Proving protocol using OPRF with a password

[forty]

I'm trying out verifypal to prove some PAKE protocols, and I'm struggling with OPRF using passwords for blind salt, as in OPAQUE.

• I cannot find out how to invert a scalar (the blinding factor, as I want to compute HASH(pwd)^r^k^(1/r) )
• the verifier is unhappy because HASH(pwd)^r reveals the password. Ideally I want H2C(HASH(pwd))^r, I'm not sure how to communicate that to verifypal, but I guess that shouldn't reveal the password if r remains secret?

[forty]

(sorry, I don't know if this is a feature request, or just my own misunderstanding of how things work)