x402-proxy 0.10.12 → 0.11.0

package/dist/{derive-DNUl8LU9.js → config-cyNyKO4-.js}

@@ -1,5 +1,9 @@
 #!/usr/bin/env node
-import { t as __commonJSMin } from "./chunk-DjEMn6fM.js";
+import { i as __toESM, t as __commonJSMin } from "./chunk-DjEMn6fM.js";
+import { t as require_dist } from "./dist-CvV4mGO6.js";
+import path from "node:path";
+import fs from "node:fs";
+import os from "node:os";
 //#region node_modules/.pnpm/@stricli+core@1.2.6/node_modules/@stricli/core/dist/index.js
 function checkEnvironmentVariable(process, varName) {
 	const value = process.env?.[varName];
@@ -4571,794 +4575,395 @@ createORPF({
 	hashToScalar: ristretto255_hasher.hashToScalar
 });
 //#endregion
-//#region node_modules/.pnpm/@scure+base@2.0.0/node_modules/@scure/base/index.js
-/*! scure-base - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-function isBytes(a) {
-	return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
-}
-function isArrayOf(isString, arr) {
-	if (!Array.isArray(arr)) return false;
-	if (arr.length === 0) return true;
-	if (isString) return arr.every((item) => typeof item === "string");
-	else return arr.every((item) => Number.isSafeInteger(item));
-}
-function afn(input) {
-	if (typeof input !== "function") throw new Error("function expected");
-	return true;
-}
-function astr(label, input) {
-	if (typeof input !== "string") throw new Error(`${label}: string expected`);
-	return true;
-}
-function anumber(n) {
-	if (!Number.isSafeInteger(n)) throw new Error(`invalid integer: ${n}`);
-}
-function aArr(input) {
-	if (!Array.isArray(input)) throw new Error("array expected");
-}
-function astrArr(label, input) {
-	if (!isArrayOf(true, input)) throw new Error(`${label}: array of strings expected`);
-}
-function anumArr(label, input) {
-	if (!isArrayOf(false, input)) throw new Error(`${label}: array of numbers expected`);
-}
+//#region node_modules/.pnpm/@noble+hashes@2.0.1/node_modules/@noble/hashes/hmac.js
 /**
-* @__NO_SIDE_EFFECTS__
+* HMAC: RFC2104 message authentication code.
+* @module
 */
-function chain(...args) {
-	const id = (a) => a;
-	const wrap = (a, b) => (c) => a(b(c));
-	return {
-		encode: args.map((x) => x.encode).reduceRight(wrap, id),
-		decode: args.map((x) => x.decode).reduce(wrap, id)
-	};
-}
+/** Internal class for HMAC. */
+var _HMAC = class {
+	oHash;
+	iHash;
+	blockLen;
+	outputLen;
+	finished = false;
+	destroyed = false;
+	constructor(hash, key) {
+		ahash(hash);
+		abytes$1(key, void 0, "key");
+		this.iHash = hash.create();
+		if (typeof this.iHash.update !== "function") throw new Error("Expected instance of class which extends utils.Hash");
+		this.blockLen = this.iHash.blockLen;
+		this.outputLen = this.iHash.outputLen;
+		const blockLen = this.blockLen;
+		const pad = new Uint8Array(blockLen);
+		pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+		for (let i = 0; i < pad.length; i++) pad[i] ^= 54;
+		this.iHash.update(pad);
+		this.oHash = hash.create();
+		for (let i = 0; i < pad.length; i++) pad[i] ^= 106;
+		this.oHash.update(pad);
+		clean(pad);
+	}
+	update(buf) {
+		aexists(this);
+		this.iHash.update(buf);
+		return this;
+	}
+	digestInto(out) {
+		aexists(this);
+		abytes$1(out, this.outputLen, "output");
+		this.finished = true;
+		this.iHash.digestInto(out);
+		this.oHash.update(out);
+		this.oHash.digestInto(out);
+		this.destroy();
+	}
+	digest() {
+		const out = new Uint8Array(this.oHash.outputLen);
+		this.digestInto(out);
+		return out;
+	}
+	_cloneInto(to) {
+		to ||= Object.create(Object.getPrototypeOf(this), {});
+		const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+		to = to;
+		to.finished = finished;
+		to.destroyed = destroyed;
+		to.blockLen = blockLen;
+		to.outputLen = outputLen;
+		to.oHash = oHash._cloneInto(to.oHash);
+		to.iHash = iHash._cloneInto(to.iHash);
+		return to;
+	}
+	clone() {
+		return this._cloneInto();
+	}
+	destroy() {
+		this.destroyed = true;
+		this.oHash.destroy();
+		this.iHash.destroy();
+	}
+};
 /**
-* Encodes integer radix representation to array of strings using alphabet and back.
-* Could also be array of strings.
-* @__NO_SIDE_EFFECTS__
+* HMAC: RFC2104 message authentication code.
+* @param hash - function that would be used e.g. sha256
+* @param key - message key
+* @param message - message data
+* @example
+* import { hmac } from '@noble/hashes/hmac';
+* import { sha256 } from '@noble/hashes/sha2';
+* const mac1 = hmac(sha256, 'key', 'message');
 */
-function alphabet(letters) {
-	const lettersA = typeof letters === "string" ? letters.split("") : letters;
-	const len = lettersA.length;
-	astrArr("alphabet", lettersA);
-	const indexes = new Map(lettersA.map((l, i) => [l, i]));
-	return {
-		encode: (digits) => {
-			aArr(digits);
-			return digits.map((i) => {
-				if (!Number.isSafeInteger(i) || i < 0 || i >= len) throw new Error(`alphabet.encode: digit index outside alphabet "${i}". Allowed: ${letters}`);
-				return lettersA[i];
-			});
-		},
-		decode: (input) => {
-			aArr(input);
-			return input.map((letter) => {
-				astr("alphabet.decode", letter);
-				const i = indexes.get(letter);
-				if (i === void 0) throw new Error(`Unknown letter: "${letter}". Allowed: ${letters}`);
-				return i;
-			});
-		}
-	};
-}
+const hmac = (hash, key, message) => new _HMAC(hash, key).update(message).digest();
+hmac.create = (hash, key) => new _HMAC(hash, key);
+//#endregion
+//#region node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/abstract/weierstrass.js
 /**
-* @__NO_SIDE_EFFECTS__
+* Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.
+*
+* ### Design rationale for types
+*
+* * Interaction between classes from different curves should fail:
+*   `k256.Point.BASE.add(p256.Point.BASE)`
+* * For this purpose we want to use `instanceof` operator, which is fast and works during runtime
+* * Different calls of `curve()` would return different classes -
+*   `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,
+*   it won't affect others
+*
+* TypeScript can't infer types for classes created inside a function. Classes is one instance
+* of nominative types in TypeScript and interfaces only check for shape, so it's hard to create
+* unique type for every function call.
+*
+* We can use generic types via some param, like curve opts, but that would:
+*     1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)
+*     which is hard to debug.
+*     2. Params can be generic and we can't enforce them to be constant value:
+*     if somebody creates curve from non-constant params,
+*     it would be allowed to interact with other curves with non-constant params
+*
+* @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol
+* @module
 */
-function join(separator = "") {
-	astr("join", separator);
-	return {
-		encode: (from) => {
-			astrArr("join.decode", from);
-			return from.join(separator);
-		},
-		decode: (to) => {
-			astr("join.decode", to);
-			return to.split(separator);
-		}
-	};
-}
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+const divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n$2) / den;
 /**
-* Pad strings array so it has integer number of bits
-* @__NO_SIDE_EFFECTS__
+* Splits scalar for GLV endomorphism.
