@icp-sdk/vetkeys 0.5.0-beta.0

package/dist/lib/index-BUXhtQhx.mjs

@@ -0,0 +1,3932 @@
+const Ut = typeof globalThis == "object" && "crypto" in globalThis ? globalThis.crypto : void 0;
+function ge(e) {
+  return e instanceof Uint8Array || ArrayBuffer.isView(e) && e.constructor.name === "Uint8Array";
+}
+function Zt(e) {
+  if (!Number.isSafeInteger(e) || e < 0)
+    throw new Error("positive integer expected, got " + e);
+}
+function J(e, ...t) {
+  if (!ge(e))
+    throw new Error("Uint8Array expected");
+  if (t.length > 0 && !t.includes(e.length))
+    throw new Error("Uint8Array expected of length " + t + ", got length=" + e.length);
+}
+function Fe(e) {
+  if (typeof e != "function" || typeof e.create != "function")
+    throw new Error("Hash should be wrapped by utils.createHasher");
+  Zt(e.outputLen), Zt(e.blockLen);
+}
+function Kt(e, t = !0) {
+  if (e.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (t && e.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function Hn(e, t) {
+  J(e);
+  const r = t.outputLen;
+  if (e.length < r)
+    throw new Error("digestInto() expects output buffer of length at least " + r);
+}
+function mr(e) {
+  return new Uint32Array(e.buffer, e.byteOffset, Math.floor(e.byteLength / 4));
+}
+function mt(...e) {
+  for (let t = 0; t < e.length; t++)
+    e[t].fill(0);
+}
+function Be(e) {
+  return new DataView(e.buffer, e.byteOffset, e.byteLength);
+}
+function ft(e, t) {
+  return e << 32 - t | e >>> t;
+}
+const gr = new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68;
+function yr(e) {
+  return e << 24 & 4278190080 | e << 8 & 16711680 | e >>> 8 & 65280 | e >>> 24 & 255;
+}
+function pr(e) {
+  for (let t = 0; t < e.length; t++)
+    e[t] = yr(e[t]);
+  return e;
+}
+const tn = gr ? (e) => e : pr, Gn = /* @ts-ignore */ typeof Uint8Array.from([]).toHex == "function" && typeof Uint8Array.fromHex == "function", wr = /* @__PURE__ */ Array.from({ length: 256 }, (e, t) => t.toString(16).padStart(2, "0"));
+function Xt(e) {
+  if (J(e), Gn)
+    return e.toHex();
+  let t = "";
+  for (let r = 0; r < e.length; r++)
+    t += wr[e[r]];
+  return t;
+}
+const ut = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
+function en(e) {
+  if (e >= ut._0 && e <= ut._9)
+    return e - ut._0;
+  if (e >= ut.A && e <= ut.F)
+    return e - (ut.A - 10);
+  if (e >= ut.a && e <= ut.f)
+    return e - (ut.a - 10);
+}
+function Un(e) {
+  if (typeof e != "string")
+    throw new Error("hex string expected, got " + typeof e);
+  if (Gn)
+    return Uint8Array.fromHex(e);
+  const t = e.length, r = t / 2;
+  if (t % 2)
+    throw new Error("hex string expected, got unpadded hex of length " + t);
+  const n = new Uint8Array(r);
+  for (let s = 0, c = 0; s < r; s++, c += 2) {
+    const o = en(e.charCodeAt(c)), i = en(e.charCodeAt(c + 1));
+    if (o === void 0 || i === void 0) {
+      const a = e[c] + e[c + 1];
+      throw new Error('hex string expected, got non-hex character "' + a + '" at index ' + c);
+    }
+    n[s] = o * 16 + i;
+  }
+  return n;
+}
+function ee(e) {
+  if (typeof e != "string")
+    throw new Error("string expected");
+  return new Uint8Array(new TextEncoder().encode(e));
+}
+function Tt(e) {
+  return typeof e == "string" && (e = ee(e)), J(e), e;
+}
+function C(...e) {
+  let t = 0;
+  for (let n = 0; n < e.length; n++) {
+    const s = e[n];
+    J(s), t += s.length;
+  }
+  const r = new Uint8Array(t);
+  for (let n = 0, s = 0; n < e.length; n++) {
+    const c = e[n];
+    r.set(c, s), s += c.length;
+  }
+  return r;
+}
+class Ce {
+}
+function Ye(e) {
+  const t = (n) => e().update(Tt(n)).digest(), r = e();
+  return t.outputLen = r.outputLen, t.blockLen = r.blockLen, t.create = () => e(), t;
+}
+function xr(e) {
+  const t = (n, s) => e(s).update(Tt(n)).digest(), r = e({});
+  return t.outputLen = r.outputLen, t.blockLen = r.blockLen, t.create = (n) => e(n), t;
+}
+function Er(e = 32) {
+  if (Ut && typeof Ut.getRandomValues == "function")
+    return Ut.getRandomValues(new Uint8Array(e));
+  if (Ut && typeof Ut.randomBytes == "function")
+    return Uint8Array.from(Ut.randomBytes(e));
+  throw new Error("crypto.getRandomValues must be defined");
+}
+function Br(e, t, r, n) {
+  if (typeof e.setBigUint64 == "function")
+    return e.setBigUint64(t, r, n);
+  const s = BigInt(32), c = BigInt(4294967295), o = Number(r >> s & c), i = Number(r & c), a = n ? 4 : 0, u = n ? 0 : 4;
+  e.setUint32(t + a, o, n), e.setUint32(t + u, i, n);
+}
+function _r(e, t, r) {
+  return e & t ^ ~e & r;
+}
+function Sr(e, t, r) {
+  return e & t ^ e & r ^ t & r;
+}
+class Ln extends Ce {
+  constructor(t, r, n, s) {
+    super(), this.finished = !1, this.length = 0, this.pos = 0, this.destroyed = !1, this.blockLen = t, this.outputLen = r, this.padOffset = n, this.isLE = s, this.buffer = new Uint8Array(t), this.view = Be(this.buffer);
+  }
+  update(t) {
+    Kt(this), t = Tt(t), J(t);
+    const { view: r, buffer: n, blockLen: s } = this, c = t.length;
+    for (let o = 0; o < c; ) {
+      const i = Math.min(s - this.pos, c - o);
+      if (i === s) {
+        const a = Be(t);
+        for (; s <= c - o; o += s)
+          this.process(a, o);
+        continue;
+      }
+      n.set(t.subarray(o, o + i), this.pos), this.pos += i, o += i, this.pos === s && (this.process(r, 0), this.pos = 0);
+    }
+    return this.length += t.length, this.roundClean(), this;
+  }
+  digestInto(t) {
+    Kt(this), Hn(t, this), this.finished = !0;
+    const { buffer: r, view: n, blockLen: s, isLE: c } = this;
+    let { pos: o } = this;
+    r[o++] = 128, mt(this.buffer.subarray(o)), this.padOffset > s - o && (this.process(n, 0), o = 0);
+    for (let d = o; d < s; d++)
+      r[d] = 0;
+    Br(n, s - 8, BigInt(this.length * 8), c), this.process(n, 0);
+    const i = Be(t), a = this.outputLen;
+    if (a % 4)
+      throw new Error("_sha2: outputLen should be aligned to 32bit");
+    const u = a / 4, l = this.get();
+    if (u > l.length)
+      throw new Error("_sha2: outputLen bigger than state");
+    for (let d = 0; d < u; d++)
+      i.setUint32(4 * d, l[d], c);
+  }
+  digest() {
+    const { buffer: t, outputLen: r } = this;
+    this.digestInto(t);
+    const n = t.slice(0, r);
+    return this.destroy(), n;
+  }
+  _cloneInto(t) {
+    t || (t = new this.constructor()), t.set(...this.get());
+    const { blockLen: r, buffer: n, length: s, finished: c, destroyed: o, pos: i } = this;
+    return t.destroyed = o, t.finished = c, t.length = s, t.pos = i, s % r && t.buffer.set(n), t;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+}
+const gt = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]), yt = /* @__PURE__ */ Uint32Array.from([
+  3238371032,
+  914150663,
+  812702999,
+  4144912697,
+  4290775857,
+  1750603025,
+  1694076839,
+  3204075428
+]), $ = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  4089235720,
+  3144134277,
+  2227873595,
+  1013904242,
+  4271175723,
+  2773480762,
+  1595750129,
+  1359893119,
+  2917565137,
+  2600822924,
+  725511199,
+  528734635,
+  4215389547,
+  1541459225,
+  327033209
+]), se = /* @__PURE__ */ BigInt(2 ** 32 - 1), nn = /* @__PURE__ */ BigInt(32);
+function Ar(e, t = !1) {
+  return t ? { h: Number(e & se), l: Number(e >> nn & se) } : { h: Number(e >> nn & se) | 0, l: Number(e & se) | 0 };
+}
+function Dn(e, t = !1) {
+  const r = e.length;
+  let n = new Uint32Array(r), s = new Uint32Array(r);
+  for (let c = 0; c < r; c++) {
+    const { h: o, l: i } = Ar(e[c], t);
+    [n[c], s[c]] = [o, i];
+  }
+  return [n, s];
+}
+const rn = (e, t, r) => e >>> r, sn = (e, t, r) => e << 32 - r | t >>> r, Lt = (e, t, r) => e >>> r | t << 32 - r, Dt = (e, t, r) => e << 32 - r | t >>> r, ce = (e, t, r) => e << 64 - r | t >>> r - 32, oe = (e, t, r) => e >>> r - 32 | t << 64 - r, vr = (e, t, r) => e << r | t >>> 32 - r, Ir = (e, t, r) => t << r | e >>> 32 - r, Or = (e, t, r) => t << r - 32 | e >>> 64 - r, Nr = (e, t, r) => e << r - 32 | t >>> 64 - r;
+function lt(e, t, r, n) {
+  const s = (t >>> 0) + (n >>> 0);
+  return { h: e + r + (s / 2 ** 32 | 0) | 0, l: s | 0 };
+}
+const Tr = (e, t, r) => (e >>> 0) + (t >>> 0) + (r >>> 0), qr = (e, t, r, n) => t + r + n + (e / 2 ** 32 | 0) | 0, Rr = (e, t, r, n) => (e >>> 0) + (t >>> 0) + (r >>> 0) + (n >>> 0), Hr = (e, t, r, n, s) => t + r + n + s + (e / 2 ** 32 | 0) | 0, Gr = (e, t, r, n, s) => (e >>> 0) + (t >>> 0) + (r >>> 0) + (n >>> 0) + (s >>> 0), Ur = (e, t, r, n, s, c) => t + r + n + s + c + (e / 2 ** 32 | 0) | 0, Lr = /* @__PURE__ */ Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]), pt = /* @__PURE__ */ new Uint32Array(64);
+class kn extends Ln {
+  constructor(t = 32) {
+    super(64, t, 8, !1), this.A = gt[0] | 0, this.B = gt[1] | 0, this.C = gt[2] | 0, this.D = gt[3] | 0, this.E = gt[4] | 0, this.F = gt[5] | 0, this.G = gt[6] | 0, this.H = gt[7] | 0;
+  }
+  get() {
+    const { A: t, B: r, C: n, D: s, E: c, F: o, G: i, H: a } = this;
+    return [t, r, n, s, c, o, i, a];
+  }
+  // prettier-ignore
+  set(t, r, n, s, c, o, i, a) {
+    this.A = t | 0, this.B = r | 0, this.C = n | 0, this.D = s | 0, this.E = c | 0, this.F = o | 0, this.G = i | 0, this.H = a | 0;
+  }
+  process(t, r) {
+    for (let d = 0; d < 16; d++, r += 4)
+      pt[d] = t.getUint32(r, !1);
+    for (let d = 16; d < 64; d++) {
+      const f = pt[d - 15], h = pt[d - 2], m = ft(f, 7) ^ ft(f, 18) ^ f >>> 3, g = ft(h, 17) ^ ft(h, 19) ^ h >>> 10;
+      pt[d] = g + pt[d - 7] + m + pt[d - 16] | 0;
+    }
+    let { A: n, B: s, C: c, D: o, E: i, F: a, G: u, H: l } = this;
+    for (let d = 0; d < 64; d++) {
+      const f = ft(i, 6) ^ ft(i, 11) ^ ft(i, 25), h = l + f + _r(i, a, u) + Lr[d] + pt[d] | 0, g = (ft(n, 2) ^ ft(n, 13) ^ ft(n, 22)) + Sr(n, s, c) | 0;
+      l = u, u = a, a = i, i = o + h | 0, o = c, c = s, s = n, n = h + g | 0;
+    }
+    n = n + this.A | 0, s = s + this.B | 0, c = c + this.C | 0, o = o + this.D | 0, i = i + this.E | 0, a = a + this.F | 0, u = u + this.G | 0, l = l + this.H | 0, this.set(n, s, c, o, i, a, u, l);
+  }
+  roundClean() {
+    mt(pt);
+  }
+  destroy() {
+    this.set(0, 0, 0, 0, 0, 0, 0, 0), mt(this.buffer);
+  }
+}
+class Dr extends kn {
+  constructor() {
+    super(28), this.A = yt[0] | 0, this.B = yt[1] | 0, this.C = yt[2] | 0, this.D = yt[3] | 0, this.E = yt[4] | 0, this.F = yt[5] | 0, this.G = yt[6] | 0, this.H = yt[7] | 0;
+  }
+}
+const Pn = Dn([
+  "0x428a2f98d728ae22",
+  "0x7137449123ef65cd",
+  "0xb5c0fbcfec4d3b2f",
+  "0xe9b5dba58189dbbc",
+  "0x3956c25bf348b538",
+  "0x59f111f1b605d019",
+  "0x923f82a4af194f9b",
+  "0xab1c5ed5da6d8118",
+  "0xd807aa98a3030242",
+  "0x12835b0145706fbe",
+  "0x243185be4ee4b28c",
+  "0x550c7dc3d5ffb4e2",
+  "0x72be5d74f27b896f",
+  "0x80deb1fe3b1696b1",
+  "0x9bdc06a725c71235",
+  "0xc19bf174cf692694",
+  "0xe49b69c19ef14ad2",
+  "0xefbe4786384f25e3",
+  "0x0fc19dc68b8cd5b5",
+  "0x240ca1cc77ac9c65",
+  "0x2de92c6f592b0275",
+  "0x4a7484aa6ea6e483",
+  "0x5cb0a9dcbd41fbd4",
+  "0x76f988da831153b5",
+  "0x983e5152ee66dfab",
+  "0xa831c66d2db43210",
+  "0xb00327c898fb213f",
+  "0xbf597fc7beef0ee4",
+  "0xc6e00bf33da88fc2",
+  "0xd5a79147930aa725",
+  "0x06ca6351e003826f",
+  "0x142929670a0e6e70",
+  "0x27b70a8546d22ffc",
+  "0x2e1b21385c26c926",
+  "0x4d2c6dfc5ac42aed",
+  "0x53380d139d95b3df",
+  "0x650a73548baf63de",
+  "0x766a0abb3c77b2a8",
+  "0x81c2c92e47edaee6",
+  "0x92722c851482353b",
+  "0xa2bfe8a14cf10364",
+  "0xa81a664bbc423001",
+  "0xc24b8b70d0f89791",
+  "0xc76c51a30654be30",
+  "0xd192e819d6ef5218",
+  "0xd69906245565a910",
+  "0xf40e35855771202a",
+  "0x106aa07032bbd1b8",
+  "0x19a4c116b8d2d0c8",
+  "0x1e376c085141ab53",
+  "0x2748774cdf8eeb99",
+  "0x34b0bcb5e19b48a8",
+  "0x391c0cb3c5c95a63",
+  "0x4ed8aa4ae3418acb",
+  "0x5b9cca4f7763e373",
+  "0x682e6ff3d6b2b8a3",
+  "0x748f82ee5defb2fc",
+  "0x78a5636f43172f60",
+  "0x84c87814a1f0ab72",
+  "0x8cc702081a6439ec",
+  "0x90befffa23631e28",
+  "0xa4506cebde82bde9",
+  "0xbef9a3f7b2c67915",
+  "0xc67178f2e372532b",
+  "0xca273eceea26619c",
+  "0xd186b8c721c0c207",
+  "0xeada7dd6cde0eb1e",
+  "0xf57d4f7fee6ed178",
+  "0x06f067aa72176fba",
+  "0x0a637dc5a2c898a6",
+  "0x113f9804bef90dae",
+  "0x1b710b35131c471b",
+  "0x28db77f523047d84",
+  "0x32caab7b40c72493",
+  "0x3c9ebe0a15c9bebc",
+  "0x431d67c49c100d4c",
+  "0x4cc5d4becb3e42b6",
+  "0x597f299cfc657e2a",
+  "0x5fcb6fab3ad6faec",
+  "0x6c44198c4a475817"
+].map((e) => BigInt(e))), kr = Pn[0], Pr = Pn[1], wt = /* @__PURE__ */ new Uint32Array(80), xt = /* @__PURE__ */ new Uint32Array(80);
+class Mr extends Ln {
+  constructor(t = 64) {
