"use strict";
var nobleCurves = (() => {
  var __defProp = Object.defineProperty;
  var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
  var __getOwnPropNames = Object.getOwnPropertyNames;
  var __hasOwnProp = Object.prototype.hasOwnProperty;
  var __export = (target, all) => {
    for (var name in all)
      __defProp(target, name, { get: all[name], enumerable: true });
  };
  var __copyProps = (to, from, except, desc) => {
    if ((from && typeof from === "object") || typeof from === "function") {
      for (let key of __getOwnPropNames(from))
        if (!__hasOwnProp.call(to, key) && key !== except)
          __defProp(to, key, {
            get: () => from[key],
            enumerable:
              !(desc = __getOwnPropDesc(from, key)) || desc.enumerable,
          });
    }
    return to;
  };
  var __toCommonJS = (mod2) =>
    __copyProps(__defProp({}, "__esModule", { value: true }), mod2);

  // input.js
  var input_exports = {};
  __export(input_exports, {
    bls12_381: () => bls12_381,
    ed25519: () => ed25519,
    ed25519_edwardsToMontgomeryPriv: () => edwardsToMontgomeryPriv,
    ed25519_edwardsToMontgomeryPub: () => edwardsToMontgomeryPub,
    ed448: () => ed448,
    ed448_edwardsToMontgomeryPub: () => edwardsToMontgomeryPub2,
    p256: () => p256,
    p384: () => p384,
    p521: () => p521,
    secp256k1: () => secp256k1,
    secp256k1_schnorr: () => schnorr,
    utils: () => utils,
    x25519: () => x25519,
    x448: () => x448,
  });

  // ../esm/abstract/utils.js
  var utils_exports = {};
  __export(utils_exports, {
    bitGet: () => bitGet,
    bitLen: () => bitLen,
    bitMask: () => bitMask,
    bitSet: () => bitSet,
    bytesToHex: () => bytesToHex,
    bytesToNumberBE: () => bytesToNumberBE,
    bytesToNumberLE: () => bytesToNumberLE,
    concatBytes: () => concatBytes,
    createHmacDrbg: () => createHmacDrbg,
    ensureBytes: () => ensureBytes,
    equalBytes: () => equalBytes,
    hexToBytes: () => hexToBytes,
    hexToNumber: () => hexToNumber,
    numberToBytesBE: () => numberToBytesBE,
    numberToBytesLE: () => numberToBytesLE,
    numberToHexUnpadded: () => numberToHexUnpadded,
    numberToVarBytesBE: () => numberToVarBytesBE,
    utf8ToBytes: () => utf8ToBytes,
    validateObject: () => validateObject,
  });
  var _0n = BigInt(0);
  var _1n = BigInt(1);
  var _2n = BigInt(2);
  var u8a = (a) => a instanceof Uint8Array;
  var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) =>
    i.toString(16).padStart(2, "0"),
  );
  function bytesToHex(bytes2) {
    if (!u8a(bytes2)) throw new Error("Uint8Array expected");
    let hex = "";
    for (let i = 0; i < bytes2.length; i++) {
      hex += hexes[bytes2[i]];
    }
    return hex;
  }
  function numberToHexUnpadded(num) {
    const hex = num.toString(16);
    return hex.length & 1 ? `0${hex}` : hex;
  }
  function hexToNumber(hex) {
    if (typeof hex !== "string")
      throw new Error("hex string expected, got " + typeof hex);
    return BigInt(hex === "" ? "0" : `0x${hex}`);
  }
  function hexToBytes(hex) {
    if (typeof hex !== "string")
      throw new Error("hex string expected, got " + typeof hex);
    const len = hex.length;
    if (len % 2)
      throw new Error(
        "padded hex string expected, got unpadded hex of length " + len,
      );
    const array = new Uint8Array(len / 2);
    for (let i = 0; i < array.length; i++) {
      const j = i * 2;
      const hexByte = hex.slice(j, j + 2);
      const byte = Number.parseInt(hexByte, 16);
      if (Number.isNaN(byte) || byte < 0)
        throw new Error("Invalid byte sequence");
      array[i] = byte;
    }
    return array;
  }
  function bytesToNumberBE(bytes2) {
    return hexToNumber(bytesToHex(bytes2));
  }
  function bytesToNumberLE(bytes2) {
    if (!u8a(bytes2)) throw new Error("Uint8Array expected");
    return hexToNumber(bytesToHex(Uint8Array.from(bytes2).reverse()));
  }
  function numberToBytesBE(n, len) {
    return hexToBytes(n.toString(16).padStart(len * 2, "0"));
  }
  function numberToBytesLE(n, len) {
    return numberToBytesBE(n, len).reverse();
  }
  function numberToVarBytesBE(n) {
    return hexToBytes(numberToHexUnpadded(n));
  }
  function ensureBytes(title, hex, expectedLength) {
    let res;
    if (typeof hex === "string") {
      try {
        res = hexToBytes(hex);
      } catch (e) {
        throw new Error(
          `${title} must be valid hex string, got "${hex}". Cause: ${e}`,
        );
      }
    } else if (u8a(hex)) {
      res = Uint8Array.from(hex);
    } else {
      throw new Error(`${title} must be hex string or Uint8Array`);
    }
    const len = res.length;
    if (typeof expectedLength === "number" && len !== expectedLength)
      throw new Error(`${title} expected ${expectedLength} bytes, got ${len}`);
    return res;
  }
  function concatBytes(...arrays) {
    const r = new Uint8Array(arrays.reduce((sum, a) => sum + a.length, 0));
    let pad = 0;
    arrays.forEach((a) => {
      if (!u8a(a)) throw new Error("Uint8Array expected");
      r.set(a, pad);
      pad += a.length;
    });
    return r;
  }
  function equalBytes(b1, b2) {
    if (b1.length !== b2.length) return false;
    for (let i = 0; i < b1.length; i++) if (b1[i] !== b2[i]) return false;
    return true;
  }
  function utf8ToBytes(str) {
    if (typeof str !== "string")
      throw new Error(`utf8ToBytes expected string, got ${typeof str}`);
    return new Uint8Array(new TextEncoder().encode(str));
  }
  function bitLen(n) {
    let len;
    for (len = 0; n > _0n; n >>= _1n, len += 1);
    return len;
  }
  function bitGet(n, pos) {
    return (n >> BigInt(pos)) & _1n;
  }
  var bitSet = (n, pos, value) => {
    return n | ((value ? _1n : _0n) << BigInt(pos));
  };
  var bitMask = (n) => (_2n << BigInt(n - 1)) - _1n;
  var u8n = (data) => new Uint8Array(data);
  var u8fr = (arr) => Uint8Array.from(arr);
  function createHmacDrbg(hashLen, qByteLen, hmacFn) {
    if (typeof hashLen !== "number" || hashLen < 2)
      throw new Error("hashLen must be a number");
    if (typeof qByteLen !== "number" || qByteLen < 2)
      throw new Error("qByteLen must be a number");
    if (typeof hmacFn !== "function")
      throw new Error("hmacFn must be a function");
    let v = u8n(hashLen);
    let k = u8n(hashLen);
    let i = 0;
    const reset = () => {
      v.fill(1);
      k.fill(0);
      i = 0;
    };
    const h = (...b) => hmacFn(k, v, ...b);
    const reseed = (seed = u8n()) => {
      k = h(u8fr([0]), seed);
      v = h();
      if (seed.length === 0) return;
      k = h(u8fr([1]), seed);
      v = h();
    };
    const gen2 = () => {
      if (i++ >= 1e3) throw new Error("drbg: tried 1000 values");
      let len = 0;
      const out = [];
      while (len < qByteLen) {
        v = h();
        const sl = v.slice();
        out.push(sl);
        len += v.length;
      }
      return concatBytes(...out);
    };
    const genUntil = (seed, pred) => {
      reset();
      reseed(seed);
      let res = void 0;
      while (!(res = pred(gen2()))) reseed();
      reset();
      return res;
    };
    return genUntil;
  }
  var validatorFns = {
    bigint: (val) => typeof val === "bigint",
    function: (val) => typeof val === "function",
    boolean: (val) => typeof val === "boolean",
    string: (val) => typeof val === "string",
    stringOrUint8Array: (val) =>
      typeof val === "string" || val instanceof Uint8Array,
    isSafeInteger: (val) => Number.isSafeInteger(val),
    array: (val) => Array.isArray(val),
    field: (val, object) => object.Fp.isValid(val),
    hash: (val) =>
      typeof val === "function" && Number.isSafeInteger(val.outputLen),
  };
  function validateObject(object, validators, optValidators = {}) {
    const checkField = (fieldName, type, isOptional) => {
      const checkVal = validatorFns[type];
      if (typeof checkVal !== "function")
        throw new Error(`Invalid validator "${type}", expected function`);
      const val = object[fieldName];
      if (isOptional && val === void 0) return;
      if (!checkVal(val, object)) {
        throw new Error(
          `Invalid param ${String(
            fieldName,
          )}=${val} (${typeof val}), expected ${type}`,
        );
      }
    };
    for (const [fieldName, type] of Object.entries(validators))
      checkField(fieldName, type, false);
    for (const [fieldName, type] of Object.entries(optValidators))
      checkField(fieldName, type, true);
    return object;
  }

  // ../node_modules/@noble/hashes/esm/_assert.js
  function number(n) {
    if (!Number.isSafeInteger(n) || n < 0)
      throw new Error(`Wrong positive integer: ${n}`);
  }
  function bytes(b, ...lengths) {
    if (!(b instanceof Uint8Array)) throw new Error("Expected Uint8Array");
    if (lengths.length > 0 && !lengths.includes(b.length))
      throw new Error(
        `Expected Uint8Array of length ${lengths}, not of length=${b.length}`,
      );
  }
  function hash(hash2) {
    if (typeof hash2 !== "function" || typeof hash2.create !== "function")
      throw new Error("Hash should be wrapped by utils.wrapConstructor");
    number(hash2.outputLen);
    number(hash2.blockLen);
  }
  function exists(instance, checkFinished = true) {
    if (instance.destroyed) throw new Error("Hash instance has been destroyed");
    if (checkFinished && instance.finished)
      throw new Error("Hash#digest() has already been called");
  }
  function output(out, instance) {
    bytes(out);
    const min = instance.outputLen;
    if (out.length < min) {
      throw new Error(
        `digestInto() expects output buffer of length at least ${min}`,
      );
    }
  }

  // ../node_modules/@noble/hashes/esm/crypto.js
  var crypto =
    typeof globalThis === "object" && "crypto" in globalThis
      ? globalThis.crypto
      : void 0;

  // ../node_modules/@noble/hashes/esm/utils.js
  var u8a2 = (a) => a instanceof Uint8Array;
  var u32 = (arr) =>
    new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
  var createView = (arr) =>
    new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
  var rotr = (word, shift) => (word << (32 - shift)) | (word >>> shift);
  var isLE = new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68;
  if (!isLE) throw new Error("Non little-endian hardware is not supported");
  function utf8ToBytes2(str) {
    if (typeof str !== "string")
      throw new Error(`utf8ToBytes expected string, got ${typeof str}`);
    return new Uint8Array(new TextEncoder().encode(str));
  }
  function toBytes(data) {
    if (typeof data === "string") data = utf8ToBytes2(data);
    if (!u8a2(data)) throw new Error(`expected Uint8Array, got ${typeof data}`);
    return data;
  }
  function concatBytes2(...arrays) {
    const r = new Uint8Array(arrays.reduce((sum, a) => sum + a.length, 0));
    let pad = 0;
    arrays.forEach((a) => {
      if (!u8a2(a)) throw new Error("Uint8Array expected");
      r.set(a, pad);
      pad += a.length;
    });
    return r;
  }
  var Hash = class {
    // Safe version that clones internal state
    clone() {
      return this._cloneInto();
    }
  };
  var toStr = {}.toString;
  function wrapConstructor(hashCons) {
    const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
    const tmp = hashCons();
    hashC.outputLen = tmp.outputLen;
    hashC.blockLen = tmp.blockLen;
    hashC.create = () => hashCons();
    return hashC;
  }
  function wrapXOFConstructorWithOpts(hashCons) {
    const hashC = (msg, opts) => hashCons(opts).update(toBytes(msg)).digest();
    const tmp = hashCons({});
    hashC.outputLen = tmp.outputLen;
    hashC.blockLen = tmp.blockLen;
    hashC.create = (opts) => hashCons(opts);
    return hashC;
  }
  function randomBytes(bytesLength = 32) {
    if (crypto && typeof crypto.getRandomValues === "function") {
      return crypto.getRandomValues(new Uint8Array(bytesLength));
    }
    throw new Error("crypto.getRandomValues must be defined");
  }

  // ../node_modules/@noble/hashes/esm/_sha2.js
  function setBigUint64(view, byteOffset, value, isLE2) {
    if (typeof view.setBigUint64 === "function")
      return view.setBigUint64(byteOffset, value, isLE2);
    const _32n2 = BigInt(32);
    const _u32_max = BigInt(4294967295);
    const wh = Number((value >> _32n2) & _u32_max);
    const wl = Number(value & _u32_max);
    const h = isLE2 ? 4 : 0;
    const l = isLE2 ? 0 : 4;
    view.setUint32(byteOffset + h, wh, isLE2);
    view.setUint32(byteOffset + l, wl, isLE2);
  }
  var SHA2 = class extends Hash {
    constructor(blockLen, outputLen, padOffset, isLE2) {
      super();
      this.blockLen = blockLen;
      this.outputLen = outputLen;
      this.padOffset = padOffset;
      this.isLE = isLE2;
      this.finished = false;
      this.length = 0;
      this.pos = 0;
      this.destroyed = false;
      this.buffer = new Uint8Array(blockLen);
      this.view = createView(this.buffer);
    }
    update(data) {
      exists(this);
      const { view, buffer, blockLen } = this;
      data = toBytes(data);
      const len = data.length;
      for (let pos = 0; pos < len; ) {
        const take = Math.min(blockLen - this.pos, len - pos);
        if (take === blockLen) {
          const dataView = createView(data);
          for (; blockLen <= len - pos; pos += blockLen)
            this.process(dataView, pos);
          continue;
        }
        buffer.set(data.subarray(pos, pos + take), this.pos);
        this.pos += take;
        pos += take;
        if (this.pos === blockLen) {
          this.process(view, 0);
          this.pos = 0;
        }
      }
      this.length += data.length;
      this.roundClean();
      return this;
    }
    digestInto(out) {
      exists(this);
      output(out, this);
      this.finished = true;
      const { buffer, view, blockLen, isLE: isLE2 } = this;
      let { pos } = this;
      buffer[pos++] = 128;
      this.buffer.subarray(pos).fill(0);
      if (this.padOffset > blockLen - pos) {
        this.process(view, 0);
        pos = 0;
      }
      for (let i = pos; i < blockLen; i++) buffer[i] = 0;
      setBigUint64(view, blockLen - 8, BigInt(this.length * 8), isLE2);
      this.process(view, 0);
      const oview = createView(out);
      const len = this.outputLen;
      if (len % 4)
        throw new Error("_sha2: outputLen should be aligned to 32bit");
      const outLen = len / 4;
      const state = this.get();
      if (outLen > state.length)
        throw new Error("_sha2: outputLen bigger than state");
      for (let i = 0; i < outLen; i++) oview.setUint32(4 * i, state[i], isLE2);
    }
    digest() {
      const { buffer, outputLen } = this;
      this.digestInto(buffer);
      const res = buffer.slice(0, outputLen);
      this.destroy();
      return res;
    }
    _cloneInto(to) {
      to || (to = new this.constructor());
      to.set(...this.get());
      const { blockLen, buffer, length, finished, destroyed, pos } = this;
      to.length = length;
      to.pos = pos;
      to.finished = finished;
      to.destroyed = destroyed;
      if (length % blockLen) to.buffer.set(buffer);
      return to;
    }
  };

  // ../node_modules/@noble/hashes/esm/sha256.js
  var Chi = (a, b, c) => (a & b) ^ (~a & c);
  var Maj = (a, b, c) => (a & b) ^ (a & c) ^ (b & c);
  var SHA256_K = /* @__PURE__ */ new Uint32Array([
    1116352408, 1899447441, 3049323471, 3921009573, 961987163, 1508970993,
    2453635748, 2870763221, 3624381080, 310598401, 607225278, 1426881987,
    1925078388, 2162078206, 2614888103, 3248222580, 3835390401, 4022224774,
    264347078, 604807628, 770255983, 1249150122, 1555081692, 1996064986,
    2554220882, 2821834349, 2952996808, 3210313671, 3336571891, 3584528711,
    113926993, 338241895, 666307205, 773529912, 1294757372, 1396182291,
    1695183700, 1986661051, 2177026350, 2456956037, 2730485921, 2820302411,
    3259730800, 3345764771, 3516065817, 3600352804, 4094571909, 275423344,
    430227734, 506948616, 659060556, 883997877, 958139571, 1322822218,
    1537002063, 1747873779, 1955562222, 2024104815, 2227730452, 2361852424,
    2428436474, 2756734187, 3204031479, 3329325298,
  ]);
  var IV = /* @__PURE__ */ new Uint32Array([
    1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924,
    528734635, 1541459225,
  ]);
  var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
  var SHA256 = class extends SHA2 {
    constructor() {
      super(64, 32, 8, false);
      this.A = IV[0] | 0;
      this.B = IV[1] | 0;
      this.C = IV[2] | 0;
      this.D = IV[3] | 0;
      this.E = IV[4] | 0;
      this.F = IV[5] | 0;
      this.G = IV[6] | 0;
      this.H = IV[7] | 0;
    }
    get() {
      const { A, B, C, D, E, F, G, H } = this;
      return [A, B, C, D, E, F, G, H];
    }
    // prettier-ignore
    set(A, B, C, D, E, F, G, H) {
      this.A = A | 0;
      this.B = B | 0;
      this.C = C | 0;
      this.D = D | 0;
      this.E = E | 0;
      this.F = F | 0;
      this.G = G | 0;
      this.H = H | 0;
    }
    process(view, offset) {
      for (let i = 0; i < 16; i++, offset += 4)
        SHA256_W[i] = view.getUint32(offset, false);
      for (let i = 16; i < 64; i++) {
        const W15 = SHA256_W[i - 15];
        const W2 = SHA256_W[i - 2];
        const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ (W15 >>> 3);
        const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ (W2 >>> 10);
        SHA256_W[i] = (s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16]) | 0;
      }
      let { A, B, C, D, E, F, G, H } = this;
      for (let i = 0; i < 64; i++) {
        const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
        const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;
        const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
        const T2 = (sigma0 + Maj(A, B, C)) | 0;
        H = G;
        G = F;
        F = E;
        E = (D + T1) | 0;
        D = C;
        C = B;
        B = A;
        A = (T1 + T2) | 0;
      }
      A = (A + this.A) | 0;
      B = (B + this.B) | 0;
      C = (C + this.C) | 0;
      D = (D + this.D) | 0;
      E = (E + this.E) | 0;
      F = (F + this.F) | 0;
      G = (G + this.G) | 0;
      H = (H + this.H) | 0;
      this.set(A, B, C, D, E, F, G, H);
    }
    roundClean() {
      SHA256_W.fill(0);
    }
    destroy() {
      this.set(0, 0, 0, 0, 0, 0, 0, 0);
      this.buffer.fill(0);
    }
  };
  var sha256 = /* @__PURE__ */ wrapConstructor(() => new SHA256());

  // ../esm/abstract/modular.js
  var _0n2 = BigInt(0);
  var _1n2 = BigInt(1);
  var _2n2 = BigInt(2);
  var _3n = BigInt(3);
  var _4n = BigInt(4);
  var _5n = BigInt(5);
  var _8n = BigInt(8);
  var _9n = BigInt(9);
  var _16n = BigInt(16);
  function mod(a, b) {
    const result = a % b;
    return result >= _0n2 ? result : b + result;
  }
  function pow(num, power, modulo) {
    if (modulo <= _0n2 || power < _0n2)
      throw new Error("Expected power/modulo > 0");
    if (modulo === _1n2) return _0n2;
    let res = _1n2;
    while (power > _0n2) {
      if (power & _1n2) res = (res * num) % modulo;
      num = (num * num) % modulo;
      power >>= _1n2;
    }
    return res;
  }
  function pow2(x, power, modulo) {
    let res = x;
    while (power-- > _0n2) {
      res *= res;
      res %= modulo;
    }
    return res;
  }
  function invert(number2, modulo) {
    if (number2 === _0n2 || modulo <= _0n2) {
      throw new Error(
        `invert: expected positive integers, got n=${number2} mod=${modulo}`,
      );
    }
    let a = mod(number2, modulo);
    let b = modulo;
    let x = _0n2,
      y = _1n2,
      u = _1n2,
      v = _0n2;
    while (a !== _0n2) {
      const q = b / a;
      const r = b % a;
      const m = x - u * q;
      const n = y - v * q;
      (b = a), (a = r), (x = u), (y = v), (u = m), (v = n);
    }
    const gcd = b;
    if (gcd !== _1n2) throw new Error("invert: does not exist");
    return mod(x, modulo);
  }
  function tonelliShanks(P3) {
    const legendreC = (P3 - _1n2) / _2n2;
    let Q, S, Z;
    for (Q = P3 - _1n2, S = 0; Q % _2n2 === _0n2; Q /= _2n2, S++);
    for (Z = _2n2; Z < P3 && pow(Z, legendreC, P3) !== P3 - _1n2; Z++);
    if (S === 1) {
      const p1div4 = (P3 + _1n2) / _4n;
      return function tonelliFast(Fp8, n) {
        const root = Fp8.pow(n, p1div4);
        if (!Fp8.eql(Fp8.sqr(root), n))
          throw new Error("Cannot find square root");
        return root;
      };
    }
    const Q1div2 = (Q + _1n2) / _2n2;
    return function tonelliSlow(Fp8, n) {
      if (Fp8.pow(n, legendreC) === Fp8.neg(Fp8.ONE))
        throw new Error("Cannot find square root");
      let r = S;
      let g = Fp8.pow(Fp8.mul(Fp8.ONE, Z), Q);
      let x = Fp8.pow(n, Q1div2);
      let b = Fp8.pow(n, Q);
      while (!Fp8.eql(b, Fp8.ONE)) {
        if (Fp8.eql(b, Fp8.ZERO)) return Fp8.ZERO;
        let m = 1;
        for (let t2 = Fp8.sqr(b); m < r; m++) {
          if (Fp8.eql(t2, Fp8.ONE)) break;
          t2 = Fp8.sqr(t2);
        }
        const ge2 = Fp8.pow(g, _1n2 << BigInt(r - m - 1));
        g = Fp8.sqr(ge2);
        x = Fp8.mul(x, ge2);
        b = Fp8.mul(b, g);
        r = m;
      }
      return x;
    };
  }
  function FpSqrt(P3) {
    if (P3 % _4n === _3n) {
      const p1div4 = (P3 + _1n2) / _4n;
      return function sqrt3mod4(Fp8, n) {
        const root = Fp8.pow(n, p1div4);
        if (!Fp8.eql(Fp8.sqr(root), n))
          throw new Error("Cannot find square root");
        return root;
      };
    }
    if (P3 % _8n === _5n) {
      const c1 = (P3 - _5n) / _8n;
      return function sqrt5mod8(Fp8, n) {
        const n2 = Fp8.mul(n, _2n2);
        const v = Fp8.pow(n2, c1);
        const nv = Fp8.mul(n, v);
        const i = Fp8.mul(Fp8.mul(nv, _2n2), v);
        const root = Fp8.mul(nv, Fp8.sub(i, Fp8.ONE));
        if (!Fp8.eql(Fp8.sqr(root), n))
          throw new Error("Cannot find square root");
        return root;
      };
    }
    if (P3 % _16n === _9n) {
    }
    return tonelliShanks(P3);
  }
  var isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n2) === _1n2;
  var FIELD_FIELDS = [
    "create",
    "isValid",
    "is0",
    "neg",
    "inv",
    "sqrt",
    "sqr",
    "eql",
    "add",
    "sub",
    "mul",
    "pow",
    "div",
    "addN",
    "subN",
    "mulN",
    "sqrN",
  ];
  function validateField(field) {
    const initial = {
      ORDER: "bigint",
      MASK: "bigint",
      BYTES: "isSafeInteger",
      BITS: "isSafeInteger",
    };
    const opts = FIELD_FIELDS.reduce((map, val) => {
      map[val] = "function";
      return map;
    }, initial);
    return validateObject(field, opts);
  }
  function FpPow(f, num, power) {
    if (power < _0n2) throw new Error("Expected power > 0");
    if (power === _0n2) return f.ONE;
    if (power === _1n2) return num;
    let p = f.ONE;
    let d = num;
    while (power > _0n2) {
      if (power & _1n2) p = f.mul(p, d);
      d = f.sqr(d);
      power >>= _1n2;
    }
    return p;
  }
  function FpInvertBatch(f, nums) {
    const tmp = new Array(nums.length);
    const lastMultiplied = nums.reduce((acc, num, i) => {
      if (f.is0(num)) return acc;
      tmp[i] = acc;
      return f.mul(acc, num);
    }, f.ONE);
    const inverted = f.inv(lastMultiplied);
    nums.reduceRight((acc, num, i) => {
      if (f.is0(num)) return acc;
      tmp[i] = f.mul(acc, tmp[i]);
      return f.mul(acc, num);
    }, inverted);
    return tmp;
  }
  function nLength(n, nBitLength) {
    const _nBitLength =
      nBitLength !== void 0 ? nBitLength : n.toString(2).length;
    const nByteLength = Math.ceil(_nBitLength / 8);
    return { nBitLength: _nBitLength, nByteLength };
  }
  function Field(ORDER, bitLen2, isLE2 = false, redef = {}) {
    if (ORDER <= _0n2)
      throw new Error(`Expected Field ORDER > 0, got ${ORDER}`);
    const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, bitLen2);
    if (BYTES > 2048)
      throw new Error("Field lengths over 2048 bytes are not supported");
    const sqrtP = FpSqrt(ORDER);
    const f = Object.freeze({
      ORDER,
      BITS,
      BYTES,
      MASK: bitMask(BITS),
      ZERO: _0n2,
      ONE: _1n2,
      create: (num) => mod(num, ORDER),
      isValid: (num) => {
        if (typeof num !== "bigint")
          throw new Error(
            `Invalid field element: expected bigint, got ${typeof num}`,
          );
        return _0n2 <= num && num < ORDER;
      },
      is0: (num) => num === _0n2,
      isOdd: (num) => (num & _1n2) === _1n2,
      neg: (num) => mod(-num, ORDER),
      eql: (lhs, rhs) => lhs === rhs,
      sqr: (num) => mod(num * num, ORDER),
      add: (lhs, rhs) => mod(lhs + rhs, ORDER),
      sub: (lhs, rhs) => mod(lhs - rhs, ORDER),
      mul: (lhs, rhs) => mod(lhs * rhs, ORDER),
      pow: (num, power) => FpPow(f, num, power),
      div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),
      // Same as above, but doesn't normalize
      sqrN: (num) => num * num,
      addN: (lhs, rhs) => lhs + rhs,
      subN: (lhs, rhs) => lhs - rhs,
      mulN: (lhs, rhs) => lhs * rhs,
      inv: (num) => invert(num, ORDER),
      sqrt: redef.sqrt || ((n) => sqrtP(f, n)),
      invertBatch: (lst) => FpInvertBatch(f, lst),
      // TODO: do we really need constant cmov?
      // We don't have const-time bigints anyway, so probably will be not very useful
      cmov: (a, b, c) => (c ? b : a),
      toBytes: (num) =>
        isLE2 ? numberToBytesLE(num, BYTES) : numberToBytesBE(num, BYTES),
      fromBytes: (bytes2) => {
        if (bytes2.length !== BYTES)
          throw new Error(
            `Fp.fromBytes: expected ${BYTES}, got ${bytes2.length}`,
          );
        return isLE2 ? bytesToNumberLE(bytes2) : bytesToNumberBE(bytes2);
      },
    });
    return Object.freeze(f);
  }
  function FpSqrtEven(Fp8, elm) {
    if (!Fp8.isOdd) throw new Error(`Field doesn't have isOdd`);
    const root = Fp8.sqrt(elm);
    return Fp8.isOdd(root) ? Fp8.neg(root) : root;
  }
  function getFieldBytesLength(fieldOrder) {
    if (typeof fieldOrder !== "bigint")
      throw new Error("field order must be bigint");
    const bitLength = fieldOrder.toString(2).length;
    return Math.ceil(bitLength / 8);
  }
  function getMinHashLength(fieldOrder) {
    const length = getFieldBytesLength(fieldOrder);
    return length + Math.ceil(length / 2);
  }
  function mapHashToField(key, fieldOrder, isLE2 = false) {
    const len = key.length;
    const fieldLen = getFieldBytesLength(fieldOrder);
    const minLen = getMinHashLength(fieldOrder);
    if (len < 16 || len < minLen || len > 1024)
      throw new Error(`expected ${minLen}-1024 bytes of input, got ${len}`);
    const num = isLE2 ? bytesToNumberBE(key) : bytesToNumberLE(key);
    const reduced = mod(num, fieldOrder - _1n2) + _1n2;
    return isLE2
      ? numberToBytesLE(reduced, fieldLen)
      : numberToBytesBE(reduced, fieldLen);
  }