 */
-function padding(bits, chr = "=") {
-	anumber(bits);
-	astr("padding", chr);
+function _splitEndoScalar(k, basis, n) {
+	const [[a1, b1], [a2, b2]] = basis;
+	const c1 = divNearest(b2 * k, n);
+	const c2 = divNearest(-b1 * k, n);
+	let k1 = k - c1 * a1 - c2 * a2;
+	let k2 = -c1 * b1 - c2 * b2;
+	const k1neg = k1 < _0n$1;
+	const k2neg = k2 < _0n$1;
+	if (k1neg) k1 = -k1;
+	if (k2neg) k2 = -k2;
+	const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n$1;
+	if (k1 < _0n$1 || k1 >= MAX_NUM || k2 < _0n$1 || k2 >= MAX_NUM) throw new Error("splitScalar (endomorphism): failed, k=" + k);
 	return {
-		encode(data) {
-			astrArr("padding.encode", data);
-			while (data.length * bits % 8) data.push(chr);
-			return data;
-		},
-		decode(input) {
-			astrArr("padding.decode", input);
-			let end = input.length;
-			if (end * bits % 8) throw new Error("padding: invalid, string should have whole number of bytes");
-			for (; end > 0 && input[end - 1] === chr; end--) if ((end - 1) * bits % 8 === 0) throw new Error("padding: invalid, string has too much padding");
-			return input.slice(0, end);
-		}
+		k1neg,
+		k1,
+		k2neg,
+		k2
 	};
 }
-/**
-* @__NO_SIDE_EFFECTS__
-*/
-function normalize$1(fn) {
-	afn(fn);
-	return {
-		encode: (from) => from,
-		decode: (to) => fn(to)
-	};
+function validateSigFormat(format) {
+	if (![
+		"compact",
+		"recovered",
+		"der"
+	].includes(format)) throw new Error("Signature format must be \"compact\", \"recovered\", or \"der\"");
+	return format;
+}
+function validateSigOpts(opts, def) {
+	const optsn = {};
+	for (let optName of Object.keys(def)) optsn[optName] = opts[optName] === void 0 ? def[optName] : opts[optName];
+	abool(optsn.lowS, "lowS");
+	abool(optsn.prehash, "prehash");
+	if (optsn.format !== void 0) validateSigFormat(optsn.format);
+	return optsn;
 }
+var DERErr = class extends Error {
+	constructor(m = "") {
+		super(m);
+	}
+};
 /**
-* Slow: O(n^2) time complexity
+* ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:
+*
+*     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]
+*
+* Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html
 */
-function convertRadix(data, from, to) {
-	if (from < 2) throw new Error(`convertRadix: invalid from=${from}, base cannot be less than 2`);
-	if (to < 2) throw new Error(`convertRadix: invalid to=${to}, base cannot be less than 2`);
-	aArr(data);
-	if (!data.length) return [];
-	let pos = 0;
-	const res = [];
-	const digits = Array.from(data, (d) => {
-		anumber(d);
-		if (d < 0 || d >= from) throw new Error(`invalid integer: ${d}`);
-		return d;
-	});
-	const dlen = digits.length;
-	while (true) {
-		let carry = 0;
-		let done = true;
-		for (let i = pos; i < dlen; i++) {
-			const digit = digits[i];
-			const fromCarry = from * carry;
-			const digitBase = fromCarry + digit;
-			if (!Number.isSafeInteger(digitBase) || fromCarry / from !== carry || digitBase - digit !== fromCarry) throw new Error("convertRadix: carry overflow");
-			const div = digitBase / to;
-			carry = digitBase % to;
-			const rounded = Math.floor(div);
-			digits[i] = rounded;
-			if (!Number.isSafeInteger(rounded) || rounded * to + carry !== digitBase) throw new Error("convertRadix: carry overflow");
-			if (!done) continue;
-			else if (!rounded) pos = i;
-			else done = false;
-		}
-		res.push(carry);
-		if (done) break;
-	}
-	for (let i = 0; i < data.length - 1 && data[i] === 0; i++) res.push(0);
-	return res.reverse();
-}
-const gcd = (a, b) => b === 0 ? a : gcd(b, a % b);
-const radix2carry = /* @__NO_SIDE_EFFECTS__ */ (from, to) => from + (to - gcd(from, to));
-const powers = /* @__PURE__ */ (() => {
-	let res = [];
-	for (let i = 0; i < 40; i++) res.push(2 ** i);
-	return res;
-})();
-/**
-* Implemented with numbers, because BigInt is 5x slower
-*/
-function convertRadix2(data, from, to, padding) {
-	aArr(data);
-	if (from <= 0 || from > 32) throw new Error(`convertRadix2: wrong from=${from}`);
-	if (to <= 0 || to > 32) throw new Error(`convertRadix2: wrong to=${to}`);
-	if (/* @__PURE__ */ radix2carry(from, to) > 32) throw new Error(`convertRadix2: carry overflow from=${from} to=${to} carryBits=${/* @__PURE__ */ radix2carry(from, to)}`);
-	let carry = 0;
-	let pos = 0;
-	const max = powers[from];
-	const mask = powers[to] - 1;
-	const res = [];
-	for (const n of data) {
-		anumber(n);
-		if (n >= max) throw new Error(`convertRadix2: invalid data word=${n} from=${from}`);
-		carry = carry << from | n;
-		if (pos + from > 32) throw new Error(`convertRadix2: carry overflow pos=${pos} from=${from}`);
-		pos += from;
-		for (; pos >= to; pos -= to) res.push((carry >> pos - to & mask) >>> 0);
-		const pow = powers[pos];
-		if (pow === void 0) throw new Error("invalid carry");
-		carry &= pow - 1;
-	}
-	carry = carry << to - pos & mask;
-	if (!padding && pos >= from) throw new Error("Excess padding");
-	if (!padding && carry > 0) throw new Error(`Non-zero padding: ${carry}`);
-	if (padding && pos > 0) res.push(carry >>> 0);
-	return res;
-}
-/**
-* @__NO_SIDE_EFFECTS__
-*/
-function radix(num) {
-	anumber(num);
-	const _256 = 2 ** 8;
-	return {
-		encode: (bytes) => {
-			if (!isBytes(bytes)) throw new Error("radix.encode input should be Uint8Array");
-			return convertRadix(Array.from(bytes), _256, num);
-		},
-		decode: (digits) => {
-			anumArr("radix.decode", digits);
-			return Uint8Array.from(convertRadix(digits, num, _256));
-		}
-	};
-}
-/**
-* If both bases are power of same number (like `2**8 <-> 2**64`),
-* there is a linear algorithm. For now we have implementation for power-of-two bases only.
-* @__NO_SIDE_EFFECTS__
-*/
-function radix2(bits, revPadding = false) {
-	anumber(bits);
-	if (bits <= 0 || bits > 32) throw new Error("radix2: bits should be in (0..32]");
-	if (/* @__PURE__ */ radix2carry(8, bits) > 32 || /* @__PURE__ */ radix2carry(bits, 8) > 32) throw new Error("radix2: carry overflow");
-	return {
-		encode: (bytes) => {
-			if (!isBytes(bytes)) throw new Error("radix2.encode input should be Uint8Array");
-			return convertRadix2(Array.from(bytes), 8, bits, !revPadding);
+const DER = {
+	Err: DERErr,
+	_tlv: {
+		encode: (tag, data) => {
+			const { Err: E } = DER;
+			if (tag < 0 || tag > 256) throw new E("tlv.encode: wrong tag");
+			if (data.length & 1) throw new E("tlv.encode: unpadded data");
+			const dataLen = data.length / 2;
+			const len = numberToHexUnpadded(dataLen);
+			if (len.length / 2 & 128) throw new E("tlv.encode: long form length too big");
+			const lenLen = dataLen > 127 ? numberToHexUnpadded(len.length / 2 | 128) : "";
+			return numberToHexUnpadded(tag) + lenLen + len + data;
 		},
-		decode: (digits) => {
-			anumArr("radix2.decode", digits);
-			return Uint8Array.from(convertRadix2(digits, bits, 8, revPadding));
+		decode(tag, data) {
+			const { Err: E } = DER;
+			let pos = 0;
+			if (tag < 0 || tag > 256) throw new E("tlv.encode: wrong tag");
+			if (data.length < 2 || data[pos++] !== tag) throw new E("tlv.decode: wrong tlv");
+			const first = data[pos++];
+			const isLong = !!(first & 128);
+			let length = 0;
+			if (!isLong) length = first;
+			else {
+				const lenLen = first & 127;
+				if (!lenLen) throw new E("tlv.decode(long): indefinite length not supported");
+				if (lenLen > 4) throw new E("tlv.decode(long): byte length is too big");
+				const lengthBytes = data.subarray(pos, pos + lenLen);
+				if (lengthBytes.length !== lenLen) throw new E("tlv.decode: length bytes not complete");
+				if (lengthBytes[0] === 0) throw new E("tlv.decode(long): zero leftmost byte");
+				for (const b of lengthBytes) length = length << 8 | b;
+				pos += lenLen;
+				if (length < 128) throw new E("tlv.decode(long): not minimal encoding");
+			}
+			const v = data.subarray(pos, pos + length);
+			if (v.length !== length) throw new E("tlv.decode: wrong value length");
+			return {
+				v,
+				l: data.subarray(pos + length)
+			};
 		}
-	};
-}
-function unsafeWrapper(fn) {
-	afn(fn);
-	return function(...args) {
-		try {
-			return fn.apply(null, args);
-		} catch (e) {}
-	};
-}
-function checksum(len, fn) {
-	anumber(len);
-	afn(fn);
-	return {
-		encode(data) {
-			if (!isBytes(data)) throw new Error("checksum.encode: input should be Uint8Array");
-			const sum = fn(data).slice(0, len);
-			const res = new Uint8Array(data.length + len);
-			res.set(data);
-			res.set(sum, data.length);
-			return res;
+	},
+	_int: {
+		encode(num) {
+			const { Err: E } = DER;
+			if (num < _0n$1) throw new E("integer: negative integers are not allowed");
+			let hex = numberToHexUnpadded(num);
+			if (Number.parseInt(hex[0], 16) & 8) hex = "00" + hex;
+			if (hex.length & 1) throw new E("unexpected DER parsing assertion: unpadded hex");
+			return hex;
 		},
 		decode(data) {
-			if (!isBytes(data)) throw new Error("checksum.decode: input should be Uint8Array");
-			const payload = data.slice(0, -len);
-			const oldChecksum = data.slice(-len);
-			const newChecksum = fn(payload).slice(0, len);
-			for (let i = 0; i < len; i++) if (newChecksum[i] !== oldChecksum[i]) throw new Error("Invalid checksum");
-			return payload;
+			const { Err: E } = DER;
+			if (data[0] & 128) throw new E("invalid signature integer: negative");
+			if (data[0] === 0 && !(data[1] & 128)) throw new E("invalid signature integer: unnecessary leading zero");
+			return bytesToNumberBE(data);
 		}
-	};
-}
-const utils = {
-	alphabet,
-	chain,
-	checksum,
-	convertRadix,
-	convertRadix2,
-	radix,
-	radix2,
-	join,
-	padding
+	},
+	toSig(bytes) {
+		const { Err: E, _int: int, _tlv: tlv } = DER;
+		const data = abytes$1(bytes, void 0, "signature");
+		const { v: seqBytes, l: seqLeftBytes } = tlv.decode(48, data);
+		if (seqLeftBytes.length) throw new E("invalid signature: left bytes after parsing");
+		const { v: rBytes, l: rLeftBytes } = tlv.decode(2, seqBytes);
+		const { v: sBytes, l: sLeftBytes } = tlv.decode(2, rLeftBytes);
+		if (sLeftBytes.length) throw new E("invalid signature: left bytes after parsing");
+		return {
+			r: int.decode(rBytes),
+			s: int.decode(sBytes)
+		};
+	},
+	hexFromSig(sig) {
+		const { _tlv: tlv, _int: int } = DER;
+		const seq = tlv.encode(2, int.encode(sig.r)) + tlv.encode(2, int.encode(sig.s));
+		return tlv.encode(48, seq);
+	}
 };
-chain(radix2(4), alphabet("0123456789ABCDEF"), join(""));
-chain(radix2(5), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), padding(5), join(""));
-chain(radix2(5), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), join(""));
-chain(radix2(5), alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), padding(5), join(""));
-chain(radix2(5), alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), join(""));
-chain(radix2(5), alphabet("0123456789ABCDEFGHJKMNPQRSTVWXYZ"), join(""), normalize$1((s) => s.toUpperCase().replace(/O/g, "0").replace(/[IL]/g, "1")));
-const hasBase64Builtin = typeof Uint8Array.from([]).toBase64 === "function" && typeof Uint8Array.fromBase64 === "function";
-hasBase64Builtin || chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), padding(6), join(""));
-chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), join(""));
-hasBase64Builtin || chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), padding(6), join(""));
-chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), join(""));
-const genBase58 = /* @__NO_SIDE_EFFECTS__ */ (abc) => chain(radix(58), alphabet(abc), join(""));
+const _0n$1 = BigInt(0), _1n$1 = BigInt(1), _2n$2 = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);
 /**
-* base58: base64 without ambigous characters +, /, 0, O, I, l.