+    super(128, t, 16, !1), this.Ah = $[0] | 0, this.Al = $[1] | 0, this.Bh = $[2] | 0, this.Bl = $[3] | 0, this.Ch = $[4] | 0, this.Cl = $[5] | 0, this.Dh = $[6] | 0, this.Dl = $[7] | 0, this.Eh = $[8] | 0, this.El = $[9] | 0, this.Fh = $[10] | 0, this.Fl = $[11] | 0, this.Gh = $[12] | 0, this.Gl = $[13] | 0, this.Hh = $[14] | 0, this.Hl = $[15] | 0;
+  }
+  // prettier-ignore
+  get() {
+    const { Ah: t, Al: r, Bh: n, Bl: s, Ch: c, Cl: o, Dh: i, Dl: a, Eh: u, El: l, Fh: d, Fl: f, Gh: h, Gl: m, Hh: g, Hl: y } = this;
+    return [t, r, n, s, c, o, i, a, u, l, d, f, h, m, g, y];
+  }
+  // prettier-ignore
+  set(t, r, n, s, c, o, i, a, u, l, d, f, h, m, g, y) {
+    this.Ah = t | 0, this.Al = r | 0, this.Bh = n | 0, this.Bl = s | 0, this.Ch = c | 0, this.Cl = o | 0, this.Dh = i | 0, this.Dl = a | 0, this.Eh = u | 0, this.El = l | 0, this.Fh = d | 0, this.Fl = f | 0, this.Gh = h | 0, this.Gl = m | 0, this.Hh = g | 0, this.Hl = y | 0;
+  }
+  process(t, r) {
+    for (let p = 0; p < 16; p++, r += 4)
+      wt[p] = t.getUint32(r), xt[p] = t.getUint32(r += 4);
+    for (let p = 16; p < 80; p++) {
+      const E = wt[p - 15] | 0, _ = xt[p - 15] | 0, O = Lt(E, _, 1) ^ Lt(E, _, 8) ^ rn(E, _, 7), N = Dt(E, _, 1) ^ Dt(E, _, 8) ^ sn(E, _, 7), H = wt[p - 2] | 0, B = xt[p - 2] | 0, Z = Lt(H, B, 19) ^ ce(H, B, 61) ^ rn(H, B, 6), F = Dt(H, B, 19) ^ oe(H, B, 61) ^ sn(H, B, 6), q = Rr(N, F, xt[p - 7], xt[p - 16]), b = Hr(q, O, Z, wt[p - 7], wt[p - 16]);
+      wt[p] = b | 0, xt[p] = q | 0;
+    }
+    let { Ah: n, Al: s, Bh: c, Bl: o, Ch: i, Cl: a, Dh: u, Dl: l, Eh: d, El: f, Fh: h, Fl: m, Gh: g, Gl: y, Hh: T, Hl: R } = this;
+    for (let p = 0; p < 80; p++) {
+      const E = Lt(d, f, 14) ^ Lt(d, f, 18) ^ ce(d, f, 41), _ = Dt(d, f, 14) ^ Dt(d, f, 18) ^ oe(d, f, 41), O = d & h ^ ~d & g, N = f & m ^ ~f & y, H = Gr(R, _, N, Pr[p], xt[p]), B = Ur(H, T, E, O, kr[p], wt[p]), Z = H | 0, F = Lt(n, s, 28) ^ ce(n, s, 34) ^ ce(n, s, 39), q = Dt(n, s, 28) ^ oe(n, s, 34) ^ oe(n, s, 39), b = n & c ^ n & i ^ c & i, w = s & o ^ s & a ^ o & a;
+      T = g | 0, R = y | 0, g = h | 0, y = m | 0, h = d | 0, m = f | 0, { h: d, l: f } = lt(u | 0, l | 0, B | 0, Z | 0), u = i | 0, l = a | 0, i = c | 0, a = o | 0, c = n | 0, o = s | 0;
+      const I = Tr(Z, q, w);
+      n = qr(I, B, F, b), s = I | 0;
+    }
+    ({ h: n, l: s } = lt(this.Ah | 0, this.Al | 0, n | 0, s | 0)), { h: c, l: o } = lt(this.Bh | 0, this.Bl | 0, c | 0, o | 0), { h: i, l: a } = lt(this.Ch | 0, this.Cl | 0, i | 0, a | 0), { h: u, l } = lt(this.Dh | 0, this.Dl | 0, u | 0, l | 0), { h: d, l: f } = lt(this.Eh | 0, this.El | 0, d | 0, f | 0), { h, l: m } = lt(this.Fh | 0, this.Fl | 0, h | 0, m | 0), { h: g, l: y } = lt(this.Gh | 0, this.Gl | 0, g | 0, y | 0), { h: T, l: R } = lt(this.Hh | 0, this.Hl | 0, T | 0, R | 0), this.set(n, s, c, o, i, a, u, l, d, f, h, m, g, y, T, R);
+  }
+  roundClean() {
+    mt(wt, xt);
+  }
+  destroy() {
+    mt(this.buffer), this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+  }
+}
+const Mn = /* @__PURE__ */ Ye(() => new kn()), nc = /* @__PURE__ */ Ye(() => new Dr()), rc = /* @__PURE__ */ Ye(() => new Mr());
+const Ve = /* @__PURE__ */ BigInt(0), de = /* @__PURE__ */ BigInt(1);
+function cn(e, t = "") {
+  if (typeof e != "boolean") {
+    const r = t && `"${t}"`;
+    throw new Error(r + "expected boolean, got type=" + typeof e);
+  }
+  return e;
+}
+function on(e, t, r = "") {
+  const n = ge(e), s = e?.length, c = t !== void 0;
+  if (!n || c && s !== t) {
+    const o = r && `"${r}" `, i = c ? ` of length ${t}` : "", a = n ? `length=${s}` : `type=${typeof e}`;
+    throw new Error(o + "expected Uint8Array" + i + ", got " + a);
+  }
+  return e;
+}
+function Zn(e) {
+  if (typeof e != "string")
+    throw new Error("hex string expected, got " + typeof e);
+  return e === "" ? Ve : BigInt("0x" + e);
+}
+function dt(e) {
+  return Zn(Xt(e));
+}
+function Kn(e) {
+  return J(e), Zn(Xt(Uint8Array.from(e).reverse()));
+}
+function V(e, t) {
+  return Un(e.toString(16).padStart(t * 2, "0"));
+}
+function Fn(e, t) {
+  return V(e, t).reverse();
+}
+function Ft(e, t, r) {
+  let n;
+  if (typeof t == "string")
+    try {
+      n = Un(t);
+    } catch (c) {
+      throw new Error(e + " must be hex string or Uint8Array, cause: " + c);
+    }
+  else if (ge(t))
+    n = Uint8Array.from(t);
+  else
+    throw new Error(e + " must be hex string or Uint8Array");
+  const s = n.length;
+  if (typeof r == "number" && s !== r)
+    throw new Error(e + " of length " + r + " expected, got " + s);
+  return n;
+}
+function sc(e) {
+  return Uint8Array.from(e);
+}
+const _e = (e) => typeof e == "bigint" && Ve <= e;
+function Cn(e, t, r) {
+  return _e(e) && _e(t) && _e(r) && t <= e && e < r;
+}
+function cc(e, t, r, n) {
+  if (!Cn(t, r, n))
+    throw new Error("expected valid " + e + ": " + r + " <= n < " + n + ", got " + t);
+}
+function Wt(e) {
+  let t;
+  for (t = 0; e > Ve; e >>= de, t += 1)
+    ;
+  return t;
+}
+function Zr(e, t) {
+  return e >> BigInt(t) & de;
+}
+const Rt = (e) => (de << BigInt(e)) - de;
+function Kr(e) {
+  return typeof e == "function" && Number.isSafeInteger(e.outputLen);
+}
+function ze(e, t, r = {}) {
+  if (!e || typeof e != "object")
+    throw new Error("expected valid options object");
+  function n(s, c, o) {
+    const i = e[s];
+    if (o && i === void 0)
+      return;
+    const a = typeof i;
+    if (a !== c || i === null)
+      throw new Error(`param "${s}" is invalid: expected ${c}, got ${a}`);
+  }
+  Object.entries(t).forEach(([s, c]) => n(s, c, !1)), Object.entries(r).forEach(([s, c]) => n(s, c, !0));
+}
+const Yn = () => {
+  throw new Error("not implemented");
+};
+function Ue(e) {
+  const t = /* @__PURE__ */ new WeakMap();
+  return (r, ...n) => {
+    const s = t.get(r);
+    if (s !== void 0)
+      return s;
+    const c = e(r, ...n);
+    return t.set(r, c), c;
+  };
+}
+const et = BigInt(0), z = BigInt(1), vt = /* @__PURE__ */ BigInt(2), Vn = /* @__PURE__ */ BigInt(3), zn = /* @__PURE__ */ BigInt(4), $n = /* @__PURE__ */ BigInt(5), Fr = /* @__PURE__ */ BigInt(7), jn = /* @__PURE__ */ BigInt(8), Cr = /* @__PURE__ */ BigInt(9), Xn = /* @__PURE__ */ BigInt(16);
+function nt(e, t) {
+  const r = e % t;
+  return r >= et ? r : t + r;
+}
+function oc(e, t, r) {
+  let n = e;
+  for (; t-- > et; )
+    n *= n, n %= r;
+  return n;
+}
+function an(e, t) {
+  if (e === et)
+    throw new Error("invert: expected non-zero number");
+  if (t <= et)
+    throw new Error("invert: expected positive modulus, got " + t);
+  let r = nt(e, t), n = t, s = et, c = z;
+  for (; r !== et; ) {
+    const i = n / r, a = n % r, u = s - c * i;
+    n = r, r = a, s = c, c = u;
+  }
+  if (n !== z)
+    throw new Error("invert: does not exist");
+  return nt(s, t);
+}
+function $e(e, t, r) {
+  if (!e.eql(e.sqr(t), r))
+    throw new Error("Cannot find square root");
+}
+function Wn(e, t) {
+  const r = (e.ORDER + z) / zn, n = e.pow(t, r);
+  return $e(e, n, t), n;
+}
+function Yr(e, t) {
+  const r = (e.ORDER - $n) / jn, n = e.mul(t, vt), s = e.pow(n, r), c = e.mul(t, s), o = e.mul(e.mul(c, vt), s), i = e.mul(c, e.sub(o, e.ONE));
+  return $e(e, i, t), i;
+}
+function Vr(e) {
+  const t = Yt(e), r = Qn(e), n = r(t, t.neg(t.ONE)), s = r(t, n), c = r(t, t.neg(n)), o = (e + Fr) / Xn;
+  return (i, a) => {
+    let u = i.pow(a, o), l = i.mul(u, n);
+    const d = i.mul(u, s), f = i.mul(u, c), h = i.eql(i.sqr(l), a), m = i.eql(i.sqr(d), a);
+    u = i.cmov(u, l, h), l = i.cmov(f, d, m);
+    const g = i.eql(i.sqr(l), a), y = i.cmov(u, l, g);
+    return $e(i, y, a), y;
+  };
+}
+function Qn(e) {
+  if (e < Vn)
+    throw new Error("sqrt is not defined for small field");
+  let t = e - z, r = 0;
+  for (; t % vt === et; )
+    t /= vt, r++;
+  let n = vt;
+  const s = Yt(e);
+  for (; ue(s, n) === 1; )
+    if (n++ > 1e3)
+      throw new Error("Cannot find square root: probably non-prime P");
+  if (r === 1)
+    return Wn;
+  let c = s.pow(n, t);
+  const o = (t + z) / vt;
+  return function(a, u) {
+    if (a.is0(u))
+      return u;
+    if (ue(a, u) !== 1)
+      throw new Error("Cannot find square root");
+    let l = r, d = a.mul(a.ONE, c), f = a.pow(u, t), h = a.pow(u, o);
+    for (; !a.eql(f, a.ONE); ) {
+      if (a.is0(f))
+        return a.ZERO;
+      let m = 1, g = a.sqr(f);
+      for (; !a.eql(g, a.ONE); )
+        if (m++, g = a.sqr(g), m === l)
+          throw new Error("Cannot find square root");
+      const y = z << BigInt(l - m - 1), T = a.pow(d, y);
+      l = m, d = a.sqr(T), f = a.mul(f, d), h = a.mul(h, T);
+    }
+    return h;
+  };
+}
+function zr(e) {
+  return e % zn === Vn ? Wn : e % jn === $n ? Yr : e % Xn === Cr ? Vr(e) : Qn(e);
+}
+const ic = (e, t) => (nt(e, t) & z) === z, $r = [
+  "create",
+  "isValid",
+  "is0",
+  "neg",
+  "inv",
+  "sqrt",
+  "sqr",
+  "eql",
+  "add",
+  "sub",
+  "mul",
+  "pow",
+  "div",
+  "addN",
+  "subN",
+  "mulN",
+  "sqrN"
+];
+function Jn(e) {
+  const t = {
+    ORDER: "bigint",
+    MASK: "bigint",
+    BYTES: "number",
+    BITS: "number"
+  }, r = $r.reduce((n, s) => (n[s] = "function", n), t);
+  return ze(e, r), e;
+}
+function ye(e, t, r) {
+  if (r < et)
+    throw new Error("invalid exponent, negatives unsupported");
+  if (r === et)
+    return e.ONE;
+  if (r === z)
+    return t;
+  let n = e.ONE, s = t;
+  for (; r > et; )
+    r & z && (n = e.mul(n, s)), s = e.sqr(s), r >>= z;
+  return n;
+}
+function Ht(e, t, r = !1) {
+  const n = new Array(t.length).fill(r ? e.ZERO : void 0), s = t.reduce((o, i, a) => e.is0(i) ? o : (n[a] = o, e.mul(o, i)), e.ONE), c = e.inv(s);
+  return t.reduceRight((o, i, a) => e.is0(i) ? o : (n[a] = e.mul(o, n[a]), e.mul(o, i)), c), n;
+}
+function ue(e, t) {
+  const r = (e.ORDER - z) / vt, n = e.pow(t, r), s = e.eql(n, e.ONE), c = e.eql(n, e.ZERO), o = e.eql(n, e.neg(e.ONE));
+  if (!s && !c && !o)
+    throw new Error("invalid Legendre symbol result");
+  return s ? 1 : c ? 0 : -1;
+}
+function jr(e, t) {
+  t !== void 0 && Zt(t);
+  const r = t !== void 0 ? t : e.toString(2).length, n = Math.ceil(r / 8);
+  return { nBitLength: r, nByteLength: n };
+}
+function Yt(e, t, r = !1, n = {}) {
+  if (e <= et)
+    throw new Error("invalid field: expected ORDER > 0, got " + e);
+  let s, c, o = !1, i;
+  if (typeof t == "object" && t != null) {
+    if (n.sqrt || r)
+      throw new Error("cannot specify opts in two arguments");
+    const f = t;
+    f.BITS && (s = f.BITS), f.sqrt && (c = f.sqrt), typeof f.isLE == "boolean" && (r = f.isLE), typeof f.modFromBytes == "boolean" && (o = f.modFromBytes), i = f.allowedLengths;
+  } else
+    typeof t == "number" && (s = t), n.sqrt && (c = n.sqrt);
+  const { nBitLength: a, nByteLength: u } = jr(e, s);
+  if (u > 2048)
+    throw new Error("invalid field: expected ORDER of <= 2048 bytes");
+  let l;
+  const d = Object.freeze({
+    ORDER: e,
+    isLE: r,
+    BITS: a,
+    BYTES: u,
+    MASK: Rt(a),
+    ZERO: et,
+    ONE: z,
+    allowedLengths: i,
+    create: (f) => nt(f, e),
+    isValid: (f) => {
+      if (typeof f != "bigint")
+        throw new Error("invalid field element: expected bigint, got " + typeof f);
+      return et <= f && f < e;
+    },
+    is0: (f) => f === et,
+    // is valid and invertible
+    isValidNot0: (f) => !d.is0(f) && d.isValid(f),
+    isOdd: (f) => (f & z) === z,
+    neg: (f) => nt(-f, e),
+    eql: (f, h) => f === h,
+    sqr: (f) => nt(f * f, e),
+    add: (f, h) => nt(f + h, e),
+    sub: (f, h) => nt(f - h, e),
+    mul: (f, h) => nt(f * h, e),
+    pow: (f, h) => ye(d, f, h),
+    div: (f, h) => nt(f * an(h, e), e),
+    // Same as above, but doesn't normalize
+    sqrN: (f) => f * f,
+    addN: (f, h) => f + h,
+    subN: (f, h) => f - h,
+    mulN: (f, h) => f * h,
+    inv: (f) => an(f, e),
+    sqrt: c || ((f) => (l || (l = zr(e)), l(d, f))),
+    toBytes: (f) => r ? Fn(f, u) : V(f, u),
+    fromBytes: (f, h = !0) => {
+      if (i) {
+        if (!i.includes(f.length) || f.length > u)
+          throw new Error("Field.fromBytes: expected " + i + " bytes, got " + f.length);
+        const g = new Uint8Array(u);
+        g.set(f, r ? 0 : g.length - f.length), f = g;
+      }
+      if (f.length !== u)
+        throw new Error("Field.fromBytes: expected " + u + " bytes, got " + f.length);
+      let m = r ? Kn(f) : dt(f);
+      if (o && (m = nt(m, e)), !h && !d.isValid(m))
+        throw new Error("invalid field element: outside of range 0..ORDER");
+      return m;
+    },
+    // TODO: we don't need it here, move out to separate fn
+    invertBatch: (f) => Ht(d, f),
+    // We can't move this out because Fp6, Fp12 implement it
+    // and it's unclear what to return in there.