  // ../esm/abstract/curve.js
  var _0n3 = BigInt(0);
  var _1n3 = BigInt(1);
  function wNAF(c, bits) {
    const constTimeNegate = (condition, item) => {
      const neg = item.negate();
      return condition ? neg : item;
    };
    const opts = (W) => {
      const windows = Math.ceil(bits / W) + 1;
      const windowSize = 2 ** (W - 1);
      return { windows, windowSize };
    };
    return {
      constTimeNegate,
      // non-const time multiplication ladder
      unsafeLadder(elm, n) {
        let p = c.ZERO;
        let d = elm;
        while (n > _0n3) {
          if (n & _1n3) p = p.add(d);
          d = d.double();
          n >>= _1n3;
        }
        return p;
      },
      /**
       * Creates a wNAF precomputation window. Used for caching.
       * Default window size is set by `utils.precompute()` and is equal to 8.
       * Number of precomputed points depends on the curve size:
       * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
       * - 𝑊 is the window size
       * - 𝑛 is the bitlength of the curve order.
       * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
       * @returns precomputed point tables flattened to a single array
       */
      precomputeWindow(elm, W) {
        const { windows, windowSize } = opts(W);
        const points = [];
        let p = elm;
        let base = p;
        for (let window = 0; window < windows; window++) {
          base = p;
          points.push(base);
          for (let i = 1; i < windowSize; i++) {
            base = base.add(p);
            points.push(base);
          }
          p = base.double();
        }
        return points;
      },
      /**
       * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
       * @param W window size
       * @param precomputes precomputed tables
       * @param n scalar (we don't check here, but should be less than curve order)
       * @returns real and fake (for const-time) points
       */
      wNAF(W, precomputes, n) {
        const { windows, windowSize } = opts(W);
        let p = c.ZERO;
        let f = c.BASE;
        const mask = BigInt(2 ** W - 1);
        const maxNumber = 2 ** W;
        const shiftBy = BigInt(W);
        for (let window = 0; window < windows; window++) {
          const offset = window * windowSize;
          let wbits = Number(n & mask);
          n >>= shiftBy;
          if (wbits > windowSize) {
            wbits -= maxNumber;
            n += _1n3;
          }
          const offset1 = offset;
          const offset2 = offset + Math.abs(wbits) - 1;
          const cond1 = window % 2 !== 0;
          const cond2 = wbits < 0;
          if (wbits === 0) {
            f = f.add(constTimeNegate(cond1, precomputes[offset1]));
          } else {
            p = p.add(constTimeNegate(cond2, precomputes[offset2]));
          }
        }
        return { p, f };
      },
      wNAFCached(P3, precomputesMap, n, transform) {
        const W = P3._WINDOW_SIZE || 1;
        let comp = precomputesMap.get(P3);
        if (!comp) {
          comp = this.precomputeWindow(P3, W);
          if (W !== 1) {
            precomputesMap.set(P3, transform(comp));
          }
        }
        return this.wNAF(W, comp, n);
      },
    };
  }
  function validateBasic(curve) {
    validateField(curve.Fp);
    validateObject(
      curve,
      {
        n: "bigint",
        h: "bigint",
        Gx: "field",
        Gy: "field",
      },
      {
        nBitLength: "isSafeInteger",
        nByteLength: "isSafeInteger",
      },
    );
    return Object.freeze({
      ...nLength(curve.n, curve.nBitLength),
      ...curve,
      ...{ p: curve.Fp.ORDER },
    });
  }

  // ../esm/abstract/weierstrass.js
  function validatePointOpts(curve) {
    const opts = validateBasic(curve);
    validateObject(
      opts,
      {
        a: "field",
        b: "field",
      },
      {
        allowedPrivateKeyLengths: "array",
        wrapPrivateKey: "boolean",
        isTorsionFree: "function",
        clearCofactor: "function",
        allowInfinityPoint: "boolean",
        fromBytes: "function",
        toBytes: "function",
      },
    );
    const { endo, Fp: Fp8, a } = opts;
    if (endo) {
      if (!Fp8.eql(a, Fp8.ZERO)) {
        throw new Error(
          "Endomorphism can only be defined for Koblitz curves that have a=0",
        );
      }
      if (
        typeof endo !== "object" ||
        typeof endo.beta !== "bigint" ||
        typeof endo.splitScalar !== "function"
      ) {
        throw new Error(
          "Expected endomorphism with beta: bigint and splitScalar: function",
        );
      }
    }
    return Object.freeze({ ...opts });
  }
  var { bytesToNumberBE: b2n, hexToBytes: h2b } = utils_exports;
  var DER = {
    // asn.1 DER encoding utils
    Err: class DERErr extends Error {
      constructor(m = "") {
        super(m);
      }
    },
    _parseInt(data) {
      const { Err: E } = DER;
      if (data.length < 2 || data[0] !== 2)
        throw new E("Invalid signature integer tag");
      const len = data[1];
      const res = data.subarray(2, len + 2);
      if (!len || res.length !== len)
        throw new E("Invalid signature integer: wrong length");
      if (res[0] & 128) throw new E("Invalid signature integer: negative");
      if (res[0] === 0 && !(res[1] & 128))
        throw new E("Invalid signature integer: unnecessary leading zero");
      return { d: b2n(res), l: data.subarray(len + 2) };
    },
    toSig(hex) {
      const { Err: E } = DER;
      const data = typeof hex === "string" ? h2b(hex) : hex;
      if (!(data instanceof Uint8Array)) throw new Error("ui8a expected");
      let l = data.length;
      if (l < 2 || data[0] != 48) throw new E("Invalid signature tag");
      if (data[1] !== l - 2) throw new E("Invalid signature: incorrect length");
      const { d: r, l: sBytes } = DER._parseInt(data.subarray(2));
      const { d: s, l: rBytesLeft } = DER._parseInt(sBytes);
      if (rBytesLeft.length)
        throw new E("Invalid signature: left bytes after parsing");
      return { r, s };
    },
    hexFromSig(sig) {
      const slice = (s2) => (Number.parseInt(s2[0], 16) & 8 ? "00" + s2 : s2);
      const h = (num) => {
        const hex = num.toString(16);
        return hex.length & 1 ? `0${hex}` : hex;
      };
      const s = slice(h(sig.s));
      const r = slice(h(sig.r));
      const shl = s.length / 2;
      const rhl = r.length / 2;
      const sl = h(shl);
      const rl = h(rhl);
      return `30${h(rhl + shl + 4)}02${rl}${r}02${sl}${s}`;
    },
  };
  var _0n4 = BigInt(0);
  var _1n4 = BigInt(1);
  var _2n3 = BigInt(2);
  var _3n2 = BigInt(3);
  var _4n2 = BigInt(4);
  function weierstrassPoints(opts) {
    const CURVE2 = validatePointOpts(opts);
    const { Fp: Fp8 } = CURVE2;
    const toBytes2 =
      CURVE2.toBytes ||
      ((_c, point, _isCompressed) => {
        const a = point.toAffine();
        return concatBytes(
          Uint8Array.from([4]),
          Fp8.toBytes(a.x),
          Fp8.toBytes(a.y),
        );
      });
    const fromBytes =
      CURVE2.fromBytes ||
      ((bytes2) => {
        const tail = bytes2.subarray(1);
        const x = Fp8.fromBytes(tail.subarray(0, Fp8.BYTES));
        const y = Fp8.fromBytes(tail.subarray(Fp8.BYTES, 2 * Fp8.BYTES));
        return { x, y };
      });
    function weierstrassEquation(x) {
      const { a, b } = CURVE2;
      const x2 = Fp8.sqr(x);
      const x3 = Fp8.mul(x2, x);
      return Fp8.add(Fp8.add(x3, Fp8.mul(x, a)), b);
    }
    if (!Fp8.eql(Fp8.sqr(CURVE2.Gy), weierstrassEquation(CURVE2.Gx)))
      throw new Error("bad generator point: equation left != right");
    function isWithinCurveOrder(num) {
      return typeof num === "bigint" && _0n4 < num && num < CURVE2.n;
    }
    function assertGE(num) {
      if (!isWithinCurveOrder(num))
        throw new Error("Expected valid bigint: 0 < bigint < curve.n");
    }
    function normPrivateKeyToScalar(key) {
      const {
        allowedPrivateKeyLengths: lengths,
        nByteLength,
        wrapPrivateKey,
        n,
      } = CURVE2;
      if (lengths && typeof key !== "bigint") {
        if (key instanceof Uint8Array) key = bytesToHex(key);
        if (typeof key !== "string" || !lengths.includes(key.length))
          throw new Error("Invalid key");
        key = key.padStart(nByteLength * 2, "0");
      }
      let num;
      try {
        num =
          typeof key === "bigint"
            ? key
            : bytesToNumberBE(ensureBytes("private key", key, nByteLength));
      } catch (error) {
        throw new Error(
          `private key must be ${nByteLength} bytes, hex or bigint, not ${typeof key}`,
        );
      }
      if (wrapPrivateKey) num = mod(num, n);
      assertGE(num);
      return num;
    }
    const pointPrecomputes = /* @__PURE__ */ new Map();
    function assertPrjPoint(other) {
      if (!(other instanceof Point2))
        throw new Error("ProjectivePoint expected");
    }
    class Point2 {
      constructor(px, py, pz) {
        this.px = px;
        this.py = py;
        this.pz = pz;
        if (px == null || !Fp8.isValid(px)) throw new Error("x required");
        if (py == null || !Fp8.isValid(py)) throw new Error("y required");
        if (pz == null || !Fp8.isValid(pz)) throw new Error("z required");
      }
      // Does not validate if the point is on-curve.
      // Use fromHex instead, or call assertValidity() later.
      static fromAffine(p) {
        const { x, y } = p || {};
        if (!p || !Fp8.isValid(x) || !Fp8.isValid(y))
          throw new Error("invalid affine point");
        if (p instanceof Point2)
          throw new Error("projective point not allowed");
        const is0 = (i) => Fp8.eql(i, Fp8.ZERO);
        if (is0(x) && is0(y)) return Point2.ZERO;
        return new Point2(x, y, Fp8.ONE);
      }
      get x() {
        return this.toAffine().x;
      }
      get y() {
        return this.toAffine().y;
      }
      /**
       * Takes a bunch of Projective Points but executes only one
       * inversion on all of them. Inversion is very slow operation,
       * so this improves performance massively.
       * Optimization: converts a list of projective points to a list of identical points with Z=1.
       */
      static normalizeZ(points) {
        const toInv = Fp8.invertBatch(points.map((p) => p.pz));
        return points
          .map((p, i) => p.toAffine(toInv[i]))
          .map(Point2.fromAffine);
      }
      /**
       * Converts hash string or Uint8Array to Point.
       * @param hex short/long ECDSA hex
       */
      static fromHex(hex) {
        const P3 = Point2.fromAffine(fromBytes(ensureBytes("pointHex", hex)));
        P3.assertValidity();
        return P3;
      }
      // Multiplies generator point by privateKey.
      static fromPrivateKey(privateKey) {
        return Point2.BASE.multiply(normPrivateKeyToScalar(privateKey));
      }
      // "Private method", don't use it directly
      _setWindowSize(windowSize) {
        this._WINDOW_SIZE = windowSize;
        pointPrecomputes.delete(this);
      }
      // A point on curve is valid if it conforms to equation.
      assertValidity() {
        if (this.is0()) {
          if (CURVE2.allowInfinityPoint && !Fp8.is0(this.py)) return;
          throw new Error("bad point: ZERO");
        }
        const { x, y } = this.toAffine();
        if (!Fp8.isValid(x) || !Fp8.isValid(y))
          throw new Error("bad point: x or y not FE");
        const left = Fp8.sqr(y);
        const right = weierstrassEquation(x);
        if (!Fp8.eql(left, right))
          throw new Error("bad point: equation left != right");
        if (!this.isTorsionFree())
          throw new Error("bad point: not in prime-order subgroup");
      }
      hasEvenY() {
        const { y } = this.toAffine();
        if (Fp8.isOdd) return !Fp8.isOdd(y);
        throw new Error("Field doesn't support isOdd");
      }
      /**
       * Compare one point to another.
       */
      equals(other) {
        assertPrjPoint(other);
        const { px: X1, py: Y1, pz: Z1 } = this;
        const { px: X2, py: Y2, pz: Z2 } = other;
        const U1 = Fp8.eql(Fp8.mul(X1, Z2), Fp8.mul(X2, Z1));
        const U2 = Fp8.eql(Fp8.mul(Y1, Z2), Fp8.mul(Y2, Z1));
        return U1 && U2;
      }
      /**
       * Flips point to one corresponding to (x, -y) in Affine coordinates.
       */
      negate() {
        return new Point2(this.px, Fp8.neg(this.py), this.pz);
      }
      // Renes-Costello-Batina exception-free doubling formula.
      // There is 30% faster Jacobian formula, but it is not complete.
      // https://eprint.iacr.org/2015/1060, algorithm 3
      // Cost: 8M + 3S + 3*a + 2*b3 + 15add.
      double() {
        const { a, b } = CURVE2;
        const b3 = Fp8.mul(b, _3n2);
        const { px: X1, py: Y1, pz: Z1 } = this;
        let X3 = Fp8.ZERO,
          Y3 = Fp8.ZERO,
          Z3 = Fp8.ZERO;
        let t0 = Fp8.mul(X1, X1);
        let t1 = Fp8.mul(Y1, Y1);
        let t2 = Fp8.mul(Z1, Z1);
        let t3 = Fp8.mul(X1, Y1);
        t3 = Fp8.add(t3, t3);
        Z3 = Fp8.mul(X1, Z1);
        Z3 = Fp8.add(Z3, Z3);
        X3 = Fp8.mul(a, Z3);
        Y3 = Fp8.mul(b3, t2);
        Y3 = Fp8.add(X3, Y3);
        X3 = Fp8.sub(t1, Y3);
        Y3 = Fp8.add(t1, Y3);
        Y3 = Fp8.mul(X3, Y3);
        X3 = Fp8.mul(t3, X3);
        Z3 = Fp8.mul(b3, Z3);
        t2 = Fp8.mul(a, t2);
        t3 = Fp8.sub(t0, t2);
        t3 = Fp8.mul(a, t3);
        t3 = Fp8.add(t3, Z3);
        Z3 = Fp8.add(t0, t0);
        t0 = Fp8.add(Z3, t0);
        t0 = Fp8.add(t0, t2);
        t0 = Fp8.mul(t0, t3);
        Y3 = Fp8.add(Y3, t0);
        t2 = Fp8.mul(Y1, Z1);
        t2 = Fp8.add(t2, t2);
        t0 = Fp8.mul(t2, t3);
        X3 = Fp8.sub(X3, t0);
        Z3 = Fp8.mul(t2, t1);
        Z3 = Fp8.add(Z3, Z3);
        Z3 = Fp8.add(Z3, Z3);
        return new Point2(X3, Y3, Z3);
      }
      // Renes-Costello-Batina exception-free addition formula.
      // There is 30% faster Jacobian formula, but it is not complete.
      // https://eprint.iacr.org/2015/1060, algorithm 1
      // Cost: 12M + 0S + 3*a + 3*b3 + 23add.
      add(other) {
        assertPrjPoint(other);
        const { px: X1, py: Y1, pz: Z1 } = this;
        const { px: X2, py: Y2, pz: Z2 } = other;
        let X3 = Fp8.ZERO,
          Y3 = Fp8.ZERO,
          Z3 = Fp8.ZERO;
        const a = CURVE2.a;
        const b3 = Fp8.mul(CURVE2.b, _3n2);
        let t0 = Fp8.mul(X1, X2);
        let t1 = Fp8.mul(Y1, Y2);
        let t2 = Fp8.mul(Z1, Z2);
        let t3 = Fp8.add(X1, Y1);
        let t4 = Fp8.add(X2, Y2);
        t3 = Fp8.mul(t3, t4);
        t4 = Fp8.add(t0, t1);
        t3 = Fp8.sub(t3, t4);
        t4 = Fp8.add(X1, Z1);
        let t5 = Fp8.add(X2, Z2);
        t4 = Fp8.mul(t4, t5);
        t5 = Fp8.add(t0, t2);
        t4 = Fp8.sub(t4, t5);
        t5 = Fp8.add(Y1, Z1);
        X3 = Fp8.add(Y2, Z2);
        t5 = Fp8.mul(t5, X3);
        X3 = Fp8.add(t1, t2);
        t5 = Fp8.sub(t5, X3);
        Z3 = Fp8.mul(a, t4);
        X3 = Fp8.mul(b3, t2);
        Z3 = Fp8.add(X3, Z3);
        X3 = Fp8.sub(t1, Z3);
        Z3 = Fp8.add(t1, Z3);
        Y3 = Fp8.mul(X3, Z3);
        t1 = Fp8.add(t0, t0);
        t1 = Fp8.add(t1, t0);
        t2 = Fp8.mul(a, t2);
        t4 = Fp8.mul(b3, t4);
        t1 = Fp8.add(t1, t2);
        t2 = Fp8.sub(t0, t2);
        t2 = Fp8.mul(a, t2);
        t4 = Fp8.add(t4, t2);
        t0 = Fp8.mul(t1, t4);
        Y3 = Fp8.add(Y3, t0);
        t0 = Fp8.mul(t5, t4);
        X3 = Fp8.mul(t3, X3);
        X3 = Fp8.sub(X3, t0);
        t0 = Fp8.mul(t3, t1);
        Z3 = Fp8.mul(t5, Z3);
        Z3 = Fp8.add(Z3, t0);
        return new Point2(X3, Y3, Z3);
      }
      subtract(other) {
        return this.add(other.negate());
      }
      is0() {
        return this.equals(Point2.ZERO);
      }
      wNAF(n) {
        return wnaf.wNAFCached(this, pointPrecomputes, n, (comp) => {
          const toInv = Fp8.invertBatch(comp.map((p) => p.pz));
          return comp
            .map((p, i) => p.toAffine(toInv[i]))
            .map(Point2.fromAffine);
        });
      }
      /**
       * Non-constant-time multiplication. Uses double-and-add algorithm.
       * It's faster, but should only be used when you don't care about
       * an exposed private key e.g. sig verification, which works over *public* keys.
       */
      multiplyUnsafe(n) {
        const I = Point2.ZERO;
        if (n === _0n4) return I;
        assertGE(n);
        if (n === _1n4) return this;
        const { endo } = CURVE2;
        if (!endo) return wnaf.unsafeLadder(this, n);
        let { k1neg, k1, k2neg, k2 } = endo.splitScalar(n);
        let k1p = I;
        let k2p = I;
        let d = this;
        while (k1 > _0n4 || k2 > _0n4) {
          if (k1 & _1n4) k1p = k1p.add(d);
          if (k2 & _1n4) k2p = k2p.add(d);
          d = d.double();
          k1 >>= _1n4;
          k2 >>= _1n4;
        }
        if (k1neg) k1p = k1p.negate();
        if (k2neg) k2p = k2p.negate();
        k2p = new Point2(Fp8.mul(k2p.px, endo.beta), k2p.py, k2p.pz);
        return k1p.add(k2p);
      }
      /**
       * Constant time multiplication.
       * Uses wNAF method. Windowed method may be 10% faster,
       * but takes 2x longer to generate and consumes 2x memory.
       * Uses precomputes when available.
       * Uses endomorphism for Koblitz curves.
       * @param scalar by which the point would be multiplied
       * @returns New point
       */
      multiply(scalar) {
        assertGE(scalar);
        let n = scalar;
        let point, fake;
        const { endo } = CURVE2;
        if (endo) {
          const { k1neg, k1, k2neg, k2 } = endo.splitScalar(n);
          let { p: k1p, f: f1p } = this.wNAF(k1);
          let { p: k2p, f: f2p } = this.wNAF(k2);
          k1p = wnaf.constTimeNegate(k1neg, k1p);
          k2p = wnaf.constTimeNegate(k2neg, k2p);
          k2p = new Point2(Fp8.mul(k2p.px, endo.beta), k2p.py, k2p.pz);
          point = k1p.add(k2p);
          fake = f1p.add(f2p);
        } else {
          const { p, f } = this.wNAF(n);
          point = p;
          fake = f;
        }
        return Point2.normalizeZ([point, fake])[0];
      }
      /**
       * Efficiently calculate `aP + bQ`. Unsafe, can expose private key, if used incorrectly.
       * Not using Strauss-Shamir trick: precomputation tables are faster.
       * The trick could be useful if both P and Q are not G (not in our case).
       * @returns non-zero affine point
       */
      multiplyAndAddUnsafe(Q, a, b) {
        const G = Point2.BASE;
        const mul = (P3, a2) =>
          a2 === _0n4 || a2 === _1n4 || !P3.equals(G)
            ? P3.multiplyUnsafe(a2)
            : P3.multiply(a2);
        const sum = mul(this, a).add(mul(Q, b));
        return sum.is0() ? void 0 : sum;
      }
      // Converts Projective point to affine (x, y) coordinates.
      // Can accept precomputed Z^-1 - for example, from invertBatch.
      // (x, y, z) ∋ (x=x/z, y=y/z)
      toAffine(iz) {
        const { px: x, py: y, pz: z } = this;
        const is0 = this.is0();
        if (iz == null) iz = is0 ? Fp8.ONE : Fp8.inv(z);
        const ax = Fp8.mul(x, iz);
        const ay = Fp8.mul(y, iz);
        const zz = Fp8.mul(z, iz);
        if (is0) return { x: Fp8.ZERO, y: Fp8.ZERO };
        if (!Fp8.eql(zz, Fp8.ONE)) throw new Error("invZ was invalid");
        return { x: ax, y: ay };
      }
      isTorsionFree() {
        const { h: cofactor, isTorsionFree } = CURVE2;
        if (cofactor === _1n4) return true;
        if (isTorsionFree) return isTorsionFree(Point2, this);
        throw new Error(
          "isTorsionFree() has not been declared for the elliptic curve",
        );
      }
      clearCofactor() {
        const { h: cofactor, clearCofactor } = CURVE2;
        if (cofactor === _1n4) return this;
        if (clearCofactor) return clearCofactor(Point2, this);
        return this.multiplyUnsafe(CURVE2.h);
      }
      toRawBytes(isCompressed = true) {
        this.assertValidity();
        return toBytes2(Point2, this, isCompressed);
      }
      toHex(isCompressed = true) {
        return bytesToHex(this.toRawBytes(isCompressed));
      }
    }
    Point2.BASE = new Point2(CURVE2.Gx, CURVE2.Gy, Fp8.ONE);
    Point2.ZERO = new Point2(Fp8.ZERO, Fp8.ONE, Fp8.ZERO);
    const _bits = CURVE2.nBitLength;
    const wnaf = wNAF(Point2, CURVE2.endo ? Math.ceil(_bits / 2) : _bits);
    return {
      CURVE: CURVE2,
      ProjectivePoint: Point2,
      normPrivateKeyToScalar,
      weierstrassEquation,
      isWithinCurveOrder,
    };
  }
  function validateOpts(curve) {
    const opts = validateBasic(curve);
    validateObject(
      opts,
      {
        hash: "hash",
        hmac: "function",
        randomBytes: "function",
      },
      {
        bits2int: "function",
        bits2int_modN: "function",
        lowS: "boolean",
      },
    );
    return Object.freeze({ lowS: true, ...opts });
  }
  function weierstrass(curveDef) {
    const CURVE2 = validateOpts(curveDef);
    const { Fp: Fp8, n: CURVE_ORDER } = CURVE2;
    const compressedLen = Fp8.BYTES + 1;
    const uncompressedLen = 2 * Fp8.BYTES + 1;
    function isValidFieldElement(num) {
      return _0n4 < num && num < Fp8.ORDER;
    }
    function modN2(a) {
      return mod(a, CURVE_ORDER);
    }
    function invN(a) {
      return invert(a, CURVE_ORDER);
    }
    const {
      ProjectivePoint: Point2,
      normPrivateKeyToScalar,
      weierstrassEquation,
      isWithinCurveOrder,
    } = weierstrassPoints({
      ...CURVE2,
      toBytes(_c, point, isCompressed) {
        const a = point.toAffine();
        const x = Fp8.toBytes(a.x);
        const cat = concatBytes;
        if (isCompressed) {
          return cat(Uint8Array.from([point.hasEvenY() ? 2 : 3]), x);
        } else {
          return cat(Uint8Array.from([4]), x, Fp8.toBytes(a.y));
        }
      },
      fromBytes(bytes2) {
        const len = bytes2.length;
        const head = bytes2[0];
        const tail = bytes2.subarray(1);
        if (len === compressedLen && (head === 2 || head === 3)) {
          const x = bytesToNumberBE(tail);
          if (!isValidFieldElement(x)) throw new Error("Point is not on curve");
          const y2 = weierstrassEquation(x);
          let y = Fp8.sqrt(y2);
          const isYOdd = (y & _1n4) === _1n4;
          const isHeadOdd = (head & 1) === 1;
          if (isHeadOdd !== isYOdd) y = Fp8.neg(y);
          return { x, y };
        } else if (len === uncompressedLen && head === 4) {
          const x = Fp8.fromBytes(tail.subarray(0, Fp8.BYTES));
          const y = Fp8.fromBytes(tail.subarray(Fp8.BYTES, 2 * Fp8.BYTES));
          return { x, y };
        } else {
          throw new Error(
            `Point of length ${len} was invalid. Expected ${compressedLen} compressed bytes or ${uncompressedLen} uncompressed bytes`,
          );
        }
      },
    });
    const numToNByteStr = (num) =>
      bytesToHex(numberToBytesBE(num, CURVE2.nByteLength));
    function isBiggerThanHalfOrder(number2) {
      const HALF = CURVE_ORDER >> _1n4;
      return number2 > HALF;
    }
    function normalizeS(s) {
      return isBiggerThanHalfOrder(s) ? modN2(-s) : s;
    }
    const slcNum = (b, from, to) => bytesToNumberBE(b.slice(from, to));
    class Signature {
      constructor(r, s, recovery) {
        this.r = r;
        this.s = s;
        this.recovery = recovery;
        this.assertValidity();
      }
      // pair (bytes of r, bytes of s)
      static fromCompact(hex) {
        const l = CURVE2.nByteLength;
        hex = ensureBytes("compactSignature", hex, l * 2);
        return new Signature(slcNum(hex, 0, l), slcNum(hex, l, 2 * l));
      }
      // DER encoded ECDSA signature
      // https://bitcoin.stackexchange.com/questions/57644/what-are-the-parts-of-a-bitcoin-transaction-input-script
      static fromDER(hex) {
        const { r, s } = DER.toSig(ensureBytes("DER", hex));
        return new Signature(r, s);
      }
      assertValidity() {
        if (!isWithinCurveOrder(this.r))
          throw new Error("r must be 0 < r < CURVE.n");
        if (!isWithinCurveOrder(this.s))
          throw new Error("s must be 0 < s < CURVE.n");
      }
      addRecoveryBit(recovery) {
        return new Signature(this.r, this.s, recovery);
      }
      recoverPublicKey(msgHash) {
        const { r, s, recovery: rec } = this;
        const h = bits2int_modN(ensureBytes("msgHash", msgHash));
        if (rec == null || ![0, 1, 2, 3].includes(rec))
          throw new Error("recovery id invalid");
        const radj = rec === 2 || rec === 3 ? r + CURVE2.n : r;
        if (radj >= Fp8.ORDER) throw new Error("recovery id 2 or 3 invalid");
        const prefix = (rec & 1) === 0 ? "02" : "03";
        const R = Point2.fromHex(prefix + numToNByteStr(radj));
        const ir = invN(radj);
        const u1 = modN2(-h * ir);
        const u2 = modN2(s * ir);
        const Q = Point2.BASE.multiplyAndAddUnsafe(R, u1, u2);
        if (!Q) throw new Error("point at infinify");
        Q.assertValidity();
        return Q;
      }
      // Signatures should be low-s, to prevent malleability.
      hasHighS() {
        return isBiggerThanHalfOrder(this.s);
      }
      normalizeS() {
        return this.hasHighS()
          ? new Signature(this.r, modN2(-this.s), this.recovery)
          : this;
      }
      // DER-encoded
      toDERRawBytes() {
        return hexToBytes(this.toDERHex());
      }
      toDERHex() {
        return DER.hexFromSig({ r: this.r, s: this.s });
      }
      // padded bytes of r, then padded bytes of s
      toCompactRawBytes() {
        return hexToBytes(this.toCompactHex());
      }
      toCompactHex() {
        return numToNByteStr(this.r) + numToNByteStr(this.s);
      }
    }
    const utils2 = {
      isValidPrivateKey(privateKey) {
        try {
          normPrivateKeyToScalar(privateKey);
          return true;
        } catch (error) {
          return false;
        }
      },
      normPrivateKeyToScalar,
      /**
       * Produces cryptographically secure private key from random of size
       * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.
       */
      randomPrivateKey: () => {
        const length = getMinHashLength(CURVE2.n);
        return mapHashToField(CURVE2.randomBytes(length), CURVE2.n);
      },
      /**
       * Creates precompute table for an arbitrary EC point. Makes point "cached".
       * Allows to massively speed-up `point.multiply(scalar)`.
       * @returns cached point
       * @example
       * const fast = utils.precompute(8, ProjectivePoint.fromHex(someonesPubKey));
       * fast.multiply(privKey); // much faster ECDH now
       */
      precompute(windowSize = 8, point = Point2.BASE) {
        point._setWindowSize(windowSize);
        point.multiply(BigInt(3));
        return point;
      },
    };
    function getPublicKey(privateKey, isCompressed = true) {
      return Point2.fromPrivateKey(privateKey).toRawBytes(isCompressed);
    }
    function isProbPub(item) {
      const arr = item instanceof Uint8Array;
      const str = typeof item === "string";
      const len = (arr || str) && item.length;
      if (arr) return len === compressedLen || len === uncompressedLen;
      if (str) return len === 2 * compressedLen || len === 2 * uncompressedLen;
      if (item instanceof Point2) return true;
      return false;
    }
    function getSharedSecret(privateA, publicB, isCompressed = true) {
      if (isProbPub(privateA)) throw new Error("first arg must be private key");
      if (!isProbPub(publicB)) throw new Error("second arg must be public key");
      const b = Point2.fromHex(publicB);
      return b
        .multiply(normPrivateKeyToScalar(privateA))
        .toRawBytes(isCompressed);
    }
    const bits2int =
      CURVE2.bits2int ||
      function (bytes2) {
        const num = bytesToNumberBE(bytes2);
        const delta = bytes2.length * 8 - CURVE2.nBitLength;
        return delta > 0 ? num >> BigInt(delta) : num;
      };
    const bits2int_modN =
      CURVE2.bits2int_modN ||
      function (bytes2) {
        return modN2(bits2int(bytes2));
      };
    const ORDER_MASK = bitMask(CURVE2.nBitLength);
    function int2octets(num) {
      if (typeof num !== "bigint") throw new Error("bigint expected");
      if (!(_0n4 <= num && num < ORDER_MASK))
        throw new Error(`bigint expected < 2^${CURVE2.nBitLength}`);
      return numberToBytesBE(num, CURVE2.nByteLength);
    }
    function prepSig(msgHash, privateKey, opts = defaultSigOpts) {
      if (["recovered", "canonical"].some((k) => k in opts))
        throw new Error("sign() legacy options not supported");
      const { hash: hash2, randomBytes: randomBytes2 } = CURVE2;
      let { lowS, prehash, extraEntropy: ent } = opts;
      if (lowS == null) lowS = true;
      msgHash = ensureBytes("msgHash", msgHash);
      if (prehash) msgHash = ensureBytes("prehashed msgHash", hash2(msgHash));
      const h1int = bits2int_modN(msgHash);
      const d = normPrivateKeyToScalar(privateKey);
      const seedArgs = [int2octets(d), int2octets(h1int)];
      if (ent != null) {
        const e = ent === true ? randomBytes2(Fp8.BYTES) : ent;
        seedArgs.push(ensureBytes("extraEntropy", e));
      }
      const seed = concatBytes(...seedArgs);
      const m = h1int;
      function k2sig(kBytes) {
        const k = bits2int(kBytes);
        if (!isWithinCurveOrder(k)) return;
        const ik = invN(k);
        const q = Point2.BASE.multiply(k).toAffine();
        const r = modN2(q.x);
        if (r === _0n4) return;
        const s = modN2(ik * modN2(m + r * d));
        if (s === _0n4) return;
        let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n4);
        let normS = s;
        if (lowS && isBiggerThanHalfOrder(s)) {
          normS = normalizeS(s);
          recovery ^= 1;
        }
        return new Signature(r, normS, recovery);
      }
      return { seed, k2sig };
    }
    const defaultSigOpts = { lowS: CURVE2.lowS, prehash: false };
    const defaultVerOpts = { lowS: CURVE2.lowS, prehash: false };
    function sign(msgHash, privKey, opts = defaultSigOpts) {
      const { seed, k2sig } = prepSig(msgHash, privKey, opts);
      const C = CURVE2;
      const drbg = createHmacDrbg(C.hash.outputLen, C.nByteLength, C.hmac);
      return drbg(seed, k2sig);
    }
    Point2.BASE._setWindowSize(8);
    function verify(signature, msgHash, publicKey, opts = defaultVerOpts) {
      const sg = signature;
      msgHash = ensureBytes("msgHash", msgHash);
      publicKey = ensureBytes("publicKey", publicKey);
      if ("strict" in opts)
        throw new Error("options.strict was renamed to lowS");
      const { lowS, prehash } = opts;
      let _sig = void 0;
      let P3;
      try {
        if (typeof sg === "string" || sg instanceof Uint8Array) {
          try {
            _sig = Signature.fromDER(sg);
          } catch (derError) {
            if (!(derError instanceof DER.Err)) throw derError;
            _sig = Signature.fromCompact(sg);
          }
        } else if (
          typeof sg === "object" &&
          typeof sg.r === "bigint" &&
          typeof sg.s === "bigint"
        ) {
          const { r: r2, s: s2 } = sg;
          _sig = new Signature(r2, s2);
        } else {
          throw new Error("PARSE");
        }
        P3 = Point2.fromHex(publicKey);
      } catch (error) {
        if (error.message === "PARSE")
          throw new Error(
            `signature must be Signature instance, Uint8Array or hex string`,
          );
        return false;
      }
      if (lowS && _sig.hasHighS()) return false;
      if (prehash) msgHash = CURVE2.hash(msgHash);
      const { r, s } = _sig;
      const h = bits2int_modN(msgHash);
      const is = invN(s);
      const u1 = modN2(h * is);
      const u2 = modN2(r * is);
      const R = Point2.BASE.multiplyAndAddUnsafe(P3, u1, u2)?.toAffine();
      if (!R) return false;
      const v = modN2(R.x);
      return v === r;
    }
    return {
      CURVE: CURVE2,
      getPublicKey,
      getSharedSecret,
      sign,
      verify,
      ProjectivePoint: Point2,
      Signature,
      utils: utils2,
    };
  }
  function SWUFpSqrtRatio(Fp8, Z) {
    const q = Fp8.ORDER;
    let l = _0n4;
    for (let o = q - _1n4; o % _2n3 === _0n4; o /= _2n3) l += _1n4;
    const c1 = l;
    const _2n_pow_c1_1 = _2n3 << (c1 - _1n4 - _1n4);
    const _2n_pow_c1 = _2n_pow_c1_1 * _2n3;
    const c2 = (q - _1n4) / _2n_pow_c1;
    const c3 = (c2 - _1n4) / _2n3;
    const c4 = _2n_pow_c1 - _1n4;
    const c5 = _2n_pow_c1_1;
    const c6 = Fp8.pow(Z, c2);
    const c7 = Fp8.pow(Z, (c2 + _1n4) / _2n3);
    let sqrtRatio = (u, v) => {
      let tv1 = c6;
      let tv2 = Fp8.pow(v, c4);
      let tv3 = Fp8.sqr(tv2);
      tv3 = Fp8.mul(tv3, v);
      let tv5 = Fp8.mul(u, tv3);
      tv5 = Fp8.pow(tv5, c3);
      tv5 = Fp8.mul(tv5, tv2);
      tv2 = Fp8.mul(tv5, v);
      tv3 = Fp8.mul(tv5, u);
      let tv4 = Fp8.mul(tv3, tv2);
      tv5 = Fp8.pow(tv4, c5);
      let isQR = Fp8.eql(tv5, Fp8.ONE);
      tv2 = Fp8.mul(tv3, c7);
      tv5 = Fp8.mul(tv4, tv1);
      tv3 = Fp8.cmov(tv2, tv3, isQR);
      tv4 = Fp8.cmov(tv5, tv4, isQR);
      for (let i = c1; i > _1n4; i--) {
        let tv52 = i - _2n3;
        tv52 = _2n3 << (tv52 - _1n4);
        let tvv5 = Fp8.pow(tv4, tv52);
        const e1 = Fp8.eql(tvv5, Fp8.ONE);
        tv2 = Fp8.mul(tv3, tv1);
        tv1 = Fp8.mul(tv1, tv1);
        tvv5 = Fp8.mul(tv4, tv1);
        tv3 = Fp8.cmov(tv2, tv3, e1);
        tv4 = Fp8.cmov(tvv5, tv4, e1);
      }
      return { isValid: isQR, value: tv3 };
    };
    if (Fp8.ORDER % _4n2 === _3n2) {
      const c12 = (Fp8.ORDER - _3n2) / _4n2;
      const c22 = Fp8.sqrt(Fp8.neg(Z));
      sqrtRatio = (u, v) => {
        let tv1 = Fp8.sqr(v);
        const tv2 = Fp8.mul(u, v);
        tv1 = Fp8.mul(tv1, tv2);
        let y1 = Fp8.pow(tv1, c12);
        y1 = Fp8.mul(y1, tv2);
        const y2 = Fp8.mul(y1, c22);
        const tv3 = Fp8.mul(Fp8.sqr(y1), v);
        const isQR = Fp8.eql(tv3, u);
        let y = Fp8.cmov(y2, y1, isQR);
        return { isValid: isQR, value: y };
      };
    }
    return sqrtRatio;
  }
  function mapToCurveSimpleSWU(Fp8, opts) {
    validateField(Fp8);
    if (!Fp8.isValid(opts.A) || !Fp8.isValid(opts.B) || !Fp8.isValid(opts.Z))
      throw new Error("mapToCurveSimpleSWU: invalid opts");
    const sqrtRatio = SWUFpSqrtRatio(Fp8, opts.Z);
    if (!Fp8.isOdd) throw new Error("Fp.isOdd is not implemented!");
    return (u) => {
      let tv1, tv2, tv3, tv4, tv5, tv6, x, y;
      tv1 = Fp8.sqr(u);
      tv1 = Fp8.mul(tv1, opts.Z);
      tv2 = Fp8.sqr(tv1);
      tv2 = Fp8.add(tv2, tv1);
      tv3 = Fp8.add(tv2, Fp8.ONE);
      tv3 = Fp8.mul(tv3, opts.B);
      tv4 = Fp8.cmov(opts.Z, Fp8.neg(tv2), !Fp8.eql(tv2, Fp8.ZERO));
      tv4 = Fp8.mul(tv4, opts.A);
      tv2 = Fp8.sqr(tv3);
      tv6 = Fp8.sqr(tv4);
      tv5 = Fp8.mul(tv6, opts.A);
      tv2 = Fp8.add(tv2, tv5);
      tv2 = Fp8.mul(tv2, tv3);
      tv6 = Fp8.mul(tv6, tv4);
      tv5 = Fp8.mul(tv6, opts.B);
      tv2 = Fp8.add(tv2, tv5);
      x = Fp8.mul(tv1, tv3);
      const { isValid, value } = sqrtRatio(tv2, tv6);
      y = Fp8.mul(tv1, u);
      y = Fp8.mul(y, value);
      x = Fp8.cmov(x, tv3, isValid);
      y = Fp8.cmov(y, value, isValid);
      const e1 = Fp8.isOdd(u) === Fp8.isOdd(y);
      y = Fp8.cmov(Fp8.neg(y), y, e1);
      x = Fp8.div(x, tv4);
      return { x, y };
    };
  }