-* Quadratic (O(n^2)) - so, can't be used on large inputs.
+* Creates weierstrass Point constructor, based on specified curve options.
+*
+* See {@link WeierstrassOpts}.
+*
 * @example
-* ```js
-* base58.decode('01abcdef');
-* // => '3UhJW'
-* ```
-*/
-const base58 = /* @__PURE__ */ genBase58("123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz");
-/**
-* Method, which creates base58check encoder.
-* Requires function, calculating sha256.
+```js
+const opts = {
+p: 0xfffffffffffffffffffffffffffffffeffffac73n,
+n: 0x100000000000000000001b8fa16dfab9aca16b6b3n,
+h: 1n,
+a: 0n,
+b: 7n,
+Gx: 0x3b4c382ce37aa192a4019e763036f4f5dd4d7ebbn,
+Gy: 0x938cf935318fdced6bc28286531733c3f03c4feen,
+};
+const secp160k1_Point = weierstrass(opts);
+```
 */
-const createBase58check = (sha256) => chain(checksum(4, (data) => sha256(sha256(data))), base58);
-const BECH_ALPHABET = chain(alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l"), join(""));
-const POLYMOD_GENERATORS = [
-	996825010,
-	642813549,
-	513874426,
-	1027748829,
-	705979059
-];
-function bech32Polymod(pre) {
-	const b = pre >> 25;
-	let chk = (pre & 33554431) << 5;
-	for (let i = 0; i < POLYMOD_GENERATORS.length; i++) if ((b >> i & 1) === 1) chk ^= POLYMOD_GENERATORS[i];
-	return chk;
-}
-function bechChecksum(prefix, words, encodingConst = 1) {
-	const len = prefix.length;
-	let chk = 1;
-	for (let i = 0; i < len; i++) {
-		const c = prefix.charCodeAt(i);
-		if (c < 33 || c > 126) throw new Error(`Invalid prefix (${prefix})`);
-		chk = bech32Polymod(chk) ^ c >> 5;
+function weierstrass(params, extraOpts = {}) {
+	const validated = createCurveFields("weierstrass", params, extraOpts);
+	const { Fp, Fn } = validated;
+	let CURVE = validated.CURVE;
+	const { h: cofactor, n: CURVE_ORDER } = CURVE;
+	validateObject(extraOpts, {}, {
+		allowInfinityPoint: "boolean",
+		clearCofactor: "function",
+		isTorsionFree: "function",
+		fromBytes: "function",
+		toBytes: "function",
+		endo: "object"
+	});
+	const { endo } = extraOpts;
+	if (endo) {
+		if (!Fp.is0(CURVE.a) || typeof endo.beta !== "bigint" || !Array.isArray(endo.basises)) throw new Error("invalid endo: expected \"beta\": bigint and \"basises\": array");
 	}
-	chk = bech32Polymod(chk);
-	for (let i = 0; i < len; i++) chk = bech32Polymod(chk) ^ prefix.charCodeAt(i) & 31;
-	for (let v of words) chk = bech32Polymod(chk) ^ v;
-	for (let i = 0; i < 6; i++) chk = bech32Polymod(chk);
-	chk ^= encodingConst;
-	return BECH_ALPHABET.encode(convertRadix2([chk % powers[30]], 30, 5, false));
-}
-/**
-* @__NO_SIDE_EFFECTS__
-*/
-function genBech32(encoding) {
-	const ENCODING_CONST = encoding === "bech32" ? 1 : 734539939;
-	const _words = radix2(5);
-	const fromWords = _words.decode;
-	const toWords = _words.encode;
-	const fromWordsUnsafe = unsafeWrapper(fromWords);
-	function encode(prefix, words, limit = 90) {
-		astr("bech32.encode prefix", prefix);
-		if (isBytes(words)) words = Array.from(words);
-		anumArr("bech32.encode", words);
-		const plen = prefix.length;
-		if (plen === 0) throw new TypeError(`Invalid prefix length ${plen}`);
-		const actualLength = plen + 7 + words.length;
-		if (limit !== false && actualLength > limit) throw new TypeError(`Length ${actualLength} exceeds limit ${limit}`);
-		const lowered = prefix.toLowerCase();
-		const sum = bechChecksum(lowered, words, ENCODING_CONST);
-		return `${lowered}1${BECH_ALPHABET.encode(words)}${sum}`;
+	const lengths = getWLengths(Fp, Fn);
+	function assertCompressionIsSupported() {
+		if (!Fp.isOdd) throw new Error("compression is not supported: Field does not have .isOdd()");
 	}
-	function decode(str, limit = 90) {
-		astr("bech32.decode input", str);
-		const slen = str.length;
-		if (slen < 8 || limit !== false && slen > limit) throw new TypeError(`invalid string length: ${slen} (${str}). Expected (8..${limit})`);
-		const lowered = str.toLowerCase();
-		if (str !== lowered && str !== str.toUpperCase()) throw new Error(`String must be lowercase or uppercase`);
-		const sepIndex = lowered.lastIndexOf("1");
-		if (sepIndex === 0 || sepIndex === -1) throw new Error(`Letter "1" must be present between prefix and data only`);
-		const prefix = lowered.slice(0, sepIndex);
-		const data = lowered.slice(sepIndex + 1);
-		if (data.length < 6) throw new Error("Data must be at least 6 characters long");
-		const words = BECH_ALPHABET.decode(data).slice(0, -6);
-		const sum = bechChecksum(prefix, words, ENCODING_CONST);
-		if (!data.endsWith(sum)) throw new Error(`Invalid checksum in ${str}: expected "${sum}"`);
-		return {
-			prefix,
-			words
-		};
+	function pointToBytes(_c, point, isCompressed) {
+		const { x, y } = point.toAffine();
+		const bx = Fp.toBytes(x);
+		abool(isCompressed, "isCompressed");
+		if (isCompressed) {
+			assertCompressionIsSupported();
+			return concatBytes(pprefix(!Fp.isOdd(y)), bx);
+		} else return concatBytes(Uint8Array.of(4), bx, Fp.toBytes(y));
 	}
-	const decodeUnsafe = unsafeWrapper(decode);
-	function decodeToBytes(str) {
-		const { prefix, words } = decode(str, false);
-		return {
-			prefix,
-			words,
-			bytes: fromWords(words)
-		};
+	function pointFromBytes(bytes) {
+		abytes$1(bytes, void 0, "Point");
+		const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths;
+		const length = bytes.length;
+		const head = bytes[0];
+		const tail = bytes.subarray(1);
+		if (length === comp && (head === 2 || head === 3)) {
+			const x = Fp.fromBytes(tail);
+			if (!Fp.isValid(x)) throw new Error("bad point: is not on curve, wrong x");
+			const y2 = weierstrassEquation(x);
+			let y;
+			try {
+				y = Fp.sqrt(y2);
+			} catch (sqrtError) {
+				const err = sqrtError instanceof Error ? ": " + sqrtError.message : "";
+				throw new Error("bad point: is not on curve, sqrt error" + err);
+			}
+			assertCompressionIsSupported();
+			const evenY = Fp.isOdd(y);
+			if ((head & 1) === 1 !== evenY) y = Fp.neg(y);
+			return {
+				x,
+				y
+			};
+		} else if (length === uncomp && head === 4) {
+			const L = Fp.BYTES;
+			const x = Fp.fromBytes(tail.subarray(0, L));
+			const y = Fp.fromBytes(tail.subarray(L, L * 2));
+			if (!isValidXY(x, y)) throw new Error("bad point: is not on curve");
+			return {
+				x,
+				y
+			};
+		} else throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);
 	}
-	function encodeFromBytes(prefix, bytes) {
-		return encode(prefix, toWords(bytes));
+	const encodePoint = extraOpts.toBytes || pointToBytes;
+	const decodePoint = extraOpts.fromBytes || pointFromBytes;
+	function weierstrassEquation(x) {
+		const x2 = Fp.sqr(x);
+		const x3 = Fp.mul(x2, x);
+		return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b);
 	}
-	return {
-		encode,
-		decode,
-		encodeFromBytes,
-		decodeToBytes,
-		decodeUnsafe,
-		fromWords,
-		fromWordsUnsafe,
-		toWords
-	};
-}
-genBech32("bech32");
-genBech32("bech32m");
-typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function" || chain(radix2(4), alphabet("0123456789abcdef"), join(""), normalize$1((s) => {
-	if (typeof s !== "string" || s.length % 2 !== 0) throw new TypeError(`hex.decode: expected string, got ${typeof s} with length ${s.length}`);
-	return s.toLowerCase();
-}));
-//#endregion
-//#region node_modules/.pnpm/@noble+hashes@2.0.1/node_modules/@noble/hashes/hmac.js
-/**
-* HMAC: RFC2104 message authentication code.