+    cmov: (f, h, m) => m ? h : f
+  });
+  return Object.freeze(d);
+}
+function tr(e) {
+  if (typeof e != "bigint")
+    throw new Error("field order must be bigint");
+  const t = e.toString(2).length;
+  return Math.ceil(t / 8);
+}
+function er(e) {
+  const t = tr(e);
+  return t + Math.ceil(t / 2);
+}
+function Xr(e, t, r = !1) {
+  const n = e.length, s = tr(t), c = er(t);
+  if (n < 16 || n < c || n > 1024)
+    throw new Error("expected " + c + "-1024 bytes of input, got " + n);
+  const o = r ? Kn(e) : dt(e), i = nt(o, t - z) + z;
+  return r ? Fn(i, s) : V(i, s);
+}
+const Ct = BigInt(0), It = BigInt(1);
+function le(e, t) {
+  const r = t.negate();
+  return e ? r : t;
+}
+function jt(e, t) {
+  const r = Ht(e.Fp, t.map((n) => n.Z));
+  return t.map((n, s) => e.fromAffine(n.toAffine(r[s])));
+}
+function nr(e, t) {
+  if (!Number.isSafeInteger(e) || e <= 0 || e > t)
+    throw new Error("invalid window size, expected [1.." + t + "], got W=" + e);
+}
+function Se(e, t) {
+  nr(e, t);
+  const r = Math.ceil(t / e) + 1, n = 2 ** (e - 1), s = 2 ** e, c = Rt(e), o = BigInt(e);
+  return { windows: r, windowSize: n, mask: c, maxNumber: s, shiftBy: o };
+}
+function fn(e, t, r) {
+  const { windowSize: n, mask: s, maxNumber: c, shiftBy: o } = r;
+  let i = Number(e & s), a = e >> o;
+  i > n && (i -= c, a += It);
+  const u = t * n, l = u + Math.abs(i) - 1, d = i === 0, f = i < 0, h = t % 2 !== 0;
+  return { nextN: a, offset: l, isZero: d, isNeg: f, isNegF: h, offsetF: u };
+}
+function Wr(e, t) {
+  if (!Array.isArray(e))
+    throw new Error("array expected");
+  e.forEach((r, n) => {
+    if (!(r instanceof t))
+      throw new Error("invalid point at index " + n);
+  });
+}
+function Qr(e, t) {
+  if (!Array.isArray(e))
+    throw new Error("array of scalars expected");
+  e.forEach((r, n) => {
+    if (!t.isValid(r))
+      throw new Error("invalid scalar at index " + n);
+  });
+}
+const Ae = /* @__PURE__ */ new WeakMap(), rr = /* @__PURE__ */ new WeakMap();
+function ve(e) {
+  return rr.get(e) || 1;
+}
+function dn(e) {
+  if (e !== Ct)
+    throw new Error("invalid wNAF");
+}
+class Jr {
+  // Parametrized with a given Point class (not individual point)
+  constructor(t, r) {
+    this.BASE = t.BASE, this.ZERO = t.ZERO, this.Fn = t.Fn, this.bits = r;
+  }
+  // non-const time multiplication ladder
+  _unsafeLadder(t, r, n = this.ZERO) {
+    let s = t;
+    for (; r > Ct; )
+      r & It && (n = n.add(s)), s = s.double(), r >>= It;
+    return n;
+  }
+  /**
+   * Creates a wNAF precomputation window. Used for caching.
+   * Default window size is set by `utils.precompute()` and is equal to 8.
+   * Number of precomputed points depends on the curve size:
+   * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+   * - 𝑊 is the window size
+   * - 𝑛 is the bitlength of the curve order.
+   * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+   * @param point Point instance
+   * @param W window size
+   * @returns precomputed point tables flattened to a single array
+   */
+  precomputeWindow(t, r) {
+    const { windows: n, windowSize: s } = Se(r, this.bits), c = [];
+    let o = t, i = o;
+    for (let a = 0; a < n; a++) {
+      i = o, c.push(i);
+      for (let u = 1; u < s; u++)
+        i = i.add(o), c.push(i);
+      o = i.double();
+    }
+    return c;
+  }
+  /**
+   * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
+   * More compact implementation:
+   * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541
+   * @returns real and fake (for const-time) points
+   */
+  wNAF(t, r, n) {
+    if (!this.Fn.isValid(n))
+      throw new Error("invalid scalar");
+    let s = this.ZERO, c = this.BASE;
+    const o = Se(t, this.bits);
+    for (let i = 0; i < o.windows; i++) {
+      const { nextN: a, offset: u, isZero: l, isNeg: d, isNegF: f, offsetF: h } = fn(n, i, o);
+      n = a, l ? c = c.add(le(f, r[h])) : s = s.add(le(d, r[u]));
+    }
+    return dn(n), { p: s, f: c };
+  }
+  /**
+   * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.
+   * @param acc accumulator point to add result of multiplication
+   * @returns point
+   */
+  wNAFUnsafe(t, r, n, s = this.ZERO) {
+    const c = Se(t, this.bits);
+    for (let o = 0; o < c.windows && n !== Ct; o++) {
+      const { nextN: i, offset: a, isZero: u, isNeg: l } = fn(n, o, c);
+      if (n = i, !u) {
+        const d = r[a];
+        s = s.add(l ? d.negate() : d);
+      }
+    }
+    return dn(n), s;
+  }
+  getPrecomputes(t, r, n) {
+    let s = Ae.get(r);
+    return s || (s = this.precomputeWindow(r, t), t !== 1 && (typeof n == "function" && (s = n(s)), Ae.set(r, s))), s;
+  }
+  cached(t, r, n) {
+    const s = ve(t);
+    return this.wNAF(s, this.getPrecomputes(s, t, n), r);
+  }
+  unsafe(t, r, n, s) {
+    const c = ve(t);
+    return c === 1 ? this._unsafeLadder(t, r, s) : this.wNAFUnsafe(c, this.getPrecomputes(c, t, n), r, s);
+  }
+  // We calculate precomputes for elliptic curve point multiplication
+  // using windowed method. This specifies window size and
+  // stores precomputed values. Usually only base point would be precomputed.
+  createCache(t, r) {
+    nr(r, this.bits), rr.set(t, r), Ae.delete(t);
+  }
+  hasCache(t) {
+    return ve(t) !== 1;
+  }
+}
+function ts(e, t, r, n) {
+  let s = t, c = e.ZERO, o = e.ZERO;
+  for (; r > Ct || n > Ct; )
+    r & It && (c = c.add(s)), n & It && (o = o.add(s)), s = s.double(), r >>= It, n >>= It;
+  return { p1: c, p2: o };
+}
+function es(e, t, r, n) {
+  Wr(r, e), Qr(n, t);
+  const s = r.length, c = n.length;
+  if (s !== c)
+    throw new Error("arrays of points and scalars must have equal length");
+  const o = e.ZERO, i = Wt(BigInt(s));
+  let a = 1;
+  i > 12 ? a = i - 3 : i > 4 ? a = i - 2 : i > 0 && (a = 2);
+  const u = Rt(a), l = new Array(Number(u) + 1).fill(o), d = Math.floor((t.BITS - 1) / a) * a;
+  let f = o;
+  for (let h = d; h >= 0; h -= a) {
+    l.fill(o);
+    for (let g = 0; g < c; g++) {
+      const y = n[g], T = Number(y >> BigInt(h) & u);
+      l[T] = l[T].add(r[g]);
+    }
+    let m = o;
+    for (let g = l.length - 1, y = o; g > 0; g--)
+      y = y.add(l[g]), m = m.add(y);
+    if (f = f.add(m), h !== 0)
+      for (let g = 0; g < a; g++)
+        f = f.double();
+  }
+  return f;
+}
+function un(e, t, r) {
+  if (t) {
+    if (t.ORDER !== e)
+      throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
+    return Jn(t), t;
+  } else
+    return Yt(e, { isLE: r });
+}
+function ns(e, t, r = {}, n) {
+  if (n === void 0 && (n = e === "edwards"), !t || typeof t != "object")
+    throw new Error(`expected valid ${e} CURVE object`);
+  for (const a of ["p", "n", "h"]) {
+    const u = t[a];
+    if (!(typeof u == "bigint" && u > Ct))
+      throw new Error(`CURVE.${a} must be positive bigint`);
+  }
+  const s = un(t.p, r.Fp, n), c = un(t.n, r.Fn, n), i = ["Gx", "Gy", "a", e === "weierstrass" ? "b" : "d"];
+  for (const a of i)
+    if (!s.isValid(t[a]))
+      throw new Error(`CURVE.${a} must be valid field element of CURVE.Fp`);
+  return t = Object.freeze(Object.assign({}, t)), { CURVE: t, Fp: s, Fn: c };
+}
+const rs = dt;
+function Bt(e, t) {
+  if (Qt(e), Qt(t), e < 0 || e >= 1 << 8 * t)
+    throw new Error("invalid I2OSP input: " + e);
+  const r = Array.from({ length: t }).fill(0);
+  for (let n = t - 1; n >= 0; n--)
+    r[n] = e & 255, e >>>= 8;
+  return new Uint8Array(r);
+}
+function ss(e, t) {
+  const r = new Uint8Array(e.length);
+  for (let n = 0; n < e.length; n++)
+    r[n] = e[n] ^ t[n];
+  return r;
+}
+function Qt(e) {
+  if (!Number.isSafeInteger(e))
+    throw new Error("number expected");
+}
+function sr(e) {
+  if (!ge(e) && typeof e != "string")
+    throw new Error("DST must be Uint8Array or string");
+  return typeof e == "string" ? ee(e) : e;
+}
+function cs(e, t, r, n) {
+  J(e), Qt(r), t = sr(t), t.length > 255 && (t = n(C(ee("H2C-OVERSIZE-DST-"), t)));
+  const { outputLen: s, blockLen: c } = n, o = Math.ceil(r / s);
+  if (r > 65535 || o > 255)
+    throw new Error("expand_message_xmd: invalid lenInBytes");
+  const i = C(t, Bt(t.length, 1)), a = Bt(0, c), u = Bt(r, 2), l = new Array(o), d = n(C(a, e, u, Bt(0, 1), i));
+  l[0] = n(C(d, Bt(1, 1), i));
+  for (let h = 1; h <= o; h++) {
+    const m = [ss(d, l[h - 1]), Bt(h + 1, 1), i];
+    l[h] = n(C(...m));
+  }
+  return C(...l).slice(0, r);
+}
+function os(e, t, r, n, s) {
+  if (J(e), Qt(r), t = sr(t), t.length > 255) {
+    const c = Math.ceil(2 * n / 8);
+    t = s.create({ dkLen: c }).update(ee("H2C-OVERSIZE-DST-")).update(t).digest();
+  }
+  if (r > 65535 || t.length > 255)
+    throw new Error("expand_message_xof: invalid lenInBytes");
+  return s.create({ dkLen: r }).update(e).update(Bt(r, 2)).update(t).update(Bt(t.length, 1)).digest();
+}
+function Ie(e, t, r) {
+  ze(r, {
+    p: "bigint",
+    m: "number",
+    k: "number",
+    hash: "function"
+  });
+  const { p: n, k: s, m: c, hash: o, expand: i, DST: a } = r;
+  if (!Kr(r.hash))
+    throw new Error("expected valid hash");
+  J(e), Qt(t);
+  const u = n.toString(2).length, l = Math.ceil((u + s) / 8), d = t * c * l;
+  let f;
+  if (i === "xmd")
+    f = cs(e, a, d, o);
+  else if (i === "xof")
+    f = os(e, a, d, s, o);
+  else if (i === "_internal_pass")
+    f = e;
+  else
+    throw new Error('expand must be "xmd" or "xof"');
+  const h = new Array(t);
+  for (let m = 0; m < t; m++) {
+    const g = new Array(c);
+    for (let y = 0; y < c; y++) {
+      const T = l * (y + m * c), R = f.subarray(T, T + l);
+      g[y] = nt(rs(R), n);
+    }
+    h[m] = g;
+  }
+  return h;
+}
+function cr(e, t) {
+  const r = t.map((n) => Array.from(n).reverse());
+  return (n, s) => {
+    const [c, o, i, a] = r.map((d) => d.reduce((f, h) => e.add(e.mul(f, n), h))), [u, l] = Ht(e, [o, a], !0);
+    return n = e.mul(c, u), s = e.mul(s, e.mul(i, l)), { x: n, y: s };
+  };
+}
+const is = ee("HashToScalar-");
+function ln(e, t, r) {
+  if (typeof t != "function")
+    throw new Error("mapToCurve() must be defined");
+  function n(c) {
+    return e.fromAffine(t(c));
+  }
+  function s(c) {
+    const o = c.clearCofactor();
+    return o.equals(e.ZERO) ? e.ZERO : (o.assertValidity(), o);
+  }
+  return {
+    defaults: r,
+    hashToCurve(c, o) {
+      const i = Object.assign({}, r, o), a = Ie(c, 2, i), u = n(a[0]), l = n(a[1]);
+      return s(u.add(l));
+    },
+    encodeToCurve(c, o) {
+      const i = r.encodeDST ? { DST: r.encodeDST } : {}, a = Object.assign({}, r, i, o), u = Ie(c, 1, a), l = n(u[0]);
+      return s(l);
+    },
+    /** See {@link H2CHasher} */
+    mapToCurve(c) {
+      if (!Array.isArray(c))
+        throw new Error("expected array of bigints");
+      for (const o of c)
+        if (typeof o != "bigint")
+          throw new Error("expected array of bigints");
+      return s(n(c));
+    },
+    // hash_to_scalar can produce 0: https://www.rfc-editor.org/errata/eid8393
+    // RFC 9380, draft-irtf-cfrg-bbs-signatures-08
+    hashToScalar(c, o) {
+      const i = e.Fn.ORDER, a = Object.assign({}, r, { p: i, m: 1, DST: is }, o);
+      return Ie(c, 1, a)[0][0];
+    }
+  };
+}
+class or extends Ce {
+  constructor(t, r) {
+    super(), this.finished = !1, this.destroyed = !1, Fe(t);
+    const n = Tt(r);
+    if (this.iHash = t.create(), typeof this.iHash.update != "function")
+      throw new Error("Expected instance of class which extends utils.Hash");
+    this.blockLen = this.iHash.blockLen, this.outputLen = this.iHash.outputLen;
+    const s = this.blockLen, c = new Uint8Array(s);
+    c.set(n.length > s ? t.create().update(n).digest() : n);
+    for (let o = 0; o < c.length; o++)
+      c[o] ^= 54;
+    this.iHash.update(c), this.oHash = t.create();
+    for (let o = 0; o < c.length; o++)
+      c[o] ^= 106;
+    this.oHash.update(c), mt(c);
+  }
+  update(t) {
+    return Kt(this), this.iHash.update(t), this;
+  }
+  digestInto(t) {
+    Kt(this), J(t, this.outputLen), this.finished = !0, this.iHash.digestInto(t), this.oHash.update(t), this.oHash.digestInto(t), this.destroy();
+  }
+  digest() {
+    const t = new Uint8Array(this.oHash.outputLen);
+    return this.digestInto(t), t;
+  }
+  _cloneInto(t) {
+    t || (t = Object.create(Object.getPrototypeOf(this), {}));
+    const { oHash: r, iHash: n, finished: s, destroyed: c, blockLen: o, outputLen: i } = this;
+    return t = t, t.finished = s, t.destroyed = c, t.blockLen = o, t.outputLen = i, t.oHash = r._cloneInto(t.oHash), t.iHash = n._cloneInto(t.iHash), t;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  destroy() {
+    this.destroyed = !0, this.oHash.destroy(), this.iHash.destroy();
+  }
+}
+const je = (e, t, r) => new or(e, t).update(r).digest();
+je.create = (e, t) => new or(e, t);
+const hn = (e, t) => (e + (e >= 0 ? t : -t) / ht) / t;
+function as(e, t, r) {
+  const [[n, s], [c, o]] = t, i = hn(o * e, r), a = hn(-s * e, r);
+  let u = e - i * n - a * c, l = -i * s - a * o;
+  const d = u < Ot, f = l < Ot;
+  d && (u = -u), f && (l = -l);
+  const h = Rt(Math.ceil(Wt(r) / 2)) + W;
+  if (u < Ot || u >= h || l < Ot || l >= h)
+    throw new Error("splitScalar (endomorphism): failed, k=" + e);
+  return { k1neg: d, k1: u, k2neg: f, k2: l };
+}
+const Ot = BigInt(0), W = BigInt(1), ht = BigInt(2), Pt = BigInt(3), Le = BigInt(4);
+function he(e, t) {
+  const { BYTES: r } = e;
+  let n;
+  if (typeof t == "bigint")
+    n = t;
+  else {
+    let s = Ft("private key", t);
+    try {
+      n = e.fromBytes(s);
+    } catch {
+      throw new Error(`invalid private key: expected ui8a of size ${r}, got ${typeof t}`);
+    }
+  }
+  if (!e.isValidNot0(n))
+    throw new Error("invalid private key: out of range [1..N-1]");
+  return n;
+}
+function fs(e, t = {}) {
+  const r = ns("weierstrass", e, t), { Fp: n, Fn: s } = r;
