/**
 * RFC 9497: Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups.
 * https://www.rfc-editor.org/rfc/rfc9497
 *

OPRF allows to interactively create an `Output = PRF(Input, serverSecretKey)`:

- Server cannot calculate Output by itself: it doesn't know Input
- Client cannot calculate Output by itself: it doesn't know server secretKey
- An attacker interception the communication can't restore Input/Output/serverSecretKey and can't
  link Input to some value.

## Issues

- Low-entropy inputs (e.g. password '123') enable brute-forced dictionary attacks by the server
  (solveable by domain separation in POPRF)
- High-level protocol needs to be constructed on top, because OPRF is low-level

## Use cases

1. **Password-Authenticated Key Exchange (PAKE):** Enables secure password login (e.g., OPAQUE)
   without revealing the password to the server.
2. **Private Set Intersection (PSI):** Allows two parties to compute the intersection of their
   private sets without revealing non-intersecting elements.
3. **Anonymous Credential Systems:** Supports issuance of anonymous, unlinkable credentials
   (e.g., Privacy Pass) using blind OPRF evaluation.
4. **Private Information Retrieval (PIR):** Helps users query databases without revealing which
   item they accessed.
5. **Encrypted Search / Secure Indexing:** Enables keyword search over encrypted data while keeping
   queries private.
6. **Spam Prevention and Rate-Limiting:** Issues anonymous tokens to prevent abuse
   (e.g., CAPTCHA bypass) without compromising user privacy.

## Modes

- OPRF: simple mode, client doesn't need to know server public key
- VOPRF: verifable mode, allows client to verify that server used secret key corresponding to known public key
- POPRF: partially oblivious mode, VOPRF + domain separation

There is also non-interactive mode (Evaluate) that supports creating Output in non-interactive mode with knowledge of secret key.

Flow:
- (once) Server generates secret and public keys, distributes public keys to clients
  - deterministically: `deriveKeyPair` or just random: `generateKeyPair`
- Client blinds input: `blind(secretInput)`
- Server evaluates blinded input: `blindEvaluate` generated by client, sends result to client
- Client creates output using result of evaluation via 'finalize'

 * @module
 */
/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
import {
  abytes,
  asciiToBytes,
  bytesToNumberBE,
  bytesToNumberLE,
  concatBytes,
  numberToBytesBE,
  randomBytes,
  validateObject,
} from '../utils.ts';
import { pippenger, type CurvePoint, type CurvePointCons } from './curve.ts';
import { _DST_scalar, type H2CDSTOpts } from './hash-to-curve.ts';
import { getMinHashLength, mapHashToField } from './modular.ts';

// OPRF is designed to be used across network, so we default to serialized values.
export type PointBytes = Uint8Array;
export type ScalarBytes = Uint8Array;
export type Bytes = Uint8Array;
export type RNG = typeof randomBytes;

export type OPRFOpts<P extends CurvePoint<any, P>> = {
  name: string;
  Point: CurvePointCons<P>; // we don't return Point, so we need generic interface only
  // Fn: IField<bigint>;
  hash(msg: Bytes): Bytes;
  hashToScalar(msg: Uint8Array, options: H2CDSTOpts): bigint;
  hashToGroup(msg: Uint8Array, options: H2CDSTOpts): P;
};

export type OPRFKeys = { secretKey: ScalarBytes; publicKey: PointBytes };
export type OPRFBlind = { blind: Uint8Array; blinded: Uint8Array };
export type OPRFBlindEval = { evaluated: PointBytes; proof: Bytes };
export type OPRFBlindEvalBatch = { evaluated: PointBytes[]; proof: Bytes };
export type OPRFFinalizeItem = {
  input: Bytes;
  blind: ScalarBytes;
  evaluated: PointBytes;
  blinded: PointBytes;
};

