x402-proxy 0.10.7 → 0.10.9

package/dist/secp256k1-BZpiyffY.js

@@ -0,0 +1,2525 @@
+import { n as __exportAll } from "./chunk-DBEY4PJZ.js";
+import { $ as shrSH, A as createHasher$1, B as add3L, C as abytes, D as aoutput, E as anumber, H as add4L, I as toBytes, N as randomBytes, O as clean, P as rotr, Q as rotrSL, R as add, S as Hash, T as ahash, U as add5H, V as add4H, W as add5L, X as rotrBL, Y as rotrBH, Z as rotrSH, _ as numberToBytesBE, a as bitMask, b as utf8ToBytes, c as bytesToNumberLE, d as ensureBytes, et as shrSL, g as memoized, h as isBytes, i as bitLen, j as createView, k as concatBytes$1, l as concatBytes, m as inRange, n as abool, o as bytesToHex, p as hexToBytes, r as abytes$1, s as bytesToNumberBE, t as aInRange, tt as split, u as createHmacDrbg, v as numberToBytesLE, w as aexists, x as validateObject, y as numberToHexUnpadded, z as add3H } from "./utils-BYjkXZDF.js";
+//#region node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/_md.js
+/**
+* Internal Merkle-Damgard hash utils.
+* @module
+*/
+/** Polyfill for Safari 14. https://caniuse.com/mdn-javascript_builtins_dataview_setbiguint64 */
+function setBigUint64(view, byteOffset, value, isLE) {
+	if (typeof view.setBigUint64 === "function") return view.setBigUint64(byteOffset, value, isLE);
+	const _32n = BigInt(32);
+	const _u32_max = BigInt(4294967295);
+	const wh = Number(value >> _32n & _u32_max);
+	const wl = Number(value & _u32_max);
+	const h = isLE ? 4 : 0;
+	const l = isLE ? 0 : 4;
+	view.setUint32(byteOffset + h, wh, isLE);
+	view.setUint32(byteOffset + l, wl, isLE);
+}
+/** Choice: a ? b : c */
+function Chi(a, b, c) {
+	return a & b ^ ~a & c;
+}
+/** Majority function, true if any two inputs is true. */
+function Maj(a, b, c) {
+	return a & b ^ a & c ^ b & c;
+}
+/**
+* Merkle-Damgard hash construction base class.
+* Could be used to create MD5, RIPEMD, SHA1, SHA2.
+*/
+var HashMD = class extends Hash {
+	constructor(blockLen, outputLen, padOffset, isLE) {
+		super();
+		this.finished = false;
+		this.length = 0;
+		this.pos = 0;
+		this.destroyed = false;
+		this.blockLen = blockLen;
+		this.outputLen = outputLen;
+		this.padOffset = padOffset;
+		this.isLE = isLE;
+		this.buffer = new Uint8Array(blockLen);
+		this.view = createView(this.buffer);
+	}
+	update(data) {
+		aexists(this);
+		data = toBytes(data);
+		abytes(data);
+		const { view, buffer, blockLen } = this;
+		const len = data.length;
+		for (let pos = 0; pos < len;) {
+			const take = Math.min(blockLen - this.pos, len - pos);
+			if (take === blockLen) {
+				const dataView = createView(data);
+				for (; blockLen <= len - pos; pos += blockLen) this.process(dataView, pos);
+				continue;
+			}
+			buffer.set(data.subarray(pos, pos + take), this.pos);
+			this.pos += take;
+			pos += take;
+			if (this.pos === blockLen) {
+				this.process(view, 0);
+				this.pos = 0;
+			}
+		}
+		this.length += data.length;
+		this.roundClean();
+		return this;
+	}
+	digestInto(out) {
+		aexists(this);
+		aoutput(out, this);
+		this.finished = true;
+		const { buffer, view, blockLen, isLE } = this;
+		let { pos } = this;
+		buffer[pos++] = 128;
+		clean(this.buffer.subarray(pos));
+		if (this.padOffset > blockLen - pos) {
+			this.process(view, 0);
+			pos = 0;
+		}
+		for (let i = pos; i < blockLen; i++) buffer[i] = 0;
+		setBigUint64(view, blockLen - 8, BigInt(this.length * 8), isLE);
+		this.process(view, 0);
+		const oview = createView(out);
+		const len = this.outputLen;
+		if (len % 4) throw new Error("_sha2: outputLen should be aligned to 32bit");
+		const outLen = len / 4;
+		const state = this.get();
+		if (outLen > state.length) throw new Error("_sha2: outputLen bigger than state");
+		for (let i = 0; i < outLen; i++) oview.setUint32(4 * i, state[i], isLE);
+	}
+	digest() {
+		const { buffer, outputLen } = this;
+		this.digestInto(buffer);
+		const res = buffer.slice(0, outputLen);
+		this.destroy();
+		return res;
+	}
+	_cloneInto(to) {
+		to || (to = new this.constructor());
+		to.set(...this.get());
+		const { blockLen, buffer, length, finished, destroyed, pos } = this;
+		to.destroyed = destroyed;
+		to.finished = finished;
+		to.length = length;
+		to.pos = pos;
+		if (length % blockLen) to.buffer.set(buffer);
+		return to;
+	}
+	clone() {
+		return this._cloneInto();
+	}
+};
+/**
+* Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.
+* Check out `test/misc/sha2-gen-iv.js` for recomputation guide.
+*/
+/** Initial SHA256 state. Bits 0..32 of frac part of sqrt of primes 2..19 */
+const SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+	1779033703,
+	3144134277,
+	1013904242,
+	2773480762,
+	1359893119,
+	2600822924,
+	528734635,
+	1541459225
+]);
+/** Initial SHA384 state. Bits 0..64 of frac part of sqrt of primes 23..53 */
+const SHA384_IV = /* @__PURE__ */ Uint32Array.from([
+	3418070365,
+	3238371032,
+	1654270250,
+	914150663,
+	2438529370,
+	812702999,
+	355462360,
+	4144912697,
+	1731405415,
+	4290775857,
+	2394180231,
+	1750603025,
+	3675008525,
+	1694076839,
+	1203062813,
+	3204075428
+]);
+/** Initial SHA512 state. Bits 0..64 of frac part of sqrt of primes 2..19 */
+const SHA512_IV = /* @__PURE__ */ Uint32Array.from([
+	1779033703,
+	4089235720,
+	3144134277,
+	2227873595,
+	1013904242,
+	4271175723,
+	2773480762,
+	1595750129,
+	1359893119,
+	2917565137,
+	2600822924,
+	725511199,
+	528734635,
+	4215389547,
+	1541459225,
+	327033209
+]);
+//#endregion
+//#region node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/sha2.js
+/**
+* SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.
+* SHA256 is the fastest hash implementable in JS, even faster than Blake3.
+* Check out [RFC 4634](https://datatracker.ietf.org/doc/html/rfc4634) and
+* [FIPS 180-4](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf).
+* @module
+*/
+/**
+* Round constants:
+* First 32 bits of fractional parts of the cube roots of the first 64 primes 2..311)
+*/
+const SHA256_K = /* @__PURE__ */ Uint32Array.from([
+	1116352408,
+	1899447441,
+	3049323471,
+	3921009573,
+	961987163,
+	1508970993,
+	2453635748,
+	2870763221,
+	3624381080,
+	310598401,
+	607225278,
+	1426881987,
+	1925078388,
+	2162078206,
+	2614888103,
+	3248222580,
+	3835390401,
+	4022224774,
+	264347078,
+	604807628,
+	770255983,
+	1249150122,
+	1555081692,
+	1996064986,
+	2554220882,
+	2821834349,
+	2952996808,
+	3210313671,
+	3336571891,
+	3584528711,
+	113926993,
+	338241895,
+	666307205,
+	773529912,
+	1294757372,
+	1396182291,
+	1695183700,
+	1986661051,
+	2177026350,
+	2456956037,
+	2730485921,
+	2820302411,
+	3259730800,
+	3345764771,
+	3516065817,
+	3600352804,
+	4094571909,
+	275423344,
+	430227734,
+	506948616,
+	659060556,
+	883997877,
+	958139571,
+	1322822218,
+	1537002063,
+	1747873779,
+	1955562222,
+	2024104815,
+	2227730452,
+	2361852424,
+	2428436474,
+	2756734187,
+	3204031479,
+	3329325298
+]);
+/** Reusable temporary buffer. "W" comes straight from spec. */
+const SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+var SHA256 = class extends HashMD {
+	constructor(outputLen = 32) {
+		super(64, outputLen, 8, false);
+		this.A = SHA256_IV[0] | 0;
+		this.B = SHA256_IV[1] | 0;
+		this.C = SHA256_IV[2] | 0;
+		this.D = SHA256_IV[3] | 0;
+		this.E = SHA256_IV[4] | 0;
+		this.F = SHA256_IV[5] | 0;
+		this.G = SHA256_IV[6] | 0;
+		this.H = SHA256_IV[7] | 0;
+	}
+	get() {
+		const { A, B, C, D, E, F, G, H } = this;
+		return [
+			A,
+			B,
+			C,
+			D,
+			E,
+			F,
+			G,
+			H
+		];
+	}
+	set(A, B, C, D, E, F, G, H) {
+		this.A = A | 0;
+		this.B = B | 0;
+		this.C = C | 0;
+		this.D = D | 0;
+		this.E = E | 0;
+		this.F = F | 0;
+		this.G = G | 0;
+		this.H = H | 0;
+	}
+	process(view, offset) {
+		for (let i = 0; i < 16; i++, offset += 4) SHA256_W[i] = view.getUint32(offset, false);
+		for (let i = 16; i < 64; i++) {
+			const W15 = SHA256_W[i - 15];
+			const W2 = SHA256_W[i - 2];
+			const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+			SHA256_W[i] = (rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10) + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
+		}
+		let { A, B, C, D, E, F, G, H } = this;
+		for (let i = 0; i < 64; i++) {
+			const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+			const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
+			const T2 = (rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22)) + Maj(A, B, C) | 0;
+			H = G;
+			G = F;
+			F = E;
+			E = D + T1 | 0;
+			D = C;
+			C = B;
+			B = A;
+			A = T1 + T2 | 0;
+		}
+		A = A + this.A | 0;
+		B = B + this.B | 0;
+		C = C + this.C | 0;
+		D = D + this.D | 0;
+		E = E + this.E | 0;
+		F = F + this.F | 0;
+		G = G + this.G | 0;
+		H = H + this.H | 0;
+		this.set(A, B, C, D, E, F, G, H);
+	}
+	roundClean() {
+		clean(SHA256_W);
+	}
+	destroy() {
+		this.set(0, 0, 0, 0, 0, 0, 0, 0);
+		clean(this.buffer);
+	}
+};
+const K512 = split([
+	"0x428a2f98d728ae22",
+	"0x7137449123ef65cd",
+	"0xb5c0fbcfec4d3b2f",
+	"0xe9b5dba58189dbbc",
+	"0x3956c25bf348b538",
+	"0x59f111f1b605d019",
+	"0x923f82a4af194f9b",
+	"0xab1c5ed5da6d8118",
+	"0xd807aa98a3030242",
+	"0x12835b0145706fbe",
+	"0x243185be4ee4b28c",
+	"0x550c7dc3d5ffb4e2",
+	"0x72be5d74f27b896f",
+	"0x80deb1fe3b1696b1",
+	"0x9bdc06a725c71235",
+	"0xc19bf174cf692694",
+	"0xe49b69c19ef14ad2",
+	"0xefbe4786384f25e3",
+	"0x0fc19dc68b8cd5b5",
+	"0x240ca1cc77ac9c65",
+	"0x2de92c6f592b0275",
+	"0x4a7484aa6ea6e483",
+	"0x5cb0a9dcbd41fbd4",
+	"0x76f988da831153b5",
+	"0x983e5152ee66dfab",
+	"0xa831c66d2db43210",
+	"0xb00327c898fb213f",
+	"0xbf597fc7beef0ee4",
+	"0xc6e00bf33da88fc2",
+	"0xd5a79147930aa725",
+	"0x06ca6351e003826f",
+	"0x142929670a0e6e70",
+	"0x27b70a8546d22ffc",
+	"0x2e1b21385c26c926",
+	"0x4d2c6dfc5ac42aed",
+	"0x53380d139d95b3df",
+	"0x650a73548baf63de",
+	"0x766a0abb3c77b2a8",