+  let c = r.CURVE;
+  const { h: o, n: i } = c;
+  ze(t, {}, {
+    allowInfinityPoint: "boolean",
+    clearCofactor: "function",
+    isTorsionFree: "function",
+    fromBytes: "function",
+    toBytes: "function",
+    endo: "object",
+    wrapPrivateKey: "boolean"
+  });
+  const { endo: a } = t;
+  if (a && (!n.is0(c.a) || typeof a.beta != "bigint" || !Array.isArray(a.basises)))
+    throw new Error('invalid endo: expected "beta": bigint and "basises": array');
+  const u = ls(n, s);
+  function l() {
+    if (!n.isOdd)
+      throw new Error("compression is not supported: Field does not have .isOdd()");
+  }
+  function d(q, b, w) {
+    const { x: I, y: L } = b.toAffine(), M = n.toBytes(I);
+    if (cn(w, "isCompressed"), w) {
+      l();
+      const x = !n.isOdd(L);
+      return C(ds(x), M);
+    } else
+      return C(Uint8Array.of(4), M, n.toBytes(L));
+  }
+  function f(q) {
+    on(q, void 0, "Point");
+    const { publicKey: b, publicKeyUncompressed: w } = u, I = q.length, L = q[0], M = q.subarray(1);
+    if (I === b && (L === 2 || L === 3)) {
+      const x = n.fromBytes(M);
+      if (!n.isValid(x))
+        throw new Error("bad point: is not on curve, wrong x");
+      const S = g(x);
+      let v;
+      try {
+        v = n.sqrt(S);
+      } catch (tt) {
+        const Y = tt instanceof Error ? ": " + tt.message : "";
+        throw new Error("bad point: is not on curve, sqrt error" + Y);
+      }
+      l();
+      const G = n.isOdd(v);
+      return (L & 1) === 1 !== G && (v = n.neg(v)), { x, y: v };
+    } else if (I === w && L === 4) {
+      const x = n.BYTES, S = n.fromBytes(M.subarray(0, x)), v = n.fromBytes(M.subarray(x, x * 2));
+      if (!y(S, v))
+        throw new Error("bad point: is not on curve");
+      return { x: S, y: v };
+    } else
+      throw new Error(`bad point: got length ${I}, expected compressed=${b} or uncompressed=${w}`);
+  }
+  const h = t.toBytes || d, m = t.fromBytes || f;
+  function g(q) {
+    const b = n.sqr(q), w = n.mul(b, q);
+    return n.add(n.add(w, n.mul(q, c.a)), c.b);
+  }
+  function y(q, b) {
+    const w = n.sqr(b), I = g(q);
+    return n.eql(w, I);
+  }
+  if (!y(c.Gx, c.Gy))
+    throw new Error("bad curve params: generator point");
+  const T = n.mul(n.pow(c.a, Pt), Le), R = n.mul(n.sqr(c.b), BigInt(27));
+  if (n.is0(n.add(T, R)))
+    throw new Error("bad curve params: a or b");
+  function p(q, b, w = !1) {
+    if (!n.isValid(b) || w && n.is0(b))
+      throw new Error(`bad point coordinate ${q}`);
+    return b;
+  }
+  function E(q) {
+    if (!(q instanceof B))
+      throw new Error("ProjectivePoint expected");
+  }
+  function _(q) {
+    if (!a || !a.basises)
+      throw new Error("no endo");
+    return as(q, a.basises, s.ORDER);
+  }
+  const O = Ue((q, b) => {
+    const { X: w, Y: I, Z: L } = q;
+    if (n.eql(L, n.ONE))
+      return { x: w, y: I };
+    const M = q.is0();
+    b == null && (b = M ? n.ONE : n.inv(L));
+    const x = n.mul(w, b), S = n.mul(I, b), v = n.mul(L, b);
+    if (M)
+      return { x: n.ZERO, y: n.ZERO };
+    if (!n.eql(v, n.ONE))
+      throw new Error("invZ was invalid");
+    return { x, y: S };
+  }), N = Ue((q) => {
+    if (q.is0()) {
+      if (t.allowInfinityPoint && !n.is0(q.Y))
+        return;
+      throw new Error("bad point: ZERO");
+    }
+    const { x: b, y: w } = q.toAffine();
+    if (!n.isValid(b) || !n.isValid(w))
+      throw new Error("bad point: x or y not field elements");
+    if (!y(b, w))
+      throw new Error("bad point: equation left != right");
+    if (!q.isTorsionFree())
+      throw new Error("bad point: not in prime-order subgroup");
+    return !0;
+  });
+  function H(q, b, w, I, L) {
+    return w = new B(n.mul(w.X, q), w.Y, w.Z), b = le(I, b), w = le(L, w), b.add(w);
+  }
+  class B {
+    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
+    constructor(b, w, I) {
+      this.X = p("x", b), this.Y = p("y", w, !0), this.Z = p("z", I), Object.freeze(this);
+    }
+    static CURVE() {
+      return c;
+    }
+    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
+    static fromAffine(b) {
+      const { x: w, y: I } = b || {};
+      if (!b || !n.isValid(w) || !n.isValid(I))
+        throw new Error("invalid affine point");
+      if (b instanceof B)
+        throw new Error("projective point not allowed");
+      return n.is0(w) && n.is0(I) ? B.ZERO : new B(w, I, n.ONE);
+    }
+    static fromBytes(b) {
+      const w = B.fromAffine(m(on(b, void 0, "point")));
+      return w.assertValidity(), w;
+    }
+    static fromHex(b) {
+      return B.fromBytes(Ft("pointHex", b));
+    }
+    get x() {
+      return this.toAffine().x;
+    }
+    get y() {
+      return this.toAffine().y;
+    }
+    /**
+     *
+     * @param windowSize
+     * @param isLazy true will defer table computation until the first multiplication
+     * @returns
+     */
+    precompute(b = 8, w = !0) {
+      return F.createCache(this, b), w || this.multiply(Pt), this;
+    }
+    // TODO: return `this`
+    /** A point on curve is valid if it conforms to equation. */
+    assertValidity() {
+      N(this);
+    }
+    hasEvenY() {
+      const { y: b } = this.toAffine();
+      if (!n.isOdd)
+        throw new Error("Field doesn't support isOdd");
+      return !n.isOdd(b);
+    }
+    /** Compare one point to another. */
+    equals(b) {
+      E(b);
+      const { X: w, Y: I, Z: L } = this, { X: M, Y: x, Z: S } = b, v = n.eql(n.mul(w, S), n.mul(M, L)), G = n.eql(n.mul(I, S), n.mul(x, L));
+      return v && G;
+    }
+    /** Flips point to one corresponding to (x, -y) in Affine coordinates. */
+    negate() {
+      return new B(this.X, n.neg(this.Y), this.Z);
+    }
+    // Renes-Costello-Batina exception-free doubling formula.
+    // There is 30% faster Jacobian formula, but it is not complete.
+    // https://eprint.iacr.org/2015/1060, algorithm 3
+    // Cost: 8M + 3S + 3*a + 2*b3 + 15add.
+    double() {
+      const { a: b, b: w } = c, I = n.mul(w, Pt), { X: L, Y: M, Z: x } = this;
+      let S = n.ZERO, v = n.ZERO, G = n.ZERO, U = n.mul(L, L), tt = n.mul(M, M), Y = n.mul(x, x), K = n.mul(L, M);
+      return K = n.add(K, K), G = n.mul(L, x), G = n.add(G, G), S = n.mul(b, G), v = n.mul(I, Y), v = n.add(S, v), S = n.sub(tt, v), v = n.add(tt, v), v = n.mul(S, v), S = n.mul(K, S), G = n.mul(I, G), Y = n.mul(b, Y), K = n.sub(U, Y), K = n.mul(b, K), K = n.add(K, G), G = n.add(U, U), U = n.add(G, U), U = n.add(U, Y), U = n.mul(U, K), v = n.add(v, U), Y = n.mul(M, x), Y = n.add(Y, Y), U = n.mul(Y, K), S = n.sub(S, U), G = n.mul(Y, tt), G = n.add(G, G), G = n.add(G, G), new B(S, v, G);
+    }
+    // Renes-Costello-Batina exception-free addition formula.
+    // There is 30% faster Jacobian formula, but it is not complete.
+    // https://eprint.iacr.org/2015/1060, algorithm 1
+    // Cost: 12M + 0S + 3*a + 3*b3 + 23add.
+    add(b) {
+      E(b);
+      const { X: w, Y: I, Z: L } = this, { X: M, Y: x, Z: S } = b;
+      let v = n.ZERO, G = n.ZERO, U = n.ZERO;
+      const tt = c.a, Y = n.mul(c.b, Pt);
+      let K = n.mul(w, M), ct = n.mul(I, x), ot = n.mul(L, S), Gt = n.add(w, I), X = n.add(M, x);
+      Gt = n.mul(Gt, X), X = n.add(K, ct), Gt = n.sub(Gt, X), X = n.add(w, L);
+      let at = n.add(M, S);
+      return X = n.mul(X, at), at = n.add(K, ot), X = n.sub(X, at), at = n.add(I, L), v = n.add(x, S), at = n.mul(at, v), v = n.add(ct, ot), at = n.sub(at, v), U = n.mul(tt, X), v = n.mul(Y, ot), U = n.add(v, U), v = n.sub(ct, U), U = n.add(ct, U), G = n.mul(v, U), ct = n.add(K, K), ct = n.add(ct, K), ot = n.mul(tt, ot), X = n.mul(Y, X), ct = n.add(ct, ot), ot = n.sub(K, ot), ot = n.mul(tt, ot), X = n.add(X, ot), K = n.mul(ct, X), G = n.add(G, K), K = n.mul(at, X), v = n.mul(Gt, v), v = n.sub(v, K), K = n.mul(Gt, ct), U = n.mul(at, U), U = n.add(U, K), new B(v, G, U);
+    }
+    subtract(b) {
+      return this.add(b.negate());
+    }
+    is0() {
+      return this.equals(B.ZERO);
+    }
+    /**
+     * Constant time multiplication.
+     * Uses wNAF method. Windowed method may be 10% faster,
+     * but takes 2x longer to generate and consumes 2x memory.
+     * Uses precomputes when available.
+     * Uses endomorphism for Koblitz curves.
+     * @param scalar by which the point would be multiplied
+     * @returns New point
+     */
+    multiply(b) {
+      const { endo: w } = t;
+      if (!s.isValidNot0(b))
+        throw new Error("invalid scalar: out of range");
+      let I, L;
+      const M = (x) => F.cached(this, x, (S) => jt(B, S));
+      if (w) {
+        const { k1neg: x, k1: S, k2neg: v, k2: G } = _(b), { p: U, f: tt } = M(S), { p: Y, f: K } = M(G);
+        L = tt.add(K), I = H(w.beta, U, Y, x, v);
+      } else {
+        const { p: x, f: S } = M(b);
+        I = x, L = S;
+      }
+      return jt(B, [I, L])[0];
+    }
+    /**
+     * Non-constant-time multiplication. Uses double-and-add algorithm.
+     * It's faster, but should only be used when you don't care about
+     * an exposed secret key e.g. sig verification, which works over *public* keys.
+     */
+    multiplyUnsafe(b) {
+      const { endo: w } = t, I = this;
+      if (!s.isValid(b))
+        throw new Error("invalid scalar: out of range");
+      if (b === Ot || I.is0())
+        return B.ZERO;
+      if (b === W)
+        return I;
+      if (F.hasCache(this))
+        return this.multiply(b);
+      if (w) {
+        const { k1neg: L, k1: M, k2neg: x, k2: S } = _(b), { p1: v, p2: G } = ts(B, I, M, S);
+        return H(w.beta, v, G, L, x);
+      } else
+        return F.unsafe(I, b);
+    }
+    multiplyAndAddUnsafe(b, w, I) {
+      const L = this.multiplyUnsafe(w).add(b.multiplyUnsafe(I));
+      return L.is0() ? void 0 : L;
+    }
+    /**
+     * Converts Projective point to affine (x, y) coordinates.
+     * @param invertedZ Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch
+     */
+    toAffine(b) {
+      return O(this, b);
+    }
+    /**
+     * Checks whether Point is free of torsion elements (is in prime subgroup).
+     * Always torsion-free for cofactor=1 curves.
+     */
+    isTorsionFree() {
+      const { isTorsionFree: b } = t;
+      return o === W ? !0 : b ? b(B, this) : F.unsafe(this, i).is0();
+    }
+    clearCofactor() {
+      const { clearCofactor: b } = t;
+      return o === W ? this : b ? b(B, this) : this.multiplyUnsafe(o);
+    }
+    isSmallOrder() {
+      return this.multiplyUnsafe(o).is0();
+    }
+    toBytes(b = !0) {
+      return cn(b, "isCompressed"), this.assertValidity(), h(B, this, b);
+    }
+    toHex(b = !0) {
+      return Xt(this.toBytes(b));
+    }
+    toString() {
+      return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
+    }
+    // TODO: remove
+    get px() {
+      return this.X;
+    }
+    get py() {
+      return this.X;
+    }
+    get pz() {
+      return this.Z;
+    }
+    toRawBytes(b = !0) {
+      return this.toBytes(b);
+    }
+    _setWindowSize(b) {
+      this.precompute(b);
+    }
+    static normalizeZ(b) {
+      return jt(B, b);
+    }
+    static msm(b, w) {
+      return es(B, s, b, w);
+    }
+    static fromPrivateKey(b) {
+      return B.BASE.multiply(he(s, b));
+    }
+  }
+  B.BASE = new B(c.Gx, c.Gy, n.ONE), B.ZERO = new B(n.ZERO, n.ONE, n.ZERO), B.Fp = n, B.Fn = s;
+  const Z = s.BITS, F = new Jr(B, t.endo ? Math.ceil(Z / 2) : Z);
+  return B.BASE.precompute(8), B;
+}
+function ds(e) {
+  return Uint8Array.of(e ? 2 : 3);
+}
+function us(e, t) {
+  const r = e.ORDER;
+  let n = Ot;
+  for (let m = r - W; m % ht === Ot; m /= ht)
+    n += W;
+  const s = n, c = ht << s - W - W, o = c * ht, i = (r - W) / o, a = (i - W) / ht, u = o - W, l = c, d = e.pow(t, i), f = e.pow(t, (i + W) / ht);
+  let h = (m, g) => {
+    let y = d, T = e.pow(g, u), R = e.sqr(T);
+    R = e.mul(R, g);
+    let p = e.mul(m, R);
+    p = e.pow(p, a), p = e.mul(p, T), T = e.mul(p, g), R = e.mul(p, m);
+    let E = e.mul(R, T);
+    p = e.pow(E, l);
+    let _ = e.eql(p, e.ONE);
+    T = e.mul(R, f), p = e.mul(E, y), R = e.cmov(T, R, _), E = e.cmov(p, E, _);
+    for (let O = s; O > W; O--) {
+      let N = O - ht;
+      N = ht << N - W;
+      let H = e.pow(E, N);
+      const B = e.eql(H, e.ONE);
+      T = e.mul(R, y), y = e.mul(y, y), H = e.mul(E, y), R = e.cmov(T, R, B), E = e.cmov(H, E, B);
+    }
+    return { isValid: _, value: R };
+  };
+  if (e.ORDER % Le === Pt) {
+    const m = (e.ORDER - Pt) / Le, g = e.sqrt(e.neg(t));
+    h = (y, T) => {
+      let R = e.sqr(T);
+      const p = e.mul(y, T);
+      R = e.mul(R, p);
+      let E = e.pow(R, m);
+      E = e.mul(E, p);
+      const _ = e.mul(E, g), O = e.mul(e.sqr(E), T), N = e.eql(O, y);
+      let H = e.cmov(_, E, N);
+      return { isValid: N, value: H };
+    };
+  }
+  return h;
+}
+function ir(e, t) {
+  Jn(e);
+  const { A: r, B: n, Z: s } = t;
+  if (!e.isValid(r) || !e.isValid(n) || !e.isValid(s))
+    throw new Error("mapToCurveSimpleSWU: invalid opts");
+  const c = us(e, s);
+  if (!e.isOdd)
+    throw new Error("Field does not have .isOdd()");
+  return (o) => {
+    let i, a, u, l, d, f, h, m;
+    i = e.sqr(o), i = e.mul(i, s), a = e.sqr(i), a = e.add(a, i), u = e.add(a, e.ONE), u = e.mul(u, n), l = e.cmov(s, e.neg(a), !e.eql(a, e.ZERO)), l = e.mul(l, r), a = e.sqr(u), f = e.sqr(l), d = e.mul(f, r), a = e.add(a, d), a = e.mul(a, u), f = e.mul(f, l), d = e.mul(f, n), a = e.add(a, d), h = e.mul(i, u);
+    const { isValid: g, value: y } = c(a, f);
+    m = e.mul(i, o), m = e.mul(m, y), h = e.cmov(h, u, g), m = e.cmov(m, y, g);
+    const T = e.isOdd(o) === e.isOdd(m);
+    m = e.cmov(e.neg(m), m, T);
+    const R = Ht(e, [l], !0)[0];
+    return h = e.mul(h, R), { x: h, y: m };
+  };
+}
+function ls(e, t) {
+  return {
+    secretKey: t.BYTES,
+    publicKey: 1 + e.BYTES,