/**
 * Represents a full OPRF ciphersuite implementation according to RFC 9497.
 * This object bundles the three protocol variants (OPRF, VOPRF, POPRF) for a specific
 * prime-order group and hash function combination.
 *
 * @see https://www.rfc-editor.org/rfc/rfc9497.html
 */
export type OPRF = {
  /**
   * The unique identifier for the ciphersuite, e.g., "ristretto255-SHA512".
   * This name is used for domain separation to prevent cross-protocol attacks.
   */
  readonly name: string;

  /**
   * The base Oblivious Pseudorandom Function (OPRF) mode (mode 0x00).
   * This is a two-party protocol between a client and a server to compute F(k, x)
   * where 'k' is the server's key and 'x' is the client's input.
   *
   * The client learns the output F(k, x) but nothing about 'k'.
   * The server learns nothing about 'x' or F(k, x).
   * This mode is NOT verifiable; the client cannot prove the server used a specific key.
   */
  readonly oprf: {
    /**
     * (Server-side) Generates a new random private/public key pair for the server.
     * @returns A new key pair.
     */
    generateKeyPair(): OPRFKeys;

    /**
     * (Server-side) Deterministically derives a private/public key pair from a seed.
     * @param seed A 32-byte cryptographically secure random seed.
     * @param keyInfo An optional byte string for domain separation.
     * @returns The derived key pair.
     */
    deriveKeyPair(seed: Bytes, keyInfo: Bytes): OPRFKeys;

    /**
     * (Client-side) The first step of the protocol. The client blinds its private input.
     * @param input The client's private input bytes.
     * @param rng An optional cryptographically secure random number generator.
     * @returns An object containing the `blind` scalar (which the client MUST keep secret)
     * and the `blinded` element (which the client sends to the server).
     */
    blind(input: Bytes, rng?: RNG): OPRFBlind;

    /**
     * (Server-side) The second step. The server evaluates the client's blinded element
     * using its secret key.
     * @param secretKey The server's private key.
     * @param blinded The blinded group element received from the client.
     * @returns The evaluated group element, to be sent back to the client.
     */
    blindEvaluate(secretKey: ScalarBytes, blinded: PointBytes): PointBytes;

    /**
     * (Client-side) The final step. The client unblinds the server's response to
     * compute the final OPRF output.
     * @param input The original private input from the `blind` step.
     * @param blind The secret scalar from the `blind` step.
     * @param evaluated The evaluated group element received from the server.
     * @returns The final OPRF output, `Hash(len(input)||input||len(unblinded)||unblinded||"Finalize")`.
     */
    finalize(input: Bytes, blind: ScalarBytes, evaluated: PointBytes): Bytes;
  };

  /**
   * The Verifiable Oblivious Pseudorandom Function (VOPRF) mode (mode 0x01).
   * This mode extends the base OPRF by providing a proof that the server used the
   * secret key corresponding to its known public key.
   */
  readonly voprf: {
    /** (Server-side) Generates a key pair for the VOPRF mode. */
    generateKeyPair(): OPRFKeys;
    /** (Server-side) Deterministically derives a key pair for the VOPRF mode. */
    deriveKeyPair(seed: Bytes, keyInfo: Bytes): OPRFKeys;
    /** (Client-side) Blinds the client's private input for the VOPRF protocol. */
    blind(input: Bytes, rng?: RNG): OPRFBlind;

    /**
     * (Server-side) Evaluates the client's blinded element and generates a DLEQ proof
     * of correctness.
     * @param secretKey The server's private key.
     * @param publicKey The server's public key, used in proof generation.
     * @param blinded The blinded group element received from the client.
     * @param rng An optional cryptographically secure random number generator for the proof.
     * @returns The evaluated element and a proof of correct computation.
     */
    blindEvaluate(
      secretKey: ScalarBytes,
      publicKey: PointBytes,
      blinded: PointBytes,
      rng?: RNG
    ): OPRFBlindEval;