+	"0x81c2c92e47edaee6",
+	"0x92722c851482353b",
+	"0xa2bfe8a14cf10364",
+	"0xa81a664bbc423001",
+	"0xc24b8b70d0f89791",
+	"0xc76c51a30654be30",
+	"0xd192e819d6ef5218",
+	"0xd69906245565a910",
+	"0xf40e35855771202a",
+	"0x106aa07032bbd1b8",
+	"0x19a4c116b8d2d0c8",
+	"0x1e376c085141ab53",
+	"0x2748774cdf8eeb99",
+	"0x34b0bcb5e19b48a8",
+	"0x391c0cb3c5c95a63",
+	"0x4ed8aa4ae3418acb",
+	"0x5b9cca4f7763e373",
+	"0x682e6ff3d6b2b8a3",
+	"0x748f82ee5defb2fc",
+	"0x78a5636f43172f60",
+	"0x84c87814a1f0ab72",
+	"0x8cc702081a6439ec",
+	"0x90befffa23631e28",
+	"0xa4506cebde82bde9",
+	"0xbef9a3f7b2c67915",
+	"0xc67178f2e372532b",
+	"0xca273eceea26619c",
+	"0xd186b8c721c0c207",
+	"0xeada7dd6cde0eb1e",
+	"0xf57d4f7fee6ed178",
+	"0x06f067aa72176fba",
+	"0x0a637dc5a2c898a6",
+	"0x113f9804bef90dae",
+	"0x1b710b35131c471b",
+	"0x28db77f523047d84",
+	"0x32caab7b40c72493",
+	"0x3c9ebe0a15c9bebc",
+	"0x431d67c49c100d4c",
+	"0x4cc5d4becb3e42b6",
+	"0x597f299cfc657e2a",
+	"0x5fcb6fab3ad6faec",
+	"0x6c44198c4a475817"
+].map((n) => BigInt(n)));
+const SHA512_Kh = K512[0];
+const SHA512_Kl = K512[1];
+const SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
+const SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
+var SHA512 = class extends HashMD {
+	constructor(outputLen = 64) {
+		super(128, outputLen, 16, false);
+		this.Ah = SHA512_IV[0] | 0;
+		this.Al = SHA512_IV[1] | 0;
+		this.Bh = SHA512_IV[2] | 0;
+		this.Bl = SHA512_IV[3] | 0;
+		this.Ch = SHA512_IV[4] | 0;
+		this.Cl = SHA512_IV[5] | 0;
+		this.Dh = SHA512_IV[6] | 0;
+		this.Dl = SHA512_IV[7] | 0;
+		this.Eh = SHA512_IV[8] | 0;
+		this.El = SHA512_IV[9] | 0;
+		this.Fh = SHA512_IV[10] | 0;
+		this.Fl = SHA512_IV[11] | 0;
+		this.Gh = SHA512_IV[12] | 0;
+		this.Gl = SHA512_IV[13] | 0;
+		this.Hh = SHA512_IV[14] | 0;
+		this.Hl = SHA512_IV[15] | 0;
+	}
+	get() {
+		const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+		return [
+			Ah,
+			Al,
+			Bh,
+			Bl,
+			Ch,
+			Cl,
+			Dh,
+			Dl,
+			Eh,
+			El,
+			Fh,
+			Fl,
+			Gh,
+			Gl,
+			Hh,
+			Hl
+		];
+	}
+	set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {
+		this.Ah = Ah | 0;
+		this.Al = Al | 0;
+		this.Bh = Bh | 0;
+		this.Bl = Bl | 0;
+		this.Ch = Ch | 0;
+		this.Cl = Cl | 0;
+		this.Dh = Dh | 0;
+		this.Dl = Dl | 0;
+		this.Eh = Eh | 0;
+		this.El = El | 0;
+		this.Fh = Fh | 0;
+		this.Fl = Fl | 0;
+		this.Gh = Gh | 0;
+		this.Gl = Gl | 0;
+		this.Hh = Hh | 0;
+		this.Hl = Hl | 0;
+	}
+	process(view, offset) {
+		for (let i = 0; i < 16; i++, offset += 4) {
+			SHA512_W_H[i] = view.getUint32(offset);
+			SHA512_W_L[i] = view.getUint32(offset += 4);
+		}
+		for (let i = 16; i < 80; i++) {
+			const W15h = SHA512_W_H[i - 15] | 0;
+			const W15l = SHA512_W_L[i - 15] | 0;
+			const s0h = rotrSH(W15h, W15l, 1) ^ rotrSH(W15h, W15l, 8) ^ shrSH(W15h, W15l, 7);
+			const s0l = rotrSL(W15h, W15l, 1) ^ rotrSL(W15h, W15l, 8) ^ shrSL(W15h, W15l, 7);
+			const W2h = SHA512_W_H[i - 2] | 0;
+			const W2l = SHA512_W_L[i - 2] | 0;
+			const s1h = rotrSH(W2h, W2l, 19) ^ rotrBH(W2h, W2l, 61) ^ shrSH(W2h, W2l, 6);
+			const SUMl = add4L(s0l, rotrSL(W2h, W2l, 19) ^ rotrBL(W2h, W2l, 61) ^ shrSL(W2h, W2l, 6), SHA512_W_L[i - 7], SHA512_W_L[i - 16]);
+			SHA512_W_H[i] = add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]) | 0;
+			SHA512_W_L[i] = SUMl | 0;
+		}
+		let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+		for (let i = 0; i < 80; i++) {
+			const sigma1h = rotrSH(Eh, El, 14) ^ rotrSH(Eh, El, 18) ^ rotrBH(Eh, El, 41);
+			const sigma1l = rotrSL(Eh, El, 14) ^ rotrSL(Eh, El, 18) ^ rotrBL(Eh, El, 41);
+			const CHIh = Eh & Fh ^ ~Eh & Gh;
+			const CHIl = El & Fl ^ ~El & Gl;
+			const T1ll = add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);
+			const T1h = add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);
+			const T1l = T1ll | 0;
+			const sigma0h = rotrSH(Ah, Al, 28) ^ rotrBH(Ah, Al, 34) ^ rotrBH(Ah, Al, 39);
+			const sigma0l = rotrSL(Ah, Al, 28) ^ rotrBL(Ah, Al, 34) ^ rotrBL(Ah, Al, 39);
+			const MAJh = Ah & Bh ^ Ah & Ch ^ Bh & Ch;
+			const MAJl = Al & Bl ^ Al & Cl ^ Bl & Cl;
+			Hh = Gh | 0;
+			Hl = Gl | 0;
+			Gh = Fh | 0;
+			Gl = Fl | 0;
+			Fh = Eh | 0;
+			Fl = El | 0;
+			({h: Eh, l: El} = add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));
+			Dh = Ch | 0;
+			Dl = Cl | 0;
+			Ch = Bh | 0;
+			Cl = Bl | 0;
+			Bh = Ah | 0;
+			Bl = Al | 0;
+			const All = add3L(T1l, sigma0l, MAJl);
+			Ah = add3H(All, T1h, sigma0h, MAJh);
+			Al = All | 0;
+		}
+		({h: Ah, l: Al} = add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));
+		({h: Bh, l: Bl} = add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));
+		({h: Ch, l: Cl} = add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));
+		({h: Dh, l: Dl} = add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));
+		({h: Eh, l: El} = add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));
+		({h: Fh, l: Fl} = add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));
+		({h: Gh, l: Gl} = add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));
+		({h: Hh, l: Hl} = add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));
+		this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
+	}
+	roundClean() {
+		clean(SHA512_W_H, SHA512_W_L);
+	}
+	destroy() {
+		clean(this.buffer);
+		this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+	}
+};
+var SHA384 = class extends SHA512 {
+	constructor() {
+		super(48);
+		this.Ah = SHA384_IV[0] | 0;
+		this.Al = SHA384_IV[1] | 0;
+		this.Bh = SHA384_IV[2] | 0;
+		this.Bl = SHA384_IV[3] | 0;
+		this.Ch = SHA384_IV[4] | 0;
+		this.Cl = SHA384_IV[5] | 0;
+		this.Dh = SHA384_IV[6] | 0;
+		this.Dl = SHA384_IV[7] | 0;
+		this.Eh = SHA384_IV[8] | 0;
+		this.El = SHA384_IV[9] | 0;
+		this.Fh = SHA384_IV[10] | 0;
+		this.Fl = SHA384_IV[11] | 0;
+		this.Gh = SHA384_IV[12] | 0;
+		this.Gl = SHA384_IV[13] | 0;
+		this.Hh = SHA384_IV[14] | 0;
+		this.Hl = SHA384_IV[15] | 0;
+	}
+};
+/**
+* SHA2-256 hash function from RFC 4634.
+*
+* It is the fastest JS hash, even faster than Blake3.
+* To break sha256 using birthday attack, attackers need to try 2^128 hashes.
+* BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.
+*/
+const sha256 = /* @__PURE__ */ createHasher$1(() => new SHA256());
+/** SHA2-512 hash function from RFC 4634. */
+const sha512 = /* @__PURE__ */ createHasher$1(() => new SHA512());
+/** SHA2-384 hash function from RFC 4634. */
+const sha384 = /* @__PURE__ */ createHasher$1(() => new SHA384());
+//#endregion
+//#region node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/hmac.js
+/**
+* HMAC: RFC2104 message authentication code.
+* @module
+*/
+var HMAC = class extends Hash {
+	constructor(hash, _key) {
+		super();
+		this.finished = false;
+		this.destroyed = false;
+		ahash(hash);
+		const key = toBytes(_key);
+		this.iHash = hash.create();
+		if (typeof this.iHash.update !== "function") throw new Error("Expected instance of class which extends utils.Hash");
+		this.blockLen = this.iHash.blockLen;
+		this.outputLen = this.iHash.outputLen;
+		const blockLen = this.blockLen;
+		const pad = new Uint8Array(blockLen);
+		pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+		for (let i = 0; i < pad.length; i++) pad[i] ^= 54;
+		this.iHash.update(pad);
+		this.oHash = hash.create();
+		for (let i = 0; i < pad.length; i++) pad[i] ^= 106;
+		this.oHash.update(pad);
+		clean(pad);
+	}
+	update(buf) {
+		aexists(this);
+		this.iHash.update(buf);
+		return this;
+	}
+	digestInto(out) {
+		aexists(this);
+		abytes(out, this.outputLen);
+		this.finished = true;
+		this.iHash.digestInto(out);
+		this.oHash.update(out);
+		this.oHash.digestInto(out);
+		this.destroy();
+	}
+	digest() {
+		const out = new Uint8Array(this.oHash.outputLen);
+		this.digestInto(out);
+		return out;
+	}
+	_cloneInto(to) {
+		to || (to = Object.create(Object.getPrototypeOf(this), {}));
+		const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+		to = to;
+		to.finished = finished;
+		to.destroyed = destroyed;
+		to.blockLen = blockLen;
+		to.outputLen = outputLen;
+		to.oHash = oHash._cloneInto(to.oHash);
+		to.iHash = iHash._cloneInto(to.iHash);
+		return to;
+	}
+	clone() {
+		return this._cloneInto();
+	}
+	destroy() {
+		this.destroyed = true;
+		this.oHash.destroy();
+		this.iHash.destroy();
+	}
+};
+/**
+* HMAC: RFC2104 message authentication code.
+* @param hash - function that would be used e.g. sha256
+* @param key - message key
+* @param message - message data
+* @example
+* import { hmac } from '@noble/hashes/hmac';
+* import { sha256 } from '@noble/hashes/sha2';
+* const mac1 = hmac(sha256, 'key', 'message');
+*/
+const hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();
+hmac.create = (hash, key) => new HMAC(hash, key);
+//#endregion
+//#region node_modules/.pnpm/@noble+curves@1.9.1/node_modules/@noble/curves/esm/abstract/modular.js
+/**
+* Utils for modular division and finite fields.
+* A finite field over 11 is integer number operations `mod 11`.
+* There is no division: it is replaced by modular multiplicative inverse.
+* @module
+*/
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+const _0n$3 = BigInt(0), _1n$3 = BigInt(1), _2n$2 = /* @__PURE__ */ BigInt(2), _3n$1 = /* @__PURE__ */ BigInt(3);
+const _4n$1 = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5), _8n = /* @__PURE__ */ BigInt(8);
+function mod(a, b) {
+	const result = a % b;
+	return result >= _0n$3 ? result : b + result;
+}
+/** Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)` */
+function pow2(x, power, modulo) {
+	let res = x;
+	while (power-- > _0n$3) {
+		res *= res;
+		res %= modulo;
+	}
+	return res;
+}
+/**
+* Inverses number over modulo.
+* Implemented using [Euclidean GCD](https://brilliant.org/wiki/extended-euclidean-algorithm/).