-* @module
-*/
-/** Internal class for HMAC. */
-var _HMAC = class {
-	oHash;
-	iHash;
-	blockLen;
-	outputLen;
-	finished = false;
-	destroyed = false;
-	constructor(hash, key) {
-		ahash(hash);
-		abytes$1(key, void 0, "key");
-		this.iHash = hash.create();
-		if (typeof this.iHash.update !== "function") throw new Error("Expected instance of class which extends utils.Hash");
-		this.blockLen = this.iHash.blockLen;
-		this.outputLen = this.iHash.outputLen;
-		const blockLen = this.blockLen;
-		const pad = new Uint8Array(blockLen);
-		pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
-		for (let i = 0; i < pad.length; i++) pad[i] ^= 54;
-		this.iHash.update(pad);
-		this.oHash = hash.create();
-		for (let i = 0; i < pad.length; i++) pad[i] ^= 106;
-		this.oHash.update(pad);
-		clean(pad);
+	/** Checks whether equation holds for given x, y: y² == x³ + ax + b */
+	function isValidXY(x, y) {
+		const left = Fp.sqr(y);
+		const right = weierstrassEquation(x);
+		return Fp.eql(left, right);
 	}
-	update(buf) {
-		aexists(this);
-		this.iHash.update(buf);
-		return this;
+	if (!isValidXY(CURVE.Gx, CURVE.Gy)) throw new Error("bad curve params: generator point");
+	const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);
+	const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));
+	if (Fp.is0(Fp.add(_4a3, _27b2))) throw new Error("bad curve params: a or b");
+	/** Asserts coordinate is valid: 0 <= n < Fp.ORDER. */
+	function acoord(title, n, banZero = false) {
+		if (!Fp.isValid(n) || banZero && Fp.is0(n)) throw new Error(`bad point coordinate ${title}`);
+		return n;
 	}
-	digestInto(out) {
-		aexists(this);
-		abytes$1(out, this.outputLen, "output");
-		this.finished = true;
-		this.iHash.digestInto(out);
-		this.oHash.update(out);
-		this.oHash.digestInto(out);
-		this.destroy();
+	function aprjpoint(other) {
+		if (!(other instanceof Point)) throw new Error("Weierstrass Point expected");
 	}
-	digest() {
-		const out = new Uint8Array(this.oHash.outputLen);
-		this.digestInto(out);
-		return out;
+	function splitEndoScalarN(k) {
+		if (!endo || !endo.basises) throw new Error("no endo");
+		return _splitEndoScalar(k, endo.basises, Fn.ORDER);
 	}
-	_cloneInto(to) {
-		to ||= Object.create(Object.getPrototypeOf(this), {});
-		const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
-		to = to;
-		to.finished = finished;
-		to.destroyed = destroyed;
-		to.blockLen = blockLen;
-		to.outputLen = outputLen;
-		to.oHash = oHash._cloneInto(to.oHash);
-		to.iHash = iHash._cloneInto(to.iHash);
-		return to;
-	}
-	clone() {
-		return this._cloneInto();
-	}
-	destroy() {
-		this.destroyed = true;
-		this.oHash.destroy();
-		this.iHash.destroy();
-	}
-};
-/**
-* HMAC: RFC2104 message authentication code.
-* @param hash - function that would be used e.g. sha256
-* @param key - message key
-* @param message - message data
-* @example
-* import { hmac } from '@noble/hashes/hmac';
-* import { sha256 } from '@noble/hashes/sha2';
-* const mac1 = hmac(sha256, 'key', 'message');
-*/
-const hmac = (hash, key, message) => new _HMAC(hash, key).update(message).digest();
-hmac.create = (hash, key) => new _HMAC(hash, key);
-//#endregion
-//#region node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/abstract/weierstrass.js
-/**
-* Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.
-*
-* ### Design rationale for types
-*
-* * Interaction between classes from different curves should fail:
-*   `k256.Point.BASE.add(p256.Point.BASE)`
-* * For this purpose we want to use `instanceof` operator, which is fast and works during runtime
-* * Different calls of `curve()` would return different classes -
-*   `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,
-*   it won't affect others
-*
-* TypeScript can't infer types for classes created inside a function. Classes is one instance
-* of nominative types in TypeScript and interfaces only check for shape, so it's hard to create
-* unique type for every function call.
-*
-* We can use generic types via some param, like curve opts, but that would:
-*     1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)
-*     which is hard to debug.
-*     2. Params can be generic and we can't enforce them to be constant value:
-*     if somebody creates curve from non-constant params,
-*     it would be allowed to interact with other curves with non-constant params
-*
-* @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol
-* @module
-*/
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-const divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n$2) / den;
-/**
-* Splits scalar for GLV endomorphism.
-*/
-function _splitEndoScalar(k, basis, n) {
-	const [[a1, b1], [a2, b2]] = basis;
-	const c1 = divNearest(b2 * k, n);
-	const c2 = divNearest(-b1 * k, n);
-	let k1 = k - c1 * a1 - c2 * a2;
-	let k2 = -c1 * b1 - c2 * b2;
-	const k1neg = k1 < _0n$1;
-	const k2neg = k2 < _0n$1;
-	if (k1neg) k1 = -k1;
-	if (k2neg) k2 = -k2;
-	const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n$1;
-	if (k1 < _0n$1 || k1 >= MAX_NUM || k2 < _0n$1 || k2 >= MAX_NUM) throw new Error("splitScalar (endomorphism): failed, k=" + k);
-	return {
-		k1neg,
-		k1,
-		k2neg,
-		k2
-	};
-}
-function validateSigFormat(format) {
-	if (![
-		"compact",
-		"recovered",
-		"der"
-	].includes(format)) throw new Error("Signature format must be \"compact\", \"recovered\", or \"der\"");
-	return format;
-}
-function validateSigOpts(opts, def) {
-	const optsn = {};
-	for (let optName of Object.keys(def)) optsn[optName] = opts[optName] === void 0 ? def[optName] : opts[optName];
-	abool(optsn.lowS, "lowS");
-	abool(optsn.prehash, "prehash");
-	if (optsn.format !== void 0) validateSigFormat(optsn.format);
-	return optsn;
-}
-var DERErr = class extends Error {
-	constructor(m = "") {
-		super(m);
-	}
-};
-/**
-* ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:
-*
-*     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]
-*
-* Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html
-*/
-const DER = {
-	Err: DERErr,
-	_tlv: {
-		encode: (tag, data) => {
-			const { Err: E } = DER;
-			if (tag < 0 || tag > 256) throw new E("tlv.encode: wrong tag");
-			if (data.length & 1) throw new E("tlv.encode: unpadded data");
-			const dataLen = data.length / 2;
-			const len = numberToHexUnpadded(dataLen);
-			if (len.length / 2 & 128) throw new E("tlv.encode: long form length too big");
-			const lenLen = dataLen > 127 ? numberToHexUnpadded(len.length / 2 | 128) : "";
-			return numberToHexUnpadded(tag) + lenLen + len + data;
-		},
-		decode(tag, data) {
-			const { Err: E } = DER;
-			let pos = 0;
-			if (tag < 0 || tag > 256) throw new E("tlv.encode: wrong tag");
-			if (data.length < 2 || data[pos++] !== tag) throw new E("tlv.decode: wrong tlv");
-			const first = data[pos++];
-			const isLong = !!(first & 128);
-			let length = 0;
-			if (!isLong) length = first;
-			else {
-				const lenLen = first & 127;
-				if (!lenLen) throw new E("tlv.decode(long): indefinite length not supported");
-				if (lenLen > 4) throw new E("tlv.decode(long): byte length is too big");
-				const lengthBytes = data.subarray(pos, pos + lenLen);
-				if (lengthBytes.length !== lenLen) throw new E("tlv.decode: length bytes not complete");
-				if (lengthBytes[0] === 0) throw new E("tlv.decode(long): zero leftmost byte");
-				for (const b of lengthBytes) length = length << 8 | b;
-				pos += lenLen;
-				if (length < 128) throw new E("tlv.decode(long): not minimal encoding");
-			}
-			const v = data.subarray(pos, pos + length);
-			if (v.length !== length) throw new E("tlv.decode: wrong value length");
-			return {
-				v,
-				l: data.subarray(pos + length)
-			};
-		}
-	},
-	_int: {
-		encode(num) {
-			const { Err: E } = DER;
-			if (num < _0n$1) throw new E("integer: negative integers are not allowed");
-			let hex = numberToHexUnpadded(num);
-			if (Number.parseInt(hex[0], 16) & 8) hex = "00" + hex;
-			if (hex.length & 1) throw new E("unexpected DER parsing assertion: unpadded hex");
-			return hex;
-		},
-		decode(data) {
-			const { Err: E } = DER;
-			if (data[0] & 128) throw new E("invalid signature integer: negative");
-			if (data[0] === 0 && !(data[1] & 128)) throw new E("invalid signature integer: unnecessary leading zero");
-			return bytesToNumberBE(data);
-		}
-	},
-	toSig(bytes) {
-		const { Err: E, _int: int, _tlv: tlv } = DER;
-		const data = abytes$1(bytes, void 0, "signature");
-		const { v: seqBytes, l: seqLeftBytes } = tlv.decode(48, data);
-		if (seqLeftBytes.length) throw new E("invalid signature: left bytes after parsing");
-		const { v: rBytes, l: rLeftBytes } = tlv.decode(2, seqBytes);
-		const { v: sBytes, l: sLeftBytes } = tlv.decode(2, rLeftBytes);
-		if (sLeftBytes.length) throw new E("invalid signature: left bytes after parsing");
-		return {
-			r: int.decode(rBytes),
-			s: int.decode(sBytes)
-		};
-	},
-	hexFromSig(sig) {
-		const { _tlv: tlv, _int: int } = DER;
-		const seq = tlv.encode(2, int.encode(sig.r)) + tlv.encode(2, int.encode(sig.s));
-		return tlv.encode(48, seq);
-	}
-};
-const _0n$1 = BigInt(0), _1n$1 = BigInt(1), _2n$2 = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);
-/**
-* Creates weierstrass Point constructor, based on specified curve options.
-*
-* See {@link WeierstrassOpts}.
