{"version":3,"sources":["jsdelivr-header.js","/npm/@noble/ed25519@2.2.3/index.js"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;ACDA,MAAM,EAAI,IAAM,KAAO,IACjB,EAAI,IAAM,KAAO,wCACjB,EAAK,oEACL,EAAK,oEAOL,EAAQ,CACV,GAAI,GACJ,EARO,+EASP,EAAG,EAAG,EAAG,EAAG,EAAG,EAAG,GAAI,EAAI,GAAI,GAE5B,EAAM,CAAC,EAAI,MAAS,MAAM,IAAI,MAAM,EAAE,EACtC,EAAO,GAAmB,iBAAN,EAEpB,EAAM,CAAC,EAAG,KADH,CAAC,GAAO,aAAa,YAAe,YAAY,OAAO,IAA6B,eAAvB,EAAE,YAAY,KAEtF,CAAK,IAAoB,iBAAN,GAAkB,EAAI,GAAK,EAAE,SAAW,EACzD,EAAI,uCAAyC,EAC3C,EAAO,GAAS,IAAI,WAAW,GAC/B,EAAO,CAAC,EAAG,IAAQ,EAAI,EAAI,GAAK,EAAI,GAAK,EAAI,EAAI,IAAK,GACtD,EAAI,CAAC,EAAG,EAAI,KAAQ,IAAI,EAAI,EAAI,EAAG,OAAO,GAAK,GAAK,EAAI,EAAI,CAAC,EAC7D,EAAW,GAAO,aAAa,EAAQ,EAAI,EAAI,kBAErD,MAAM,EACF,WAAA,CAAY,EAAI,EAAI,EAAI,GACpB,KAAK,GAAK,EACV,KAAK,GAAK,EACV,KAAK,GAAK,EACV,KAAK,GAAK,CAClB,CACI,iBAAO,CAAW,GAAK,OAAO,IAAI,EAAM,EAAE,EAAG,EAAE,EAAG,GAAI,EAAE,EAAE,EAAI,EAAE,GAAI,CAEpE,cAAO,CAAQ,EAAK,GAAS,GACzB,MAAM,EAAE,GAAM,EAER,GADN,EAAM,EAAK,EAAK,KACG,QACb,EAAW,EAAI,IACrB,EAAO,KAAiB,IAAX,EACb,MAAM,EAAI,EAAO,IACb,GAAY,IAAM,GAAK,EAAI,IAAM,MACjC,EAAI,iBACH,GAAY,IAAM,GAAK,EAAI,GAC5B,EAAI,iBACR,MAAM,EAAK,EAAE,EAAI,GACX,EAAI,EAAE,EAAK,IACX,EAAI,EAAE,EAAI,EAAK,IACrB,IAAI,QAAE,EAAS,MAAO,GAAM,EAAQ,EAAG,GAClC,GACD,EAAI,sBACR,MAAM,EAAsB,MAAR,GAAJ,GACV,KAA4B,IAAX,GAKvB,OAJK,GAAgB,KAAN,GAAY,GACvB,EAAI,iBACJ,IAAkB,IAClB,EAAI,GAAG,IACJ,IAAI,EAAM,EAAG,EAAG,GAAI,EAAE,EAAI,GACzC,CACI,KAAI,GAAM,OAAO,KAAK,WAAW,CAAE,CACnC,KAAI,GAAM,OAAO,KAAK,WAAW,CAAE,CACnC,MAAA,CAAO,GACH,MAAQ,GAAI,EAAI,GAAI,EAAI,GAAI,GAAO,MAC3B,GAAI,EAAI,GAAI,EAAI,GAAI,GAAO,EAAQ,GACrC,EAAO,EAAE,EAAK,GAAK,EAAO,EAAE,EAAK,GACjC,EAAO,EAAE,EAAK,GAAK,EAAO,EAAE,EAAK,GACvC,OAAO,IAAS,GAAQ,IAAS,CACzC,CACI,GAAA,GAAQ,OAAO,KAAK,OAAO,EAAG,CAC9B,MAAA,GACI,OAAO,IAAI,EAAM,GAAG,KAAK,IAAK,KAAK,GAAI,KAAK,GAAI,GAAG,KAAK,IAChE,CAEI,MAAA,GACI,MAAQ,GAAI,EAAI,GAAI,EAAI,GAAI,GAAO,MAC7B,EAAE,GAAM,EACR,EAAI,EAAE,EAAK,GACX,EAAI,EAAE,EAAK,GACX,EAAI,EAAE,GAAK,EAAE,EAAK,IAClB,EAAI,EAAE,EAAI,GACV,EAAO,EAAK,EACZ,EAAI,EAAE,EAAE,EAAO,GAAQ,EAAI,GAC3B,EAAI,EAAI,EACR,EAAI,EAAI,EACR,EAAI,EAAI,EACR,EAAK,EAAE,EAAI,GACX,EAAK,EAAE,EAAI,GACX,EAAK,EAAE,EAAI,GACX,EAAK,EAAE,EAAI,GACjB,OAAO,IAAI,EAAM,EAAI,EAAI,EAAI,EACrC,CAEI,GAAA,CAAI,GACA,MAAQ,GAAI,EAAI,GAAI,EAAI,GAAI,EAAI,GAAI,GAAO,MACnC,GAAI,EAAI,GAAI,EAAI,GAAI,EAAI,GAAI,GAAO,EAAQ,IAC7C,EAAE,EAAC,EAAE,GAAM,EACX,EAAI,EAAE,EAAK,GACX,EAAI,EAAE,EAAK,GACX,EAAI,EAAE,EAAK,EAAI,GACf,EAAI,EAAE,EAAK,GACX,EAAI,GAAG,EAAK,IAAO,EAAK,GAAM,EAAI,GAClC,EAAI,EAAE,EAAI,GACV,EAAI,EAAE,EAAI,GACV,EAAI,EAAE,EAAI,EAAI,GACd,EAAK,EAAE,EAAI,GACX,EAAK,EAAE,EAAI,GACX,EAAK,EAAE,EAAI,GACX,EAAK,EAAE,EAAI,GACjB,OAAO,IAAI,EAAM,EAAI,EAAI,EAAI,EACrC,CACI,GAAA,CAAI,EAAG,GAAO,GACV,GAAU,KAAN,EACA,OAAgB,IAAT,EAAgB,EAAI,wBAA0B,EAGzD,GAFmB,iBAAN,GAAkB,GAAK,GAAK,EAAI,GACzC,EAAI,gCACH,GAAQ,KAAK,OAAe,KAAN,EACvB,OAAO,KACX,GAAI,KAAK,OAAO,GACZ,OAAO,EAAK,GAAG,EACnB,IAAI,EAAI,EAAG,EAAI,EACf,IAAK,IAAI,EAAI,KAAM,EAAI,GAAI,EAAI,EAAE,SAAU,IAAM,GACrC,GAAJ,EACA,EAAI,EAAE,IAAI,GACL,IACL,EAAI,EAAE,IAAI,IAElB,OAAO,CACf,CACI,QAAA,CAAS,GAAU,OAAO,KAAK,IAAI,EAAQ,CAC3C,aAAA,GAAkB,OAAO,KAAK,IAAI,OAAO,EAAM,IAAI,EAAO,CAC1D,YAAA,GAAiB,OAAO,KAAK,gBAAgB,KAAM,CACnD,aAAA,GACI,IAAI,EAAI,KAAK,IAAI,EAAI,IAAI,GAAO,SAGhC,OADI,EAAI,EAAE,IAAI,MACP,EAAE,KACjB,CAEI,QAAA,GACI,MAAQ,GAAI,EAAG,GAAI,EAAG,GAAI,GAAM,KAChC,GAAI,KAAK,OAAO,GACZ,MAAO,CAAE,EAAG,GAAI,EAAG,IACvB,MAAM,EAAK,EAAO,EAAG,GAGrB,OAFkB,KAAd,EAAE,EAAI,IACN,EAAI,mBACD,CAAE,EAAG,EAAE,EAAI,GAAK,EAAG,EAAE,EAAI,GACxC,CACI,UAAA,GACI,MAAM,EAAE,EAAC,EAAE,GAAM,KAAK,WAChB,EAAI,EAAS,GAEnB,OADA,EAAE,KAAW,GAAJ,EAAS,IAAO,EAClB,CACf,CACI,KAAA,GAAU,OAAO,EAAI,KAAK,aAAc,EAG5C,EAAM,KAAO,IAAI,EAAM,EAAI,EAAI,GAAI,EAAE,EAAK,IAE1C,EAAM,KAAO,IAAI,EAAM,GAAI,GAAI,GAAI,IACnC,MAAQ,KAAM,EAAG,KAAM,GAAM,EACvB,EAAO,CAAC,EAAK,IAAQ,EAAI,SAAS,IAAI,SAAS,EAAK,KACpD,EAAO,GAAM,MAAM,KAAK,EAAI,IAAI,KAAI,GAAK,EAAK,EAAG,KAAI,KAAK,IAC1D,EAAU,GAAV,EAAkB,GAAlB,EAAyB,GAAzB,EAAgC,GAAhC,EAAuC,GAAvC,EAA8C,IAC9C,EAAO,GACL,GAAM,GAAQ,GAAM,EACb,EAAK,EACZ,GAAM,GAAO,GAAM,EACZ,GAAM,EAAM,IACnB,GAAM,GAAO,GAAM,EACZ,GAAM,EAAM,SADvB,EAIE,EAAO,IACT,MAAM,EAAI,cACV,IAAK,EAAI,GACL,OAAO,EAAI,GACf,MAAM,EAAK,EAAI,OAAQ,EAAK,EAAK,EACjC,GAAI,EAAK,EACL,OAAO,EAAI,GACf,MAAM,EAAQ,EAAI,GAClB,IAAK,IAAI,EAAK,EAAG,EAAK,EAAG,EAAK,EAAI,IAAM,GAAM,EAAG,CAC7C,MAAM,EAAK,EAAI,EAAI,WAAW,IACxB,EAAK,EAAI,EAAI,WAAW,EAAK,IACnC,QAAW,IAAP,QAA2B,IAAP,EACpB,OAAO,EAAI,GACf,EAAM,GAAW,GAAL,EAAU,CAC9B,CACI,OAAO,CAAK,EAEV,EAAY,GAAQ,EAAI,EAAK,EAAK,KAAS,UAC3C,EAAU,GAAM,OAAO,KAAO,EAAI,EAAI,EAAI,IAAI,YAC9C,EAAU,IAAI,KAChB,MAAM,EAAI,EAAI,EAAK,QAAO,CAAC,EAAK,IAAM,EAAM,EAAI,GAAG,QAAQ,IAC3D,IAAI,EAAM,EAEV,OADA,EAAK,SAAQ,IAAO,EAAE,IAAI,EAAG,GAAM,GAAO,EAAE,MAAM,IAC3C,CAAC,EAEN,EAAS,CAAC,EAAK,MACL,KAAR,GAAc,GAAM,KACpB,EAAI,gBAAkB,EAAM,QAAU,GACvC,IAAC,EAAI,EAAE,EAAK,GAAK,EAAI,EAAI,EAAI,GAAY,EAAI,GAChD,KAAa,KAAN,GAAU,CACb,MAAiB,EAAI,EAAI,EACnB,EAAI,EAAI,GADJ,EAAI,GAEd,EAAI,EAAG,EAAI,EAAG,EAAI,EAAU,EAAI,CACxC,CACI,OAAa,KAAN,EAAW,EAAE,EAAG,GAAM,EAAI,aAAa,EAE5C,EAAO,CAAC,EAAG,KACb,IAAI,EAAI,EACR,KAAO,KAAU,IACb,GAAK,EACL,GAAK,EAET,OAAO,CAAC,EAiBN,EAAM,+EACN,EAAU,CAAC,EAAG,KAChB,MAAM,EAAK,EAAE,EAAI,EAAI,GAEf,EAnBU,CAAC,IACjB,MACM,EADM,EAAI,EAAK,EACJ,EAAK,EAChB,EAAM,EAAK,EAAI,IAAM,EAAM,EAC3B,EAAM,EAAK,EAAI,IAAM,EAAK,EAC1B,EAAO,EAAK,EAAI,IAAM,EAAM,EAC5B,EAAO,EAAK,EAAK,KAAO,EAAO,EAC/B,EAAO,EAAK,EAAK,KAAO,EAAO,EAC/B,EAAO,EAAK,EAAK,KAAO,EAAO,EAC/B,EAAQ,EAAK,EAAK,KAAO,EAAO,EAChC,EAAQ,EAAK,EAAM,KAAO,EAAO,EACjC,EAAQ,EAAK,EAAM,KAAO,EAAO,EAEvC,MAAO,CAAE,UADU,EAAK,EAAM,IAAM,EAAK,EACrB,KAAI,EAMZ,CAAY,EADb,EAAE,EAAK,EAAK,IACS,UAChC,IAAI,EAAI,EAAE,EAAI,EAAK,GACnB,MAAM,EAAM,EAAE,EAAI,EAAI,GAChB,EAAQ,EACR,EAAQ,EAAE,EAAI,GACd,EAAW,IAAQ,EACnB,EAAW,IAAQ,GAAG,GACtB,EAAS,IAAQ,GAAG,EAAI,GAO9B,OANI,IACA,EAAI,IACJ,GAAY,KACZ,EAAI,GACY,MAAR,GAAP,EAAE,MACH,EAAI,GAAG,IACJ,CAAE,QAAS,GAAY,EAAU,MAAO,EAAG,EAEhD,EAAW,GAAS,EAAE,EAAO,GAAO,GAC1C,IAAI,EACJ,MAAM,EAAU,IAAI,IAAM,EAAI,eAAe,GACvC,EAAU,IAAI,IACF,mBAAV,EAAuB,KAAS,GAAK,EAAI,0BAC3C,EAAa,IACf,MAAM,EAAO,EAAO,MAAM,EAAG,IAC7B,EAAK,IAAM,IACX,EAAK,KAAO,IACZ,EAAK,KAAO,GACZ,MAAM,EAAS,EAAO,MAAM,GAAI,IAC1B,EAAS,EAAQ,GACjB,EAAQ,EAAE,IAAI,GACd,EAAa,EAAM,aACzB,MAAO,CAAE,OAAM,SAAQ,SAAQ,QAAO,aAAY,EAGhD,EAA6B,GAAS,EAAQ,EAAK,EAAM,KAAK,KAAK,GACnE,EAAwB,GAAS,EAAU,EAAQ,EAAK,EAAM,MAE9D,EAAqB,GAAS,EAA0B,GAAM,MAAK,GAAK,EAAE,aAE1E,EAAgB,GAAS,EAAqB,GAAM,WAC1D,SAAS,EAAW,EAAc,GAC9B,OAAI,EACO,EAAQ,EAAI,UAAU,KAAK,EAAI,QACnC,EAAI,OAAO,EAAQ,EAAI,UAClC,CACA,MAAM,EAAQ,CAAC,EAAG,EAAQ,KACtB,MAAQ,WAAY,EAAG,OAAQ,GAAM,EAC/B,EAAI,EAAQ,GACZ,EAAI,EAAE,IAAI,GAAG,aAMnB,MAAO,CAAE,SALQ,EAAQ,EAAG,EAAG,GAKZ,OAJH,IACZ,MAAM,EAAI,EAAE,EAAI,EAAQ,GAAU,EAAG,GACrC,OAAO,EAAI,EAAQ,EAAG,EAAS,IAAK,GAAG,EAEhB,EAGzB,EAAY,MAAO,EAAK,KAC1B,MAAM,EAAI,EAAK,GACT,QAAU,EAA0B,GACpC,QAAe,EAAQ,EAAE,OAAQ,GACvC,OAAO,GAAW,EAAM,EAAM,EAAG,EAAQ,GAAG,EAG1C,EAAO,CAAC,EAAK,KACf,MAAM,EAAI,EAAK,GACT,EAAI,EAAqB,GACzB,EAAS,EAAQ,EAAE,OAAQ,GACjC,OAAO,GAAW,EAAO,EAAM,EAAG,EAAQ,GAAG,EAE3C,EAAM,CAAE,QAAQ,GAChB,EAAU,CAAC,EAAK,EAAK,EAAK,EAAO,KACnC,EAAM,EAAK,EAAK,IAChB,EAAM,EAAK,GACX,EAAM,EAAK,EAAK,IAChB,MAAM,OAAE,GAAW,EACnB,IAAI,EAAG,EAAG,EAAG,EAAI,EAAW,IAAI,WAChC,IACI,EAAI,EAAM,QAAQ,EAAK,GACvB,EAAI,EAAM,QAAQ,EAAI,MAAM,EAAG,IAAK,GACpC,EAAI,EAAO,EAAI,MAAM,GAAI,KACzB,EAAK,EAAE,IAAI,GAAG,GACd,EAAW,EAAQ,EAAE,aAAc,EAAE,aAAc,EAC3D,CACI,MAAO,GAAO,CAUd,MAAO,CAAE,WAAU,OATH,IACZ,GAAU,MAAN,EACA,OAAO,EACX,IAAK,GAAU,EAAE,eACb,OAAO,EACX,MAAM,EAAI,EAAQ,GAElB,OADY,EAAE,IAAI,EAAE,IAAI,GAAG,IAChB,IAAI,EAAG,UAAU,gBAAgB,KAAK,EAE1B,EAIzB,EAAc,MAAO,EAAG,EAAG,EAAG,EAAO,IAAQ,GAAW,EAAM,EAAQ,EAAG,EAAG,EAAG,IAE/E,EAAS,CAAC,EAAG,EAAG,EAAG,EAAO,IAAQ,GAAW,EAAO,EAAQ,EAAG,EAAG,EAAG,IACrE,EAAK,IACY,iBAAf,YAA2B,WAAY,WAAa,WAAW,YAAS,EAE1E,EAAM,CACR,WAAY,EACZ,WAAY,EACZ,YAAa,EACb,IAAK,EACL,OAAQ,EACR,YAAa,CAAC,EAAM,MAChB,MAAM,EAAI,IAKV,OAFK,GAAM,EAAE,iBACT,EAAI,0CACD,EAAE,gBAAgB,EAAI,GAAK,EAEtC,YAAa,SAAU,KACnB,MAAM,EAAI,IACJ,EAAI,GAAK,EAAE,OACZ,GACD,EAAI,oDACR,MAAM,EAAI,KAAW,GACrB,OAAO,QAAU,EAAE,OAAO,UAAW,EAAE,QAAQ,EAEnD,gBAAY,GAEhB,OAAO,iBAAiB,EAAK,CAAE,WAAY,CACnC,cAAc,EAAO,IAAG,IAAY,EAAU,GAAA,CAAI,GAAU,IACxD,EAAQ,EAAE,KAGjB,MAAC,EAAQ,CACV,0BAA2B,EAC3B,qBAAsB,EACtB,iBAAkB,IAAM,EAAI,YAAY,IACxC,WAAY,CAAC,EAAI,EAAG,EAAI,KAAQ,EAAE,SAAS,IAAe,IAkB9D,IAAI,EACJ,MAAM,EAAQ,IAEV,MAAM,EAAO,IAAU,EAlBR,MACf,MAAM,EAAS,GAEf,IAAI,EAAI,EAAG,EAAI,EACf,IAAK,IAAI,EAAI,EAAG,EAFA,GAEa,IAAK,CAC9B,EAAI,EACJ,EAAO,KAAK,GACZ,IAAK,IAAI,EAAI,EAAG,EAAI,IAAc,IAC9B,EAAI,EAAE,IAAI,GACV,EAAO,KAAK,GAEhB,EAAI,EAAE,QACd,CACI,OAAO,CAAM,EAKkB,IACzB,EAAM,CAAC,EAAK,KAAQ,IAAI,EAAI,EAAE,SAAU,OAAO,EAAM,EAAI,CAAC,EAChE,IAAI,EAAI,EAAG,EAAI,EACf,MAEM,EAAO,OAAO,KAEd,EAAU,OA1BV,GA2BN,IAAK,IAAI,EAAI,EAAG,EALA,GAKa,IAAK,CAC9B,MAAM,EALI,IAKE,EACZ,IAAI,EAAQ,OAAO,EAAI,GACvB,IAAM,EACF,EARM,MASN,GAPO,IAQP,GAAK,IAET,MAAM,EAAO,EAAK,EAAO,EAAM,KAAK,IAAI,GAAS,EAC3C,EAAO,EAAI,GAAM,EAAG,EAAO,EAAQ,EAC3B,IAAV,EACA,EAAI,EAAE,IAAI,EAAI,EAAM,EAAK,KAGzB,EAAI,EAAE,IAAI,EAAI,EAAM,EAAK,IAErC,CACI,MAAO,CAAE,IAAG,IAAG,S","file":"/npm/@noble/ed25519@2.2.3/index.js/+esm","sourceRoot":"","sourcesContent":["/**\n * Bundled by jsDelivr using Rollup v2.79.2 and Terser v5.39.0.\n * Original file: /npm/@noble/ed25519@2.2.3/index.js\n *\n * Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files\n */\n","/*! noble-ed25519 - MIT License (c) 2019 Paul Miller (paulmillr.com) */\n/**\n * 4KB JS implementation of ed25519 EDDSA signatures compliant with RFC8032, FIPS 186-5 & ZIP215.\n * @module\n */\nconst P = 2n ** 255n - 19n; // ed25519 is twisted edwards curve\nconst N = 2n ** 252n + 27742317777372353535851937790883648493n; // curve's (group) order\nconst Gx = 0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51an; // base point x\nconst Gy = 0x6666666666666666666666666666666666666666666666666666666666666658n; // base point y\nconst _d = 37095705934669439343138083508754565189542113879843219016388785533085940283555n;\n/**\n * ed25519 curve parameters. Equation is −x² + y² = -a + dx²y².\n * Gx and Gy are generator coordinates. p is field order, n is group order.\n * h is cofactor.\n */\nconst CURVE = {\n    a: -1n, // -1 mod p\n    d: _d, // -(121665/121666) mod p\n    p: P, n: N, h: 8, Gx: Gx, Gy: Gy // field prime, curve (group) order, cofactor\n};\nconst err = (m = '') => { throw new Error(m); }; // error helper, messes-up stack trace\nconst isS = (s) => typeof s === 'string'; // is string\nconst isu8 = (a) => (a instanceof Uint8Array || (ArrayBuffer.isView(a) && a.constructor.name === 'Uint8Array'));\nconst au8 = (a, l) => // is Uint8Array (of specific length)\n !isu8(a) || (typeof l === 'number' && l > 0 && a.length !== l) ?\n    err('Uint8Array of valid length expected') : a;\nconst u8n = (data) => new Uint8Array(data); // creates Uint8Array\nconst toU8 = (a, len) => au8(isS(a) ? h2b(a) : u8n(au8(a)), len); // norm(hex/u8a) to u8a\nconst M = (a, b = P) => { let r = a % b; return r >= 0n ? r : b + r; }; // mod division\nconst isPoint = (p) => (p instanceof Point ? p : err('Point expected')); // is xyzt point\n/** Point in xyzt extended coordinates. */\nclass Point {\n    constructor(ex, ey, ez, et) {\n        this.ex = ex;\n        this.ey = ey;\n        this.ez = ez;\n        this.et = et;\n    }\n    static fromAffine(p) { return new Point(p.x, p.y, 1n, M(p.x * p.y)); }\n    /** RFC8032 5.1.3: hex / Uint8Array to Point. */\n    static fromHex(hex, zip215 = false) {\n        const { d } = CURVE;\n        hex = toU8(hex, 32);\n        const normed = hex.slice(); // copy the array to not mess it up\n        const lastByte = hex[31];\n        normed[31] = lastByte & ~0x80; // adjust first LE byte = last BE byte\n        const y = b2n_LE(normed); // decode as little-endian, convert to num\n        if (zip215 && !