  // ../esm/abstract/hash-to-curve.js
  function validateDST(dst) {
    if (dst instanceof Uint8Array) return dst;
    if (typeof dst === "string") return utf8ToBytes(dst);
    throw new Error("DST must be Uint8Array or string");
  }
  var os2ip = bytesToNumberBE;
  function i2osp(value, length) {
    if (value < 0 || value >= 1 << (8 * length)) {
      throw new Error(`bad I2OSP call: value=${value} length=${length}`);
    }
    const res = Array.from({ length }).fill(0);
    for (let i = length - 1; i >= 0; i--) {
      res[i] = value & 255;
      value >>>= 8;
    }
    return new Uint8Array(res);
  }
  function strxor(a, b) {
    const arr = new Uint8Array(a.length);
    for (let i = 0; i < a.length; i++) {
      arr[i] = a[i] ^ b[i];
    }
    return arr;
  }
  function isBytes(item) {
    if (!(item instanceof Uint8Array)) throw new Error("Uint8Array expected");
  }
  function isNum(item) {
    if (!Number.isSafeInteger(item)) throw new Error("number expected");
  }
  function expand_message_xmd(msg, DST, lenInBytes, H) {
    isBytes(msg);
    isBytes(DST);
    isNum(lenInBytes);
    if (DST.length > 255)
      DST = H(concatBytes(utf8ToBytes("H2C-OVERSIZE-DST-"), DST));
    const { outputLen: b_in_bytes, blockLen: r_in_bytes } = H;
    const ell = Math.ceil(lenInBytes / b_in_bytes);
    if (ell > 255) throw new Error("Invalid xmd length");
    const DST_prime = concatBytes(DST, i2osp(DST.length, 1));
    const Z_pad = i2osp(0, r_in_bytes);
    const l_i_b_str = i2osp(lenInBytes, 2);
    const b = new Array(ell);
    const b_0 = H(concatBytes(Z_pad, msg, l_i_b_str, i2osp(0, 1), DST_prime));
    b[0] = H(concatBytes(b_0, i2osp(1, 1), DST_prime));
    for (let i = 1; i <= ell; i++) {
      const args = [strxor(b_0, b[i - 1]), i2osp(i + 1, 1), DST_prime];
      b[i] = H(concatBytes(...args));
    }
    const pseudo_random_bytes = concatBytes(...b);
    return pseudo_random_bytes.slice(0, lenInBytes);
  }
  function expand_message_xof(msg, DST, lenInBytes, k, H) {
    isBytes(msg);
    isBytes(DST);
    isNum(lenInBytes);
    if (DST.length > 255) {
      const dkLen = Math.ceil((2 * k) / 8);
      DST = H.create({ dkLen })
        .update(utf8ToBytes("H2C-OVERSIZE-DST-"))
        .update(DST)
        .digest();
    }
    if (lenInBytes > 65535 || DST.length > 255)
      throw new Error("expand_message_xof: invalid lenInBytes");
    return H.create({ dkLen: lenInBytes })
      .update(msg)
      .update(i2osp(lenInBytes, 2))
      .update(DST)
      .update(i2osp(DST.length, 1))
      .digest();
  }
  function hash_to_field(msg, count, options) {
    validateObject(options, {
      DST: "stringOrUint8Array",
      p: "bigint",
      m: "isSafeInteger",
      k: "isSafeInteger",
      hash: "hash",
    });
    const { p, k, m, hash: hash2, expand, DST: _DST } = options;
    isBytes(msg);
    isNum(count);
    const DST = validateDST(_DST);
    const log2p = p.toString(2).length;
    const L = Math.ceil((log2p + k) / 8);
    const len_in_bytes = count * m * L;
    let prb;
    if (expand === "xmd") {
      prb = expand_message_xmd(msg, DST, len_in_bytes, hash2);
    } else if (expand === "xof") {
      prb = expand_message_xof(msg, DST, len_in_bytes, k, hash2);
    } else if (expand === "_internal_pass") {
      prb = msg;
    } else {
      throw new Error('expand must be "xmd" or "xof"');
    }
    const u = new Array(count);
    for (let i = 0; i < count; i++) {
      const e = new Array(m);
      for (let j = 0; j < m; j++) {
        const elm_offset = L * (j + i * m);
        const tv = prb.subarray(elm_offset, elm_offset + L);
        e[j] = mod(os2ip(tv), p);
      }
      u[i] = e;
    }
    return u;
  }
  function isogenyMap(field, map) {
    const COEFF = map.map((i) => Array.from(i).reverse());
    return (x, y) => {
      const [xNum, xDen, yNum, yDen] = COEFF.map((val) =>
        val.reduce((acc, i) => field.add(field.mul(acc, x), i)),
      );
      x = field.div(xNum, xDen);
      y = field.mul(y, field.div(yNum, yDen));
      return { x, y };
    };
  }
  function createHasher(Point2, mapToCurve, def) {
    if (typeof mapToCurve !== "function")
      throw new Error("mapToCurve() must be defined");
    return {
      // Encodes byte string to elliptic curve.
      // hash_to_curve from https://www.rfc-editor.org/rfc/rfc9380#section-3
      hashToCurve(msg, options) {
        const u = hash_to_field(msg, 2, { ...def, DST: def.DST, ...options });
        const u0 = Point2.fromAffine(mapToCurve(u[0]));
        const u1 = Point2.fromAffine(mapToCurve(u[1]));
        const P3 = u0.add(u1).clearCofactor();
        P3.assertValidity();
        return P3;
      },
      // Encodes byte string to elliptic curve.
      // encode_to_curve from https://www.rfc-editor.org/rfc/rfc9380#section-3
      encodeToCurve(msg, options) {
        const u = hash_to_field(msg, 1, {
          ...def,
          DST: def.encodeDST,
          ...options,
        });
        const P3 = Point2.fromAffine(mapToCurve(u[0])).clearCofactor();
        P3.assertValidity();
        return P3;
      },
    };
  }

  // ../node_modules/@noble/hashes/esm/hmac.js
  var HMAC = class extends Hash {
    constructor(hash2, _key) {
      super();
      this.finished = false;
      this.destroyed = false;
      hash(hash2);
      const key = toBytes(_key);
      this.iHash = hash2.create();
      if (typeof this.iHash.update !== "function")
        throw new Error("Expected instance of class which extends utils.Hash");
      this.blockLen = this.iHash.blockLen;
      this.outputLen = this.iHash.outputLen;
      const blockLen = this.blockLen;
      const pad = new Uint8Array(blockLen);
      pad.set(
        key.length > blockLen ? hash2.create().update(key).digest() : key,
      );
      for (let i = 0; i < pad.length; i++) pad[i] ^= 54;
      this.iHash.update(pad);
      this.oHash = hash2.create();
      for (let i = 0; i < pad.length; i++) pad[i] ^= 54 ^ 92;
      this.oHash.update(pad);
      pad.fill(0);
    }
    update(buf) {
      exists(this);
      this.iHash.update(buf);
      return this;
    }
    digestInto(out) {
      exists(this);
      bytes(out, this.outputLen);
      this.finished = true;
      this.iHash.digestInto(out);
      this.oHash.update(out);
      this.oHash.digestInto(out);
      this.destroy();
    }
    digest() {
      const out = new Uint8Array(this.oHash.outputLen);
      this.digestInto(out);
      return out;
    }
    _cloneInto(to) {
      to || (to = Object.create(Object.getPrototypeOf(this), {}));
      const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
      to = to;
      to.finished = finished;
      to.destroyed = destroyed;
      to.blockLen = blockLen;
      to.outputLen = outputLen;
      to.oHash = oHash._cloneInto(to.oHash);
      to.iHash = iHash._cloneInto(to.iHash);
      return to;
    }
    destroy() {
      this.destroyed = true;
      this.oHash.destroy();
      this.iHash.destroy();
    }
  };
  var hmac = (hash2, key, message) =>
    new HMAC(hash2, key).update(message).digest();
  hmac.create = (hash2, key) => new HMAC(hash2, key);

  // ../esm/_shortw_utils.js
  function getHash(hash2) {
    return {
      hash: hash2,
      hmac: (key, ...msgs) => hmac(hash2, key, concatBytes2(...msgs)),
      randomBytes,
    };
  }
  function createCurve(curveDef, defHash) {
    const create = (hash2) => weierstrass({ ...curveDef, ...getHash(hash2) });
    return Object.freeze({ ...create(defHash), create });
  }