    /**
     * (Server-side) An optimized batch version of `blindEvaluate`. It evaluates multiple
     * blinded elements and produces a single, constant-size proof for the entire batch,
     * amortizing the cost of proof generation.
     * @param secretKey The server's private key.
     * @param publicKey The server's public key.
     * @param blinded An array of blinded group elements from one or more clients.
     * @param rng An optional cryptographically secure random number generator for the proof.
     * @returns An array of evaluated elements and a single proof for the batch.
     */
    blindEvaluateBatch(
      secretKey: ScalarBytes,
      publicKey: PointBytes,
      blinded: PointBytes[],
      rng?: RNG
    ): OPRFBlindEvalBatch;

    /**
     * (Client-side) The final step. The client verifies the server's proof, and if valid,
     * unblinds the result to compute the final VOPRF output.
     * @param input The original private input.
     * @param blind The secret scalar from the `blind` step.
     * @param evaluated The evaluated element from the server.
     * @param blinded The blinded element sent to the server (needed for proof verification).
     * @param publicKey The server's public key against which the proof is verified.
     * @param proof The DLEQ proof from the server.
     * @returns The final VOPRF output.
     * @throws If the proof verification fails.
     */
    finalize(
      input: Bytes,
      blind: ScalarBytes,
      evaluated: PointBytes,
      blinded: PointBytes,
      publicKey: PointBytes,
      proof: Bytes
    ): Bytes;

    /**
     * (Client-side) The batch-aware version of `finalize`. It verifies a single batch proof
     * against a list of corresponding inputs and outputs.
     * @param items An array of objects, each containing the parameters for a single finalization.
     * @param publicKey The server's public key.
     * @param proof The single DLEQ proof for the entire batch.
     * @returns An array of final VOPRF outputs, one for each item in the input.
     * @throws If the proof verification fails.
     */
    finalizeBatch(items: OPRFFinalizeItem[], publicKey: PointBytes, proof: Bytes): Bytes[];
  };

  /**
   * A factory for the Partially Oblivious Pseudorandom Function (POPRF) mode (mode 0x02).
   * This mode extends VOPRF to include a public `info` parameter, known to both client and
   * server, which is cryptographically bound to the final output.
   * This is useful for domain separation at the application level.
   * @param info A public byte string to be mixed into the computation.
   * @returns An object with the POPRF protocol functions.
   */
  readonly poprf: (info: Bytes) => {
    /** (Server-side) Generates a key pair for the POPRF mode. */
    generateKeyPair(): OPRFKeys;
    /** (Server-side) Deterministically derives a key pair for the POPRF mode. */
    deriveKeyPair(seed: Bytes, keyInfo: Bytes): OPRFKeys;

    /**
     * (Client-side) Blinds the client's private input and computes the "tweaked key".
     * The tweaked key is a public value derived from the server's public key and the public `info`.
     * @param input The client's private input.
     * @param publicKey The server's public key.
     * @param rng An optional cryptographically secure random number generator.
     * @returns The `blind`, `blinded` element, and the `tweakedKey` which the client uses for verification.
     */
    blind(input: Bytes, publicKey: PointBytes, rng?: RNG): OPRFBlind & { tweakedKey: PointBytes };

    /**
     * (Server-side) Evaluates the blinded element using a key derived from its secret key and the public `info`.
     * It generates a DLEQ proof against the tweaked key.
     * @param secretKey The server's private key.
     * @param blinded The blinded element from the client.
     * @param rng An optional RNG for the proof.
     * @returns The evaluated element and a proof of correct computation.
     */
    blindEvaluate(secretKey: ScalarBytes, blinded: PointBytes, rng?: RNG): OPRFBlindEval;

    /**
     * (Server-side) A batch-aware version of `blindEvaluate` for the POPRF mode.
     * @param secretKey The server's private key.
     * @param blinded An array of blinded elements.
     * @param rng An optional RNG for the proof.
     * @returns An array of evaluated elements and a single proof for the batch.
     */
    blindEvaluateBatch(secretKey: ScalarBytes, blinded: PointBytes[], rng: RNG): OPRFBlindEvalBatch;