+    publicKeyUncompressed: 1 + 2 * e.BYTES,
+    publicKeyHasPrefix: !0,
+    signature: 2 * t.BYTES
+  };
+}
+function bn(e) {
+  const { CURVE: t, curveOpts: r } = hs(e), n = fs(t, r);
+  return ms(e, n);
+}
+function hs(e) {
+  const t = {
+    a: e.a,
+    b: e.b,
+    p: e.Fp.ORDER,
+    n: e.n,
+    h: e.h,
+    Gx: e.Gx,
+    Gy: e.Gy
+  }, r = e.Fp;
+  let n = e.allowedPrivateKeyLengths ? Array.from(new Set(e.allowedPrivateKeyLengths.map((o) => Math.ceil(o / 2)))) : void 0;
+  const s = Yt(t.n, {
+    BITS: e.nBitLength,
+    allowedLengths: n,
+    modFromBytes: e.wrapPrivateKey
+  }), c = {
+    Fp: r,
+    Fn: s,
+    allowInfinityPoint: e.allowInfinityPoint,
+    endo: e.endo,
+    isTorsionFree: e.isTorsionFree,
+    clearCofactor: e.clearCofactor,
+    fromBytes: e.fromBytes,
+    toBytes: e.toBytes
+  };
+  return { CURVE: t, curveOpts: c };
+}
+function bs(e, t, r) {
+  function n(s) {
+    const c = e.sqr(s), o = e.mul(c, s);
+    return e.add(e.add(o, e.mul(s, t)), r);
+  }
+  return n;
+}
+function ms(e, t) {
+  const { Fp: r, Fn: n } = t;
+  function s(o) {
+    return Cn(o, W, n.ORDER);
+  }
+  const c = bs(r, e.a, e.b);
+  return Object.assign({}, {
+    CURVE: e,
+    Point: t,
+    ProjectivePoint: t,
+    normPrivateKeyToScalar: (o) => he(n, o),
+    weierstrassEquation: c,
+    isWithinCurveOrder: s
+  });
+}
+const gs = BigInt(0), ie = BigInt(1), mn = BigInt(2), Mt = BigInt(3);
+function ys(e) {
+  const t = [];
+  for (; e > ie; e >>= ie)
+    (e & ie) === gs ? t.unshift(0) : (e & Mt) === Mt ? (t.unshift(-1), e += ie) : t.unshift(1);
+  return t;
+}
+function Oe(e) {
+  if (!Array.isArray(e) || e.length === 0)
+    throw new Error("expected non-empty array");
+}
+function ps(e, t, r, n) {
+  const { Fp2: s, Fp12: c } = e, { twistType: o, ateLoopSize: i, xNegative: a, postPrecompute: u } = n;
+  let l;
+  if (o === "multiplicative")
+    l = (p, E, _, O, N, H) => c.mul014(O, p, s.mul(E, N), s.mul(_, H));
+  else if (o === "divisive")
+    l = (p, E, _, O, N, H) => c.mul034(O, s.mul(_, H), s.mul(E, N), p);
+  else
+    throw new Error("bls: unknown twist type");
+  const d = s.div(s.ONE, s.mul(s.ONE, mn));
+  function f(p, E, _, O) {
+    const N = s.sqr(_), H = s.sqr(O), B = s.mulByB(s.mul(H, Mt)), Z = s.mul(B, Mt), F = s.sub(s.sub(s.sqr(s.add(_, O)), H), N), q = s.sub(B, N), b = s.mul(s.sqr(E), Mt), w = s.neg(F);
+    return p.push([q, b, w]), E = s.mul(s.mul(s.mul(s.sub(N, Z), E), _), d), _ = s.sub(s.sqr(s.mul(s.add(N, Z), d)), s.mul(s.sqr(B), Mt)), O = s.mul(N, F), { Rx: E, Ry: _, Rz: O };
+  }
+  function h(p, E, _, O, N, H) {
+    const B = s.sub(_, s.mul(H, O)), Z = s.sub(E, s.mul(N, O)), F = s.sub(s.mul(B, N), s.mul(Z, H)), q = s.neg(B), b = Z;
+    p.push([F, q, b]);
+    const w = s.sqr(Z), I = s.mul(w, Z), L = s.mul(w, E), M = s.add(s.sub(I, s.mul(L, mn)), s.mul(s.sqr(B), O));
+    return E = s.mul(Z, M), _ = s.sub(s.mul(s.sub(L, M), B), s.mul(I, _)), O = s.mul(O, I), { Rx: E, Ry: _, Rz: O };
+  }
+  const m = ys(i), g = Ue((p) => {
+    const E = p, { x: _, y: O } = E.toAffine(), N = _, H = O, B = s.neg(O);
+    let Z = N, F = H, q = s.ONE;
+    const b = [];
+    for (const w of m) {
+      const I = [];
+      ({ Rx: Z, Ry: F, Rz: q } = f(I, Z, F, q)), w && ({ Rx: Z, Ry: F, Rz: q } = h(I, Z, F, q, N, w === -1 ? B : H)), b.push(I);
+    }
+    if (u) {
+      const w = b[b.length - 1];
+      u(Z, F, q, N, H, h.bind(null, w));
+    }
+    return b;
+  });
+  function y(p, E = !1) {
+    let _ = c.ONE;
+    if (p.length) {
+      const O = p[0][0].length;
+      for (let N = 0; N < O; N++) {
+        _ = c.sqr(_);
+        for (const [H, B, Z] of p)
+          for (const [F, q, b] of H[N])
+            _ = l(F, q, b, _, B, Z);
+      }
+    }
+    return a && (_ = c.conjugate(_)), E ? c.finalExponentiate(_) : _;
+  }
+  function T(p, E = !0) {
+    const _ = [];
+    jt(t, p.map(({ g1: O }) => O)), jt(r, p.map(({ g2: O }) => O));
+    for (const { g1: O, g2: N } of p) {
+      if (O.is0() || N.is0())
+        throw new Error("pairing is not available for ZERO point");
+      O.assertValidity(), N.assertValidity();
+      const H = O.toAffine();
+      _.push([g(N), H.x, H.y]);
+    }
+    return y(_, E);
+  }
+  function R(p, E, _ = !0) {
+    return T([{ g1: p, g2: E }], _);
+  }
+  return {
+    Fp12: c,
+    // NOTE: we re-export Fp12 here because pairing results are Fp12!
+    millerLoopBatch: y,
+    pairing: R,
+    pairingBatch: T,
+    calcPairingPrecomputes: g
+  };
+}
+function gn(e, t, r, n, s) {
+  const { Fp12: c, pairingBatch: o } = e;
+  function i(d) {
+    return d instanceof t.Point ? d : t.Point.fromHex(d);
+  }
+  function a(d) {
+    return d instanceof r.Point ? d : r.Point.fromHex(d);
+  }
+  function u(d) {
+    if (!(d instanceof r.Point))
+      throw new Error(`expected valid message hashed to ${s ? "G1" : "G2"} curve`);
+    return d;
+  }
+  const l = s ? (d, f) => ({ g1: f, g2: d }) : (d, f) => ({ g1: d, g2: f });
+  return {
+    // P = pk x G
+    getPublicKey(d) {
+      const f = he(t.Point.Fn, d);
+      return t.Point.BASE.multiply(f);
+    },
+    // S = pk x H(m)
+    sign(d, f, h) {
+      if (h != null)
+        throw new Error("sign() expects 2 arguments");
+      const m = he(t.Point.Fn, f);
+      return u(d).assertValidity(), d.multiply(m);
+    },
+    // Checks if pairing of public key & hash is equal to pairing of generator & signature.
+    // e(P, H(m)) == e(G, S)
+    // e(S, G) == e(H(m), P)
+    verify(d, f, h, m) {
+      if (m != null)
+        throw new Error("verify() expects 3 arguments");
+      d = a(d), h = i(h);
+      const g = h.negate(), y = t.Point.BASE, T = u(f), R = d, p = o([l(g, T), l(y, R)]);
+      return c.eql(p, c.ONE);
+    },
+    // https://ethresear.ch/t/fast-verification-of-multiple-bls-signatures/5407
+    // e(G, S) = e(G, SUM(n)(Si)) = MUL(n)(e(G, Si))
+    // TODO: maybe `{message: G2Hex, publicKey: G1Hex}[]` instead?
+    verifyBatch(d, f, h) {
+      if (Oe(f), h.length !== f.length)
+        throw new Error("amount of public keys and messages should be equal");
+      const m = a(d), g = f, y = h.map(i), T = /* @__PURE__ */ new Map();
+      for (let E = 0; E < y.length; E++) {
+        const _ = y[E], O = g[E];
+        let N = T.get(O);
+        N === void 0 && (N = [], T.set(O, N)), N.push(_);
+      }
+      const R = [], p = t.Point.BASE;
+      try {
+        for (const [E, _] of T) {
+          const O = _.reduce((N, H) => N.add(H));
+          R.push(l(O, E));
+        }
+        return R.push(l(p.negate(), m)), c.eql(o(R), c.ONE);
+      } catch {
+        return !1;
+      }
+    },
+    // Adds a bunch of public key points together.
+    // pk1 + pk2 + pk3 = pkA
+    aggregatePublicKeys(d) {
+      Oe(d), d = d.map((h) => i(h));
+      const f = d.reduce((h, m) => h.add(m), t.Point.ZERO);
+      return f.assertValidity(), f;
+    },
+    // Adds a bunch of signature points together.
+    // pk1 + pk2 + pk3 = pkA
+    aggregateSignatures(d) {
+      Oe(d), d = d.map((h) => a(h));
+      const f = d.reduce((h, m) => h.add(m), r.Point.ZERO);
+      return f.assertValidity(), f;
+    },
+    hash(d, f) {
+      J(d);
+      const h = f ? { DST: f } : void 0;
+      return r.hashToCurve(d, h);
+    },
+    Signature: n
+  };
+}
+function ws(e) {
+  const { Fp: t, Fr: r, Fp2: n, Fp6: s, Fp12: c } = e.fields, o = bn(e.G1), i = Object.assign(o, ln(o.Point, e.G1.mapToCurve, {
+    ...e.htfDefaults,
+    ...e.G1.htfDefaults
+  })), a = bn(e.G2), u = Object.assign(a, ln(a.Point, e.G2.mapToCurve, {
+    ...e.htfDefaults,
+    ...e.G2.htfDefaults
+  })), l = ps(e.fields, i.Point, u.Point, {
+    ...e.params,
+    postPrecompute: e.postPrecompute
+  }), { millerLoopBatch: d, pairing: f, pairingBatch: h, calcPairingPrecomputes: m } = l, g = gn(l, i, u, e.G2.Signature, !1), y = gn(l, u, i, e.G1.ShortSignature, !0), T = e.randomBytes || Er, R = () => {
+    const x = er(r.ORDER);
+    return Xr(T(x), r.ORDER);
+  }, p = {
+    randomSecretKey: R,
+    randomPrivateKey: R,
+    calcPairingPrecomputes: m
+  }, { ShortSignature: E } = e.G1, { Signature: _ } = e.G2;
+  function O(x, S) {
+    return x instanceof i.Point ? x : y.hash(Ft("point", x), S?.DST);
+  }
+  function N(x, S) {
+    return x instanceof u.Point ? x : g.hash(Ft("point", x), S?.DST);
+  }
+  function H(x) {
+    return g.getPublicKey(x).toBytes(!0);
+  }
+  function B(x) {
+    return y.getPublicKey(x).toBytes(!0);
+  }
+  function Z(x, S, v) {
+    const G = N(x, v), U = g.sign(G, S);
+    return x instanceof u.Point ? U : _.toBytes(U);
+  }
+  function F(x, S, v) {
+    const G = O(x, v), U = y.sign(G, S);
+    return x instanceof i.Point ? U : E.toBytes(U);
+  }
+  function q(x, S, v, G) {
+    const U = N(S, G);
+    return g.verify(x, U, v);
+  }
+  function b(x, S, v, G) {
+    const U = O(S, G);
+    return y.verify(x, U, v);
+  }
+  function w(x) {
+    const S = g.aggregatePublicKeys(x);
+    return x[0] instanceof i.Point ? S : S.toBytes(!0);
+  }
+  function I(x) {
+    const S = g.aggregateSignatures(x);
+    return x[0] instanceof u.Point ? S : _.toBytes(S);
+  }
+  function L(x) {
+    const S = y.aggregateSignatures(x);
+    return x[0] instanceof i.Point ? S : E.toBytes(S);
+  }
+  function M(x, S, v, G) {
+    const U = S.map((tt) => N(tt, G));
+    return g.verifyBatch(x, U, v);
+  }
+  return i.Point.BASE.precompute(4), {
+    longSignatures: g,
+    shortSignatures: y,
+    millerLoopBatch: d,
+    pairing: f,
+    pairingBatch: h,
+    verifyBatch: M,
+    fields: {
+      Fr: r,
+      Fp: t,
+      Fp2: n,
+      Fp6: s,
+      Fp12: c
+    },
+    params: {
+      ateLoopSize: e.params.ateLoopSize,
+      twistType: e.params.twistType,
+      // deprecated
+      r: e.params.r,
+      G1b: e.G1.b,
+      G2b: e.G2.b
+    },
+    utils: p,
+    // deprecated
+    getPublicKey: H,
+    getPublicKeyForShortSignatures: B,
+    sign: Z,
+    signShortSignature: F,
+    verify: q,
+    verifyShortSignature: b,
+    aggregatePublicKeys: w,
+    aggregateSignatures: I,
+    aggregateShortSignatures: L,
+    G1: i,
+    G2: u,
+    Signature: _,
+    ShortSignature: E
+  };
+}
+const yn = BigInt(0), bt = BigInt(1), Q = BigInt(2), pn = BigInt(3);
+function Xe(e, t, r, n, s = 1, c) {
+  const o = BigInt(c === void 0 ? n : c), i = r ** BigInt(n), a = [];
+  for (let u = 0; u < s; u++) {
+    const l = BigInt(u + 1), d = [];
+    for (let f = 0, h = bt; f < n; f++) {
+      const m = (l * h - l) / o % i;
+      d.push(e.pow(t, m)), h *= r;
+    }
+    a.push(d);
+  }
+  return a;
+}
+function xs(e, t, r) {
+  const n = t.pow(r, (e.ORDER - bt) / pn), s = t.pow(r, (e.ORDER - bt) / Q);
+  function c(f, h) {
+    const m = t.mul(t.frobeniusMap(f, 1), n), g = t.mul(t.frobeniusMap(h, 1), s);
+    return [m, g];
+  }
+  const o = t.pow(r, (e.ORDER ** Q - bt) / pn), i = t.pow(r, (e.ORDER ** Q - bt) / Q);
+  if (!t.eql(i, t.neg(t.ONE)))
+    throw new Error("psiFrobenius: PSI2_Y!==-1");
+  function a(f, h) {
+    return [t.mul(f, o), t.neg(h)];
+  }
+  const u = (f) => (h, m) => {
+    const g = m.toAffine(), y = f(g.x, g.y);
+    return h.fromAffine({ x: y[0], y: y[1] });
+  }, l = u(c), d = u(a);
+  return { psi: c, psi2: a, G2psi: l, G2psi2: d, PSI_X: n, PSI_Y: s, PSI2_X: o, PSI2_Y: i };
+}
+const wn = (e, t) => {
+  if (t.length !== 2)
+    throw new Error("invalid tuple");
+  const r = t.map((n) => e.create(n));
+  return { c0: r[0], c1: r[1] };
+};
+class Es {
+  constructor(t, r = {}) {
+    this.MASK = bt;
+    const n = t.ORDER, s = n * n;
+    this.Fp = t, this.ORDER = s, this.BITS = Wt(s), this.BYTES = Math.ceil(Wt(s) / 8), this.isLE = t.isLE, this.ZERO = { c0: t.ZERO, c1: t.ZERO }, this.ONE = { c0: t.ONE, c1: t.ZERO }, this.Fp_NONRESIDUE = t.create(r.NONRESIDUE || BigInt(-1)), this.Fp_div2 = t.div(t.ONE, Q), this.NONRESIDUE = wn(t, r.FP2_NONRESIDUE), this.FROBENIUS_COEFFICIENTS = Xe(t, this.Fp_NONRESIDUE, t.ORDER, 2)[0], this.mulByB = r.Fp2mulByB, Object.seal(this);
+  }
+  fromBigTuple(t) {
+    return wn(this.Fp, t);
+  }
+  create(t) {
+    return t;
+  }
+  isValid({ c0: t, c1: r }) {
+    function n(s, c) {
+      return typeof s == "bigint" && yn <= s && s < c;
+    }
+    return n(t, this.ORDER) && n(r, this.ORDER);
+  }
+  is0({ c0: t, c1: r }) {
+    return this.Fp.is0(t) && this.Fp.is0(r);
+  }
+  isValidNot0(t) {
+    return !this.is0(t) && this.isValid(t);
+  }
+  eql({ c0: t, c1: r }, { c0: n, c1: s }) {
+    return this.Fp.eql(t, n) && this.Fp.eql(r, s);
+  }
+  neg({ c0: t, c1: r }) {
+    return { c0: this.Fp.neg(t), c1: this.Fp.neg(r) };
+  }
+  pow(t, r) {
+    return ye(this, t, r);
+  }
+  invertBatch(t) {
+    return Ht(this, t);
+  }
+  // Normalized
+  add(t, r) {
+    const { c0: n, c1: s } = t, { c0: c, c1: o } = r;
+    return {
+      c0: this.Fp.add(n, c),
+      c1: this.Fp.add(s, o)
+    };
+  }
+  sub({ c0: t, c1: r }, { c0: n, c1: s }) {
+    return {
+      c0: this.Fp.sub(t, n),
+      c1: this.Fp.sub(r, s)
+    };
+  }
+  mul({ c0: t, c1: r }, n) {
+    const { Fp: s } = this;
+    if (typeof n == "bigint")
+      return { c0: s.mul(t, n), c1: s.mul(r, n) };
+    const { c0: c, c1: o } = n;
+    let i = s.mul(t, c), a = s.mul(r, o);
+    const u = s.sub(i, a), l = s.sub(s.mul(s.add(t, r), s.add(c, o)), s.add(i, a));
+    return { c0: u, c1: l };
+  }
+  sqr({ c0: t, c1: r }) {
+    const { Fp: n } = this, s = n.add(t, r), c = n.sub(t, r), o = n.add(t, t);
+    return { c0: n.mul(s, c), c1: n.mul(o, r) };
+  }
+  // NonNormalized stuff
+  addN(t, r) {
+    return this.add(t, r);
+  }
+  subN(t, r) {
+    return this.sub(t, r);
+  }
+  mulN(t, r) {
+    return this.mul(t, r);
+  }
+  sqrN(t) {
+    return this.sqr(t);
+  }
+  // Why inversion for bigint inside Fp instead of Fp2? it is even used in that context?