(0n <= y && y < 2n ** 256n))\n            err('bad y coord 1'); // zip215=true  [1..2^256-1]\n        if (!zip215 && !(0n <= y && y < P))\n            err('bad y coord 2'); // zip215=false [1..P-1]\n        const y2 = M(y * y); // y²\n        const u = M(y2 - 1n); // u=y²-1\n        const v = M(d * y2 + 1n); // v=dy²+1\n        let { isValid, value: x } = uvRatio(u, v); // (uv³)(uv⁷)^(p-5)/8; square root\n        if (!isValid)\n            err('bad y coordinate 3'); // not square root: bad point\n        const isXOdd = (x & 1n) === 1n; // adjust sign of x coordinate\n        const isLastByteOdd = (lastByte & 0x80) !== 0; // x_0, last bit\n        if (!zip215 && x === 0n && isLastByteOdd)\n            err('bad y coord 3'); // x=0 and x_0 = 1\n        if (isLastByteOdd !== isXOdd)\n            x = M(-x);\n        return new Point(x, y, 1n, M(x * y)); // Z=1, T=xy\n    }\n    get x() { return this.toAffine().x; } // .x, .y will call expensive toAffine.\n    get y() { return this.toAffine().y; } // Should be used with care.\n    equals(other) {\n        const { ex: X1, ey: Y1, ez: Z1 } = this;\n        const { ex: X2, ey: Y2, ez: Z2 } = isPoint(other); // isPoint() checks class equality\n        const X1Z2 = M(X1 * Z2), X2Z1 = M(X2 * Z1);\n        const Y1Z2 = M(Y1 * Z2), Y2Z1 = M(Y2 * Z1);\n        return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;\n    }\n    is0() { return this.equals(I); }\n    negate() {\n        return new Point(M(-this.ex), this.ey, this.ez, M(-this.et));\n    }\n    /** Point doubling. Complete formula. */\n    double() {\n        const { ex: X1, ey: Y1, ez: Z1 } = this; // Cost: 4M + 4S + 1*a + 6add + 1*2\n        const { a } = CURVE; // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd\n        const A = M(X1 * X1);\n        const B = M(Y1 * Y1);\n        const C = M(2n * M(Z1 * Z1));\n        const D = M(a * A);\n        const x1y1 = X1 + Y1;\n        const E = M(M(x1y1 * x1y1) - A - B);\n        const G = D + B;\n        const F = G - C;\n        const H = D - B;\n        const X3 = M(E * F);\n        const Y3 = M(G * H);\n        const T3 = M(E * H);\n        const Z3 = M(F * G);\n        return new Point(X3, Y3, Z3, T3);\n    }\n    /** Point addition. Complete formula. */\n    add(other) {\n        const { ex: X1, ey: Y1, ez: Z1, et: T1 } = this; // Cost: 8M + 1*k + 8add + 1*2.\n        const { ex: X2, ey: Y2, ez: Z2, et: T2 } = isPoint(other); // doesn't check if other on-curve\n        const { a, d } = CURVE; // http://hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html#addition-add-2008-hwcd-3\n        const A = M(X1 * X2);\n        const B = M(Y1 * Y2);\n        const C = M(T1 * d * T2);\n        const D = M(Z1 * Z2);\n        const E = M((X1 + Y1) * (X2 + Y2) - A - B);\n        const F = M(D - C);\n        const G = M(D + C);\n        const H = M(B - a * A);\n        const X3 = M(E * F);\n        const Y3 = M(G * H);\n        const T3 = M(E * H);\n        const Z3 = M(F * G);\n        return new Point(X3, Y3, Z3, T3);\n    }\n    mul(n, safe = true) {\n        if (n === 0n)\n            return safe === true ? err('cannot multiply by 0') : I;\n        if (!(typeof n === 'bigint' && 0n < n && n < N))\n            err('invalid scalar, must be < L');\n        if (!safe && this.is0() || n === 1n)\n            return this; // safe=true bans 0. safe=false allows 0.