    /**
     * (Client-side) A batch-aware version of `finalize` for the POPRF mode.
     * It verifies the proof against the tweaked key.
     * @param items An array containing the parameters for each finalization.
     * @param proof The single DLEQ proof for the batch.
     * @param tweakedKey The tweaked key corresponding to the proof (all items must share the same `info` and `publicKey`).
     * @returns An array of final POPRF outputs.
     * @throws If proof verification fails.
     */
    finalizeBatch(items: OPRFFinalizeItem[], proof: Bytes, tweakedKey: PointBytes): Bytes[];

    /**
     * (Client-side) Finalizes the POPRF protocol. It verifies the server's proof against the
     * `tweakedKey` computed in the `blind` step. The final output is bound to the public `info`.
     * @param input The original private input.
     * @param blind The secret scalar.
     * @param evaluated The evaluated element from the server.
     * @param blinded The blinded element sent to the server.
     * @param proof The DLEQ proof from the server.
     * @param tweakedKey The public tweaked key computed by the client during the `blind` step.
     * @returns The final POPRF output.
     * @throws If proof verification fails.
     */
    finalize(
      input: Bytes,
      blind: ScalarBytes,
      evaluated: PointBytes,
      blinded: PointBytes,
      proof: Bytes,
      tweakedKey: PointBytes
    ): Bytes;

    /**
     * A non-interactive evaluation function for an entity that knows all inputs.
     * Computes the final POPRF output directly. Useful for testing or specific applications
     * where the server needs to compute the output for a known input.
     * @param secretKey The server's private key.
     * @param input The client's private input.
     * @returns The final POPRF output.
     */
    evaluate(secretKey: ScalarBytes, input: Bytes): Bytes;
  };
};

// welcome to generic hell
export function createORPF<P extends CurvePoint<any, P>>(opts: OPRFOpts<P>): OPRF {
  validateObject(opts, {
    name: 'string',
    hash: 'function',
    hashToScalar: 'function',
    hashToGroup: 'function',
  });
  // TODO
  // Point: 'point',
  const { name, Point, hash } = opts;
  const { Fn } = Point;

  const hashToGroup = (msg: Uint8Array, ctx: Uint8Array) =>
    opts.hashToGroup(msg, {
      DST: concatBytes(asciiToBytes('HashToGroup-'), ctx),
    }) as P;
  const hashToScalarPrefixed = (msg: Uint8Array, ctx: Uint8Array) =>
    opts.hashToScalar(msg, { DST: concatBytes(_DST_scalar, ctx) });
  const randomScalar = (rng: RNG = randomBytes) => {
    const t = mapHashToField(rng(getMinHashLength(Fn.ORDER)), Fn.ORDER, Fn.isLE);
    // We cannot use Fn.fromBytes here, because field
    // can have different number of bytes (like ed448)
    return Fn.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t);
  };

  const msm = (points: P[], scalars: bigint[]) => pippenger(Point, points, scalars);

  const getCtx = (mode: number) =>
    concatBytes(asciiToBytes('OPRFV1-'), new Uint8Array([mode]), asciiToBytes('-' + name));
  const ctxOPRF = getCtx(0x00);
  const ctxVOPRF = getCtx(0x01);
  const ctxPOPRF = getCtx(0x02);

  function encode(...args: (Uint8Array | number | string)[]) {
    const res = [];
    for (const a of args) {
      if (typeof a === 'number') res.push(numberToBytesBE(a, 2));
      else if (typeof a === 'string') res.push(asciiToBytes(a));
      else {
        abytes(a);
        res.push(numberToBytesBE(a.length, 2), a);
      }
    }
    // No wipe here, since will modify actual bytes
    return concatBytes(...res);
  }
  const hashInput = (...bytes: Uint8Array[]) => hash(encode(...bytes, 'Finalize'));