  // ../esm/secp256k1.js
  var secp256k1P = BigInt(
    "0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f",
  );
  var secp256k1N = BigInt(
    "0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141",
  );
  var _1n5 = BigInt(1);
  var _2n4 = BigInt(2);
  var divNearest = (a, b) => (a + b / _2n4) / b;
  function sqrtMod(y) {
    const P3 = secp256k1P;
    const _3n6 = BigInt(3),
      _6n = BigInt(6),
      _11n2 = BigInt(11),
      _22n2 = BigInt(22);
    const _23n = BigInt(23),
      _44n2 = BigInt(44),
      _88n2 = BigInt(88);
    const b2 = (y * y * y) % P3;
    const b3 = (b2 * b2 * y) % P3;
    const b6 = (pow2(b3, _3n6, P3) * b3) % P3;
    const b9 = (pow2(b6, _3n6, P3) * b3) % P3;
    const b11 = (pow2(b9, _2n4, P3) * b2) % P3;
    const b22 = (pow2(b11, _11n2, P3) * b11) % P3;
    const b44 = (pow2(b22, _22n2, P3) * b22) % P3;
    const b88 = (pow2(b44, _44n2, P3) * b44) % P3;
    const b176 = (pow2(b88, _88n2, P3) * b88) % P3;
    const b220 = (pow2(b176, _44n2, P3) * b44) % P3;
    const b223 = (pow2(b220, _3n6, P3) * b3) % P3;
    const t1 = (pow2(b223, _23n, P3) * b22) % P3;
    const t2 = (pow2(t1, _6n, P3) * b2) % P3;
    const root = pow2(t2, _2n4, P3);
    if (!Fp.eql(Fp.sqr(root), y)) throw new Error("Cannot find square root");
    return root;
  }
  var Fp = Field(secp256k1P, void 0, void 0, { sqrt: sqrtMod });
  var secp256k1 = createCurve(
    {
      a: BigInt(0),
      b: BigInt(7),
      Fp,
      n: secp256k1N,
      // Base point (x, y) aka generator point
      Gx: BigInt(
        "55066263022277343669578718895168534326250603453777594175500187360389116729240",
      ),
      Gy: BigInt(
        "32670510020758816978083085130507043184471273380659243275938904335757337482424",
      ),
      h: BigInt(1),
      lowS: true,
      /**
       * secp256k1 belongs to Koblitz curves: it has efficiently computable endomorphism.
       * Endomorphism uses 2x less RAM, speeds up precomputation by 2x and ECDH / key recovery by 20%.
       * For precomputed wNAF it trades off 1/2 init time & 1/3 ram for 20% perf hit.
       * Explanation: https://gist.github.com/paulmillr/eb670806793e84df628a7c434a873066
       */
      endo: {
        beta: BigInt(
          "0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee",
        ),
        splitScalar: (k) => {
          const n = secp256k1N;
          const a1 = BigInt("0x3086d221a7d46bcde86c90e49284eb15");
          const b1 = -_1n5 * BigInt("0xe4437ed6010e88286f547fa90abfe4c3");
          const a2 = BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8");
          const b2 = a1;
          const POW_2_128 = BigInt("0x100000000000000000000000000000000");
          const c1 = divNearest(b2 * k, n);
          const c2 = divNearest(-b1 * k, n);
          let k1 = mod(k - c1 * a1 - c2 * a2, n);
          let k2 = mod(-c1 * b1 - c2 * b2, n);
          const k1neg = k1 > POW_2_128;
          const k2neg = k2 > POW_2_128;
          if (k1neg) k1 = n - k1;
          if (k2neg) k2 = n - k2;
          if (k1 > POW_2_128 || k2 > POW_2_128) {
            throw new Error("splitScalar: Endomorphism failed, k=" + k);
          }
          return { k1neg, k1, k2neg, k2 };
        },
      },
    },
    sha256,
  );
  var _0n5 = BigInt(0);
  var fe = (x) => typeof x === "bigint" && _0n5 < x && x < secp256k1P;
  var ge = (x) => typeof x === "bigint" && _0n5 < x && x < secp256k1N;
  var TAGGED_HASH_PREFIXES = {};
  function taggedHash(tag, ...messages) {
    let tagP = TAGGED_HASH_PREFIXES[tag];
    if (tagP === void 0) {
      const tagH = sha256(Uint8Array.from(tag, (c) => c.charCodeAt(0)));
      tagP = concatBytes(tagH, tagH);
      TAGGED_HASH_PREFIXES[tag] = tagP;
    }
    return sha256(concatBytes(tagP, ...messages));
  }
  var pointToBytes = (point) => point.toRawBytes(true).slice(1);
  var numTo32b = (n) => numberToBytesBE(n, 32);
  var modP = (x) => mod(x, secp256k1P);
  var modN = (x) => mod(x, secp256k1N);
  var Point = secp256k1.ProjectivePoint;
  var GmulAdd = (Q, a, b) => Point.BASE.multiplyAndAddUnsafe(Q, a, b);
  function schnorrGetExtPubKey(priv) {
    let d_ = secp256k1.utils.normPrivateKeyToScalar(priv);
    let p = Point.fromPrivateKey(d_);
    const scalar = p.hasEvenY() ? d_ : modN(-d_);
    return { scalar, bytes: pointToBytes(p) };
  }
  function lift_x(x) {
    if (!fe(x)) throw new Error("bad x: need 0 < x < p");
    const xx = modP(x * x);
    const c = modP(xx * x + BigInt(7));
    let y = sqrtMod(c);
    if (y % _2n4 !== _0n5) y = modP(-y);
    const p = new Point(x, y, _1n5);
    p.assertValidity();
    return p;
  }
  function challenge(...args) {
    return modN(bytesToNumberBE(taggedHash("BIP0340/challenge", ...args)));
  }
  function schnorrGetPublicKey(privateKey) {
    return schnorrGetExtPubKey(privateKey).bytes;
  }
  function schnorrSign(message, privateKey, auxRand = randomBytes(32)) {
    const m = ensureBytes("message", message);
    const { bytes: px, scalar: d } = schnorrGetExtPubKey(privateKey);
    const a = ensureBytes("auxRand", auxRand, 32);
    const t = numTo32b(d ^ bytesToNumberBE(taggedHash("BIP0340/aux", a)));
    const rand = taggedHash("BIP0340/nonce", t, px, m);
    const k_ = modN(bytesToNumberBE(rand));
    if (k_ === _0n5) throw new Error("sign failed: k is zero");
    const { bytes: rx, scalar: k } = schnorrGetExtPubKey(k_);
    const e = challenge(rx, px, m);
    const sig = new Uint8Array(64);
    sig.set(rx, 0);
    sig.set(numTo32b(modN(k + e * d)), 32);
    if (!schnorrVerify(sig, m, px))
      throw new Error("sign: Invalid signature produced");
    return sig;
  }
  function schnorrVerify(signature, message, publicKey) {
    const sig = ensureBytes("signature", signature, 64);
    const m = ensureBytes("message", message);
    const pub = ensureBytes("publicKey", publicKey, 32);
    try {
      const P3 = lift_x(bytesToNumberBE(pub));
      const r = bytesToNumberBE(sig.subarray(0, 32));
      if (!fe(r)) return false;
      const s = bytesToNumberBE(sig.subarray(32, 64));
      if (!ge(s)) return false;
      const e = challenge(numTo32b(r), pointToBytes(P3), m);
      const R = GmulAdd(P3, s, modN(-e));
      if (!R || !R.hasEvenY() || R.toAffine().x !== r) return false;
      return true;
    } catch (error) {
      return false;
    }
  }
  var schnorr = /* @__PURE__ */ (() => ({
    getPublicKey: schnorrGetPublicKey,
    sign: schnorrSign,
    verify: schnorrVerify,
    utils: {
      randomPrivateKey: secp256k1.utils.randomPrivateKey,
      lift_x,
      pointToBytes,
      numberToBytesBE,
      bytesToNumberBE,
      taggedHash,
      mod,
    },
  }))();

  // ../node_modules/@noble/hashes/esm/_u64.js
  var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
  var _32n = /* @__PURE__ */ BigInt(32);
  function fromBig(n, le = false) {
    if (le)
      return { h: Number(n & U32_MASK64), l: Number((n >> _32n) & U32_MASK64) };
    return {
      h: Number((n >> _32n) & U32_MASK64) | 0,
      l: Number(n & U32_MASK64) | 0,
    };
  }
  function split(lst, le = false) {
    let Ah = new Uint32Array(lst.length);
    let Al = new Uint32Array(lst.length);
    for (let i = 0; i < lst.length; i++) {
      const { h, l } = fromBig(lst[i], le);
      [Ah[i], Al[i]] = [h, l];
    }
    return [Ah, Al];
  }
  var toBig = (h, l) => (BigInt(h >>> 0) << _32n) | BigInt(l >>> 0);
  var shrSH = (h, _l, s) => h >>> s;
  var shrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);
  var rotrSH = (h, l, s) => (h >>> s) | (l << (32 - s));
  var rotrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);
  var rotrBH = (h, l, s) => (h << (64 - s)) | (l >>> (s - 32));
  var rotrBL = (h, l, s) => (h >>> (s - 32)) | (l << (64 - s));
  var rotr32H = (_h, l) => l;
  var rotr32L = (h, _l) => h;
  var rotlSH = (h, l, s) => (h << s) | (l >>> (32 - s));
  var rotlSL = (h, l, s) => (l << s) | (h >>> (32 - s));
  var rotlBH = (h, l, s) => (l << (s - 32)) | (h >>> (64 - s));
  var rotlBL = (h, l, s) => (h << (s - 32)) | (l >>> (64 - s));
  function add(Ah, Al, Bh, Bl) {
    const l = (Al >>> 0) + (Bl >>> 0);
    return { h: (Ah + Bh + ((l / 2 ** 32) | 0)) | 0, l: l | 0 };
  }
  var add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
  var add3H = (low, Ah, Bh, Ch) => (Ah + Bh + Ch + ((low / 2 ** 32) | 0)) | 0;
  var add4L = (Al, Bl, Cl, Dl) =>
    (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
  var add4H = (low, Ah, Bh, Ch, Dh) =>
    (Ah + Bh + Ch + Dh + ((low / 2 ** 32) | 0)) | 0;
  var add5L = (Al, Bl, Cl, Dl, El) =>
    (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
  var add5H = (low, Ah, Bh, Ch, Dh, Eh) =>
    (Ah + Bh + Ch + Dh + Eh + ((low / 2 ** 32) | 0)) | 0;
  var u64 = {
    fromBig,
    split,
    toBig,
    shrSH,
    shrSL,
    rotrSH,
    rotrSL,
    rotrBH,
    rotrBL,
    rotr32H,
    rotr32L,
    rotlSH,
    rotlSL,
    rotlBH,
    rotlBL,
    add,
    add3L,
    add3H,
    add4L,
    add4H,
    add5H,
    add5L,
  };
  var u64_default = u64;

  // ../node_modules/@noble/hashes/esm/sha512.js
  var [SHA512_Kh, SHA512_Kl] = /* @__PURE__ */ (() =>
    u64_default.split(
      [
        "0x428a2f98d728ae22",
        "0x7137449123ef65cd",
        "0xb5c0fbcfec4d3b2f",
        "0xe9b5dba58189dbbc",
        "0x3956c25bf348b538",
        "0x59f111f1b605d019",
        "0x923f82a4af194f9b",
        "0xab1c5ed5da6d8118",
        "0xd807aa98a3030242",
        "0x12835b0145706fbe",
        "0x243185be4ee4b28c",
        "0x550c7dc3d5ffb4e2",
        "0x72be5d74f27b896f",
        "0x80deb1fe3b1696b1",
        "0x9bdc06a725c71235",
        "0xc19bf174cf692694",
        "0xe49b69c19ef14ad2",
        "0xefbe4786384f25e3",
        "0x0fc19dc68b8cd5b5",
        "0x240ca1cc77ac9c65",
        "0x2de92c6f592b0275",
        "0x4a7484aa6ea6e483",
        "0x5cb0a9dcbd41fbd4",
        "0x76f988da831153b5",
        "0x983e5152ee66dfab",
        "0xa831c66d2db43210",
        "0xb00327c898fb213f",
        "0xbf597fc7beef0ee4",
        "0xc6e00bf33da88fc2",
        "0xd5a79147930aa725",
        "0x06ca6351e003826f",
        "0x142929670a0e6e70",
        "0x27b70a8546d22ffc",
        "0x2e1b21385c26c926",
        "0x4d2c6dfc5ac42aed",
        "0x53380d139d95b3df",
        "0x650a73548baf63de",
        "0x766a0abb3c77b2a8",
        "0x81c2c92e47edaee6",
        "0x92722c851482353b",
        "0xa2bfe8a14cf10364",
        "0xa81a664bbc423001",
        "0xc24b8b70d0f89791",
        "0xc76c51a30654be30",
        "0xd192e819d6ef5218",
        "0xd69906245565a910",
        "0xf40e35855771202a",
        "0x106aa07032bbd1b8",
        "0x19a4c116b8d2d0c8",
        "0x1e376c085141ab53",
        "0x2748774cdf8eeb99",
        "0x34b0bcb5e19b48a8",
        "0x391c0cb3c5c95a63",
        "0x4ed8aa4ae3418acb",
        "0x5b9cca4f7763e373",
        "0x682e6ff3d6b2b8a3",
        "0x748f82ee5defb2fc",
        "0x78a5636f43172f60",
        "0x84c87814a1f0ab72",
        "0x8cc702081a6439ec",
        "0x90befffa23631e28",
        "0xa4506cebde82bde9",
        "0xbef9a3f7b2c67915",
        "0xc67178f2e372532b",
        "0xca273eceea26619c",
        "0xd186b8c721c0c207",
        "0xeada7dd6cde0eb1e",
        "0xf57d4f7fee6ed178",
        "0x06f067aa72176fba",
        "0x0a637dc5a2c898a6",
        "0x113f9804bef90dae",
        "0x1b710b35131c471b",
        "0x28db77f523047d84",
        "0x32caab7b40c72493",
        "0x3c9ebe0a15c9bebc",
        "0x431d67c49c100d4c",
        "0x4cc5d4becb3e42b6",
        "0x597f299cfc657e2a",
        "0x5fcb6fab3ad6faec",
        "0x6c44198c4a475817",
      ].map((n) => BigInt(n)),
    ))();
  var SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
  var SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
  var SHA512 = class extends SHA2 {
    constructor() {
      super(128, 64, 16, false);
      this.Ah = 1779033703 | 0;
      this.Al = 4089235720 | 0;
      this.Bh = 3144134277 | 0;
      this.Bl = 2227873595 | 0;
      this.Ch = 1013904242 | 0;
      this.Cl = 4271175723 | 0;
      this.Dh = 2773480762 | 0;
      this.Dl = 1595750129 | 0;
      this.Eh = 1359893119 | 0;
      this.El = 2917565137 | 0;
      this.Fh = 2600822924 | 0;
      this.Fl = 725511199 | 0;
      this.Gh = 528734635 | 0;
      this.Gl = 4215389547 | 0;
      this.Hh = 1541459225 | 0;
      this.Hl = 327033209 | 0;
    }
    // prettier-ignore
    get() {
      const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
      return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];
    }
    // prettier-ignore
    set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {
      this.Ah = Ah | 0;
      this.Al = Al | 0;
      this.Bh = Bh | 0;
      this.Bl = Bl | 0;
      this.Ch = Ch | 0;
      this.Cl = Cl | 0;
      this.Dh = Dh | 0;
      this.Dl = Dl | 0;
      this.Eh = Eh | 0;
      this.El = El | 0;
      this.Fh = Fh | 0;
      this.Fl = Fl | 0;
      this.Gh = Gh | 0;
      this.Gl = Gl | 0;
      this.Hh = Hh | 0;
      this.Hl = Hl | 0;
    }
    process(view, offset) {
      for (let i = 0; i < 16; i++, offset += 4) {
        SHA512_W_H[i] = view.getUint32(offset);
        SHA512_W_L[i] = view.getUint32((offset += 4));
      }
      for (let i = 16; i < 80; i++) {
        const W15h = SHA512_W_H[i - 15] | 0;
        const W15l = SHA512_W_L[i - 15] | 0;
        const s0h =
          u64_default.rotrSH(W15h, W15l, 1) ^
          u64_default.rotrSH(W15h, W15l, 8) ^
          u64_default.shrSH(W15h, W15l, 7);
        const s0l =
          u64_default.rotrSL(W15h, W15l, 1) ^
          u64_default.rotrSL(W15h, W15l, 8) ^
          u64_default.shrSL(W15h, W15l, 7);
        const W2h = SHA512_W_H[i - 2] | 0;
        const W2l = SHA512_W_L[i - 2] | 0;
        const s1h =
          u64_default.rotrSH(W2h, W2l, 19) ^
          u64_default.rotrBH(W2h, W2l, 61) ^
          u64_default.shrSH(W2h, W2l, 6);
        const s1l =
          u64_default.rotrSL(W2h, W2l, 19) ^
          u64_default.rotrBL(W2h, W2l, 61) ^
          u64_default.shrSL(W2h, W2l, 6);
        const SUMl = u64_default.add4L(
          s0l,
          s1l,
          SHA512_W_L[i - 7],
          SHA512_W_L[i - 16],
        );
        const SUMh = u64_default.add4H(
          SUMl,
          s0h,
          s1h,
          SHA512_W_H[i - 7],
          SHA512_W_H[i - 16],
        );
        SHA512_W_H[i] = SUMh | 0;
        SHA512_W_L[i] = SUMl | 0;
      }
      let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } =
        this;
      for (let i = 0; i < 80; i++) {
        const sigma1h =
          u64_default.rotrSH(Eh, El, 14) ^
          u64_default.rotrSH(Eh, El, 18) ^
          u64_default.rotrBH(Eh, El, 41);
        const sigma1l =
          u64_default.rotrSL(Eh, El, 14) ^
          u64_default.rotrSL(Eh, El, 18) ^
          u64_default.rotrBL(Eh, El, 41);
        const CHIh = (Eh & Fh) ^ (~Eh & Gh);
        const CHIl = (El & Fl) ^ (~El & Gl);
        const T1ll = u64_default.add5L(
          Hl,
          sigma1l,
          CHIl,
          SHA512_Kl[i],
          SHA512_W_L[i],
        );
        const T1h = u64_default.add5H(
          T1ll,
          Hh,
          sigma1h,
          CHIh,
          SHA512_Kh[i],
          SHA512_W_H[i],
        );
        const T1l = T1ll | 0;
        const sigma0h =
          u64_default.rotrSH(Ah, Al, 28) ^
          u64_default.rotrBH(Ah, Al, 34) ^
          u64_default.rotrBH(Ah, Al, 39);
        const sigma0l =
          u64_default.rotrSL(Ah, Al, 28) ^
          u64_default.rotrBL(Ah, Al, 34) ^
          u64_default.rotrBL(Ah, Al, 39);
        const MAJh = (Ah & Bh) ^ (Ah & Ch) ^ (Bh & Ch);
        const MAJl = (Al & Bl) ^ (Al & Cl) ^ (Bl & Cl);
        Hh = Gh | 0;
        Hl = Gl | 0;
        Gh = Fh | 0;
        Gl = Fl | 0;
        Fh = Eh | 0;
        Fl = El | 0;
        ({ h: Eh, l: El } = u64_default.add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));
        Dh = Ch | 0;
        Dl = Cl | 0;
        Ch = Bh | 0;
        Cl = Bl | 0;
        Bh = Ah | 0;
        Bl = Al | 0;
        const All = u64_default.add3L(T1l, sigma0l, MAJl);
        Ah = u64_default.add3H(All, T1h, sigma0h, MAJh);
        Al = All | 0;
      }
      ({ h: Ah, l: Al } = u64_default.add(
        this.Ah | 0,
        this.Al | 0,
        Ah | 0,
        Al | 0,
      ));
      ({ h: Bh, l: Bl } = u64_default.add(
        this.Bh | 0,
        this.Bl | 0,
        Bh | 0,
        Bl | 0,
      ));
      ({ h: Ch, l: Cl } = u64_default.add(
        this.Ch | 0,
        this.Cl | 0,
        Ch | 0,
        Cl | 0,
      ));
      ({ h: Dh, l: Dl } = u64_default.add(
        this.Dh | 0,
        this.Dl | 0,
        Dh | 0,
        Dl | 0,
      ));
      ({ h: Eh, l: El } = u64_default.add(
        this.Eh | 0,
        this.El | 0,
        Eh | 0,
        El | 0,
      ));
      ({ h: Fh, l: Fl } = u64_default.add(
        this.Fh | 0,
        this.Fl | 0,
        Fh | 0,
        Fl | 0,
      ));
      ({ h: Gh, l: Gl } = u64_default.add(
        this.Gh | 0,
        this.Gl | 0,
        Gh | 0,
        Gl | 0,
      ));
      ({ h: Hh, l: Hl } = u64_default.add(
        this.Hh | 0,
        this.Hl | 0,
        Hh | 0,
        Hl | 0,
      ));
      this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
    }
    roundClean() {
      SHA512_W_H.fill(0);
      SHA512_W_L.fill(0);
    }
    destroy() {
      this.buffer.fill(0);
      this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
    }
  };
  var SHA384 = class extends SHA512 {
    constructor() {
      super();
      this.Ah = 3418070365 | 0;
      this.Al = 3238371032 | 0;
      this.Bh = 1654270250 | 0;
      this.Bl = 914150663 | 0;
      this.Ch = 2438529370 | 0;
      this.Cl = 812702999 | 0;
      this.Dh = 355462360 | 0;
      this.Dl = 4144912697 | 0;
      this.Eh = 1731405415 | 0;
      this.El = 4290775857 | 0;
      this.Fh = 2394180231 | 0;
      this.Fl = 1750603025 | 0;
      this.Gh = 3675008525 | 0;
      this.Gl = 1694076839 | 0;
      this.Hh = 1203062813 | 0;
      this.Hl = 3204075428 | 0;
      this.outputLen = 48;
    }
  };
  var sha512 = /* @__PURE__ */ wrapConstructor(() => new SHA512());
  var sha384 = /* @__PURE__ */ wrapConstructor(() => new SHA384());