+  div(t, r) {
+    const { Fp: n } = this;
+    return this.mul(t, typeof r == "bigint" ? n.inv(n.create(r)) : this.inv(r));
+  }
+  inv({ c0: t, c1: r }) {
+    const { Fp: n } = this, s = n.inv(n.create(t * t + r * r));
+    return { c0: n.mul(s, n.create(t)), c1: n.mul(s, n.create(-r)) };
+  }
+  sqrt(t) {
+    const { Fp: r } = this, n = this, { c0: s, c1: c } = t;
+    if (r.is0(c))
+      return ue(r, s) === 1 ? n.create({ c0: r.sqrt(s), c1: r.ZERO }) : n.create({ c0: r.ZERO, c1: r.sqrt(r.div(s, this.Fp_NONRESIDUE)) });
+    const o = r.sqrt(r.sub(r.sqr(s), r.mul(r.sqr(c), this.Fp_NONRESIDUE)));
+    let i = r.mul(r.add(o, s), this.Fp_div2);
+    ue(r, i) === -1 && (i = r.sub(i, o));
+    const u = r.sqrt(i), l = n.create({ c0: u, c1: r.div(r.mul(c, this.Fp_div2), u) });
+    if (!n.eql(n.sqr(l), t))
+      throw new Error("Cannot find square root");
+    const d = l, f = n.neg(d), { re: h, im: m } = n.reim(d), { re: g, im: y } = n.reim(f);
+    return m > y || m === y && h > g ? d : f;
+  }
+  // Same as sgn0_m_eq_2 in RFC 9380
+  isOdd(t) {
+    const { re: r, im: n } = this.reim(t), s = r % Q, c = r === yn, o = n % Q;
+    return BigInt(s || c && o) == bt;
+  }
+  // Bytes util
+  fromBytes(t) {
+    const { Fp: r } = this;
+    if (t.length !== this.BYTES)
+      throw new Error("fromBytes invalid length=" + t.length);
+    return { c0: r.fromBytes(t.subarray(0, r.BYTES)), c1: r.fromBytes(t.subarray(r.BYTES)) };
+  }
+  toBytes({ c0: t, c1: r }) {
+    return C(this.Fp.toBytes(t), this.Fp.toBytes(r));
+  }
+  cmov({ c0: t, c1: r }, { c0: n, c1: s }, c) {
+    return {
+      c0: this.Fp.cmov(t, n, c),
+      c1: this.Fp.cmov(r, s, c)
+    };
+  }
+  reim({ c0: t, c1: r }) {
+    return { re: t, im: r };
+  }
+  Fp4Square(t, r) {
+    const n = this, s = n.sqr(t), c = n.sqr(r);
+    return {
+      first: n.add(n.mulByNonresidue(c), s),
+      // b² * Nonresidue + a²
+      second: n.sub(n.sub(n.sqr(n.add(t, r)), s), c)
+      // (a + b)² - a² - b²
+    };
+  }
+  // multiply by u + 1
+  mulByNonresidue({ c0: t, c1: r }) {
+    return this.mul({ c0: t, c1: r }, this.NONRESIDUE);
+  }
+  frobeniusMap({ c0: t, c1: r }, n) {
+    return {
+      c0: t,
+      c1: this.Fp.mul(r, this.FROBENIUS_COEFFICIENTS[n % 2])
+    };
+  }
+}
+class Bs {
+  constructor(t) {
+    this.MASK = bt, this.Fp2 = t, this.ORDER = t.ORDER, this.BITS = 3 * t.BITS, this.BYTES = 3 * t.BYTES, this.isLE = t.isLE, this.ZERO = { c0: t.ZERO, c1: t.ZERO, c2: t.ZERO }, this.ONE = { c0: t.ONE, c1: t.ZERO, c2: t.ZERO };
+    const { Fp: r } = t, n = Xe(t, t.NONRESIDUE, r.ORDER, 6, 2, 3);
+    this.FROBENIUS_COEFFICIENTS_1 = n[0], this.FROBENIUS_COEFFICIENTS_2 = n[1], Object.seal(this);
+  }
+  add({ c0: t, c1: r, c2: n }, { c0: s, c1: c, c2: o }) {
+    const { Fp2: i } = this;
+    return {
+      c0: i.add(t, s),
+      c1: i.add(r, c),
+      c2: i.add(n, o)
+    };
+  }
+  sub({ c0: t, c1: r, c2: n }, { c0: s, c1: c, c2: o }) {
+    const { Fp2: i } = this;
+    return {
+      c0: i.sub(t, s),
+      c1: i.sub(r, c),
+      c2: i.sub(n, o)
+    };
+  }
+  mul({ c0: t, c1: r, c2: n }, s) {
+    const { Fp2: c } = this;
+    if (typeof s == "bigint")
+      return {
+        c0: c.mul(t, s),
+        c1: c.mul(r, s),
+        c2: c.mul(n, s)
+      };
+    const { c0: o, c1: i, c2: a } = s, u = c.mul(t, o), l = c.mul(r, i), d = c.mul(n, a);
+    return {
+      // t0 + (c1 + c2) * (r1 * r2) - (T1 + T2) * (u + 1)
+      c0: c.add(u, c.mulByNonresidue(c.sub(c.mul(c.add(r, n), c.add(i, a)), c.add(l, d)))),
+      // (c0 + c1) * (r0 + r1) - (T0 + T1) + T2 * (u + 1)
+      c1: c.add(c.sub(c.mul(c.add(t, r), c.add(o, i)), c.add(u, l)), c.mulByNonresidue(d)),
+      // T1 + (c0 + c2) * (r0 + r2) - T0 + T2
+      c2: c.sub(c.add(l, c.mul(c.add(t, n), c.add(o, a))), c.add(u, d))
+    };
+  }
+  sqr({ c0: t, c1: r, c2: n }) {
+    const { Fp2: s } = this;
+    let c = s.sqr(t), o = s.mul(s.mul(t, r), Q), i = s.mul(s.mul(r, n), Q), a = s.sqr(n);
+    return {
+      c0: s.add(s.mulByNonresidue(i), c),
+      // T3 * (u + 1) + T0
+      c1: s.add(s.mulByNonresidue(a), o),
+      // T4 * (u + 1) + T1
+      // T1 + (c0 - c1 + c2)² + T3 - T0 - T4
+      c2: s.sub(s.sub(s.add(s.add(o, s.sqr(s.add(s.sub(t, r), n))), i), c), a)
+    };
+  }
+  addN(t, r) {
+    return this.add(t, r);
+  }
+  subN(t, r) {
+    return this.sub(t, r);
+  }
+  mulN(t, r) {
+    return this.mul(t, r);
+  }
+  sqrN(t) {
+    return this.sqr(t);
+  }
+  create(t) {
+    return t;
+  }
+  isValid({ c0: t, c1: r, c2: n }) {
+    const { Fp2: s } = this;
+    return s.isValid(t) && s.isValid(r) && s.isValid(n);
+  }
+  is0({ c0: t, c1: r, c2: n }) {
+    const { Fp2: s } = this;
+    return s.is0(t) && s.is0(r) && s.is0(n);
+  }
+  isValidNot0(t) {
+    return !this.is0(t) && this.isValid(t);
+  }
+  neg({ c0: t, c1: r, c2: n }) {
+    const { Fp2: s } = this;
+    return { c0: s.neg(t), c1: s.neg(r), c2: s.neg(n) };
+  }
+  eql({ c0: t, c1: r, c2: n }, { c0: s, c1: c, c2: o }) {
+    const { Fp2: i } = this;
+    return i.eql(t, s) && i.eql(r, c) && i.eql(n, o);
+  }
+  sqrt(t) {
+    return Yn();
+  }
+  // Do we need division by bigint at all? Should be done via order:
+  div(t, r) {
+    const { Fp2: n } = this, { Fp: s } = n;
+    return this.mul(t, typeof r == "bigint" ? s.inv(s.create(r)) : this.inv(r));
+  }
+  pow(t, r) {
+    return ye(this, t, r);
+  }
+  invertBatch(t) {
+    return Ht(this, t);
+  }
+  inv({ c0: t, c1: r, c2: n }) {
+    const { Fp2: s } = this;
+    let c = s.sub(s.sqr(t), s.mulByNonresidue(s.mul(n, r))), o = s.sub(s.mulByNonresidue(s.sqr(n)), s.mul(t, r)), i = s.sub(s.sqr(r), s.mul(t, n)), a = s.inv(s.add(s.mulByNonresidue(s.add(s.mul(n, o), s.mul(r, i))), s.mul(t, c)));
+    return { c0: s.mul(a, c), c1: s.mul(a, o), c2: s.mul(a, i) };
+  }
+  // Bytes utils
+  fromBytes(t) {
+    const { Fp2: r } = this;
+    if (t.length !== this.BYTES)
+      throw new Error("fromBytes invalid length=" + t.length);
+    const n = r.BYTES;
+    return {
+      c0: r.fromBytes(t.subarray(0, n)),
+      c1: r.fromBytes(t.subarray(n, n * 2)),
+      c2: r.fromBytes(t.subarray(2 * n))
+    };
+  }
+  toBytes({ c0: t, c1: r, c2: n }) {
+    const { Fp2: s } = this;
+    return C(s.toBytes(t), s.toBytes(r), s.toBytes(n));
+  }
+  cmov({ c0: t, c1: r, c2: n }, { c0: s, c1: c, c2: o }, i) {
+    const { Fp2: a } = this;
+    return {
+      c0: a.cmov(t, s, i),
+      c1: a.cmov(r, c, i),
+      c2: a.cmov(n, o, i)
+    };
+  }
+  fromBigSix(t) {
+    const { Fp2: r } = this;
+    if (!Array.isArray(t) || t.length !== 6)
+      throw new Error("invalid Fp6 usage");
+    return {
+      c0: r.fromBigTuple(t.slice(0, 2)),
+      c1: r.fromBigTuple(t.slice(2, 4)),
+      c2: r.fromBigTuple(t.slice(4, 6))
+    };
+  }
+  frobeniusMap({ c0: t, c1: r, c2: n }, s) {
+    const { Fp2: c } = this;
+    return {
+      c0: c.frobeniusMap(t, s),
+      c1: c.mul(c.frobeniusMap(r, s), this.FROBENIUS_COEFFICIENTS_1[s % 6]),
+      c2: c.mul(c.frobeniusMap(n, s), this.FROBENIUS_COEFFICIENTS_2[s % 6])
+    };
+  }
+  mulByFp2({ c0: t, c1: r, c2: n }, s) {
+    const { Fp2: c } = this;
+    return {
+      c0: c.mul(t, s),
+      c1: c.mul(r, s),
+      c2: c.mul(n, s)
+    };
+  }
+  mulByNonresidue({ c0: t, c1: r, c2: n }) {
+    const { Fp2: s } = this;
+    return { c0: s.mulByNonresidue(n), c1: t, c2: r };
+  }
+  // Sparse multiplication
+  mul1({ c0: t, c1: r, c2: n }, s) {
+    const { Fp2: c } = this;
+    return {
+      c0: c.mulByNonresidue(c.mul(n, s)),
+      c1: c.mul(t, s),
+      c2: c.mul(r, s)
+    };
+  }
+  // Sparse multiplication
+  mul01({ c0: t, c1: r, c2: n }, s, c) {
+    const { Fp2: o } = this;
+    let i = o.mul(t, s), a = o.mul(r, c);
+    return {
+      // ((c1 + c2) * b1 - T1) * (u + 1) + T0
+      c0: o.add(o.mulByNonresidue(o.sub(o.mul(o.add(r, n), c), a)), i),
+      // (b0 + b1) * (c0 + c1) - T0 - T1
+      c1: o.sub(o.sub(o.mul(o.add(s, c), o.add(t, r)), i), a),
+      // (c0 + c2) * b0 - T0 + T1
+      c2: o.add(o.sub(o.mul(o.add(t, n), s), i), a)
+    };
+  }
+}
+class _s {
+  constructor(t, r) {
+    this.MASK = bt;
+    const { Fp2: n } = t, { Fp: s } = n;
+    this.Fp6 = t, this.ORDER = n.ORDER, this.BITS = 2 * t.BITS, this.BYTES = 2 * t.BYTES, this.isLE = t.isLE, this.ZERO = { c0: t.ZERO, c1: t.ZERO }, this.ONE = { c0: t.ONE, c1: t.ZERO }, this.FROBENIUS_COEFFICIENTS = Xe(n, n.NONRESIDUE, s.ORDER, 12, 1, 6)[0], this.X_LEN = r.X_LEN, this.finalExponentiate = r.Fp12finalExponentiate;
+  }
+  create(t) {
+    return t;
+  }
+  isValid({ c0: t, c1: r }) {
+    const { Fp6: n } = this;
+    return n.isValid(t) && n.isValid(r);
+  }
+  is0({ c0: t, c1: r }) {
+    const { Fp6: n } = this;
+    return n.is0(t) && n.is0(r);
+  }
+  isValidNot0(t) {
+    return !this.is0(t) && this.isValid(t);
+  }
+  neg({ c0: t, c1: r }) {
+    const { Fp6: n } = this;
+    return { c0: n.neg(t), c1: n.neg(r) };
+  }
+  eql({ c0: t, c1: r }, { c0: n, c1: s }) {
+    const { Fp6: c } = this;
+    return c.eql(t, n) && c.eql(r, s);
+  }
+  sqrt(t) {
+    Yn();
+  }
+  inv({ c0: t, c1: r }) {
+    const { Fp6: n } = this;
+    let s = n.inv(n.sub(n.sqr(t), n.mulByNonresidue(n.sqr(r))));
+    return { c0: n.mul(t, s), c1: n.neg(n.mul(r, s)) };
+  }
+  div(t, r) {
+    const { Fp6: n } = this, { Fp2: s } = n, { Fp: c } = s;
+    return this.mul(t, typeof r == "bigint" ? c.inv(c.create(r)) : this.inv(r));
+  }
+  pow(t, r) {
+    return ye(this, t, r);
+  }
+  invertBatch(t) {
+    return Ht(this, t);
+  }
+  // Normalized
+  add({ c0: t, c1: r }, { c0: n, c1: s }) {
+    const { Fp6: c } = this;
+    return {
+      c0: c.add(t, n),
+      c1: c.add(r, s)
+    };
+  }
+  sub({ c0: t, c1: r }, { c0: n, c1: s }) {
+    const { Fp6: c } = this;
+    return {
+      c0: c.sub(t, n),
+      c1: c.sub(r, s)
+    };
+  }
+  mul({ c0: t, c1: r }, n) {
+    const { Fp6: s } = this;
+    if (typeof n == "bigint")
+      return { c0: s.mul(t, n), c1: s.mul(r, n) };
+    let { c0: c, c1: o } = n, i = s.mul(t, c), a = s.mul(r, o);
+    return {
+      c0: s.add(i, s.mulByNonresidue(a)),
+      // T1 + T2 * v
+      // (c0 + c1) * (r0 + r1) - (T1 + T2)
+      c1: s.sub(s.mul(s.add(t, r), s.add(c, o)), s.add(i, a))
+    };
+  }
+  sqr({ c0: t, c1: r }) {
+    const { Fp6: n } = this;
+    let s = n.mul(t, r);
+    return {
+      // (c1 * v + c0) * (c0 + c1) - AB - AB * v
+      c0: n.sub(n.sub(n.mul(n.add(n.mulByNonresidue(r), t), n.add(t, r)), s), n.mulByNonresidue(s)),
+      c1: n.add(s, s)
+    };
+  }
+  // NonNormalized stuff
+  addN(t, r) {
+    return this.add(t, r);
+  }
+  subN(t, r) {
+    return this.sub(t, r);
+  }
+  mulN(t, r) {
+    return this.mul(t, r);
+  }
+  sqrN(t) {
+    return this.sqr(t);
+  }
+  // Bytes utils
+  fromBytes(t) {
+    const { Fp6: r } = this;
+    if (t.length !== this.BYTES)
+      throw new Error("fromBytes invalid length=" + t.length);
+    return {
+      c0: r.fromBytes(t.subarray(0, r.BYTES)),
+      c1: r.fromBytes(t.subarray(r.BYTES))
+    };
+  }
+  toBytes({ c0: t, c1: r }) {
+    const { Fp6: n } = this;
+    return C(n.toBytes(t), n.toBytes(r));
+  }
+  cmov({ c0: t, c1: r }, { c0: n, c1: s }, c) {
+    const { Fp6: o } = this;
+    return {
+      c0: o.cmov(t, n, c),
+      c1: o.cmov(r, s, c)
+    };
+  }
+  // Utils
+  // toString() {
+  //   return '' + 'Fp12(' + this.c0 + this.c1 + '* w');
+  // },
+  // fromTuple(c: [Fp6, Fp6]) {
+  //   return new Fp12(...c);
+  // }
+  fromBigTwelve(t) {
+    const { Fp6: r } = this;
+    return {
+      c0: r.fromBigSix(t.slice(0, 6)),
+      c1: r.fromBigSix(t.slice(6, 12))
+    };
+  }
+  // Raises to q**i -th power
+  frobeniusMap(t, r) {
+    const { Fp6: n } = this, { Fp2: s } = n, { c0: c, c1: o, c2: i } = n.frobeniusMap(t.c1, r), a = this.FROBENIUS_COEFFICIENTS[r % 12];
+    return {
+      c0: n.frobeniusMap(t.c0, r),
+      c1: n.create({
+        c0: s.mul(c, a),
+        c1: s.mul(o, a),
+        c2: s.mul(i, a)
+      })
+    };
+  }
+  mulByFp2({ c0: t, c1: r }, n) {
+    const { Fp6: s } = this;
+    return {
+      c0: s.mulByFp2(t, n),
+      c1: s.mulByFp2(r, n)