+*/
+function invert(number, modulo) {
+	if (number === _0n$3) throw new Error("invert: expected non-zero number");
+	if (modulo <= _0n$3) throw new Error("invert: expected positive modulus, got " + modulo);
+	let a = mod(number, modulo);
+	let b = modulo;
+	let x = _0n$3, y = _1n$3, u = _1n$3, v = _0n$3;
+	while (a !== _0n$3) {
+		const q = b / a;
+		const r = b % a;
+		const m = x - u * q;
+		const n = y - v * q;
+		b = a, a = r, x = u, y = v, u = m, v = n;
+	}
+	if (b !== _1n$3) throw new Error("invert: does not exist");
+	return mod(x, modulo);
+}
+function sqrt3mod4(Fp, n) {
+	const p1div4 = (Fp.ORDER + _1n$3) / _4n$1;
+	const root = Fp.pow(n, p1div4);
+	if (!Fp.eql(Fp.sqr(root), n)) throw new Error("Cannot find square root");
+	return root;
+}
+function sqrt5mod8(Fp, n) {
+	const p5div8 = (Fp.ORDER - _5n) / _8n;
+	const n2 = Fp.mul(n, _2n$2);
+	const v = Fp.pow(n2, p5div8);
+	const nv = Fp.mul(n, v);
+	const i = Fp.mul(Fp.mul(nv, _2n$2), v);
+	const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));
+	if (!Fp.eql(Fp.sqr(root), n)) throw new Error("Cannot find square root");
+	return root;
+}
+/**
+* Tonelli-Shanks square root search algorithm.
+* 1. https://eprint.iacr.org/2012/685.pdf (page 12)
+* 2. Square Roots from 1; 24, 51, 10 to Dan Shanks
+* @param P field order
+* @returns function that takes field Fp (created from P) and number n
+*/
+function tonelliShanks(P) {
+	if (P < BigInt(3)) throw new Error("sqrt is not defined for small field");
+	let Q = P - _1n$3;
+	let S = 0;
+	while (Q % _2n$2 === _0n$3) {
+		Q /= _2n$2;
+		S++;
+	}
+	let Z = _2n$2;
+	const _Fp = Field(P);
+	while (FpLegendre(_Fp, Z) === 1) if (Z++ > 1e3) throw new Error("Cannot find square root: probably non-prime P");
+	if (S === 1) return sqrt3mod4;
+	let cc = _Fp.pow(Z, Q);
+	const Q1div2 = (Q + _1n$3) / _2n$2;
+	return function tonelliSlow(Fp, n) {
+		if (Fp.is0(n)) return n;
+		if (FpLegendre(Fp, n) !== 1) throw new Error("Cannot find square root");
+		let M = S;
+		let c = Fp.mul(Fp.ONE, cc);
+		let t = Fp.pow(n, Q);
+		let R = Fp.pow(n, Q1div2);
+		while (!Fp.eql(t, Fp.ONE)) {
+			if (Fp.is0(t)) return Fp.ZERO;
+			let i = 1;
+			let t_tmp = Fp.sqr(t);
+			while (!Fp.eql(t_tmp, Fp.ONE)) {
+				i++;
+				t_tmp = Fp.sqr(t_tmp);
+				if (i === M) throw new Error("Cannot find square root");
+			}
+			const exponent = _1n$3 << BigInt(M - i - 1);
+			const b = Fp.pow(c, exponent);
+			M = i;
+			c = Fp.sqr(b);
+			t = Fp.mul(t, c);
+			R = Fp.mul(R, b);
+		}
+		return R;
+	};
+}
+/**
+* Square root for a finite field. Will try optimized versions first:
+*
+* 1. P ≡ 3 (mod 4)
+* 2. P ≡ 5 (mod 8)
+* 3. Tonelli-Shanks algorithm
+*
+* Different algorithms can give different roots, it is up to user to decide which one they want.
+* For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).
+*/
+function FpSqrt(P) {
+	if (P % _4n$1 === _3n$1) return sqrt3mod4;
+	if (P % _8n === _5n) return sqrt5mod8;
+	return tonelliShanks(P);
+}
+const FIELD_FIELDS = [
+	"create",
+	"isValid",
+	"is0",
+	"neg",
+	"inv",
+	"sqrt",
+	"sqr",
+	"eql",
+	"add",
+	"sub",
+	"mul",
+	"pow",
+	"div",
+	"addN",
+	"subN",
+	"mulN",
+	"sqrN"
+];
+function validateField(field) {
+	return validateObject(field, FIELD_FIELDS.reduce((map, val) => {
+		map[val] = "function";
+		return map;
+	}, {
+		ORDER: "bigint",
+		MASK: "bigint",
+		BYTES: "isSafeInteger",
+		BITS: "isSafeInteger"
+	}));
+}
+/**
+* Same as `pow` but for Fp: non-constant-time.
+* Unsafe in some contexts: uses ladder, so can expose bigint bits.
+*/
+function FpPow(Fp, num, power) {
+	if (power < _0n$3) throw new Error("invalid exponent, negatives unsupported");
+	if (power === _0n$3) return Fp.ONE;
+	if (power === _1n$3) return num;
+	let p = Fp.ONE;
+	let d = num;
+	while (power > _0n$3) {
+		if (power & _1n$3) p = Fp.mul(p, d);
+		d = Fp.sqr(d);
+		power >>= _1n$3;
+	}
+	return p;
+}
+/**
+* Efficiently invert an array of Field elements.
+* Exception-free. Will return `undefined` for 0 elements.
+* @param passZero map 0 to 0 (instead of undefined)
+*/
+function FpInvertBatch(Fp, nums, passZero = false) {
+	const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : void 0);
+	const multipliedAcc = nums.reduce((acc, num, i) => {
+		if (Fp.is0(num)) return acc;
+		inverted[i] = acc;
+		return Fp.mul(acc, num);
+	}, Fp.ONE);
+	const invertedAcc = Fp.inv(multipliedAcc);
+	nums.reduceRight((acc, num, i) => {
+		if (Fp.is0(num)) return acc;
+		inverted[i] = Fp.mul(acc, inverted[i]);
+		return Fp.mul(acc, num);
+	}, invertedAcc);
+	return inverted;
+}
+/**
+* Legendre symbol.
+* Legendre constant is used to calculate Legendre symbol (a | p)
+* which denotes the value of a^((p-1)/2) (mod p).
+*
+* * (a | p) ≡ 1    if a is a square (mod p), quadratic residue
+* * (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue
+* * (a | p) ≡ 0    if a ≡ 0 (mod p)
+*/
+function FpLegendre(Fp, n) {
+	const p1mod2 = (Fp.ORDER - _1n$3) / _2n$2;
+	const powered = Fp.pow(n, p1mod2);
+	const yes = Fp.eql(powered, Fp.ONE);
+	const zero = Fp.eql(powered, Fp.ZERO);
+	const no = Fp.eql(powered, Fp.neg(Fp.ONE));
+	if (!yes && !zero && !no) throw new Error("invalid Legendre symbol result");
+	return yes ? 1 : zero ? 0 : -1;
+}
+function nLength(n, nBitLength) {
+	if (nBitLength !== void 0) anumber(nBitLength);
+	const _nBitLength = nBitLength !== void 0 ? nBitLength : n.toString(2).length;
+	return {
+		nBitLength: _nBitLength,
+		nByteLength: Math.ceil(_nBitLength / 8)
+	};
+}
+/**
+* Initializes a finite field over prime.
+* Major performance optimizations:
+* * a) denormalized operations like mulN instead of mul
+* * b) same object shape: never add or remove keys
+* * c) Object.freeze
+* Fragile: always run a benchmark on a change.
+* Security note: operations don't check 'isValid' for all elements for performance reasons,
+* it is caller responsibility to check this.
+* This is low-level code, please make sure you know what you're doing.
+* @param ORDER prime positive bigint
+* @param bitLen how many bits the field consumes
+* @param isLE (def: false) if encoding / decoding should be in little-endian
+* @param redef optional faster redefinitions of sqrt and other methods
+*/
+function Field(ORDER, bitLen, isLE = false, redef = {}) {
+	if (ORDER <= _0n$3) throw new Error("invalid field: expected ORDER > 0, got " + ORDER);
+	const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, bitLen);
+	if (BYTES > 2048) throw new Error("invalid field: expected ORDER of <= 2048 bytes");
+	let sqrtP;
+	const f = Object.freeze({
+		ORDER,
+		isLE,
+		BITS,
+		BYTES,
+		MASK: bitMask(BITS),
+		ZERO: _0n$3,
+		ONE: _1n$3,
+		create: (num) => mod(num, ORDER),
+		isValid: (num) => {
+			if (typeof num !== "bigint") throw new Error("invalid field element: expected bigint, got " + typeof num);
+			return _0n$3 <= num && num < ORDER;
+		},
+		is0: (num) => num === _0n$3,
+		isOdd: (num) => (num & _1n$3) === _1n$3,
+		neg: (num) => mod(-num, ORDER),
+		eql: (lhs, rhs) => lhs === rhs,
+		sqr: (num) => mod(num * num, ORDER),
+		add: (lhs, rhs) => mod(lhs + rhs, ORDER),
+		sub: (lhs, rhs) => mod(lhs - rhs, ORDER),
+		mul: (lhs, rhs) => mod(lhs * rhs, ORDER),
+		pow: (num, power) => FpPow(f, num, power),
+		div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),
+		sqrN: (num) => num * num,
+		addN: (lhs, rhs) => lhs + rhs,
+		subN: (lhs, rhs) => lhs - rhs,
+		mulN: (lhs, rhs) => lhs * rhs,
+		inv: (num) => invert(num, ORDER),
+		sqrt: redef.sqrt || ((n) => {
+			if (!sqrtP) sqrtP = FpSqrt(ORDER);
+			return sqrtP(f, n);
+		}),
+		toBytes: (num) => isLE ? numberToBytesLE(num, BYTES) : numberToBytesBE(num, BYTES),
+		fromBytes: (bytes) => {
+			if (bytes.length !== BYTES) throw new Error("Field.fromBytes: expected " + BYTES + " bytes, got " + bytes.length);
+			return isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);
+		},
+		invertBatch: (lst) => FpInvertBatch(f, lst),
+		cmov: (a, b, c) => c ? b : a
+	});
+	return Object.freeze(f);
+}
+/**
+* Returns total number of bytes consumed by the field element.
+* For example, 32 bytes for usual 256-bit weierstrass curve.
+* @param fieldOrder number of field elements, usually CURVE.n
+* @returns byte length of field
+*/
+function getFieldBytesLength(fieldOrder) {
+	if (typeof fieldOrder !== "bigint") throw new Error("field order must be bigint");
+	const bitLength = fieldOrder.toString(2).length;
+	return Math.ceil(bitLength / 8);
+}
+/**
+* Returns minimal amount of bytes that can be safely reduced
+* by field order.
+* Should be 2^-128 for 128-bit curve such as P256.
+* @param fieldOrder number of field elements, usually CURVE.n
+* @returns byte length of target hash
+*/
+function getMinHashLength(fieldOrder) {
+	const length = getFieldBytesLength(fieldOrder);
+	return length + Math.ceil(length / 2);
+}
+/**
+* "Constant-time" private key generation utility.
+* Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF
+* and convert them into private scalar, with the modulo bias being negligible.
+* Needs at least 48 bytes of input for 32-byte private key.
+* https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/
+* FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final
+* RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5
+* @param hash hash output from SHA3 or a similar function
+* @param groupOrder size of subgroup - (e.g. secp256k1.CURVE.n)
+* @param isLE interpret hash bytes as LE num
+* @returns valid private scalar
+*/
+function mapHashToField(key, fieldOrder, isLE = false) {
+	const len = key.length;
+	const fieldLen = getFieldBytesLength(fieldOrder);
+	const minLen = getMinHashLength(fieldOrder);
+	if (len < 16 || len < minLen || len > 1024) throw new Error("expected " + minLen + "-1024 bytes of input, got " + len);
+	const reduced = mod(isLE ? bytesToNumberLE(key) : bytesToNumberBE(key), fieldOrder - _1n$3) + _1n$3;
+	return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
+}
+//#endregion
+//#region node_modules/.pnpm/@noble+curves@1.9.1/node_modules/@noble/curves/esm/abstract/curve.js
+/**
+* Methods for elliptic curve multiplication by scalars.