  function getTranscripts(B: P, C: P[], D: P[], ctx: Bytes) {
    const Bm = B.toBytes();
    const seed = hash(encode(Bm, concatBytes(asciiToBytes('Seed-'), ctx)));
    const res: bigint[] = [];
    for (let i = 0; i < C.length; i++) {
      const Ci = C[i].toBytes();
      const Di = D[i].toBytes();
      const di = hashToScalarPrefixed(encode(seed, i, Ci, Di, 'Composite'), ctx);
      res.push(di);
    }
    return res;
  }

  function computeComposites(B: P, C: P[], D: P[], ctx: Bytes) {
    const T = getTranscripts(B, C, D, ctx);
    const M = msm(C, T);
    const Z = msm(D, T);
    return { M, Z };
  }

  function computeCompositesFast(k: bigint, B: P, C: P[], D: P[], ctx: Bytes): { M: P; Z: P } {
    const T = getTranscripts(B, C, D, ctx);
    const M = msm(C, T);
    const Z = M.multiply(k);
    return { M, Z };
  }

  function challengeTranscript(B: P, M: P, Z: P, t2: P, t3: P, ctx: Bytes) {
    const [Bm, a0, a1, a2, a3] = [B, M, Z, t2, t3].map((i) => i.toBytes());
    return hashToScalarPrefixed(encode(Bm, a0, a1, a2, a3, 'Challenge'), ctx);
  }

  function generateProof(ctx: Bytes, k: bigint, B: P, C: P[], D: P[], rng: RNG) {
    const { M, Z } = computeCompositesFast(k, B, C, D, ctx);
    const r = randomScalar(rng);
    const t2 = Point.BASE.multiply(r);
    const t3 = M.multiply(r);
    const c = challengeTranscript(B, M, Z, t2, t3, ctx);
    const s = Fn.sub(r, Fn.mul(c, k)); // r - c*k
    return concatBytes(...[c, s].map((i) => Fn.toBytes(i)));
  }

  function verifyProof(ctx: Bytes, B: P, C: P[], D: P[], proof: Bytes) {
    abytes(proof, 2 * Fn.BYTES);
    const { M, Z } = computeComposites(B, C, D, ctx);
    const [c, s] = [proof.subarray(0, Fn.BYTES), proof.subarray(Fn.BYTES)].map((f) =>
      Fn.fromBytes(f)
    );
    const t2 = Point.BASE.multiply(s).add(B.multiply(c)); // s*G + c*B
    const t3 = M.multiply(s).add(Z.multiply(c)); // s*M + c*Z
    const expectedC = challengeTranscript(B, M, Z, t2, t3, ctx);
    if (!Fn.eql(c, expectedC)) throw new Error('proof verification failed');
  }

  function generateKeyPair() {
    const skS = randomScalar();
    const pkS = Point.BASE.multiply(skS);
    return { secretKey: Fn.toBytes(skS), publicKey: pkS.toBytes() };
  }