-*
-* @example
-```js
-const opts = {
-p: 0xfffffffffffffffffffffffffffffffeffffac73n,
-n: 0x100000000000000000001b8fa16dfab9aca16b6b3n,
-h: 1n,
-a: 0n,
-b: 7n,
-Gx: 0x3b4c382ce37aa192a4019e763036f4f5dd4d7ebbn,
-Gy: 0x938cf935318fdced6bc28286531733c3f03c4feen,
-};
-const secp160k1_Point = weierstrass(opts);
-```
-*/
-function weierstrass(params, extraOpts = {}) {
-	const validated = createCurveFields("weierstrass", params, extraOpts);
-	const { Fp, Fn } = validated;
-	let CURVE = validated.CURVE;
-	const { h: cofactor, n: CURVE_ORDER } = CURVE;
-	validateObject(extraOpts, {}, {
-		allowInfinityPoint: "boolean",
-		clearCofactor: "function",
-		isTorsionFree: "function",
-		fromBytes: "function",
-		toBytes: "function",
-		endo: "object"
-	});
-	const { endo } = extraOpts;
-	if (endo) {
-		if (!Fp.is0(CURVE.a) || typeof endo.beta !== "bigint" || !Array.isArray(endo.basises)) throw new Error("invalid endo: expected \"beta\": bigint and \"basises\": array");
-	}
-	const lengths = getWLengths(Fp, Fn);
-	function assertCompressionIsSupported() {
-		if (!Fp.isOdd) throw new Error("compression is not supported: Field does not have .isOdd()");
-	}
-	function pointToBytes(_c, point, isCompressed) {
-		const { x, y } = point.toAffine();
-		const bx = Fp.toBytes(x);
-		abool(isCompressed, "isCompressed");
-		if (isCompressed) {
-			assertCompressionIsSupported();
-			return concatBytes(pprefix(!Fp.isOdd(y)), bx);
-		} else return concatBytes(Uint8Array.of(4), bx, Fp.toBytes(y));
-	}
-	function pointFromBytes(bytes) {
-		abytes$1(bytes, void 0, "Point");
-		const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths;
-		const length = bytes.length;
-		const head = bytes[0];
-		const tail = bytes.subarray(1);
-		if (length === comp && (head === 2 || head === 3)) {
-			const x = Fp.fromBytes(tail);
-			if (!Fp.isValid(x)) throw new Error("bad point: is not on curve, wrong x");
-			const y2 = weierstrassEquation(x);
-			let y;
-			try {
-				y = Fp.sqrt(y2);
-			} catch (sqrtError) {
-				const err = sqrtError instanceof Error ? ": " + sqrtError.message : "";
-				throw new Error("bad point: is not on curve, sqrt error" + err);
-			}
-			assertCompressionIsSupported();
-			const evenY = Fp.isOdd(y);
-			if ((head & 1) === 1 !== evenY) y = Fp.neg(y);
-			return {
-				x,
-				y
-			};
-		} else if (length === uncomp && head === 4) {
-			const L = Fp.BYTES;
-			const x = Fp.fromBytes(tail.subarray(0, L));
-			const y = Fp.fromBytes(tail.subarray(L, L * 2));
-			if (!isValidXY(x, y)) throw new Error("bad point: is not on curve");
-			return {
-				x,
-				y
-			};
-		} else throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);
-	}
-	const encodePoint = extraOpts.toBytes || pointToBytes;
-	const decodePoint = extraOpts.fromBytes || pointFromBytes;
-	function weierstrassEquation(x) {
-		const x2 = Fp.sqr(x);
-		const x3 = Fp.mul(x2, x);
-		return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b);
-	}
-	/** Checks whether equation holds for given x, y: y² == x³ + ax + b */
-	function isValidXY(x, y) {
-		const left = Fp.sqr(y);
-		const right = weierstrassEquation(x);
-		return Fp.eql(left, right);
-	}
-	if (!isValidXY(CURVE.Gx, CURVE.Gy)) throw new Error("bad curve params: generator point");
-	const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);
-	const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));
-	if (Fp.is0(Fp.add(_4a3, _27b2))) throw new Error("bad curve params: a or b");
-	/** Asserts coordinate is valid: 0 <= n < Fp.ORDER. */
-	function acoord(title, n, banZero = false) {
-		if (!Fp.isValid(n) || banZero && Fp.is0(n)) throw new Error(`bad point coordinate ${title}`);
-		return n;
-	}
-	function aprjpoint(other) {
-		if (!(other instanceof Point)) throw new Error("Weierstrass Point expected");
-	}
-	function splitEndoScalarN(k) {
-		if (!endo || !endo.basises) throw new Error("no endo");
-		return _splitEndoScalar(k, endo.basises, Fn.ORDER);
-	}
-	const toAffineMemo = memoized((p, iz) => {
-		const { X, Y, Z } = p;
-		if (Fp.eql(Z, Fp.ONE)) return {
-			x: X,
-			y: Y
-		};
-		const is0 = p.is0();
-		if (iz == null) iz = is0 ? Fp.ONE : Fp.inv(Z);
-		const x = Fp.mul(X, iz);
-		const y = Fp.mul(Y, iz);
-		const zz = Fp.mul(Z, iz);
-		if (is0) return {
-			x: Fp.ZERO,
-			y: Fp.ZERO
-		};
-		if (!Fp.eql(zz, Fp.ONE)) throw new Error("invZ was invalid");
-		return {
-			x,
-			y
-		};
-	});
-	const assertValidMemo = memoized((p) => {
-		if (p.is0()) {
-			if (extraOpts.allowInfinityPoint && !Fp.is0(p.Y)) return;
-			throw new Error("bad point: ZERO");
-		}
-		const { x, y } = p.toAffine();
-		if (!Fp.isValid(x) || !Fp.isValid(y)) throw new Error("bad point: x or y not field elements");
-		if (!isValidXY(x, y)) throw new Error("bad point: equation left != right");
-		if (!p.isTorsionFree()) throw new Error("bad point: not in prime-order subgroup");
-		return true;
-	});
-	function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {
-		k2p = new Point(Fp.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);
-		k1p = negateCt(k1neg, k1p);
-		k2p = negateCt(k2neg, k2p);
-		return k1p.add(k2p);
+	const toAffineMemo = memoized((p, iz) => {
+		const { X, Y, Z } = p;
+		if (Fp.eql(Z, Fp.ONE)) return {
+			x: X,
+			y: Y
+		};
+		const is0 = p.is0();
+		if (iz == null) iz = is0 ? Fp.ONE : Fp.inv(Z);
+		const x = Fp.mul(X, iz);
+		const y = Fp.mul(Y, iz);
+		const zz = Fp.mul(Z, iz);
+		if (is0) return {
+			x: Fp.ZERO,
+			y: Fp.ZERO
+		};
+		if (!Fp.eql(zz, Fp.ONE)) throw new Error("invZ was invalid");
+		return {
+			x,
+			y
+		};
+	});
+	const assertValidMemo = memoized((p) => {
+		if (p.is0()) {
+			if (extraOpts.allowInfinityPoint && !Fp.is0(p.Y)) return;
+			throw new Error("bad point: ZERO");
+		}
+		const { x, y } = p.toAffine();
+		if (!Fp.isValid(x) || !Fp.isValid(y)) throw new Error("bad point: x or y not field elements");
+		if (!isValidXY(x, y)) throw new Error("bad point: equation left != right");
+		if (!p.isTorsionFree()) throw new Error("bad point: not in prime-order subgroup");
+		return true;
+	});
+	function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {
+		k2p = new Point(Fp.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);
+		k1p = negateCt(k1neg, k1p);
+		k2p = negateCt(k2neg, k2p);
+		return k1p.add(k2p);
 	}
 	/**
 	* Projective Point works in 3d / projective (homogeneous) coordinates:(X, Y, Z) ∋ (x=X/Z, y=Y/Z).
@@ -6223,179 +5828,578 @@ createHasher(Pointk1, (scalars) => {
 * Check out `sha3-addons` module for cSHAKE, k12, and others.
 * @module
 */
-const _0n = BigInt(0);
-const _1n = BigInt(1);
-const _2n = BigInt(2);
-const _7n = BigInt(7);
-const _256n = BigInt(256);
-const _0x71n = BigInt(113);
-const SHA3_PI = [];
-const SHA3_ROTL = [];
-const _SHA3_IOTA = [];
-for (let round = 0, R = _1n, x = 1, y = 0; round < 24; round++) {
-	[x, y] = [y, (2 * x + 3 * y) % 5];
-	SHA3_PI.push(2 * (5 * y + x));
-	SHA3_ROTL.push((round + 1) * (round + 2) / 2 % 64);
-	let t = _0n;
-	for (let j = 0; j < 7; j++) {
-		R = (R << _1n ^ (R >> _7n) * _0x71n) % _256n;
-		if (R & _2n) t ^= _1n << (_1n << BigInt(j)) - _1n;
-	}
-	_SHA3_IOTA.push(t);
+const _0n = BigInt(0);
+const _1n = BigInt(1);
+const _2n = BigInt(2);
+const _7n = BigInt(7);
+const _256n = BigInt(256);
+const _0x71n = BigInt(113);
+const SHA3_PI = [];
+const SHA3_ROTL = [];
+const _SHA3_IOTA = [];
+for (let round = 0, R = _1n, x = 1, y = 0; round < 24; round++) {
+	[x, y] = [y, (2 * x + 3 * y) % 5];
+	SHA3_PI.push(2 * (5 * y + x));
+	SHA3_ROTL.push((round + 1) * (round + 2) / 2 % 64);
+	let t = _0n;
+	for (let j = 0; j < 7; j++) {
+		R = (R << _1n ^ (R >> _7n) * _0x71n) % _256n;
+		if (R & _2n) t ^= _1n << (_1n << BigInt(j)) - _1n;
+	}
+	_SHA3_IOTA.push(t);
+}
+const IOTAS = split(_SHA3_IOTA, true);
+const SHA3_IOTA_H = IOTAS[0];
+const SHA3_IOTA_L = IOTAS[1];
+const rotlH = (h, l, s) => s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s);
+const rotlL = (h, l, s) => s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s);
+/** `keccakf1600` internal function, additionally allows to adjust round count. */
+function keccakP(s, rounds = 24) {
+	const B = new Uint32Array(10);
+	for (let round = 24 - rounds; round < 24; round++) {
+		for (let x = 0; x < 10; x++) B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];
+		for (let x = 0; x < 10; x += 2) {
+			const idx1 = (x + 8) % 10;
+			const idx0 = (x + 2) % 10;
+			const B0 = B[idx0];
+			const B1 = B[idx0 + 1];
+			const Th = rotlH(B0, B1, 1) ^ B[idx1];
+			const Tl = rotlL(B0, B1, 1) ^ B[idx1 + 1];
+			for (let y = 0; y < 50; y += 10) {
+				s[x + y] ^= Th;
+				s[x + y + 1] ^= Tl;
+			}
+		}
+		let curH = s[2];
+		let curL = s[3];