+* Contains wNAF, pippenger
+* @module
+*/
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+const _0n$2 = BigInt(0);
+const _1n$2 = BigInt(1);
+function constTimeNegate(condition, item) {
+	const neg = item.negate();
+	return condition ? neg : item;
+}
+function validateW(W, bits) {
+	if (!Number.isSafeInteger(W) || W <= 0 || W > bits) throw new Error("invalid window size, expected [1.." + bits + "], got W=" + W);
+}
+function calcWOpts(W, scalarBits) {
+	validateW(W, scalarBits);
+	const windows = Math.ceil(scalarBits / W) + 1;
+	const windowSize = 2 ** (W - 1);
+	const maxNumber = 2 ** W;
+	return {
+		windows,
+		windowSize,
+		mask: bitMask(W),
+		maxNumber,
+		shiftBy: BigInt(W)
+	};
+}
+function calcOffsets(n, window, wOpts) {
+	const { windowSize, mask, maxNumber, shiftBy } = wOpts;
+	let wbits = Number(n & mask);
+	let nextN = n >> shiftBy;
+	if (wbits > windowSize) {
+		wbits -= maxNumber;
+		nextN += _1n$2;
+	}
+	const offsetStart = window * windowSize;
+	const offset = offsetStart + Math.abs(wbits) - 1;
+	const isZero = wbits === 0;
+	const isNeg = wbits < 0;
+	const isNegF = window % 2 !== 0;
+	return {
+		nextN,
+		offset,
+		isZero,
+		isNeg,
+		isNegF,
+		offsetF: offsetStart
+	};
+}
+function validateMSMPoints(points, c) {
+	if (!Array.isArray(points)) throw new Error("array expected");
+	points.forEach((p, i) => {
+		if (!(p instanceof c)) throw new Error("invalid point at index " + i);
+	});
+}
+function validateMSMScalars(scalars, field) {
+	if (!Array.isArray(scalars)) throw new Error("array of scalars expected");
+	scalars.forEach((s, i) => {
+		if (!field.isValid(s)) throw new Error("invalid scalar at index " + i);
+	});
+}
+const pointPrecomputes = /* @__PURE__ */ new WeakMap();
+const pointWindowSizes = /* @__PURE__ */ new WeakMap();
+function getW(P) {
+	return pointWindowSizes.get(P) || 1;
+}
+/**
+* Elliptic curve multiplication of Point by scalar. Fragile.
+* Scalars should always be less than curve order: this should be checked inside of a curve itself.
+* Creates precomputation tables for fast multiplication:
+* - private scalar is split by fixed size windows of W bits
+* - every window point is collected from window's table & added to accumulator
+* - since windows are different, same point inside tables won't be accessed more than once per calc
+* - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)
+* - +1 window is neccessary for wNAF
+* - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication
+*
+* @todo Research returning 2d JS array of windows, instead of a single window.
+* This would allow windows to be in different memory locations
+*/
+function wNAF(c, bits) {
+	return {
+		constTimeNegate,
+		hasPrecomputes(elm) {
+			return getW(elm) !== 1;
+		},
+		unsafeLadder(elm, n, p = c.ZERO) {
+			let d = elm;
+			while (n > _0n$2) {
+				if (n & _1n$2) p = p.add(d);
+				d = d.double();
+				n >>= _1n$2;
+			}
+			return p;
+		},
+		precomputeWindow(elm, W) {
+			const { windows, windowSize } = calcWOpts(W, bits);
+			const points = [];
+			let p = elm;
+			let base = p;
+			for (let window = 0; window < windows; window++) {
+				base = p;
+				points.push(base);
+				for (let i = 1; i < windowSize; i++) {
+					base = base.add(p);
+					points.push(base);
+				}
+				p = base.double();
+			}
+			return points;
+		},
+		wNAF(W, precomputes, n) {
+			let p = c.ZERO;
+			let f = c.BASE;
+			const wo = calcWOpts(W, bits);
+			for (let window = 0; window < wo.windows; window++) {
+				const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);
+				n = nextN;
+				if (isZero) f = f.add(constTimeNegate(isNegF, precomputes[offsetF]));
+				else p = p.add(constTimeNegate(isNeg, precomputes[offset]));
+			}
+			return {
+				p,
+				f
+			};
+		},
+		wNAFUnsafe(W, precomputes, n, acc = c.ZERO) {
+			const wo = calcWOpts(W, bits);
+			for (let window = 0; window < wo.windows; window++) {
+				if (n === _0n$2) break;
+				const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);
+				n = nextN;
+				if (isZero) continue;
+				else {
+					const item = precomputes[offset];
+					acc = acc.add(isNeg ? item.negate() : item);
+				}
+			}
+			return acc;
+		},
+		getPrecomputes(W, P, transform) {
+			let comp = pointPrecomputes.get(P);
+			if (!comp) {
+				comp = this.precomputeWindow(P, W);
+				if (W !== 1) pointPrecomputes.set(P, transform(comp));
+			}
+			return comp;
+		},
+		wNAFCached(P, n, transform) {
+			const W = getW(P);
+			return this.wNAF(W, this.getPrecomputes(W, P, transform), n);
+		},
+		wNAFCachedUnsafe(P, n, transform, prev) {
+			const W = getW(P);
+			if (W === 1) return this.unsafeLadder(P, n, prev);
+			return this.wNAFUnsafe(W, this.getPrecomputes(W, P, transform), n, prev);
+		},
+		setWindowSize(P, W) {
+			validateW(W, bits);
+			pointWindowSizes.set(P, W);
+			pointPrecomputes.delete(P);
+		}
+	};
+}
+/**
+* Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).
+* 30x faster vs naive addition on L=4096, 10x faster than precomputes.
+* For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.
+* Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.
+* @param c Curve Point constructor
+* @param fieldN field over CURVE.N - important that it's not over CURVE.P
+* @param points array of L curve points
+* @param scalars array of L scalars (aka private keys / bigints)
+*/
+function pippenger(c, fieldN, points, scalars) {
+	validateMSMPoints(points, c);
+	validateMSMScalars(scalars, fieldN);
+	const plength = points.length;
+	const slength = scalars.length;
+	if (plength !== slength) throw new Error("arrays of points and scalars must have equal length");
+	const zero = c.ZERO;
+	const wbits = bitLen(BigInt(plength));
+	let windowSize = 1;
+	if (wbits > 12) windowSize = wbits - 3;
+	else if (wbits > 4) windowSize = wbits - 2;
+	else if (wbits > 0) windowSize = 2;
+	const MASK = bitMask(windowSize);
+	const buckets = new Array(Number(MASK) + 1).fill(zero);
+	const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;
+	let sum = zero;
+	for (let i = lastBits; i >= 0; i -= windowSize) {
+		buckets.fill(zero);
+		for (let j = 0; j < slength; j++) {
+			const scalar = scalars[j];
+			const wbits = Number(scalar >> BigInt(i) & MASK);
+			buckets[wbits] = buckets[wbits].add(points[j]);
+		}
+		let resI = zero;
+		for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {
+			sumI = sumI.add(buckets[j]);
+			resI = resI.add(sumI);
+		}
+		sum = sum.add(resI);
+		if (i !== 0) for (let j = 0; j < windowSize; j++) sum = sum.double();
+	}
+	return sum;
+}
+function validateBasic(curve) {
+	validateField(curve.Fp);
+	validateObject(curve, {
+		n: "bigint",
+		h: "bigint",
+		Gx: "field",
+		Gy: "field"
+	}, {
+		nBitLength: "isSafeInteger",
+		nByteLength: "isSafeInteger"
+	});
+	return Object.freeze({
+		...nLength(curve.n, curve.nBitLength),
+		...curve,
+		p: curve.Fp.ORDER
+	});
+}
+//#endregion
+//#region node_modules/.pnpm/@noble+curves@1.9.1/node_modules/@noble/curves/esm/abstract/weierstrass.js
+/**
+* Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.
+*
+* ### Parameters
+*
+* To initialize a weierstrass curve, one needs to pass following params:
+*
+* * a: formula param
+* * b: formula param
+* * Fp: finite field of prime characteristic P; may be complex (Fp2). Arithmetics is done in field
+* * n: order of prime subgroup a.k.a total amount of valid curve points
+* * Gx: Base point (x, y) aka generator point. Gx = x coordinate
+* * Gy: ...y coordinate
+* * h: cofactor, usually 1. h*n = curve group order (n is only subgroup order)
+* * lowS: whether to enable (default) or disable "low-s" non-malleable signatures
+*
+* ### Design rationale for types
+*
+* * Interaction between classes from different curves should fail:
+*   `k256.Point.BASE.add(p256.Point.BASE)`
+* * For this purpose we want to use `instanceof` operator, which is fast and works during runtime
+* * Different calls of `curve()` would return different classes -
+*   `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,
+*   it won't affect others
+*
+* TypeScript can't infer types for classes created inside a function. Classes is one instance
+* of nominative types in TypeScript and interfaces only check for shape, so it's hard to create
+* unique type for every function call.
+*
+* We can use generic types via some param, like curve opts, but that would:
+*     1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)
+*     which is hard to debug.
+*     2. Params can be generic and we can't enforce them to be constant value:
+*     if somebody creates curve from non-constant params,
+*     it would be allowed to interact with other curves with non-constant params
+*
+* @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol
+* @module
+*/
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+function validateSigVerOpts(opts) {
+	if (opts.lowS !== void 0) abool("lowS", opts.lowS);
+	if (opts.prehash !== void 0) abool("prehash", opts.prehash);
+}
+function validatePointOpts(curve) {
+	const opts = validateBasic(curve);
+	validateObject(opts, {
+		a: "field",
+		b: "field"
+	}, {
+		allowInfinityPoint: "boolean",
+		allowedPrivateKeyLengths: "array",
+		clearCofactor: "function",
+		fromBytes: "function",
+		isTorsionFree: "function",
+		toBytes: "function",
+		wrapPrivateKey: "boolean"
+	});
+	const { endo, Fp, a } = opts;
+	if (endo) {
+		if (!Fp.eql(a, Fp.ZERO)) throw new Error("invalid endo: CURVE.a must be 0");
+		if (typeof endo !== "object" || typeof endo.beta !== "bigint" || typeof endo.splitScalar !== "function") throw new Error("invalid endo: expected \"beta\": bigint and \"splitScalar\": function");
+	}
+	return Object.freeze({ ...opts });
+}
+var DERErr = class extends Error {
+	constructor(m = "") {
+		super(m);
+	}
+};
+/**
+* ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:
+*
+*     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]
+*
+* Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html
+*/
+const DER = {
+	Err: DERErr,
+	_tlv: {
+		encode: (tag, data) => {
+			const { Err: E } = DER;
+			if (tag < 0 || tag > 256) throw new E("tlv.encode: wrong tag");
+			if (data.length & 1) throw new E("tlv.encode: unpadded data");
+			const dataLen = data.length / 2;
+			const len = numberToHexUnpadded(dataLen);
+			if (len.length / 2 & 128) throw new E("tlv.encode: long form length too big");
+			const lenLen = dataLen > 127 ? numberToHexUnpadded(len.length / 2 | 128) : "";
+			return numberToHexUnpadded(tag) + lenLen + len + data;
+		},
+		decode(tag, data) {
+			const { Err: E } = DER;
+			let pos = 0;
+			if (tag < 0 || tag > 256) throw new E("tlv.encode: wrong tag");
+			if (data.length < 2 || data[pos++] !== tag) throw new E("tlv.decode: wrong tlv");
+			const first = data[pos++];
+			const isLong = !!(first & 128);
+			let length = 0;
+			if (!isLong) length = first;
+			else {
+				const lenLen = first & 127;
+				if (!lenLen) throw new E("tlv.decode(long): indefinite length not supported");
+				if (lenLen > 4) throw new E("tlv.decode(long): byte length is too big");
+				const lengthBytes = data.subarray(pos, pos + lenLen);
+				if (lengthBytes.length !== lenLen) throw new E("tlv.decode: length bytes not complete");
+				if (lengthBytes[0] === 0) throw new E("tlv.decode(long): zero leftmost byte");
+				for (const b of lengthBytes) length = length << 8 | b;
+				pos += lenLen;
+				if (length < 128) throw new E("tlv.decode(long): not minimal encoding");
+			}
+			const v = data.subarray(pos, pos + length);
+			if (v.length !== length) throw new E("tlv.decode: wrong value length");
+			return {
+				v,
+				l: data.subarray(pos + length)
+			};
+		}
+	},
+	_int: {
+		encode(num) {
+			const { Err: E } = DER;
+			if (num < _0n$1) throw new E("integer: negative integers are not allowed");
+			let hex = numberToHexUnpadded(num);
+			if (Number.parseInt(hex[0], 16) & 8) hex = "00" + hex;
+			if (hex.length & 1) throw new E("unexpected DER parsing assertion: unpadded hex");
+			return hex;
+		},
+		decode(data) {
+			const { Err: E } = DER;
+			if (data[0] & 128) throw new E("invalid signature integer: negative");
+			if (data[0] === 0 && !(data[1] & 128)) throw new E("invalid signature integer: unnecessary leading zero");
+			return bytesToNumberBE(data);
+		}
+	},
+	toSig(hex) {
+		const { Err: E, _int: int, _tlv: tlv } = DER;
+		const data = ensureBytes("signature", hex);
+		const { v: seqBytes, l: seqLeftBytes } = tlv.decode(48, data);
+		if (seqLeftBytes.length) throw new E("invalid signature: left bytes after parsing");
+		const { v: rBytes, l: rLeftBytes } = tlv.decode(2, seqBytes);
+		const { v: sBytes, l: sLeftBytes } = tlv.decode(2, rLeftBytes);
+		if (sLeftBytes.length) throw new E("invalid signature: left bytes after parsing");
+		return {
+			r: int.decode(rBytes),
+			s: int.decode(sBytes)
+		};
+	},
+	hexFromSig(sig) {
+		const { _tlv: tlv, _int: int } = DER;
+		const seq = tlv.encode(2, int.encode(sig.r)) + tlv.encode(2, int.encode(sig.s));
+		return tlv.encode(48, seq);
+	}
+};
+function numToSizedHex(num, size) {
+	return bytesToHex(numberToBytesBE(num, size));
+}
+const _0n$1 = BigInt(0), _1n$1 = BigInt(1), _2n$1 = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);
+function weierstrassPoints(opts) {
+	const CURVE = validatePointOpts(opts);
+	const { Fp } = CURVE;
+	const Fn = Field(CURVE.n, CURVE.nBitLength);
+	const toBytes = CURVE.toBytes || ((_c, point, _isCompressed) => {
+		const a = point.toAffine();
+		return concatBytes(Uint8Array.from([4]), Fp.toBytes(a.x), Fp.toBytes(a.y));
+	});
+	const fromBytes = CURVE.fromBytes || ((bytes) => {
+		const tail = bytes.subarray(1);
+		return {
+			x: Fp.fromBytes(tail.subarray(0, Fp.BYTES)),
+			y: Fp.fromBytes(tail.subarray(Fp.BYTES, 2 * Fp.BYTES))
+		};
+	});
+	/**
+	* y² = x³ + ax + b: Short weierstrass curve formula. Takes x, returns y².