  function deriveKeyPair(ctx: Bytes, seed: Bytes, info: Bytes) {
    const dst = concatBytes(asciiToBytes('DeriveKeyPair'), ctx);
    const msg = concatBytes(seed, encode(info), Uint8Array.of(0));
    for (let counter = 0; counter <= 255; counter++) {
      msg[msg.length - 1] = counter;
      const skS = opts.hashToScalar(msg, { DST: dst });
      if (Fn.is0(skS)) continue; // should not happen
      return { secretKey: Fn.toBytes(skS), publicKey: Point.BASE.multiply(skS).toBytes() };
    }
    throw new Error('Cannot derive key');
  }
  function blind(ctx: Bytes, input: Uint8Array, rng: RNG = randomBytes) {
    const blind = randomScalar(rng);
    const inputPoint = hashToGroup(input, ctx);
    if (inputPoint.equals(Point.ZERO)) throw new Error('Input point at infinity');
    const blinded = inputPoint.multiply(blind);
    return { blind: Fn.toBytes(blind), blinded: blinded.toBytes() };
  }
  function evaluate(ctx: Bytes, secretKey: ScalarBytes, input: Bytes) {
    const skS = Fn.fromBytes(secretKey);
    const inputPoint = hashToGroup(input, ctx);
    if (inputPoint.equals(Point.ZERO)) throw new Error('Input point at infinity');
    const unblinded = inputPoint.multiply(skS).toBytes();
    return hashInput(input, unblinded);
  }
  const oprf = {
    generateKeyPair,
    deriveKeyPair: (seed: Bytes, keyInfo: Bytes) => deriveKeyPair(ctxOPRF, seed, keyInfo),
    blind: (input: Bytes, rng: RNG = randomBytes) => blind(ctxOPRF, input, rng),
    blindEvaluate(secretKey: ScalarBytes, blindedPoint: PointBytes) {
      const skS = Fn.fromBytes(secretKey);
      const elm = Point.fromBytes(blindedPoint);
      return elm.multiply(skS).toBytes();
    },
    finalize(input: Bytes, blindBytes: ScalarBytes, evaluatedBytes: PointBytes) {
      const blind = Fn.fromBytes(blindBytes);
      const evalPoint = Point.fromBytes(evaluatedBytes);
      const unblinded = evalPoint.multiply(Fn.inv(blind)).toBytes();
      return hashInput(input, unblinded);
    },
    evaluate: (secretKey: ScalarBytes, input: Bytes) => evaluate(ctxOPRF, secretKey, input),
  };

