi(t):So(t)}var pi=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function Nn(t){let e={ORDER:"bigint",BYTES:"number",BITS:"number"},r=pi.reduce((n,o)=>(n[o]="function",n),e);return pt(t,r),t}function gi(t,e,r){if(r<ie)throw new Error("invalid exponent, negatives unsupported");if(r===ie)return t.ONE;if(r===re)return e;let n=t.ONE,o=e;for(;r>ie;)r&re&&(n=t.mul(n,o)),o=t.sqr(o),r>>=re;return n}function Pt(t,e,r=!1){let n=new Array(e.length).fill(r?t.ZERO:void 0),o=e.reduce((i,c,f)=>t.is0(c)?i:(n[f]=i,t.mul(i,c)),t.ONE),s=t.inv(o);return e.reduceRight((i,c,f)=>t.is0(c)?i:(n[f]=t.mul(i,n[f]),t.mul(i,c)),s),n}function yo(t,e){let r=(t.ORDER-re)/Me,n=t.pow(e,r),o=t.eql(n,t.ONE),s=t.eql(n,t.ZERO),i=t.eql(n,t.neg(t.ONE));if(!o&&!s&&!i)throw new Error("invalid Legendre symbol result");return o?1:s?0:-1}function xi(t,e){e!==void 0&&ue(e);let r=e!==void 0?e:t.toString(2).length,n=Math.ceil(r/8);return{nBitLength:r,nByteLength:n}}var kn=class{constructor(e,r={}){m(this,"ORDER");m(this,"BITS");m(this,"BYTES");m(this,"isLE");m(this,"ZERO",ie);m(this,"ONE",re);m(this,"_lengths");m(this,"_sqrt");m(this,"_mod");if(e<=ie)throw new Error("invalid field: expected ORDER > 0, got "+e);let n;this.isLE=!1,r!=null&&typeof r=="object"&&(typeof r.BITS=="number"&&(n=r.BITS),typeof r.sqrt=="function"&&(this.sqrt=r.sqrt),typeof r.isLE=="boolean"&&(this.isLE=r.isLE),r.allowedLengths&&(this._lengths=r.allowedLengths?.slice()),typeof r.modFromBytes=="boolean"&&(this._mod=r.modFromBytes));let{nBitLength:o,nByteLength:s}=xi(e,n);if(s>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");this.ORDER=e,this.BITS=o,this.BYTES=s,this._sqrt=void 0,Object.preventExtensions(this)}create(e){return pe(e,this.ORDER)}isValid(e){if(typeof e!="bigint")throw new Error("invalid field element: expected bigint, got "+typeof e);return ie<=e&&e<this.ORDER}is0(e){return e===ie}isValidNot0(e){return!this.is0(e)&&this.isValid(e)}isOdd(e){return(e&re)===re}neg(e){return pe(-e,this.ORDER)}eql(e,r){return e===r}sqr(e){return pe(e*e,this.ORDER)}add(e,r){return pe(e+r,this.ORDER)}sub(e,r){return pe(e-r,this.ORDER)}mul(e,r){return pe(e*r,this.ORDER)}pow(e,r){return gi(this,e,r)}div(e,r){return pe(e*xo(r,this.ORDER),this.ORDER)}sqrN(e){return e*e}addN(e,r){return e+r}subN(e,r){return e-r}mulN(e,r){return e*r}inv(e){return xo(e,this.ORDER)}sqrt(e){return this._sqrt||(this._sqrt=bi(this.ORDER)),this._sqrt(this,e)}toBytes(e){return this.isLE?In(e,this.BYTES):Zt(e,this.BYTES)}fromBytes(e,r=!1){W(e);let{_lengths:n,BYTES:o,isLE:s,ORDER:i,_mod:c}=this;if(n){if(!n.includes(e.length)||e.length>o)throw new Error("Field.fromBytes: expected "+n+" bytes, got "+e.length);let a=new Uint8Array(o);a.set(e,s?0:a.length-e.length),e=a}if(e.length!==o)throw new Error("Field.fromBytes: expected "+o+" bytes, got "+e.length);let f=s?Ln(e):et(e);if(c&&(f=pe(f,i)),!r&&!this.isValid(f))throw new Error("invalid field element: outside of range 0..ORDER");return f}invertBatch(e){return Pt(this,e)}cmov(e,r,n){return n?r:e}};function tt(t,e={}){return new kn(t,e)}function Ro(t){if(typeof t!="bigint")throw new Error("field order must be bigint");let e=t.toString(2).length;return Math.ceil(e/8)}function Cn(t){let e=Ro(t);return e+Math.ceil(e/2)}function qn(t,e,r=!1){W(t);let n=t.length,o=Ro(e),s=Cn(e);if(n<16||n<s||n>1024)throw new Error("expected "+s+"-1024 bytes of input, got "+n);let i=r?Ln(t):et(t),c=pe(i,e-re)+re;return r?In(c,o):Zt(c,o)}var nt=BigInt(0),je=BigInt(1);function gt(t,e){let r=e.negate();return t?r:e}function Vn(t,e){let r=Pt(t.Fp,e.map(n=>n.Z));return e.map((n,o)=>t.fromAffine(n.toAffine(r[o])))}function Io(t,e){if(!Number.isSafeInteger(t)||t<=0||t>e)throw new Error("invalid window size, expected [1.."+e+"], got W="+t)}function Dn(t,e){Io(t,e);let r=Math.ceil(e/t)+1,n=2**(t-1),o=2**t,s=bt(t),i=BigInt(t);return{windows:r,windowSize:n,mask:s,maxNumber:o,shiftBy:i}}function Oo(t,e,r){let{windowSize:n,mask:o,maxNumber:s,shiftBy:i}=r,c=Number(t&o),f=t>>i;c>n&&(c-=s,f+=je);let a=e*n,u=a+Math.abs(c)-1,d=c===0,y=c<0,l=e%2!==0;return{nextN:f,offset:u,isZero:d,isNeg:y,isNegF:l,offsetF:a}}var Mn=new WeakMap,Uo=new WeakMap;function jn(t){return Uo.get(t)||1}function To(t){if(t!==nt)throw new Error("invalid wNAF")}var Ft=class{constructor(e,r){m(this,"BASE");m(this,"ZERO");m(this,"Fn");m(this,"bits");this.BASE=e.BASE,this.ZERO=e.ZERO,this.Fn=e.Fn,this.bits=r}_unsafeLadder(e,r,n=this.ZERO){let o=e;for(;r>nt;)r&je&&(n=n.add(o)),o=o.double(),r>>=je;return n}precomputeWindow(e,r){let{windows:n,windowSize:o}=Dn(r,this.bits),s=[],i=e,c=i;for(let f=0;f<n;f++){c=i,s.push(c);for(let a=1;a<o;a++)c=c.add(i),s.push(c);i=c.double()}return s}wNAF(e,r,n){if(!this.Fn.isValid(n))throw new Error("invalid scalar");let o=this.ZERO,s=this.BASE,i=Dn(e,this.bits);for(let c=0;c<i.windows;c++){let{nextN:f,offset:a,isZero:u,isNeg:d,isNegF:y,offsetF:l}=Oo(n,c,i);n=f,u?s=s.add(gt(y,r[l])):o=o.add(gt(d,r[a]))}return To(n),{p:o,f:s}}wNAFUnsafe(e,r,n,o=this.ZERO){let s=Dn(e,this.bits);for(let i=0;i<s.windows&&n!==nt;i++){let{nextN:c,offset:f,isZero:a,isNeg:u}=Oo(n,i,s);if(n=c,!a){let d=r[f];o=o.add(u?d.negate():d)}}return To(n),o}getPrecomputes(e,r,n){let o=Mn.get(r);return o||(o=this.precomputeWindow(r,e),e!==1&&(typeof n=="function"&&(o=n(o)),Mn.set(r,o))),o}cached(e,r,n){let o=jn(e);return this.wNAF(o,this.getPrecomputes(o,e,n),r)}unsafe(e,r,n,o){let s=jn(e);return s===1?this._unsafeLadder(e,r,o):this.wNAFUnsafe(s,this.getPrecomputes(s,e,n),r,o)}createCache(e,r){Io(r,this.bits),Uo.set(e,r),Mn.delete(e)}hasCache(e){return jn(e)!==1}};function _o(t,e,r,n){let o=e,s=t.ZERO,i=t.ZERO;for(;r>nt||n>nt;)r&je&&(s=s.add(o)),n&je&&(i=i.add(o)),o=o.double(),r>>=je,n>>=je;return{p1:s,p2:i}}function Lo(t,e,r){if(e){if(e.ORDER!==t)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return Nn(e),e}else return tt(t,{isLE:r})}function ko(t,e,r={},n){if(n===void 0&&(n=t==="edwards"),!e||typeof e!="object")throw new Error(`expected valid ${t} CURVE object`);for(let f of["p","n","h"]){let a=e[f];if(!(typeof a=="bigint"&&a>nt))throw new Error(`CURVE.${f} must be positive bigint`)}let o=Lo(e.p,r.Fp,n),s=Lo(e.n,r.Fn,n),c=["Gx","Gy","a",t==="weierstrass"?"b":"d"];for(let f of c)if(!o.isValid(e[f]))throw new Error(`CURVE.${f} must be valid field element of CURVE.Fp`);return e=Object.freeze(Object.assign({},e)),{CURVE:e,Fp:o,Fn:s}}function Ho(t,e){return function(n){let o=t(n);return{secretKey:o,publicKey:e(o)}}}var Kt=class{constructor(e,r){m(this,"oHash");m(this,"iHash");m(this,"blockLen");m(this,"outputLen");m(this,"finished",!1);m(this,"destroyed",!1);if(qe(e),W(r,void 0,"key"),this.iHash=e.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let n=this.blockLen,o=new Uint8Array(n);o.set(r.length>n?e.create().update(r).digest():r);for(let s=0;s<o.length;s++)o[s]^=54;this.iHash.update(o),this.oHash=e.create();for(let s=0;s<o.length;s++)o[s]^=106;this.oHash.update(o),me(o)}update(e){return Je(this),this.iHash.update(e),this}digestInto(e){Je(this),W(e,this.outputLen,"output"),this.finished=!0,this.iHash.digestInto(e),this.oHash.update(e),this.oHash.digestInto(e),this.destroy()}digest(){let e=new Uint8Array(this.oHash.outputLen);return this.digestInto(e),e}_cloneInto(e){e||(e=Object.create(Object.getPrototypeOf(this),{}));let{oHash:r,iHash:n,finished:o,destroyed:s,blockLen:i,outputLen:c}=this;return e=e,e.finished=o,e.destroyed=s,e.blockLen=i,e.outputLen=c,e.oHash=r._cloneInto(e.oHash),e.iHash=n._cloneInto(e.iHash),e}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},ke=(t,e,r)=>new Kt(t,e).update(r).digest();ke.create=(t,e)=>new Kt(t,e);var No=(t,e)=>(t+(t>=0?e:-e)/Co)/e;function yi(t,e,r){let[[n,o],[s,i]]=e,c=No(i*t,r),f=No(-o*t,r),a=t-c*n-f*s,u=-c*o-f*i,d=a<ve,y=u<ve;d&&(a=-a),y&&(u=-u);let l=bt(Math.ceil(Un(r)/2))+rt;if(a<ve||a>=l||u<ve||u>=l)throw new Error("splitScalar (endomorphism): failed, k="+t);return{k1neg:d,k1:a,k2neg:y,k2:u}}function Zn(t){if(!["compact","recovered","der"].includes(t))throw new Error('Signature format must be "compact", "recovered", or "der"');return t}function $n(t,e){let r={};for(let n of Object.keys(e))r[n]=t[n]===void 0?e[n]:t[n];return lt(r.lowS,"lowS"),lt(r.prehash,"prehash"),r.format!==void 0&&Zn(r.format),r}var Pn=class extends Error{constructor(e=""){super(e)}},He={Err:Pn,_tlv:{encode:(t,e)=>{let{Err:r}=He;if(t<0||t>256)throw new r("tlv.encode: wrong tag");if(e.length&1)throw new r("tlv.encode: unpadded data");let n=e.length/2,o=ht(n);if(o.length/2&128)throw new r("tlv.encode: long form length too big");let s=n>127?ht(o.length/2|128):"";return ht(t)+s+o+e},decode(t,e){let{Err:r}=He,n=0;if(t<0||t>256)throw new r("tlv.encode: wrong tag");if(e.length<2||e[n++]!==t)throw new r("tlv.decode: wrong tlv");let o=e[n++],s=!!(o&128),i=0;if(!s)i=o;else{let f=o&127;if(!f)throw new r("tlv.decode(long): indefinite length not supported");if(f>4)throw new r("tlv.decode(long): byte length is too big");let a=e.subarray(n,n+f);if(a.length!==f)throw new r("tlv.decode: length bytes not complete");if(a[0]===0)throw new r("tlv.decode(long): zero leftmost byte");for(let u of a)i=i<<8|u;if(n+=f,i<128)throw new r("tlv.decode(long): not minimal encoding")}let c=e.subarray(n,n+i);if(c.length!==i)throw new r("tlv.decode: wrong value length");return{v:c,l:e.subarray(n+i)}}},_int:{encode(t){let{Err:e}=He;if(t<ve)throw new e("integer: negative integers are not allowed");let r=ht(t);if(Number.parseInt(r[0],16)&8&&(r="00"+r),r.length&1)throw new e("unexpected DER parsing assertion: unpadded hex");return r},decode(t){let{Err:e}=He;if(t[0]&128)throw new e("invalid signature integer: negative");if(t[0]===0&&!(t[1]&128))throw new e("invalid signature integer: unnecessary leading zero");return et(t)}},toSig(t){let{Err:e,_int:r,_tlv:n}=He,o=W(t,void 0,"signature"),{v:s,l:i}=n.decode(48,o);if(i.length)throw new e("invalid signature: left bytes after parsing");let{v:c,l:f}=n.decode(2,s),{v:a,l:u}=n.decode(2,f);if(u.length)throw new e("invalid signature: left bytes after parsing");return{r:r.decode(c),s:r.decode(a)}},hexFromSig(t){let{_tlv:e,_int:r}=He,n=e.encode(2,r.encode(t.r)),o=e.encode(2,r.encode(t.s)),s=n+o;return e.encode(48,s)}},ve=BigInt(0),rt=BigInt(1),Co=BigInt(2),zt=BigInt(3),wi=BigInt(4);function qo(t,e={}){let r=ko("weierstrass",t,e),{Fp:n,Fn:o}=r,s=r.CURVE,{h:i,n:c}=s;pt(e,{},{allowInfinityPoint:"boolean",clearCofactor:"function",isTorsionFree:"function",fromBytes:"function",toBytes:"function",endo:"object"});let{endo:f}=e;if(f&&(!n.is0(s.a)||typeof f.beta!="bigint"||!Array.isArray(f.basises)))throw new Error('invalid endo: expected "beta": bigint and "basises": array');let a=Mo(n,o);function u(){if(!n.isOdd)throw new Error("compression is not supported: Field does not have .isOdd()")}function d(H,h,b){let{x:v,y:S}=h.toAffine(),O=n.toBytes(v);if(lt(b,"isCompressed"),b){u();let p=!n.isOdd(S);return fe(Do(p),O)}else return fe(Uint8Array.of(4),O,n.toBytes(S))}function y(H){W(H,void 0,"Point");let{publicKey:h,publicKeyUncompressed:b}=a,v=H.length,S=H[0],O=H.subarray(1);if(v===h&&(S===2||S===3)){let p=n.fromBytes(O);if(!n.isValid(p))throw new Error("bad point: is not on curve, wrong x");let R=A(p),w;try{w=n.sqrt(R)}catch(I){let _=I instanceof Error?": "+I.message:"";throw new Error("bad point: is not on curve, sqrt error"+_)}u();let g=n.isOdd(w);return(S&1)===1!==g&&(w=n.neg(w)),{x:p,y:w}}else if(v===b&&S===4){let p=n.BYTES,R=n.fromBytes(O.subarray(0,p)),w=n.fromBytes(O.subarray(p,p*2));if(!B(R,w))throw new Error("bad point: is not on curve");return{x:R,y:w}}else throw new Error(`bad point: got length ${v}, expected compressed=${h} or uncompressed=${b}`)}let l=e.toBytes||d,x=e.fromBytes||y;function A(H){let h=n.sqr(H),b=n.mul(h,H);return n.add(n.add(b,n.mul(H,s.a)),s.b)}function B(H,h){let b=n.sqr(h),v=A(H);return n.eql(b,v)}if(!B(s.Gx,s.Gy))throw new Error("bad curve params: generator point");let L=n.mul(n.pow(s.a,zt),wi),D=n.mul(n.sqr(s.b),BigInt(27));if(n.is0(n.add(L,D)))throw new Error("bad curve params: a or b");function P(H,h,b=!1){if(!n.isValid(h)||b&&n.is0(h))throw new Error(`bad point coordinate ${H}`);return h}function j(H){if(!(H instanceof $))throw new Error("Weierstrass Point expected")}function G(H){if(!f||!f.basises)throw new Error("no endo");return yi(H,f.basises,o.ORDER)}let K=_n((H,h)=>{let{X:b,Y:v,Z:S}=H;if(n.eql(S,n.ONE))return{x:b,y:v};let O=H.is0();h==null&&(h=O?n.ONE:n.inv(S));let p=n.mul(b,h),R=n.mul(v,h),w=n.mul(S,h);if(O)return{x:n.ZERO,y:n.ZERO};if(!n.eql(w,n.ONE))throw new Error("invZ was invalid");return{x:p,y:R}}),z=_n(H=>{if(H.is0()){if(e.allowInfinityPoint&&!n.is0(H.Y))return;throw new Error("bad point: ZERO")}let{x:h,y:b}=H.toAffine();if(!n.isValid(h)||!n.isValid(b))throw new Error("bad point: x or y not field elements");if(!B(h,b))throw new Error("bad point: equation left != right");if(!H.isTorsionFree())throw new Error("bad point: not in prime-order subgroup");return!0});function Y(H,h,b,v,S){return b=new $(n.mul(b.X,H),b.Y,b.Z),h=gt(v,h),b=gt(S,b),h.add(b)}let C=class C{constructor(h,b,v){m(this,"X");m(this,"Y");m(this,"Z");this.X=P("x",h),this.Y=P("y",b,!0),this.Z=P("z",v),Object.freeze(this)}static CURVE(){return s}static fromAffine(h){let{x:b,y:v}=h||{};if(!h||!n.isValid(b)||!n.isValid(v))throw new Error("invalid affine point");if(h instanceof C)throw new Error("projective point not allowed");return n.is0(b)&&n.is0(v)?C.ZERO:new C(b,v,n.ONE)}static fromBytes(h){let b=C.fromAffine(x(W(h,void 0,"point")));return b.assertValidity(),b}static fromHex(h){return C.fromBytes(Ee(h))}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(h=8,b=!0){return M.createCache(this,h),b||this.multiply(zt),this}assertValidity(){z(this)}hasEvenY(){let{y:h}=this.toAffine();if(!n.isOdd)throw new Error("Field doesn't support isOdd");return!n.isOdd(h)}equals(h){j(h);let{X:b,Y:v,Z:S}=this,{X:O,Y:p,Z:R}=h,w=n.eql(n.mul(b,R),n.mul(O,S)),g=n.eql(n.mul(v,R),n.mul(p,S));return w&&g}negate(){return new C(this.X,n.neg(this.Y),this.Z)}double(){let{a:h,b}=s,v=n.mul(b,zt),{X:S,Y:O,Z:p}=this,R=n.ZERO,w=n.ZERO,g=n.ZERO,E=n.mul(S,S),I=n.mul(O,O),_=n.mul(p,p),T=n.mul(S,O);return T=n.add(T,T),g=n.mul(S,p),g=n.add(g,g),R=n.mul(h,g),w=n.mul(v,_),w=n.add(R,w),R=n.sub(I,w),w=n.add(I,w),w=n.mul(R,w),R=n.mul(T,R),g=n.mul(v,g),_=n.mul(h,_),T=n.sub(E,_),T=n.mul(h,T),T=n.add(T,g),g=n.add(E,E),E=n.add(g,E),E=n.add(E,_),E=n.mul(E,T),w=n.add(w,E),_=n.mul(O,p),_=n.add(_,_),E=n.mul(_,T),R=n.sub(R,E),g=n.mul(_,I),g=n.add(g,g),g=n.add(g,g),new C(R,w,g)}add(h){j(h);let{X:b,Y:v,Z:S}=this,{X:O,Y:p,Z:R}=h,w=n.ZERO,g=n.ZERO,E=n.ZERO,I=s.a,_=n.mul(s.b,zt),T=n.mul(b,O),k=n.mul(v,p),q=n.mul(S,R),U=n.add(b,v),V=n.add(O,p);U=n.mul(U,V),V=n.add(T,k),U=n.sub(U,V),V=n.add(b,S);let Z=n.add(O,R);return V=n.mul(V,Z),Z=n.add(T,q),V=n.sub(V,Z),Z=n.add(v,S),w=n.add(p,R),Z=n.mul(Z,w),w=n.add(k,q),Z=n.sub(Z,w),E=n.mul(I,V),w=n.mul(_,q),E=n.add(w,E),w=n.sub(k,E),E=n.add(k,E),g=n.mul(w,E),k=n.add(T,T),k=n.add(k,T),q=n.mul(I,q),V=n.mul(_,V),k=n.add(k,q),q=n.sub(T,q),q=n.mul(I,q),V=n.add(V,q),T=n.mul(k,V),g=n.add(g,T),T=n.mul(Z,V),w=n.mul(U,w),w=n.sub(w,T),T=n.mul(U,k),E=n.mul(Z,E),E=n.add(E,T),new C(w,g,E)}subtract(h){return this.add(h.negate())}is0(){return this.equals(C.ZERO)}multiply(h){let{endo:b}=e;if(!o.isValidNot0(h))throw new Error("invalid scalar: out of range");let v,S,O=p=>M.cached(this,p,R=>Vn(C,R));if(b){let{k1neg:p,k1:R,k2neg:w,k2:g}=G(h),{p:E,f:I}=O(R),{p:_,f:T}=O(g);S=I.add(T),v=Y(b.beta,E,_,p,w)}else{let{p,f:R}=O(h);v=p,S=R}return Vn(C,[v,S])[0]}multiplyUnsafe(h){let{endo:b}=e,v=this;if(!o.isValid(h))throw new Error("invalid scalar: out of range");if(h===ve||v.is0())return C.ZERO;if(h===rt)return v;if(M.hasCache(this))return this.multiply(h);if(b){let{k1neg:S,k1:O,k2neg:p,k2:R}=G(h),{p1:w,p2:g}=_o(C,v,O,R);return Y(b.beta,w,g,S,p)}else return M.unsafe(v,h)}toAffine(h){return K(this,h)}isTorsionFree(){let{isTorsionFree:h}=e;return i===rt?!0:h?h(C,this):M.unsafe(this,c).is0()}clearCofactor(){let{clearCofactor:h}=e;return i===rt?this:h?h(C,this):this.multiplyUnsafe(i)}isSmallOrder(){return this.multiplyUnsafe(i).is0()}toBytes(h=!0){return lt(h,"isCompressed"),this.assertValidity(),l(C,this,h)}toHex(h=!0){return De(this.toBytes(h))}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}};m(C,"BASE",new C(s.Gx,s.Gy,n.ONE)),m(C,"ZERO",new C(n.ZERO,n.ONE,n.ZERO)),m(C,"Fp",n),m(C,"Fn",o);let $=C,F=o.BITS,M=new Ft($,e.endo?Math.ceil(F/2):F);return $.BASE.precompute(8),$}function Do(t){return Uint8Array.of(t?2:3)}function Mo(t,e){return{secretKey:e.BYTES,publicKey:1+t.BYTES,publicKeyUncompressed:1+2*t.BYTES,publicKeyHasPrefix:!0,signature:2*e.BYTES}}function mi(t,e={}){let{Fn:r}=t,n=e.randomBytes||dt,o=Object.assign(Mo(t.Fp,r),{seed:Cn(r.ORDER)});function s(l){try{let x=r.fromBytes(l);return r.isValidNot0(x)}catch{return!1}}function i(l,x){let{publicKey:A,publicKeyUncompressed:B}=o;try{let L=l.length;return x===!0&&L!==A||x===!1&&L!