+	* @returns y²
+	*/
+	function weierstrassEquation(x) {
+		const { a, b } = CURVE;
+		const x2 = Fp.sqr(x);
+		const x3 = Fp.mul(x2, x);
+		return Fp.add(Fp.add(x3, Fp.mul(x, a)), b);
+	}
+	function isValidXY(x, y) {
+		const left = Fp.sqr(y);
+		const right = weierstrassEquation(x);
+		return Fp.eql(left, right);
+	}
+	if (!isValidXY(CURVE.Gx, CURVE.Gy)) throw new Error("bad curve params: generator point");
+	const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);
+	const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));
+	if (Fp.is0(Fp.add(_4a3, _27b2))) throw new Error("bad curve params: a or b");
+	function isWithinCurveOrder(num) {
+		return inRange(num, _1n$1, CURVE.n);
+	}
+	function normPrivateKeyToScalar(key) {
+		const { allowedPrivateKeyLengths: lengths, nByteLength, wrapPrivateKey, n: N } = CURVE;
+		if (lengths && typeof key !== "bigint") {
+			if (isBytes(key)) key = bytesToHex(key);
+			if (typeof key !== "string" || !lengths.includes(key.length)) throw new Error("invalid private key");
+			key = key.padStart(nByteLength * 2, "0");
+		}
+		let num;
+		try {
+			num = typeof key === "bigint" ? key : bytesToNumberBE(ensureBytes("private key", key, nByteLength));
+		} catch (error) {
+			throw new Error("invalid private key, expected hex or " + nByteLength + " bytes, got " + typeof key);
+		}
+		if (wrapPrivateKey) num = mod(num, N);
+		aInRange("private key", num, _1n$1, N);
+		return num;
+	}
+	function aprjpoint(other) {
+		if (!(other instanceof Point)) throw new Error("ProjectivePoint expected");
+	}
+	const toAffineMemo = memoized((p, iz) => {
+		const { px: x, py: y, pz: z } = p;
+		if (Fp.eql(z, Fp.ONE)) return {
+			x,
+			y
+		};
+		const is0 = p.is0();
+		if (iz == null) iz = is0 ? Fp.ONE : Fp.inv(z);
+		const ax = Fp.mul(x, iz);
+		const ay = Fp.mul(y, iz);
+		const zz = Fp.mul(z, iz);
+		if (is0) return {
+			x: Fp.ZERO,
+			y: Fp.ZERO
+		};
+		if (!Fp.eql(zz, Fp.ONE)) throw new Error("invZ was invalid");
+		return {
+			x: ax,
+			y: ay
+		};
+	});
+	const assertValidMemo = memoized((p) => {
+		if (p.is0()) {
+			if (CURVE.allowInfinityPoint && !Fp.is0(p.py)) return;
+			throw new Error("bad point: ZERO");
+		}
+		const { x, y } = p.toAffine();
+		if (!Fp.isValid(x) || !Fp.isValid(y)) throw new Error("bad point: x or y not FE");
+		if (!isValidXY(x, y)) throw new Error("bad point: equation left != right");
+		if (!p.isTorsionFree()) throw new Error("bad point: not in prime-order subgroup");
+		return true;
+	});
+	/**
+	* Projective Point works in 3d / projective (homogeneous) coordinates: (X, Y, Z) ∋ (x=X/Z, y=Y/Z)
+	* Default Point works in 2d / affine coordinates: (x, y)
+	* We're doing calculations in projective, because its operations don't require costly inversion.
+	*/
+	class Point {
+		constructor(px, py, pz) {
+			if (px == null || !Fp.isValid(px)) throw new Error("x required");
+			if (py == null || !Fp.isValid(py) || Fp.is0(py)) throw new Error("y required");
+			if (pz == null || !Fp.isValid(pz)) throw new Error("z required");
+			this.px = px;
+			this.py = py;
+			this.pz = pz;
+			Object.freeze(this);
+		}
+		static fromAffine(p) {
+			const { x, y } = p || {};
+			if (!p || !Fp.isValid(x) || !Fp.isValid(y)) throw new Error("invalid affine point");
+			if (p instanceof Point) throw new Error("projective point not allowed");
+			const is0 = (i) => Fp.eql(i, Fp.ZERO);
+			if (is0(x) && is0(y)) return Point.ZERO;
+			return new Point(x, y, Fp.ONE);
+		}
+		get x() {
+			return this.toAffine().x;
+		}
+		get y() {
+			return this.toAffine().y;
+		}
+		/**
+		* Takes a bunch of Projective Points but executes only one
+		* inversion on all of them. Inversion is very slow operation,
+		* so this improves performance massively.
+		* Optimization: converts a list of projective points to a list of identical points with Z=1.
+		*/
+		static normalizeZ(points) {
+			const toInv = FpInvertBatch(Fp, points.map((p) => p.pz));
+			return points.map((p, i) => p.toAffine(toInv[i])).map(Point.fromAffine);
+		}
+		/**
+		* Converts hash string or Uint8Array to Point.
+		* @param hex short/long ECDSA hex
+		*/
+		static fromHex(hex) {
+			const P = Point.fromAffine(fromBytes(ensureBytes("pointHex", hex)));
+			P.assertValidity();
+			return P;
+		}
+		static fromPrivateKey(privateKey) {
+			return Point.BASE.multiply(normPrivateKeyToScalar(privateKey));
+		}
+		static msm(points, scalars) {
+			return pippenger(Point, Fn, points, scalars);
+		}
+		_setWindowSize(windowSize) {
+			wnaf.setWindowSize(this, windowSize);
+		}
+		assertValidity() {
+			assertValidMemo(this);
+		}
+		hasEvenY() {
+			const { y } = this.toAffine();
+			if (Fp.isOdd) return !Fp.isOdd(y);
+			throw new Error("Field doesn't support isOdd");
+		}
+		/**
+		* Compare one point to another.
+		*/
+		equals(other) {
+			aprjpoint(other);
+			const { px: X1, py: Y1, pz: Z1 } = this;
+			const { px: X2, py: Y2, pz: Z2 } = other;
+			const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));
+			const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));
+			return U1 && U2;
+		}
+		/**
+		* Flips point to one corresponding to (x, -y) in Affine coordinates.
+		*/
+		negate() {
+			return new Point(this.px, Fp.neg(this.py), this.pz);
+		}
+		double() {
+			const { a, b } = CURVE;
+			const b3 = Fp.mul(b, _3n);
+			const { px: X1, py: Y1, pz: Z1 } = this;
+			let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO;
+			let t0 = Fp.mul(X1, X1);
+			let t1 = Fp.mul(Y1, Y1);
+			let t2 = Fp.mul(Z1, Z1);
+			let t3 = Fp.mul(X1, Y1);
+			t3 = Fp.add(t3, t3);
+			Z3 = Fp.mul(X1, Z1);
+			Z3 = Fp.add(Z3, Z3);
+			X3 = Fp.mul(a, Z3);
+			Y3 = Fp.mul(b3, t2);
+			Y3 = Fp.add(X3, Y3);
+			X3 = Fp.sub(t1, Y3);
+			Y3 = Fp.add(t1, Y3);
+			Y3 = Fp.mul(X3, Y3);
+			X3 = Fp.mul(t3, X3);
+			Z3 = Fp.mul(b3, Z3);
+			t2 = Fp.mul(a, t2);
+			t3 = Fp.sub(t0, t2);
+			t3 = Fp.mul(a, t3);
+			t3 = Fp.add(t3, Z3);
+			Z3 = Fp.add(t0, t0);
+			t0 = Fp.add(Z3, t0);
+			t0 = Fp.add(t0, t2);
+			t0 = Fp.mul(t0, t3);
+			Y3 = Fp.add(Y3, t0);
+			t2 = Fp.mul(Y1, Z1);
+			t2 = Fp.add(t2, t2);
+			t0 = Fp.mul(t2, t3);
+			X3 = Fp.sub(X3, t0);
+			Z3 = Fp.mul(t2, t1);
+			Z3 = Fp.add(Z3, Z3);
+			Z3 = Fp.add(Z3, Z3);
+			return new Point(X3, Y3, Z3);
+		}
+		add(other) {
+			aprjpoint(other);
+			const { px: X1, py: Y1, pz: Z1 } = this;
+			const { px: X2, py: Y2, pz: Z2 } = other;
+			let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO;
+			const a = CURVE.a;
+			const b3 = Fp.mul(CURVE.b, _3n);
+			let t0 = Fp.mul(X1, X2);
+			let t1 = Fp.mul(Y1, Y2);
+			let t2 = Fp.mul(Z1, Z2);
+			let t3 = Fp.add(X1, Y1);
+			let t4 = Fp.add(X2, Y2);
+			t3 = Fp.mul(t3, t4);
+			t4 = Fp.add(t0, t1);
+			t3 = Fp.sub(t3, t4);
+			t4 = Fp.add(X1, Z1);
+			let t5 = Fp.add(X2, Z2);
+			t4 = Fp.mul(t4, t5);
+			t5 = Fp.add(t0, t2);
+			t4 = Fp.sub(t4, t5);
+			t5 = Fp.add(Y1, Z1);
+			X3 = Fp.add(Y2, Z2);
+			t5 = Fp.mul(t5, X3);
+			X3 = Fp.add(t1, t2);
+			t5 = Fp.sub(t5, X3);
+			Z3 = Fp.mul(a, t4);
+			X3 = Fp.mul(b3, t2);
+			Z3 = Fp.add(X3, Z3);
+			X3 = Fp.sub(t1, Z3);
+			Z3 = Fp.add(t1, Z3);
+			Y3 = Fp.mul(X3, Z3);
+			t1 = Fp.add(t0, t0);
+			t1 = Fp.add(t1, t0);
+			t2 = Fp.mul(a, t2);
+			t4 = Fp.mul(b3, t4);
+			t1 = Fp.add(t1, t2);
+			t2 = Fp.sub(t0, t2);
+			t2 = Fp.mul(a, t2);
+			t4 = Fp.add(t4, t2);
+			t0 = Fp.mul(t1, t4);
+			Y3 = Fp.add(Y3, t0);
+			t0 = Fp.mul(t5, t4);
+			X3 = Fp.mul(t3, X3);
+			X3 = Fp.sub(X3, t0);
+			t0 = Fp.mul(t3, t1);
+			Z3 = Fp.mul(t5, Z3);
+			Z3 = Fp.add(Z3, t0);
+			return new Point(X3, Y3, Z3);
+		}
+		subtract(other) {
+			return this.add(other.negate());
+		}
+		is0() {
+			return this.equals(Point.ZERO);
+		}
+		wNAF(n) {
+			return wnaf.wNAFCached(this, n, Point.normalizeZ);
+		}
+		/**
+		* Non-constant-time multiplication. Uses double-and-add algorithm.
+		* It's faster, but should only be used when you don't care about
+		* an exposed private key e.g. sig verification, which works over *public* keys.