  // ../esm/abstract/edwards.js
  var _0n6 = BigInt(0);
  var _1n6 = BigInt(1);
  var _2n5 = BigInt(2);
  var _8n2 = BigInt(8);
  var VERIFY_DEFAULT = { zip215: true };
  function validateOpts2(curve) {
    const opts = validateBasic(curve);
    validateObject(
      curve,
      {
        hash: "function",
        a: "bigint",
        d: "bigint",
        randomBytes: "function",
      },
      {
        adjustScalarBytes: "function",
        domain: "function",
        uvRatio: "function",
        mapToCurve: "function",
      },
    );
    return Object.freeze({ ...opts });
  }
  function twistedEdwards(curveDef) {
    const CURVE2 = validateOpts2(curveDef);
    const {
      Fp: Fp8,
      n: CURVE_ORDER,
      prehash,
      hash: cHash,
      randomBytes: randomBytes2,
      nByteLength,
      h: cofactor,
    } = CURVE2;
    const MASK = _2n5 << (BigInt(nByteLength * 8) - _1n6);
    const modP2 = Fp8.create;
    const uvRatio3 =
      CURVE2.uvRatio ||
      ((u, v) => {
        try {
          return { isValid: true, value: Fp8.sqrt(u * Fp8.inv(v)) };
        } catch (e) {
          return { isValid: false, value: _0n6 };
        }
      });
    const adjustScalarBytes3 = CURVE2.adjustScalarBytes || ((bytes2) => bytes2);
    const domain =
      CURVE2.domain ||
      ((data, ctx, phflag) => {
        if (ctx.length || phflag)
          throw new Error("Contexts/pre-hash are not supported");
        return data;
      });
    const inBig = (n) => typeof n === "bigint" && _0n6 < n;
    const inRange = (n, max) => inBig(n) && inBig(max) && n < max;
    const in0MaskRange = (n) => n === _0n6 || inRange(n, MASK);
    function assertInRange(n, max) {
      if (inRange(n, max)) return n;
      throw new Error(`Expected valid scalar < ${max}, got ${typeof n} ${n}`);
    }
    function assertGE0(n) {
      return n === _0n6 ? n : assertInRange(n, CURVE_ORDER);
    }
    const pointPrecomputes = /* @__PURE__ */ new Map();
    function isPoint(other) {
      if (!(other instanceof Point2)) throw new Error("ExtendedPoint expected");
    }
    class Point2 {
      constructor(ex, ey, ez, et) {
        this.ex = ex;
        this.ey = ey;
        this.ez = ez;
        this.et = et;
        if (!in0MaskRange(ex)) throw new Error("x required");
        if (!in0MaskRange(ey)) throw new Error("y required");
        if (!in0MaskRange(ez)) throw new Error("z required");
        if (!in0MaskRange(et)) throw new Error("t required");
      }
      get x() {
        return this.toAffine().x;
      }
      get y() {
        return this.toAffine().y;
      }
      static fromAffine(p) {
        if (p instanceof Point2) throw new Error("extended point not allowed");
        const { x, y } = p || {};
        if (!in0MaskRange(x) || !in0MaskRange(y))
          throw new Error("invalid affine point");
        return new Point2(x, y, _1n6, modP2(x * y));
      }
      static normalizeZ(points) {
        const toInv = Fp8.invertBatch(points.map((p) => p.ez));
        return points
          .map((p, i) => p.toAffine(toInv[i]))
          .map(Point2.fromAffine);
      }
      // "Private method", don't use it directly
      _setWindowSize(windowSize) {
        this._WINDOW_SIZE = windowSize;
        pointPrecomputes.delete(this);
      }
      // Not required for fromHex(), which always creates valid points.
      // Could be useful for fromAffine().
      assertValidity() {
        const { a, d } = CURVE2;
        if (this.is0()) throw new Error("bad point: ZERO");
        const { ex: X, ey: Y, ez: Z, et: T } = this;
        const X2 = modP2(X * X);
        const Y2 = modP2(Y * Y);
        const Z2 = modP2(Z * Z);
        const Z4 = modP2(Z2 * Z2);
        const aX2 = modP2(X2 * a);
        const left = modP2(Z2 * modP2(aX2 + Y2));
        const right = modP2(Z4 + modP2(d * modP2(X2 * Y2)));
        if (left !== right)
          throw new Error("bad point: equation left != right (1)");
        const XY = modP2(X * Y);
        const ZT = modP2(Z * T);
        if (XY !== ZT) throw new Error("bad point: equation left != right (2)");
      }
      // Compare one point to another.
      equals(other) {
        isPoint(other);
        const { ex: X1, ey: Y1, ez: Z1 } = this;
        const { ex: X2, ey: Y2, ez: Z2 } = other;
        const X1Z2 = modP2(X1 * Z2);
        const X2Z1 = modP2(X2 * Z1);
        const Y1Z2 = modP2(Y1 * Z2);
        const Y2Z1 = modP2(Y2 * Z1);
        return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
      }
      is0() {
        return this.equals(Point2.ZERO);
      }
      negate() {
        return new Point2(modP2(-this.ex), this.ey, this.ez, modP2(-this.et));
      }
      // Fast algo for doubling Extended Point.
      // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
      // Cost: 4M + 4S + 1*a + 6add + 1*2.
      double() {
        const { a } = CURVE2;
        const { ex: X1, ey: Y1, ez: Z1 } = this;
        const A = modP2(X1 * X1);
        const B = modP2(Y1 * Y1);
        const C = modP2(_2n5 * modP2(Z1 * Z1));
        const D = modP2(a * A);
        const x1y1 = X1 + Y1;
        const E = modP2(modP2(x1y1 * x1y1) - A - B);
        const G2 = D + B;
        const F = G2 - C;
        const H = D - B;
        const X3 = modP2(E * F);
        const Y3 = modP2(G2 * H);
        const T3 = modP2(E * H);
        const Z3 = modP2(F * G2);
        return new Point2(X3, Y3, Z3, T3);
      }
      // Fast algo for adding 2 Extended Points.
      // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
      // Cost: 9M + 1*a + 1*d + 7add.
      add(other) {
        isPoint(other);
        const { a, d } = CURVE2;
        const { ex: X1, ey: Y1, ez: Z1, et: T1 } = this;
        const { ex: X2, ey: Y2, ez: Z2, et: T2 } = other;
        if (a === BigInt(-1)) {
          const A2 = modP2((Y1 - X1) * (Y2 + X2));
          const B2 = modP2((Y1 + X1) * (Y2 - X2));
          const F2 = modP2(B2 - A2);
          if (F2 === _0n6) return this.double();
          const C2 = modP2(Z1 * _2n5 * T2);
          const D2 = modP2(T1 * _2n5 * Z2);
          const E2 = D2 + C2;
          const G3 = B2 + A2;
          const H2 = D2 - C2;
          const X32 = modP2(E2 * F2);
          const Y32 = modP2(G3 * H2);
          const T32 = modP2(E2 * H2);
          const Z32 = modP2(F2 * G3);
          return new Point2(X32, Y32, Z32, T32);
        }
        const A = modP2(X1 * X2);
        const B = modP2(Y1 * Y2);
        const C = modP2(T1 * d * T2);
        const D = modP2(Z1 * Z2);
        const E = modP2((X1 + Y1) * (X2 + Y2) - A - B);
        const F = D - C;
        const G2 = D + C;
        const H = modP2(B - a * A);
        const X3 = modP2(E * F);
        const Y3 = modP2(G2 * H);
        const T3 = modP2(E * H);
        const Z3 = modP2(F * G2);
        return new Point2(X3, Y3, Z3, T3);
      }
      subtract(other) {
        return this.add(other.negate());
      }
      wNAF(n) {
        return wnaf.wNAFCached(this, pointPrecomputes, n, Point2.normalizeZ);
      }
      // Constant-time multiplication.
      multiply(scalar) {
        const { p, f } = this.wNAF(assertInRange(scalar, CURVE_ORDER));
        return Point2.normalizeZ([p, f])[0];
      }
      // Non-constant-time multiplication. Uses double-and-add algorithm.
      // It's faster, but should only be used when you don't care about
      // an exposed private key e.g. sig verification.
      // Does NOT allow scalars higher than CURVE.n.
      multiplyUnsafe(scalar) {
        let n = assertGE0(scalar);
        if (n === _0n6) return I;
        if (this.equals(I) || n === _1n6) return this;
        if (this.equals(G)) return this.wNAF(n).p;
        return wnaf.unsafeLadder(this, n);
      }
      // Checks if point is of small order.
      // If you add something to small order point, you will have "dirty"
      // point with torsion component.
      // Multiplies point by cofactor and checks if the result is 0.
      isSmallOrder() {
        return this.multiplyUnsafe(cofactor).is0();
      }
      // Multiplies point by curve order and checks if the result is 0.
      // Returns `false` is the point is dirty.
      isTorsionFree() {
        return wnaf.unsafeLadder(this, CURVE_ORDER).is0();
      }
      // Converts Extended point to default (x, y) coordinates.
      // Can accept precomputed Z^-1 - for example, from invertBatch.
      toAffine(iz) {
        const { ex: x, ey: y, ez: z } = this;
        const is0 = this.is0();
        if (iz == null) iz = is0 ? _8n2 : Fp8.inv(z);
        const ax = modP2(x * iz);
        const ay = modP2(y * iz);
        const zz = modP2(z * iz);
        if (is0) return { x: _0n6, y: _1n6 };
        if (zz !== _1n6) throw new Error("invZ was invalid");
        return { x: ax, y: ay };
      }
      clearCofactor() {
        const { h: cofactor2 } = CURVE2;
        if (cofactor2 === _1n6) return this;
        return this.multiplyUnsafe(cofactor2);
      }
      // Converts hash string or Uint8Array to Point.
      // Uses algo from RFC8032 5.1.3.
      static fromHex(hex, zip215 = false) {
        const { d, a } = CURVE2;
        const len = Fp8.BYTES;
        hex = ensureBytes("pointHex", hex, len);
        const normed = hex.slice();
        const lastByte = hex[len - 1];
        normed[len - 1] = lastByte & ~128;
        const y = bytesToNumberLE(normed);
        if (y === _0n6) {
        } else {
          if (zip215) assertInRange(y, MASK);
          else assertInRange(y, Fp8.ORDER);
        }
        const y2 = modP2(y * y);
        const u = modP2(y2 - _1n6);
        const v = modP2(d * y2 - a);
        let { isValid, value: x } = uvRatio3(u, v);
        if (!isValid) throw new Error("Point.fromHex: invalid y coordinate");
        const isXOdd = (x & _1n6) === _1n6;
        const isLastByteOdd = (lastByte & 128) !== 0;
        if (!zip215 && x === _0n6 && isLastByteOdd)
          throw new Error("Point.fromHex: x=0 and x_0=1");
        if (isLastByteOdd !== isXOdd) x = modP2(-x);
        return Point2.fromAffine({ x, y });
      }
      static fromPrivateKey(privKey) {
        return getExtendedPublicKey(privKey).point;
      }
      toRawBytes() {
        const { x, y } = this.toAffine();
        const bytes2 = numberToBytesLE(y, Fp8.BYTES);
        bytes2[bytes2.length - 1] |= x & _1n6 ? 128 : 0;
        return bytes2;
      }
      toHex() {
        return bytesToHex(this.toRawBytes());
      }
    }
    Point2.BASE = new Point2(
      CURVE2.Gx,
      CURVE2.Gy,
      _1n6,
      modP2(CURVE2.Gx * CURVE2.Gy),
    );
    Point2.ZERO = new Point2(_0n6, _1n6, _1n6, _0n6);
    const { BASE: G, ZERO: I } = Point2;
    const wnaf = wNAF(Point2, nByteLength * 8);
    function modN2(a) {
      return mod(a, CURVE_ORDER);
    }
    function modN_LE(hash2) {
      return modN2(bytesToNumberLE(hash2));
    }
    function getExtendedPublicKey(key) {
      const len = nByteLength;
      key = ensureBytes("private key", key, len);
      const hashed = ensureBytes("hashed private key", cHash(key), 2 * len);
      const head = adjustScalarBytes3(hashed.slice(0, len));
      const prefix = hashed.slice(len, 2 * len);
      const scalar = modN_LE(head);
      const point = G.multiply(scalar);
      const pointBytes = point.toRawBytes();
      return { head, prefix, scalar, point, pointBytes };
    }
    function getPublicKey(privKey) {
      return getExtendedPublicKey(privKey).pointBytes;
    }
    function hashDomainToScalar(context = new Uint8Array(), ...msgs) {
      const msg = concatBytes(...msgs);
      return modN_LE(
        cHash(domain(msg, ensureBytes("context", context), !!prehash)),
      );
    }
    function sign(msg, privKey, options = {}) {
      msg = ensureBytes("message", msg);
      if (prehash) msg = prehash(msg);
      const { prefix, scalar, pointBytes } = getExtendedPublicKey(privKey);
      const r = hashDomainToScalar(options.context, prefix, msg);
      const R = G.multiply(r).toRawBytes();
      const k = hashDomainToScalar(options.context, R, pointBytes, msg);
      const s = modN2(r + k * scalar);
      assertGE0(s);
      const res = concatBytes(R, numberToBytesLE(s, Fp8.BYTES));
      return ensureBytes("result", res, nByteLength * 2);
    }
    const verifyOpts = VERIFY_DEFAULT;
    function verify(sig, msg, publicKey, options = verifyOpts) {
      const { context, zip215 } = options;
      const len = Fp8.BYTES;
      sig = ensureBytes("signature", sig, 2 * len);
      msg = ensureBytes("message", msg);
      if (prehash) msg = prehash(msg);
      const s = bytesToNumberLE(sig.slice(len, 2 * len));
      let A, R, SB;
      try {
        A = Point2.fromHex(publicKey, zip215);
        R = Point2.fromHex(sig.slice(0, len), zip215);
        SB = G.multiplyUnsafe(s);
      } catch (error) {
        return false;
      }
      if (!zip215 && A.isSmallOrder()) return false;
      const k = hashDomainToScalar(
        context,
        R.toRawBytes(),
        A.toRawBytes(),
        msg,
      );
      const RkA = R.add(A.multiplyUnsafe(k));
      return RkA.subtract(SB).clearCofactor().equals(Point2.ZERO);
    }
    G._setWindowSize(8);
    const utils2 = {
      getExtendedPublicKey,
      // ed25519 private keys are uniform 32b. No need to check for modulo bias, like in secp256k1.
      randomPrivateKey: () => randomBytes2(Fp8.BYTES),
      /**
       * We're doing scalar multiplication (used in getPublicKey etc) with precomputed BASE_POINT
       * values. This slows down first getPublicKey() by milliseconds (see Speed section),
       * but allows to speed-up subsequent getPublicKey() calls up to 20x.
       * @param windowSize 2, 4, 8, 16
       */
      precompute(windowSize = 8, point = Point2.BASE) {
        point._setWindowSize(windowSize);
        point.multiply(BigInt(3));
        return point;
      },
    };
    return {
      CURVE: CURVE2,
      getPublicKey,
      sign,
      verify,
      ExtendedPoint: Point2,
      utils: utils2,
    };
  }

  // ../esm/abstract/montgomery.js
  var _0n7 = BigInt(0);
  var _1n7 = BigInt(1);
  function validateOpts3(curve) {
    validateObject(
      curve,
      {
        a: "bigint",
      },
      {
        montgomeryBits: "isSafeInteger",
        nByteLength: "isSafeInteger",
        adjustScalarBytes: "function",
        domain: "function",
        powPminus2: "function",
        Gu: "bigint",
      },
    );
    return Object.freeze({ ...curve });
  }
  function montgomery(curveDef) {
    const CURVE2 = validateOpts3(curveDef);
    const { P: P3 } = CURVE2;
    const modP2 = (n) => mod(n, P3);
    const montgomeryBits = CURVE2.montgomeryBits;
    const montgomeryBytes = Math.ceil(montgomeryBits / 8);
    const fieldLen = CURVE2.nByteLength;
    const adjustScalarBytes3 = CURVE2.adjustScalarBytes || ((bytes2) => bytes2);
    const powPminus2 = CURVE2.powPminus2 || ((x) => pow(x, P3 - BigInt(2), P3));
    function cswap(swap, x_2, x_3) {
      const dummy = modP2(swap * (x_2 - x_3));
      x_2 = modP2(x_2 - dummy);
      x_3 = modP2(x_3 + dummy);
      return [x_2, x_3];
    }
    function assertFieldElement(n) {
      if (typeof n === "bigint" && _0n7 <= n && n < P3) return n;
      throw new Error("Expected valid scalar 0 < scalar < CURVE.P");
    }
    const a24 = (CURVE2.a - BigInt(2)) / BigInt(4);
    function montgomeryLadder(pointU, scalar) {
      const u = assertFieldElement(pointU);
      const k = assertFieldElement(scalar);
      const x_1 = u;
      let x_2 = _1n7;
      let z_2 = _0n7;
      let x_3 = u;
      let z_3 = _1n7;
      let swap = _0n7;
      let sw;
      for (let t = BigInt(montgomeryBits - 1); t >= _0n7; t--) {
        const k_t = (k >> t) & _1n7;
        swap ^= k_t;
        sw = cswap(swap, x_2, x_3);
        x_2 = sw[0];
        x_3 = sw[1];
        sw = cswap(swap, z_2, z_3);
        z_2 = sw[0];
        z_3 = sw[1];
        swap = k_t;
        const A = x_2 + z_2;
        const AA = modP2(A * A);
        const B = x_2 - z_2;
        const BB = modP2(B * B);
        const E = AA - BB;
        const C = x_3 + z_3;
        const D = x_3 - z_3;
        const DA = modP2(D * A);
        const CB = modP2(C * B);
        const dacb = DA + CB;
        const da_cb = DA - CB;
        x_3 = modP2(dacb * dacb);
        z_3 = modP2(x_1 * modP2(da_cb * da_cb));
        x_2 = modP2(AA * BB);
        z_2 = modP2(E * (AA + modP2(a24 * E)));
      }
      sw = cswap(swap, x_2, x_3);
      x_2 = sw[0];
      x_3 = sw[1];
      sw = cswap(swap, z_2, z_3);
      z_2 = sw[0];
      z_3 = sw[1];
      const z2 = powPminus2(z_2);
      return modP2(x_2 * z2);
    }
    function encodeUCoordinate(u) {
      return numberToBytesLE(modP2(u), montgomeryBytes);
    }
    function decodeUCoordinate(uEnc) {
      const u = ensureBytes("u coordinate", uEnc, montgomeryBytes);
      if (fieldLen === montgomeryBytes) u[fieldLen - 1] &= 127;
      return bytesToNumberLE(u);
    }
    function decodeScalar(n) {
      const bytes2 = ensureBytes("scalar", n);
      if (bytes2.length !== montgomeryBytes && bytes2.length !== fieldLen)
        throw new Error(
          `Expected ${montgomeryBytes} or ${fieldLen} bytes, got ${bytes2.length}`,
        );
      return bytesToNumberLE(adjustScalarBytes3(bytes2));
    }
    function scalarMult(scalar, u) {
      const pointU = decodeUCoordinate(u);
      const _scalar = decodeScalar(scalar);
      const pu = montgomeryLadder(pointU, _scalar);
      if (pu === _0n7)
        throw new Error("Invalid private or public key received");
      return encodeUCoordinate(pu);
    }
    const GuBytes = encodeUCoordinate(CURVE2.Gu);
    function scalarMultBase(scalar) {
      return scalarMult(scalar, GuBytes);
    }
    return {
      scalarMult,
      scalarMultBase,
      getSharedSecret: (privateKey, publicKey) =>
        scalarMult(privateKey, publicKey),
      getPublicKey: (privateKey) => scalarMultBase(privateKey),
      utils: { randomPrivateKey: () => CURVE2.randomBytes(CURVE2.nByteLength) },
      GuBytes,
    };
  }

  // ../esm/ed25519.js
  var ED25519_P = BigInt(
    "57896044618658097711785492504343953926634992332820282019728792003956564819949",
  );
  var ED25519_SQRT_M1 = BigInt(
    "19681161376707505956807079304988542015446066515923890162744021073123829784752",
  );
  var _0n8 = BigInt(0);
  var _1n8 = BigInt(1);
  var _2n6 = BigInt(2);
  var _5n2 = BigInt(5);
  var _10n = BigInt(10);
  var _20n = BigInt(20);
  var _40n = BigInt(40);
  var _80n = BigInt(80);
  function ed25519_pow_2_252_3(x) {
    const P3 = ED25519_P;
    const x2 = (x * x) % P3;
    const b2 = (x2 * x) % P3;
    const b4 = (pow2(b2, _2n6, P3) * b2) % P3;
    const b5 = (pow2(b4, _1n8, P3) * x) % P3;
    const b10 = (pow2(b5, _5n2, P3) * b5) % P3;
    const b20 = (pow2(b10, _10n, P3) * b10) % P3;
    const b40 = (pow2(b20, _20n, P3) * b20) % P3;
    const b80 = (pow2(b40, _40n, P3) * b40) % P3;
    const b160 = (pow2(b80, _80n, P3) * b80) % P3;
    const b240 = (pow2(b160, _80n, P3) * b80) % P3;
    const b250 = (pow2(b240, _10n, P3) * b10) % P3;
    const pow_p_5_8 = (pow2(b250, _2n6, P3) * x) % P3;
    return { pow_p_5_8, b2 };
  }
  function adjustScalarBytes(bytes2) {
    bytes2[0] &= 248;
    bytes2[31] &= 127;
    bytes2[31] |= 64;
    return bytes2;
  }
  function uvRatio(u, v) {
    const P3 = ED25519_P;
    const v3 = mod(v * v * v, P3);
    const v7 = mod(v3 * v3 * v, P3);
    const pow3 = ed25519_pow_2_252_3(u * v7).pow_p_5_8;
    let x = mod(u * v3 * pow3, P3);
    const vx2 = mod(v * x * x, P3);
    const root1 = x;
    const root2 = mod(x * ED25519_SQRT_M1, P3);
    const useRoot1 = vx2 === u;
    const useRoot2 = vx2 === mod(-u, P3);
    const noRoot = vx2 === mod(-u * ED25519_SQRT_M1, P3);
    if (useRoot1) x = root1;
    if (useRoot2 || noRoot) x = root2;
    if (isNegativeLE(x, P3)) x = mod(-x, P3);
    return { isValid: useRoot1 || useRoot2, value: x };
  }
  var Fp2 = Field(ED25519_P, void 0, true);
  var ed25519Defaults = {
    // Param: a
    a: BigInt(-1),
    // d is equal to -121665/121666 over finite field.
    // Negative number is P - number, and division is invert(number, P)
    d: BigInt(
      "37095705934669439343138083508754565189542113879843219016388785533085940283555",
    ),
    // Finite field 𝔽p over which we'll do calculations; 2n**255n - 19n
    Fp: Fp2,
    // Subgroup order: how many points curve has
    // 2n**252n + 27742317777372353535851937790883648493n;
    n: BigInt(
      "7237005577332262213973186563042994240857116359379907606001950938285454250989",
    ),
    // Cofactor
    h: BigInt(8),
    // Base point (x, y) aka generator point
    Gx: BigInt(
      "15112221349535400772501151409588531511454012693041857206046113283949847762202",
    ),
    Gy: BigInt(
      "46316835694926478169428394003475163141307993866256225615783033603165251855960",
    ),
    hash: sha512,
    randomBytes,
    adjustScalarBytes,
    // dom2
    // Ratio of u to v. Allows us to combine inversion and square root. Uses algo from RFC8032 5.1.3.
    // Constant-time, u/√v
    uvRatio,
  };
  var ed25519 = /* @__PURE__ */ twistedEdwards(ed25519Defaults);
  function ed25519_domain(data, ctx, phflag) {
    if (ctx.length > 255) throw new Error("Context is too big");
    return concatBytes2(
      utf8ToBytes2("SigEd25519 no Ed25519 collisions"),
      new Uint8Array([phflag ? 1 : 0, ctx.length]),
      ctx,
      data,
    );
  }
  var ed25519ctx = /* @__PURE__ */ twistedEdwards({
    ...ed25519Defaults,
    domain: ed25519_domain,
  });
  var ed25519ph = /* @__PURE__ */ twistedEdwards({
    ...ed25519Defaults,
    domain: ed25519_domain,
    prehash: sha512,
  });
  var x25519 = /* @__PURE__ */ (() =>
    montgomery({
      P: ED25519_P,
      a: BigInt(486662),
      montgomeryBits: 255,
      nByteLength: 32,
      Gu: BigInt(9),
      powPminus2: (x) => {
        const P3 = ED25519_P;
        const { pow_p_5_8, b2 } = ed25519_pow_2_252_3(x);
        return mod(pow2(pow_p_5_8, BigInt(3), P3) * b2, P3);
      },
      adjustScalarBytes,
      randomBytes,
    }))();
  function edwardsToMontgomeryPub(edwardsPub) {
    const { y } = ed25519.ExtendedPoint.fromHex(edwardsPub);
    const _1n12 = BigInt(1);
    return Fp2.toBytes(Fp2.create((_1n12 + y) * Fp2.inv(_1n12 - y)));
  }
  function edwardsToMontgomeryPriv(edwardsPriv) {
    const hashed = ed25519Defaults.hash(edwardsPriv.subarray(0, 32));
    return ed25519Defaults.adjustScalarBytes(hashed).subarray(0, 32);
  }
  var ELL2_C1 = (Fp2.ORDER + BigInt(3)) / BigInt(8);
  var ELL2_C2 = Fp2.pow(_2n6, ELL2_C1);
  var ELL2_C3 = Fp2.sqrt(Fp2.neg(Fp2.ONE));
  var ELL2_C4 = (Fp2.ORDER - BigInt(5)) / BigInt(8);
  var ELL2_J = BigInt(486662);
  var ELL2_C1_EDWARDS = FpSqrtEven(Fp2, Fp2.neg(BigInt(486664)));
  var SQRT_AD_MINUS_ONE = BigInt(
    "25063068953384623474111414158702152701244531502492656460079210482610430750235",
  );
  var INVSQRT_A_MINUS_D = BigInt(
    "54469307008909316920995813868745141605393597292927456921205312896311721017578",
  );
  var ONE_MINUS_D_SQ = BigInt(
    "1159843021668779879193775521855586647937357759715417654439879720876111806838",
  );
  var D_MINUS_ONE_SQ = BigInt(
    "40440834346308536858101042469323190826248399146238708352240133220865137265952",
  );
  var MAX_255B = BigInt(
    "0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
  );

  // ../node_modules/@noble/hashes/esm/sha3.js
  var [SHA3_PI, SHA3_ROTL, _SHA3_IOTA] = [[], [], []];
  var _0n9 = /* @__PURE__ */ BigInt(0);
  var _1n9 = /* @__PURE__ */ BigInt(1);
  var _2n7 = /* @__PURE__ */ BigInt(2);
  var _7n = /* @__PURE__ */ BigInt(7);
  var _256n = /* @__PURE__ */ BigInt(256);
  var _0x71n = /* @__PURE__ */ BigInt(113);
  for (let round = 0, R = _1n9, x = 1, y = 0; round < 24; round++) {
    [x, y] = [y, (2 * x + 3 * y) % 5];
    SHA3_PI.push(2 * (5 * y + x));
    SHA3_ROTL.push((((round + 1) * (round + 2)) / 2) % 64);
    let t = _0n9;
    for (let j = 0; j < 7; j++) {
      R = ((R << _1n9) ^ ((R >> _7n) * _0x71n)) % _256n;
      if (R & _2n7) t ^= _1n9 << ((_1n9 << /* @__PURE__ */ BigInt(j)) - _1n9);
    }
    _SHA3_IOTA.push(t);
  }
  var [SHA3_IOTA_H, SHA3_IOTA_L] = /* @__PURE__ */ split(_SHA3_IOTA, true);
  var rotlH = (h, l, s) => (s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s));
  var rotlL = (h, l, s) => (s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s));
  function keccakP(s, rounds = 24) {
    const B = new Uint32Array(5 * 2);
    for (let round = 24 - rounds; round < 24; round++) {
      for (let x = 0; x < 10; x++)
        B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];
      for (let x = 0; x < 10; x += 2) {
        const idx1 = (x + 8) % 10;
        const idx0 = (x + 2) % 10;
        const B0 = B[idx0];
        const B1 = B[idx0 + 1];
        const Th = rotlH(B0, B1, 1) ^ B[idx1];
        const Tl = rotlL(B0, B1, 1) ^ B[idx1 + 1];
        for (let y = 0; y < 50; y += 10) {
          s[x + y] ^= Th;
          s[x + y + 1] ^= Tl;
        }
      }
      let curH = s[2];
      let curL = s[3];
      for (let t = 0; t < 24; t++) {
        const shift = SHA3_ROTL[t];
        const Th = rotlH(curH, curL, shift);
        const Tl = rotlL(curH, curL, shift);
        const PI = SHA3_PI[t];
        curH = s[PI];
        curL = s[PI + 1];
        s[PI] = Th;
        s[PI + 1] = Tl;
      }
      for (let y = 0; y < 50; y += 10) {
        for (let x = 0; x < 10; x++) B[x] = s[y + x];
        for (let x = 0; x < 10; x++)
          s[y + x] ^= ~B[(x + 2) % 10] & B[(x + 4) % 10];
      }
      s[0] ^= SHA3_IOTA_H[round];
      s[1] ^= SHA3_IOTA_L[round];
    }
    B.fill(0);
  }
  var Keccak = class _Keccak extends Hash {
    // NOTE: we accept arguments in bytes instead of bits here.
    constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {
      super();
      this.blockLen = blockLen;
      this.suffix = suffix;
      this.outputLen = outputLen;
      this.enableXOF = enableXOF;
      this.rounds = rounds;
      this.pos = 0;
      this.posOut = 0;
      this.finished = false;
      this.destroyed = false;
      number(outputLen);
      if (0 >= this.blockLen || this.blockLen >= 200)
        throw new Error("Sha3 supports only keccak-f1600 function");
      this.state = new Uint8Array(200);
      this.state32 = u32(this.state);
    }
    keccak() {
      keccakP(this.state32, this.rounds);
      this.posOut = 0;
      this.pos = 0;
    }
    update(data) {
      exists(this);
      const { blockLen, state } = this;
      data = toBytes(data);
      const len = data.length;
      for (let pos = 0; pos < len; ) {
        const take = Math.min(blockLen - this.pos, len - pos);
        for (let i = 0; i < take; i++) state[this.pos++] ^= data[pos++];
        if (this.pos === blockLen) this.keccak();
      }
      return this;
    }
    finish() {
      if (this.finished) return;
      this.finished = true;
      const { state, suffix, pos, blockLen } = this;
      state[pos] ^= suffix;
      if ((suffix & 128) !== 0 && pos === blockLen - 1) this.keccak();
      state[blockLen - 1] ^= 128;
      this.keccak();
    }
    writeInto(out) {
      exists(this, false);
      bytes(out);
      this.finish();
      const bufferOut = this.state;
      const { blockLen } = this;
      for (let pos = 0, len = out.length; pos < len; ) {
        if (this.posOut >= blockLen) this.keccak();
        const take = Math.min(blockLen - this.posOut, len - pos);
        out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
        this.posOut += take;
        pos += take;
      }
      return out;
    }
    xofInto(out) {
      if (!this.enableXOF)
        throw new Error("XOF is not possible for this instance");
      return this.writeInto(out);
    }
    xof(bytes2) {
      number(bytes2);
      return this.xofInto(new Uint8Array(bytes2));
    }
    digestInto(out) {
      output(out, this);
      if (this.finished) throw new Error("digest() was already called");
      this.writeInto(out);
      this.destroy();
      return out;
    }
    digest() {
      return this.digestInto(new Uint8Array(this.outputLen));
    }
    destroy() {
      this.destroyed = true;
      this.state.fill(0);
    }
    _cloneInto(to) {
      const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
      to || (to = new _Keccak(blockLen, suffix, outputLen, enableXOF, rounds));
      to.state32.set(this.state32);
      to.pos = this.pos;
      to.posOut = this.posOut;
      to.finished = this.finished;
      to.rounds = rounds;
      to.suffix = suffix;
      to.outputLen = outputLen;
      to.enableXOF = enableXOF;
      to.destroyed = this.destroyed;
      return to;
    }
  };
  var gen = (suffix, blockLen, outputLen) =>
    wrapConstructor(() => new Keccak(blockLen, suffix, outputLen));
  var sha3_224 = /* @__PURE__ */ gen(6, 144, 224 / 8);
  var sha3_256 = /* @__PURE__ */ gen(6, 136, 256 / 8);
  var sha3_384 = /* @__PURE__ */ gen(6, 104, 384 / 8);
  var sha3_512 = /* @__PURE__ */ gen(6, 72, 512 / 8);
  var keccak_224 = /* @__PURE__ */ gen(1, 144, 224 / 8);
  var keccak_256 = /* @__PURE__ */ gen(1, 136, 256 / 8);
  var keccak_384 = /* @__PURE__ */ gen(1, 104, 384 / 8);
  var keccak_512 = /* @__PURE__ */ gen(1, 72, 512 / 8);
  var genShake = (suffix, blockLen, outputLen) =>
    wrapXOFConstructorWithOpts(
      (opts = {}) =>
        new Keccak(
          blockLen,
          suffix,
          opts.dkLen === void 0 ? outputLen : opts.dkLen,
          true,
        ),
    );
  var shake128 = /* @__PURE__ */ genShake(31, 168, 128 / 8);
  var shake256 = /* @__PURE__ */ genShake(31, 136, 256 / 8);