\n        if (this.equals(G))\n            return wNAF(n).p; // use wNAF precomputes for base points\n        let p = I, f = G; // init result point & fake point\n        for (let d = this; n > 0n; d = d.double(), n >>= 1n) { // double-and-add ladder\n            if (n & 1n)\n                p = p.add(d); // if bit is present, add to point\n            else if (safe)\n                f = f.add(d); // if not, add to fake for timing safety\n        }\n        return p;\n    }\n    multiply(scalar) { return this.mul(scalar); } // Aliases for compatibilty\n    clearCofactor() { return this.mul(BigInt(CURVE.h), false); } // multiply by cofactor\n    isSmallOrder() { return this.clearCofactor().is0(); } // check if P is small order\n    isTorsionFree() {\n        let p = this.mul(N / 2n, false).double(); // ensures the point is not \"bad\".\n        if (N % 2n)\n            p = p.add(this); // P^(N+1)             // P*N == (P*(N/2))*2+P\n        return p.is0();\n    }\n    /** converts point to 2d xy affine point. (x, y, z, t) ∋ (x=x/z, y=y/z, t=xy). */\n    toAffine() {\n        const { ex: x, ey: y, ez: z } = this;\n        if (this.equals(I))\n            return { x: 0n, y: 1n }; // fast-path for zero point\n        const iz = invert(z, P); // z^-1: invert z\n        if (M(z * iz) !== 1n)\n            err('invalid inverse'); // (z * z^-1) must be 1, otherwise bad math\n        return { x: M(x * iz), y: M(y * iz) }; // x = x*z^-1; y = y*z^-1\n    }\n    toRawBytes() {\n        const { x, y } = this.toAffine(); // convert to affine 2d point\n        const b = n2b_32LE(y); // encode number to 32 bytes\n        b[31] |= x & 1n ? 0x80 : 0; // store sign in first LE byte\n        return b;\n    }\n    toHex() { return b2h(this.toRawBytes()); } // encode to hex string\n}\n/** Generator / Base point */\nPoint.BASE = new Point(Gx, Gy, 1n, M(Gx * Gy));\n/** Identity / Zero point */\nPoint.ZERO = new Point(0n, 1n, 1n, 0n);\nconst { BASE: G, ZERO: I } = Point; // Generator, identity points\nconst padh = (num, pad) => num.toString(16).padStart(pad, '0');\nconst b2h = (b) => Array.from(au8(b)).map(e => padh(e, 2)).join(''); // bytes to hex\nconst C = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 }; // ASCII characters\nconst _ch = (ch) => {\n    if (ch >= C._0 && ch <= C._9)\n        return ch - C._0; // '2' => 50-48\n    if (ch >= C.A && ch <= C.F)\n        return ch - (C.A - 10); // 'B' => 66-(65-10)\n    if (ch >= C.a && ch <= C.f)\n        return ch - (C.a - 10); // 'b' => 98-(97-10)\n    return;\n};\nconst h2b = (hex) => {\n    const e = 'hex invalid';\n    if (!isS(hex))\n        return err(e);\n    const hl = hex.length, al = hl / 2;\n    if (hl % 2)\n        return err(e);\n    const array = u8n(al);\n    for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) { // treat each char as ASCII\n        const n1 = _ch(hex.charCodeAt(hi)); // parse first char, multiply it by 16\n        const n2 = _ch(hex.charCodeAt(hi + 1)); // parse second char\n        if (n1 === undefined || n2 === undefined)\n            return err(e);\n        array[ai] = n1 * 16 + n2; // example: 'A9' => 10*16 + 9\n    }\n    return array;\n};\nconst n2b_32LE = (num) => h2b(padh(num, 32 * 2)).reverse(); // number to bytes LE\nconst b2n_LE = (b) => BigInt('0x' + b2h(u8n(au8(b)).reverse())); // bytes LE to num\nconst concatB = (...arrs) => {\n    const r = u8n(arrs.reduce((sum, a) => sum + au8(a).length, 0)); // create u8a of summed length\n    let pad = 0; // walk through each array,\n    arrs.forEach(a => { r.set(a, pad); pad += a.length; }); // ensure they have proper type\n    return r;\n};\nconst invert = (num, md) => {\n    if (num === 0n || md <= 0n)\n        err('no inverse n=' + num + ' mod=' + md); // no neg exponent for now\n    let a = M(num, md), b = md, x = 0n, y = 1n, u = 1n, v = 0n;\n    while (a !