+		*/
+		multiplyUnsafe(sc) {
+			const { endo, n: N } = CURVE;
+			aInRange("scalar", sc, _0n$1, N);
+			const I = Point.ZERO;
+			if (sc === _0n$1) return I;
+			if (this.is0() || sc === _1n$1) return this;
+			if (!endo || wnaf.hasPrecomputes(this)) return wnaf.wNAFCachedUnsafe(this, sc, Point.normalizeZ);
+			/** See docs for {@link EndomorphismOpts} */
+			let { k1neg, k1, k2neg, k2 } = endo.splitScalar(sc);
+			let k1p = I;
+			let k2p = I;
+			let d = this;
+			while (k1 > _0n$1 || k2 > _0n$1) {
+				if (k1 & _1n$1) k1p = k1p.add(d);
+				if (k2 & _1n$1) k2p = k2p.add(d);
+				d = d.double();
+				k1 >>= _1n$1;
+				k2 >>= _1n$1;
+			}
+			if (k1neg) k1p = k1p.negate();
+			if (k2neg) k2p = k2p.negate();
+			k2p = new Point(Fp.mul(k2p.px, endo.beta), k2p.py, k2p.pz);
+			return k1p.add(k2p);
+		}
+		/**
+		* Constant time multiplication.
+		* Uses wNAF method. Windowed method may be 10% faster,
+		* but takes 2x longer to generate and consumes 2x memory.
+		* Uses precomputes when available.
+		* Uses endomorphism for Koblitz curves.
+		* @param scalar by which the point would be multiplied
+		* @returns New point
+		*/
+		multiply(scalar) {
+			const { endo, n: N } = CURVE;
+			aInRange("scalar", scalar, _1n$1, N);
+			let point, fake;
+			/** See docs for {@link EndomorphismOpts} */
+			if (endo) {
+				const { k1neg, k1, k2neg, k2 } = endo.splitScalar(scalar);
+				let { p: k1p, f: f1p } = this.wNAF(k1);
+				let { p: k2p, f: f2p } = this.wNAF(k2);
+				k1p = wnaf.constTimeNegate(k1neg, k1p);
+				k2p = wnaf.constTimeNegate(k2neg, k2p);
+				k2p = new Point(Fp.mul(k2p.px, endo.beta), k2p.py, k2p.pz);
+				point = k1p.add(k2p);
+				fake = f1p.add(f2p);
+			} else {
+				const { p, f } = this.wNAF(scalar);
+				point = p;
+				fake = f;
+			}
+			return Point.normalizeZ([point, fake])[0];
+		}
+		/**
+		* Efficiently calculate `aP + bQ`. Unsafe, can expose private key, if used incorrectly.
+		* Not using Strauss-Shamir trick: precomputation tables are faster.
+		* The trick could be useful if both P and Q are not G (not in our case).
+		* @returns non-zero affine point
+		*/
+		multiplyAndAddUnsafe(Q, a, b) {
+			const G = Point.BASE;
+			const mul = (P, a) => a === _0n$1 || a === _1n$1 || !P.equals(G) ? P.multiplyUnsafe(a) : P.multiply(a);
+			const sum = mul(this, a).add(mul(Q, b));
+			return sum.is0() ? void 0 : sum;
+		}
+		toAffine(iz) {
+			return toAffineMemo(this, iz);
+		}
+		isTorsionFree() {
+			const { h: cofactor, isTorsionFree } = CURVE;
+			if (cofactor === _1n$1) return true;
+			if (isTorsionFree) return isTorsionFree(Point, this);
+			throw new Error("isTorsionFree() has not been declared for the elliptic curve");
+		}
+		clearCofactor() {
+			const { h: cofactor, clearCofactor } = CURVE;
+			if (cofactor === _1n$1) return this;
+			if (clearCofactor) return clearCofactor(Point, this);
+			return this.multiplyUnsafe(CURVE.h);
+		}
+		toRawBytes(isCompressed = true) {
+			abool("isCompressed", isCompressed);
+			this.assertValidity();
+			return toBytes(Point, this, isCompressed);
+		}
+		toHex(isCompressed = true) {
+			abool("isCompressed", isCompressed);
+			return bytesToHex(this.toRawBytes(isCompressed));
+		}
+	}
+	Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);
+	Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO);
+	const { endo, nBitLength } = CURVE;
+	const wnaf = wNAF(Point, endo ? Math.ceil(nBitLength / 2) : nBitLength);
+	return {
+		CURVE,
+		ProjectivePoint: Point,
+		normPrivateKeyToScalar,
+		weierstrassEquation,
+		isWithinCurveOrder
+	};
+}
+function validateOpts(curve) {
+	const opts = validateBasic(curve);
+	validateObject(opts, {
+		hash: "hash",
+		hmac: "function",
+		randomBytes: "function"
+	}, {
+		bits2int: "function",
+		bits2int_modN: "function",
+		lowS: "boolean"
+	});
+	return Object.freeze({
+		lowS: true,
+		...opts
+	});
+}
+/**
+* Creates short weierstrass curve and ECDSA signature methods for it.
+* @example
+* import { Field } from '@noble/curves/abstract/modular';
+* // Before that, define BigInt-s: a, b, p, n, Gx, Gy
+* const curve = weierstrass({ a, b, Fp: Field(p), n, Gx, Gy, h: 1n })
+*/
+function weierstrass(curveDef) {
+	const CURVE = validateOpts(curveDef);
+	const { Fp, n: CURVE_ORDER, nByteLength, nBitLength } = CURVE;
+	const compressedLen = Fp.BYTES + 1;
+	const uncompressedLen = 2 * Fp.BYTES + 1;
+	function modN(a) {
+		return mod(a, CURVE_ORDER);
+	}
+	function invN(a) {
+		return invert(a, CURVE_ORDER);
+	}
+	const { ProjectivePoint: Point, normPrivateKeyToScalar, weierstrassEquation, isWithinCurveOrder } = weierstrassPoints({
+		...CURVE,
+		toBytes(_c, point, isCompressed) {
+			const a = point.toAffine();
+			const x = Fp.toBytes(a.x);
+			const cat = concatBytes;
+			abool("isCompressed", isCompressed);
+			if (isCompressed) return cat(Uint8Array.from([point.hasEvenY() ? 2 : 3]), x);
+			else return cat(Uint8Array.from([4]), x, Fp.toBytes(a.y));
+		},
+		fromBytes(bytes) {
+			const len = bytes.length;
+			const head = bytes[0];
+			const tail = bytes.subarray(1);
+			if (len === compressedLen && (head === 2 || head === 3)) {
+				const x = bytesToNumberBE(tail);
+				if (!inRange(x, _1n$1, Fp.ORDER)) throw new Error("Point is not on curve");
+				const y2 = weierstrassEquation(x);
+				let y;
+				try {
+					y = Fp.sqrt(y2);
+				} catch (sqrtError) {
+					const suffix = sqrtError instanceof Error ? ": " + sqrtError.message : "";
+					throw new Error("Point is not on curve" + suffix);
+				}
+				const isYOdd = (y & _1n$1) === _1n$1;
+				if ((head & 1) === 1 !== isYOdd) y = Fp.neg(y);
+				return {
+					x,
+					y
+				};
+			} else if (len === uncompressedLen && head === 4) return {
+				x: Fp.fromBytes(tail.subarray(0, Fp.BYTES)),
+				y: Fp.fromBytes(tail.subarray(Fp.BYTES, 2 * Fp.BYTES))
+			};
+			else {
+				const cl = compressedLen;
+				const ul = uncompressedLen;
+				throw new Error("invalid Point, expected length of " + cl + ", or uncompressed " + ul + ", got " + len);
+			}
+		}
+	});
+	function isBiggerThanHalfOrder(number) {
+		return number > CURVE_ORDER >> _1n$1;
+	}
+	function normalizeS(s) {
+		return isBiggerThanHalfOrder(s) ? modN(-s) : s;
+	}
+	const slcNum = (b, from, to) => bytesToNumberBE(b.slice(from, to));
+	/**
+	* ECDSA signature with its (r, s) properties. Supports DER & compact representations.
+	*/
+	class Signature {
+		constructor(r, s, recovery) {
+			aInRange("r", r, _1n$1, CURVE_ORDER);
+			aInRange("s", s, _1n$1, CURVE_ORDER);
+			this.r = r;
+			this.s = s;
+			if (recovery != null) this.recovery = recovery;
+			Object.freeze(this);
+		}
+		static fromCompact(hex) {
+			const l = nByteLength;
+			hex = ensureBytes("compactSignature", hex, l * 2);
+			return new Signature(slcNum(hex, 0, l), slcNum(hex, l, 2 * l));
+		}
+		static fromDER(hex) {
+			const { r, s } = DER.toSig(ensureBytes("DER", hex));
+			return new Signature(r, s);
+		}
+		/**
+		* @todo remove
+		* @deprecated
+		*/
+		assertValidity() {}
+		addRecoveryBit(recovery) {
+			return new Signature(this.r, this.s, recovery);
+		}
+		recoverPublicKey(msgHash) {
+			const { r, s, recovery: rec } = this;
+			const h = bits2int_modN(ensureBytes("msgHash", msgHash));
+			if (rec == null || ![
+				0,
+				1,
+				2,
+				3
+			].includes(rec)) throw new Error("recovery id invalid");
+			const radj = rec === 2 || rec === 3 ? r + CURVE.n : r;
+			if (radj >= Fp.ORDER) throw new Error("recovery id 2 or 3 invalid");
+			const prefix = (rec & 1) === 0 ? "02" : "03";
+			const R = Point.fromHex(prefix + numToSizedHex(radj, Fp.BYTES));
+			const ir = invN(radj);
+			const u1 = modN(-h * ir);
+			const u2 = modN(s * ir);
+			const Q = Point.BASE.multiplyAndAddUnsafe(R, u1, u2);
+			if (!Q) throw new Error("point at infinify");
+			Q.assertValidity();
+			return Q;
+		}
+		hasHighS() {
+			return isBiggerThanHalfOrder(this.s);
+		}
+		normalizeS() {
+			return this.hasHighS() ? new Signature(this.r, modN(-this.s), this.recovery) : this;
+		}
+		toDERRawBytes() {
+			return hexToBytes(this.toDERHex());
+		}
+		toDERHex() {
+			return DER.hexFromSig(this);
+		}
+		toCompactRawBytes() {
+			return hexToBytes(this.toCompactHex());
+		}
+		toCompactHex() {
+			const l = nByteLength;
+			return numToSizedHex(this.r, l) + numToSizedHex(this.s, l);
+		}
+	}
+	const utils = {
+		isValidPrivateKey(privateKey) {
+			try {
+				normPrivateKeyToScalar(privateKey);
+				return true;
+			} catch (error) {
+				return false;
+			}
+		},
+		normPrivateKeyToScalar,
+		randomPrivateKey: () => {
+			const length = getMinHashLength(CURVE.n);
+			return mapHashToField(CURVE.randomBytes(length), CURVE.n);
+		},
+		precompute(windowSize = 8, point = Point.BASE) {
+			point._setWindowSize(windowSize);
+			point.multiply(BigInt(3));
+			return point;
+		}
+	};
+	/**
+	* Computes public key for a private key. Checks for validity of the private key.
+	* @param privateKey private key
+	* @param isCompressed whether to return compact (default), or full key
+	* @returns Public key, full when isCompressed=false; short when isCompressed=true
+	*/
+	function getPublicKey(privateKey, isCompressed = true) {
+		return Point.fromPrivateKey(privateKey).toRawBytes(isCompressed);
+	}
+	/**
+	* Quick and dirty check for item being public key. Does not validate hex, or being on-curve.
+	*/
+	function isProbPub(item) {
+		if (typeof item === "bigint") return false;
+		if (item instanceof Point) return true;
+		const len = ensureBytes("key", item).length;
+		const fpl = Fp.BYTES;
+		const compLen = fpl + 1;
+		const uncompLen = 2 * fpl + 1;
+		if (CURVE.allowedPrivateKeyLengths || nByteLength === compLen) return;
+		else return len === compLen || len === uncompLen;
+	}
+	/**
+	* ECDH (Elliptic Curve Diffie Hellman).
+	* Computes shared public key from private key and public key.
+	* Checks: 1) private key validity 2) shared key is on-curve.
+	* Does NOT hash the result.
+	* @param privateA private key
+	* @param publicB different public key
+	* @param isCompressed whether to return compact (default), or full key
+	* @returns shared public key
+	*/
+	function getSharedSecret(privateA, publicB, isCompressed = true) {
+		if (isProbPub(privateA) === true) throw new Error("first arg must be private key");
+		if (isProbPub(publicB) === false) throw new Error("second arg must be public key");
+		return Point.fromHex(publicB).multiply(normPrivateKeyToScalar(privateA)).toRawBytes(isCompressed);
+	}
+	const bits2int = CURVE.bits2int || function(bytes) {
+		if (bytes.length > 8192) throw new Error("input is too large");
+		const num = bytesToNumberBE(bytes);
+		const delta = bytes.length * 8 - nBitLength;
+		return delta > 0 ? num >> BigInt(delta) : num;
+	};
+	const bits2int_modN = CURVE.bits2int_modN || function(bytes) {
+		return modN(bits2int(bytes));
+	};
+	const ORDER_MASK = bitMask(nBitLength);
+	/**
+	* Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`.