+		for (let t = 0; t < 24; t++) {
+			const shift = SHA3_ROTL[t];
+			const Th = rotlH(curH, curL, shift);
+			const Tl = rotlL(curH, curL, shift);
+			const PI = SHA3_PI[t];
+			curH = s[PI];
+			curL = s[PI + 1];
+			s[PI] = Th;
+			s[PI + 1] = Tl;
+		}
+		for (let y = 0; y < 50; y += 10) {
+			for (let x = 0; x < 10; x++) B[x] = s[y + x];
+			for (let x = 0; x < 10; x++) s[y + x] ^= ~B[(x + 2) % 10] & B[(x + 4) % 10];
+		}
+		s[0] ^= SHA3_IOTA_H[round];
+		s[1] ^= SHA3_IOTA_L[round];
+	}
+	clean(B);
+}
+/** Keccak sponge function. */
+var Keccak = class Keccak {
+	state;
+	pos = 0;
+	posOut = 0;
+	finished = false;
+	state32;
+	destroyed = false;
+	blockLen;
+	suffix;
+	outputLen;
+	enableXOF = false;
+	rounds;
+	constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {
+		this.blockLen = blockLen;
+		this.suffix = suffix;
+		this.outputLen = outputLen;
+		this.enableXOF = enableXOF;
+		this.rounds = rounds;
+		anumber$1(outputLen, "outputLen");
+		if (!(0 < blockLen && blockLen < 200)) throw new Error("only keccak-f1600 function is supported");
+		this.state = new Uint8Array(200);
+		this.state32 = u32(this.state);
+	}
+	clone() {
+		return this._cloneInto();
+	}
+	keccak() {
+		swap32IfBE(this.state32);
+		keccakP(this.state32, this.rounds);
+		swap32IfBE(this.state32);
+		this.posOut = 0;
+		this.pos = 0;
+	}
+	update(data) {
+		aexists(this);
+		abytes$1(data);
+		const { blockLen, state } = this;
+		const len = data.length;
+		for (let pos = 0; pos < len;) {
+			const take = Math.min(blockLen - this.pos, len - pos);
+			for (let i = 0; i < take; i++) state[this.pos++] ^= data[pos++];
+			if (this.pos === blockLen) this.keccak();
+		}
+		return this;
+	}
+	finish() {
+		if (this.finished) return;
+		this.finished = true;
+		const { state, suffix, pos, blockLen } = this;
+		state[pos] ^= suffix;
+		if ((suffix & 128) !== 0 && pos === blockLen - 1) this.keccak();
+		state[blockLen - 1] ^= 128;
+		this.keccak();
+	}
+	writeInto(out) {
+		aexists(this, false);
+		abytes$1(out);
+		this.finish();
+		const bufferOut = this.state;
+		const { blockLen } = this;
+		for (let pos = 0, len = out.length; pos < len;) {
+			if (this.posOut >= blockLen) this.keccak();
+			const take = Math.min(blockLen - this.posOut, len - pos);
+			out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
+			this.posOut += take;
+			pos += take;
+		}
+		return out;
+	}
+	xofInto(out) {
+		if (!this.enableXOF) throw new Error("XOF is not possible for this instance");
+		return this.writeInto(out);
+	}
+	xof(bytes) {
+		anumber$1(bytes);
+		return this.xofInto(new Uint8Array(bytes));
+	}
+	digestInto(out) {
+		aoutput(out, this);
+		if (this.finished) throw new Error("digest() was already called");
+		this.writeInto(out);
+		this.destroy();
+		return out;
+	}
+	digest() {
+		return this.digestInto(new Uint8Array(this.outputLen));
+	}
+	destroy() {
+		this.destroyed = true;
+		clean(this.state);
+	}
+	_cloneInto(to) {
+		const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
+		to ||= new Keccak(blockLen, suffix, outputLen, enableXOF, rounds);
+		to.state32.set(this.state32);
+		to.pos = this.pos;
+		to.posOut = this.posOut;
+		to.finished = this.finished;
+		to.rounds = rounds;
+		to.suffix = suffix;
+		to.outputLen = outputLen;
+		to.enableXOF = enableXOF;
+		to.destroyed = this.destroyed;
+		return to;
+	}
+};
+const genKeccak = (suffix, blockLen, outputLen, info = {}) => createHasher$1(() => new Keccak(blockLen, suffix, outputLen), info);
+/** keccak-256 hash function. Different from SHA3-256. */
+const keccak_256 = /* @__PURE__ */ genKeccak(1, 136, 32);
+//#endregion
+//#region node_modules/.pnpm/@scure+base@2.0.0/node_modules/@scure/base/index.js
+/*! scure-base - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+function isBytes(a) {
+	return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+}
+function isArrayOf(isString, arr) {
+	if (!Array.isArray(arr)) return false;
+	if (arr.length === 0) return true;
+	if (isString) return arr.every((item) => typeof item === "string");
+	else return arr.every((item) => Number.isSafeInteger(item));
+}
+function afn(input) {
+	if (typeof input !== "function") throw new Error("function expected");
+	return true;
+}
+function astr(label, input) {
+	if (typeof input !== "string") throw new Error(`${label}: string expected`);
+	return true;
+}
+function anumber(n) {
+	if (!Number.isSafeInteger(n)) throw new Error(`invalid integer: ${n}`);
+}
+function aArr(input) {
+	if (!Array.isArray(input)) throw new Error("array expected");
+}
+function astrArr(label, input) {
+	if (!isArrayOf(true, input)) throw new Error(`${label}: array of strings expected`);
+}
+function anumArr(label, input) {
+	if (!isArrayOf(false, input)) throw new Error(`${label}: array of numbers expected`);
+}
+/**
+* @__NO_SIDE_EFFECTS__
+*/
+function chain(...args) {
+	const id = (a) => a;
+	const wrap = (a, b) => (c) => a(b(c));
+	return {
+		encode: args.map((x) => x.encode).reduceRight(wrap, id),
+		decode: args.map((x) => x.decode).reduce(wrap, id)
+	};
+}
+/**
+* Encodes integer radix representation to array of strings using alphabet and back.
+* Could also be array of strings.
+* @__NO_SIDE_EFFECTS__
+*/
+function alphabet(letters) {
+	const lettersA = typeof letters === "string" ? letters.split("") : letters;
+	const len = lettersA.length;
+	astrArr("alphabet", lettersA);
+	const indexes = new Map(lettersA.map((l, i) => [l, i]));
+	return {
+		encode: (digits) => {
+			aArr(digits);
+			return digits.map((i) => {
+				if (!Number.isSafeInteger(i) || i < 0 || i >= len) throw new Error(`alphabet.encode: digit index outside alphabet "${i}". Allowed: ${letters}`);
+				return lettersA[i];
+			});
+		},
+		decode: (input) => {
+			aArr(input);
+			return input.map((letter) => {
+				astr("alphabet.decode", letter);
+				const i = indexes.get(letter);
+				if (i === void 0) throw new Error(`Unknown letter: "${letter}". Allowed: ${letters}`);
+				return i;
+			});
+		}
+	};
 }
-const IOTAS = split(_SHA3_IOTA, true);
-const SHA3_IOTA_H = IOTAS[0];
-const SHA3_IOTA_L = IOTAS[1];
-const rotlH = (h, l, s) => s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s);
-const rotlL = (h, l, s) => s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s);
-/** `keccakf1600` internal function, additionally allows to adjust round count. */
-function keccakP(s, rounds = 24) {
-	const B = new Uint32Array(10);
-	for (let round = 24 - rounds; round < 24; round++) {
-		for (let x = 0; x < 10; x++) B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];
-		for (let x = 0; x < 10; x += 2) {
-			const idx1 = (x + 8) % 10;
-			const idx0 = (x + 2) % 10;
-			const B0 = B[idx0];
-			const B1 = B[idx0 + 1];
-			const Th = rotlH(B0, B1, 1) ^ B[idx1];
-			const Tl = rotlL(B0, B1, 1) ^ B[idx1 + 1];
-			for (let y = 0; y < 50; y += 10) {
-				s[x + y] ^= Th;
-				s[x + y + 1] ^= Tl;
-			}
+/**
+* @__NO_SIDE_EFFECTS__
+*/
+function join$1(separator = "") {
+	astr("join", separator);
+	return {
+		encode: (from) => {
+			astrArr("join.decode", from);
+			return from.join(separator);
+		},
+		decode: (to) => {
+			astr("join.decode", to);
+			return to.split(separator);
 		}
-		let curH = s[2];
-		let curL = s[3];
-		for (let t = 0; t < 24; t++) {
-			const shift = SHA3_ROTL[t];
-			const Th = rotlH(curH, curL, shift);
-			const Tl = rotlL(curH, curL, shift);
-			const PI = SHA3_PI[t];
-			curH = s[PI];
-			curL = s[PI + 1];
-			s[PI] = Th;
-			s[PI + 1] = Tl;
+	};
+}
+/**
+* Pad strings array so it has integer number of bits
+* @__NO_SIDE_EFFECTS__
+*/
+function padding(bits, chr = "=") {
+	anumber(bits);
+	astr("padding", chr);
+	return {
+		encode(data) {
+			astrArr("padding.encode", data);
+			while (data.length * bits % 8) data.push(chr);
+			return data;
+		},
+		decode(input) {
+			astrArr("padding.decode", input);
+			let end = input.length;
+			if (end * bits % 8) throw new Error("padding: invalid, string should have whole number of bytes");
+			for (; end > 0 && input[end - 1] === chr; end--) if ((end - 1) * bits % 8 === 0) throw new Error("padding: invalid, string has too much padding");
+			return input.slice(0, end);
 		}
-		for (let y = 0; y < 50; y += 10) {
-			for (let x = 0; x < 10; x++) B[x] = s[y + x];
-			for (let x = 0; x < 10; x++) s[y + x] ^= ~B[(x + 2) % 10] & B[(x + 4) % 10];
+	};
+}
+/**
+* @__NO_SIDE_EFFECTS__
+*/
+function normalize$2(fn) {
+	afn(fn);
+	return {
+		encode: (from) => from,
+		decode: (to) => fn(to)
+	};
+}
+/**
+* Slow: O(n^2) time complexity
+*/
+function convertRadix(data, from, to) {
+	if (from < 2) throw new Error(`convertRadix: invalid from=${from}, base cannot be less than 2`);