==B?!1:!!t.fromBytes(l)}catch{return!1}}function c(l=n(o.seed)){return qn(W(l,o.seed,"seed"),r.ORDER)}function f(l,x=!0){return t.BASE.multiply(r.fromBytes(l)).toBytes(x)}function a(l){let{secretKey:x,publicKey:A,publicKeyUncompressed:B}=o;if(!ut(l)||"_lengths"in r&&r._lengths||x===A)return;let L=W(l,void 0,"key").length;return L===A||L===B}function u(l,x,A=!0){if(a(l)===!0)throw new Error("first arg must be private key");if(a(x)===!1)throw new Error("second arg must be public key");let B=r.fromBytes(l);return t.fromBytes(x).multiply(B).toBytes(A)}let d={isValidSecretKey:s,isValidPublicKey:i,randomSecretKey:c},y=Ho(c,f);return Object.freeze({getPublicKey:f,getSharedSecret:u,keygen:y,Point:t,utils:d,lengths:o})}function jo(t,e,r={}){qe(e),pt(r,{},{hmac:"function",lowS:"boolean",randomBytes:"function",bits2int:"function",bits2int_modN:"function"}),r=Object.assign({},r);let n=r.randomBytes||dt,o=r.hmac||((h,b)=>ke(e,h,b)),{Fp:s,Fn:i}=t,{ORDER:c,BITS:f}=i,{keygen:a,getPublicKey:u,getSharedSecret:d,utils:y,lengths:l}=mi(t,r),x={prehash:!0,lowS:typeof r.lowS=="boolean"?r.lowS:!0,format:"compact",extraEntropy:!1},A=c*Co<s.ORDER;function B(h){let b=c>>rt;return h>b}function L(h,b){if(!i.isValidNot0(b))throw new Error(`invalid signature ${h}: out of range 1..Point.Fn.ORDER`);return b}function D(){if(A)throw new Error('"recovered" sig type is not supported for cofactor >2 curves')}function P(h,b){Zn(b);let v=l.signature,S=b==="compact"?v:b==="recovered"?v+1:void 0;return W(h,S)}class j{constructor(b,v,S){m(this,"r");m(this,"s");m(this,"recovery");if(this.r=L("r",b),this.s=L("s",v),S!=null){if(D(),![0,1,2,3].includes(S))throw new Error("invalid recovery id");this.recovery=S}Object.freeze(this)}static fromBytes(b,v=x.format){P(b,v);let S;if(v==="der"){let{r:w,s:g}=He.toSig(W(b));return new j(w,g)}v==="recovered"&&(S=b[0],v="compact",b=b.subarray(1));let O=l.signature/2,p=b.subarray(0,O),R=b.subarray(O,O*2);return new j(i.fromBytes(p),i.fromBytes(R),S)}static fromHex(b,v){return this.fromBytes(Ee(b),v)}assertRecovery(){let{recovery:b}=this;if(b==null)throw new Error("invalid recovery id: must be present");return b}addRecoveryBit(b){return new j(this.r,this.s,b)}recoverPublicKey(b){let{r:v,s:S}=this,O=this.assertRecovery(),p=O===2||O===3?v+c:v;if(!s.isValid(p))throw new Error("invalid recovery id: sig.r+curve.n != R.x");let R=s.toBytes(p),w=t.fromBytes(fe(Do((O&1)===0),R)),g=i.inv(p),E=K(W(b,void 0,"msgHash")),I=i.create(-E*g),_=i.create(S*g),T=t.BASE.multiplyUnsafe(I).add(w.multiplyUnsafe(_));if(T.is0())throw new Error("invalid recovery: point at infinify");return T.assertValidity(),T}hasHighS(){return B(this.s)}toBytes(b=x.format){if(Zn(b),b==="der")return Ee(He.hexFromSig(this));let{r:v,s:S}=this,O=i.toBytes(v),p=i.toBytes(S);return b==="recovered"?(D(),fe(Uint8Array.of(this.assertRecovery()),O,p)):fe(O,p)}toHex(b){return De(this.toBytes(b))}}let G=r.bits2int||function(b){if(b.length>8192)throw new Error("input is too large");let v=et(b),S=b.length*8-f;return S>0?v>>BigInt(S):v},K=r.bits2int_modN||function(b){return i.create(G(b))},z=bt(f);function Y(h){return po("num < 2^"+f,h,ve,z),i.toBytes(h)}function $(h,b){return W(h,void 0,"message"),b?W(e(h),void 0,"prehashed message"):h}function F(h,b,v){let{lowS:S,prehash:O,extraEntropy:p}=$n(v,x);h=$(h,O);let R=K(h),w=i.fromBytes(b);if(!i.isValidNot0(w))throw new Error("invalid private key");let g=[Y(w),Y(R)];if(p!=null&&p!==!1){let T=p===!0?n(l.secretKey):p;g.push(W(T,void 0,"extraEntropy"))}let E=fe(...g),I=R;function _(T){let k=G(T);if(!i.isValidNot0(k))return;let q=i.inv(k),U=t.BASE.multiply(k).toAffine(),V=i.create(U.x);if(V===ve)return;let Z=i.create(q*i.create(I+V*w));if(Z===ve)return;let J=(U.x===V?0:2)|Number(U.y&rt),ne=Z;return S&&B(Z)&&(ne=i.neg(Z),J^=1),new j(V,ne,A?void 0:J)}return{seed:E,k2sig:_}}function M(h,b,v={}){let{seed:S,k2sig:O}=F(h,b,v);return go(e.outputLen,i.BYTES,o)(S,O).toBytes(v.format)}function C(h,b,v,S={}){let{lowS:O,prehash:p,format:R}=$n(S,x);if(v=W(v,void 0,"publicKey"),b=$(b,p),!ut(h)){let w=h instanceof j?", use sig.toBytes()":"";throw new Error("verify expects Uint8Array signature"+w)}P(h,R);try{let w=j.fromBytes(h,R),g=t.fromBytes(v);if(O&&w.hasHighS())return!1;let{r:E,s:I}=w,_=K(b),T=i.inv(I),k=i.create(_*T),q=i.create(E*T),U=t.BASE.multiplyUnsafe(k).add(g.multiplyUnsafe(q));return U.is0()?!1:i.create(U.x)===E}catch{return!1}}function H(h,b,v={}){let{prehash:S}=$n(v,x);return b=$(b,S),j.fromBytes(h,"recovered").recoverPublicKey(b).toBytes()}return Object.freeze({keygen:a,getPublicKey:u,getSharedSecret:d,utils:y,lengths:l,Point:t,sign:M,verify:C,recoverPublicKey:H,Signature:j,hash:e})}var Kn={p:BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f"),n:BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"),h:BigInt(1),a:BigInt(0),b:BigInt(7),Gx:BigInt("0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"),Gy:BigInt("0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8")},Ei={beta:BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),basises:[[BigInt("0x3086d221a7d46bcde86c90e49284eb15"),-BigInt("0xe4437ed6010e88286f547fa90abfe4c3")],[BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"),BigInt("0x3086d221a7d46bcde86c90e49284eb15")]]};var Vo=BigInt(2);function Bi(t){let e=Kn.p,r=BigInt(3),n=BigInt(6),o=BigInt(11),s=BigInt(22),i=BigInt(23),c=BigInt(44),f=BigInt(88),a=t*t*t%e,u=a*a*t%e,d=ae(u,r,e)*u%e,y=ae(d,r,e)*u%e,l=ae(y,Vo,e)*a%e,x=ae(l,o,e)*l%e,A=ae(x,s,e)*x%e,B=ae(A,c,e)*A%e,L=ae(B,f,e)*B%e,D=ae(L,c,e)*A%e,P=ae(D,r,e)*u%e,j=ae(P,i,e)*x%e,G=ae(j,n,e)*a%e,K=ae(G,Vo,e);if(!Fn.eql(Fn.sqr(K),t))throw new Error("Cannot find square root");return K}var Fn=tt(Kn.p,{sqrt:Bi}),vi=qo(Kn,{Fp:Fn,endo:Ei}),$o=jo(vi,Qe);function Po(t,e,r){return qe(t),r===void 0&&(r=new Uint8Array(t.outputLen)),ke(t,r,e)}var zn=Uint8Array.of(0),Zo=Uint8Array.of();function Fo(t,e,r,n=32){qe(t),ue(n,"length");let o=t.outputLen;if(n>255*o)throw new Error("Length must be <= 255*HashLen");let s=Math.ceil(n/o);r===void 0?r=Zo:W(r,void 0,"info");let i=new Uint8Array(s*o),c=ke.create(t,e),f=c._cloneInto(),a=new Uint8Array(c.outputLen);for(let u=0;u<s;u++)zn[0]=u+1,f.update(u===0?Zo:a).update(r).update(zn).digestInto(a),i.set(a,o*u),c._cloneInto(f);return c.destroy(),f.destroy(),me(a,zn),i.slice(0,n)}function zo(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"}function Ai(t){if(!zo(t))throw new Error("Uint8Array expected")}function Yo(t,e){return Array.isArray(e)?e.length===0?!0:t?e.every(r=>typeof r=="string"):e.every(r=>Number.isSafeInteger(r)):!1}function xt(t,e){if(typeof e!="string")throw new Error(`${t}: string expected`);return!0}function Gn(t){if(!Number.isSafeInteger(t))throw new Error(`invalid integer: ${t}`)}function Wn(t){if(!Array.isArray(t))throw new Error("array expected")}function Yt(t,e){if(!Yo(!0,e))throw new Error(`${t}: array of strings expected`)}function Si(t,e){if(!Yo(!1,e))throw new Error(`${t}: array of numbers expected`)}function Ri(...t){let e=s=>s,r=(s,i)=>c=>s(i(c)),n=t.map(s=>s.encode).reduceRight(r,e),o=t.map(s=>s.decode).reduce(r,e);return{encode:n,decode:o}}function Oi(t){let e=typeof t=="string"?t.split(""):t,r=e.length;Yt("alphabet",e);let n=new Map(e.map((o,s)=>[o,s]));return{encode:o=>(Wn(o),o.map(s=>{if(!Number.isSafeInteger(s)||s<0||s>=r)throw new Error(`alphabet.encode: digit index outside alphabet "${s}". Allowed: ${t}`);return e[s]})),decode:o=>(Wn(o),o.map(s=>{xt("alphabet.decode",s);let i=n.get(s);if(i===void 0)throw new Error(`Unknown letter: "${s}". Allowed: ${t}`);return i}))}}function Ti(t=""){return xt("join",t),{encode:e=>(Yt("join.decode",e),e.join(t)),decode:e=>(xt("join.decode",e),e.split(t))}}function Li(t,e="="){return Gn(t),xt("padding",e),{encode(r){for(Yt("padding.encode",r);r.length*t%8;)r.push(e);return r},decode(r){Yt("padding.decode",r);let n=r.length;if(n*t%8)throw new Error("padding: invalid, string should have whole number of bytes");for(;n>0&&r[n-1]===e;n--)if((n-1)*t%8===0)throw new Error("padding: invalid, string has too much padding");return r.slice(0,n)}}}var Wo=(t,e)=>e===0?t:Wo(e,t%e),Wt=(t,e)=>t+(e-Wo(t,e)),Yn=(()=>{let t=[];for(let e=0;e<40;e++)t.push(2**e);return t})();function Ko(t,e,r,n){if(Wn(t),e<=0||e>32)throw new Error(`convertRadix2: wrong from=${e}`);if(r<=0||r>32)throw new Error(`convertRadix2: wrong to=${r}`);if(Wt(e,r)>32)throw new Error(`convertRadix2: carry overflow from=${e} to=${r} carryBits=${Wt(e,r)}`);let o=0,s=0,i=Yn[e],c=Yn[r]-1,f=[];for(let a of t){if(Gn(a),a>=i)throw new Error(`convertRadix2: invalid data word=${a} from=${e}`);if(o=o<<e|a,s+e>32)throw new Error(`convertRadix2: carry overflow pos=${s} from=${e}`);for(s+=e;s>=r;s-=r)f.push((o>>s-r&c)>>>0);let u=Yn[s];if(u===void 0)throw new Error("invalid carry");o&=u-1}if(o=o<<r-s&c,!n&&s>=e)throw new Error("Excess padding");if(!n&&o>0)throw new Error(`Non-zero padding: ${o}`);return n&&s>0&&f.push(o>>>0),f}function Ii(t,e=!1){if(Gn(t),t<=0||t>32)throw new Error("radix2: bits should be in (0..32]");if(Wt(8,t)>32||Wt(t,8)>32)throw new Error("radix2: carry overflow");return{encode:r=>{if(!zo(r))throw new Error("radix2.encode input should be Uint8Array");return Ko(Array.from(r),8,t,!e)},decode:r=>(Si("radix2.decode",r),Uint8Array.from(Ko(r,t,8,e)))}}var Ui=typeof Uint8Array.from([]).toBase64=="function"&&typeof Uint8Array.fromBase64=="function",_i=(t,e)=>{xt("base64",t);let r=e?/^[A-Za-z0-9=_-]+$/:/^[A-Za-z0-9=+/]+$/,n=e?"base64url":"base64";if(t.length>0&&!r.test(t))throw new Error("invalid base64");return Uint8Array.fromBase64(t,{alphabet:n,lastChunkHandling:"strict"})},Go=Ui?{encode(t){return Ai(t),t.toBase64()},decode(t){return _i(t,!1)}}:Ri(Ii(6),Oi("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"),Li(6),Ti(""));var ki=new TextDecoder("utf-8"),Hi=new TextEncoder,Ni=1,Ci=4294967295,qi=65536;function Xn(t,e){let r=$o.getSharedSecret(t,Ee("02"+e)).subarray(1,33);return Po(Qe,r,Hi.encode("nip44-v2"))}function Di(t,e){let r=Fo(Qe,t,e,76);return{chacha_key:r.subarray(0,32),chacha_nonce:r.subarray(32,44),hmac_key:r.subarray(44,76)}}function Mi(t){if(!Number.isSafeInteger(t)||t<1)throw new Error("expected positive integer");if(t<=32)return 32;let e=2**(Math.floor(Math.log2(t-1))+1),r=e<=256?32:e/8;return r*(Math.floor((t-1)/r)+1)}function ji(t){let e=new DataView(t.buffer,t.byteOffset,t.byteLength),r=e.getUint16(0),n,o;if(r===0){if(n=e.getUint32(2),n<qi)throw new Error("invalid padding");o=6}else n=r,o=2;let s=t.subarray(o,o+n);if(n<Ni||n>Ci||s.length!==n||t.length!==o+Mi(n))throw new Error("invalid padding");return ki.decode(s)}function Vi(t,e,r){if(r.length!==32)throw new Error("AAD associated data must be 32 bytes");let n=fe(r,e);return ke(Qe,t,n)}function $i(t){if(typeof t!="string")throw new Error("payload must be a valid string");let e=t.length;if(e<132)throw new Error("invalid payload length: "+e);if(t[0]==="#")throw new Error("unknown encryption version");let r;try{r=Go.decode(t)}catch(s){throw new Error("invalid base64: "+s.message)}let n=r.length;if(n<99)throw new Error("invalid data length: "+n);let o=r[0];if(o!==2)throw new Error("unknown encryption version "+o);return{nonce:r.subarray(1,33),ciphertext:r.subarray(33,-32),mac:r.subarray(-32)}}function Jn(t,e){let{nonce:r,ciphertext:n,mac:o}=$i(t),{chacha_key:s,chacha_nonce:i,hmac_key:c}=Di(e,r),f=Vi(c,n,r);if(!Dt(f,o))throw new Error("invalid MAC");let a=An(s,i,n);return ji(a)}function Zi(t){return t.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function Pi(){let t=new Uint8Array(16);return crypto.getRandomValues(t),Array.from(t,e=>e.toString(16).padStart(2,"0")).join("")}function Gt(t,e){let r=t.find(n=>n[0]===e);return r?r[1]:void 0}function Ae(t){let e=new Uint8Array(t.length/2);for(let r=0;r<e.length;r++)e[r]=parseInt(t.substr(r*2,2),16);return e}async function Fi(t){if(!t.id||!t.pubkey||!t.sig||!t.tags||t.kind!==30470||!/^[0-9a-f]{128}$/i.test(t.sig)||!/^[0-9a-f]{64}$/i.test(t.pubkey)||!/^[0-9a-f]{64}$/i.test(t.id)||t.tags.length>100||t.content.length>65536||t.tags.some(i=>i.some(c=>c.length>1024)))return!1;let e=t.tags.map(i=>i[0]);if(!e.includes("tier")||!e.includes("age-range")||!e.includes("entity-type"))return!1;let r=JSON.stringify([0,t.pubkey,t.created_at,t.kind,t.tags,t.content]),n=new TextEncoder,o=$e(n.encode(r));if(Re(o)!==t.id.toLowerCase())return!1;try{let i=Ae(t.sig),c=Ae(t.id),f=Ae(t.pubkey);return at.verify(i,c,f)}catch{return!1}}function Ki(t,e){if(t===e||t==="18+"&&e==="18+")return!0;let r=["0-3","4-7","8-12","13-17","18+"],n=r.indexOf(t),o=r.indexOf(e);return n===-1||o===-1?!1:e==="18+"?t==="18+":t===e}async function zi(t,e){if(e==null||!/^https:\/\//i.test(e)||!/^[0-9a-f]{64}$/i.test(t))return null;try{let r=await fetch(`${e}/status/${t}`,{signal:AbortSignal.timeout(5e3)});if(!r.ok)return null;let n=await r.json();if(typeof n!="object"||n===null)return null;let o=n;return{confirmed:o.confirmed===!0,method:["A","B","C","D"].includes(o.method)?o.method:null,profession:typeof o.profession=="string"?o.profession:void 0,jurisdiction:typeof o.jurisdiction=="string"?o.jurisdiction:void 0}}catch{return null}}async function Jo(t,e){if(!["0-3","4-7","8-12","13-17","18+"].includes(t))return{verified:!1,ageRange:null,tier:null,entityType:null,credentialId:null,verifierPubkey:null,verifierConfirmed:null,verifierMethod:null,issuedAt:null,expiresAt:null,error:"invalid-age-range"};let n={requiredAgeRange:t,relayUrl:e?.relayUrl||"wss://relay.damus.io",theme:e?.theme||"auto",timeout:e?.timeout||12e4,verifierCheckUrl:e?.verifierCheckUrl!==void 0?e.verifierCheckUrl:"https://verify.signet.forgesworn.dev",acceptUnconfirmed:e?.acceptUnconfirmed||!1,...e};n.timeout=Math.max(5e3,Math.min(n.timeout??12e4,6e5));let o=Pi(),s={type:"signet-verify-request",requestId:o,requiredAgeRange:n.requiredAgeRange,relayUrl:n.relayUrl,timestamp:Math.floor(Date.now()/1e3)},i=JSON.stringify(s),c=btoa(i);return new Promise(f=>{let a=document.createElement("style");a.textContent="#signet-verify-dialog::backdrop{background:rgba(0,0,0,0.7)}",document.head.appendChild(a);let u=n.theme==="dark"||n.theme==="auto"&&window.matchMedia("(prefers-color-scheme: dark)").matches,d=u?"#1a1a2e":"#ffffff",y=u?"#e0e0e0":"#1a1a2e",l=u?"#888":"#666",x=document.createElement("dialog");x.id="signet-verify-dialog",x.style.cssText=`border:none;border-radius:16px;padding:32px;max-width:380px;width:90%;text-align:center;box-shadow:0 20px 60px rgba(0,0,0,0.3);background:${d};color:${y};font-family:system-ui,-apple-system,sans-serif;`,x.innerHTML=`
+"use strict";var Signet=(()=>{var yt=Object.defineProperty;var ns=Object.getOwnPropertyDescriptor;var rs=Object.getOwnPropertyNames;var os=Object.prototype.hasOwnProperty;var ss=(t,e,r)=>e in t?yt(t,e,{enumerable:!0,configurable:!0,writable:!0,value:r}):t[e]=r;var is=(t,e)=>{for(var r in e)yt(t,r,{get:e[r],enumerable:!0})},cs=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of rs(e))!os.call(t,o)&&o!==r&&yt(t,o,{get:()=>e[o],enumerable:!(n=ns(e,o))||n.enumerable});return t};var fs=t=>cs(yt({},"__esModule",{value:!0}),t);var m=(t,e,r)=>ss(t,typeof e!="symbol"?e+"":e,r);var Xi={};is(Xi,{AUTH_FRESHNESS_WINDOW_SEC:()=>ot,DEFAULT_RELAY_URL:()=>Qo,verifyAge:()=>Jo,waitForAuthResponse:()=>ts});var as=t=>t/2**32|0,us=t=>t>>>0;function er(t,e,r,n){let o=as(r),s=us(r);t.setUint32(e,n?s:o,n),t.setUint32(e+4,n?o:s,n)}function wt(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in t&&t.BYTES_PER_ELEMENT===1}var Xt=t=>t?`"${t}" `:"";function st(t,e=""){if(typeof t!="number")throw new TypeError(Xt(e)+"expected number, got "+typeof t);if(!Number.isSafeInteger(t)||t<0)throw new RangeError(Xt(e)+"expected integer >= 0, got "+t);return t}function Se(t,e,r=""){if(wt(t)&&(e===void 0||t.length===e))return t;e!==void 0&&st(e,"length");let n=wt(t),o=e!==void 0?` of length ${e}`:"",s=n?`length=${t.length}`:`type=${typeof t}`,i=Xt(r)+"expected Uint8Array"+o+", got "+s;throw n?new RangeError(i):new TypeError(i)}var ds=(t,e)=>{if(t===null||typeof t!="object"||Array.isArray(t))throw new TypeError((e==="object"?"":`"${e}" `)+"expected object, got type="+typeof t)},tr=(t,e)=>{ds(t,e);let r=Object.getPrototypeOf(t);if(r!==Object.prototype&&r!==null)throw new TypeError(`"${e}" expected plain object`);if(Object.hasOwn(t,"__proto__"))throw new TypeError(`"${e}.__proto__" is not allowed`)};function Jt(t,e=!0){if(t.destroyed)throw new Error("hash was destroyed");if(e&&t.finished)throw new Error("digest() was already called")}function rr(t,e){Se(t,void 0,"output");let r=e.outputLen;if(!(t.length>=r))throw new RangeError('"output" expected length >= '+r)}function Qt(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function mt(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}function le(t,e){return t<<32-e|t>>>e}var or=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",ls=Array.from({length:256},(t,e)=>e.toString(16).padStart(2,"0"));function Re(t){if(Se(t),or)return t.toHex();let e="";for(let r=0;r<t.length;r++)e+=ls[t[r]];return e}function nr(t){return t>=48&&t<=57?t-48:t>=65&&t<=70?t-55:t>=97&&t<=102?t-87:void 0}function en(t){if(typeof t!="string")throw new TypeError("hex string expected, got "+typeof t);if(or)try{return Uint8Array.fromHex(t)}catch(o){throw o instanceof SyntaxError?new RangeError(o.message):o}let e=t.length,r=e/2;if(e%2)throw new RangeError("hex string expected, got unpadded hex of length "+e);let n=new Uint8Array(r);for(let o=0,s=0;o<r;o++,s+=2){let i=nr(t.charCodeAt(s)),c=nr(t.charCodeAt(s+1));if(i===void 0||c===void 0){let f=t[s]+t[s+1];throw new RangeError('hex string expected, got non-hex character "'+f+'" at index '+s)}n[o]=i*16+c}return n}function sr(...t){let e=0;for(let n=0;n<t.length;n++){let o=t[n];Se(o),e+=o.length}let r=new Uint8Array(e);for(let n=0,o=0;n<t.length;n++){let s=t[n];r.set(s,o),o+=s.length}return r}function hs(t,e,r="opts"){return tr(t,"defaults"),e!