== 0n) { // uses euclidean gcd algorithm\n        const q = b / a, r = b % a; // not constant-time\n        const m = x - u * q, n = y - v * q;\n        b = a, a = r, x = u, y = v, u = m, v = n;\n    }\n    return b === 1n ? M(x, md) : err('no inverse'); // b is gcd at this point\n};\nconst pow2 = (x, power) => {\n    let r = x;\n    while (power-- > 0n) {\n        r *= r;\n        r %= P;\n    }\n    return r;\n};\nconst pow_2_252_3 = (x) => {\n    const x2 = (x * x) % P; // x^2,       bits 1\n    const b2 = (x2 * x) % P; // x^3,       bits 11\n    const b4 = (pow2(b2, 2n) * b2) % P; // x^(2^4-1), bits 1111\n    const b5 = (pow2(b4, 1n) * x) % P; // x^(2^5-1), bits 11111\n    const b10 = (pow2(b5, 5n) * b5) % P; // x^(2^10)\n    const b20 = (pow2(b10, 10n) * b10) % P; // x^(2^20)\n    const b40 = (pow2(b20, 20n) * b20) % P; // x^(2^40)\n    const b80 = (pow2(b40, 40n) * b40) % P; // x^(2^80)\n    const b160 = (pow2(b80, 80n) * b80) % P; // x^(2^160)\n    const b240 = (pow2(b160, 80n) * b80) % P; // x^(2^240)\n    const b250 = (pow2(b240, 10n) * b10) % P; // x^(2^250)\n    const pow_p_5_8 = (pow2(b250, 2n) * x) % P; // < To pow to (p+3)/8, multiply it by x.\n    return { pow_p_5_8, b2 };\n};\nconst RM1 = 19681161376707505956807079304988542015446066515923890162744021073123829784752n; // √-1\nconst uvRatio = (u, v) => {\n    const v3 = M(v * v * v); // v³\n    const v7 = M(v3 * v3 * v); // v⁷\n    const pow = pow_2_252_3(u * v7).pow_p_5_8; // (uv⁷)^(p-5)/8\n    let x = M(u * v3 * pow); // (uv³)(uv⁷)^(p-5)/8\n    const vx2 = M(v * x * x); // vx²\n    const root1 = x; // First root candidate\n    const root2 = M(x * RM1); // Second root candidate; RM1 is √-1\n    const useRoot1 = vx2 === u; // If vx² = u (mod p), x is a square root\n    const useRoot2 = vx2 === M(-u); // If vx² = -u, set x <-- x * 2^((p-1)/4)\n    const noRoot = vx2 === M(-u * RM1); // There is no valid root, vx² = -u√-1\n    if (useRoot1)\n        x = root1;\n    if (useRoot2 || noRoot)\n        x = root2; // We return root2 anyway, for const-time\n    if ((M(x) & 1n) === 1n)\n        x = M(-x); // edIsNegative\n    return { isValid: useRoot1 || useRoot2, value: x };\n};\nconst modL_LE = (hash) => M(b2n_LE(hash), N); // modulo L; but little-endian\nlet _shaS;\nconst sha512a = (...m) => etc.sha512Async(...m); // Async SHA512\nconst sha512s = (...m) => // Sync SHA512, not set by default\n typeof _shaS === 'function' ? _shaS(...m) : err('etc.sha512Sync not set');\nconst hash2extK = (hashed) => {\n    const head = hashed.slice(0, 32); // slice creates a copy, unlike subarray\n    head[0] &= 248; // Clamp bits: 0b1111_1000,\n    head[31] &= 127; // 0b0111_1111,\n    head[31] |= 64; // 0b0100_0000\n    const prefix = hashed.slice(32, 64); // private key \"prefix\"\n    const scalar = modL_LE(head); // modular division over curve order\n    const point = G.mul(scalar); // public key point\n    const pointBytes = point.toRawBytes(); // point serialized to Uint8Array\n    return { head, prefix, scalar, point, pointBytes };\n};\n// RFC8032 5.1.5; getPublicKey async, sync. Hash priv key and extract point.