+	if (to < 2) throw new Error(`convertRadix: invalid to=${to}, base cannot be less than 2`);
+	aArr(data);
+	if (!data.length) return [];
+	let pos = 0;
+	const res = [];
+	const digits = Array.from(data, (d) => {
+		anumber(d);
+		if (d < 0 || d >= from) throw new Error(`invalid integer: ${d}`);
+		return d;
+	});
+	const dlen = digits.length;
+	while (true) {
+		let carry = 0;
+		let done = true;
+		for (let i = pos; i < dlen; i++) {
+			const digit = digits[i];
+			const fromCarry = from * carry;
+			const digitBase = fromCarry + digit;
+			if (!Number.isSafeInteger(digitBase) || fromCarry / from !== carry || digitBase - digit !== fromCarry) throw new Error("convertRadix: carry overflow");
+			const div = digitBase / to;
+			carry = digitBase % to;
+			const rounded = Math.floor(div);
+			digits[i] = rounded;
+			if (!Number.isSafeInteger(rounded) || rounded * to + carry !== digitBase) throw new Error("convertRadix: carry overflow");
+			if (!done) continue;
+			else if (!rounded) pos = i;
+			else done = false;
 		}
-		s[0] ^= SHA3_IOTA_H[round];
-		s[1] ^= SHA3_IOTA_L[round];
+		res.push(carry);
+		if (done) break;
 	}
-	clean(B);
+	for (let i = 0; i < data.length - 1 && data[i] === 0; i++) res.push(0);
+	return res.reverse();
 }
-/** Keccak sponge function. */
-var Keccak = class Keccak {
-	state;
-	pos = 0;
-	posOut = 0;
-	finished = false;
-	state32;
-	destroyed = false;
-	blockLen;
-	suffix;
-	outputLen;
-	enableXOF = false;
-	rounds;
-	constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {
-		this.blockLen = blockLen;
-		this.suffix = suffix;
-		this.outputLen = outputLen;
-		this.enableXOF = enableXOF;
-		this.rounds = rounds;
-		anumber$1(outputLen, "outputLen");
-		if (!(0 < blockLen && blockLen < 200)) throw new Error("only keccak-f1600 function is supported");
-		this.state = new Uint8Array(200);
-		this.state32 = u32(this.state);
-	}
-	clone() {
-		return this._cloneInto();
-	}
-	keccak() {
-		swap32IfBE(this.state32);
-		keccakP(this.state32, this.rounds);
-		swap32IfBE(this.state32);
-		this.posOut = 0;
-		this.pos = 0;
+const gcd = (a, b) => b === 0 ? a : gcd(b, a % b);
+const radix2carry = /* @__NO_SIDE_EFFECTS__ */ (from, to) => from + (to - gcd(from, to));
+const powers = /* @__PURE__ */ (() => {
+	let res = [];
+	for (let i = 0; i < 40; i++) res.push(2 ** i);
+	return res;
+})();
+/**
+* Implemented with numbers, because BigInt is 5x slower
+*/
+function convertRadix2(data, from, to, padding) {
+	aArr(data);
+	if (from <= 0 || from > 32) throw new Error(`convertRadix2: wrong from=${from}`);
+	if (to <= 0 || to > 32) throw new Error(`convertRadix2: wrong to=${to}`);
+	if (/* @__PURE__ */ radix2carry(from, to) > 32) throw new Error(`convertRadix2: carry overflow from=${from} to=${to} carryBits=${/* @__PURE__ */ radix2carry(from, to)}`);
+	let carry = 0;
+	let pos = 0;
+	const max = powers[from];
+	const mask = powers[to] - 1;
+	const res = [];
+	for (const n of data) {
+		anumber(n);
+		if (n >= max) throw new Error(`convertRadix2: invalid data word=${n} from=${from}`);
+		carry = carry << from | n;
+		if (pos + from > 32) throw new Error(`convertRadix2: carry overflow pos=${pos} from=${from}`);
+		pos += from;
+		for (; pos >= to; pos -= to) res.push((carry >> pos - to & mask) >>> 0);
+		const pow = powers[pos];
+		if (pow === void 0) throw new Error("invalid carry");
+		carry &= pow - 1;
 	}
-	update(data) {
-		aexists(this);
-		abytes$1(data);
-		const { blockLen, state } = this;
-		const len = data.length;
-		for (let pos = 0; pos < len;) {
-			const take = Math.min(blockLen - this.pos, len - pos);
-			for (let i = 0; i < take; i++) state[this.pos++] ^= data[pos++];
-			if (this.pos === blockLen) this.keccak();
+	carry = carry << to - pos & mask;
+	if (!padding && pos >= from) throw new Error("Excess padding");
+	if (!padding && carry > 0) throw new Error(`Non-zero padding: ${carry}`);
+	if (padding && pos > 0) res.push(carry >>> 0);
+	return res;
+}
+/**
+* @__NO_SIDE_EFFECTS__
+*/
+function radix(num) {
+	anumber(num);
+	const _256 = 2 ** 8;
+	return {
+		encode: (bytes) => {
+			if (!isBytes(bytes)) throw new Error("radix.encode input should be Uint8Array");
+			return convertRadix(Array.from(bytes), _256, num);
+		},
+		decode: (digits) => {
+			anumArr("radix.decode", digits);
+			return Uint8Array.from(convertRadix(digits, num, _256));
 		}
-		return this;
-	}
-	finish() {
-		if (this.finished) return;
-		this.finished = true;
-		const { state, suffix, pos, blockLen } = this;
-		state[pos] ^= suffix;
-		if ((suffix & 128) !== 0 && pos === blockLen - 1) this.keccak();
-		state[blockLen - 1] ^= 128;
-		this.keccak();
-	}
-	writeInto(out) {
-		aexists(this, false);
-		abytes$1(out);
-		this.finish();
-		const bufferOut = this.state;
-		const { blockLen } = this;
-		for (let pos = 0, len = out.length; pos < len;) {
-			if (this.posOut >= blockLen) this.keccak();
-			const take = Math.min(blockLen - this.posOut, len - pos);
-			out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
-			this.posOut += take;
-			pos += take;
+	};
+}
+/**
+* If both bases are power of same number (like `2**8 <-> 2**64`),
+* there is a linear algorithm. For now we have implementation for power-of-two bases only.
+* @__NO_SIDE_EFFECTS__
+*/
+function radix2(bits, revPadding = false) {
+	anumber(bits);
+	if (bits <= 0 || bits > 32) throw new Error("radix2: bits should be in (0..32]");
+	if (/* @__PURE__ */ radix2carry(8, bits) > 32 || /* @__PURE__ */ radix2carry(bits, 8) > 32) throw new Error("radix2: carry overflow");
+	return {
+		encode: (bytes) => {
+			if (!isBytes(bytes)) throw new Error("radix2.encode input should be Uint8Array");
+			return convertRadix2(Array.from(bytes), 8, bits, !revPadding);
+		},
+		decode: (digits) => {
+			anumArr("radix2.decode", digits);
+			return Uint8Array.from(convertRadix2(digits, bits, 8, revPadding));
 		}
-		return out;
-	}
-	xofInto(out) {
-		if (!this.enableXOF) throw new Error("XOF is not possible for this instance");
-		return this.writeInto(out);
-	}
-	xof(bytes) {
-		anumber$1(bytes);
-		return this.xofInto(new Uint8Array(bytes));
+	};
+}
+function unsafeWrapper(fn) {
+	afn(fn);
+	return function(...args) {
+		try {
+			return fn.apply(null, args);
+		} catch (e) {}
+	};
+}
+function checksum(len, fn) {
+	anumber(len);
+	afn(fn);
+	return {
+		encode(data) {
+			if (!isBytes(data)) throw new Error("checksum.encode: input should be Uint8Array");
+			const sum = fn(data).slice(0, len);
+			const res = new Uint8Array(data.length + len);
+			res.set(data);
+			res.set(sum, data.length);
+			return res;
+		},
+		decode(data) {
+			if (!isBytes(data)) throw new Error("checksum.decode: input should be Uint8Array");
+			const payload = data.slice(0, -len);
+			const oldChecksum = data.slice(-len);
+			const newChecksum = fn(payload).slice(0, len);
+			for (let i = 0; i < len; i++) if (newChecksum[i] !== oldChecksum[i]) throw new Error("Invalid checksum");
+			return payload;
+		}
+	};
+}
+const utils = {
+	alphabet,
+	chain,
+	checksum,
+	convertRadix,
+	convertRadix2,
+	radix,
+	radix2,
+	join: join$1,
+	padding
+};
+chain(radix2(4), alphabet("0123456789ABCDEF"), join$1(""));
+chain(radix2(5), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), padding(5), join$1(""));
+chain(radix2(5), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), join$1(""));
+chain(radix2(5), alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), padding(5), join$1(""));
+chain(radix2(5), alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), join$1(""));
+chain(radix2(5), alphabet("0123456789ABCDEFGHJKMNPQRSTVWXYZ"), join$1(""), normalize$2((s) => s.toUpperCase().replace(/O/g, "0").replace(/[IL]/g, "1")));
+const hasBase64Builtin = typeof Uint8Array.from([]).toBase64 === "function" && typeof Uint8Array.fromBase64 === "function";
+hasBase64Builtin || chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), padding(6), join$1(""));
+chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), join$1(""));
+hasBase64Builtin || chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), padding(6), join$1(""));
+chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), join$1(""));
+const genBase58 = /* @__NO_SIDE_EFFECTS__ */ (abc) => chain(radix(58), alphabet(abc), join$1(""));
+/**
+* base58: base64 without ambigous characters +, /, 0, O, I, l.
+* Quadratic (O(n^2)) - so, can't be used on large inputs.
+* @example
+* ```js
+* base58.decode('01abcdef');
+* // => '3UhJW'
+* ```
+*/
+const base58 = /* @__PURE__ */ genBase58("123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz");
+/**
+* Method, which creates base58check encoder.
+* Requires function, calculating sha256.