+    };
+  }
+  conjugate({ c0: t, c1: r }) {
+    return { c0: t, c1: this.Fp6.neg(r) };
+  }
+  // Sparse multiplication
+  mul014({ c0: t, c1: r }, n, s, c) {
+    const { Fp6: o } = this, { Fp2: i } = o;
+    let a = o.mul01(t, n, s), u = o.mul1(r, c);
+    return {
+      c0: o.add(o.mulByNonresidue(u), a),
+      // T1 * v + T0
+      // (c1 + c0) * [o0, o1+o4] - T0 - T1
+      c1: o.sub(o.sub(o.mul01(o.add(r, t), n, i.add(s, c)), a), u)
+    };
+  }
+  mul034({ c0: t, c1: r }, n, s, c) {
+    const { Fp6: o } = this, { Fp2: i } = o, a = o.create({
+      c0: i.mul(t.c0, n),
+      c1: i.mul(t.c1, n),
+      c2: i.mul(t.c2, n)
+    }), u = o.mul01(r, s, c), l = o.mul01(o.add(t, r), i.add(n, s), c);
+    return {
+      c0: o.add(o.mulByNonresidue(u), a),
+      c1: o.sub(l, o.add(a, u))
+    };
+  }
+  // A cyclotomic group is a subgroup of Fp^n defined by
+  //   GΦₙ(p) = {α ∈ Fpⁿ : α^Φₙ(p) = 1}
+  // The result of any pairing is in a cyclotomic subgroup
+  // https://eprint.iacr.org/2009/565.pdf
+  // https://eprint.iacr.org/2010/354.pdf
+  _cyclotomicSquare({ c0: t, c1: r }) {
+    const { Fp6: n } = this, { Fp2: s } = n, { c0: c, c1: o, c2: i } = t, { c0: a, c1: u, c2: l } = r, { first: d, second: f } = s.Fp4Square(c, u), { first: h, second: m } = s.Fp4Square(a, i), { first: g, second: y } = s.Fp4Square(o, l), T = s.mulByNonresidue(y);
+    return {
+      c0: n.create({
+        c0: s.add(s.mul(s.sub(d, c), Q), d),
+        // 2 * (T3 - c0c0)  + T3
+        c1: s.add(s.mul(s.sub(h, o), Q), h),
+        // 2 * (T5 - c0c1)  + T5
+        c2: s.add(s.mul(s.sub(g, i), Q), g)
+      }),
+      // 2 * (T7 - c0c2)  + T7
+      c1: n.create({
+        c0: s.add(s.mul(s.add(T, a), Q), T),
+        // 2 * (T9 + c1c0) + T9
+        c1: s.add(s.mul(s.add(f, u), Q), f),
+        // 2 * (T4 + c1c1) + T4
+        c2: s.add(s.mul(s.add(m, l), Q), m)
+      })
+    };
+  }
+  // https://eprint.iacr.org/2009/565.pdf
+  _cyclotomicExp(t, r) {
+    let n = this.ONE;
+    for (let s = this.X_LEN - 1; s >= 0; s--)
+      n = this._cyclotomicSquare(n), Zr(r, s) && (n = this.mul(n, t));
+    return n;
+  }
+}
+function Ss(e) {
+  const t = Yt(e.ORDER), r = new Es(t, e), n = new Bs(r), s = new _s(n, e);
+  return { Fp: t, Fp2: r, Fp6: n, Fp12: s };
+}
+const j = BigInt(0), be = BigInt(1), st = BigInt(2), pe = BigInt(3), Jt = BigInt(4), _t = BigInt("0xd201000000010000"), As = Wt(_t), qt = {
+  p: BigInt("0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab"),
+  n: BigInt("0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001"),
+  h: BigInt("0x396c8c005555e1568c00aaab0000aaab"),
+  a: j,
+  b: Jt,
+  Gx: BigInt("0x17f1d3a73197d7942695638c4fa9ac0fc3688c4f9774b905a14e3a3f171bac586c55e83ff97a1aeffb3af00adb22c6bb"),
+  Gy: BigInt("0x08b3f481e3aaa0f1a09e30ed741d8ae4fcf5e095d5d00af600db18cb2c04b3edd03cc744a2888ae40caa232946c5e7e1")
+}, vs = Yt(qt.n, {
+  modFromBytes: !0,
+  isLE: !0
+}), { Fp: A, Fp2: D, Fp6: Is, Fp12: k } = Ss({
+  ORDER: qt.p,
+  X_LEN: As,
+  // Finite extension field over irreducible polynominal.
+  // Fp(u) / (u² - β) where β = -1
+  FP2_NONRESIDUE: [be, be],
+  Fp2mulByB: ({ c0: e, c1: t }) => {
+    const r = A.mul(e, Jt), n = A.mul(t, Jt);
+    return { c0: A.sub(r, n), c1: A.add(r, n) };
+  },
+  Fp12finalExponentiate: (e) => {
+    const t = _t, r = k.div(k.frobeniusMap(e, 6), e), n = k.mul(k.frobeniusMap(r, 2), r), s = k.conjugate(k._cyclotomicExp(n, t)), c = k.mul(k.conjugate(k._cyclotomicSquare(n)), s), o = k.conjugate(k._cyclotomicExp(c, t)), i = k.conjugate(k._cyclotomicExp(o, t)), a = k.mul(k.conjugate(k._cyclotomicExp(i, t)), k._cyclotomicSquare(s)), u = k.conjugate(k._cyclotomicExp(a, t)), l = k.frobeniusMap(k.mul(s, i), 2), d = k.frobeniusMap(k.mul(o, n), 3), f = k.frobeniusMap(k.mul(a, k.conjugate(n)), 1), h = k.mul(k.mul(u, k.conjugate(c)), n);
+    return k.mul(k.mul(k.mul(l, d), f), h);
+  }
+}), { G2psi: xn, G2psi2: Os } = xs(A, D, D.div(D.ONE, D.NONRESIDUE)), Ne = Object.freeze({
+  DST: "BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_",
+  encodeDST: "BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_",
+  p: A.ORDER,
+  m: 2,
+  k: 128,
+  expand: "xmd",
+  hash: Mn
+}), We = {
+  p: D.ORDER,
+  n: qt.n,
+  h: BigInt("0x5d543a95414e7f1091d50792876a202cd91de4547085abaa68a205b2e5a7ddfa628f1cb4d9e82ef21537e293a6691ae1616ec6e786f0c70cf1c38e31c7238e5"),
+  a: D.ZERO,
+  b: D.fromBigTuple([Jt, Jt]),
+  Gx: D.fromBigTuple([
+    BigInt("0x024aa2b2f08f0a91260805272dc51051c6e47ad4fa403b02b4510b647ae3d1770bac0326a805bbefd48056c8c121bdb8"),
+    BigInt("0x13e02b6052719f607dacd3a088274f65596bd0d09920b61ab5da61bbdc7f5049334cf11213945d57e5ac7d055d042b7e")
+  ]),
+  Gy: D.fromBigTuple([
+    BigInt("0x0ce5d527727d6e118cc9cdc6da2e351aadfd9baa8cbdd3a76d429a695160d12c923ac9cc3baca289e193548608b82801"),
+    BigInt("0x0606c4a02ea734cc32acd2b02bc28b99cb3e287e85a763af267492ab572e99ab3f370d275cec1da1aaa9075ff05f79be")
+  ])
+}, we = ne(A.toBytes(j), { infinity: !0, compressed: !0 });
+function xe(e) {
+  e = e.slice();
+  const t = e[0] & 224, r = !!(t >> 7 & 1), n = !!(t >> 6 & 1), s = !!(t >> 5 & 1);
+  return e[0] &= 31, { compressed: r, infinity: n, sort: s, value: e };
+}
+function ne(e, t) {
+  if (e[0] & 224)
+    throw new Error("setMask: non-empty mask");
+  return t.compressed && (e[0] |= 128), t.infinity && (e[0] |= 64), t.sort && (e[0] |= 32), e;
+}
+function Ns(e, t, r) {
+  const { BYTES: n, ORDER: s } = A, c = t.is0(), { x: o, y: i } = t.toAffine();
+  if (r) {
+    if (c)
+      return we.slice();
+    const a = !!(i * st / s);
+    return ne(V(o, n), { compressed: !0, sort: a });
+  } else
+    return c ? C(Uint8Array.of(64), new Uint8Array(2 * n - 1)) : C(V(o, n), V(i, n));
+}
+function Te(e) {
+  e.assertValidity();
+  const { BYTES: t, ORDER: r } = A, { x: n, y: s } = e.toAffine();
+  if (e.is0())
+    return we.slice();
+  const c = !!(s * st / r);
+  return ne(V(n, t), { compressed: !0, sort: c });
+}
+function Ts(e) {
+  const { compressed: t, infinity: r, sort: n, value: s } = xe(e), { BYTES: c, ORDER: o } = A;
+  if (s.length === 48 && t) {
+    const i = dt(s), a = A.create(i & Rt(A.BITS));
+    if (r) {
+      if (a !== j)
+        throw new Error("invalid G1 point: non-empty, at infinity, with compression");
+      return { x: j, y: j };
+    }
+    const u = A.add(A.pow(a, pe), A.create(qt.b));
+    let l = A.sqrt(u);
+    if (!l)
+      throw new Error("invalid G1 point: compressed point");
+    return l * st / o !== BigInt(n) && (l = A.neg(l)), { x: A.create(a), y: A.create(l) };
+  } else if (s.length === 96 && !t) {
+    const i = dt(s.subarray(0, c)), a = dt(s.subarray(c));
+    if (r) {
+      if (i !== j || a !== j)
+        throw new Error("G1: non-empty point at infinity");
+      return P.G1.Point.ZERO.toAffine();
+    }
+    return { x: A.create(i), y: A.create(a) };
+  } else
+    throw new Error("invalid G1 point: expected 48/96 bytes");
+}
+function En(e) {
+  const { infinity: t, sort: r, value: n } = xe(Ft("signatureHex", e, 48)), s = A.ORDER, c = P.G1.Point, o = dt(n);
+  if (t)
+    return c.ZERO;
+  const i = A.create(o & Rt(A.BITS)), a = A.add(A.pow(i, pe), A.create(qt.b));
+  let u = A.sqrt(a);
+  if (!u)
+    throw new Error("invalid G1 point: compressed");
+  const l = BigInt(r);
+  u * st / s !== l && (u = A.neg(u));
+  const d = c.fromAffine({ x: i, y: u });
+  return d.assertValidity(), d;
+}
+function qs(e, t, r) {
+  const { BYTES: n, ORDER: s } = A, c = t.is0(), { x: o, y: i } = t.toAffine();
+  if (r) {
+    if (c)
+      return C(we, V(j, n));
+    const a = !!(i.c1 === j ? i.c0 * st / s : i.c1 * st / s);
+    return C(ne(V(o.c1, n), { compressed: !0, sort: a }), V(o.c0, n));
+  } else {
+    if (c)
+      return C(Uint8Array.of(64), new Uint8Array(4 * n - 1));
+    const { re: a, im: u } = D.reim(o), { re: l, im: d } = D.reim(i);
+    return C(V(u, n), V(a, n), V(d, n), V(l, n));
+  }
+}
+function qe(e) {
+  e.assertValidity();
+  const { BYTES: t } = A;
+  if (e.is0())
+    return C(we, V(j, t));
+  const { x: r, y: n } = e.toAffine(), { re: s, im: c } = D.reim(r), { re: o, im: i } = D.reim(n), u = !!((i > j ? i * st : o * st) / A.ORDER & be), l = s;
+  return C(ne(V(c, t), { sort: u, compressed: !0 }), V(l, t));
+}
+function Rs(e) {
+  const { BYTES: t, ORDER: r } = A, { compressed: n, infinity: s, sort: c, value: o } = xe(e);
+  if (!n && !s && c || // 00100000
+  !n && s && c || // 01100000
+  c && s && n)
+    throw new Error("invalid encoding flag: " + (e[0] & 224));
+  const i = (a, u, l) => dt(a.slice(u, l));
+  if (o.length === 96 && n) {
+    if (s) {
+      if (o.reduce((m, g) => m !== 0 ? g + 1 : g, 0) > 0)
+        throw new Error("invalid G2 point: compressed");
+      return { x: D.ZERO, y: D.ZERO };
+    }
+    const a = i(o, 0, t), u = i(o, t, 2 * t), l = D.create({ c0: A.create(u), c1: A.create(a) }), d = D.add(D.pow(l, pe), We.b);
+    let f = D.sqrt(d);
+    const h = f.c1 === j ? f.c0 * st / r : f.c1 * st / r ? be : j;
+    return f = c && h > 0 ? f : D.neg(f), { x: l, y: f };
+  } else if (o.length === 192 && !n) {
+    if (s) {
+      if (o.reduce((f, h) => f !== 0 ? h + 1 : h, 0) > 0)
+        throw new Error("invalid G2 point: uncompressed");
+      return { x: D.ZERO, y: D.ZERO };
+    }
+    const a = i(o, 0 * t, 1 * t), u = i(o, 1 * t, 2 * t), l = i(o, 2 * t, 3 * t), d = i(o, 3 * t, 4 * t);
+    return { x: D.fromBigTuple([u, a]), y: D.fromBigTuple([d, l]) };
+  } else
+    throw new Error("invalid G2 point: expected 96/192 bytes");
+}
+function Bn(e) {
+  const { ORDER: t } = A, { infinity: r, sort: n, value: s } = xe(Ft("signatureHex", e)), c = P.G2.Point, o = s.length / 2;
+  if (o !== 48 && o !== 96)
+    throw new Error("invalid compressed signature length, expected 96/192 bytes");
+  const i = dt(s.slice(0, o)), a = dt(s.slice(o));
+  if (r)
+    return c.ZERO;
+  const u = A.create(i & Rt(A.BITS)), l = A.create(a), d = D.create({ c0: l, c1: u }), f = D.add(D.pow(d, pe), We.b);
+  let h = D.sqrt(f);
+  if (!h)
+    throw new Error("Failed to find a square root");
+  const { re: m, im: g } = D.reim(h), y = BigInt(n), T = g > j && g * st / t !== y, R = g === j && m * st / t !== y;
+  (T || R) && (h = D.neg(h));
+  const p = c.fromAffine({ x: d, y: h });
+  return p.assertValidity(), p;
+}
+const P = ws({
+  // Fields
+  fields: {
+    Fp: A,
+    Fp2: D,
+    Fp6: Is,
+    Fp12: k,
+    Fr: vs
+  },
+  // G1: y² = x³ + 4
+  G1: {
+    ...qt,
+    Fp: A,
+    htfDefaults: { ...Ne, m: 1, DST: "BLS_SIG_BLS12381G1_XMD:SHA-256_SSWU_RO_NUL_" },
+    wrapPrivateKey: !0,
+    allowInfinityPoint: !0,
+    // Checks is the point resides in prime-order subgroup.
+    // point.isTorsionFree() should return true for valid points
+    // It returns false for shitty points.
+    // https://eprint.iacr.org/2021/1130.pdf
+    isTorsionFree: (e, t) => {
+      const r = BigInt("0x5f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe"), n = new e(A.mul(t.X, r), t.Y, t.Z);
+      return t.multiplyUnsafe(_t).negate().multiplyUnsafe(_t).equals(n);
+    },
+    // Clear cofactor of G1
+    // https://eprint.iacr.org/2019/403
+    clearCofactor: (e, t) => t.multiplyUnsafe(_t).add(t),
+    mapToCurve: Ds,
+    fromBytes: Ts,
+    toBytes: Ns,
+    ShortSignature: {
+      fromBytes(e) {
+        return J(e), En(e);
+      },
+      fromHex(e) {
+        return En(e);
+      },
+      toBytes(e) {
+        return Te(e);
+      },
+      toRawBytes(e) {
+        return Te(e);
+      },
+      toHex(e) {
+        return Xt(Te(e));
+      }
+    }
+  },
+  G2: {
+    ...We,
+    Fp: D,
+    // https://datatracker.ietf.org/doc/html/rfc9380#name-clearing-the-cofactor
+    // https://datatracker.ietf.org/doc/html/rfc9380#name-cofactor-clearing-for-bls12
+    hEff: BigInt("0xbc69f08f2ee75b3584c6a0ea91b352888e2a8e9145ad7689986ff031508ffe1329c2f178731db956d82bf015d1212b02ec0ec69d7477c1ae954cbc06689f6a359894c0adebbf6b4e8020005aaa95551"),
+    htfDefaults: { ...Ne },
+    wrapPrivateKey: !0,
+    allowInfinityPoint: !0,
+    mapToCurve: ks,
+    // Checks is the point resides in prime-order subgroup.