\nconst getExtendedPublicKeyAsync = (priv) => sha512a(toU8(priv, 32)).then(hash2extK);\nconst getExtendedPublicKey = (priv) => hash2extK(sha512s(toU8(priv, 32)));\n/** Creates 32-byte ed25519 public key from 32-byte private key. Async. */\nconst getPublicKeyAsync = (priv) => getExtendedPublicKeyAsync(priv).then(p => p.pointBytes);\n/** Creates 32-byte ed25519 public key from 32-byte private key. To use, set `etc.sha512Sync` first. */\nconst getPublicKey = (priv) => getExtendedPublicKey(priv).pointBytes;\nfunction hashFinish(asynchronous, res) {\n    if (asynchronous)\n        return sha512a(res.hashable).then(res.finish);\n    return res.finish(sha512s(res.hashable));\n}\nconst _sign = (e, rBytes, msg) => {\n    const { pointBytes: P, scalar: s } = e;\n    const r = modL_LE(rBytes); // r was created outside, reduce it modulo L\n    const R = G.mul(r).toRawBytes(); // R = [r]B\n    const hashable = concatB(R, P, msg); // dom2(F, C) || R || A || PH(M)\n    const finish = (hashed) => {\n        const S = M(r + modL_LE(hashed) * s, N); // S = (r + k * s) mod L; 0 <= s < l\n        return au8(concatB(R, n2b_32LE(S)), 64); // 64-byte sig: 32b R.x + 32b LE(S)\n    };\n    return { hashable, finish };\n};\n/** Signs message (NOT message hash) using private key. Async. */\nconst signAsync = async (msg, privKey) => {\n    const m = toU8(msg); // RFC8032 5.1.6: sign msg with key async\n    const e = await getExtendedPublicKeyAsync(privKey); // pub,prfx\n    const rBytes = await sha512a(e.prefix, m); // r = SHA512(dom2(F, C) || prefix || PH(M))\n    return hashFinish(true, _sign(e, rBytes, m)); // gen R, k, S, then 64-byte signature\n};\n/** Signs message (NOT message hash) using private key. To use, set `etc.sha512Sync` first. */\nconst sign = (msg, privKey) => {\n    const m = toU8(msg); // RFC8032 5.1.6: sign msg with key sync\n    const e = getExtendedPublicKey(privKey); // pub,prfx\n    const rBytes = sha512s(e.prefix, m); // r = SHA512(dom2(F, C) || prefix || PH(M))\n    return hashFinish(false, _sign(e, rBytes, m)); // gen R, k, S, then 64-byte signature\n};\nconst dvo = { zip215: true };\nconst _verify = (sig, msg, pub, opts = dvo) => {\n    sig = toU8(sig, 64); // Signature hex str/Bytes, must be 64 bytes\n    msg = toU8(msg); // Message hex str/Bytes\n    pub = toU8(pub, 32);\n    const { zip215 } = opts; // switch between zip215 and rfc8032 verif\n    let A, R, s, SB, hashable = new Uint8Array();\n    try {\n        A = Point.fromHex(pub, zip215); // public key A decoded\n        R = Point.fromHex(sig.slice(0, 32), zip215); // 0 <= R < 2^256: ZIP215 R can be >= P\n        s = b2n_LE(sig.slice(32, 64)); // Decode second half as an integer S\n        SB = G.mul(s, false); // in the range 0 <= s < L\n        hashable = concatB(R.toRawBytes(), A.toRawBytes(), msg); // dom2(F, C) || R || A || PH(M)\n    }\n    catch (error) { }\n    const finish = (hashed) => {\n        if (SB == null)\n            return false; // false if try-catch catched an error\n        if (!zip215 && A.isSmallOrder())\n            return false; // false for SBS: Strongly Binding Signature\n        const k = modL_LE(hashed); // decode in little-endian, modulo L\n        const RkA = R.add(A.mul(k, false)); // [8]R + [8][k]A'\n        return RkA.add(SB.negate()).clearCofactor().is0(); // [8][S]B = [8]R + [8][k]A'\n    };\n    return { hashable, finish };\n};\n// RFC8032 5.1.7: verification async, sync\n/** Verifies signature on message and public key. Async. */\nconst verifyAsync = async (s, m, p, opts = dvo) => hashFinish(true, _verify(s, m, p, opts));\n/** Verifies signature on message and public key. To use, set `etc.sha512Sync` first. */\nconst verify = (s, m, p, opts = dvo) => hashFinish(false, _verify(s, m, p, opts));\nconst cr = () => // We support: 1) browsers 2) node.js 19+\n typeof globalThis === 'object' && 'crypto' in globalThis ? globalThis.crypto : undefined;\n/** Math, hex, byte helpers. Not in `utils` because utils share API with noble-curves. */\nconst etc = {\n    bytesToHex: b2h,\n    hexToBytes: h2b,\n    concatBytes: concatB,\n    mod: M,\n    invert: invert,\n    randomBytes: (len = 