  // ../esm/ed448.js
  var shake256_114 = wrapConstructor(() => shake256.create({ dkLen: 114 }));
  var shake256_64 = wrapConstructor(() => shake256.create({ dkLen: 64 }));
  var ed448P = BigInt(
    "726838724295606890549323807888004534353641360687318060281490199180612328166730772686396383698676545930088884461843637361053498018365439",
  );
  var _1n10 = BigInt(1);
  var _2n8 = BigInt(2);
  var _3n3 = BigInt(3);
  var _4n3 = BigInt(4);
  var _11n = BigInt(11);
  var _22n = BigInt(22);
  var _44n = BigInt(44);
  var _88n = BigInt(88);
  var _223n = BigInt(223);
  function ed448_pow_Pminus3div4(x) {
    const P3 = ed448P;
    const b2 = (x * x * x) % P3;
    const b3 = (b2 * b2 * x) % P3;
    const b6 = (pow2(b3, _3n3, P3) * b3) % P3;
    const b9 = (pow2(b6, _3n3, P3) * b3) % P3;
    const b11 = (pow2(b9, _2n8, P3) * b2) % P3;
    const b22 = (pow2(b11, _11n, P3) * b11) % P3;
    const b44 = (pow2(b22, _22n, P3) * b22) % P3;
    const b88 = (pow2(b44, _44n, P3) * b44) % P3;
    const b176 = (pow2(b88, _88n, P3) * b88) % P3;
    const b220 = (pow2(b176, _44n, P3) * b44) % P3;
    const b222 = (pow2(b220, _2n8, P3) * b2) % P3;
    const b223 = (pow2(b222, _1n10, P3) * x) % P3;
    return (pow2(b223, _223n, P3) * b222) % P3;
  }
  function adjustScalarBytes2(bytes2) {
    bytes2[0] &= 252;
    bytes2[55] |= 128;
    bytes2[56] = 0;
    return bytes2;
  }
  function uvRatio2(u, v) {
    const P3 = ed448P;
    const u2v = mod(u * u * v, P3);
    const u3v = mod(u2v * u, P3);
    const u5v3 = mod(u3v * u2v * v, P3);
    const root = ed448_pow_Pminus3div4(u5v3);
    const x = mod(u3v * root, P3);
    const x2 = mod(x * x, P3);
    return { isValid: mod(x2 * v, P3) === u, value: x };
  }
  var Fp3 = Field(ed448P, 456, true);
  var ED448_DEF = {
    // Param: a
    a: BigInt(1),
    // -39081. Negative number is P - number
    d: BigInt(
      "726838724295606890549323807888004534353641360687318060281490199180612328166730772686396383698676545930088884461843637361053498018326358",
    ),
    // Finite field 𝔽p over which we'll do calculations; 2n**448n - 2n**224n - 1n
    Fp: Fp3,
    // Subgroup order: how many points curve has;
    // 2n**446n - 13818066809895115352007386748515426880336692474882178609894547503885n
    n: BigInt(
      "181709681073901722637330951972001133588410340171829515070372549795146003961539585716195755291692375963310293709091662304773755859649779",
    ),
    nBitLength: 456,
    // Cofactor
    h: BigInt(4),
    // Base point (x, y) aka generator point
    Gx: BigInt(
      "224580040295924300187604334099896036246789641632564134246125461686950415467406032909029192869357953282578032075146446173674602635247710",
    ),
    Gy: BigInt(
      "298819210078481492676017930443930673437544040154080242095928241372331506189835876003536878655418784733982303233503462500531545062832660",
    ),
    // SHAKE256(dom4(phflag,context)||x, 114)
    hash: shake256_114,
    randomBytes,
    adjustScalarBytes: adjustScalarBytes2,
    // dom4
    domain: (data, ctx, phflag) => {
      if (ctx.length > 255)
        throw new Error(`Context is too big: ${ctx.length}`);
      return concatBytes2(
        utf8ToBytes2("SigEd448"),
        new Uint8Array([phflag ? 1 : 0, ctx.length]),
        ctx,
        data,
      );
    },
    uvRatio: uvRatio2,
  };
  var ed448 = /* @__PURE__ */ twistedEdwards(ED448_DEF);
  var ed448ph = /* @__PURE__ */ twistedEdwards({
    ...ED448_DEF,
    prehash: shake256_64,
  });
  var x448 = /* @__PURE__ */ (() =>
    montgomery({
      a: BigInt(156326),
      montgomeryBits: 448,
      nByteLength: 57,
      P: ed448P,
      Gu: BigInt(5),
      powPminus2: (x) => {
        const P3 = ed448P;
        const Pminus3div4 = ed448_pow_Pminus3div4(x);
        const Pminus3 = pow2(Pminus3div4, BigInt(2), P3);
        return mod(Pminus3 * x, P3);
      },
      adjustScalarBytes: adjustScalarBytes2,
      randomBytes,
    }))();
  function edwardsToMontgomeryPub2(edwardsPub) {
    const { y } = ed448.ExtendedPoint.fromHex(edwardsPub);
    const _1n12 = BigInt(1);
    return Fp3.toBytes(Fp3.create((y - _1n12) * Fp3.inv(y + _1n12)));
  }
  var ELL2_C12 = (Fp3.ORDER - BigInt(3)) / BigInt(4);
  var ELL2_J2 = BigInt(156326);
  var ONE_MINUS_D = BigInt("39082");
  var ONE_MINUS_TWO_D = BigInt("78163");
  var SQRT_MINUS_D = BigInt(
    "98944233647732219769177004876929019128417576295529901074099889598043702116001257856802131563896515373927712232092845883226922417596214",
  );
  var INVSQRT_MINUS_D = BigInt(
    "315019913931389607337177038330951043522456072897266928557328499619017160722351061360252776265186336876723201881398623946864393857820716",
  );
  var MAX_448B = BigInt(
    "0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
  );

  // ../esm/p256.js
  var Fp4 = Field(
    BigInt(
      "0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff",
    ),
  );
  var CURVE_A = Fp4.create(BigInt("-3"));
  var CURVE_B = BigInt(
    "0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b",
  );
  var p256 = createCurve(
    {
      a: CURVE_A,
      b: CURVE_B,
      Fp: Fp4,
      // Curve order, total count of valid points in the field
      n: BigInt(
        "0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551",
      ),
      // Base (generator) point (x, y)
      Gx: BigInt(
        "0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
      ),
      Gy: BigInt(
        "0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5",
      ),
      h: BigInt(1),
      lowS: false,
    },
    sha256,
  );

  // ../esm/p384.js
  var P = BigInt(
    "0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff",
  );
  var Fp5 = Field(P);
  var CURVE_A2 = Fp5.create(BigInt("-3"));
  var CURVE_B2 = BigInt(
    "0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef",
  );
  var p384 = createCurve(
    {
      a: CURVE_A2,
      b: CURVE_B2,
      Fp: Fp5,
      // Curve order, total count of valid points in the field.
      n: BigInt(
        "0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973",
      ),
      // Base (generator) point (x, y)
      Gx: BigInt(
        "0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7",
      ),
      Gy: BigInt(
        "0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f",
      ),
      h: BigInt(1),
      lowS: false,
    },
    sha384,
  );

  // ../esm/p521.js
  var P2 = BigInt(
    "0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
  );
  var Fp6 = Field(P2);
  var CURVE = {
    a: Fp6.create(BigInt("-3")),
    b: BigInt(
      "0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00",
    ),
    Fp: Fp6,
    n: BigInt(
      "0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409",
    ),
    Gx: BigInt(
      "0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66",
    ),
    Gy: BigInt(
      "0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650",
    ),
    h: BigInt(1),
  };
  var p521 = createCurve(
    {
      a: CURVE.a,
      b: CURVE.b,
      Fp: Fp6,
      // Curve order, total count of valid points in the field
      n: CURVE.n,
      Gx: CURVE.Gx,
      Gy: CURVE.Gy,
      h: CURVE.h,
      lowS: false,
      allowedPrivateKeyLengths: [130, 131, 132],
      // P521 keys are variable-length. Normalize to 132b
    },
    sha512,
  );

  // ../esm/abstract/bls.js
  var _2n9 = BigInt(2);
  var _3n4 = BigInt(3);
  function bls(CURVE2) {
    const {
      Fp: Fp8,
      Fr: Fr2,
      Fp2: Fp23,
      Fp6: Fp63,
      Fp12: Fp122,
    } = CURVE2.fields;
    const BLS_X_LEN2 = bitLen(CURVE2.params.x);
    function calcPairingPrecomputes(p) {
      const { x, y } = p;
      const Qx = x,
        Qy = y,
        Qz = Fp23.ONE;
      let Rx = Qx,
        Ry = Qy,
        Rz = Qz;
      let ell_coeff = [];
      for (let i = BLS_X_LEN2 - 2; i >= 0; i--) {
        let t0 = Fp23.sqr(Ry);
        let t1 = Fp23.sqr(Rz);
        let t2 = Fp23.multiplyByB(Fp23.mul(t1, _3n4));
        let t3 = Fp23.mul(t2, _3n4);
        let t4 = Fp23.sub(Fp23.sub(Fp23.sqr(Fp23.add(Ry, Rz)), t1), t0);
        ell_coeff.push([
          Fp23.sub(t2, t0),
          Fp23.mul(Fp23.sqr(Rx), _3n4),
          Fp23.neg(t4),
          // -T4
        ]);
        Rx = Fp23.div(Fp23.mul(Fp23.mul(Fp23.sub(t0, t3), Rx), Ry), _2n9);
        Ry = Fp23.sub(
          Fp23.sqr(Fp23.div(Fp23.add(t0, t3), _2n9)),
          Fp23.mul(Fp23.sqr(t2), _3n4),
        );
        Rz = Fp23.mul(t0, t4);
        if (bitGet(CURVE2.params.x, i)) {
          let t02 = Fp23.sub(Ry, Fp23.mul(Qy, Rz));
          let t12 = Fp23.sub(Rx, Fp23.mul(Qx, Rz));
          ell_coeff.push([
            Fp23.sub(Fp23.mul(t02, Qx), Fp23.mul(t12, Qy)),
            Fp23.neg(t02),
            t12,
            // T1
          ]);
          let t22 = Fp23.sqr(t12);
          let t32 = Fp23.mul(t22, t12);
          let t42 = Fp23.mul(t22, Rx);
          let t5 = Fp23.add(
            Fp23.sub(t32, Fp23.mul(t42, _2n9)),
            Fp23.mul(Fp23.sqr(t02), Rz),
          );
          Rx = Fp23.mul(t12, t5);
          Ry = Fp23.sub(Fp23.mul(Fp23.sub(t42, t5), t02), Fp23.mul(t32, Ry));
          Rz = Fp23.mul(Rz, t32);
        }
      }
      return ell_coeff;
    }
    function millerLoop(ell, g1) {
      const { x } = CURVE2.params;
      const Px = g1[0];
      const Py = g1[1];
      let f12 = Fp122.ONE;
      for (let j = 0, i = BLS_X_LEN2 - 2; i >= 0; i--, j++) {
        const E = ell[j];
        f12 = Fp122.multiplyBy014(
          f12,
          E[0],
          Fp23.mul(E[1], Px),
          Fp23.mul(E[2], Py),
        );
        if (bitGet(x, i)) {
          j += 1;
          const F = ell[j];
          f12 = Fp122.multiplyBy014(
            f12,
            F[0],
            Fp23.mul(F[1], Px),
            Fp23.mul(F[2], Py),
          );
        }
        if (i !== 0) f12 = Fp122.sqr(f12);
      }
      return Fp122.conjugate(f12);
    }
    const utils2 = {
      randomPrivateKey: () => {
        const length = getMinHashLength(Fr2.ORDER);
        return mapHashToField(CURVE2.randomBytes(length), Fr2.ORDER);
      },
      calcPairingPrecomputes,
    };
    const G1_ = weierstrassPoints({ n: Fr2.ORDER, ...CURVE2.G1 });
    const G1 = Object.assign(
      G1_,
      createHasher(G1_.ProjectivePoint, CURVE2.G1.mapToCurve, {
        ...CURVE2.htfDefaults,
        ...CURVE2.G1.htfDefaults,
      }),
    );
    function pairingPrecomputes(point) {
      const p = point;
      if (p._PPRECOMPUTES) return p._PPRECOMPUTES;
      p._PPRECOMPUTES = calcPairingPrecomputes(point.toAffine());
      return p._PPRECOMPUTES;
    }
    const G2_ = weierstrassPoints({ n: Fr2.ORDER, ...CURVE2.G2 });
    const G2 = Object.assign(
      G2_,
      createHasher(G2_.ProjectivePoint, CURVE2.G2.mapToCurve, {
        ...CURVE2.htfDefaults,
        ...CURVE2.G2.htfDefaults,
      }),
    );
    const { Signature } = CURVE2.G2;
    function pairing(Q, P3, withFinalExponent = true) {
      if (
        Q.equals(G1.ProjectivePoint.ZERO) ||
        P3.equals(G2.ProjectivePoint.ZERO)
      )
        throw new Error("pairing is not available for ZERO point");
      Q.assertValidity();
      P3.assertValidity();
      const Qa = Q.toAffine();
      const looped = millerLoop(pairingPrecomputes(P3), [Qa.x, Qa.y]);
      return withFinalExponent ? Fp122.finalExponentiate(looped) : looped;
    }
    function normP1(point) {
      return point instanceof G1.ProjectivePoint
        ? point
        : G1.ProjectivePoint.fromHex(point);
    }
    function normP2(point) {
      return point instanceof G2.ProjectivePoint
        ? point
        : Signature.fromHex(point);
    }
    function normP2Hash(point, htfOpts) {
      return point instanceof G2.ProjectivePoint
        ? point
        : G2.hashToCurve(ensureBytes("point", point), htfOpts);
    }
    function getPublicKey(privateKey) {
      return G1.ProjectivePoint.fromPrivateKey(privateKey).toRawBytes(true);
    }
    function sign(message, privateKey, htfOpts) {
      const msgPoint = normP2Hash(message, htfOpts);
      msgPoint.assertValidity();
      const sigPoint = msgPoint.multiply(G1.normPrivateKeyToScalar(privateKey));
      if (message instanceof G2.ProjectivePoint) return sigPoint;
      return Signature.toRawBytes(sigPoint);
    }
    function verify(signature, message, publicKey, htfOpts) {
      const P3 = normP1(publicKey);
      const Hm = normP2Hash(message, htfOpts);
      const G = G1.ProjectivePoint.BASE;
      const S = normP2(signature);
      const ePHm = pairing(P3.negate(), Hm, false);
      const eGS = pairing(G, S, false);
      const exp = Fp122.finalExponentiate(Fp122.mul(eGS, ePHm));
      return Fp122.eql(exp, Fp122.ONE);
    }
    function aggregatePublicKeys(publicKeys) {
      if (!publicKeys.length) throw new Error("Expected non-empty array");
      const agg = publicKeys
        .map(normP1)
        .reduce((sum, p) => sum.add(p), G1.ProjectivePoint.ZERO);
      const aggAffine = agg;
      if (publicKeys[0] instanceof G1.ProjectivePoint) {
        aggAffine.assertValidity();
        return aggAffine;
      }
      return aggAffine.toRawBytes(true);
    }
    function aggregateSignatures(signatures) {
      if (!signatures.length) throw new Error("Expected non-empty array");
      const agg = signatures
        .map(normP2)
        .reduce((sum, s) => sum.add(s), G2.ProjectivePoint.ZERO);
      const aggAffine = agg;
      if (signatures[0] instanceof G2.ProjectivePoint) {
        aggAffine.assertValidity();
        return aggAffine;
      }
      return Signature.toRawBytes(aggAffine);
    }
    function verifyBatch(signature, messages, publicKeys, htfOpts) {
      if (!messages.length)
        throw new Error("Expected non-empty messages array");
      if (publicKeys.length !== messages.length)
        throw new Error("Pubkey count should equal msg count");
      const sig = normP2(signature);
      const nMessages = messages.map((i) => normP2Hash(i, htfOpts));
      const nPublicKeys = publicKeys.map(normP1);
      try {
        const paired = [];
        for (const message of new Set(nMessages)) {
          const groupPublicKey = nMessages.reduce(
            (groupPublicKey2, subMessage, i) =>
              subMessage === message
                ? groupPublicKey2.add(nPublicKeys[i])
                : groupPublicKey2,
            G1.ProjectivePoint.ZERO,
          );
          paired.push(pairing(groupPublicKey, message, false));
        }
        paired.push(pairing(G1.ProjectivePoint.BASE.negate(), sig, false));
        const product = paired.reduce((a, b) => Fp122.mul(a, b), Fp122.ONE);
        const exp = Fp122.finalExponentiate(product);
        return Fp122.eql(exp, Fp122.ONE);
      } catch {
        return false;
      }
    }
    G1.ProjectivePoint.BASE._setWindowSize(4);
    return {
      getPublicKey,
      sign,
      verify,
      verifyBatch,
      aggregatePublicKeys,
      aggregateSignatures,
      millerLoop,
      pairing,
      G1,
      G2,
      Signature,
      fields: {
        Fr: Fr2,
        Fp: Fp8,
        Fp2: Fp23,
        Fp6: Fp63,
        Fp12: Fp122,
      },
      params: {
        x: CURVE2.params.x,
        r: CURVE2.params.r,
        G1b: CURVE2.G1.b,
        G2b: CURVE2.G2.b,
      },
      utils: utils2,
    };
  }