==void 0&&tr(e,r),Object.assign(Object.create(null),t,e)}function ir(t,e={}){if(typeof t!="function")throw new TypeError('"hashCons" expected function, got type='+typeof t);e=hs({},e,"info");let r=(o,s)=>t(s).update(o).digest(),n=t(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.canXOF=n.canXOF,r.create=o=>t(o),Object.assign(r,e),Object.freeze(r)}function it(t=32){st(t,"bytesLength");let e=typeof globalThis=="object"?globalThis.crypto:null;if(typeof e?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");if(t>65536)throw new RangeError(`"bytesLength" expected <= 65536, got ${t}`);return e.getRandomValues(new Uint8Array(t))}var cr=t=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,t])});function fr(t,e,r){return t&e^~t&r}function ar(t,e,r){return t&e^t&r^e&r}var Et=class{constructor(e,r,n,o){m(this,"blockLen");m(this,"outputLen");m(this,"canXOF",!1);m(this,"padOffset");m(this,"isLE");m(this,"buffer");m(this,"view");m(this,"finished",!1);m(this,"length",0);m(this,"pos",0);m(this,"destroyed",!1);this.blockLen=e,this.outputLen=r,this.padOffset=n,this.isLE=o,this.buffer=new Uint8Array(e),this.view=mt(this.buffer)}update(e){Jt(this),Se(e);let{view:r,buffer:n,blockLen:o}=this,s=e.length,i=!1;for(let c=0;c<s;){let f=Math.min(o-this.pos,s-c);if(f===o){let a=mt(e);for(;o<=s-c;c+=o)this.process(a,c);i=!0;continue}n.set(c===0&&f===s?e:e.subarray(c,c+f),this.pos),this.pos+=f,c+=f,this.pos===o&&(this.process(r,0),this.pos=0,i=!0)}return this.length+=e.length,i&&this.roundClean(),this}digestInto(e){Jt(this),rr(e,this),this.finished=!0;let{buffer:r,view:n,blockLen:o,isLE:s}=this,{pos:i}=this;r[i++]=128,r.fill(0,i),this.padOffset>o-i&&(this.process(n,0),r.fill(0)),er(n,o-8,this.length*8,s),this.process(n,0),this.roundClean();let c=e===r?n:mt(e),f=this.outputLen,a=f/4,u=this.get();if(f%4||a>u.length)throw new Error("invalid outputLen");for(let d=0;d<a;d++)c.setUint32(4*d,u[d],s)}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}_cloneIntoMeta(e){let{buffer:r,length:n,finished:o,destroyed:s,pos:i}=this;return e.destroyed=s,e.finished=o,e.length=n,e.pos=i,i&&e.buffer.set(r),e}clone(){return this._cloneInto()}},ur=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var bs=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),Oe=new Uint32Array(64),tn=class extends Et{constructor(r,n){super(64,r,8,!1);m(this,"A",0);m(this,"B",0);m(this,"C",0);m(this,"D",0);m(this,"E",0);m(this,"F",0);m(this,"G",0);m(this,"H",0);this.A=n[0]|0,this.B=n[1]|0,this.C=n[2]|0,this.D=n[3]|0,this.E=n[4]|0,this.F=n[5]|0,this.G=n[6]|0,this.H=n[7]|0}get(){let{A:r,B:n,C:o,D:s,E:i,F:c,G:f,H:a}=this;return[r,n,o,s,i,c,f,a]}set(r,n,o,s,i,c,f,a){this.A=r|0,this.B=n|0,this.C=o|0,this.D=s|0,this.E=i|0,this.F=c|0,this.G=f|0,this.H=a|0}_cloneInto(r){return(r||(r=new this.constructor)).set(...this.get()),this._cloneIntoMeta(r)}process(r,n){for(let y=0;y<16;y++,n+=4)Oe[y]=r.getUint32(n,!1);for(let y=16;y<64;y++){let l=Oe[y-15],x=Oe[y-2],A=le(l,7)^le(l,18)^l>>>3,B=le(x,17)^le(x,19)^x>>>10;Oe[y]=B+Oe[y-7]+A+Oe[y-16]|0}let{A:o,B:s,C:i,D:c,E:f,F:a,G:u,H:d}=this;for(let y=0;y<64;y++){let l=le(f,6)^le(f,11)^le(f,25),x=d+l+fr(f,a,u)+bs[y]+Oe[y]|0,B=(le(o,2)^le(o,13)^le(o,22))+ar(o,s,i)|0;d=u,u=a,a=f,f=c+x|0,c=i,i=s,s=o,o=x+B|0}o=o+this.A|0,s=s+this.B|0,i=i+this.C|0,c=c+this.D|0,f=f+this.E|0,a=a+this.F|0,u=u+this.G|0,d=d+this.H|0,this.set(o,s,i,c,f,a,u,d)}roundClean(){Qt(Oe)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),Qt(this.buffer)}},nn=class extends tn{constructor(){super(32,ur)}};var $e=ir(()=>new nn,cr(1));function vt(t,e,r=()=>{}){if(!Array.isArray(t))throw new TypeError(`"${e}" expected array, got type=${typeof t}`);for(let n=0;n<t.length;n++)r(t[n],`${e}[${n}]`);return t}var se=(t,e,r)=>Se(t,e,r),rn=st;function Te(t,e="object"){if(t===null||typeof t!="object"||Array.isArray(t))throw new TypeError(e==="object"?"expected valid options object":`"${e}" expected object, got type=${typeof t}`);return t}function Ne(t,e){if(typeof t!="function")throw new TypeError(`"${e}" is invalid: expected function, got ${typeof t}`);return t}var lr=Re,Ze=(...t)=>sr(...t),hr=t=>en(t),At=wt,br=t=>it(t),Bt=BigInt(0),dr=BigInt(1),ps=t=>t?`"${t}" `:"";function Ie(t,e=""){if(typeof t!="boolean")throw new TypeError(ps(e)+"expected boolean, got type="+typeof t);return t}function gs(t){if(typeof t=="bigint"){if(!Le(t))throw new RangeError("positive bigint expected, got "+t)}else rn(t);return t}function St(t,e=""){if(typeof t!="number"){let r=e&&`"${e}" `;throw new TypeError(r+"expected number, got type="+typeof t)}if(!Number.isSafeInteger(t)){let r=e&&`"${e}" `;throw new RangeError(r+"expected safe integer, got "+t)}}function pr(t){if(typeof t!="string")throw new TypeError("hex string expected, got "+typeof t);return t===""?Bt:BigInt("0x"+t)}function Ue(t){return pr(Re(t))}function on(t){return pr(Re(cn(Se(t)).reverse()))}function Rt(t,e){if(st(e),e===0)throw new Error("zero output length is invalid");t=gs(t);let r=e*2,n=t.toString(16);if(n.length>r)throw new RangeError("number is too large");return en(n.padStart(r,"0"))}function sn(t,e){return Rt(t,e).reverse()}function cn(t){return Uint8Array.from(se(t))}function gr(t){if(typeof t!="string")throw new TypeError("ascii string expected, got "+typeof t);return Uint8Array.from(t,(e,r)=>{let n=e.charCodeAt(0);if(e.length!==1||n>127)throw new RangeError(`string contains non-ASCII character "${t[r]}" with code ${n} at position ${r}`);return n})}function Le(t){return typeof t=="bigint"&&Bt<=t}function fn(t,e,r){return Le(t)&&Le(e)&&Le(r)&&e<=t&&t<r}function xr(t,e,r,n){if(!fn(e,r,n))throw new RangeError("expected valid "+t+": "+r+" <= n < "+n+", got "+e)}function Pe(t){if(t<Bt)throw new Error("expected non-negative bigint, got "+t);return t===Bt?0:t.toString(2).length}var Ot=t=>(St(t,"n"),(dr<<BigInt(t))-dr);function Tt(t,e={},r={},n="object"){Te(t,n),Te(e,"fields"),Te(r,"optFields");function o(i,c,f){let a=n==="object"?`param "${String(i)}"`:`"${n}.${String(i)}"`,u=t[i];if(!Object.hasOwn(t,i)&&(f?u!==void 0:c!=="function"))throw new TypeError(`${a} is invalid: expected own property`);if(f&&u===void 0)return;let d=typeof u;if(d!==c||u===null)throw new TypeError(`${a} is invalid: expected ${c}, got ${d}`)}let s=(i,c)=>Object.entries(i).forEach(([f,a])=>o(f,a,c));s(e,!1),s(r,!0)}var Q=BigInt(0),X=BigInt(1),Ce=BigInt(2),Er=BigInt(3),an=BigInt(4),Br=BigInt(5),xs=BigInt(7),vr=BigInt(8),ys=BigInt(9),ws=BigInt(15),Ar=BigInt(16),ms=BigInt("0x10000000000000000");function he(t,e){if(e<=Q)throw new Error("mod: expected positive modulus, got "+e);let r=t%e;return r>=Q?r:e+r}function Es(t,e,r){if(r<=X)throw new Error("pow: expected modulus > 1, got "+r);if(typeof e!="bigint")throw new TypeError("invalid exponent: expected bigint, got "+typeof e);if(e<Q)throw new Error("invalid exponent, negatives unsupported");if(e===Q)return X;if(e===X)return t;let n=t%r;if(n<Q&&(n+=r),e<ms){let c=X;for(;e>Q;)e&X&&(c=c*n%r),n=n*n%r,e>>=X;return c}let o=[];for(;e>Q;)o.push(Number(e&ws)),e>>=an;let s=new Array(16);s[0]=X,s[1]=n;for(let c=2;c<16;c++)s[c]=s[c-1]*n%r;let i=s[o[o.length-1]];for(let c=o.length-2;c>=0;c--){i=i*i%r,i=i*i%r,i=i*i%r,i=i*i%r;let f=o[c];f!==0&&(i=i*s[f]%r)}return i}function ce(t,e,r){if(r<=X)throw new Error("pow2: expected modulus > 1, got "+r);if(e<Q)throw new Error("pow2: expected non-negative exponent, got "+e);let n=t;for(;e-- >Q;)n*=n,n%=r;return n}function yr(t,e){if(t===Q)throw new Error("invert: expected non-zero number");if(e<=X)throw new Error("invert: expected modulus > 1, got "+e);let r=he(t,e),n=e,o=Q,s=X;for(;r!==Q;){let c=n/r,f=n-r*c,a=o-s*c;n=r,r=f,o=s,s=a}if(n!==X)throw new Error("invert: does not exist");return he(o,e)}function un(t,e,r){let n=t;if(!n.eql(n.sqr(e),r))throw new Error("Cannot find square root")}function dn(t,e){if((t&X)===Q)throw new Error(e+": expected odd modulus, got "+t)}function Sr(t,e){let r=t,n=(r.ORDER+X)/an,o=r.pow(e,n);return un(r,o,e),o}function Bs(t,e){let r=t,n=(r.ORDER-Br)/vr,o=r.mul(e,Ce),s=r.pow(o,n),i=r.mul(e,s),c=r.mul(r.mul(i,Ce),s),f=r.mul(i,r.sub(c,r.ONE));return un(r,f,e),f}function vs(t){let e=Ke(t),r=Rr(t),n=r(e,e.neg(e.ONE)),o=r(e,n),s=r(e,e.neg(n)),i=(t+xs)/Ar;return((c,f)=>{let a=c,u=a.pow(f,i),d=a.mul(u,n),y=a.mul(u,o),l=a.mul(u,s),x=a.eql(a.sqr(d),f),A=a.eql(a.sqr(y),f);u=a.cmov(u,d,x),d=a.cmov(l,y,A);let B=a.eql(a.sqr(d),f),L=a.cmov(u,d,B);return un(a,L,f),L})}function Rr(t){if(t<Er)throw new Error("sqrt is not defined for small field");dn(t,"tonelliShanks");let e=t-X,r=0;for(;e%Ce===Q;)e/=Ce,r++;let n=Ce,o=Ke(t);for(;wr(o,n)===1;)if(n++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(r===1)return Sr;let s=o.pow(n,e),i=(e+X)/Ce;return function(f,a){let u=f;if(u.is0(a))return a;if(wr(u,a)!==1)throw new Error("Cannot find square root");let d=r,y=u.mul(u.ONE,s),l=u.pow(a,e),x=u.pow(a,i);for(;!u.eql(l,u.ONE);){if(u.is0(l))throw new Error("Cannot find square root: probably non-prime P");let A=1,B=u.sqr(l);for(;!u.eql(B,u.ONE);)if(A++,B=u.sqr(B),A===d)throw new Error("Cannot find square root");let L=X<<BigInt(d-A-1),D=u.pow(y,L);d=A,y=u.sqr(D),l=u.mul(l,y),x=u.mul(x,D)}return x}}function As(t){return dn(t,"Fp.sqrt"),t%an===Er?Sr:t%vr===Br?Bs:t%Ar===ys?vs(t):Rr(t)}var Ss=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function Fe(t){if(Te(t,"field"),typeof t.ORDER!="bigint")throw new TypeError('param "ORDER" is invalid: expected bigint, got '+typeof t.ORDER);St(t.BYTES,"BYTES"),St(t.BITS,"BITS");for(let e of Ss)Ne(t[e],"field."+e);if(t.BYTES<1||t.BITS<1)throw new Error("invalid field: expected BYTES/BITS > 0");if(t.ORDER<=X)throw new Error("invalid field: expected ORDER > 1, got "+t.ORDER);return t}function ln(t,e,r=!1){Fe(t),vt(e,"nums"),Ie(r,"passZero");let n=t,o=new Array(e.length).fill(r?n.ZERO:void 0),s=e.reduce((c,f,a)=>n.is0(f)?c:(o[a]=c,n.mul(c,f)),n.ONE),i=n.inv(s);return e.reduceRight((c,f,a)=>n.is0(f)?c:(o[a]=n.mul(c,o[a]),n.mul(c,f)),i),o}function wr(t,e){Fe(t);let r=t;dn(r.ORDER,"FpLegendre");let n=(r.ORDER-X)/Ce,o=r.pow(e,n),s=r.eql(o,r.ONE),i=r.eql(o,r.ZERO),c=r.eql(o,r.neg(r.ONE));if(!s&&!i&&!c)throw new Error("invalid Legendre symbol result");return s?1:i?0:-1}function Rs(t,e){if(e!==void 0&&rn(e),t<=Q)throw new Error("invalid n length: expected positive n, got "+t);if(e!==void 0&&e<1)throw new Error("invalid n length: expected positive bit length, got "+e);let r=Pe(t);if(e!==void 0&&e<r)throw new Error(`invalid n length: expected nBitLength (${e}) >= bitLen(n) (${r})`);let n=e!==void 0?e:r,o=Math.ceil(n/8);return{nBitLength:n,nByteLength:o}}var mr=new WeakMap,Lt=class{constructor(e,r={}){m(this,"ORDER");m(this,"BITS");m(this,"BYTES");m(this,"isLE");m(this,"ZERO",Q);m(this,"ONE",X);m(this,"_lengths");m(this,"_mod");if(e<=X)throw new Error("invalid field: expected ORDER > 1, got "+e);let n;this.isLE=!1,r!=null&&typeof r=="object"&&(typeof r.BITS=="number"&&(n=r.BITS),typeof r.sqrt=="function"&&Object.defineProperty(this,"sqrt",{value:r.sqrt,enumerable:!0}),typeof r.isLE=="boolean"&&(this.isLE=r.isLE),r.allowedLengths&&(this._lengths=Object.freeze(r.allowedLengths.slice())),typeof r.modFromBytes=="boolean"&&(this._mod=r.modFromBytes));let{nBitLength:o,nByteLength:s}=Rs(e,n);if(s>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");this.ORDER=e,this.BITS=o,this.BYTES=s,Object.freeze(this)}create(e){return he(e,this.ORDER)}isValid(e){if(typeof e!="bigint")throw new TypeError("invalid field element: expected bigint, got "+typeof e);return Q<=e&&e<this.ORDER}is0(e){return e===Q}isValidNot0(e){return!this.is0(e)&&this.isValid(e)}isOdd(e){return(e&X)===X}neg(e){return he(-e,this.ORDER)}eql(e,r){return e===r}sqr(e){return he(e*e,this.ORDER)}add(e,r){return he(e+r,this.ORDER)}sub(e,r){return he(e-r,this.ORDER)}mul(e,r){return he(e*r,this.ORDER)}pow(e,r){return Es(e,r,this.ORDER)}div(e,r){return he(e*yr(r,this.ORDER),this.ORDER)}sqrN(e){return e*e}addN(e,r){return e+r}subN(e,r){return e-r}mulN(e,r){return e*r}inv(e){return yr(e,this.ORDER)}sqrt(e){let r=mr.get(this);return r||mr.set(this,r=As(this.ORDER)),r(this,e)}toBytes(e){return this.isLE?sn(e,this.BYTES):Rt(e,this.BYTES)}fromBytes(e,r=!1){se(e);let{_lengths:n,BYTES:o,isLE:s,ORDER:i,_mod:c}=this;if(n){if(e.length<1||!n.includes(e.length)||e.length>o)throw new Error("Field.fromBytes: expected "+n+" bytes, got "+e.length);let a=new Uint8Array(o);a.set(e,s?0:a.length-e.length),e=a}if(e.length!==o)throw new Error("Field.fromBytes: expected "+o+" bytes, got "+e.length);let f=s?on(e):Ue(e);if(c&&(f=he(f,i)),!r&&!this.isValid(f))throw new Error("invalid field element: outside of range 0..ORDER");return f}invertBatch(e){return ln(this,e,!0)}cmov(e,r,n){return Ie(n,"condition"),n?r:e}};function Ke(t,e={}){return Object.freeze(Lt.prototype),new Lt(t,e)}function Or(t){if(typeof t!="bigint")throw new Error("field order must be bigint");if(t<=X)throw new Error("field order must be greater than 1");let e=Pe(t-X);return Math.ceil(e/8)}function Os(t){let e=Or(t);return e+Math.ceil(e/2)}function Tr(t,e,r=!1){se(t);let n=t.length,o=Or(e),s=Math.max(Os(e),16);if(n<s||n>1024)throw new Error("expected "+s+"-1024 bytes of input, got "+n);let i=r?on(t):Ue(t),c=he(i,e-X)+X;return r?sn(c,o):Rt(c,o)}var pn=BigInt(0),ct=BigInt(1),Ts=BigInt(4),hn=16,Lr=128,Ls=5,Ir=2**31;function Ut(t){let e=t;if(typeof e!="function")throw new TypeError('"Point" expected constructor, got type='+typeof t);Ne(e.fromAffine,"Point.fromAffine"),Ne(e.fromBytes,"Point.fromBytes"),Ne(e.fromHex,"Point.fromHex"),Te(e.BASE,"Point.BASE"),Te(e.ZERO,"Point.ZERO"),Fe(e.Fp),Fe(e.Fn)}function _r(t,e){Ut(t),Hr(e,t);let r=ln(t.Fp,e.map(n=>n.Z));return e.map((n,o)=>t.fromAffine(n.toAffine(r[o])))}function Is(t,e,r=1){if(!Number.isSafeInteger(t)||t<r||t>e)throw new Error("invalid window size, expected ["+r+".."+e+"], got W="+t)}function Us(t,e){let r=t*(4*e+128);if(r>Ir)throw new Error("invalid window size: table would need ~"+Math.ceil(r/2**20)+" MiB, max "+Ir/2**20+" MiB")}function kr(t,e){if(t!==void 0){Ne(t,"randomBytes");try{let r=t(e);if(!At(r)||r.length!==e)return}catch{return}return t}}function Hr(t,e){vt(t,"points"),t.forEach((r,n)=>{if(!(r instanceof e))throw new Error("invalid point at index "+n)})}function _s(t,e,r){if(!Array.isArray(t))throw new Error("array of scalars expected");t.forEach((n,o)=>{if(!(r===void 0?e.isValid(n):Le(n)&&n<r))throw new Error("invalid scalar at index "+o)})}var Nr=new WeakMap;function bn(t){return Nr.get(t)||1}function ks(t,e){let r=t.double(),n=[t];for(let o=1;o<e;o++)n.push(n[o-1].add(r));return n}function Hs(t,e){let r=2**e,n=r/2,o=BigInt(r-1),s=[];for(;t>pn;){let i=0;t&ct&&(i=Number(t&o),i>=n&&(i-=r),t-=BigInt(i)),s.push(i),t>>=ct}return s}function Ns(t,e,r){let n=2**e,o=n/2,s=BigInt(n-1),i=BigInt(e),c=[];for(let f=0;f<r;f++){let a=Number(t&s);t>>=i,a>o&&(a-=n,t+=ct),c.push(a)}if(t!==pn)throw new Error("invalid wnaf");return c}function Cs(t,e,r){let n=0;for(let s of r)n=Math.max(n,s.length);let o=t;for(let s=n-1;s>=0;s--){s!==n-1&&(o=o.double());for(let i=0;i<r.length;i++){let c=r[i][s];if(c){let f=e[i][Math.abs(c)-1>>1];o=o.add(c<0?f.negate():f)}}}return o}var It=class{constructor(e,r){m(this,"Point");m(this,"BASE");m(this,"ZERO");m(this,"randomBytes");m(this,"wnafPrecomputes",new WeakMap);m(this,"baseCanBeBlinded");m(this,"bits");Ut(e),this.randomBytes=kr(r,hn),this.Point=e,this.BASE=e.BASE,this.ZERO=e.ZERO,this.bits=e.Fn.BITS}buildWnafTable(e,r,n){let o=Math.ceil(n/r)+1,s=2**(r-1),i=[],c=e;for(let f=0;f<o;f++){let a=c;for(let u=0;u<s;u++)i.push(a),a=a.add(c);c=i[i.length-1].double()}return{W:r,bits:n,windows:o,comp:i}}wnafCachedCT(e,r){let{W:n,windows:o,comp:s}=e,i=2**(n-1),c=Ns(r,n,o),f=this.ZERO,a=this.BASE;for(let u=0;u<o;u++){let d=c[u],y=u*i,l=Math.abs(d)-1,x=s[y];for(let B=1;B<i;B++)x=B===l?s[y+B]:x;let A=x.negate();d===0?a=a.add(s[y]):f=f.add(d<0?A:x)}return{p:f,f:a}}getWnafPrecomputes(e,r,n,o){let s=this.wnafPrecomputes.get(r),i=s?.find(c=>c.W===e&&c.bits===n);return i||(i=this.buildWnafTable(r,e,n),typeof o=="function"&&(i={...i,comp:o(i.comp)}),s||(s=[],this.wnafPrecomputes.set(r,s)),s.push(i)),i}assertPoint(e){if(!(e instanceof this.Point))throw new TypeError('"point" expected Point instance, got type='+typeof e)}validateMulInput(e,r){if(this.assertPoint(e),!fn(r,ct,this.Point.Fn.ORDER))throw new Error("invalid scalar")}runCT(e,r,n,o){let s=bn(e);return s===1?this.fixedWindowCT(e,r,n):this.wnafCachedCT(this.getWnafPrecomputes(s,e,n,o),r)}mulCT(e,r,n){return this.validateMulInput(e,r),this.runCT(e,r,this.bits,n)}mulCTBlinded(e,r,n){if(this.validateMulInput(e,r),this.randomBytes===void 0)throw new Error("randomBytes is required for scalar blinding");let o=this.Point.Fn.BITS+Lr,s=this.randomBytes(hn);if(!At(s)||s.length!