32) => {\n        const c = cr(); // Can be shimmed in node.js <= 18 to prevent error:\n        // import { webcrypto } from 'node:crypto';\n        // if (!globalThis.crypto) globalThis.crypto = webcrypto;\n        if (!c || !c.getRandomValues)\n            err('crypto.getRandomValues must be defined');\n        return c.getRandomValues(u8n(len));\n    },\n    sha512Async: async (...messages) => {\n        const c = cr();\n        const s = c && c.subtle;\n        if (!s)\n            err('etc.sha512Async or crypto.subtle must be defined');\n        const m = concatB(...messages);\n        return u8n(await s.digest('SHA-512', m.buffer));\n    },\n    sha512Sync: undefined, // Actual logic below\n};\nObject.defineProperties(etc, { sha512Sync: {\n        configurable: false, get() { return _shaS; }, set(f) { if (!_shaS)\n            _shaS = f; },\n    } });\n/** ed25519-specific key utilities. */\nconst utils = {\n    getExtendedPublicKeyAsync: getExtendedPublicKeyAsync,\n    getExtendedPublicKey: getExtendedPublicKey,\n    randomPrivateKey: () => etc.randomBytes(32),\n    precompute: (w = 8, p = G) => { p.multiply(3n); w; return p; }, // no-op\n};\nconst W = 8; // Precomputes-related code. W = window size\nconst precompute = () => {\n    const points = []; // 10x sign(), 2x verify(). To achieve this,\n    const windows = 256 / W + 1; // app needs to spend 40ms+ to calculate\n    let p = G, b = p; // a lot of points related to base point G.\n    for (let w = 0; w < windows; w++) { // Points are stored in array and used\n        b = p; // any time Gx multiplication is done.\n        points.push(b); // They consume 16-32 MiB of RAM.\n        for (let i = 1; i < 2 ** (W - 1); i++) {\n            b = b.add(p);\n            points.push(b);\n        }\n        p = b.double(); // Precomputes don't speed-up getSharedKey,\n    } // which multiplies user point by scalar,\n    return points; // when precomputes are using base point\n};\nlet Gpows = undefined; // precomputes for base point G\nconst wNAF = (n) => {\n    // Compared to other point mult methods,\n    const comp = Gpows || (Gpows = precompute()); // stores 2x less points using subtraction\n    const neg = (cnd, p) => { let n = p.negate(); return cnd ? n : p; }; // negate\n    let p = I, f = G; // f must be G, or could become I in the end\n    const windows = 1 + 256 / W; // W=8 17 windows\n    const wsize = 2 ** (W - 1); // W=8 128 window size\n    const mask = BigInt(2 ** W - 1); // W=8 will create mask 0b11111111\n    const maxNum = 2 ** W; // W=8 256\n    const shiftBy = BigInt(W); // W=8 8\n    for (let w = 0; w < windows; w++) {\n        const off = w * wsize;\n        let wbits = Number(n & mask); // extract W bits.\n        n >>= shiftBy; // shift number by W bits.\n        if (wbits > wsize) {\n            wbits -= maxNum;\n            n += 1n;\n        } // split if bits > max: +224 => 256-32\n        const off1 = off, off2 = off + Math.abs(wbits) - 1; // offsets, evaluate both\n        const cnd1 = w % 2 !== 0, cnd2 = wbits < 0; // conditions, evaluate both\n        if (wbits === 0) {\n            f = f.add(neg(cnd1, comp[off1])); // bits are 0: add garbage to fake point\n        }\n        else { //          ^ can't add off2, off2 = I\n            p = p.add(neg(cnd2, comp[off2])); // bits are 1: add to result point\n        }\n    }\n    return { p, f }; // return both real and fake points for JIT\n}; // !! you can disable precomputes by commenting-out call of the wNAF() inside Point#mul()\nexport { getPublicKey, getPublicKeyAsync, sign, verify, // Remove the export to easily use in REPL\nsignAsync, verifyAsync, CURVE, etc, utils, Point as ExtendedPoint }; // envs like browser console\n"]}