  // ../esm/bls12-381.js
  var _0n10 = BigInt(0);
  var _1n11 = BigInt(1);
  var _2n10 = BigInt(2);
  var _3n5 = BigInt(3);
  var _4n4 = BigInt(4);
  var _8n3 = BigInt(8);
  var _16n2 = BigInt(16);
  var Fp_raw = BigInt(
    "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab",
  );
  var Fp7 = Field(Fp_raw);
  var Fr = Field(
    BigInt(
      "0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001",
    ),
  );
  var Fp2Add = ({ c0, c1 }, { c0: r0, c1: r1 }) => ({
    c0: Fp7.add(c0, r0),
    c1: Fp7.add(c1, r1),
  });
  var Fp2Subtract = ({ c0, c1 }, { c0: r0, c1: r1 }) => ({
    c0: Fp7.sub(c0, r0),
    c1: Fp7.sub(c1, r1),
  });
  var Fp2Multiply = ({ c0, c1 }, rhs) => {
    if (typeof rhs === "bigint")
      return { c0: Fp7.mul(c0, rhs), c1: Fp7.mul(c1, rhs) };
    const { c0: r0, c1: r1 } = rhs;
    let t1 = Fp7.mul(c0, r0);
    let t2 = Fp7.mul(c1, r1);
    const o0 = Fp7.sub(t1, t2);
    const o1 = Fp7.sub(
      Fp7.mul(Fp7.add(c0, c1), Fp7.add(r0, r1)),
      Fp7.add(t1, t2),
    );
    return { c0: o0, c1: o1 };
  };
  var Fp2Square = ({ c0, c1 }) => {
    const a = Fp7.add(c0, c1);
    const b = Fp7.sub(c0, c1);
    const c = Fp7.add(c0, c0);
    return { c0: Fp7.mul(a, b), c1: Fp7.mul(c, c1) };
  };
  var FP2_ORDER = Fp_raw * Fp_raw;
  var Fp22 = {
    ORDER: FP2_ORDER,
    BITS: bitLen(FP2_ORDER),
    BYTES: Math.ceil(bitLen(FP2_ORDER) / 8),
    MASK: bitMask(bitLen(FP2_ORDER)),
    ZERO: { c0: Fp7.ZERO, c1: Fp7.ZERO },
    ONE: { c0: Fp7.ONE, c1: Fp7.ZERO },
    create: (num) => num,
    isValid: ({ c0, c1 }) => typeof c0 === "bigint" && typeof c1 === "bigint",
    is0: ({ c0, c1 }) => Fp7.is0(c0) && Fp7.is0(c1),
    eql: ({ c0, c1 }, { c0: r0, c1: r1 }) => Fp7.eql(c0, r0) && Fp7.eql(c1, r1),
    neg: ({ c0, c1 }) => ({ c0: Fp7.neg(c0), c1: Fp7.neg(c1) }),
    pow: (num, power) => FpPow(Fp22, num, power),
    invertBatch: (nums) => FpInvertBatch(Fp22, nums),
    // Normalized
    add: Fp2Add,
    sub: Fp2Subtract,
    mul: Fp2Multiply,
    sqr: Fp2Square,
    // NonNormalized stuff
    addN: Fp2Add,
    subN: Fp2Subtract,
    mulN: Fp2Multiply,
    sqrN: Fp2Square,
    // Why inversion for bigint inside Fp instead of Fp2? it is even used in that context?
    div: (lhs, rhs) =>
      Fp22.mul(
        lhs,
        typeof rhs === "bigint" ? Fp7.inv(Fp7.create(rhs)) : Fp22.inv(rhs),
      ),
    inv: ({ c0: a, c1: b }) => {
      const factor = Fp7.inv(Fp7.create(a * a + b * b));
      return {
        c0: Fp7.mul(factor, Fp7.create(a)),
        c1: Fp7.mul(factor, Fp7.create(-b)),
      };
    },
    sqrt: (num) => {
      if (Fp22.eql(num, Fp22.ZERO)) return Fp22.ZERO;
      const candidateSqrt = Fp22.pow(num, (Fp22.ORDER + _8n3) / _16n2);
      const check = Fp22.div(Fp22.sqr(candidateSqrt), num);
      const R = FP2_ROOTS_OF_UNITY;
      const divisor = [R[0], R[2], R[4], R[6]].find((r) => Fp22.eql(r, check));
      if (!divisor) throw new Error("No root");
      const index = R.indexOf(divisor);
      const root = R[index / 2];
      if (!root) throw new Error("Invalid root");
      const x1 = Fp22.div(candidateSqrt, root);
      const x2 = Fp22.neg(x1);
      const { re: re1, im: im1 } = Fp22.reim(x1);
      const { re: re2, im: im2 } = Fp22.reim(x2);
      if (im1 > im2 || (im1 === im2 && re1 > re2)) return x1;
      return x2;
    },
    // Same as sgn0_m_eq_2 in RFC 9380
    isOdd: (x) => {
      const { re: x0, im: x1 } = Fp22.reim(x);
      const sign_0 = x0 % _2n10;
      const zero_0 = x0 === _0n10;
      const sign_1 = x1 % _2n10;
      return BigInt(sign_0 || (zero_0 && sign_1)) == _1n11;
    },
    // Bytes util
    fromBytes(b) {
      if (b.length !== Fp22.BYTES)
        throw new Error(`fromBytes wrong length=${b.length}`);
      return {
        c0: Fp7.fromBytes(b.subarray(0, Fp7.BYTES)),
        c1: Fp7.fromBytes(b.subarray(Fp7.BYTES)),
      };
    },
    toBytes: ({ c0, c1 }) => concatBytes(Fp7.toBytes(c0), Fp7.toBytes(c1)),
    cmov: ({ c0, c1 }, { c0: r0, c1: r1 }, c) => ({
      c0: Fp7.cmov(c0, r0, c),
      c1: Fp7.cmov(c1, r1, c),
    }),
    // Specific utils
    // toString() {
    //   return `Fp2(${this.c0} + ${this.c1}×i)`;
    // }
    reim: ({ c0, c1 }) => ({ re: c0, im: c1 }),
    // multiply by u + 1
    mulByNonresidue: ({ c0, c1 }) => ({
      c0: Fp7.sub(c0, c1),
      c1: Fp7.add(c0, c1),
    }),
    multiplyByB: ({ c0, c1 }) => {
      let t0 = Fp7.mul(c0, _4n4);
      let t1 = Fp7.mul(c1, _4n4);
      return { c0: Fp7.sub(t0, t1), c1: Fp7.add(t0, t1) };
    },
    fromBigTuple: (tuple) => {
      if (tuple.length !== 2) throw new Error("Invalid tuple");
      const fps = tuple.map((n) => Fp7.create(n));
      return { c0: fps[0], c1: fps[1] };
    },
    frobeniusMap: ({ c0, c1 }, power) => ({
      c0,
      c1: Fp7.mul(c1, FP2_FROBENIUS_COEFFICIENTS[power % 2]),
    }),
  };
  var FP2_FROBENIUS_COEFFICIENTS = [
    BigInt("0x1"),
    BigInt(
      "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaaa",
    ),
  ].map((item) => Fp7.create(item));
  var rv1 = BigInt(
    "0x6af0e0437ff400b6831e36d6bd17ffe48395dabc2d3435e77f76e17009241c5ee67992f72ec05f4c81084fbede3cc09",
  );
  var FP2_ROOTS_OF_UNITY = [
    [_1n11, _0n10],
    [rv1, -rv1],
    [_0n10, _1n11],
    [rv1, rv1],
    [-_1n11, _0n10],
    [-rv1, rv1],
    [_0n10, -_1n11],
    [-rv1, -rv1],
  ].map((pair) => Fp22.fromBigTuple(pair));
  var Fp6Add = ({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }) => ({
    c0: Fp22.add(c0, r0),
    c1: Fp22.add(c1, r1),
    c2: Fp22.add(c2, r2),
  });
  var Fp6Subtract = ({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }) => ({
    c0: Fp22.sub(c0, r0),
    c1: Fp22.sub(c1, r1),
    c2: Fp22.sub(c2, r2),
  });
  var Fp6Multiply = ({ c0, c1, c2 }, rhs) => {
    if (typeof rhs === "bigint") {
      return {
        c0: Fp22.mul(c0, rhs),
        c1: Fp22.mul(c1, rhs),
        c2: Fp22.mul(c2, rhs),
      };
    }
    const { c0: r0, c1: r1, c2: r2 } = rhs;
    const t0 = Fp22.mul(c0, r0);
    const t1 = Fp22.mul(c1, r1);
    const t2 = Fp22.mul(c2, r2);
    return {
      // t0 + (c1 + c2) * (r1 * r2) - (T1 + T2) * (u + 1)
      c0: Fp22.add(
        t0,
        Fp22.mulByNonresidue(
          Fp22.sub(
            Fp22.mul(Fp22.add(c1, c2), Fp22.add(r1, r2)),
            Fp22.add(t1, t2),
          ),
        ),
      ),
      // (c0 + c1) * (r0 + r1) - (T0 + T1) + T2 * (u + 1)
      c1: Fp22.add(
        Fp22.sub(
          Fp22.mul(Fp22.add(c0, c1), Fp22.add(r0, r1)),
          Fp22.add(t0, t1),
        ),
        Fp22.mulByNonresidue(t2),
      ),
      // T1 + (c0 + c2) * (r0 + r2) - T0 + T2
      c2: Fp22.sub(
        Fp22.add(t1, Fp22.mul(Fp22.add(c0, c2), Fp22.add(r0, r2))),
        Fp22.add(t0, t2),
      ),
    };
  };
  var Fp6Square = ({ c0, c1, c2 }) => {
    let t0 = Fp22.sqr(c0);
    let t1 = Fp22.mul(Fp22.mul(c0, c1), _2n10);
    let t3 = Fp22.mul(Fp22.mul(c1, c2), _2n10);
    let t4 = Fp22.sqr(c2);
    return {
      c0: Fp22.add(Fp22.mulByNonresidue(t3), t0),
      c1: Fp22.add(Fp22.mulByNonresidue(t4), t1),
      // T1 + (c0 - c1 + c2)² + T3 - T0 - T4
      c2: Fp22.sub(
        Fp22.sub(
          Fp22.add(Fp22.add(t1, Fp22.sqr(Fp22.add(Fp22.sub(c0, c1), c2))), t3),
          t0,
        ),
        t4,
      ),
    };
  };
  var Fp62 = {
    ORDER: Fp22.ORDER,
    BITS: 3 * Fp22.BITS,
    BYTES: 3 * Fp22.BYTES,
    MASK: bitMask(3 * Fp22.BITS),
    ZERO: { c0: Fp22.ZERO, c1: Fp22.ZERO, c2: Fp22.ZERO },
    ONE: { c0: Fp22.ONE, c1: Fp22.ZERO, c2: Fp22.ZERO },
    create: (num) => num,
    isValid: ({ c0, c1, c2 }) =>
      Fp22.isValid(c0) && Fp22.isValid(c1) && Fp22.isValid(c2),
    is0: ({ c0, c1, c2 }) => Fp22.is0(c0) && Fp22.is0(c1) && Fp22.is0(c2),
    neg: ({ c0, c1, c2 }) => ({
      c0: Fp22.neg(c0),
      c1: Fp22.neg(c1),
      c2: Fp22.neg(c2),
    }),
    eql: ({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }) =>
      Fp22.eql(c0, r0) && Fp22.eql(c1, r1) && Fp22.eql(c2, r2),
    sqrt: () => {
      throw new Error("Not implemented");
    },
    // Do we need division by bigint at all? Should be done via order:
    div: (lhs, rhs) =>
      Fp62.mul(
        lhs,
        typeof rhs === "bigint" ? Fp7.inv(Fp7.create(rhs)) : Fp62.inv(rhs),
      ),
    pow: (num, power) => FpPow(Fp62, num, power),
    invertBatch: (nums) => FpInvertBatch(Fp62, nums),
    // Normalized
    add: Fp6Add,
    sub: Fp6Subtract,
    mul: Fp6Multiply,
    sqr: Fp6Square,
    // NonNormalized stuff
    addN: Fp6Add,
    subN: Fp6Subtract,
    mulN: Fp6Multiply,
    sqrN: Fp6Square,
    inv: ({ c0, c1, c2 }) => {
      let t0 = Fp22.sub(Fp22.sqr(c0), Fp22.mulByNonresidue(Fp22.mul(c2, c1)));
      let t1 = Fp22.sub(Fp22.mulByNonresidue(Fp22.sqr(c2)), Fp22.mul(c0, c1));
      let t2 = Fp22.sub(Fp22.sqr(c1), Fp22.mul(c0, c2));
      let t4 = Fp22.inv(
        Fp22.add(
          Fp22.mulByNonresidue(Fp22.add(Fp22.mul(c2, t1), Fp22.mul(c1, t2))),
          Fp22.mul(c0, t0),
        ),
      );
      return {
        c0: Fp22.mul(t4, t0),
        c1: Fp22.mul(t4, t1),
        c2: Fp22.mul(t4, t2),
      };
    },
    // Bytes utils
    fromBytes: (b) => {
      if (b.length !== Fp62.BYTES)
        throw new Error(`fromBytes wrong length=${b.length}`);
      return {
        c0: Fp22.fromBytes(b.subarray(0, Fp22.BYTES)),
        c1: Fp22.fromBytes(b.subarray(Fp22.BYTES, 2 * Fp22.BYTES)),
        c2: Fp22.fromBytes(b.subarray(2 * Fp22.BYTES)),
      };
    },
    toBytes: ({ c0, c1, c2 }) =>
      concatBytes(Fp22.toBytes(c0), Fp22.toBytes(c1), Fp22.toBytes(c2)),
    cmov: ({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }, c) => ({
      c0: Fp22.cmov(c0, r0, c),
      c1: Fp22.cmov(c1, r1, c),
      c2: Fp22.cmov(c2, r2, c),
    }),
    // Utils
    //   fromTriple(triple: [Fp2, Fp2, Fp2]) {
    //     return new Fp6(...triple);
    //   }
    //   toString() {
    //     return `Fp6(${this.c0} + ${this.c1} * v, ${this.c2} * v^2)`;
    //   }
    fromBigSix: (t) => {
      if (!Array.isArray(t) || t.length !== 6)
        throw new Error("Invalid Fp6 usage");
      return {
        c0: Fp22.fromBigTuple(t.slice(0, 2)),
        c1: Fp22.fromBigTuple(t.slice(2, 4)),
        c2: Fp22.fromBigTuple(t.slice(4, 6)),
      };
    },
    frobeniusMap: ({ c0, c1, c2 }, power) => ({
      c0: Fp22.frobeniusMap(c0, power),
      c1: Fp22.mul(
        Fp22.frobeniusMap(c1, power),
        FP6_FROBENIUS_COEFFICIENTS_1[power % 6],
      ),
      c2: Fp22.mul(
        Fp22.frobeniusMap(c2, power),
        FP6_FROBENIUS_COEFFICIENTS_2[power % 6],
      ),
    }),
    mulByNonresidue: ({ c0, c1, c2 }) => ({
      c0: Fp22.mulByNonresidue(c2),
      c1: c0,
      c2: c1,
    }),
    // Sparse multiplication
    multiplyBy1: ({ c0, c1, c2 }, b1) => ({
      c0: Fp22.mulByNonresidue(Fp22.mul(c2, b1)),
      c1: Fp22.mul(c0, b1),
      c2: Fp22.mul(c1, b1),
    }),
    // Sparse multiplication
    multiplyBy01({ c0, c1, c2 }, b0, b1) {
      let t0 = Fp22.mul(c0, b0);
      let t1 = Fp22.mul(c1, b1);
      return {
        // ((c1 + c2) * b1 - T1) * (u + 1) + T0
        c0: Fp22.add(
          Fp22.mulByNonresidue(Fp22.sub(Fp22.mul(Fp22.add(c1, c2), b1), t1)),
          t0,
        ),
        // (b0 + b1) * (c0 + c1) - T0 - T1
        c1: Fp22.sub(
          Fp22.sub(Fp22.mul(Fp22.add(b0, b1), Fp22.add(c0, c1)), t0),
          t1,
        ),
        // (c0 + c2) * b0 - T0 + T1
        c2: Fp22.add(Fp22.sub(Fp22.mul(Fp22.add(c0, c2), b0), t0), t1),
      };
    },
    multiplyByFp2: ({ c0, c1, c2 }, rhs) => ({
      c0: Fp22.mul(c0, rhs),
      c1: Fp22.mul(c1, rhs),
      c2: Fp22.mul(c2, rhs),
    }),
  };
  var FP6_FROBENIUS_COEFFICIENTS_1 = [
    [BigInt("0x1"), BigInt("0x0")],
    [
      BigInt("0x0"),
      BigInt(
        "0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac",
      ),
    ],
    [
      BigInt(
        "0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe",
      ),
      BigInt("0x0"),
    ],
    [BigInt("0x0"), BigInt("0x1")],
    [
      BigInt(
        "0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac",
      ),
      BigInt("0x0"),
    ],
    [
      BigInt("0x0"),
      BigInt(
        "0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe",
      ),
    ],
  ].map((pair) => Fp22.fromBigTuple(pair));
  var FP6_FROBENIUS_COEFFICIENTS_2 = [
    [BigInt("0x1"), BigInt("0x0")],
    [
      BigInt(
        "0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaad",
      ),
      BigInt("0x0"),
    ],
    [
      BigInt(
        "0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac",
      ),
      BigInt("0x0"),
    ],
    [
      BigInt(
        "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaaa",
      ),
      BigInt("0x0"),
    ],
    [
      BigInt(
        "0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe",
      ),
      BigInt("0x0"),
    ],
    [
      BigInt(
        "0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffeffff",
      ),
      BigInt("0x0"),
    ],
  ].map((pair) => Fp22.fromBigTuple(pair));
  var BLS_X = BigInt("0xd201000000010000");
  var BLS_X_LEN = bitLen(BLS_X);
  var Fp12Add = ({ c0, c1 }, { c0: r0, c1: r1 }) => ({
    c0: Fp62.add(c0, r0),
    c1: Fp62.add(c1, r1),
  });
  var Fp12Subtract = ({ c0, c1 }, { c0: r0, c1: r1 }) => ({
    c0: Fp62.sub(c0, r0),
    c1: Fp62.sub(c1, r1),
  });
  var Fp12Multiply = ({ c0, c1 }, rhs) => {
    if (typeof rhs === "bigint")
      return { c0: Fp62.mul(c0, rhs), c1: Fp62.mul(c1, rhs) };
    let { c0: r0, c1: r1 } = rhs;
    let t1 = Fp62.mul(c0, r0);
    let t2 = Fp62.mul(c1, r1);
    return {
      c0: Fp62.add(t1, Fp62.mulByNonresidue(t2)),
      // (c0 + c1) * (r0 + r1) - (T1 + T2)
      c1: Fp62.sub(
        Fp62.mul(Fp62.add(c0, c1), Fp62.add(r0, r1)),
        Fp62.add(t1, t2),
      ),
    };
  };
  var Fp12Square = ({ c0, c1 }) => {
    let ab = Fp62.mul(c0, c1);
    return {
      // (c1 * v + c0) * (c0 + c1) - AB - AB * v
      c0: Fp62.sub(
        Fp62.sub(
          Fp62.mul(Fp62.add(Fp62.mulByNonresidue(c1), c0), Fp62.add(c0, c1)),
          ab,
        ),
        Fp62.mulByNonresidue(ab),
      ),
      c1: Fp62.add(ab, ab),
    };
  };
  function Fp4Square(a, b) {
    const a2 = Fp22.sqr(a);
    const b2 = Fp22.sqr(b);
    return {
      first: Fp22.add(Fp22.mulByNonresidue(b2), a2),
      second: Fp22.sub(Fp22.sub(Fp22.sqr(Fp22.add(a, b)), a2), b2),
      // (a + b)² - a² - b²
    };
  }
  var Fp12 = {
    ORDER: Fp22.ORDER,
    BITS: 2 * Fp22.BITS,
    BYTES: 2 * Fp22.BYTES,
    MASK: bitMask(2 * Fp22.BITS),
    ZERO: { c0: Fp62.ZERO, c1: Fp62.ZERO },
    ONE: { c0: Fp62.ONE, c1: Fp62.ZERO },
    create: (num) => num,
    isValid: ({ c0, c1 }) => Fp62.isValid(c0) && Fp62.isValid(c1),
    is0: ({ c0, c1 }) => Fp62.is0(c0) && Fp62.is0(c1),
    neg: ({ c0, c1 }) => ({ c0: Fp62.neg(c0), c1: Fp62.neg(c1) }),
    eql: ({ c0, c1 }, { c0: r0, c1: r1 }) =>
      Fp62.eql(c0, r0) && Fp62.eql(c1, r1),
    sqrt: () => {
      throw new Error("Not implemented");
    },
    inv: ({ c0, c1 }) => {
      let t = Fp62.inv(
        Fp62.sub(Fp62.sqr(c0), Fp62.mulByNonresidue(Fp62.sqr(c1))),
      );
      return { c0: Fp62.mul(c0, t), c1: Fp62.neg(Fp62.mul(c1, t)) };
    },
    div: (lhs, rhs) =>
      Fp12.mul(
        lhs,
        typeof rhs === "bigint" ? Fp7.inv(Fp7.create(rhs)) : Fp12.inv(rhs),
      ),
    pow: (num, power) => FpPow(Fp12, num, power),
    invertBatch: (nums) => FpInvertBatch(Fp12, nums),
    // Normalized
    add: Fp12Add,
    sub: Fp12Subtract,
    mul: Fp12Multiply,
    sqr: Fp12Square,
    // NonNormalized stuff
    addN: Fp12Add,
    subN: Fp12Subtract,
    mulN: Fp12Multiply,
    sqrN: Fp12Square,
    // Bytes utils
    fromBytes: (b) => {
      if (b.length !== Fp12.BYTES)
        throw new Error(`fromBytes wrong length=${b.length}`);
      return {
        c0: Fp62.fromBytes(b.subarray(0, Fp62.BYTES)),
        c1: Fp62.fromBytes(b.subarray(Fp62.BYTES)),
      };
    },
    toBytes: ({ c0, c1 }) => concatBytes(Fp62.toBytes(c0), Fp62.toBytes(c1)),
    cmov: ({ c0, c1 }, { c0: r0, c1: r1 }, c) => ({
      c0: Fp62.cmov(c0, r0, c),
      c1: Fp62.cmov(c1, r1, c),
    }),
    // Utils
    // toString() {
    //   return `Fp12(${this.c0} + ${this.c1} * w)`;
    // },
    // fromTuple(c: [Fp6, Fp6]) {
    //   return new Fp12(...c);
    // }
    fromBigTwelve: (t) => ({
      c0: Fp62.fromBigSix(t.slice(0, 6)),
      c1: Fp62.fromBigSix(t.slice(6, 12)),
    }),
    // Raises to q**i -th power
    frobeniusMap(lhs, power) {
      const r0 = Fp62.frobeniusMap(lhs.c0, power);
      const { c0, c1, c2 } = Fp62.frobeniusMap(lhs.c1, power);
      const coeff = FP12_FROBENIUS_COEFFICIENTS[power % 12];
      return {
        c0: r0,
        c1: Fp62.create({
          c0: Fp22.mul(c0, coeff),
          c1: Fp22.mul(c1, coeff),
          c2: Fp22.mul(c2, coeff),
        }),
      };
    },
    // Sparse multiplication
    multiplyBy014: ({ c0, c1 }, o0, o1, o4) => {
      let t0 = Fp62.multiplyBy01(c0, o0, o1);
      let t1 = Fp62.multiplyBy1(c1, o4);
      return {
        c0: Fp62.add(Fp62.mulByNonresidue(t1), t0),
        // (c1 + c0) * [o0, o1+o4] - T0 - T1
        c1: Fp62.sub(
          Fp62.sub(
            Fp62.multiplyBy01(Fp62.add(c1, c0), o0, Fp22.add(o1, o4)),
            t0,
          ),
          t1,
        ),
      };
    },
    multiplyByFp2: ({ c0, c1 }, rhs) => ({
      c0: Fp62.multiplyByFp2(c0, rhs),
      c1: Fp62.multiplyByFp2(c1, rhs),
    }),
    conjugate: ({ c0, c1 }) => ({ c0, c1: Fp62.neg(c1) }),
    // A cyclotomic group is a subgroup of Fp^n defined by
    //   GΦₙ(p) = {α ∈ Fpⁿ : α^Φₙ(p) = 1}
    // The result of any pairing is in a cyclotomic subgroup
    // https://eprint.iacr.org/2009/565.pdf
    _cyclotomicSquare: ({ c0, c1 }) => {
      const { c0: c0c0, c1: c0c1, c2: c0c2 } = c0;
      const { c0: c1c0, c1: c1c1, c2: c1c2 } = c1;
      const { first: t3, second: t4 } = Fp4Square(c0c0, c1c1);
      const { first: t5, second: t6 } = Fp4Square(c1c0, c0c2);
      const { first: t7, second: t8 } = Fp4Square(c0c1, c1c2);
      let t9 = Fp22.mulByNonresidue(t8);
      return {
        c0: Fp62.create({
          c0: Fp22.add(Fp22.mul(Fp22.sub(t3, c0c0), _2n10), t3),
          c1: Fp22.add(Fp22.mul(Fp22.sub(t5, c0c1), _2n10), t5),
          c2: Fp22.add(Fp22.mul(Fp22.sub(t7, c0c2), _2n10), t7),
        }),
        c1: Fp62.create({
          c0: Fp22.add(Fp22.mul(Fp22.add(t9, c1c0), _2n10), t9),
          c1: Fp22.add(Fp22.mul(Fp22.add(t4, c1c1), _2n10), t4),
          c2: Fp22.add(Fp22.mul(Fp22.add(t6, c1c2), _2n10), t6),
        }),
      };
    },
    _cyclotomicExp(num, n) {
      let z = Fp12.ONE;
      for (let i = BLS_X_LEN - 1; i >= 0; i--) {
        z = Fp12._cyclotomicSquare(z);
        if (bitGet(n, i)) z = Fp12.mul(z, num);
      }
      return z;
    },
    // https://eprint.iacr.org/2010/354.pdf
    // https://eprint.iacr.org/2009/565.pdf
    finalExponentiate: (num) => {
      const x = BLS_X;
      const t0 = Fp12.div(Fp12.frobeniusMap(num, 6), num);
      const t1 = Fp12.mul(Fp12.frobeniusMap(t0, 2), t0);
      const t2 = Fp12.conjugate(Fp12._cyclotomicExp(t1, x));
      const t3 = Fp12.mul(Fp12.conjugate(Fp12._cyclotomicSquare(t1)), t2);
      const t4 = Fp12.conjugate(Fp12._cyclotomicExp(t3, x));
      const t5 = Fp12.conjugate(Fp12._cyclotomicExp(t4, x));
      const t6 = Fp12.mul(
        Fp12.conjugate(Fp12._cyclotomicExp(t5, x)),
        Fp12._cyclotomicSquare(t2),
      );
      const t7 = Fp12.conjugate(Fp12._cyclotomicExp(t6, x));
      const t2_t5_pow_q2 = Fp12.frobeniusMap(Fp12.mul(t2, t5), 2);
      const t4_t1_pow_q3 = Fp12.frobeniusMap(Fp12.mul(t4, t1), 3);
      const t6_t1c_pow_q1 = Fp12.frobeniusMap(
        Fp12.mul(t6, Fp12.conjugate(t1)),
        1,
      );
      const t7_t3c_t1 = Fp12.mul(Fp12.mul(t7, Fp12.conjugate(t3)), t1);
      return Fp12.mul(
        Fp12.mul(Fp12.mul(t2_t5_pow_q2, t4_t1_pow_q3), t6_t1c_pow_q1),
        t7_t3c_t1,
      );
    },
  };
  var FP12_FROBENIUS_COEFFICIENTS = [
    [BigInt("0x1"), BigInt("0x0")],
    [
      BigInt(
        "0x1904d3bf02bb0667c231beb4202c0d1f0fd603fd3cbd5f4f7b2443d784bab9c4f67ea53d63e7813d8d0775ed92235fb8",
      ),
      BigInt(
        "0x00fc3e2b36c4e03288e9e902231f9fb854a14787b6c7b36fec0c8ec971f63c5f282d5ac14d6c7ec22cf78a126ddc4af3",
      ),
    ],
    [
      BigInt(
        "0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffeffff",
      ),
      BigInt("0x0"),
    ],
    [
      BigInt(
        "0x135203e60180a68ee2e9c448d77a2cd91c3dedd930b1cf60ef396489f61eb45e304466cf3e67fa0af1ee7b04121bdea2",
      ),
      BigInt(
        "0x06af0e0437ff400b6831e36d6bd17ffe48395dabc2d3435e77f76e17009241c5ee67992f72ec05f4c81084fbede3cc09",
      ),
    ],
    [
      BigInt(
        "0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe",
      ),
      BigInt("0x0"),
    ],
    [
      BigInt(
        "0x144e4211384586c16bd3ad4afa99cc9170df3560e77982d0db45f3536814f0bd5871c1908bd478cd1ee605167ff82995",
      ),
      BigInt(
        "0x05b2cfd9013a5fd8df47fa6b48b1e045f39816240c0b8fee8beadf4d8e9c0566c63a3e6e257f87329b18fae980078116",
      ),
    ],
    [
      BigInt(
        "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaaa",
      ),
      BigInt("0x0"),
    ],
    [
      BigInt(
        "0x00fc3e2b36c4e03288e9e902231f9fb854a14787b6c7b36fec0c8ec971f63c5f282d5ac14d6c7ec22cf78a126ddc4af3",
      ),
      BigInt(
        "0x1904d3bf02bb0667c231beb4202c0d1f0fd603fd3cbd5f4f7b2443d784bab9c4f67ea53d63e7813d8d0775ed92235fb8",
      ),
    ],
    [
      BigInt(
        "0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac",
      ),
      BigInt("0x0"),
    ],
    [
      BigInt(
        "0x06af0e0437ff400b6831e36d6bd17ffe48395dabc2d3435e77f76e17009241c5ee67992f72ec05f4c81084fbede3cc09",
      ),
      BigInt(
        "0x135203e60180a68ee2e9c448d77a2cd91c3dedd930b1cf60ef396489f61eb45e304466cf3e67fa0af1ee7b04121bdea2",
      ),
    ],
    [
      BigInt(
        "0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaad",
      ),
      BigInt("0x0"),
    ],
    [
      BigInt(
        "0x05b2cfd9013a5fd8df47fa6b48b1e045f39816240c0b8fee8beadf4d8e9c0566c63a3e6e257f87329b18fae980078116",
      ),
      BigInt(
        "0x144e4211384586c16bd3ad4afa99cc9170df3560e77982d0db45f3536814f0bd5871c1908bd478cd1ee605167ff82995",
      ),
    ],
  ].map((n) => Fp22.fromBigTuple(n));
  var isogenyMapG2 = isogenyMap(
    Fp22,
    [
      // xNum
      [
        [
          "0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97d6",
          "0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97d6",
        ],
        [
          "0x0",
          "0x11560bf17baa99bc32126fced787c88f984f87adf7ae0c7f9a208c6b4f20a4181472aaa9cb8d555526a9ffffffffc71a",
        ],
        [
          "0x11560bf17baa99bc32126fced787c88f984f87adf7ae0c7f9a208c6b4f20a4181472aaa9cb8d555526a9ffffffffc71e",
          "0x8ab05f8bdd54cde190937e76bc3e447cc27c3d6fbd7063fcd104635a790520c0a395554e5c6aaaa9354ffffffffe38d",
        ],
        [
          "0x171d6541fa38ccfaed6dea691f5fb614cb14b4e7f4e810aa22d6108f142b85757098e38d0f671c7188e2aaaaaaaa5ed1",
          "0x0",
        ],
      ],
      // xDen
      [
        [
          "0x0",