==hn)throw new Error("randomBytes returned invalid byte array");s[0]=s[0]&63|128;let i=r+Ue(s)*this.Point.Fn.ORDER;return this.runCT(e,i,o,n)}fixedWindowCT(e,r,n){let o=Ls,s=1<<o,i=Ot(o),c=new Array(s);c[0]=this.ZERO;for(let u=1;u<s;u++)c[u]=c[u-1].add(e);let f=Math.ceil(n/o),a=this.ZERO;for(let u=f-1;u>=0;u--){if(u!==f-1)for(let l=0;l<o;l++)a=a.double();let d=Number(r>>BigInt(u*o)&i),y=c[0];for(let l=1;l<s;l++)y=l===d?c[l]:y;a=a.add(y)}return{p:a,f:a}}shouldBlind(e,r){return this.randomBytes===void 0?!1:r===ct?!0:e!==this.BASE?!1:(this.baseCanBeBlinded===void 0&&(this.baseCanBeBlinded=this.mulUnsafe(this.BASE,this.Point.Fn.ORDER).is0()),this.baseCanBeBlinded)}mulSecret(e,r,n,o){return this.shouldBlind(e,n)?this.mulCTBlinded(e,r,o):this.mulCT(e,r,o)}mulUnsafe(e,r,n){if(this.assertPoint(e),!Le(r))throw new Error("invalid scalar");let o=bn(e);if(o===1||r>=this.Point.Fn.ORDER)return _t(this.Point,[e],[r],!0);let s=this.getWnafPrecomputes(o,e,this.bits,n);return this.wnafCachedCT(s,r).p}setWindowSize(e,r){this.assertPoint(e),Is(r,this.bits);let n=Math.ceil((this.bits+Lr)/r)+1;Us(n*2**(r-1),this.Point.Fp.BYTES),Nr.set(e,r),this.wnafPrecomputes.delete(e)}hasWindowSize(e){return bn(e)!==1}};function _t(t,e,r,n=!1){if(Ut(t),Hr(e,t),Ie(n,"allowOversized"),_s(r,t.Fn,n?t.Fn.ORDER**Ts:void 0),e.length!==r.length)throw new Error("arrays of points and scalars must have equal length");let o=e.map(i=>ks(i,4)),s=r.map(i=>Hs(i,4));return Cs(t.ZERO,o,s)}function Ur(t,e,r){if(e){if(e.ORDER!==t)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return Fe(e),e}else return Ke(t,{isLE:r})}function Cr(t,e,r={},n){if(t!=="weierstrass"&&t!=="edwards")throw new Error('expected curve type "weierstrass" or "edwards"');if(n===void 0&&(n=t==="edwards"),!e||typeof e!="object")throw new Error(`expected valid ${t} CURVE object`);Tt(r);for(let f of["p","n","h"]){let a=e[f];if(!(Le(a)&&a!==pn))throw new Error(`CURVE.${f} must be positive bigint`)}let o=Ur(e.p,r.Fp,n),s=Ur(e.n,r.Fn,n),c=["Gx","Gy","a",t==="weierstrass"?"b":"d"];for(let f of c)if(!o.isValid(e[f]))throw new Error(`CURVE.${f} must be valid field element of CURVE.Fp`);return e=Object.freeze(Object.assign({},e)),{CURVE:e,Fp:o,Fn:s}}function gn(t,e){return function(n){let o=t(n);return{secretKey:o,publicKey:e(o)}}}var qr=(t,e)=>(t+(t>=0?e:-e)/Ds)/e;function qs(t,e,r){xr("scalar",t,ze,r);let[[n,o],[s,i]]=e,c=qr(i*t,r),f=qr(-o*t,r),a=t-c*n-f*s,u=-c*o-f*i,d=a<ze,y=u<ze;d&&(a=-a),y&&(u=-u);let l=Ot(Math.ceil(Pe(r)/2))+ft;if(a<ze||a>=l||u<ze||u>=l)throw new Error("splitScalar (endomorphism): failed for k");return{k1neg:d,k1:a,k2neg:y,k2:u}}var ze=BigInt(0),ft=BigInt(1),Ds=BigInt(2),xn=BigInt(3),Ms=BigInt(4);function Dr(t,e={}){let r=Cr("weierstrass",t,e),n=r.Fp,o=r.Fn,s=r.CURVE,{h:i,n:c}=s;Tt(e,{},{allowInfinityPoint:"boolean",clearCofactor:"function",isTorsionFree:"function",fromBytes:"function",toBytes:"function",endo:"object",randomBytes:"function"});let{endo:f,allowInfinityPoint:a,clearCofactor:u,isTorsionFree:d,fromBytes:y,toBytes:l}=e,x=e.randomBytes===void 0?br:e.randomBytes;if(f&&(!n.is0(s.a)||typeof f.beta!="bigint"||!Array.isArray(f.basises)))throw new Error('invalid endo: expected "beta": bigint and "basises": array');let A=f?{beta:f.beta,basises:f.basises.map(w=>[...w])}:void 0,B=Vs(n,o);function L(){if(!n.isOdd)throw new Error("compression is not supported: Field does not have .isOdd()")}function D(w,g,E){if(g.is0()){if(!a)throw new Error("bad point: ZERO");return Uint8Array.of(0)}let{x:I,y:_}=g.toAffine(),T=n.toBytes(I);if(Ie(E,"isCompressed"),E){L();let k=!n.isOdd(_);return Ze(js(k),T)}else return Ze(Uint8Array.of(4),T,n.toBytes(_))}function P(w){se(w,void 0,"Point");let{publicKey:g,publicKeyUncompressed:E}=B,I=w.length,_=w[0],T=w.subarray(1);if(a&&I===1&&_===0)return{x:n.ZERO,y:n.ZERO};if(I===g&&(_===2||_===3)){let k=n.fromBytes(T);if(!n.isValid(k))throw new Error("bad point: is not on curve, wrong x");let q=Y(k),U;try{U=n.sqrt(q)}catch(J){let ne=J instanceof Error?": "+J.message:"";throw new Error("bad point: is not on curve, sqrt error"+ne)}L();let V=n.isOdd(U);return(_&1)===1!==V&&(U=n.neg(U)),{x:k,y:U}}else if(I===E&&_===4){let k=n.BYTES,q=n.fromBytes(T.subarray(0,k)),U=n.fromBytes(T.subarray(k,k*2));if(!$(q,U))throw new Error("bad point: is not on curve");return{x:q,y:U}}else throw new Error(`bad point: got length ${I}, expected compressed=${g} or uncompressed=${E}`)}let j=l===void 0?D:l,G=y===void 0?P:y,K=n.mul(s.b,xn),z=n.is0(s.a)?w=>n.ZERO:w=>n.mul(s.a,w);function Y(w){let g=n.sqr(w),E=n.mul(g,w);return n.add(n.add(E,n.mul(w,s.a)),s.b)}function $(w,g){let E=n.sqr(g),I=Y(w);return n.eql(E,I)}if(!$(s.Gx,s.Gy))throw new Error("bad curve params: generator point");let F=n.mul(n.pow(s.a,xn),Ms),M=n.mul(n.sqr(s.b),BigInt(27));if(n.is0(n.add(F,M)))throw new Error("bad curve params: a or b");function C(w,g,E=!1){if(!n.isValid(g)||E&&n.is0(g))throw new Error(`bad point coordinate ${w}`);return typeof g=="object"&&g!==null?n.create(g):g}function H(w){if(!(w instanceof S))throw new Error("Weierstrass Point expected")}function h(w){if(!A||!A.basises)throw new Error("no endo");return qs(w,A.basises,o.ORDER)}function b(w,g,E,I){if(!o.isValid(I))throw new RangeError("invalid scalar: out of range");if(A){let{k1neg:_,k1:T,k2neg:k,k2:q}=h(I),U=new S(n.mul(E.X,A.beta),E.Y,E.Z);w.push(_?E.negate():E,k?U.negate():U),g.push(T,q)}else w.push(E),g.push(I)}let v=new WeakSet,R=class R{constructor(g,E,I){m(this,"X");m(this,"Y");m(this,"Z");this.X=C("x",g),this.Y=C("y",E,!0),this.Z=C("z",I),Object.freeze(this)}static CURVE(){return s}static fromAffine(g){let{x:E,y:I}=g||{};if(!g||!n.isValid(E)||!n.isValid(I))throw new Error("invalid affine point");if(g instanceof R)throw new Error("projective point not allowed");return n.is0(E)&&n.is0(I)?R.ZERO:new R(E,I,n.ONE)}static fromBytes(g){let E=R.fromAffine(G(se(g,void 0,"point")));return E.assertValidity(),E}static fromHex(g){return R.fromBytes(hr(g))}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(g=6,E=!0){return p.setWindowSize(this,g),E||this.multiply(xn),this}assertValidity(){let g=this;if(g.is0()){if(a&&n.is0(g.X)&&n.eql(g.Y,n.ONE)&&n.is0(g.Z))return;throw new Error("bad point: ZERO")}if(v.has(g))return;let{x:E,y:I}=g.toAffine();if(!n.isValid(E)||!n.isValid(I))throw new Error("bad point: x or y not field elements");if(!$(E,I))throw new Error("bad point: equation left != right");if(!g.isTorsionFree())throw new Error("bad point: not in prime-order subgroup");v.add(g)}hasEvenY(){let{y:g}=this.toAffine();if(!n.isOdd)throw new Error("Field doesn't support isOdd");return!n.isOdd(g)}equals(g){H(g);let{X:E,Y:I,Z:_}=this,{X:T,Y:k,Z:q}=g,U=n.eql(n.mul(E,q),n.mul(T,_)),V=n.eql(n.mul(I,q),n.mul(k,_));return U&&V}negate(){return new R(this.X,n.neg(this.Y),this.Z)}double(){let{X:g,Y:E,Z:I}=this,_=n.ZERO,T=n.ZERO,k=n.ZERO,q=n.mul(g,g),U=n.mul(E,E),V=n.mul(I,I),Z=n.mul(g,E);return Z=n.add(Z,Z),k=n.mul(g,I),k=n.add(k,k),_=z(k),T=n.mul(K,V),T=n.add(_,T),_=n.sub(U,T),T=n.add(U,T),T=n.mul(_,T),_=n.mul(Z,_),k=n.mul(K,k),V=z(V),Z=n.sub(q,V),Z=z(Z),Z=n.add(Z,k),k=n.add(q,q),q=n.add(k,q),q=n.add(q,V),q=n.mul(q,Z),T=n.add(T,q),V=n.mul(E,I),V=n.add(V,V),q=n.mul(V,Z),_=n.sub(_,q),k=n.mul(V,U),k=n.add(k,k),k=n.add(k,k),new R(_,T,k)}add(g){H(g);let{X:E,Y:I,Z:_}=this,{X:T,Y:k,Z:q}=g,U=n.ZERO,V=n.ZERO,Z=n.ZERO,J=n.mul(E,T),ne=n.mul(I,k),de=n.mul(_,q),Ve=n.add(E,I),oe=n.add(T,k);Ve=n.mul(Ve,oe),oe=n.add(J,ne),Ve=n.sub(Ve,oe),oe=n.add(E,_);let ge=n.add(T,q);return oe=n.mul(oe,ge),ge=n.add(J,de),oe=n.sub(oe,ge),ge=n.add(I,_),U=n.add(k,q),ge=n.mul(ge,U),U=n.add(ne,de),ge=n.sub(ge,U),Z=z(oe),U=n.mul(K,de),Z=n.add(U,Z),U=n.sub(ne,Z),Z=n.add(ne,Z),V=n.mul(U,Z),ne=n.add(J,J),ne=n.add(ne,J),de=z(de),oe=n.mul(K,oe),ne=n.add(ne,de),de=n.sub(J,de),de=z(de),oe=n.add(oe,de),J=n.mul(ne,oe),V=n.add(V,J),J=n.mul(ge,oe),U=n.mul(Ve,U),U=n.sub(U,J),J=n.mul(Ve,ne),Z=n.mul(ge,Z),Z=n.add(Z,J),new R(U,V,Z)}subtract(g){return H(g),this.add(g.negate())}is0(){return this.equals(R.ZERO)}multiply(g){if(!o.isValidNot0(g))throw new RangeError("invalid scalar: out of range");let{p:E,f:I}=p.mulSecret(this,g,i,O);return O([E,I])[0]}multiplyUnsafe(g){let E=this,I=g;if(!o.isValid(I))throw new RangeError("invalid scalar: out of range");if(I===ze||E.is0())return R.ZERO;if(I===ft)return E;if(p.hasWindowSize(this))return p.mulUnsafe(E,I,O);let _=[],T=[];return b(_,T,E,I),_t(R,_,T)}mulAddUnsafe(g,E,I){H(E);let _=[],T=[];return b(_,T,this,g),b(_,T,E,I),_t(R,_,T)}toAffine(g){let E=this,I=g;if(I!=null&&!n.isValid(I))throw new RangeError('"invertedZ" expected valid field element');let{X:_,Y:T,Z:k}=E;if(n.eql(k,n.ONE))return{x:_,y:T};let q=E.is0();I==null&&(I=q?n.ONE:n.inv(k));let U=n.mul(_,I),V=n.mul(T,I),Z=n.mul(k,I);if(q)return{x:n.ZERO,y:n.ZERO};if(!n.eql(Z,n.ONE))throw new Error("invZ was invalid");return{x:U,y:V}}isTorsionFree(){return i===ft?!0:d?d(R,this):p.mulUnsafe(this,c).is0()}clearCofactor(){return i===ft?this:u?u(R,this):this.multiplyUnsafe(i)}isSmallOrder(){return i===ft?this.is0():this.clearCofactor().is0()}toBytes(g=!0){return Ie(g,"isCompressed"),this.assertValidity(),j(R,this,g)}toHex(g=!0){return lr(this.toBytes(g))}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}};m(R,"BASE",new R(s.Gx,s.Gy,n.ONE)),m(R,"ZERO",new R(n.ZERO,n.ONE,n.ZERO)),m(R,"Fp",n),m(R,"Fn",o);let S=R,O=w=>_r(S,w),p=new It(S,x);return p.bits>=6&&S.BASE.precompute(6),Object.freeze(S.prototype),Object.freeze(S),S}function js(t){return Uint8Array.of(t?2:3)}function Vs(t,e){return{secretKey:e.BYTES,publicKey:1+t.BYTES,publicKeyUncompressed:1+2*t.BYTES,publicKeyHasPrefix:!0,signature:2*e.BYTES}}var Ht={p:BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f"),n:BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"),h:BigInt(1),a:BigInt(0),b:BigInt(7),Gx:BigInt("0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"),Gy:BigInt("0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8")},$s={beta:BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),basises:[[BigInt("0x3086d221a7d46bcde86c90e49284eb15"),-BigInt("0xe4437ed6010e88286f547fa90abfe4c3")],[BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"),BigInt("0x3086d221a7d46bcde86c90e49284eb15")]]},Zs=BigInt(0),Mr=BigInt(2);function Ps(t){let e=Ht.p,r=BigInt(3),n=BigInt(6),o=BigInt(11),s=BigInt(22),i=BigInt(23),c=BigInt(44),f=BigInt(88),a=t*t*t%e,u=a*a*t%e,d=ce(u,r,e)*u%e,y=ce(d,r,e)*u%e,l=ce(y,Mr,e)*a%e,x=ce(l,o,e)*l%e,A=ce(x,s,e)*x%e,B=ce(A,c,e)*A%e,L=ce(B,f,e)*B%e,D=ce(L,c,e)*A%e,P=ce(D,r,e)*u%e,j=ce(P,i,e)*x%e,G=ce(j,n,e)*a%e,K=ce(G,Mr,e);if(!We.eql(We.sqr(K),t))throw new Error("Cannot find square root");return K}var We=Ke(Ht.p,{sqrt:Ps}),Ge=Dr(Ht,{Fp:We,endo:$s});var jr=Object.create(null);function kt(t,...e){let r=jr[t];if(r===void 0){let n=$e(gr(t));r=Ze(n,n),jr[t]=r}return $e(Ze(r,...e))}var $r=t=>t.toBytes(!0).slice(1),Zr=({x:t})=>We.toBytes(t),Nt=t=>!We.isOdd(t);function Pr(t){let{Fn:e,BASE:r}=Ge,n=e.fromBytes(se(t,32,"secretKey")),s=r.multiply(n).toAffine();return{scalar:Nt(s.y)?n:e.neg(n),bytes:Zr(s)}}function Fr(t){let e=We;if(!e.isValidNot0(t))throw new Error("invalid x: Fail if x \u2265 p");let r=e.sqr(t),n=e.add(e.mulN(r,t),BigInt(7)),o=e.sqrt(n);Nt(o)||(o=e.neg(o));let s=Ge.fromAffine({x:t,y:o});return s.assertValidity(),s}var Ye=Ue;function Kr(...t){return Ge.Fn.create(Ye(kt("BIP0340/challenge",...t)))}function Vr(t){return Pr(t).bytes}function Fs(t,e,r=it(32)){let{Fn:n,BASE:o}=Ge,s=cn(se(t,void 0,"message")),{bytes:i,scalar:c}=Pr(e),f=se(r,32,"auxRand"),a=n.toBytes(c^Ye(kt("BIP0340/aux",f))),u=kt("BIP0340/nonce",a,i,s),d=n.create(Ye(u));if(d===Zs)throw new Error("sign failed: k is zero");let l=o.multiply(d).toAffine(),x=Nt(l.y)?d:n.neg(d),A=Zr(l),B=Kr(A,i,s),L=new Uint8Array(64);if(L.set(A,0),L.set(n.toBytes(n.create(x+B*c)),32),!zr(L,s,i))throw new Error("sign: Invalid signature produced");return L}function zr(t,e,r){let{Fp:n,Fn:o,BASE:s}=Ge,i=se(t,64,"signature"),c=se(e,void 0,"message"),f=se(r,32,"publicKey");try{let a=Fr(Ye(f)),u=i.subarray(0,32),d=Ye(u);if(!n.isValidNot0(d))return!1;let y=Ye(i.subarray(32,64));if(!o.isValidNot0(y))return!1;let l=Kr(u,$r(a),c),x=s.mulAddUnsafe(y,a,o.neg(l)),{x:A,y:B}=x.toAffine();return!(x.is0()||!Nt(B)||!n.eql(A,d))}catch{return!1}}var at=(()=>{let r=n=>(n=n===void 0?it(48):n,Tr(se(n,48,"seed"),Ht.n));return Object.freeze({keygen:gn(r,Vr),getPublicKey:Vr,sign:Fs,verify:zr,Point:Ge,utils:Object.freeze({randomSecretKey:r,taggedHash:kt,lift_x:Fr,pointToBytes:$r}),lengths:Object.freeze({secretKey:32,publicKey:32,publicKeyHasPrefix:!1,signature:64,seed:48})})})();function Ks(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"}function Ct(t){if(typeof t!="boolean")throw new Error(`boolean expected, not ${t}`)}function qt(t){if(!Number.isSafeInteger(t)||t<0)throw new Error("positive integer expected, got "+t)}function ee(t,e,r=""){let n=Ks(t),o=t?.length,s=e!==void 0;if(!n||s&&o!==e){let i=r&&`"${r}" `,c=s?` of length ${e}`:"",f=n?`length=${o}`:`type=${typeof t}`;throw new Error(i+"expected Uint8Array"+c+", got "+f)}return t}function yn(t,e=!0){if(t.destroyed)throw new Error("Hash instance has been destroyed");if(e&&t.finished)throw new Error("Hash#digest() has already been called")}function Yr(t,e){ee(t,void 0,"output");let r=e.outputLen;if(t.length<r)throw new Error("digestInto() expects output buffer of length at least "+r)}function xe(t){return new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4))}function ye(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function zs(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}var Ys=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function Wr(t,e){if(e==null||typeof e!="object")throw new Error("options must be defined");return Object.assign(t,e)}function Dt(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t[n]^e[n];return r===0}var wn=(t,e)=>{function r(n,...o){if(ee(n,void 0,"key"),!Ys)throw new Error("Non little-endian hardware is not yet supported");if(t.nonceLength!==void 0){let u=o[0];ee(u,t.varSizeNonce?void 0:t.nonceLength,"nonce")}let s=t.tagLength;s&&o[1]!==void 0&&ee(o[1],void 0,"AAD");let i=e(n,...o),c=(u,d)=>{if(d!==void 0){if(u!==2)throw new Error("cipher output not supported");ee(d,void 0,"output")}},f=!1;return{encrypt(u,d){if(f)throw new Error("cannot encrypt() twice with same key + nonce");return f=!0,ee(u),c(i.encrypt.length,d),i.encrypt(u,d)},decrypt(u,d){if(ee(u),s&&u.length<s)throw new Error('"ciphertext" expected length bigger than tagLength='+s);return c(i.decrypt.length,d),i.decrypt(u,d)}}}return Object.assign(r,t),r};function mn(t,e,r=!0){if(e===void 0)return new Uint8Array(t);if(e.length!==t)throw new Error('"output" expected Uint8Array of length '+t+", got: "+e.length);if(r&&!Ws(e))throw new Error("invalid output, must be aligned");return e}function Gr(t,e,r){Ct(r);let n=new Uint8Array(16),o=zs(n);return o.setBigUint64(0,BigInt(e),r),o.setBigUint64(8,BigInt(t),r),n}function Ws(t){return t.byteOffset%4===0}function Xe(t){return Uint8Array.from(t)}var Jr=t=>Uint8Array.from(t.split(""),e=>e.charCodeAt(0)),Gs=Jr("expand 16-byte k"),Xs=Jr("expand 32-byte k"),Js=xe(Gs),Qs=xe(Xs);function N(t,e){return t<<e|t>>>32-e}function En(t){return t.byteOffset%4===0}var Mt=64,ei=16,Qr=2**32-1,Xr=Uint32Array.of();function ti(t,e,r,n,o,s,i,c){let f=o.length,a=new Uint8Array(Mt),u=xe(a),d=En(o)&&En(s),y=d?xe(o):Xr,l=d?xe(s):Xr;for(let x=0;x<f;i++){if(t(e,r,n,u,i,c),i>=Qr)throw new Error("arx: counter overflow");let A=Math.min(Mt,f-x);if(d&&A===Mt){let B=x/4;if(x%4!==0)throw new Error("arx: invalid block position");for(let L=0,D;L<ei;L++)D=B+L,l[D]=y[D]^u[L];x+=Mt;continue}for(let B=0,L;B<A;B++)L=x+B,s[L]=o[L]^a[B];x+=A}}function Bn(t,e){let{allowShortKeys:r,extendNonceFn:n,counterLength:o,counterRight:s,rounds:i}=Wr({allowShortKeys:!1,counterLength:8,counterRight:!1,rounds:20},e);if(typeof t!="function")throw new Error("core must be a function");return qt(o),qt(i),Ct(s),Ct(r),(c,f,a,u,d=0)=>{ee(c,void 0,"key"),ee(f,void 0,"nonce"),ee(a,void 0,"data");let y=a.length;if(u===void 0&&(u=new Uint8Array(y)),ee(u,void 0,"output"),qt(d),d<0||d>=Qr)throw new Error("arx: counter overflow");if(u.length<y)throw new Error(`arx: output (${u.length}) is shorter than data (${y})`);let l=[],x=c.length,A,B;if(x===32)l.push(A=Xe(c)),B=Qs;else if(x===16&&r)A=new Uint8Array(32),A.set(c),A.set(c,16),B=Js,l.push(A);else throw ee(c,32,"arx key"),new Error("invalid key size");En(f)||l.push(f=Xe(f));let L=xe(A);if(n){if(f.length!==24)throw new Error("arx: extended nonce must be 24 bytes");n(B,L,xe(f.subarray(0,16)),L),f=f.subarray(16)}let D=16-o;if(D!==f.length)throw new Error(`arx: nonce must be ${D} or 16 bytes`);if(D!