docs: def recover(y):
      """ given a value y, recover the preimage x """
      p = (y*y - 1) * inverse(D*y*y + 1)
      x = powmod(p, (PRIME+3) // 8, PRIME)
      if (x*x - p) % PRIME != 0:
          i = powmod(2, (PRIME-1) // 4, PRIME)
          x = (x*i) % PRIME
      if x % 2 != 0:
          x = PRIME - x
      return x