+*/
+const createBase58check = (sha256) => chain(checksum(4, (data) => sha256(sha256(data))), base58);
+const BECH_ALPHABET = chain(alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l"), join$1(""));
+const POLYMOD_GENERATORS = [
+	996825010,
+	642813549,
+	513874426,
+	1027748829,
+	705979059
+];
+function bech32Polymod(pre) {
+	const b = pre >> 25;
+	let chk = (pre & 33554431) << 5;
+	for (let i = 0; i < POLYMOD_GENERATORS.length; i++) if ((b >> i & 1) === 1) chk ^= POLYMOD_GENERATORS[i];
+	return chk;
+}
+function bechChecksum(prefix, words, encodingConst = 1) {
+	const len = prefix.length;
+	let chk = 1;
+	for (let i = 0; i < len; i++) {
+		const c = prefix.charCodeAt(i);
+		if (c < 33 || c > 126) throw new Error(`Invalid prefix (${prefix})`);
+		chk = bech32Polymod(chk) ^ c >> 5;
 	}
-	digestInto(out) {
-		aoutput(out, this);
-		if (this.finished) throw new Error("digest() was already called");
-		this.writeInto(out);
-		this.destroy();
-		return out;
+	chk = bech32Polymod(chk);
+	for (let i = 0; i < len; i++) chk = bech32Polymod(chk) ^ prefix.charCodeAt(i) & 31;
+	for (let v of words) chk = bech32Polymod(chk) ^ v;
+	for (let i = 0; i < 6; i++) chk = bech32Polymod(chk);
+	chk ^= encodingConst;
+	return BECH_ALPHABET.encode(convertRadix2([chk % powers[30]], 30, 5, false));
+}
+/**
+* @__NO_SIDE_EFFECTS__
+*/
+function genBech32(encoding) {
+	const ENCODING_CONST = encoding === "bech32" ? 1 : 734539939;
+	const _words = radix2(5);
+	const fromWords = _words.decode;
+	const toWords = _words.encode;
+	const fromWordsUnsafe = unsafeWrapper(fromWords);
+	function encode(prefix, words, limit = 90) {
+		astr("bech32.encode prefix", prefix);
+		if (isBytes(words)) words = Array.from(words);
+		anumArr("bech32.encode", words);
+		const plen = prefix.length;
+		if (plen === 0) throw new TypeError(`Invalid prefix length ${plen}`);
+		const actualLength = plen + 7 + words.length;
+		if (limit !== false && actualLength > limit) throw new TypeError(`Length ${actualLength} exceeds limit ${limit}`);
+		const lowered = prefix.toLowerCase();
+		const sum = bechChecksum(lowered, words, ENCODING_CONST);
+		return `${lowered}1${BECH_ALPHABET.encode(words)}${sum}`;
 	}
-	digest() {
-		return this.digestInto(new Uint8Array(this.outputLen));
+	function decode(str, limit = 90) {
+		astr("bech32.decode input", str);
+		const slen = str.length;
+		if (slen < 8 || limit !== false && slen > limit) throw new TypeError(`invalid string length: ${slen} (${str}). Expected (8..${limit})`);
+		const lowered = str.toLowerCase();
+		if (str !== lowered && str !== str.toUpperCase()) throw new Error(`String must be lowercase or uppercase`);
+		const sepIndex = lowered.lastIndexOf("1");
+		if (sepIndex === 0 || sepIndex === -1) throw new Error(`Letter "1" must be present between prefix and data only`);
+		const prefix = lowered.slice(0, sepIndex);
+		const data = lowered.slice(sepIndex + 1);
+		if (data.length < 6) throw new Error("Data must be at least 6 characters long");
+		const words = BECH_ALPHABET.decode(data).slice(0, -6);
+		const sum = bechChecksum(prefix, words, ENCODING_CONST);
+		if (!data.endsWith(sum)) throw new Error(`Invalid checksum in ${str}: expected "${sum}"`);
+		return {
+			prefix,
+			words
+		};
 	}
-	destroy() {
-		this.destroyed = true;
-		clean(this.state);
+	const decodeUnsafe = unsafeWrapper(decode);
+	function decodeToBytes(str) {
+		const { prefix, words } = decode(str, false);
+		return {
+			prefix,
+			words,
+			bytes: fromWords(words)
+		};
 	}
-	_cloneInto(to) {
-		const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
-		to ||= new Keccak(blockLen, suffix, outputLen, enableXOF, rounds);
-		to.state32.set(this.state32);
-		to.pos = this.pos;
-		to.posOut = this.posOut;
-		to.finished = this.finished;
-		to.rounds = rounds;
-		to.suffix = suffix;
-		to.outputLen = outputLen;
-		to.enableXOF = enableXOF;
-		to.destroyed = this.destroyed;
-		return to;
+	function encodeFromBytes(prefix, bytes) {
+		return encode(prefix, toWords(bytes));
 	}
-};
-const genKeccak = (suffix, blockLen, outputLen, info = {}) => createHasher$1(() => new Keccak(blockLen, suffix, outputLen), info);
-/** keccak-256 hash function. Different from SHA3-256. */
-const keccak_256 = /* @__PURE__ */ genKeccak(1, 136, 32);
+	return {
+		encode,
+		decode,
+		encodeFromBytes,
+		decodeToBytes,
+		decodeUnsafe,
+		fromWords,
+		fromWordsUnsafe,
+		toWords
+	};
+}
+genBech32("bech32");
+genBech32("bech32m");
+typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function" || chain(radix2(4), alphabet("0123456789abcdef"), join$1(""), normalize$2((s) => {
+	if (typeof s !== "string" || s.length % 2 !== 0) throw new TypeError(`hex.decode: expected string, got ${typeof s} with length ${s.length}`);
+	return s.toLowerCase();
+}));
 //#endregion
 //#region node_modules/.pnpm/@noble+hashes@2.0.1/node_modules/@noble/hashes/legacy.js
 /**
@@ -6902,7 +6906,7 @@ function nfkd(str) {
 	if (typeof str !== "string") throw new TypeError("invalid mnemonic type: " + typeof str);
 	return str.normalize("NFKD");
 }
-function normalize(str) {
+function normalize$1(str) {
 	const norm = nfkd(str);
 	const words = norm.split(" ");
 	if (![
@@ -6980,7 +6984,7 @@ const psalt = (passphrase) => nfkd("mnemonic" + passphrase);
 * // new Uint8Array([...64 bytes])
 */
 function mnemonicToSeedSync(mnemonic, passphrase = "") {
-	return pbkdf2(sha512, normalize(mnemonic).nfkd, psalt(passphrase), {
+	return pbkdf2(sha512, normalize$1(mnemonic).nfkd, psalt(passphrase), {
 		c: 2048,
 		dkLen: 64
 	});
@@ -9106,4 +9110,105 @@ function checksumAddress(addr) {
 	return out;
 }
 //#endregion
-export { ed25519 as a, buildCommand as c, base58 as i, buildRouteMap as l, deriveSolanaKeypair as n, require_picocolors as o, generateMnemonic as r, buildApplication as s, deriveEvmKeypair as t, run as u };
+//#region packages/x402-proxy/src/lib/config.ts
+var import_dist = /* @__PURE__ */ __toESM(require_dist(), 1);
+const APP_NAME = "x402-proxy";
+function getConfigDir() {
+	const xdg = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config");
+	return path.join(xdg, APP_NAME);
+}
+/** Config dir with $HOME replaced by ~ for display */
+function getConfigDirShort() {
+	const dir = getConfigDir();
+	const home = os.homedir();
+	return dir.startsWith(home) ? `~${dir.slice(home.length)}` : dir;
+}
+function getWalletPath() {
+	return path.join(getConfigDir(), "wallet.json");
+}
+function getHistoryPath() {
+	return path.join(getConfigDir(), "history.jsonl");
+}
+function getDebugLogPath() {
+	return path.join(getConfigDir(), "debug.log");
+}
+function ensureConfigDir() {
+	fs.mkdirSync(getConfigDir(), { recursive: true });
+}
+function loadWalletFile() {
+	const p = getWalletPath();
+	if (!fs.existsSync(p)) return null;
+	try {
+		const data = JSON.parse(fs.readFileSync(p, "utf-8"));
+		if (data.version === 1 && typeof data.mnemonic === "string") return data;
+		return null;
+	} catch {
+		return null;
+	}
+}
+function createWalletFile(mnemonic) {
+	const evm = deriveEvmKeypair(mnemonic);
+	const sol = deriveSolanaKeypair(mnemonic);
+	return {
+		version: 1,
+		mnemonic,
+		addresses: {
+			evm: evm.address,
+			solana: sol.address
+		}
+	};
+}
+function saveWalletFile(wallet) {
+	ensureConfigDir();
+	fs.writeFileSync(getWalletPath(), JSON.stringify(wallet, null, 2), {
+		mode: 384,
+		encoding: "utf-8"
+	});
+}
+function loadConfig() {
+	const dir = getConfigDir();
+	for (const name of [
+		"config.yaml",
+		"config.yml",
+		"config.jsonc",
+		"config.json"
+	]) {
+		const p = path.join(dir, name);
+		if (!fs.existsSync(p)) continue;
+		try {
+			const raw = fs.readFileSync(p, "utf-8");
+			if (name.endsWith(".yaml") || name.endsWith(".yml")) return (0, import_dist.parse)(raw);
+			if (name.endsWith(".jsonc")) {
+				const stripped = raw.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "");
+				return JSON.parse(stripped);
+			}
+			return JSON.parse(raw);
+		} catch {}
+	}
+	return null;
+}
+function saveConfig(config) {
+	ensureConfigDir();
+	const p = path.join(getConfigDir(), "config.yaml");
+	fs.writeFileSync(p, (0, import_dist.stringify)(config), "utf-8");
+}
+function getSessionPath() {
+	return path.join(getConfigDir(), "session.json");
+}
+function saveSession(session) {
+	ensureConfigDir();
+	fs.writeFileSync(getSessionPath(), JSON.stringify(session, null, 2), "utf-8");
+}
+function clearSession() {
+	try {
+		fs.unlinkSync(getSessionPath());
+	} catch {}
+}
+function isConfigured() {
+	if (process.env.X402_PROXY_WALLET_MNEMONIC) return true;
+	if (process.env.X402_PROXY_WALLET_EVM_KEY) return true;
+	if (process.env.X402_PROXY_WALLET_SOLANA_KEY) return true;
+	return loadWalletFile() !== null;
+}
+//#endregion
+export { run as C, buildRouteMap as S, base58 as _, getDebugLogPath as a, buildApplication as b, isConfigured as c, saveConfig as d, saveSession as f, generateMnemonic as g, deriveSolanaKeypair as h, getConfigDirShort as i, loadConfig as l, deriveEvmKeypair as m, createWalletFile as n, getHistoryPath as o, saveWalletFile as p, ensureConfigDir as r, getWalletPath as s, clearSession as t, loadWalletFile as u, ed25519 as v, buildCommand as x, require_picocolors as y };