==12){let j=new Uint8Array(12);j.set(f,s?0:12-f.length),f=j,l.push(f)}let P=xe(f);return ti(t,B,L,P,a,u,d,i),ye(...l),u}}function te(t,e){return t[e++]&255|(t[e++]&255)<<8}var vn=class{constructor(e){m(this,"blockLen",16);m(this,"outputLen",16);m(this,"buffer",new Uint8Array(16));m(this,"r",new Uint16Array(10));m(this,"h",new Uint16Array(10));m(this,"pad",new Uint16Array(8));m(this,"pos",0);m(this,"finished",!1);e=Xe(ee(e,32,"key"));let r=te(e,0),n=te(e,2),o=te(e,4),s=te(e,6),i=te(e,8),c=te(e,10),f=te(e,12),a=te(e,14);this.r[0]=r&8191,this.r[1]=(r>>>13|n<<3)&8191,this.r[2]=(n>>>10|o<<6)&7939,this.r[3]=(o>>>7|s<<9)&8191,this.r[4]=(s>>>4|i<<12)&255,this.r[5]=i>>>1&8190,this.r[6]=(i>>>14|c<<2)&8191,this.r[7]=(c>>>11|f<<5)&8065,this.r[8]=(f>>>8|a<<8)&8191,this.r[9]=a>>>5&127;for(let u=0;u<8;u++)this.pad[u]=te(e,16+2*u)}process(e,r,n=!1){let o=n?0:2048,{h:s,r:i}=this,c=i[0],f=i[1],a=i[2],u=i[3],d=i[4],y=i[5],l=i[6],x=i[7],A=i[8],B=i[9],L=te(e,r+0),D=te(e,r+2),P=te(e,r+4),j=te(e,r+6),G=te(e,r+8),K=te(e,r+10),z=te(e,r+12),Y=te(e,r+14),$=s[0]+(L&8191),F=s[1]+((L>>>13|D<<3)&8191),M=s[2]+((D>>>10|P<<6)&8191),C=s[3]+((P>>>7|j<<9)&8191),H=s[4]+((j>>>4|G<<12)&8191),h=s[5]+(G>>>1&8191),b=s[6]+((G>>>14|K<<2)&8191),v=s[7]+((K>>>11|z<<5)&8191),S=s[8]+((z>>>8|Y<<8)&8191),O=s[9]+(Y>>>5|o),p=0,R=p+$*c+F*(5*B)+M*(5*A)+C*(5*x)+H*(5*l);p=R>>>13,R&=8191,R+=h*(5*y)+b*(5*d)+v*(5*u)+S*(5*a)+O*(5*f),p+=R>>>13,R&=8191;let w=p+$*f+F*c+M*(5*B)+C*(5*A)+H*(5*x);p=w>>>13,w&=8191,w+=h*(5*l)+b*(5*y)+v*(5*d)+S*(5*u)+O*(5*a),p+=w>>>13,w&=8191;let g=p+$*a+F*f+M*c+C*(5*B)+H*(5*A);p=g>>>13,g&=8191,g+=h*(5*x)+b*(5*l)+v*(5*y)+S*(5*d)+O*(5*u),p+=g>>>13,g&=8191;let E=p+$*u+F*a+M*f+C*c+H*(5*B);p=E>>>13,E&=8191,E+=h*(5*A)+b*(5*x)+v*(5*l)+S*(5*y)+O*(5*d),p+=E>>>13,E&=8191;let I=p+$*d+F*u+M*a+C*f+H*c;p=I>>>13,I&=8191,I+=h*(5*B)+b*(5*A)+v*(5*x)+S*(5*l)+O*(5*y),p+=I>>>13,I&=8191;let _=p+$*y+F*d+M*u+C*a+H*f;p=_>>>13,_&=8191,_+=h*c+b*(5*B)+v*(5*A)+S*(5*x)+O*(5*l),p+=_>>>13,_&=8191;let T=p+$*l+F*y+M*d+C*u+H*a;p=T>>>13,T&=8191,T+=h*f+b*c+v*(5*B)+S*(5*A)+O*(5*x),p+=T>>>13,T&=8191;let k=p+$*x+F*l+M*y+C*d+H*u;p=k>>>13,k&=8191,k+=h*a+b*f+v*c+S*(5*B)+O*(5*A),p+=k>>>13,k&=8191;let q=p+$*A+F*x+M*l+C*y+H*d;p=q>>>13,q&=8191,q+=h*u+b*a+v*f+S*c+O*(5*B),p+=q>>>13,q&=8191;let U=p+$*B+F*A+M*x+C*l+H*y;p=U>>>13,U&=8191,U+=h*d+b*u+v*a+S*f+O*c,p+=U>>>13,U&=8191,p=(p<<2)+p|0,p=p+R|0,R=p&8191,p=p>>>13,w+=p,s[0]=R,s[1]=w,s[2]=g,s[3]=E,s[4]=I,s[5]=_,s[6]=T,s[7]=k,s[8]=q,s[9]=U}finalize(){let{h:e,pad:r}=this,n=new Uint16Array(10),o=e[1]>>>13;e[1]&=8191;for(let c=2;c<10;c++)e[c]+=o,o=e[c]>>>13,e[c]&=8191;e[0]+=o*5,o=e[0]>>>13,e[0]&=8191,e[1]+=o,o=e[1]>>>13,e[1]&=8191,e[2]+=o,n[0]=e[0]+5,o=n[0]>>>13,n[0]&=8191;for(let c=1;c<10;c++)n[c]=e[c]+o,o=n[c]>>>13,n[c]&=8191;n[9]-=8192;let s=(o^1)-1;for(let c=0;c<10;c++)n[c]&=s;s=~s;for(let c=0;c<10;c++)e[c]=e[c]&s|n[c];e[0]=(e[0]|e[1]<<13)&65535,e[1]=(e[1]>>>3|e[2]<<10)&65535,e[2]=(e[2]>>>6|e[3]<<7)&65535,e[3]=(e[3]>>>9|e[4]<<4)&65535,e[4]=(e[4]>>>12|e[5]<<1|e[6]<<14)&65535,e[5]=(e[6]>>>2|e[7]<<11)&65535,e[6]=(e[7]>>>5|e[8]<<8)&65535,e[7]=(e[8]>>>8|e[9]<<5)&65535;let i=e[0]+r[0];e[0]=i&65535;for(let c=1;c<8;c++)i=(e[c]+r[c]|0)+(i>>>16)|0,e[c]=i&65535;ye(n)}update(e){yn(this),ee(e),e=Xe(e);let{buffer:r,blockLen:n}=this,o=e.length;for(let s=0;s<o;){let i=Math.min(n-this.pos,o-s);if(i===n){for(;n<=o-s;s+=n)this.process(e,s);continue}r.set(e.subarray(s,s+i),this.pos),this.pos+=i,s+=i,this.pos===n&&(this.process(r,0,!1),this.pos=0)}return this}destroy(){ye(this.h,this.r,this.buffer,this.pad)}digestInto(e){yn(this),Yr(e,this),this.finished=!0;let{buffer:r,h:n}=this,{pos:o}=this;if(o){for(r[o++]=1;o<16;o++)r[o]=0;this.process(r,0,!0)}this.finalize();let s=0;for(let i=0;i<8;i++)e[s++]=n[i]>>>0,e[s++]=n[i]>>>8;return e}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}};function ni(t){let e=(n,o)=>t(o).update(n).digest(),r=t(new Uint8Array(32));return e.outputLen=r.outputLen,e.blockLen=r.blockLen,e.create=n=>t(n),e}var eo=ni(t=>new vn(t));function ro(t,e,r,n,o,s=20){let i=t[0],c=t[1],f=t[2],a=t[3],u=e[0],d=e[1],y=e[2],l=e[3],x=e[4],A=e[5],B=e[6],L=e[7],D=o,P=r[0],j=r[1],G=r[2],K=i,z=c,Y=f,$=a,F=u,M=d,C=y,H=l,h=x,b=A,v=B,S=L,O=D,p=P,R=j,w=G;for(let E=0;E<s;E+=2)K=K+F|0,O=N(O^K,16),h=h+O|0,F=N(F^h,12),K=K+F|0,O=N(O^K,8),h=h+O|0,F=N(F^h,7),z=z+M|0,p=N(p^z,16),b=b+p|0,M=N(M^b,12),z=z+M|0,p=N(p^z,8),b=b+p|0,M=N(M^b,7),Y=Y+C|0,R=N(R^Y,16),v=v+R|0,C=N(C^v,12),Y=Y+C|0,R=N(R^Y,8),v=v+R|0,C=N(C^v,7),$=$+H|0,w=N(w^$,16),S=S+w|0,H=N(H^S,12),$=$+H|0,w=N(w^$,8),S=S+w|0,H=N(H^S,7),K=K+M|0,w=N(w^K,16),v=v+w|0,M=N(M^v,12),K=K+M|0,w=N(w^K,8),v=v+w|0,M=N(M^v,7),z=z+C|0,O=N(O^z,16),S=S+O|0,C=N(C^S,12),z=z+C|0,O=N(O^z,8),S=S+O|0,C=N(C^S,7),Y=Y+H|0,p=N(p^Y,16),h=h+p|0,H=N(H^h,12),Y=Y+H|0,p=N(p^Y,8),h=h+p|0,H=N(H^h,7),$=$+F|0,R=N(R^$,16),b=b+R|0,F=N(F^b,12),$=$+F|0,R=N(R^$,8),b=b+R|0,F=N(F^b,7);let g=0;n[g++]=i+K|0,n[g++]=c+z|0,n[g++]=f+Y|0,n[g++]=a+$|0,n[g++]=u+F|0,n[g++]=d+M|0,n[g++]=y+C|0,n[g++]=l+H|0,n[g++]=x+h|0,n[g++]=A+b|0,n[g++]=B+v|0,n[g++]=L+S|0,n[g++]=D+O|0,n[g++]=P+p|0,n[g++]=j+R|0,n[g++]=G+w|0}function ri(t,e,r,n){let o=t[0],s=t[1],i=t[2],c=t[3],f=e[0],a=e[1],u=e[2],d=e[3],y=e[4],l=e[5],x=e[6],A=e[7],B=r[0],L=r[1],D=r[2],P=r[3];for(let G=0;G<20;G+=2)o=o+f|0,B=N(B^o,16),y=y+B|0,f=N(f^y,12),o=o+f|0,B=N(B^o,8),y=y+B|0,f=N(f^y,7),s=s+a|0,L=N(L^s,16),l=l+L|0,a=N(a^l,12),s=s+a|0,L=N(L^s,8),l=l+L|0,a=N(a^l,7),i=i+u|0,D=N(D^i,16),x=x+D|0,u=N(u^x,12),i=i+u|0,D=N(D^i,8),x=x+D|0,u=N(u^x,7),c=c+d|0,P=N(P^c,16),A=A+P|0,d=N(d^A,12),c=c+d|0,P=N(P^c,8),A=A+P|0,d=N(d^A,7),o=o+a|0,P=N(P^o,16),x=x+P|0,a=N(a^x,12),o=o+a|0,P=N(P^o,8),x=x+P|0,a=N(a^x,7),s=s+u|0,B=N(B^s,16),A=A+B|0,u=N(u^A,12),s=s+u|0,B=N(B^s,8),A=A+B|0,u=N(u^A,7),i=i+d|0,L=N(L^i,16),y=y+L|0,d=N(d^y,12),i=i+d|0,L=N(L^i,8),y=y+L|0,d=N(d^y,7),c=c+f|0,D=N(D^c,16),l=l+D|0,f=N(f^l,12),c=c+f|0,D=N(D^c,8),l=l+D|0,f=N(f^l,7);let j=0;n[j++]=o,n[j++]=s,n[j++]=i,n[j++]=c,n[j++]=B,n[j++]=L,n[j++]=D,n[j++]=P}var An=Bn(ro,{counterRight:!1,counterLength:4,allowShortKeys:!1}),oi=Bn(ro,{counterRight:!1,counterLength:8,extendNonceFn:ri,allowShortKeys:!1});var si=new Uint8Array(16),to=(t,e)=>{t.update(e);let r=e.length%16;r&&t.update(si.subarray(r))},ii=new Uint8Array(32);function no(t,e,r,n,o){o!==void 0&&ee(o,void 0,"AAD");let s=t(e,r,ii),i=Gr(n.length,o?o.length:0,!0),c=eo.create(s);o&&to(c,o),to(c,n),c.update(i);let f=c.digest();return ye(s,i),f}var oo=t=>(e,r,n)=>({encrypt(s,i){let c=s.length;i=mn(c+16,i,!1),i.set(s);let f=i.subarray(0,-16);t(e,r,f,f,1);let a=no(t,e,r,f,n);return i.set(a,c),ye(a),i},decrypt(s,i){i=mn(s.length-16,i,!1);let c=s.subarray(0,-16),f=s.subarray(-16),a=no(t,e,r,c,n);if(!Dt(f,a))throw new Error("invalid tag");return i.set(s.subarray(0,-16)),t(e,r,i,i,1),ye(a),i}}),Gc=wn({blockSize:64,nonceLength:12,tagLength:16},oo(An)),Xc=wn({blockSize:64,nonceLength:24,tagLength:16},oo(oi));function ut(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"}function ue(t,e=""){if(!Number.isSafeInteger(t)||t<0){let r=e&&`"${e}" `;throw new Error(`${r}expected integer >= 0, got ${t}`)}}function W(t,e,r=""){let n=ut(t),o=t?.length,s=e!==void 0;if(!n||s&&o!==e){let i=r&&`"${r}" `,c=s?` of length ${e}`:"",f=n?`length=${o}`:`type=${typeof t}`;throw new Error(i+"expected Uint8Array"+c+", got "+f)}return t}function qe(t){if(typeof t!="function"||typeof t.create!="function")throw new Error("Hash must wrapped by utils.createHasher");ue(t.outputLen),ue(t.blockLen)}function Je(t,e=!0){if(t.destroyed)throw new Error("Hash instance has been destroyed");if(e&&t.finished)throw new Error("Hash#digest() has already been called")}function io(t,e){W(t,void 0,"digestInto() output");let r=e.outputLen;if(t.length<r)throw new Error('"digestInto() output" expected to be of length >='+r)}function me(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function jt(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}function be(t,e){return t<<32-e|t>>>e}var co=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",ci=Array.from({length:256},(t,e)=>e.toString(16).padStart(2,"0"));function De(t){if(W(t),co)return t.toHex();let e="";for(let r=0;r<t.length;r++)e+=ci[t[r]];return e}var we={_0:48,_9:57,A:65,F:70,a:97,f:102};function so(t){if(t>=we._0&&t<=we._9)return t-we._0;if(t>=we.A&&t<=we.F)return t-(we.A-10);if(t>=we.a&&t<=we.f)return t-(we.a-10)}function Ee(t){if(typeof t!="string")throw new Error("hex string expected, got "+typeof t);if(co)return Uint8Array.fromHex(t);let e=t.length,r=e/2;if(e%2)throw new Error("hex string expected, got unpadded hex of length "+e);let n=new Uint8Array(r);for(let o=0,s=0;o<r;o++,s+=2){let i=so(t.charCodeAt(s)),c=so(t.charCodeAt(s+1));if(i===void 0||c===void 0){let f=t[s]+t[s+1];throw new Error('hex string expected, got non-hex character "'+f+'" at index '+s)}n[o]=i*16+c}return n}function fe(...t){let e=0;for(let n=0;n<t.length;n++){let o=t[n];W(o),e+=o.length}let r=new Uint8Array(e);for(let n=0,o=0;n<t.length;n++){let s=t[n];r.set(s,o),o+=s.length}return r}function fo(t,e={}){let r=(o,s)=>t(s).update(o).digest(),n=t(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.create=o=>t(o),Object.assign(r,e),Object.freeze(r)}function dt(t=32){let e=typeof globalThis=="object"?globalThis.crypto:null;if(typeof e?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");return e.getRandomValues(new Uint8Array(t))}var ao=t=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,t])});function uo(t,e,r){return t&e^~t&r}function lo(t,e,r){return t&e^t&r^e&r}var Vt=class{constructor(e,r,n,o){m(this,"blockLen");m(this,"outputLen");m(this,"padOffset");m(this,"isLE");m(this,"buffer");m(this,"view");m(this,"finished",!1);m(this,"length",0);m(this,"pos",0);m(this,"destroyed",!1);this.blockLen=e,this.outputLen=r,this.padOffset=n,this.isLE=o,this.buffer=new Uint8Array(e),this.view=jt(this.buffer)}update(e){Je(this),W(e);let{view:r,buffer:n,blockLen:o}=this,s=e.length;for(let i=0;i<s;){let c=Math.min(o-this.pos,s-i);if(c===o){let f=jt(e);for(;o<=s-i;i+=o)this.process(f,i);continue}n.set(e.subarray(i,i+c),this.pos),this.pos+=c,i+=c,this.pos===o&&(this.process(r,0),this.pos=0)}return this.length+=e.length,this.roundClean(),this}digestInto(e){Je(this),io(e,this),this.finished=!0;let{buffer:r,view:n,blockLen:o,isLE:s}=this,{pos:i}=this;r[i++]=128,me(this.buffer.subarray(i)),this.padOffset>o-i&&(this.process(n,0),i=0);for(let d=i;d<o;d++)r[d]=0;n.setBigUint64(o-8,BigInt(this.length*8),s),this.process(n,0);let c=jt(e),f=this.outputLen;if(f%4)throw new Error("_sha2: outputLen must be aligned to 32bit");let a=f/4,u=this.get();if(a>u.length)throw new Error("_sha2: outputLen bigger than state");for(let d=0;d<a;d++)c.setUint32(4*d,u[d],s)}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}_cloneInto(e){e||(e=new this.constructor),e.set(...this.get());let{blockLen:r,buffer:n,length:o,finished:s,destroyed:i,pos:c}=this;return e.destroyed=i,e.finished=s,e.length=o,e.pos=c,o%r&&e.buffer.set(n),e}clone(){return this._cloneInto()}},Be=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var fi=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),_e=new Uint32Array(64),Sn=class extends Vt{constructor(e){super(64,e,8,!1)}get(){let{A:e,B:r,C:n,D:o,E:s,F:i,G:c,H:f}=this;return[e,r,n,o,s,i,c,f]}set(e,r,n,o,s,i,c,f){this.A=e|0,this.B=r|0,this.C=n|0,this.D=o|0,this.E=s|0,this.F=i|0,this.G=c|0,this.H=f|0}process(e,r){for(let d=0;d<16;d++,r+=4)_e[d]=e.getUint32(r,!1);for(let d=16;d<64;d++){let y=_e[d-15],l=_e[d-2],x=be(y,7)^be(y,18)^y>>>3,A=be(l,17)^be(l,19)^l>>>10;_e[d]=A+_e[d-7]+x+_e[d-16]|0}let{A:n,B:o,C:s,D:i,E:c,F:f,G:a,H:u}=this;for(let d=0;d<64;d++){let y=be(c,6)^be(c,11)^be(c,25),l=u+y+uo(c,f,a)+fi[d]+_e[d]|0,A=(be(n,2)^be(n,13)^be(n,22))+lo(n,o,s)|0;u=a,a=f,f=c,c=i+l|0,i=s,s=o,o=n,n=l+A|0}n=n+this.A|0,o=o+this.B|0,s=s+this.C|0,i=i+this.D|0,c=c+this.E|0,f=f+this.F|0,a=a+this.G|0,u=u+this.H|0,this.set(n,o,s,i,c,f,a,u)}roundClean(){me(_e)}destroy(){this.set(0,0,0,0,0,0,0,0),me(this.buffer)}},Rn=class extends Sn{constructor(){super(32);m(this,"A",Be[0]|0);m(this,"B",Be[1]|0);m(this,"C",Be[2]|0);m(this,"D",Be[3]|0);m(this,"E",Be[4]|0);m(this,"F",Be[5]|0);m(this,"G",Be[6]|0);m(this,"H",Be[7]|0)}};var Qe=fo(()=>new Rn,ao(1));var Tn=BigInt(0),On=BigInt(1);function lt(t,e=""){if(typeof t!="boolean"){let r=e&&`"${e}" `;throw new Error(r+"expected boolean, got type="+typeof t)}return t}function ho(t){if(typeof t=="bigint"){if(!$t(t))throw new Error("positive bigint expected, got "+t)}else ue(t);return t}function ht(t){let e=ho(t).toString(16);return e.length&1?"0"+e:e}function bo(t){if(typeof t!="string")throw new Error("hex string expected, got "+typeof t);return t===""?Tn:BigInt("0x"+t)}function et(t){return bo(De(t))}function Ln(t){return bo(De(ai(W(t)).reverse()))}function Zt(t,e){ue(e),t=ho(t);let r=Ee(t.toString(16).padStart(e*2,"0"));if(r.length!==e)throw new Error("number too large");return r}function In(t,e){return Zt(t,e).reverse()}function ai(t){return Uint8Array.from(t)}var $t=t=>typeof t=="bigint"&&Tn<=t;function ui(t,e,r){return $t(t)&&$t(e)&&$t(r)&&e<=t&&t<r}function po(t,e,r,n){if(!ui(e,r,n))throw new Error("expected valid "+t+": "+r+" <= n < "+n+", got "+e)}function Un(t){let e;for(e=0;t>Tn;t>>=On,e+=1);return e}var bt=t=>(On<<BigInt(t))-On;function go(t,e,r){if(ue(t,"hashLen"),ue(e,"qByteLen"),typeof r!="function")throw new Error("hmacFn must be a function");let n=B=>new Uint8Array(B),o=Uint8Array.of(),s=Uint8Array.of(0),i=Uint8Array.of(1),c=1e3,f=n(t),a=n(t),u=0,d=()=>{f.fill(1),a.fill(0),u=0},y=(...B)=>r(a,fe(f,...B)),l=(B=o)=>{a=y(s,B),f=y(),B.length!==0&&(a=y(i,B),f=y())},x=()=>{if(u++>=c)throw new Error("drbg: tried max amount of iterations");let B=0,L=[];for(;B<e;){f=y();let D=f.slice();L.push(D),B+=f.length}return fe(...L)};return(B,L)=>{d(),l(B);let D;for(;!(D=L(x()));)l();return d(),D}}function pt(t,e={},r={}){if(!t||typeof t!="object")throw new Error("expected valid options object");function n(s,i,c){let f=t[s];if(c&&f===void 0)return;let a=typeof f;if(a!==i||f===null)throw new Error(`param "${s}" is invalid: expected ${i}, got ${a}`)}let o=(s,i)=>Object.entries(s).forEach(([c,f])=>n(c,f,i));o(e,!1),o(r,!0)}function _n(t){let e=new WeakMap;return(r,...n)=>{let o=e.get(r);if(o!==void 0)return o;let s=t(r,...n);return e.set(r,s),s}}var ie=BigInt(0),re=BigInt(1),Me=BigInt(2),wo=BigInt(3),mo=BigInt(4),Eo=BigInt(5),di=BigInt(7),Bo=BigInt(8),li=BigInt(9),vo=BigInt(16);function pe(t,e){let r=t%e;return r>=ie?r:e+r}function ae(t,e,r){let n=t;for(;e-- >ie;)n*=n,n%=r;return n}function xo(t,e){if(t===ie)throw new Error("invert: expected non-zero number");if(e<=ie)throw new Error("invert: expected positive modulus, got "+e);let r=pe(t,e),n=e,o=ie,s=re,i=re,c=ie;for(;r!==ie;){let a=n/r,u=n%r,d=o-i*a,y=s-c*a;n=r,r=u,o=i,s=c,i=d,c=y}if(n!==re)throw new Error("invert: does not exist");return pe(o,e)}function Hn(t,e,r){if(!t.eql(t.sqr(e),r))throw new Error("Cannot find square root")}function Ao(t,e){let r=(t.ORDER+re)/mo,n=t.pow(e,r);return Hn(t,n,e),n}function hi(t,e){let r=(t.ORDER-Eo)/Bo,n=t.mul(e,Me),o=t.pow(n,r),s=t.mul(e,o),i=t.mul(t.mul(s,Me),o),c=t.mul(s,t.sub(i,t.ONE));return Hn(t,c,e),c}function bi(t){let e=tt(t),r=So(t),n=r(e,e.neg(e.ONE)),o=r(e,n),s=r(e,e.neg(n)),i=(t+di)/vo;return(c,f)=>{let a=c.pow(f,i),u=c.mul(a,n),d=c.mul(a,o),y=c.mul(a,s),l=c.eql(c.sqr(u),f),x=c.eql(c.sqr(d),f);a=c.cmov(a,u,l),u=c.cmov(y,d,x);let A=c.eql(c.sqr(u),f),B=c.cmov(a,u,A);return Hn(c,B,f),B}}function So(t){if(t<wo)throw new Error("sqrt is not defined for small field");let e=t-re,r=0;for(;e%Me===ie;)e/=Me,r++;let n=Me,o=tt(t);for(;yo(o,n)===1;)if(n++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(r===1)return Ao;let s=o.pow(n,e),i=(e+re)/Me;return function(f,a){if(f.is0(a))return a;if(yo(f,a)!==1)throw new Error("Cannot find square root");let u=r,d=f.mul(f.ONE,s),y=f.pow(a,e),l=f.pow(a,i);for(;!f.eql(y,f.ONE);){if(f.is0(y))return f.ZERO;let x=1,A=f.sqr(y);for(;!f.eql(A,f.ONE);)if(x++,A=f.sqr(A),x===u)throw new Error("Cannot find square root");let B=re<<BigInt(u-x-1),L=f.pow(d,B);u=x,d=f.sqr(L),y=f.mul(y,d),l=f.mul(l,L)}return l}}function pi(t){return t%mo===wo?Ao:t%Bo===Eo?hi:t%vo===li?bi(t):So(t)}var gi=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function Nn(t){let e={ORDER:"bigint",BYTES:"number",BITS:"number"},r=gi.reduce((n,o)=>(n[o]="function",n),e);return pt(t,r),t}function xi(t,e,r){if(r<ie)throw new Error("invalid exponent, negatives unsupported");if(r===ie)return t.ONE;if(r===re)return e;let n=t.ONE,o=e;for(;r>ie;)r&re&&(n=t.mul(n,o)),o=t.sqr(o),r>>=re;return n}function Pt(t,e,r=!1){let n=new Array(e.length).fill(r?t.ZERO:void 0),o=e.reduce((i,c,f)=>t.is0(c)?i:(n[f]=i,t.mul(i,c)),t.ONE),s=t.inv(o);return e.reduceRight((i,c,f)=>t.is0(c)?i:(n[f]=t.mul(i,n[f]),t.mul(i,c)),s),n}function yo(t,e){let r=(t.ORDER-re)/Me,n=t.pow(e,r),o=t.eql(n,t.ONE),s=t.eql(n,t.ZERO),i=t.eql(n,t.neg(t.ONE));if(!o&&!s&&!i)throw new Error("invalid Legendre symbol result");return o?1:s?0:-1}function yi(t,e){e!==void 0&&ue(e);let r=e!==void 0?e:t.toString(2).length,n=Math.ceil(r/8);return{nBitLength:r,nByteLength:n}}var kn=class{constructor(e,r={}){m(this,"ORDER");m(this,"BITS");m(this,"BYTES");m(this,"isLE");m(this,"ZERO",ie);m(this,"ONE",re);m(this,"_lengths");m(this,"_sqrt");m(this,"_mod");if(e<=ie)throw new Error("invalid field: expected ORDER > 0, got "+e);let n;this.isLE=!1,r!=null&&typeof r=="object"&&(typeof r.BITS=="number"&&(n=r.BITS),typeof r.sqrt=="function"&&(this.sqrt=r.sqrt),typeof r.isLE=="boolean"&&(this.isLE=r.isLE),r.allowedLengths&&(this._lengths=r.allowedLengths?.slice()),typeof r.modFromBytes=="boolean"&&(this._mod=r.modFromBytes));let{nBitLength:o,nByteLength:s}=yi(e,n);if(s>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");this.ORDER=e,this.BITS=o,this.BYTES=s,this._sqrt=void 0,Object.preventExtensions(this)}create(e){return pe(e,this.ORDER)}isValid(e){if(typeof e!