+	*/
+	function int2octets(num) {
+		aInRange("num < 2^" + nBitLength, num, _0n$1, ORDER_MASK);
+		return numberToBytesBE(num, nByteLength);
+	}
+	function prepSig(msgHash, privateKey, opts = defaultSigOpts) {
+		if (["recovered", "canonical"].some((k) => k in opts)) throw new Error("sign() legacy options not supported");
+		const { hash, randomBytes } = CURVE;
+		let { lowS, prehash, extraEntropy: ent } = opts;
+		if (lowS == null) lowS = true;
+		msgHash = ensureBytes("msgHash", msgHash);
+		validateSigVerOpts(opts);
+		if (prehash) msgHash = ensureBytes("prehashed msgHash", hash(msgHash));
+		const h1int = bits2int_modN(msgHash);
+		const d = normPrivateKeyToScalar(privateKey);
+		const seedArgs = [int2octets(d), int2octets(h1int)];
+		if (ent != null && ent !== false) {
+			const e = ent === true ? randomBytes(Fp.BYTES) : ent;
+			seedArgs.push(ensureBytes("extraEntropy", e));
+		}
+		const seed = concatBytes(...seedArgs);
+		const m = h1int;
+		function k2sig(kBytes) {
+			const k = bits2int(kBytes);
+			if (!isWithinCurveOrder(k)) return;
+			const ik = invN(k);
+			const q = Point.BASE.multiply(k).toAffine();
+			const r = modN(q.x);
+			if (r === _0n$1) return;
+			const s = modN(ik * modN(m + r * d));
+			if (s === _0n$1) return;
+			let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n$1);
+			let normS = s;
+			if (lowS && isBiggerThanHalfOrder(s)) {
+				normS = normalizeS(s);
+				recovery ^= 1;
+			}
+			return new Signature(r, normS, recovery);
+		}
+		return {
+			seed,
+			k2sig
+		};
+	}
+	const defaultSigOpts = {
+		lowS: CURVE.lowS,
+		prehash: false
+	};
+	const defaultVerOpts = {
+		lowS: CURVE.lowS,
+		prehash: false
+	};
+	/**
+	* Signs message hash with a private key.
+	* ```
+	* sign(m, d, k) where
+	*   (x, y) = G × k
+	*   r = x mod n
+	*   s = (m + dr)/k mod n
+	* ```
+	* @param msgHash NOT message. msg needs to be hashed to `msgHash`, or use `prehash`.
+	* @param privKey private key
+	* @param opts lowS for non-malleable sigs. extraEntropy for mixing randomness into k. prehash will hash first arg.
+	* @returns signature with recovery param
+	*/
+	function sign(msgHash, privKey, opts = defaultSigOpts) {
+		const { seed, k2sig } = prepSig(msgHash, privKey, opts);
+		const C = CURVE;
+		return createHmacDrbg(C.hash.outputLen, C.nByteLength, C.hmac)(seed, k2sig);
+	}
+	Point.BASE._setWindowSize(8);
+	/**
+	* Verifies a signature against message hash and public key.
+	* Rejects lowS signatures by default: to override,
+	* specify option `{lowS: false}`. Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:
+	*
+	* ```
+	* verify(r, s, h, P) where
+	*   U1 = hs^-1 mod n
+	*   U2 = rs^-1 mod n
+	*   R = U1⋅G - U2⋅P
+	*   mod(R.x, n) == r
+	* ```
+	*/
+	function verify(signature, msgHash, publicKey, opts = defaultVerOpts) {
+		const sg = signature;
+		msgHash = ensureBytes("msgHash", msgHash);
+		publicKey = ensureBytes("publicKey", publicKey);
+		const { lowS, prehash, format } = opts;
+		validateSigVerOpts(opts);
+		if ("strict" in opts) throw new Error("options.strict was renamed to lowS");
+		if (format !== void 0 && format !== "compact" && format !== "der") throw new Error("format must be compact or der");
+		const isHex = typeof sg === "string" || isBytes(sg);
+		const isObj = !isHex && !format && typeof sg === "object" && sg !== null && typeof sg.r === "bigint" && typeof sg.s === "bigint";
+		if (!isHex && !isObj) throw new Error("invalid signature, expected Uint8Array, hex string or Signature instance");
+		let _sig = void 0;
+		let P;
+		try {
+			if (isObj) _sig = new Signature(sg.r, sg.s);
+			if (isHex) {
+				try {
+					if (format !== "compact") _sig = Signature.fromDER(sg);
+				} catch (derError) {
+					if (!(derError instanceof DER.Err)) throw derError;
+				}
+				if (!_sig && format !== "der") _sig = Signature.fromCompact(sg);
+			}
+			P = Point.fromHex(publicKey);
+		} catch (error) {
+			return false;
+		}
+		if (!_sig) return false;
+		if (lowS && _sig.hasHighS()) return false;
+		if (prehash) msgHash = CURVE.hash(msgHash);
+		const { r, s } = _sig;
+		const h = bits2int_modN(msgHash);
+		const is = invN(s);
+		const u1 = modN(h * is);
+		const u2 = modN(r * is);
+		const R = Point.BASE.multiplyAndAddUnsafe(P, u1, u2)?.toAffine();
+		if (!R) return false;
+		return modN(R.x) === r;
+	}
+	return {
+		CURVE,
+		getPublicKey,
+		getSharedSecret,
+		sign,
+		verify,
+		ProjectivePoint: Point,
+		Signature,
+		utils
+	};
+}
+/**
+* Implementation of the Shallue and van de Woestijne method for any weierstrass curve.
+* TODO: check if there is a way to merge this with uvRatio in Edwards; move to modular.
+* b = True and y = sqrt(u / v) if (u / v) is square in F, and
+* b = False and y = sqrt(Z * (u / v)) otherwise.
+* @param Fp
+* @param Z
+* @returns
+*/
+function SWUFpSqrtRatio(Fp, Z) {
+	const q = Fp.ORDER;
+	let l = _0n$1;
+	for (let o = q - _1n$1; o % _2n$1 === _0n$1; o /= _2n$1) l += _1n$1;
+	const c1 = l;
+	const _2n_pow_c1_1 = _2n$1 << c1 - _1n$1 - _1n$1;
+	const _2n_pow_c1 = _2n_pow_c1_1 * _2n$1;
+	const c2 = (q - _1n$1) / _2n_pow_c1;
+	const c3 = (c2 - _1n$1) / _2n$1;
+	const c4 = _2n_pow_c1 - _1n$1;
+	const c5 = _2n_pow_c1_1;
+	const c6 = Fp.pow(Z, c2);
+	const c7 = Fp.pow(Z, (c2 + _1n$1) / _2n$1);
+	let sqrtRatio = (u, v) => {
+		let tv1 = c6;
+		let tv2 = Fp.pow(v, c4);
+		let tv3 = Fp.sqr(tv2);
+		tv3 = Fp.mul(tv3, v);
+		let tv5 = Fp.mul(u, tv3);
+		tv5 = Fp.pow(tv5, c3);
+		tv5 = Fp.mul(tv5, tv2);
+		tv2 = Fp.mul(tv5, v);
+		tv3 = Fp.mul(tv5, u);
+		let tv4 = Fp.mul(tv3, tv2);
+		tv5 = Fp.pow(tv4, c5);
+		let isQR = Fp.eql(tv5, Fp.ONE);
+		tv2 = Fp.mul(tv3, c7);
+		tv5 = Fp.mul(tv4, tv1);
+		tv3 = Fp.cmov(tv2, tv3, isQR);
+		tv4 = Fp.cmov(tv5, tv4, isQR);
+		for (let i = c1; i > _1n$1; i--) {
+			let tv5 = i - _2n$1;
+			tv5 = _2n$1 << tv5 - _1n$1;
+			let tvv5 = Fp.pow(tv4, tv5);
+			const e1 = Fp.eql(tvv5, Fp.ONE);
+			tv2 = Fp.mul(tv3, tv1);
+			tv1 = Fp.mul(tv1, tv1);
+			tvv5 = Fp.mul(tv4, tv1);
+			tv3 = Fp.cmov(tv2, tv3, e1);
+			tv4 = Fp.cmov(tvv5, tv4, e1);
+		}
+		return {
+			isValid: isQR,
+			value: tv3
+		};
+	};
+	if (Fp.ORDER % _4n === _3n) {
+		const c1 = (Fp.ORDER - _3n) / _4n;
+		const c2 = Fp.sqrt(Fp.neg(Z));
+		sqrtRatio = (u, v) => {
+			let tv1 = Fp.sqr(v);
+			const tv2 = Fp.mul(u, v);
+			tv1 = Fp.mul(tv1, tv2);
+			let y1 = Fp.pow(tv1, c1);
+			y1 = Fp.mul(y1, tv2);
+			const y2 = Fp.mul(y1, c2);
+			const tv3 = Fp.mul(Fp.sqr(y1), v);
+			const isQR = Fp.eql(tv3, u);
+			return {
+				isValid: isQR,
+				value: Fp.cmov(y2, y1, isQR)
+			};
+		};
+	}
+	return sqrtRatio;
+}
+/**
+* Simplified Shallue-van de Woestijne-Ulas Method
+* https://www.rfc-editor.org/rfc/rfc9380#section-6.6.2
+*/
+function mapToCurveSimpleSWU(Fp, opts) {
+	validateField(Fp);
+	if (!Fp.isValid(opts.A) || !Fp.isValid(opts.B) || !Fp.isValid(opts.Z)) throw new Error("mapToCurveSimpleSWU: invalid opts");
+	const sqrtRatio = SWUFpSqrtRatio(Fp, opts.Z);
+	if (!Fp.isOdd) throw new Error("Fp.isOdd is not implemented!");
+	return (u) => {
+		let tv1, tv2, tv3, tv4, tv5, tv6, x, y;
+		tv1 = Fp.sqr(u);
+		tv1 = Fp.mul(tv1, opts.Z);
+		tv2 = Fp.sqr(tv1);
+		tv2 = Fp.add(tv2, tv1);
+		tv3 = Fp.add(tv2, Fp.ONE);
+		tv3 = Fp.mul(tv3, opts.B);
+		tv4 = Fp.cmov(opts.Z, Fp.neg(tv2), !Fp.eql(tv2, Fp.ZERO));
+		tv4 = Fp.mul(tv4, opts.A);
+		tv2 = Fp.sqr(tv3);
+		tv6 = Fp.sqr(tv4);
+		tv5 = Fp.mul(tv6, opts.A);
+		tv2 = Fp.add(tv2, tv5);
+		tv2 = Fp.mul(tv2, tv3);
+		tv6 = Fp.mul(tv6, tv4);
+		tv5 = Fp.mul(tv6, opts.B);
+		tv2 = Fp.add(tv2, tv5);
+		x = Fp.mul(tv1, tv3);
+		const { isValid, value } = sqrtRatio(tv2, tv6);
+		y = Fp.mul(tv1, u);
+		y = Fp.mul(y, value);
+		x = Fp.cmov(x, tv3, isValid);
+		y = Fp.cmov(y, value, isValid);
+		const e1 = Fp.isOdd(u) === Fp.isOdd(y);
+		y = Fp.cmov(Fp.neg(y), y, e1);
+		const tv4_inv = FpInvertBatch(Fp, [tv4], true)[0];
+		x = Fp.mul(x, tv4_inv);
+		return {
+			x,
+			y
+		};
+	};
+}
+//#endregion
+//#region node_modules/.pnpm/@noble+curves@1.9.1/node_modules/@noble/curves/esm/_shortw_utils.js
+/**
+* Utilities for short weierstrass curves, combined with noble-hashes.
+* @module
+*/
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+/** connects noble-curves to noble-hashes */
+function getHash(hash) {
+	return {
+		hash,
+		hmac: (key, ...msgs) => hmac(hash, key, concatBytes$1(...msgs)),
+		randomBytes
+	};
+}
+function createCurve(curveDef, defHash) {
+	const create = (hash) => weierstrass({
+		...curveDef,
+		...getHash(hash)
+	});
+	return {
+		...create(defHash),
+		create
+	};
+}
+//#endregion
+//#region node_modules/.pnpm/@noble+curves@1.9.1/node_modules/@noble/curves/esm/abstract/hash-to-curve.js
+const os2ip = bytesToNumberBE;
+function i2osp(value, length) {
+	anum(value);
+	anum(length);
+	if (value < 0 || value >= 1 << 8 * length) throw new Error("invalid I2OSP input: " + value);
+	const res = Array.from({ length }).fill(0);
+	for (let i = length - 1; i >= 0; i--) {
+		res[i] = value & 255;
+		value >>>= 8;
+	}
+	return new Uint8Array(res);
+}
+function strxor(a, b) {
+	const arr = new Uint8Array(a.length);
+	for (let i = 0; i < a.length; i++) arr[i] = a[i] ^ b[i];
+	return arr;
+}
+function anum(item) {
+	if (!Number.isSafeInteger(item)) throw new Error("number expected");
+}
+/**
+* Produces a uniformly random byte string using a cryptographic hash function H that outputs b bits.