          "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa63",
        ],
        [
          "0xc",
          "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa9f",
        ],
        ["0x1", "0x0"],
        // LAST 1
      ],
      // yNum
      [
        [
          "0x1530477c7ab4113b59a4c18b076d11930f7da5d4a07f649bf54439d87d27e500fc8c25ebf8c92f6812cfc71c71c6d706",
          "0x1530477c7ab4113b59a4c18b076d11930f7da5d4a07f649bf54439d87d27e500fc8c25ebf8c92f6812cfc71c71c6d706",
        ],
        [
          "0x0",
          "0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97be",
        ],
        [
          "0x11560bf17baa99bc32126fced787c88f984f87adf7ae0c7f9a208c6b4f20a4181472aaa9cb8d555526a9ffffffffc71c",
          "0x8ab05f8bdd54cde190937e76bc3e447cc27c3d6fbd7063fcd104635a790520c0a395554e5c6aaaa9354ffffffffe38f",
        ],
        [
          "0x124c9ad43b6cf79bfbf7043de3811ad0761b0f37a1e26286b0e977c69aa274524e79097a56dc4bd9e1b371c71c718b10",
          "0x0",
        ],
      ],
      // yDen
      [
        [
          "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffa8fb",
          "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffa8fb",
        ],
        [
          "0x0",
          "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffa9d3",
        ],
        [
          "0x12",
          "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa99",
        ],
        ["0x1", "0x0"],
        // LAST 1
      ],
    ].map((i) => i.map((pair) => Fp22.fromBigTuple(pair.map(BigInt)))),
  );
  var isogenyMapG1 = isogenyMap(
    Fp7,
    [
      // xNum
      [
        "0x11a05f2b1e833340b809101dd99815856b303e88a2d7005ff2627b56cdb4e2c85610c2d5f2e62d6eaeac1662734649b7",
        "0x17294ed3e943ab2f0588bab22147a81c7c17e75b2f6a8417f565e33c70d1e86b4838f2a6f318c356e834eef1b3cb83bb",
        "0xd54005db97678ec1d1048c5d10a9a1bce032473295983e56878e501ec68e25c958c3e3d2a09729fe0179f9dac9edcb0",
        "0x1778e7166fcc6db74e0609d307e55412d7f5e4656a8dbf25f1b33289f1b330835336e25ce3107193c5b388641d9b6861",
        "0xe99726a3199f4436642b4b3e4118e5499db995a1257fb3f086eeb65982fac18985a286f301e77c451154ce9ac8895d9",
        "0x1630c3250d7313ff01d1201bf7a74ab5db3cb17dd952799b9ed3ab9097e68f90a0870d2dcae73d19cd13c1c66f652983",
        "0xd6ed6553fe44d296a3726c38ae652bfb11586264f0f8ce19008e218f9c86b2a8da25128c1052ecaddd7f225a139ed84",
        "0x17b81e7701abdbe2e8743884d1117e53356de5ab275b4db1a682c62ef0f2753339b7c8f8c8f475af9ccb5618e3f0c88e",
        "0x80d3cf1f9a78fc47b90b33563be990dc43b756ce79f5574a2c596c928c5d1de4fa295f296b74e956d71986a8497e317",
        "0x169b1f8e1bcfa7c42e0c37515d138f22dd2ecb803a0c5c99676314baf4bb1b7fa3190b2edc0327797f241067be390c9e",
        "0x10321da079ce07e272d8ec09d2565b0dfa7dccdde6787f96d50af36003b14866f69b771f8c285decca67df3f1605fb7b",
        "0x6e08c248e260e70bd1e962381edee3d31d79d7e22c837bc23c0bf1bc24c6b68c24b1b80b64d391fa9c8ba2e8ba2d229",
      ],
      // xDen
      [
        "0x8ca8d548cff19ae18b2e62f4bd3fa6f01d5ef4ba35b48ba9c9588617fc8ac62b558d681be343df8993cf9fa40d21b1c",
        "0x12561a5deb559c4348b4711298e536367041e8ca0cf0800c0126c2588c48bf5713daa8846cb026e9e5c8276ec82b3bff",
        "0xb2962fe57a3225e8137e629bff2991f6f89416f5a718cd1fca64e00b11aceacd6a3d0967c94fedcfcc239ba5cb83e19",
        "0x3425581a58ae2fec83aafef7c40eb545b08243f16b1655154cca8abc28d6fd04976d5243eecf5c4130de8938dc62cd8",
        "0x13a8e162022914a80a6f1d5f43e7a07dffdfc759a12062bb8d6b44e833b306da9bd29ba81f35781d539d395b3532a21e",
        "0xe7355f8e4e667b955390f7f0506c6e9395735e9ce9cad4d0a43bcef24b8982f7400d24bc4228f11c02df9a29f6304a5",
        "0x772caacf16936190f3e0c63e0596721570f5799af53a1894e2e073062aede9cea73b3538f0de06cec2574496ee84a3a",
        "0x14a7ac2a9d64a8b230b3f5b074cf01996e7f63c21bca68a81996e1cdf9822c580fa5b9489d11e2d311f7d99bbdcc5a5e",
        "0xa10ecf6ada54f825e920b3dafc7a3cce07f8d1d7161366b74100da67f39883503826692abba43704776ec3a79a1d641",
        "0x95fc13ab9e92ad4476d6e3eb3a56680f682b4ee96f7d03776df533978f31c1593174e4b4b7865002d6384d168ecdd0a",
        "0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
        // LAST 1
      ],
      // yNum
      [
        "0x90d97c81ba24ee0259d1f094980dcfa11ad138e48a869522b52af6c956543d3cd0c7aee9b3ba3c2be9845719707bb33",
        "0x134996a104ee5811d51036d776fb46831223e96c254f383d0f906343eb67ad34d6c56711962fa8bfe097e75a2e41c696",
        "0xcc786baa966e66f4a384c86a3b49942552e2d658a31ce2c344be4b91400da7d26d521628b00523b8dfe240c72de1f6",
        "0x1f86376e8981c217898751ad8746757d42aa7b90eeb791c09e4a3ec03251cf9de405aba9ec61deca6355c77b0e5f4cb",
        "0x8cc03fdefe0ff135caf4fe2a21529c4195536fbe3ce50b879833fd221351adc2ee7f8dc099040a841b6daecf2e8fedb",
        "0x16603fca40634b6a2211e11db8f0a6a074a7d0d4afadb7bd76505c3d3ad5544e203f6326c95a807299b23ab13633a5f0",
        "0x4ab0b9bcfac1bbcb2c977d027796b3ce75bb8ca2be184cb5231413c4d634f3747a87ac2460f415ec961f8855fe9d6f2",
        "0x987c8d5333ab86fde9926bd2ca6c674170a05bfe3bdd81ffd038da6c26c842642f64550fedfe935a15e4ca31870fb29",
        "0x9fc4018bd96684be88c9e221e4da1bb8f3abd16679dc26c1e8b6e6a1f20cabe69d65201c78607a360370e577bdba587",
        "0xe1bba7a1186bdb5223abde7ada14a23c42a0ca7915af6fe06985e7ed1e4d43b9b3f7055dd4eba6f2bafaaebca731c30",
        "0x19713e47937cd1be0dfd0b8f1d43fb93cd2fcbcb6caf493fd1183e416389e61031bf3a5cce3fbafce813711ad011c132",
        "0x18b46a908f36f6deb918c143fed2edcc523559b8aaf0c2462e6bfe7f911f643249d9cdf41b44d606ce07c8a4d0074d8e",
        "0xb182cac101b9399d155096004f53f447aa7b12a3426b08ec02710e807b4633f06c851c1919211f20d4c04f00b971ef8",
        "0x245a394ad1eca9b72fc00ae7be315dc757b3b080d4c158013e6632d3c40659cc6cf90ad1c232a6442d9d3f5db980133",
        "0x5c129645e44cf1102a159f748c4a3fc5e673d81d7e86568d9ab0f5d396a7ce46ba1049b6579afb7866b1e715475224b",
        "0x15e6be4e990f03ce4ea50b3b42df2eb5cb181d8f84965a3957add4fa95af01b2b665027efec01c7704b456be69c8b604",
      ],
      // yDen
      [
        "0x16112c4c3a9c98b252181140fad0eae9601a6de578980be6eec3232b5be72e7a07f3688ef60c206d01479253b03663c1",
        "0x1962d75c2381201e1a0cbd6c43c348b885c84ff731c4d59ca4a10356f453e01f78a4260763529e3532f6102c2e49a03d",
        "0x58df3306640da276faaae7d6e8eb15778c4855551ae7f310c35a5dd279cd2eca6757cd636f96f891e2538b53dbf67f2",
        "0x16b7d288798e5395f20d23bf89edb4d1d115c5dbddbcd30e123da489e726af41727364f2c28297ada8d26d98445f5416",
        "0xbe0e079545f43e4b00cc912f8228ddcc6d19c9f0f69bbb0542eda0fc9dec916a20b15dc0fd2ededda39142311a5001d",
        "0x8d9e5297186db2d9fb266eaac783182b70152c65550d881c5ecd87b6f0f5a6449f38db9dfa9cce202c6477faaf9b7ac",
        "0x166007c08a99db2fc3ba8734ace9824b5eecfdfa8d0cf8ef5dd365bc400a0051d5fa9c01a58b1fb93d1a1399126a775c",
        "0x16a3ef08be3ea7ea03bcddfabba6ff6ee5a4375efa1f4fd7feb34fd206357132b920f5b00801dee460ee415a15812ed9",
        "0x1866c8ed336c61231a1be54fd1d74cc4f9fb0ce4c6af5920abc5750c4bf39b4852cfe2f7bb9248836b233d9d55535d4a",
        "0x167a55cda70a6e1cea820597d94a84903216f763e13d87bb5308592e7ea7d4fbc7385ea3d529b35e346ef48bb8913f55",
        "0x4d2f259eea405bd48f010a01ad2911d9c6dd039bb61a6290e591b36e636a5c871a5c29f4f83060400f8b49cba8f6aa8",
        "0xaccbb67481d033ff5852c1e48c50c477f94ff8aefce42d28c0f9a88cea7913516f968986f7ebbea9684b529e2561092",
        "0xad6b9514c767fe3c3613144b45f1496543346d98adf02267d5ceef9a00d9b8693000763e3b90ac11e99b138573345cc",
        "0x2660400eb2e4f3b628bdd0d53cd76f2bf565b94e72927c1cb748df27942480e420517bd8714cc80d1fadc1326ed06f7",
        "0xe0fa1d816ddc03e6b24255e0d7819c171c40f65e273b853324efcd6356caa205ca2f570f13497804415473a1d634b8f",
        "0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
        // LAST 1
      ],
    ].map((i) => i.map((j) => BigInt(j))),
  );
  var G2_SWU = mapToCurveSimpleSWU(Fp22, {
    A: Fp22.create({ c0: Fp7.create(_0n10), c1: Fp7.create(BigInt(240)) }),
    B: Fp22.create({
      c0: Fp7.create(BigInt(1012)),
      c1: Fp7.create(BigInt(1012)),
    }),
    Z: Fp22.create({ c0: Fp7.create(BigInt(-2)), c1: Fp7.create(BigInt(-1)) }),
    // Z: -(2 + I)
  });
  var G1_SWU = mapToCurveSimpleSWU(Fp7, {
    A: Fp7.create(
      BigInt(
        "0x144698a3b8e9433d693a02c96d4982b0ea985383ee66a8d8e8981aefd881ac98936f8da0e0f97f5cf428082d584c1d",
      ),
    ),
    B: Fp7.create(
      BigInt(
        "0x12e2908d11688030018b12e8753eee3b2016c1f0f24f4070a0b9c14fcef35ef55a23215a316ceaa5d1cc48e98e172be0",
      ),
    ),
    Z: Fp7.create(BigInt(11)),
  });
  var ut_root = Fp62.create({ c0: Fp22.ZERO, c1: Fp22.ONE, c2: Fp22.ZERO });
  var wsq = Fp12.create({ c0: ut_root, c1: Fp62.ZERO });
  var wcu = Fp12.create({ c0: Fp62.ZERO, c1: ut_root });
  var [wsq_inv, wcu_inv] = Fp12.invertBatch([wsq, wcu]);
  function psi(x, y) {
    const x2 = Fp12.mul(
      Fp12.frobeniusMap(Fp12.multiplyByFp2(wsq_inv, x), 1),
      wsq,
    ).c0.c0;
    const y2 = Fp12.mul(
      Fp12.frobeniusMap(Fp12.multiplyByFp2(wcu_inv, y), 1),
      wcu,
    ).c0.c0;
    return [x2, y2];
  }
  function G2psi(c, P3) {
    const affine = P3.toAffine();
    const p = psi(affine.x, affine.y);
    return new c(p[0], p[1], Fp22.ONE);
  }
  var PSI2_C1 = BigInt(
    "0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac",
  );
  function psi2(x, y) {
    return [Fp22.mul(x, PSI2_C1), Fp22.neg(y)];
  }
  function G2psi2(c, P3) {
    const affine = P3.toAffine();
    const p = psi2(affine.x, affine.y);
    return new c(p[0], p[1], Fp22.ONE);
  }
  var htfDefaults = Object.freeze({
    // DST: a domain separation tag
    // defined in section 2.2.5
    // Use utils.getDSTLabel(), utils.setDSTLabel(value)
    DST: "BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_",
    encodeDST: "BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_",
    // p: the characteristic of F
    //    where F is a finite field of characteristic p and order q = p^m
    p: Fp7.ORDER,
    // m: the extension degree of F, m >= 1
    //     where F is a finite field of characteristic p and order q = p^m
    m: 2,
    // k: the target security level for the suite in bits
    // defined in section 5.1
    k: 128,
    // option to use a message that has already been processed by
    // expand_message_xmd
    expand: "xmd",
    // Hash functions for: expand_message_xmd is appropriate for use with a
    // wide range of hash functions, including SHA-2, SHA-3, BLAKE2, and others.
    // BBS+ uses blake2: https://github.com/hyperledger/aries-framework-go/issues/2247
    hash: sha256,
  });
  var C_BIT_POS = Fp7.BITS;
  var I_BIT_POS = Fp7.BITS + 1;
  var S_BIT_POS = Fp7.BITS + 2;
  var COMPRESSED_ZERO = Fp7.toBytes(
    bitSet(bitSet(_0n10, I_BIT_POS, true), S_BIT_POS, true),
  );
  function signatureG2ToRawBytes(point) {
    point.assertValidity();
    const len = Fp7.BYTES;
    if (point.equals(bls12_381.G2.ProjectivePoint.ZERO))
      return concatBytes(COMPRESSED_ZERO, numberToBytesBE(_0n10, len));
    const { x, y } = point.toAffine();
    const { re: x0, im: x1 } = Fp22.reim(x);
    const { re: y0, im: y1 } = Fp22.reim(y);
    const tmp = y1 > _0n10 ? y1 * _2n10 : y0 * _2n10;
    const aflag1 = Boolean((tmp / Fp7.ORDER) & _1n11);
    const z1 = bitSet(bitSet(x1, 381, aflag1), S_BIT_POS, true);
    const z2 = x0;
    return concatBytes(numberToBytesBE(z1, len), numberToBytesBE(z2, len));
  }
  var bls12_381 = bls({
    // Fields
    fields: {
      Fp: Fp7,
      Fp2: Fp22,
      Fp6: Fp62,
      Fp12,
      Fr,
    },
    // G1 is the order-q subgroup of E1(Fp) : y² = x³ + 4, #E1(Fp) = h1q, where
    // characteristic; z + (z⁴ - z² + 1)(z - 1)²/3
    G1: {
      Fp: Fp7,
      // cofactor; (z - 1)²/3
      h: BigInt("0x396c8c005555e1568c00aaab0000aaab"),
      // generator's coordinates
      // x = 3685416753713387016781088315183077757961620795782546409894578378688607592378376318836054947676345821548104185464507
      // y = 1339506544944476473020471379941921221584933875938349620426543736416511423956333506472724655353366534992391756441569
      Gx: BigInt(
        "0x17f1d3a73197d7942695638c4fa9ac0fc3688c4f9774b905a14e3a3f171bac586c55e83ff97a1aeffb3af00adb22c6bb",
      ),
      Gy: BigInt(
        "0x08b3f481e3aaa0f1a09e30ed741d8ae4fcf5e095d5d00af600db18cb2c04b3edd03cc744a2888ae40caa232946c5e7e1",
      ),
      a: Fp7.ZERO,
      b: _4n4,
      htfDefaults: { ...htfDefaults, m: 1 },
      wrapPrivateKey: true,
      allowInfinityPoint: true,
      // Checks is the point resides in prime-order subgroup.
      // point.isTorsionFree() should return true for valid points
      // It returns false for shitty points.
      // https://eprint.iacr.org/2021/1130.pdf
      isTorsionFree: (c, point) => {
        const cubicRootOfUnityModP = BigInt(
          "0x5f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe",
        );
        const phi = new c(
          Fp7.mul(point.px, cubicRootOfUnityModP),
          point.py,
          point.pz,
        );
        const xP = point.multiplyUnsafe(bls12_381.params.x).negate();
        const u2P = xP.multiplyUnsafe(bls12_381.params.x);
        return u2P.equals(phi);
      },
      // Clear cofactor of G1
      // https://eprint.iacr.org/2019/403
      clearCofactor: (_c, point) => {
        return point.multiplyUnsafe(bls12_381.params.x).add(point);
      },
      mapToCurve: (scalars) => {
        const { x, y } = G1_SWU(Fp7.create(scalars[0]));
        return isogenyMapG1(x, y);
      },
      fromBytes: (bytes2) => {
        bytes2 = bytes2.slice();
        if (bytes2.length === 48) {
          const P3 = Fp7.ORDER;
          const compressedValue = bytesToNumberBE(bytes2);
          const bflag = bitGet(compressedValue, I_BIT_POS);
          if (bflag === _1n11) return { x: _0n10, y: _0n10 };
          const x = Fp7.create(compressedValue & Fp7.MASK);
          const right = Fp7.add(
            Fp7.pow(x, _3n5),
            Fp7.create(bls12_381.params.G1b),
          );
          let y = Fp7.sqrt(right);
          if (!y) throw new Error("Invalid compressed G1 point");
          const aflag = bitGet(compressedValue, C_BIT_POS);
          if ((y * _2n10) / P3 !== aflag) y = Fp7.neg(y);
          return { x: Fp7.create(x), y: Fp7.create(y) };
        } else if (bytes2.length === 96) {
          if ((bytes2[0] & (1 << 6)) !== 0)
            return bls12_381.G1.ProjectivePoint.ZERO.toAffine();
          const x = bytesToNumberBE(bytes2.subarray(0, Fp7.BYTES));
          const y = bytesToNumberBE(bytes2.subarray(Fp7.BYTES));
          return { x: Fp7.create(x), y: Fp7.create(y) };
        } else {
          throw new Error("Invalid point G1, expected 48/96 bytes");
        }
      },
      toBytes: (c, point, isCompressed) => {
        const isZero = point.equals(c.ZERO);
        const { x, y } = point.toAffine();
        if (isCompressed) {
          if (isZero) return COMPRESSED_ZERO.slice();
          const P3 = Fp7.ORDER;
          let num;
          num = bitSet(x, C_BIT_POS, Boolean((y * _2n10) / P3));
          num = bitSet(num, S_BIT_POS, true);
          return numberToBytesBE(num, Fp7.BYTES);
        } else {
          if (isZero) {
            const x2 = concatBytes(
              new Uint8Array([64]),
              new Uint8Array(2 * Fp7.BYTES - 1),
            );
            return x2;
          } else {
            return concatBytes(
              numberToBytesBE(x, Fp7.BYTES),
              numberToBytesBE(y, Fp7.BYTES),
            );
          }
        }
      },
    },
    // G2 is the order-q subgroup of E2(Fp²) : y² = x³+4(1+√−1),
    // where Fp2 is Fp[√−1]/(x2+1). #E2(Fp2 ) = h2q, where
    // G² - 1
    // h2q
    G2: {
      Fp: Fp22,
      // cofactor
      h: BigInt(
        "0x5d543a95414e7f1091d50792876a202cd91de4547085abaa68a205b2e5a7ddfa628f1cb4d9e82ef21537e293a6691ae1616ec6e786f0c70cf1c38e31c7238e5",
      ),
      Gx: Fp22.fromBigTuple([
        BigInt(
          "0x024aa2b2f08f0a91260805272dc51051c6e47ad4fa403b02b4510b647ae3d1770bac0326a805bbefd48056c8c121bdb8",
        ),
        BigInt(
          "0x13e02b6052719f607dacd3a088274f65596bd0d09920b61ab5da61bbdc7f5049334cf11213945d57e5ac7d055d042b7e",
        ),
      ]),
      // y =
      // 927553665492332455747201965776037880757740193453592970025027978793976877002675564980949289727957565575433344219582,
      // 1985150602287291935568054521177171638300868978215655730859378665066344726373823718423869104263333984641494340347905
      Gy: Fp22.fromBigTuple([
        BigInt(
          "0x0ce5d527727d6e118cc9cdc6da2e351aadfd9baa8cbdd3a76d429a695160d12c923ac9cc3baca289e193548608b82801",
        ),
        BigInt(
          "0x0606c4a02ea734cc32acd2b02bc28b99cb3e287e85a763af267492ab572e99ab3f370d275cec1da1aaa9075ff05f79be",
        ),
      ]),
      a: Fp22.ZERO,
      b: Fp22.fromBigTuple([_4n4, _4n4]),
      hEff: BigInt(
        "0xbc69f08f2ee75b3584c6a0ea91b352888e2a8e9145ad7689986ff031508ffe1329c2f178731db956d82bf015d1212b02ec0ec69d7477c1ae954cbc06689f6a359894c0adebbf6b4e8020005aaa95551",
      ),
      htfDefaults: { ...htfDefaults },
      wrapPrivateKey: true,
      allowInfinityPoint: true,
      mapToCurve: (scalars) => {
        const { x, y } = G2_SWU(Fp22.fromBigTuple(scalars));
        return isogenyMapG2(x, y);
      },
      // Checks is the point resides in prime-order subgroup.
      // point.isTorsionFree() should return true for valid points
      // It returns false for shitty points.
      // https://eprint.iacr.org/2021/1130.pdf
      isTorsionFree: (c, P3) => {
        return P3.multiplyUnsafe(bls12_381.params.x)
          .negate()
          .equals(G2psi(c, P3));
      },
      // Maps the point into the prime-order subgroup G2.
      // clear_cofactor_bls12381_g2 from cfrg-hash-to-curve-11
      // https://eprint.iacr.org/2017/419.pdf
      // prettier-ignore
      clearCofactor: (c, P3) => {
        const x = bls12_381.params.x;
        let t1 = P3.multiplyUnsafe(x).negate();
        let t2 = G2psi(c, P3);
        let t3 = P3.double();
        t3 = G2psi2(c, t3);
        t3 = t3.subtract(t2);
        t2 = t1.add(t2);
        t2 = t2.multiplyUnsafe(x).negate();
        t3 = t3.add(t2);
        t3 = t3.subtract(t1);
        const Q = t3.subtract(P3);
        return Q;
      },
      fromBytes: (bytes2) => {
        bytes2 = bytes2.slice();
        const m_byte = bytes2[0] & 224;
        if (m_byte === 32 || m_byte === 96 || m_byte === 224) {
          throw new Error("Invalid encoding flag: " + m_byte);
        }
        const bitC = m_byte & 128;
        const bitI = m_byte & 64;
        const bitS = m_byte & 32;
        const L = Fp7.BYTES;
        const slc = (b, from, to) => bytesToNumberBE(b.slice(from, to));
        if (bytes2.length === 96 && bitC) {
          const b = bls12_381.params.G2b;
          const P3 = Fp7.ORDER;
          bytes2[0] = bytes2[0] & 31;
          if (bitI) {
            if (bytes2.reduce((p, c) => (p !== 0 ? c + 1 : c), 0) > 0) {
              throw new Error("Invalid compressed G2 point");
            }
            return { x: Fp22.ZERO, y: Fp22.ZERO };
          }
          const x_1 = slc(bytes2, 0, L);
          const x_0 = slc(bytes2, L, 2 * L);
          const x = Fp22.create({ c0: Fp7.create(x_0), c1: Fp7.create(x_1) });
          const right = Fp22.add(Fp22.pow(x, _3n5), b);
          let y = Fp22.sqrt(right);
          const Y_bit =
            y.c1 === _0n10
              ? (y.c0 * _2n10) / P3
              : (y.c1 * _2n10) / P3
                ? _1n11
                : _0n10;
          y = bitS > 0 && Y_bit > 0 ? y : Fp22.neg(y);
          return { x, y };
        } else if (bytes2.length === 192 && !bitC) {
          if ((bytes2[0] & (1 << 6)) !== 0) {
            return { x: Fp22.ZERO, y: Fp22.ZERO };
          }
          const x1 = slc(bytes2, 0, L);
          const x0 = slc(bytes2, L, 2 * L);
          const y1 = slc(bytes2, 2 * L, 3 * L);
          const y0 = slc(bytes2, 3 * L, 4 * L);
          return {
            x: Fp22.fromBigTuple([x0, x1]),
            y: Fp22.fromBigTuple([y0, y1]),
          };
        } else {
          throw new Error("Invalid point G2, expected 96/192 bytes");
        }
      },
      toBytes: (c, point, isCompressed) => {
        const { BYTES: len, ORDER: P3 } = Fp7;
        const isZero = point.equals(c.ZERO);
        const { x, y } = point.toAffine();
        if (isCompressed) {
          if (isZero)
            return concatBytes(COMPRESSED_ZERO, numberToBytesBE(_0n10, len));
          const flag = Boolean(
            y.c1 === _0n10 ? (y.c0 * _2n10) / P3 : (y.c1 * _2n10) / P3,
          );
          let x_1 = bitSet(x.c1, C_BIT_POS, flag);
          x_1 = bitSet(x_1, S_BIT_POS, true);
          return concatBytes(
            numberToBytesBE(x_1, len),
            numberToBytesBE(x.c0, len),
          );
        } else {
          if (isZero)
            return concatBytes(
              new Uint8Array([64]),
              new Uint8Array(4 * len - 1),
            );
          const { re: x0, im: x1 } = Fp22.reim(x);
          const { re: y0, im: y1 } = Fp22.reim(y);
          return concatBytes(
            numberToBytesBE(x1, len),
            numberToBytesBE(x0, len),
            numberToBytesBE(y1, len),
            numberToBytesBE(y0, len),
          );
        }
      },
      Signature: {
        // TODO: Optimize, it's very slow because of sqrt.
        fromHex(hex) {
          hex = ensureBytes("signatureHex", hex);
          const P3 = Fp7.ORDER;
          const half = hex.length / 2;
          if (half !== 48 && half !== 96)
            throw new Error(
              "Invalid compressed signature length, must be 96 or 192",
            );
          const z1 = bytesToNumberBE(hex.slice(0, half));
          const z2 = bytesToNumberBE(hex.slice(half));
          const bflag1 = bitGet(z1, I_BIT_POS);
          if (bflag1 === _1n11) return bls12_381.G2.ProjectivePoint.ZERO;
          const x1 = Fp7.create(z1 & Fp7.MASK);
          const x2 = Fp7.create(z2);
          const x = Fp22.create({ c0: x2, c1: x1 });
          const y2 = Fp22.add(Fp22.pow(x, _3n5), bls12_381.params.G2b);
          let y = Fp22.sqrt(y2);
          if (!y) throw new Error("Failed to find a square root");
          const { re: y0, im: y1 } = Fp22.reim(y);
          const aflag1 = bitGet(z1, 381);
          const isGreater = y1 > _0n10 && (y1 * _2n10) / P3 !== aflag1;
          const isZero = y1 === _0n10 && (y0 * _2n10) / P3 !== aflag1;
          if (isGreater || isZero) y = Fp22.neg(y);
          const point = bls12_381.G2.ProjectivePoint.fromAffine({ x, y });
          point.assertValidity();
          return point;
        },
        toRawBytes(point) {
          return signatureG2ToRawBytes(point);
        },
        toHex(point) {
          return bytesToHex(signatureG2ToRawBytes(point));
        },
      },
    },
    params: {
      x: BLS_X,
      r: Fr.ORDER,
      // order; z⁴ − z² + 1; CURVE.n from other curves
    },
    htfDefaults,
    hash: sha256,
    randomBytes,
  });

  // input.js
  var utils = { bytesToHex, concatBytes, hexToBytes };
  return __toCommonJS(input_exports);
})();
/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
/*! Bundled license information:

@noble/hashes/esm/utils.js:
  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
*/