="bigint")throw new Error("invalid field element: expected bigint, got "+typeof e);return ie<=e&&e<this.ORDER}is0(e){return e===ie}isValidNot0(e){return!this.is0(e)&&this.isValid(e)}isOdd(e){return(e&re)===re}neg(e){return pe(-e,this.ORDER)}eql(e,r){return e===r}sqr(e){return pe(e*e,this.ORDER)}add(e,r){return pe(e+r,this.ORDER)}sub(e,r){return pe(e-r,this.ORDER)}mul(e,r){return pe(e*r,this.ORDER)}pow(e,r){return xi(this,e,r)}div(e,r){return pe(e*xo(r,this.ORDER),this.ORDER)}sqrN(e){return e*e}addN(e,r){return e+r}subN(e,r){return e-r}mulN(e,r){return e*r}inv(e){return xo(e,this.ORDER)}sqrt(e){return this._sqrt||(this._sqrt=pi(this.ORDER)),this._sqrt(this,e)}toBytes(e){return this.isLE?In(e,this.BYTES):Zt(e,this.BYTES)}fromBytes(e,r=!1){W(e);let{_lengths:n,BYTES:o,isLE:s,ORDER:i,_mod:c}=this;if(n){if(!n.includes(e.length)||e.length>o)throw new Error("Field.fromBytes: expected "+n+" bytes, got "+e.length);let a=new Uint8Array(o);a.set(e,s?0:a.length-e.length),e=a}if(e.length!==o)throw new Error("Field.fromBytes: expected "+o+" bytes, got "+e.length);let f=s?Ln(e):et(e);if(c&&(f=pe(f,i)),!r&&!this.isValid(f))throw new Error("invalid field element: outside of range 0..ORDER");return f}invertBatch(e){return Pt(this,e)}cmov(e,r,n){return n?r:e}};function tt(t,e={}){return new kn(t,e)}function Ro(t){if(typeof t!="bigint")throw new Error("field order must be bigint");let e=t.toString(2).length;return Math.ceil(e/8)}function Cn(t){let e=Ro(t);return e+Math.ceil(e/2)}function qn(t,e,r=!1){W(t);let n=t.length,o=Ro(e),s=Cn(e);if(n<16||n<s||n>1024)throw new Error("expected "+s+"-1024 bytes of input, got "+n);let i=r?Ln(t):et(t),c=pe(i,e-re)+re;return r?In(c,o):Zt(c,o)}var nt=BigInt(0),je=BigInt(1);function gt(t,e){let r=e.negate();return t?r:e}function Vn(t,e){let r=Pt(t.Fp,e.map(n=>n.Z));return e.map((n,o)=>t.fromAffine(n.toAffine(r[o])))}function Io(t,e){if(!Number.isSafeInteger(t)||t<=0||t>e)throw new Error("invalid window size, expected [1.."+e+"], got W="+t)}function Dn(t,e){Io(t,e);let r=Math.ceil(e/t)+1,n=2**(t-1),o=2**t,s=bt(t),i=BigInt(t);return{windows:r,windowSize:n,mask:s,maxNumber:o,shiftBy:i}}function Oo(t,e,r){let{windowSize:n,mask:o,maxNumber:s,shiftBy:i}=r,c=Number(t&o),f=t>>i;c>n&&(c-=s,f+=je);let a=e*n,u=a+Math.abs(c)-1,d=c===0,y=c<0,l=e%2!==0;return{nextN:f,offset:u,isZero:d,isNeg:y,isNegF:l,offsetF:a}}var Mn=new WeakMap,Uo=new WeakMap;function jn(t){return Uo.get(t)||1}function To(t){if(t!==nt)throw new Error("invalid wNAF")}var Ft=class{constructor(e,r){m(this,"BASE");m(this,"ZERO");m(this,"Fn");m(this,"bits");this.BASE=e.BASE,this.ZERO=e.ZERO,this.Fn=e.Fn,this.bits=r}_unsafeLadder(e,r,n=this.ZERO){let o=e;for(;r>nt;)r&je&&(n=n.add(o)),o=o.double(),r>>=je;return n}precomputeWindow(e,r){let{windows:n,windowSize:o}=Dn(r,this.bits),s=[],i=e,c=i;for(let f=0;f<n;f++){c=i,s.push(c);for(let a=1;a<o;a++)c=c.add(i),s.push(c);i=c.double()}return s}wNAF(e,r,n){if(!this.Fn.isValid(n))throw new Error("invalid scalar");let o=this.ZERO,s=this.BASE,i=Dn(e,this.bits);for(let c=0;c<i.windows;c++){let{nextN:f,offset:a,isZero:u,isNeg:d,isNegF:y,offsetF:l}=Oo(n,c,i);n=f,u?s=s.add(gt(y,r[l])):o=o.add(gt(d,r[a]))}return To(n),{p:o,f:s}}wNAFUnsafe(e,r,n,o=this.ZERO){let s=Dn(e,this.bits);for(let i=0;i<s.windows&&n!==nt;i++){let{nextN:c,offset:f,isZero:a,isNeg:u}=Oo(n,i,s);if(n=c,!a){let d=r[f];o=o.add(u?d.negate():d)}}return To(n),o}getPrecomputes(e,r,n){let o=Mn.get(r);return o||(o=this.precomputeWindow(r,e),e!==1&&(typeof n=="function"&&(o=n(o)),Mn.set(r,o))),o}cached(e,r,n){let o=jn(e);return this.wNAF(o,this.getPrecomputes(o,e,n),r)}unsafe(e,r,n,o){let s=jn(e);return s===1?this._unsafeLadder(e,r,o):this.wNAFUnsafe(s,this.getPrecomputes(s,e,n),r,o)}createCache(e,r){Io(r,this.bits),Uo.set(e,r),Mn.delete(e)}hasCache(e){return jn(e)!==1}};function _o(t,e,r,n){let o=e,s=t.ZERO,i=t.ZERO;for(;r>nt||n>nt;)r&je&&(s=s.add(o)),n&je&&(i=i.add(o)),o=o.double(),r>>=je,n>>=je;return{p1:s,p2:i}}function Lo(t,e,r){if(e){if(e.ORDER!==t)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return Nn(e),e}else return tt(t,{isLE:r})}function ko(t,e,r={},n){if(n===void 0&&(n=t==="edwards"),!e||typeof e!="object")throw new Error(`expected valid ${t} CURVE object`);for(let f of["p","n","h"]){let a=e[f];if(!(typeof a=="bigint"&&a>nt))throw new Error(`CURVE.${f} must be positive bigint`)}let o=Lo(e.p,r.Fp,n),s=Lo(e.n,r.Fn,n),c=["Gx","Gy","a",t==="weierstrass"?"b":"d"];for(let f of c)if(!o.isValid(e[f]))throw new Error(`CURVE.${f} must be valid field element of CURVE.Fp`);return e=Object.freeze(Object.assign({},e)),{CURVE:e,Fp:o,Fn:s}}function Ho(t,e){return function(n){let o=t(n);return{secretKey:o,publicKey:e(o)}}}var Kt=class{constructor(e,r){m(this,"oHash");m(this,"iHash");m(this,"blockLen");m(this,"outputLen");m(this,"finished",!1);m(this,"destroyed",!1);if(qe(e),W(r,void 0,"key"),this.iHash=e.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let n=this.blockLen,o=new Uint8Array(n);o.set(r.length>n?e.create().update(r).digest():r);for(let s=0;s<o.length;s++)o[s]^=54;this.iHash.update(o),this.oHash=e.create();for(let s=0;s<o.length;s++)o[s]^=106;this.oHash.update(o),me(o)}update(e){return Je(this),this.iHash.update(e),this}digestInto(e){Je(this),W(e,this.outputLen,"output"),this.finished=!0,this.iHash.digestInto(e),this.oHash.update(e),this.oHash.digestInto(e),this.destroy()}digest(){let e=new Uint8Array(this.oHash.outputLen);return this.digestInto(e),e}_cloneInto(e){e||(e=Object.create(Object.getPrototypeOf(this),{}));let{oHash:r,iHash:n,finished:o,destroyed:s,blockLen:i,outputLen:c}=this;return e=e,e.finished=o,e.destroyed=s,e.blockLen=i,e.outputLen=c,e.oHash=r._cloneInto(e.oHash),e.iHash=n._cloneInto(e.iHash),e}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},ke=(t,e,r)=>new Kt(t,e).update(r).digest();ke.create=(t,e)=>new Kt(t,e);var No=(t,e)=>(t+(t>=0?e:-e)/Co)/e;function wi(t,e,r){let[[n,o],[s,i]]=e,c=No(i*t,r),f=No(-o*t,r),a=t-c*n-f*s,u=-c*o-f*i,d=a<ve,y=u<ve;d&&(a=-a),y&&(u=-u);let l=bt(Math.ceil(Un(r)/2))+rt;if(a<ve||a>=l||u<ve||u>=l)throw new Error("splitScalar (endomorphism): failed, k="+t);return{k1neg:d,k1:a,k2neg:y,k2:u}}function Zn(t){if(!["compact","recovered","der"].includes(t))throw new Error('Signature format must be "compact", "recovered", or "der"');return t}function $n(t,e){let r={};for(let n of Object.keys(e))r[n]=t[n]===void 0?e[n]:t[n];return lt(r.lowS,"lowS"),lt(r.prehash,"prehash"),r.format!==void 0&&Zn(r.format),r}var Pn=class extends Error{constructor(e=""){super(e)}},He={Err:Pn,_tlv:{encode:(t,e)=>{let{Err:r}=He;if(t<0||t>256)throw new r("tlv.encode: wrong tag");if(e.length&1)throw new r("tlv.encode: unpadded data");let n=e.length/2,o=ht(n);if(o.length/2&128)throw new r("tlv.encode: long form length too big");let s=n>127?ht(o.length/2|128):"";return ht(t)+s+o+e},decode(t,e){let{Err:r}=He,n=0;if(t<0||t>256)throw new r("tlv.encode: wrong tag");if(e.length<2||e[n++]!==t)throw new r("tlv.decode: wrong tlv");let o=e[n++],s=!!(o&128),i=0;if(!s)i=o;else{let f=o&127;if(!f)throw new r("tlv.decode(long): indefinite length not supported");if(f>4)throw new r("tlv.decode(long): byte length is too big");let a=e.subarray(n,n+f);if(a.length!==f)throw new r("tlv.decode: length bytes not complete");if(a[0]===0)throw new r("tlv.decode(long): zero leftmost byte");for(let u of a)i=i<<8|u;if(n+=f,i<128)throw new r("tlv.decode(long): not minimal encoding")}let c=e.subarray(n,n+i);if(c.length!==i)throw new r("tlv.decode: wrong value length");return{v:c,l:e.subarray(n+i)}}},_int:{encode(t){let{Err:e}=He;if(t<ve)throw new e("integer: negative integers are not allowed");let r=ht(t);if(Number.parseInt(r[0],16)&8&&(r="00"+r),r.length&1)throw new e("unexpected DER parsing assertion: unpadded hex");return r},decode(t){let{Err:e}=He;if(t[0]&128)throw new e("invalid signature integer: negative");if(t[0]===0&&!(t[1]&128))throw new e("invalid signature integer: unnecessary leading zero");return et(t)}},toSig(t){let{Err:e,_int:r,_tlv:n}=He,o=W(t,void 0,"signature"),{v:s,l:i}=n.decode(48,o);if(i.length)throw new e("invalid signature: left bytes after parsing");let{v:c,l:f}=n.decode(2,s),{v:a,l:u}=n.decode(2,f);if(u.length)throw new e("invalid signature: left bytes after parsing");return{r:r.decode(c),s:r.decode(a)}},hexFromSig(t){let{_tlv:e,_int:r}=He,n=e.encode(2,r.encode(t.r)),o=e.encode(2,r.encode(t.s)),s=n+o;return e.encode(48,s)}},ve=BigInt(0),rt=BigInt(1),Co=BigInt(2),zt=BigInt(3),mi=BigInt(4);function qo(t,e={}){let r=ko("weierstrass",t,e),{Fp:n,Fn:o}=r,s=r.CURVE,{h:i,n:c}=s;pt(e,{},{allowInfinityPoint:"boolean",clearCofactor:"function",isTorsionFree:"function",fromBytes:"function",toBytes:"function",endo:"object"});let{endo:f}=e;if(f&&(!n.is0(s.a)||typeof f.beta!="bigint"||!Array.isArray(f.basises)))throw new Error('invalid endo: expected "beta": bigint and "basises": array');let a=Mo(n,o);function u(){if(!n.isOdd)throw new Error("compression is not supported: Field does not have .isOdd()")}function d(H,h,b){let{x:v,y:S}=h.toAffine(),O=n.toBytes(v);if(lt(b,"isCompressed"),b){u();let p=!n.isOdd(S);return fe(Do(p),O)}else return fe(Uint8Array.of(4),O,n.toBytes(S))}function y(H){W(H,void 0,"Point");let{publicKey:h,publicKeyUncompressed:b}=a,v=H.length,S=H[0],O=H.subarray(1);if(v===h&&(S===2||S===3)){let p=n.fromBytes(O);if(!n.isValid(p))throw new Error("bad point: is not on curve, wrong x");let R=A(p),w;try{w=n.sqrt(R)}catch(I){let _=I instanceof Error?": "+I.message:"";throw new Error("bad point: is not on curve, sqrt error"+_)}u();let g=n.isOdd(w);return(S&1)===1!==g&&(w=n.neg(w)),{x:p,y:w}}else if(v===b&&S===4){let p=n.BYTES,R=n.fromBytes(O.subarray(0,p)),w=n.fromBytes(O.subarray(p,p*2));if(!B(R,w))throw new Error("bad point: is not on curve");return{x:R,y:w}}else throw new Error(`bad point: got length ${v}, expected compressed=${h} or uncompressed=${b}`)}let l=e.toBytes||d,x=e.fromBytes||y;function A(H){let h=n.sqr(H),b=n.mul(h,H);return n.add(n.add(b,n.mul(H,s.a)),s.b)}function B(H,h){let b=n.sqr(h),v=A(H);return n.eql(b,v)}if(!B(s.Gx,s.Gy))throw new Error("bad curve params: generator point");let L=n.mul(n.pow(s.a,zt),mi),D=n.mul(n.sqr(s.b),BigInt(27));if(n.is0(n.add(L,D)))throw new Error("bad curve params: a or b");function P(H,h,b=!1){if(!n.isValid(h)||b&&n.is0(h))throw new Error(`bad point coordinate ${H}`);return h}function j(H){if(!(H instanceof $))throw new Error("Weierstrass Point expected")}function G(H){if(!f||!f.basises)throw new Error("no endo");return wi(H,f.basises,o.ORDER)}let K=_n((H,h)=>{let{X:b,Y:v,Z:S}=H;if(n.eql(S,n.ONE))return{x:b,y:v};let O=H.is0();h==null&&(h=O?n.ONE:n.inv(S));let p=n.mul(b,h),R=n.mul(v,h),w=n.mul(S,h);if(O)return{x:n.ZERO,y:n.ZERO};if(!n.eql(w,n.ONE))throw new Error("invZ was invalid");return{x:p,y:R}}),z=_n(H=>{if(H.is0()){if(e.allowInfinityPoint&&!n.is0(H.Y))return;throw new Error("bad point: ZERO")}let{x:h,y:b}=H.toAffine();if(!n.isValid(h)||!n.isValid(b))throw new Error("bad point: x or y not field elements");if(!B(h,b))throw new Error("bad point: equation left != right");if(!H.isTorsionFree())throw new Error("bad point: not in prime-order subgroup");return!0});function Y(H,h,b,v,S){return b=new $(n.mul(b.X,H),b.Y,b.Z),h=gt(v,h),b=gt(S,b),h.add(b)}let C=class C{constructor(h,b,v){m(this,"X");m(this,"Y");m(this,"Z");this.X=P("x",h),this.Y=P("y",b,!0),this.Z=P("z",v),Object.freeze(this)}static CURVE(){return s}static fromAffine(h){let{x:b,y:v}=h||{};if(!h||!n.isValid(b)||!n.isValid(v))throw new Error("invalid affine point");if(h instanceof C)throw new Error("projective point not allowed");return n.is0(b)&&n.is0(v)?C.ZERO:new C(b,v,n.ONE)}static fromBytes(h){let b=C.fromAffine(x(W(h,void 0,"point")));return b.assertValidity(),b}static fromHex(h){return C.fromBytes(Ee(h))}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(h=8,b=!0){return M.createCache(this,h),b||this.multiply(zt),this}assertValidity(){z(this)}hasEvenY(){let{y:h}=this.toAffine();if(!n.isOdd)throw new Error("Field doesn't support isOdd");return!n.isOdd(h)}equals(h){j(h);let{X:b,Y:v,Z:S}=this,{X:O,Y:p,Z:R}=h,w=n.eql(n.mul(b,R),n.mul(O,S)),g=n.eql(n.mul(v,R),n.mul(p,S));return w&&g}negate(){return new C(this.X,n.neg(this.Y),this.Z)}double(){let{a:h,b}=s,v=n.mul(b,zt),{X:S,Y:O,Z:p}=this,R=n.ZERO,w=n.ZERO,g=n.ZERO,E=n.mul(S,S),I=n.mul(O,O),_=n.mul(p,p),T=n.mul(S,O);return T=n.add(T,T),g=n.mul(S,p),g=n.add(g,g),R=n.mul(h,g),w=n.mul(v,_),w=n.add(R,w),R=n.sub(I,w),w=n.add(I,w),w=n.mul(R,w),R=n.mul(T,R),g=n.mul(v,g),_=n.mul(h,_),T=n.sub(E,_),T=n.mul(h,T),T=n.add(T,g),g=n.add(E,E),E=n.add(g,E),E=n.add(E,_),E=n.mul(E,T),w=n.add(w,E),_=n.mul(O,p),_=n.add(_,_),E=n.mul(_,T),R=n.sub(R,E),g=n.mul(_,I),g=n.add(g,g),g=n.add(g,g),new C(R,w,g)}add(h){j(h);let{X:b,Y:v,Z:S}=this,{X:O,Y:p,Z:R}=h,w=n.ZERO,g=n.ZERO,E=n.ZERO,I=s.a,_=n.mul(s.b,zt),T=n.mul(b,O),k=n.mul(v,p),q=n.mul(S,R),U=n.add(b,v),V=n.add(O,p);U=n.mul(U,V),V=n.add(T,k),U=n.sub(U,V),V=n.add(b,S);let Z=n.add(O,R);return V=n.mul(V,Z),Z=n.add(T,q),V=n.sub(V,Z),Z=n.add(v,S),w=n.add(p,R),Z=n.mul(Z,w),w=n.add(k,q),Z=n.sub(Z,w),E=n.mul(I,V),w=n.mul(_,q),E=n.add(w,E),w=n.sub(k,E),E=n.add(k,E),g=n.mul(w,E),k=n.add(T,T),k=n.add(k,T),q=n.mul(I,q),V=n.mul(_,V),k=n.add(k,q),q=n.sub(T,q),q=n.mul(I,q),V=n.add(V,q),T=n.mul(k,V),g=n.add(g,T),T=n.mul(Z,V),w=n.mul(U,w),w=n.sub(w,T),T=n.mul(U,k),E=n.mul(Z,E),E=n.add(E,T),new C(w,g,E)}subtract(h){return this.add(h.negate())}is0(){return this.equals(C.ZERO)}multiply(h){let{endo:b}=e;if(!o.isValidNot0(h))throw new Error("invalid scalar: out of range");let v,S,O=p=>M.cached(this,p,R=>Vn(C,R));if(b){let{k1neg:p,k1:R,k2neg:w,k2:g}=G(h),{p:E,f:I}=O(R),{p:_,f:T}=O(g);S=I.add(T),v=Y(b.beta,E,_,p,w)}else{let{p,f:R}=O(h);v=p,S=R}return Vn(C,[v,S])[0]}multiplyUnsafe(h){let{endo:b}=e,v=this;if(!o.isValid(h))throw new Error("invalid scalar: out of range");if(h===ve||v.is0())return C.ZERO;if(h===rt)return v;if(M.hasCache(this))return this.multiply(h);if(b){let{k1neg:S,k1:O,k2neg:p,k2:R}=G(h),{p1:w,p2:g}=_o(C,v,O,R);return Y(b.beta,w,g,S,p)}else return M.unsafe(v,h)}toAffine(h){return K(this,h)}isTorsionFree(){let{isTorsionFree:h}=e;return i===rt?!0:h?h(C,this):M.unsafe(this,c).is0()}clearCofactor(){let{clearCofactor:h}=e;return i===rt?this:h?h(C,this):this.multiplyUnsafe(i)}isSmallOrder(){return this.multiplyUnsafe(i).is0()}toBytes(h=!0){return lt(h,"isCompressed"),this.assertValidity(),l(C,this,h)}toHex(h=!0){return De(this.toBytes(h))}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}};m(C,"BASE",new C(s.Gx,s.Gy,n.ONE)),m(C,"ZERO",new C(n.ZERO,n.ONE,n.ZERO)),m(C,"Fp",n),m(C,"Fn",o);let $=C,F=o.BITS,M=new Ft($,e.endo?Math.ceil(F/2):F);return $.BASE.precompute(8),$}function Do(t){return Uint8Array.of(t?2:3)}function Mo(t,e){return{secretKey:e.BYTES,publicKey:1+t.BYTES,publicKeyUncompressed:1+2*t.BYTES,publicKeyHasPrefix:!0,signature:2*e.BYTES}}function Ei(t,e={}){let{Fn:r}=t,n=e.randomBytes||dt,o=Object.assign(Mo(t.Fp,r),{seed:Cn(r.ORDER)});function s(l){try{let x=r.fromBytes(l);return r.isValidNot0(x)}catch{return!1}}function i(l,x){let{publicKey:A,publicKeyUncompressed:B}=o;try{let L=l.length;return x===!0&&L!==A||x===!1&&L!==B?!1:!!t.fromBytes(l)}catch{return!1}}function c(l=n(o.seed)){return qn(W(l,o.seed,"seed"),r.ORDER)}function f(l,x=!0){return t.BASE.multiply(r.fromBytes(l)).toBytes(x)}function a(l){let{secretKey:x,publicKey:A,publicKeyUncompressed:B}=o;if(!ut(l)||"_lengths"in r&&r._lengths||x===A)return;let L=W(l,void 0,"key").length;return L===A||L===B}function u(l,x,A=!0){if(a(l)===!0)throw new Error("first arg must be private key");if(a(x)===!1)throw new Error("second arg must be public key");let B=r.fromBytes(l);return t.fromBytes(x).multiply(B).toBytes(A)}let d={isValidSecretKey:s,isValidPublicKey:i,randomSecretKey:c},y=Ho(c,f);return Object.freeze({getPublicKey:f,getSharedSecret:u,keygen:y,Point:t,utils:d,lengths:o})}function jo(t,e,r={}){qe(e),pt(r,{},{hmac:"function",lowS:"boolean",randomBytes:"function",bits2int:"function",bits2int_modN:"function"}),r=Object.assign({},r);let n=r.randomBytes||dt,o=r.hmac||((h,b)=>ke(e,h,b)),{Fp:s,Fn:i}=t,{ORDER:c,BITS:f}=i,{keygen:a,getPublicKey:u,getSharedSecret:d,utils:y,lengths:l}=Ei(t,r),x={prehash:!0,lowS:typeof r.lowS=="boolean"?r.lowS:!0,format:"compact",extraEntropy:!1},A=c*Co<s.ORDER;function B(h){let b=c>>rt;return h>b}function L(h,b){if(!i.isValidNot0(b))throw new Error(`invalid signature ${h}: out of range 1..Point.Fn.ORDER`);return b}function D(){if(A)throw new Error('"recovered" sig type is not supported for cofactor >2 curves')}function P(h,b){Zn(b);let v=l.signature,S=b==="compact"?v:b==="recovered"?v+1:void 0;return W(h,S)}class j{constructor(b,v,S){m(this,"r");m(this,"s");m(this,"recovery");if(this.r=L("r",b),this.s=L("s",v),S!