+* [RFC 9380 5.3.1](https://www.rfc-editor.org/rfc/rfc9380#section-5.3.1).
+*/
+function expand_message_xmd(msg, DST, lenInBytes, H) {
+	abytes$1(msg);
+	abytes$1(DST);
+	anum(lenInBytes);
+	if (DST.length > 255) DST = H(concatBytes(utf8ToBytes("H2C-OVERSIZE-DST-"), DST));
+	const { outputLen: b_in_bytes, blockLen: r_in_bytes } = H;
+	const ell = Math.ceil(lenInBytes / b_in_bytes);
+	if (lenInBytes > 65535 || ell > 255) throw new Error("expand_message_xmd: invalid lenInBytes");
+	const DST_prime = concatBytes(DST, i2osp(DST.length, 1));
+	const Z_pad = i2osp(0, r_in_bytes);
+	const l_i_b_str = i2osp(lenInBytes, 2);
+	const b = new Array(ell);
+	const b_0 = H(concatBytes(Z_pad, msg, l_i_b_str, i2osp(0, 1), DST_prime));
+	b[0] = H(concatBytes(b_0, i2osp(1, 1), DST_prime));
+	for (let i = 1; i <= ell; i++) b[i] = H(concatBytes(...[
+		strxor(b_0, b[i - 1]),
+		i2osp(i + 1, 1),
+		DST_prime
+	]));
+	return concatBytes(...b).slice(0, lenInBytes);
+}
+/**
+* Produces a uniformly random byte string using an extendable-output function (XOF) H.
+* 1. The collision resistance of H MUST be at least k bits.
+* 2. H MUST be an XOF that has been proved indifferentiable from
+*    a random oracle under a reasonable cryptographic assumption.
+* [RFC 9380 5.3.2](https://www.rfc-editor.org/rfc/rfc9380#section-5.3.2).
+*/
+function expand_message_xof(msg, DST, lenInBytes, k, H) {
+	abytes$1(msg);
+	abytes$1(DST);
+	anum(lenInBytes);
+	if (DST.length > 255) {
+		const dkLen = Math.ceil(2 * k / 8);
+		DST = H.create({ dkLen }).update(utf8ToBytes("H2C-OVERSIZE-DST-")).update(DST).digest();
+	}
+	if (lenInBytes > 65535 || DST.length > 255) throw new Error("expand_message_xof: invalid lenInBytes");
+	return H.create({ dkLen: lenInBytes }).update(msg).update(i2osp(lenInBytes, 2)).update(DST).update(i2osp(DST.length, 1)).digest();
+}
+/**
+* Hashes arbitrary-length byte strings to a list of one or more elements of a finite field F.
+* [RFC 9380 5.2](https://www.rfc-editor.org/rfc/rfc9380#section-5.2).
+* @param msg a byte string containing the message to hash
+* @param count the number of elements of F to output
+* @param options `{DST: string, p: bigint, m: number, k: number, expand: 'xmd' | 'xof', hash: H}`, see above
+* @returns [u_0, ..., u_(count - 1)], a list of field elements.
+*/
+function hash_to_field(msg, count, options) {
+	validateObject(options, {
+		DST: "stringOrUint8Array",
+		p: "bigint",
+		m: "isSafeInteger",
+		k: "isSafeInteger",
+		hash: "hash"
+	});
+	const { p, k, m, hash, expand, DST: _DST } = options;
+	abytes$1(msg);
+	anum(count);
+	const DST = typeof _DST === "string" ? utf8ToBytes(_DST) : _DST;
+	const log2p = p.toString(2).length;
+	const L = Math.ceil((log2p + k) / 8);
+	const len_in_bytes = count * m * L;
+	let prb;
+	if (expand === "xmd") prb = expand_message_xmd(msg, DST, len_in_bytes, hash);
+	else if (expand === "xof") prb = expand_message_xof(msg, DST, len_in_bytes, k, hash);
+	else if (expand === "_internal_pass") prb = msg;
+	else throw new Error("expand must be \"xmd\" or \"xof\"");
+	const u = new Array(count);
+	for (let i = 0; i < count; i++) {
+		const e = new Array(m);
+		for (let j = 0; j < m; j++) {
+			const elm_offset = L * (j + i * m);
+			e[j] = mod(os2ip(prb.subarray(elm_offset, elm_offset + L)), p);
+		}
+		u[i] = e;
+	}
+	return u;
+}
+function isogenyMap(field, map) {
+	const coeff = map.map((i) => Array.from(i).reverse());
+	return (x, y) => {
+		const [xn, xd, yn, yd] = coeff.map((val) => val.reduce((acc, i) => field.add(field.mul(acc, x), i)));
+		const [xd_inv, yd_inv] = FpInvertBatch(field, [xd, yd], true);
+		x = field.mul(xn, xd_inv);
+		y = field.mul(y, field.mul(yn, yd_inv));
+		return {
+			x,
+			y
+		};
+	};
+}
+/** Creates hash-to-curve methods from EC Point and mapToCurve function. */
+function createHasher(Point, mapToCurve, defaults) {
+	if (typeof mapToCurve !== "function") throw new Error("mapToCurve() must be defined");
+	function map(num) {
+		return Point.fromAffine(mapToCurve(num));
+	}
+	function clear(initial) {
+		const P = initial.clearCofactor();
+		if (P.equals(Point.ZERO)) return Point.ZERO;
+		P.assertValidity();
+		return P;
+	}
+	return {
+		defaults,
+		hashToCurve(msg, options) {
+			const u = hash_to_field(msg, 2, {
+				...defaults,
+				DST: defaults.DST,
+				...options
+			});
+			const u0 = map(u[0]);
+			const u1 = map(u[1]);
+			return clear(u0.add(u1));
+		},
+		encodeToCurve(msg, options) {
+			return clear(map(hash_to_field(msg, 1, {
+				...defaults,
+				DST: defaults.encodeDST,
+				...options
+			})[0]));
+		},
+		mapToCurve(scalars) {
+			if (!Array.isArray(scalars)) throw new Error("expected array of bigints");
+			for (const i of scalars) if (typeof i !== "bigint") throw new Error("expected array of bigints");
+			return clear(map(scalars));
+		}
+	};
+}
+//#endregion
+//#region node_modules/.pnpm/@noble+curves@1.9.1/node_modules/@noble/curves/esm/secp256k1.js
+/**
+* NIST secp256k1. See [pdf](https://www.secg.org/sec2-v2.pdf).
+*
+* Seems to be rigid (not backdoored)
+* [as per discussion](https://bitcointalk.org/index.php?topic=289795.msg3183975#msg3183975).
+*
+* secp256k1 belongs to Koblitz curves: it has efficiently computable endomorphism.
+* Endomorphism uses 2x less RAM, speeds up precomputation by 2x and ECDH / key recovery by 20%.
+* For precomputed wNAF it trades off 1/2 init time & 1/3 ram for 20% perf hit.
+* [See explanation](https://gist.github.com/paulmillr/eb670806793e84df628a7c434a873066).
+* @module
+*/
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+var secp256k1_exports = /* @__PURE__ */ __exportAll({
+	secp256k1: () => secp256k1,
+	secp256k1_hasher: () => secp256k1_hasher
+});
+const secp256k1P = BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f");
+const secp256k1N = BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141");
+const _0n = BigInt(0);
+const _1n = BigInt(1);
+const _2n = BigInt(2);
+const divNearest = (a, b) => (a + b / _2n) / b;
+/**
+* √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.
+* (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]
+*/
+function sqrtMod(y) {
+	const P = secp256k1P;
+	const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);
+	const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);
+	const b2 = y * y * y % P;
+	const b3 = b2 * b2 * y % P;
+	const b11 = pow2(pow2(pow2(b3, _3n, P) * b3 % P, _3n, P) * b3 % P, _2n, P) * b2 % P;
+	const b22 = pow2(b11, _11n, P) * b11 % P;
+	const b44 = pow2(b22, _22n, P) * b22 % P;
+	const b88 = pow2(b44, _44n, P) * b44 % P;
+	const root = pow2(pow2(pow2(pow2(pow2(pow2(b88, _88n, P) * b88 % P, _44n, P) * b44 % P, _3n, P) * b3 % P, _23n, P) * b22 % P, _6n, P) * b2 % P, _2n, P);
+	if (!Fpk1.eql(Fpk1.sqr(root), y)) throw new Error("Cannot find square root");
+	return root;
+}
+const Fpk1 = Field(secp256k1P, void 0, void 0, { sqrt: sqrtMod });
+/**
+* secp256k1 curve, ECDSA and ECDH methods.
+*
+* Field: `2n**256n - 2n**32n - 2n**9n - 2n**8n - 2n**7n - 2n**6n - 2n**4n - 1n`
+*
+* @example
+* ```js
+* import { secp256k1 } from '@noble/curves/secp256k1';
+* const priv = secp256k1.utils.randomPrivateKey();
+* const pub = secp256k1.getPublicKey(priv);
+* const msg = new Uint8Array(32).fill(1); // message hash (not message) in ecdsa
+* const sig = secp256k1.sign(msg, priv); // `{prehash: true}` option is available
+* const isValid = secp256k1.verify(sig, msg, pub) === true;
+* ```
+*/
+const secp256k1 = createCurve({
+	a: _0n,
+	b: BigInt(7),
+	Fp: Fpk1,
+	n: secp256k1N,
+	Gx: BigInt("55066263022277343669578718895168534326250603453777594175500187360389116729240"),
+	Gy: BigInt("32670510020758816978083085130507043184471273380659243275938904335757337482424"),
+	h: BigInt(1),
+	lowS: true,
+	endo: {
+		beta: BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),
+		splitScalar: (k) => {
+			const n = secp256k1N;
+			const a1 = BigInt("0x3086d221a7d46bcde86c90e49284eb15");
+			const b1 = -_1n * BigInt("0xe4437ed6010e88286f547fa90abfe4c3");
+			const a2 = BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8");
+			const b2 = a1;
+			const POW_2_128 = BigInt("0x100000000000000000000000000000000");
+			const c1 = divNearest(b2 * k, n);
+			const c2 = divNearest(-b1 * k, n);
+			let k1 = mod(k - c1 * a1 - c2 * a2, n);
+			let k2 = mod(-c1 * b1 - c2 * b2, n);
+			const k1neg = k1 > POW_2_128;
+			const k2neg = k2 > POW_2_128;
+			if (k1neg) k1 = n - k1;
+			if (k2neg) k2 = n - k2;
+			if (k1 > POW_2_128 || k2 > POW_2_128) throw new Error("splitScalar: Endomorphism failed, k=" + k);
+			return {
+				k1neg,
+				k1,
+				k2neg,
+				k2
+			};
+		}
+	}
+}, sha256);
+secp256k1.ProjectivePoint;
+secp256k1.utils.randomPrivateKey;
+const isoMap = isogenyMap(Fpk1, [
+	[
+		"0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7",
+		"0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581",
+		"0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262",
+		"0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c"
+	],
+	[
+		"0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b",
+		"0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14",
+		"0x0000000000000000000000000000000000000000000000000000000000000001"
+	],
+	[
+		"0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c",
+		"0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3",
+		"0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931",
+		"0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84"
+	],
+	[
+		"0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b",
+		"0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573",
+		"0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f",
+		"0x0000000000000000000000000000000000000000000000000000000000000001"
+	]
+].map((i) => i.map((j) => BigInt(j))));
+const mapSWU = mapToCurveSimpleSWU(Fpk1, {
+	A: BigInt("0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533"),
+	B: BigInt("1771"),
+	Z: Fpk1.create(BigInt("-11"))
+});
+/** Hashing / encoding to secp256k1 points / field. RFC 9380 methods. */
+const secp256k1_hasher = createHasher(secp256k1.ProjectivePoint, (scalars) => {
+	const { x, y } = mapSWU(Fpk1.create(scalars[0]));
+	return isoMap(x, y);
+}, {
+	DST: "secp256k1_XMD:SHA-256_SSWU_RO_",
+	encodeDST: "secp256k1_XMD:SHA-256_SSWU_NU_",
+	p: Fpk1.ORDER,
+	m: 1,
+	k: 128,
+	expand: "xmd",
+	hash: sha256
+});
+secp256k1_hasher.hashToCurve;
+secp256k1_hasher.encodeToCurve;
+//#endregion
+export { mapToCurveSimpleSWU as a, sha256 as c, createCurve as i, sha384 as l, secp256k1_exports as n, Field as o, createHasher as r, hmac as s, secp256k1 as t, sha512 as u };