  const voprf = {
    generateKeyPair,
    deriveKeyPair: (seed: Bytes, keyInfo: Bytes) => deriveKeyPair(ctxVOPRF, seed, keyInfo),
    blind: (input: Bytes, rng: RNG = randomBytes) => blind(ctxVOPRF, input, rng),
    blindEvaluateBatch(
      secretKey: ScalarBytes,
      publicKey: PointBytes,
      blinded: PointBytes[],
      rng: RNG = randomBytes
    ) {
      if (!Array.isArray(blinded)) throw new Error('expected array');
      const skS = Fn.fromBytes(secretKey);
      const pkS = Point.fromBytes(publicKey);
      const blindedPoints = blinded.map(Point.fromBytes);
      const evaluated = blindedPoints.map((i) => i.multiply(skS));
      const proof = generateProof(ctxVOPRF, skS, pkS, blindedPoints, evaluated, rng);
      return { evaluated: evaluated.map((i) => i.toBytes()), proof };
    },
    blindEvaluate(
      secretKey: ScalarBytes,
      publicKey: PointBytes,
      blinded: PointBytes,
      rng: RNG = randomBytes
    ) {
      const res = this.blindEvaluateBatch(secretKey, publicKey, [blinded], rng);
      return { evaluated: res.evaluated[0], proof: res.proof };
    },
    finalizeBatch(items: OPRFFinalizeItem[], publicKey: PointBytes, proof: Bytes) {
      if (!Array.isArray(items)) throw new Error('expected array');
      const pkS = Point.fromBytes(publicKey);
      const blindedPoints = items.map((i) => i.blinded).map(Point.fromBytes);
      const evalPoints = items.map((i) => i.evaluated).map(Point.fromBytes);
      verifyProof(ctxVOPRF, pkS, blindedPoints, evalPoints, proof);
      return items.map((i) => oprf.finalize(i.input, i.blind, i.evaluated));
    },
    finalize(
      input: Bytes,
      blind: ScalarBytes,
      evaluated: PointBytes,
      blinded: PointBytes,
      publicKey: PointBytes,
      proof: Bytes
    ) {
      return this.finalizeBatch([{ input, blind, evaluated, blinded }], publicKey, proof)[0];
    },
    evaluate: (secretKey: ScalarBytes, input: Bytes) => evaluate(ctxVOPRF, secretKey, input),
  };
  // NOTE: info is domain separation
  const poprf = (info: Bytes) => {
    const m = hashToScalarPrefixed(encode('Info', info), ctxPOPRF);
    const T = Point.BASE.multiply(m);
    return {
      generateKeyPair,
      deriveKeyPair: (seed: Bytes, keyInfo: Bytes) => deriveKeyPair(ctxPOPRF, seed, keyInfo),
      blind(input: Bytes, publicKey: PointBytes, rng: RNG = randomBytes) {
        const pkS = Point.fromBytes(publicKey);
        const tweakedKey = T.add(pkS);
        if (tweakedKey.equals(Point.ZERO)) throw new Error('tweakedKey point at infinity');
        const blind = randomScalar(rng);
        const inputPoint = hashToGroup(input, ctxPOPRF);
        if (inputPoint.equals(Point.ZERO)) throw new Error('Input point at infinity');
        const blindedPoint = inputPoint.multiply(blind);
        return {
          blind: Fn.toBytes(blind),
          blinded: blindedPoint.toBytes(),
          tweakedKey: tweakedKey.toBytes(),
        };
      },
      blindEvaluateBatch(secretKey: ScalarBytes, blinded: PointBytes[], rng: RNG = randomBytes) {
        if (!Array.isArray(blinded)) throw new Error('expected array');
        const skS = Fn.fromBytes(secretKey);
        const t = Fn.add(skS, m);
        // "Hence, this error can be a signal for the server to replace its private key". We throw inside,
        // should be impossible.
        const invT = Fn.inv(t);
        const blindedPoints = blinded.map(Point.fromBytes);
        const evalPoints = blindedPoints.map((i) => i.multiply(invT));
        const tweakedKey = Point.BASE.multiply(t);
        const proof = generateProof(ctxPOPRF, t, tweakedKey, evalPoints, blindedPoints, rng);
        return { evaluated: evalPoints.map((i) => i.toBytes()), proof };
      },
      blindEvaluate(secretKey: ScalarBytes, blinded: PointBytes, rng: RNG = randomBytes) {
        const res = this.blindEvaluateBatch(secretKey, [blinded], rng);
        return { evaluated: res.evaluated[0], proof: res.proof };
      },
      finalizeBatch(items: OPRFFinalizeItem[], proof: Bytes, tweakedKey: PointBytes) {
        if (!Array.isArray(items)) throw new Error('expected array');
        const evalPoints = items.map((i) => i.evaluated).map(Point.fromBytes);
        verifyProof(
          ctxPOPRF,
          Point.fromBytes(tweakedKey),
          evalPoints,
          items.map((i) => i.blinded).map(Point.fromBytes),
          proof
        );
        return items.map((i, j) => {
          const blind = Fn.fromBytes(i.blind);
          const point = evalPoints[j].multiply(Fn.inv(blind)).toBytes();
          return hashInput(i.input, info, point);
        });
      },
      finalize(
        input: Bytes,
        blind: ScalarBytes,
        evaluated: PointBytes,
        blinded: PointBytes,
        proof: Bytes,
        tweakedKey: PointBytes
      ) {
        return this.finalizeBatch([{ input, blind, evaluated, blinded }], proof, tweakedKey)[0];
      },
      evaluate(secretKey: ScalarBytes, input: Bytes) {
        const skS = Fn.fromBytes(secretKey);
        const inputPoint = hashToGroup(input, ctxPOPRF);
        if (inputPoint.equals(Point.ZERO)) throw new Error('Input point at infinity');
        const t = Fn.add(skS, m);
        const invT = Fn.inv(t);
        const unblinded = inputPoint.multiply(invT).toBytes();
        return hashInput(input, info, unblinded);
      },
    };
  };
  return Object.freeze({ name, oprf, voprf, poprf, __tests: { Fn } });
}