=null){if(D(),![0,1,2,3].includes(S))throw new Error("invalid recovery id");this.recovery=S}Object.freeze(this)}static fromBytes(b,v=x.format){P(b,v);let S;if(v==="der"){let{r:w,s:g}=He.toSig(W(b));return new j(w,g)}v==="recovered"&&(S=b[0],v="compact",b=b.subarray(1));let O=l.signature/2,p=b.subarray(0,O),R=b.subarray(O,O*2);return new j(i.fromBytes(p),i.fromBytes(R),S)}static fromHex(b,v){return this.fromBytes(Ee(b),v)}assertRecovery(){let{recovery:b}=this;if(b==null)throw new Error("invalid recovery id: must be present");return b}addRecoveryBit(b){return new j(this.r,this.s,b)}recoverPublicKey(b){let{r:v,s:S}=this,O=this.assertRecovery(),p=O===2||O===3?v+c:v;if(!s.isValid(p))throw new Error("invalid recovery id: sig.r+curve.n != R.x");let R=s.toBytes(p),w=t.fromBytes(fe(Do((O&1)===0),R)),g=i.inv(p),E=K(W(b,void 0,"msgHash")),I=i.create(-E*g),_=i.create(S*g),T=t.BASE.multiplyUnsafe(I).add(w.multiplyUnsafe(_));if(T.is0())throw new Error("invalid recovery: point at infinify");return T.assertValidity(),T}hasHighS(){return B(this.s)}toBytes(b=x.format){if(Zn(b),b==="der")return Ee(He.hexFromSig(this));let{r:v,s:S}=this,O=i.toBytes(v),p=i.toBytes(S);return b==="recovered"?(D(),fe(Uint8Array.of(this.assertRecovery()),O,p)):fe(O,p)}toHex(b){return De(this.toBytes(b))}}let G=r.bits2int||function(b){if(b.length>8192)throw new Error("input is too large");let v=et(b),S=b.length*8-f;return S>0?v>>BigInt(S):v},K=r.bits2int_modN||function(b){return i.create(G(b))},z=bt(f);function Y(h){return po("num < 2^"+f,h,ve,z),i.toBytes(h)}function $(h,b){return W(h,void 0,"message"),b?W(e(h),void 0,"prehashed message"):h}function F(h,b,v){let{lowS:S,prehash:O,extraEntropy:p}=$n(v,x);h=$(h,O);let R=K(h),w=i.fromBytes(b);if(!i.isValidNot0(w))throw new Error("invalid private key");let g=[Y(w),Y(R)];if(p!=null&&p!==!1){let T=p===!0?n(l.secretKey):p;g.push(W(T,void 0,"extraEntropy"))}let E=fe(...g),I=R;function _(T){let k=G(T);if(!i.isValidNot0(k))return;let q=i.inv(k),U=t.BASE.multiply(k).toAffine(),V=i.create(U.x);if(V===ve)return;let Z=i.create(q*i.create(I+V*w));if(Z===ve)return;let J=(U.x===V?0:2)|Number(U.y&rt),ne=Z;return S&&B(Z)&&(ne=i.neg(Z),J^=1),new j(V,ne,A?void 0:J)}return{seed:E,k2sig:_}}function M(h,b,v={}){let{seed:S,k2sig:O}=F(h,b,v);return go(e.outputLen,i.BYTES,o)(S,O).toBytes(v.format)}function C(h,b,v,S={}){let{lowS:O,prehash:p,format:R}=$n(S,x);if(v=W(v,void 0,"publicKey"),b=$(b,p),!ut(h)){let w=h instanceof j?", use sig.toBytes()":"";throw new Error("verify expects Uint8Array signature"+w)}P(h,R);try{let w=j.fromBytes(h,R),g=t.fromBytes(v);if(O&&w.hasHighS())return!1;let{r:E,s:I}=w,_=K(b),T=i.inv(I),k=i.create(_*T),q=i.create(E*T),U=t.BASE.multiplyUnsafe(k).add(g.multiplyUnsafe(q));return U.is0()?!1:i.create(U.x)===E}catch{return!1}}function H(h,b,v={}){let{prehash:S}=$n(v,x);return b=$(b,S),j.fromBytes(h,"recovered").recoverPublicKey(b).toBytes()}return Object.freeze({keygen:a,getPublicKey:u,getSharedSecret:d,utils:y,lengths:l,Point:t,sign:M,verify:C,recoverPublicKey:H,Signature:j,hash:e})}var Kn={p:BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f"),n:BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"),h:BigInt(1),a:BigInt(0),b:BigInt(7),Gx:BigInt("0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"),Gy:BigInt("0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8")},Bi={beta:BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),basises:[[BigInt("0x3086d221a7d46bcde86c90e49284eb15"),-BigInt("0xe4437ed6010e88286f547fa90abfe4c3")],[BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"),BigInt("0x3086d221a7d46bcde86c90e49284eb15")]]};var Vo=BigInt(2);function vi(t){let e=Kn.p,r=BigInt(3),n=BigInt(6),o=BigInt(11),s=BigInt(22),i=BigInt(23),c=BigInt(44),f=BigInt(88),a=t*t*t%e,u=a*a*t%e,d=ae(u,r,e)*u%e,y=ae(d,r,e)*u%e,l=ae(y,Vo,e)*a%e,x=ae(l,o,e)*l%e,A=ae(x,s,e)*x%e,B=ae(A,c,e)*A%e,L=ae(B,f,e)*B%e,D=ae(L,c,e)*A%e,P=ae(D,r,e)*u%e,j=ae(P,i,e)*x%e,G=ae(j,n,e)*a%e,K=ae(G,Vo,e);if(!Fn.eql(Fn.sqr(K),t))throw new Error("Cannot find square root");return K}var Fn=tt(Kn.p,{sqrt:vi}),Ai=qo(Kn,{Fp:Fn,endo:Bi}),$o=jo(Ai,Qe);function Po(t,e,r){return qe(t),r===void 0&&(r=new Uint8Array(t.outputLen)),ke(t,r,e)}var zn=Uint8Array.of(0),Zo=Uint8Array.of();function Fo(t,e,r,n=32){qe(t),ue(n,"length");let o=t.outputLen;if(n>255*o)throw new Error("Length must be <= 255*HashLen");let s=Math.ceil(n/o);r===void 0?r=Zo:W(r,void 0,"info");let i=new Uint8Array(s*o),c=ke.create(t,e),f=c._cloneInto(),a=new Uint8Array(c.outputLen);for(let u=0;u<s;u++)zn[0]=u+1,f.update(u===0?Zo:a).update(r).update(zn).digestInto(a),i.set(a,o*u),c._cloneInto(f);return c.destroy(),f.destroy(),me(a,zn),i.slice(0,n)}function zo(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"}function Si(t){if(!zo(t))throw new Error("Uint8Array expected")}function Yo(t,e){return Array.isArray(e)?e.length===0?!0:t?e.every(r=>typeof r=="string"):e.every(r=>Number.isSafeInteger(r)):!1}function xt(t,e){if(typeof e!="string")throw new Error(`${t}: string expected`);return!0}function Gn(t){if(!Number.isSafeInteger(t))throw new Error(`invalid integer: ${t}`)}function Wn(t){if(!Array.isArray(t))throw new Error("array expected")}function Yt(t,e){if(!Yo(!0,e))throw new Error(`${t}: array of strings expected`)}function Ri(t,e){if(!Yo(!1,e))throw new Error(`${t}: array of numbers expected`)}function Oi(...t){let e=s=>s,r=(s,i)=>c=>s(i(c)),n=t.map(s=>s.encode).reduceRight(r,e),o=t.map(s=>s.decode).reduce(r,e);return{encode:n,decode:o}}function Ti(t){let e=typeof t=="string"?t.split(""):t,r=e.length;Yt("alphabet",e);let n=new Map(e.map((o,s)=>[o,s]));return{encode:o=>(Wn(o),o.map(s=>{if(!Number.isSafeInteger(s)||s<0||s>=r)throw new Error(`alphabet.encode: digit index outside alphabet "${s}". Allowed: ${t}`);return e[s]})),decode:o=>(Wn(o),o.map(s=>{xt("alphabet.decode",s);let i=n.get(s);if(i===void 0)throw new Error(`Unknown letter: "${s}". Allowed: ${t}`);return i}))}}function Li(t=""){return xt("join",t),{encode:e=>(Yt("join.decode",e),e.join(t)),decode:e=>(xt("join.decode",e),e.split(t))}}function Ii(t,e="="){return Gn(t),xt("padding",e),{encode(r){for(Yt("padding.encode",r);r.length*t%8;)r.push(e);return r},decode(r){Yt("padding.decode",r);let n=r.length;if(n*t%8)throw new Error("padding: invalid, string should have whole number of bytes");for(;n>0&&r[n-1]===e;n--)if((n-1)*t%8===0)throw new Error("padding: invalid, string has too much padding");return r.slice(0,n)}}}var Wo=(t,e)=>e===0?t:Wo(e,t%e),Wt=(t,e)=>t+(e-Wo(t,e)),Yn=(()=>{let t=[];for(let e=0;e<40;e++)t.push(2**e);return t})();function Ko(t,e,r,n){if(Wn(t),e<=0||e>32)throw new Error(`convertRadix2: wrong from=${e}`);if(r<=0||r>32)throw new Error(`convertRadix2: wrong to=${r}`);if(Wt(e,r)>32)throw new Error(`convertRadix2: carry overflow from=${e} to=${r} carryBits=${Wt(e,r)}`);let o=0,s=0,i=Yn[e],c=Yn[r]-1,f=[];for(let a of t){if(Gn(a),a>=i)throw new Error(`convertRadix2: invalid data word=${a} from=${e}`);if(o=o<<e|a,s+e>32)throw new Error(`convertRadix2: carry overflow pos=${s} from=${e}`);for(s+=e;s>=r;s-=r)f.push((o>>s-r&c)>>>0);let u=Yn[s];if(u===void 0)throw new Error("invalid carry");o&=u-1}if(o=o<<r-s&c,!n&&s>=e)throw new Error("Excess padding");if(!n&&o>0)throw new Error(`Non-zero padding: ${o}`);return n&&s>0&&f.push(o>>>0),f}function Ui(t,e=!1){if(Gn(t),t<=0||t>32)throw new Error("radix2: bits should be in (0..32]");if(Wt(8,t)>32||Wt(t,8)>32)throw new Error("radix2: carry overflow");return{encode:r=>{if(!zo(r))throw new Error("radix2.encode input should be Uint8Array");return Ko(Array.from(r),8,t,!e)},decode:r=>(Ri("radix2.decode",r),Uint8Array.from(Ko(r,t,8,e)))}}var _i=typeof Uint8Array.from([]).toBase64=="function"&&typeof Uint8Array.fromBase64=="function",ki=(t,e)=>{xt("base64",t);let r=e?/^[A-Za-z0-9=_-]+$/:/^[A-Za-z0-9=+/]+$/,n=e?"base64url":"base64";if(t.length>0&&!r.test(t))throw new Error("invalid base64");return Uint8Array.fromBase64(t,{alphabet:n,lastChunkHandling:"strict"})},Go=_i?{encode(t){return Si(t),t.toBase64()},decode(t){return ki(t,!1)}}:Oi(Ui(6),Ti("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"),Ii(6),Li(""));var Hi=new TextDecoder("utf-8"),Ni=new TextEncoder,Ci=1,qi=4294967295,Di=65536;function Xn(t,e){let r=$o.getSharedSecret(t,Ee("02"+e)).subarray(1,33);return Po(Qe,r,Ni.encode("nip44-v2"))}function Mi(t,e){let r=Fo(Qe,t,e,76);return{chacha_key:r.subarray(0,32),chacha_nonce:r.subarray(32,44),hmac_key:r.subarray(44,76)}}function ji(t){if(!Number.isSafeInteger(t)||t<1)throw new Error("expected positive integer");if(t<=32)return 32;let e=2**(Math.floor(Math.log2(t-1))+1),r=e<=256?32:e/8;return r*(Math.floor((t-1)/r)+1)}function Vi(t){let e=new DataView(t.buffer,t.byteOffset,t.byteLength),r=e.getUint16(0),n,o;if(r===0){if(n=e.getUint32(2),n<Di)throw new Error("invalid padding");o=6}else n=r,o=2;let s=t.subarray(o,o+n);if(n<Ci||n>qi||s.length!==n||t.length!==o+ji(n))throw new Error("invalid padding");return Hi.decode(s)}function $i(t,e,r){if(r.length!==32)throw new Error("AAD associated data must be 32 bytes");let n=fe(r,e);return ke(Qe,t,n)}function Zi(t){if(typeof t!="string")throw new Error("payload must be a valid string");let e=t.length;if(e<132)throw new Error("invalid payload length: "+e);if(t[0]==="#")throw new Error("unknown encryption version");let r;try{r=Go.decode(t)}catch(s){throw new Error("invalid base64: "+s.message)}let n=r.length;if(n<99)throw new Error("invalid data length: "+n);let o=r[0];if(o!==2)throw new Error("unknown encryption version "+o);return{nonce:r.subarray(1,33),ciphertext:r.subarray(33,-32),mac:r.subarray(-32)}}function Jn(t,e){let{nonce:r,ciphertext:n,mac:o}=Zi(t),{chacha_key:s,chacha_nonce:i,hmac_key:c}=Mi(e,r),f=$i(c,n,r);if(!Dt(f,o))throw new Error("invalid MAC");let a=An(s,i,n);return Vi(a)}function Pi(t){return t.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function Fi(){let t=new Uint8Array(16);return crypto.getRandomValues(t),Array.from(t,e=>e.toString(16).padStart(2,"0")).join("")}function Gt(t,e){let r=t.find(n=>n[0]===e);return r?r[1]:void 0}function Ae(t){let e=new Uint8Array(t.length/2);for(let r=0;r<e.length;r++)e[r]=parseInt(t.substr(r*2,2),16);return e}async function Ki(t){if(!t.id||!t.pubkey||!t.sig||!t.tags||t.kind!==30470||!/^[0-9a-f]{128}$/i.test(t.sig)||!/^[0-9a-f]{64}$/i.test(t.pubkey)||!/^[0-9a-f]{64}$/i.test(t.id)||t.tags.length>100||t.content.length>65536||t.tags.some(i=>i.some(c=>c.length>1024)))return!1;let e=t.tags.map(i=>i[0]);if(!e.includes("tier")||!e.includes("age-range")||!e.includes("entity-type"))return!1;let r=JSON.stringify([0,t.pubkey,t.created_at,t.kind,t.tags,t.content]),n=new TextEncoder,o=$e(n.encode(r));if(Re(o)!==t.id.toLowerCase())return!1;try{let i=Ae(t.sig),c=Ae(t.id),f=Ae(t.pubkey);return at.verify(i,c,f)}catch{return!1}}function zi(t,e){if(t===e||t==="18+"&&e==="18+")return!0;let r=["0-3","4-7","8-12","13-17","18+"],n=r.indexOf(t),o=r.indexOf(e);return n===-1||o===-1?!1:e==="18+"?t==="18+":t===e}async function Yi(t,e){if(e==null||!/^https:\/\//i.test(e)||!/^[0-9a-f]{64}$/i.test(t))return null;try{let r=await fetch(`${e}/status/${t}`,{signal:AbortSignal.timeout(5e3)});if(!r.ok)return null;let n=await r.json();if(typeof n!="object"||n===null)return null;let o=n;return{confirmed:o.confirmed===!0,method:["A","B","C","D"].includes(o.method)?o.method:null,profession:typeof o.profession=="string"?o.profession:void 0,jurisdiction:typeof o.jurisdiction=="string"?o.jurisdiction:void 0}}catch{return null}}async function Jo(t,e){if(!["0-3","4-7","8-12","13-17","18+"].includes(t))return{verified:!1,ageRange:null,tier:null,entityType:null,credentialId:null,verifierPubkey:null,verifierConfirmed:null,verifierMethod:null,issuedAt:null,expiresAt:null,error:"invalid-age-range"};let n={requiredAgeRange:t,relayUrl:e?.relayUrl||Qo,theme:e?.theme||"auto",timeout:e?.timeout||12e4,verifierCheckUrl:e?.verifierCheckUrl!==void 0?e.verifierCheckUrl:"https://verify.signet.forgesworn.dev",acceptUnconfirmed:e?.acceptUnconfirmed||!1,...e};n.timeout=Math.max(5e3,Math.min(n.timeout??12e4,6e5));let o=Fi(),s={type:"signet-verify-request",requestId:o,requiredAgeRange:n.requiredAgeRange,relayUrl:n.relayUrl,timestamp:Math.floor(Date.now()/1e3)},i=JSON.stringify(s),c=btoa(i);return new Promise(f=>{let a=document.createElement("style");a.textContent="#signet-verify-dialog::backdrop{background:rgba(0,0,0,0.7)}",document.head.appendChild(a);let u=n.theme==="dark"||n.theme==="auto"&&window.matchMedia("(prefers-color-scheme: dark)").matches,d=u?"#1a1a2e":"#ffffff",y=u?"#e0e0e0":"#1a1a2e",l=u?"#888":"#666",x=document.createElement("dialog");x.id="signet-verify-dialog",x.style.cssText=`border:none;border-radius:16px;padding:32px;max-width:380px;width:90%;text-align:center;box-shadow:0 20px 60px rgba(0,0,0,0.3);background:${d};color:${y};font-family:system-ui,-apple-system,sans-serif;`,x.innerHTML=`
       <h2 style="margin:0 0 8px;font-size:1.3rem;">Verify your age with Signet</h2>
-      <p style="margin:0 0 24px;color:${l};font-size:0.9rem;">Scan this QR code with your Signet app to prove you are ${Zi(t)}. No personal data is shared.</p>
+      <p style="margin:0 0 24px;color:${l};font-size:0.9rem;">Scan this QR code with your Signet app to prove you are ${Pi(t)}. No personal data is shared.</p>
       <div id="signet-qr" style="display:flex;justify-content:center;margin-bottom:24px;"></div>
       <p style="margin:0 0 16px;color:${l};font-size:0.8rem;">Waiting for verification...</p>
       <button id="signet-cancel" style="background:none;border:1px solid ${l};color:${y};padding:10px 24px;border-radius:8px;cursor:pointer;font-size:0.9rem;">Cancel</button>
-    `,document.body.appendChild(x),x.showModal();let A=x.querySelector("#signet-qr");if(A){let L=document.createElement("div");L.style.cssText=`width:200px;height:200px;background:${u?"#2a2a3e":"#f0f0f0"};border-radius:8px;display:flex;align-items:center;justify-content:center;font-size:0.75rem;color:${l};word-break:break-all;padding:12px;`,L.textContent=`signet:verify:${c.slice(0,40)}...`,A.appendChild(L)}let B=new BroadcastChannel("signet-verify-"+o);x.querySelector("#signet-cancel")?.addEventListener("click",()=>{B.close(),x.close(),x.remove(),a.remove(),f({verified:!1,ageRange:null,tier:null,entityType:null,credentialId:null,verifierPubkey:null,verifierConfirmed:null,verifierMethod:null,issuedAt:null,expiresAt:null,error:"cancelled"})}),B.onmessage=async L=>{let D=L.data;if(typeof D!="object"||D===null)return;let P=D;if(P.type!=="signet-verify-response"||P.requestId!==o||!P.credential||typeof P.credential!="object"||!Array.isArray(P.credential.tags))return;let j=P.credential,G=await Fi(j),K=Gt(j.tags,"age-range"),z=Gt(j.tags,"tier"),Y=Gt(j.tags,"entity-type"),$=Gt(j.tags,"expires"),F=K?Ki(K,n.requiredAgeRange):!1,M=await zi(j.pubkey,n.verifierCheckUrl),C=M?.confirmed??null,H=M?.method??null,h=n.acceptUnconfirmed||C===!0;x.close(),x.remove(),a.remove(),B.close();let b=z?parseInt(z,10):null,v=$?parseInt($,10):null,S=Math.floor(Date.now()/1e3),O=v===null||!isNaN(v)&&v>S,p;G?O?F?h||(p=C===!1?"verifier-not-confirmed":"verifier-check-unavailable"):p="age-range-not-met":p="credential-expired":p="invalid-credential",f({verified:G&&O&&F&&h,ageRange:K||null,tier:b!==null&&!isNaN(b)?b:null,entityType:Y||null,credentialId:j.id,verifierPubkey:j.pubkey,verifierConfirmed:C,verifierMethod:H,issuedAt:j.created_at,expiresAt:v!==null&&!isNaN(v)?v:null,error:p})},setTimeout(()=>{x.close(),x.remove(),a.remove(),B.close(),f({verified:!1,ageRange:null,tier:null,entityType:null,credentialId:null,verifierPubkey:null,verifierConfirmed:null,verifierMethod:null,issuedAt:null,expiresAt:null,error:"timeout"})},n.timeout)})}var ot=300,Xo=60;function Qn(t){let e=JSON.stringify([0,t.pubkey,t.created_at,t.kind,t.tags,t.content]),r=$e(new TextEncoder().encode(e));return Re(r)}async function Yi(t,e){try{let r=Xn(e,t.pubkey),n=Jn(t.content,r),o=JSON.parse(n);if(typeof o!="object"||o===null)return null;let s=o;if(s.kind!==13||typeof s.pubkey!="string"||!/^[0-9a-f]{64}$/i.test(s.pubkey)||typeof s.created_at!="number"||!Array.isArray(s.tags)||typeof s.content!="string"||typeof s.id!="string"||!/^[0-9a-f]{64}$/i.test(s.id)||typeof s.sig!="string"||!/^[0-9a-f]{128}$/i.test(s.sig)||Qn({pubkey:s.pubkey,created_at:s.created_at,kind:13,tags:s.tags,content:s.content})!==s.id.toLowerCase())return null;let c=Ae(s.sig),f=Ae(s.id),a=Ae(s.pubkey);if(!at.verify(c,f,a))return null;let u=Xn(e,s.pubkey),d=Jn(s.content,u),y=JSON.parse(d);if(typeof y!="object"||y===null)return null;let l=y;if(typeof l.pubkey!="string"||l.pubkey!==s.pubkey||typeof l.kind!="number"||typeof l.created_at!="number"||!Array.isArray(l.tags)||typeof l.content!="string")return null;let x=typeof l.id=="string"?l.id:Qn({pubkey:l.pubkey,created_at:l.created_at,kind:l.kind,tags:l.tags,content:l.content});return{pubkey:l.pubkey,id:x,kind:l.kind,created_at:l.created_at,tags:l.tags,content:l.content}}catch{return null}}function Wi(t){return Qo(t,64)}function Qo(t,e){if(typeof t!="string")return;let r=t.replace(/[\x00-\x1f\x7f-\x9f\u200b-\u200f\u2028-\u202e\u2066-\u2069]/g,"").trim().slice(0,e);return r.length>0?r:void 0}async function es(t){let e=a=>{let u=new Error(a);return u.code=a,u};if(!/^[0-9a-f]{64}$/i.test(t.requestId))throw e("invalid-request-id");if(!(t.sessionPrivKey instanceof Uint8Array)||t.sessionPrivKey.length!==32)throw e("invalid-session-privkey");if(!/^wss:\/\//i.test(t.relayUrl)&&!/^ws:\/\/(localhost|127\.0\.0\.1)([:\/]|$)/i.test(t.relayUrl))throw e("invalid-relay-url");if(typeof t.expectedOrigin!="string"||t.expectedOrigin.length===0)throw e("invalid-expected-origin");if(Number.isFinite(t.issuedAt)&&t.issuedAt>Math.floor(Date.now()/1e3)+ot)throw e("invalid-issued-at");let r=Re(at.getPublicKey(t.sessionPrivKey)),n=Number.isFinite(t.issuedAt)?(Math.floor(t.issuedAt)+ot)*1e3-Date.now():12e4,o=Math.max(5e3,Math.min(t.timeout??n,6e5)),s=t.requestId.toLowerCase(),i=t.expectedOrigin,c=Number.isFinite(t.since)?Math.floor(t.since):Number.isFinite(t.issuedAt)?Math.floor(t.issuedAt)-Xo:Math.floor(Date.now()/1e3)-Xo,f=()=>Number.isFinite(t.issuedAt)&&Date.now()>=(Math.floor(t.issuedAt)+ot)*1e3-1e3;return new Promise((a,u)=>{let d=`sa-${Math.random().toString(36).slice(2,12)}`,y=!1,l=!1,x,A,B=Date.now()+o,L=F=>{if(!y){y=!0,clearTimeout(P),clearTimeout(A),typeof document<"u"&&document.removeEventListener("visibilitychange",G),t.abortSignal?.removeEventListener("abort",$);try{x?.close()}catch{}F()}},D=()=>L(()=>u(e(l||f()?"expired":"timeout"))),P=setTimeout(()=>{D()},o),j=()=>{!y&&x?.readyState===1&&x.send(JSON.stringify(["REQ",d,{kinds:[1059],"#p":[r],since:c}]))},G=()=>{if(!(y||document.visibilityState!=="visible")){if(Date.now()>=B)return D();!x||x.readyState>=2?Y():j()}};typeof document<"u"&&document.addEventListener("visibilitychange",G);let K=async F=>{if(y)return;let M;try{M=JSON.parse(typeof F.data=="string"?F.data:"")}catch{return}if(!Array.isArray(M))return;if(M[0]==="CLOSED"&&M[1]===d){let U=Qo(M[2],200);L(()=>{let V=e("relay-refused");U&&(V.reason=U),u(V)});return}if(M[0]!=="EVENT"||M[1]!==d)return;let C=M[2];if(typeof C!="object"||C===null)return;let H=C;if(H.kind!==1059||typeof H.pubkey!="string"||typeof H.content!="string")return;let h=await Yi({pubkey:H.pubkey,content:H.content},t.sessionPrivKey);if(!h||h.kind!==29999)return;let b=h.tags.find(U=>U[0]==="session");if(!b||b[1]!==s)return;let v=h.tags.find(U=>U[0]==="status");if(v?.[1]==="rejected"){L(()=>u(e("denied")));return}if(v?.[1]!=="approved")return;if(Math.abs(Date.now()/1e3-h.created_at)>ot){l=!0;return}let O;try{let U=JSON.parse(h.content);if(typeof U!="object"||U===null)return;O=U}catch{return}if(O.type!=="signet-auth-response"||O.requestId!==s||typeof O.authEvent!="object"||O.authEvent===null)return;let p=O.authEvent;if(typeof p.id!="string"||!/^[0-9a-f]{64}$/i.test(p.id)||typeof p.pubkey!="string"||!/^[0-9a-f]{64}$/i.test(p.pubkey)||typeof p.sig!="string"||!/^[0-9a-f]{128}$/i.test(p.sig)||p.kind!==21236||typeof p.created_at!="number"||!Array.isArray(p.tags)||typeof p.content!="string"||p.pubkey.toLowerCase()!==h.pubkey.toLowerCase()||Qn({pubkey:p.pubkey,created_at:p.created_at,kind:21236,tags:p.tags,content:p.content})!==p.id.toLowerCase())return;let w=!1;try{let U=Ae(p.sig),V=Ae(p.id),Z=Ae(p.pubkey);w=at.verify(U,V,Z)}catch{w=!1}if(!w)return;let g=p.tags,E=g.find(U=>Array.isArray(U)&&U[0]==="challenge");if(!E||typeof E[1]!="string"||E[1].toLowerCase()!==s)return;let I=g.find(U=>Array.isArray(U)&&U[0]==="origin");if(!I||I[1]!==i)return;if(Math.abs(Date.now()/1e3-p.created_at)>ot){l=!0;return}let T={id:p.id.toLowerCase(),pubkey:p.pubkey.toLowerCase(),kind:21236,created_at:p.created_at,tags:g,content:p.content,sig:p.sig},k=Wi(O.displayName),q=typeof O.bunkerUri=="string"&&/^bunker:\/\//i.test(O.bunkerUri)?O.bunkerUri:void 0;L(()=>a({pubkey:T.pubkey,authEvent:T,credential:O.credential,...k!==void 0?{displayName:k}:{},...q!==void 0?{bunkerUri:q}:{},createdAt:T.created_at}))},z=F=>{if(!y){if(typeof document>"u")return L(()=>u(e(F)));clearTimeout(A),document.visibilityState==="visible"&&(A=setTimeout(Y,1e3))}};function Y(){if(y)return;if(clearTimeout(A),Date.now()>=B)return D();let F=x;x=void 0;try{F?.close()}catch{}try{let M=new WebSocket(t.relayUrl);x=M,M.onopen=j,M.onmessage=K,M.onerror=()=>{x===M&&z("relay-error")},M.onclose=()=>{x===M&&z("relay-closed")}}catch{z("relay-error")}}let $=()=>L(()=>u(e("aborted")));if(t.abortSignal?.aborted){L(()=>u(e("aborted")));return}t.abortSignal?.addEventListener("abort",$,{once:!0}),Y()})}typeof window<"u"&&(window.Signet={verifyAge:Jo,waitForAuthResponse:es});return cs(Gi);})();
+    `,document.body.appendChild(x),x.showModal();let A=x.querySelector("#signet-qr");if(A){let L=document.createElement("div");L.style.cssText=`width:200px;height:200px;background:${u?"#2a2a3e":"#f0f0f0"};border-radius:8px;display:flex;align-items:center;justify-content:center;font-size:0.75rem;color:${l};word-break:break-all;padding:12px;`,L.textContent=`signet:verify:${c.slice(0,40)}...`,A.appendChild(L)}let B=new BroadcastChannel("signet-verify-"+o);x.querySelector("#signet-cancel")?.addEventListener("click",()=>{B.close(),x.close(),x.remove(),a.remove(),f({verified:!1,ageRange:null,tier:null,entityType:null,credentialId:null,verifierPubkey:null,verifierConfirmed:null,verifierMethod:null,issuedAt:null,expiresAt:null,error:"cancelled"})}),B.onmessage=async L=>{let D=L.data;if(typeof D!="object"||D===null)return;let P=D;if(P.type!=="signet-verify-response"||P.requestId!==o||!P.credential||typeof P.credential!="object"||!Array.isArray(P.credential.tags))return;let j=P.credential,G=await Ki(j),K=Gt(j.tags,"age-range"),z=Gt(j.tags,"tier"),Y=Gt(j.tags,"entity-type"),$=Gt(j.tags,"expires"),F=K?zi(K,n.requiredAgeRange):!1,M=await Yi(j.pubkey,n.verifierCheckUrl),C=M?.confirmed??null,H=M?.method??null,h=n.acceptUnconfirmed||C===!0;x.close(),x.remove(),a.remove(),B.close();let b=z?parseInt(z,10):null,v=$?parseInt($,10):null,S=Math.floor(Date.now()/1e3),O=v===null||!isNaN(v)&&v>S,p;G?O?F?h||(p=C===!1?"verifier-not-confirmed":"verifier-check-unavailable"):p="age-range-not-met":p="credential-expired":p="invalid-credential",f({verified:G&&O&&F&&h,ageRange:K||null,tier:b!==null&&!isNaN(b)?b:null,entityType:Y||null,credentialId:j.id,verifierPubkey:j.pubkey,verifierConfirmed:C,verifierMethod:H,issuedAt:j.created_at,expiresAt:v!==null&&!isNaN(v)?v:null,error:p})},setTimeout(()=>{x.close(),x.remove(),a.remove(),B.close(),f({verified:!1,ageRange:null,tier:null,entityType:null,credentialId:null,verifierPubkey:null,verifierConfirmed:null,verifierMethod:null,issuedAt:null,expiresAt:null,error:"timeout"})},n.timeout)})}var ot=300,Qo="wss://nos.lol",Xo=60;function Qn(t){let e=JSON.stringify([0,t.pubkey,t.created_at,t.kind,t.tags,t.content]),r=$e(new TextEncoder().encode(e));return Re(r)}async function Wi(t,e){try{let r=Xn(e,t.pubkey),n=Jn(t.content,r),o=JSON.parse(n);if(typeof o!="object"||o===null)return null;let s=o;if(s.kind!==13||typeof s.pubkey!="string"||!/^[0-9a-f]{64}$/i.test(s.pubkey)||typeof s.created_at!="number"||!Array.isArray(s.tags)||typeof s.content!="string"||typeof s.id!="string"||!/^[0-9a-f]{64}$/i.test(s.id)||typeof s.sig!="string"||!/^[0-9a-f]{128}$/i.test(s.sig)||Qn({pubkey:s.pubkey,created_at:s.created_at,kind:13,tags:s.tags,content:s.content})!==s.id.toLowerCase())return null;let c=Ae(s.sig),f=Ae(s.id),a=Ae(s.pubkey);if(!at.verify(c,f,a))return null;let u=Xn(e,s.pubkey),d=Jn(s.content,u),y=JSON.parse(d);if(typeof y!="object"||y===null)return null;let l=y;if(typeof l.pubkey!="string"||l.pubkey!==s.pubkey||typeof l.kind!="number"||typeof l.created_at!="number"||!Array.isArray(l.tags)||typeof l.content!="string")return null;let x=typeof l.id=="string"?l.id:Qn({pubkey:l.pubkey,created_at:l.created_at,kind:l.kind,tags:l.tags,content:l.content});return{pubkey:l.pubkey,id:x,kind:l.kind,created_at:l.created_at,tags:l.tags,content:l.content}}catch{return null}}function Gi(t){return es(t,64)}function es(t,e){if(typeof t!="string")return;let r=t.replace(/[\x00-\x1f\x7f-\x9f\u200b-\u200f\u2028-\u202e\u2066-\u2069]/g,"").trim().slice(0,e);return r.length>0?r:void 0}async function ts(t){let e=a=>{let u=new Error(a);return u.code=a,u};if(!/^[0-9a-f]{64}$/i.test(t.requestId))throw e("invalid-request-id");if(!(t.sessionPrivKey instanceof Uint8Array)||t.sessionPrivKey.length!==32)throw e("invalid-session-privkey");if(!/^wss:\/\//i.test(t.relayUrl)&&!/^ws:\/\/(localhost|127\.0\.0\.1)([:\/]|$)/i.test(t.relayUrl))throw e("invalid-relay-url");if(typeof t.expectedOrigin!="string"||t.expectedOrigin.length===0)throw e("invalid-expected-origin");if(Number.isFinite(t.issuedAt)&&t.issuedAt>Math.floor(Date.now()/1e3)+ot)throw e("invalid-issued-at");let r=Re(at.getPublicKey(t.sessionPrivKey)),n=Number.isFinite(t.issuedAt)?(Math.floor(t.issuedAt)+ot)*1e3-Date.now():12e4,o=Math.max(5e3,Math.min(t.timeout??n,6e5)),s=t.requestId.toLowerCase(),i=t.expectedOrigin,c=Number.isFinite(t.since)?Math.floor(t.since):Number.isFinite(t.issuedAt)?Math.floor(t.issuedAt)-Xo:Math.floor(Date.now()/1e3)-Xo,f=()=>Number.isFinite(t.issuedAt)&&Date.now()>=(Math.floor(t.issuedAt)+ot)*1e3-1e3;return new Promise((a,u)=>{let d=`sa-${Math.random().toString(36).slice(2,12)}`,y=!1,l=!1,x,A,B=Date.now()+o,L=F=>{if(!y){y=!0,clearTimeout(P),clearTimeout(A),typeof document<"u"&&document.removeEventListener("visibilitychange",G),t.abortSignal?.removeEventListener("abort",$);try{x?.close()}catch{}F()}},D=()=>L(()=>u(e(l||f()?"expired":"timeout"))),P=setTimeout(()=>{D()},o),j=()=>{!y&&x?.readyState===1&&x.send(JSON.stringify(["REQ",d,{kinds:[1059],"#p":[r],since:c}]))},G=()=>{if(!(y||document.visibilityState!=="visible")){if(Date.now()>=B)return D();!x||x.readyState>=2?Y():j()}};typeof document<"u"&&document.addEventListener("visibilitychange",G);let K=async F=>{if(y)return;let M;try{M=JSON.parse(typeof F.data=="string"?F.data:"")}catch{return}if(!Array.isArray(M))return;if(M[0]==="CLOSED"&&M[1]===d){let U=es(M[2],200);L(()=>{let V=e("relay-refused");U&&(V.reason=U),u(V)});return}if(M[0]!=="EVENT"||M[1]!==d)return;let C=M[2];if(typeof C!="object"||C===null)return;let H=C;if(H.kind!==1059||typeof H.pubkey!="string"||typeof H.content!="string")return;let h=await Wi({pubkey:H.pubkey,content:H.content},t.sessionPrivKey);if(!h||h.kind!==29999)return;let b=h.tags.find(U=>U[0]==="session");if(!b||b[1]!==s)return;let v=h.tags.find(U=>U[0]==="status");if(v?.[1]==="rejected"){L(()=>u(e("denied")));return}if(v?.[1]!=="approved")return;if(Math.abs(Date.now()/1e3-h.created_at)>ot){l=!0;return}let O;try{let U=JSON.parse(h.content);if(typeof U!="object"||U===null)return;O=U}catch{return}if(O.type!=="signet-auth-response"||O.requestId!==s||typeof O.authEvent!="object"||O.authEvent===null)return;let p=O.authEvent;if(typeof p.id!="string"||!/^[0-9a-f]{64}$/i.test(p.id)||typeof p.pubkey!="string"||!/^[0-9a-f]{64}$/i.test(p.pubkey)||typeof p.sig!="string"||!/^[0-9a-f]{128}$/i.test(p.sig)||p.kind!==21236||typeof p.created_at!="number"||!Array.isArray(p.tags)||typeof p.content!="string"||p.pubkey.toLowerCase()!==h.pubkey.toLowerCase()||Qn({pubkey:p.pubkey,created_at:p.created_at,kind:21236,tags:p.tags,content:p.content})!==p.id.toLowerCase())return;let w=!1;try{let U=Ae(p.sig),V=Ae(p.id),Z=Ae(p.pubkey);w=at.verify(U,V,Z)}catch{w=!1}if(!w)return;let g=p.tags,E=g.find(U=>Array.isArray(U)&&U[0]==="challenge");if(!E||typeof E[1]!="string"||E[1].toLowerCase()!==s)return;let I=g.find(U=>Array.isArray(U)&&U[0]==="origin");if(!I||I[1]!==i)return;if(Math.abs(Date.now()/1e3-p.created_at)>ot){l=!0;return}let T={id:p.id.toLowerCase(),pubkey:p.pubkey.toLowerCase(),kind:21236,created_at:p.created_at,tags:g,content:p.content,sig:p.sig},k=Gi(O.displayName),q=typeof O.bunkerUri=="string"&&/^bunker:\/\//i.test(O.bunkerUri)?O.bunkerUri:void 0;L(()=>a({pubkey:T.pubkey,authEvent:T,credential:O.credential,...k!==void 0?{displayName:k}:{},...q!==void 0?{bunkerUri:q}:{},createdAt:T.created_at}))},z=F=>{if(!y){if(typeof document>"u")return L(()=>u(e(F)));clearTimeout(A),document.visibilityState==="visible"&&(A=setTimeout(Y,1e3))}};function Y(){if(y)return;if(clearTimeout(A),Date.now()>=B)return D();let F=x;x=void 0;try{F?.close()}catch{}try{let M=new WebSocket(t.relayUrl);x=M,M.onopen=j,M.onmessage=K,M.onerror=()=>{x===M&&z("relay-error")},M.onclose=()=>{x===M&&z("relay-closed")}}catch{z("relay-error")}}let $=()=>L(()=>u(e("aborted")));if(t.abortSignal?.aborted){L(()=>u(e("aborted")));return}t.abortSignal?.addEventListener("abort",$,{once:!0}),Y()})}typeof window<"u"&&(window.Signet={verifyAge:Jo,waitForAuthResponse:ts});return fs(Xi);})();
 /*! Bundled license information:
 
 @noble/curves/utils.js:

package/dist/signet-verify.js

@@ -154,7 +154,7 @@ export async function verifyAge(requiredAgeRange, options) {
     }
     const opts = {
         requiredAgeRange,
-        relayUrl: options?.relayUrl || 'wss://relay.damus.io',
+        relayUrl: options?.relayUrl || DEFAULT_RELAY_URL,
         theme: options?.theme || 'auto',
         timeout: options?.timeout || 120000,
         verifierCheckUrl: options?.verifierCheckUrl !== undefined ? options.verifierCheckUrl : 'https://verify.signet.forgesworn.dev',
@@ -292,6 +292,14 @@ export async function verifyAge(requiredAgeRange, options) {
  * — instead of hardcoding 300 and drifting from this library.
  */
 export const AUTH_FRESHNESS_WINDOW_SEC = 300;
+/**
+ * The Signet relay — the one ForgeSworn operates and the Signet app publishes
+ * to. Use it unless you have a reason not to: a relay for this flow must serve
+ * kind-1059 gift wraps to an unauthenticated reader, and not all do.
+ * relay.damus.io, the previous default, refuses those reads and has AUTH
+ * misconfigured, so nothing can fetch a response from it.
+ */
+export const DEFAULT_RELAY_URL = 'wss://nos.lol';
 /**
  * Slack subtracted from `issuedAt` when deriving the relay query window, to
  * absorb clock skew between the consumer and the signer device. Widening the

package/llms.txt

@@ -0,0 +1,67 @@
+# Signet Verify
+
+> Age verification on a website usually means collecting ID or sending users
+> off to a third-party checker. signet-verify is a browser SDK that checks a
+> cryptographic age credential from the Signet app instead, without the site
+> ever seeing personal data.
+
+For websites that need to gate content by age range (adult content, age
+brackets for minors) without running their own verification flow. A single
+function call opens a QR/modal, waits for the user's Signet app to respond,
+and checks both the credential and the issuing verifier's professional
+registration.
+
+## Getting Started
+
+```bash
+npm install signet-verify
+```
+
+```javascript
+import { verifyAge } from 'signet-verify';
+
+const result = await verifyAge('18+');
+if (result.verified) {
+  // user confirmed 18+ by a confirmed professional verifier
+}
+```
+
+For a script tag / CDN build, use the IIFE export (`signet-verify/iife`),
+which exposes `window.Signet`.
+
+## Key Concepts
+
+- **Credential, not identity**: the proof carries an age range and verifier
+  info, never a name, date of birth or other PII.
+- **Verifier confirmation**: by default a result only counts as `verified`
+  when the issuing verifier is checked against a public professional
+  register (GMC, SRA, TRA, etc.) via a verification bot; this can be relaxed
+  with `acceptUnconfirmed` or pointed at a different bot with
+  `verifierCheckUrl`.
+- **Same-device vs cross-device**: `verifyAge` covers the common same-device
+  QR/modal flow; `waitForAuthResponse` is the lower-level cross-device
+  primitive for a consumer that mints its own challenge and waits on a relay
+  for the signed response.
+- **The sign-in deadline**: a cross-device wait has one deadline,
+  `issuedAt + AUTH_FRESHNESS_WINDOW_SEC`. `issuedAt` must be passed on every
+  call for the same sign-in, including retries after the page was
+  backgrounded, or the relay query anchor is wrong.
+
+## API Surface
+
+- `verifyAge(requiredAgeRange, options?) => Promise<SignetVerifyResult>`:
+  the same-device verification flow.
+- `waitForAuthResponse(options) => Promise<SignetAuthResult>`: the
+  cross-device primitive; see the README for the full option set
+  (`requestId`, `relayUrl`, `sessionPrivKey`, `expectedOrigin`, `issuedAt`,
+  `abortSignal`).
+- `AUTH_FRESHNESS_WINDOW_SEC`, `DEFAULT_RELAY_URL`: constants used to
+  compute and check the sign-in deadline.
+- Result and option types: `SignetVerifyResult`, `SignetVerifyOptions`,
+  `WaitForAuthOptions`, `SignetAuthResult`, `SignetAuthEvent`.
+
+## Optional
+
+- Full API reference, error codes and age range values: [README](README.md)
+- Cross-device example: [examples/cross-device-login.html](examples/cross-device-login.html)
+- Release history: [CHANGELOG.md](CHANGELOG.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "signet-verify",
-  "version": "0.6.1",
+  "version": "0.7.1",
   "description": "Signet SDK — website age verification and cross-device Sign-in-with-Signet",
   "type": "module",
   "main": "./dist/signet-verify.js",
@@ -14,7 +14,25 @@
     "./iife": "./dist/signet-verify.iife.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "llms.txt"
+  ],
+  "homepage": "https://github.com/forgesworn/signet-verify#readme",
+  "keywords": [
+    "signet",
+    "age-verification",
+    "age-gate",
+    "nostr",
+    "credential",
+    "verifiable-credential",
+    "cross-device",
+    "sign-in",
+    "authentication",
+    "privacy",
+    "gdpr",
+    "compliance",
+    "sdk",
+    "browser"
   ],
   "publishConfig": {
     "provenance": true