+    // point.isTorsionFree() should return true for valid points
+    // It returns false for shitty points.
+    // https://eprint.iacr.org/2021/1130.pdf
+    // Older version: https://eprint.iacr.org/2019/814.pdf
+    isTorsionFree: (e, t) => t.multiplyUnsafe(_t).negate().equals(xn(e, t)),
+    // Maps the point into the prime-order subgroup G2.
+    // clear_cofactor_bls12381_g2 from RFC 9380.
+    // https://eprint.iacr.org/2017/419.pdf
+    // prettier-ignore
+    clearCofactor: (e, t) => {
+      const r = _t;
+      let n = t.multiplyUnsafe(r).negate(), s = xn(e, t), c = t.double();
+      return c = Os(e, c), c = c.subtract(s), s = n.add(s), s = s.multiplyUnsafe(r).negate(), c = c.add(s), c = c.subtract(n), c.subtract(t);
+    },
+    fromBytes: Rs,
+    toBytes: qs,
+    Signature: {
+      fromBytes(e) {
+        return J(e), Bn(e);
+      },
+      fromHex(e) {
+        return Bn(e);
+      },
+      toBytes(e) {
+        return qe(e);
+      },
+      toRawBytes(e) {
+        return qe(e);
+      },
+      toHex(e) {
+        return Xt(qe(e));
+      }
+    }
+  },
+  params: {
+    ateLoopSize: _t,
+    // The BLS parameter x for BLS12-381
+    r: qt.n,
+    // order; z⁴ − z² + 1; CURVE.n from other curves
+    xNegative: !0,
+    twistType: "multiplicative"
+  },
+  htfDefaults: Ne
+}), Hs = cr(D, [
+  // xNum
+  [
+    [
+      "0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97d6",
+      "0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97d6"
+    ],
+    [
+      "0x0",
+      "0x11560bf17baa99bc32126fced787c88f984f87adf7ae0c7f9a208c6b4f20a4181472aaa9cb8d555526a9ffffffffc71a"
+    ],
+    [
+      "0x11560bf17baa99bc32126fced787c88f984f87adf7ae0c7f9a208c6b4f20a4181472aaa9cb8d555526a9ffffffffc71e",
+      "0x8ab05f8bdd54cde190937e76bc3e447cc27c3d6fbd7063fcd104635a790520c0a395554e5c6aaaa9354ffffffffe38d"
+    ],
+    [
+      "0x171d6541fa38ccfaed6dea691f5fb614cb14b4e7f4e810aa22d6108f142b85757098e38d0f671c7188e2aaaaaaaa5ed1",
+      "0x0"
+    ]
+  ],
+  // xDen
+  [
+    [
+      "0x0",
+      "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa63"
+    ],
+    [
+      "0xc",
+      "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa9f"
+    ],
+    ["0x1", "0x0"]
+    // LAST 1
+  ],
+  // yNum
+  [
+    [
+      "0x1530477c7ab4113b59a4c18b076d11930f7da5d4a07f649bf54439d87d27e500fc8c25ebf8c92f6812cfc71c71c6d706",
+      "0x1530477c7ab4113b59a4c18b076d11930f7da5d4a07f649bf54439d87d27e500fc8c25ebf8c92f6812cfc71c71c6d706"
+    ],
+    [
+      "0x0",
+      "0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97be"
+    ],
+    [
+      "0x11560bf17baa99bc32126fced787c88f984f87adf7ae0c7f9a208c6b4f20a4181472aaa9cb8d555526a9ffffffffc71c",
+      "0x8ab05f8bdd54cde190937e76bc3e447cc27c3d6fbd7063fcd104635a790520c0a395554e5c6aaaa9354ffffffffe38f"
+    ],
+    [
+      "0x124c9ad43b6cf79bfbf7043de3811ad0761b0f37a1e26286b0e977c69aa274524e79097a56dc4bd9e1b371c71c718b10",
+      "0x0"
+    ]
+  ],
+  // yDen
+  [
+    [
+      "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffa8fb",
+      "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffa8fb"
+    ],
+    [
+      "0x0",
+      "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffa9d3"
+    ],
+    [
+      "0x12",
+      "0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa99"
+    ],
+    ["0x1", "0x0"]
+    // LAST 1
+  ]
+].map((e) => e.map((t) => D.fromBigTuple(t.map(BigInt))))), Gs = cr(A, [
+  // xNum
+  [
+    "0x11a05f2b1e833340b809101dd99815856b303e88a2d7005ff2627b56cdb4e2c85610c2d5f2e62d6eaeac1662734649b7",
+    "0x17294ed3e943ab2f0588bab22147a81c7c17e75b2f6a8417f565e33c70d1e86b4838f2a6f318c356e834eef1b3cb83bb",
+    "0xd54005db97678ec1d1048c5d10a9a1bce032473295983e56878e501ec68e25c958c3e3d2a09729fe0179f9dac9edcb0",
+    "0x1778e7166fcc6db74e0609d307e55412d7f5e4656a8dbf25f1b33289f1b330835336e25ce3107193c5b388641d9b6861",
+    "0xe99726a3199f4436642b4b3e4118e5499db995a1257fb3f086eeb65982fac18985a286f301e77c451154ce9ac8895d9",
+    "0x1630c3250d7313ff01d1201bf7a74ab5db3cb17dd952799b9ed3ab9097e68f90a0870d2dcae73d19cd13c1c66f652983",
+    "0xd6ed6553fe44d296a3726c38ae652bfb11586264f0f8ce19008e218f9c86b2a8da25128c1052ecaddd7f225a139ed84",
+    "0x17b81e7701abdbe2e8743884d1117e53356de5ab275b4db1a682c62ef0f2753339b7c8f8c8f475af9ccb5618e3f0c88e",
+    "0x80d3cf1f9a78fc47b90b33563be990dc43b756ce79f5574a2c596c928c5d1de4fa295f296b74e956d71986a8497e317",
+    "0x169b1f8e1bcfa7c42e0c37515d138f22dd2ecb803a0c5c99676314baf4bb1b7fa3190b2edc0327797f241067be390c9e",
+    "0x10321da079ce07e272d8ec09d2565b0dfa7dccdde6787f96d50af36003b14866f69b771f8c285decca67df3f1605fb7b",
+    "0x6e08c248e260e70bd1e962381edee3d31d79d7e22c837bc23c0bf1bc24c6b68c24b1b80b64d391fa9c8ba2e8ba2d229"
+  ],
+  // xDen
+  [
+    "0x8ca8d548cff19ae18b2e62f4bd3fa6f01d5ef4ba35b48ba9c9588617fc8ac62b558d681be343df8993cf9fa40d21b1c",
+    "0x12561a5deb559c4348b4711298e536367041e8ca0cf0800c0126c2588c48bf5713daa8846cb026e9e5c8276ec82b3bff",
+    "0xb2962fe57a3225e8137e629bff2991f6f89416f5a718cd1fca64e00b11aceacd6a3d0967c94fedcfcc239ba5cb83e19",
+    "0x3425581a58ae2fec83aafef7c40eb545b08243f16b1655154cca8abc28d6fd04976d5243eecf5c4130de8938dc62cd8",
+    "0x13a8e162022914a80a6f1d5f43e7a07dffdfc759a12062bb8d6b44e833b306da9bd29ba81f35781d539d395b3532a21e",
+    "0xe7355f8e4e667b955390f7f0506c6e9395735e9ce9cad4d0a43bcef24b8982f7400d24bc4228f11c02df9a29f6304a5",
+    "0x772caacf16936190f3e0c63e0596721570f5799af53a1894e2e073062aede9cea73b3538f0de06cec2574496ee84a3a",
+    "0x14a7ac2a9d64a8b230b3f5b074cf01996e7f63c21bca68a81996e1cdf9822c580fa5b9489d11e2d311f7d99bbdcc5a5e",
+    "0xa10ecf6ada54f825e920b3dafc7a3cce07f8d1d7161366b74100da67f39883503826692abba43704776ec3a79a1d641",
+    "0x95fc13ab9e92ad4476d6e3eb3a56680f682b4ee96f7d03776df533978f31c1593174e4b4b7865002d6384d168ecdd0a",
+    "0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"
+    // LAST 1
+  ],
+  // yNum
+  [
+    "0x90d97c81ba24ee0259d1f094980dcfa11ad138e48a869522b52af6c956543d3cd0c7aee9b3ba3c2be9845719707bb33",
+    "0x134996a104ee5811d51036d776fb46831223e96c254f383d0f906343eb67ad34d6c56711962fa8bfe097e75a2e41c696",
+    "0xcc786baa966e66f4a384c86a3b49942552e2d658a31ce2c344be4b91400da7d26d521628b00523b8dfe240c72de1f6",
+    "0x1f86376e8981c217898751ad8746757d42aa7b90eeb791c09e4a3ec03251cf9de405aba9ec61deca6355c77b0e5f4cb",
+    "0x8cc03fdefe0ff135caf4fe2a21529c4195536fbe3ce50b879833fd221351adc2ee7f8dc099040a841b6daecf2e8fedb",
+    "0x16603fca40634b6a2211e11db8f0a6a074a7d0d4afadb7bd76505c3d3ad5544e203f6326c95a807299b23ab13633a5f0",
+    "0x4ab0b9bcfac1bbcb2c977d027796b3ce75bb8ca2be184cb5231413c4d634f3747a87ac2460f415ec961f8855fe9d6f2",
+    "0x987c8d5333ab86fde9926bd2ca6c674170a05bfe3bdd81ffd038da6c26c842642f64550fedfe935a15e4ca31870fb29",
+    "0x9fc4018bd96684be88c9e221e4da1bb8f3abd16679dc26c1e8b6e6a1f20cabe69d65201c78607a360370e577bdba587",
+    "0xe1bba7a1186bdb5223abde7ada14a23c42a0ca7915af6fe06985e7ed1e4d43b9b3f7055dd4eba6f2bafaaebca731c30",
+    "0x19713e47937cd1be0dfd0b8f1d43fb93cd2fcbcb6caf493fd1183e416389e61031bf3a5cce3fbafce813711ad011c132",
+    "0x18b46a908f36f6deb918c143fed2edcc523559b8aaf0c2462e6bfe7f911f643249d9cdf41b44d606ce07c8a4d0074d8e",
+    "0xb182cac101b9399d155096004f53f447aa7b12a3426b08ec02710e807b4633f06c851c1919211f20d4c04f00b971ef8",
+    "0x245a394ad1eca9b72fc00ae7be315dc757b3b080d4c158013e6632d3c40659cc6cf90ad1c232a6442d9d3f5db980133",
+    "0x5c129645e44cf1102a159f748c4a3fc5e673d81d7e86568d9ab0f5d396a7ce46ba1049b6579afb7866b1e715475224b",
+    "0x15e6be4e990f03ce4ea50b3b42df2eb5cb181d8f84965a3957add4fa95af01b2b665027efec01c7704b456be69c8b604"
+  ],
+  // yDen
+  [
+    "0x16112c4c3a9c98b252181140fad0eae9601a6de578980be6eec3232b5be72e7a07f3688ef60c206d01479253b03663c1",
+    "0x1962d75c2381201e1a0cbd6c43c348b885c84ff731c4d59ca4a10356f453e01f78a4260763529e3532f6102c2e49a03d",
+    "0x58df3306640da276faaae7d6e8eb15778c4855551ae7f310c35a5dd279cd2eca6757cd636f96f891e2538b53dbf67f2",
+    "0x16b7d288798e5395f20d23bf89edb4d1d115c5dbddbcd30e123da489e726af41727364f2c28297ada8d26d98445f5416",
+    "0xbe0e079545f43e4b00cc912f8228ddcc6d19c9f0f69bbb0542eda0fc9dec916a20b15dc0fd2ededda39142311a5001d",
+    "0x8d9e5297186db2d9fb266eaac783182b70152c65550d881c5ecd87b6f0f5a6449f38db9dfa9cce202c6477faaf9b7ac",
+    "0x166007c08a99db2fc3ba8734ace9824b5eecfdfa8d0cf8ef5dd365bc400a0051d5fa9c01a58b1fb93d1a1399126a775c",
+    "0x16a3ef08be3ea7ea03bcddfabba6ff6ee5a4375efa1f4fd7feb34fd206357132b920f5b00801dee460ee415a15812ed9",
+    "0x1866c8ed336c61231a1be54fd1d74cc4f9fb0ce4c6af5920abc5750c4bf39b4852cfe2f7bb9248836b233d9d55535d4a",
+    "0x167a55cda70a6e1cea820597d94a84903216f763e13d87bb5308592e7ea7d4fbc7385ea3d529b35e346ef48bb8913f55",
+    "0x4d2f259eea405bd48f010a01ad2911d9c6dd039bb61a6290e591b36e636a5c871a5c29f4f83060400f8b49cba8f6aa8",
+    "0xaccbb67481d033ff5852c1e48c50c477f94ff8aefce42d28c0f9a88cea7913516f968986f7ebbea9684b529e2561092",
+    "0xad6b9514c767fe3c3613144b45f1496543346d98adf02267d5ceef9a00d9b8693000763e3b90ac11e99b138573345cc",
+    "0x2660400eb2e4f3b628bdd0d53cd76f2bf565b94e72927c1cb748df27942480e420517bd8714cc80d1fadc1326ed06f7",
+    "0xe0fa1d816ddc03e6b24255e0d7819c171c40f65e273b853324efcd6356caa205ca2f570f13497804415473a1d634b8f",
+    "0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"
+    // LAST 1
+  ]
+].map((e) => e.map((t) => BigInt(t)))), Us = ir(A, {
+  A: A.create(BigInt("0x144698a3b8e9433d693a02c96d4982b0ea985383ee66a8d8e8981aefd881ac98936f8da0e0f97f5cf428082d584c1d")),
+  B: A.create(BigInt("0x12e2908d11688030018b12e8753eee3b2016c1f0f24f4070a0b9c14fcef35ef55a23215a316ceaa5d1cc48e98e172be0")),
+  Z: A.create(BigInt(11))
+}), Ls = ir(D, {
+  A: D.create({ c0: A.create(j), c1: A.create(BigInt(240)) }),
+  // A' = 240 * I
+  B: D.create({ c0: A.create(BigInt(1012)), c1: A.create(BigInt(1012)) }),
+  // B' = 1012 * (1 + I)
+  Z: D.create({ c0: A.create(BigInt(-2)), c1: A.create(BigInt(-1)) })
+  // Z: -(2 + I)
+});
+function Ds(e) {
+  const { x: t, y: r } = Us(A.create(e[0]));
+  return Gs(t, r);
+}
+function ks(e) {
+  const { x: t, y: r } = Ls(D.fromBigTuple(e));
+  return Hs(t, r);
+}
+const Ps = BigInt(0), Vt = BigInt(1), Ms = BigInt(2), Zs = BigInt(7), Ks = BigInt(256), Fs = BigInt(113), ar = [], fr = [], dr = [];
+for (let e = 0, t = Vt, r = 1, n = 0; e < 24; e++) {
+  [r, n] = [n, (2 * r + 3 * n) % 5], ar.push(2 * (5 * n + r)), fr.push((e + 1) * (e + 2) / 2 % 64);
+  let s = Ps;
+  for (let c = 0; c < 7; c++)
+    t = (t << Vt ^ (t >> Zs) * Fs) % Ks, t & Ms && (s ^= Vt << (Vt << /* @__PURE__ */ BigInt(c)) - Vt);
+  dr.push(s);
+}
+const ur = Dn(dr, !0), Cs = ur[0], Ys = ur[1], _n = (e, t, r) => r > 32 ? Or(e, t, r) : vr(e, t, r), Sn = (e, t, r) => r > 32 ? Nr(e, t, r) : Ir(e, t, r);
+function Vs(e, t = 24) {
+  const r = new Uint32Array(10);
+  for (let n = 24 - t; n < 24; n++) {
+    for (let o = 0; o < 10; o++)
+      r[o] = e[o] ^ e[o + 10] ^ e[o + 20] ^ e[o + 30] ^ e[o + 40];
+    for (let o = 0; o < 10; o += 2) {
+      const i = (o + 8) % 10, a = (o + 2) % 10, u = r[a], l = r[a + 1], d = _n(u, l, 1) ^ r[i], f = Sn(u, l, 1) ^ r[i + 1];
+      for (let h = 0; h < 50; h += 10)
+        e[o + h] ^= d, e[o + h + 1] ^= f;
+    }
+    let s = e[2], c = e[3];
+    for (let o = 0; o < 24; o++) {
+      const i = fr[o], a = _n(s, c, i), u = Sn(s, c, i), l = ar[o];
+      s = e[l], c = e[l + 1], e[l] = a, e[l + 1] = u;
+    }
+    for (let o = 0; o < 50; o += 10) {
+      for (let i = 0; i < 10; i++)
+        r[i] = e[o + i];
+      for (let i = 0; i < 10; i++)
+        e[o + i] ^= ~r[(i + 2) % 10] & r[(i + 4) % 10];
+    }
+    e[0] ^= Cs[n], e[1] ^= Ys[n];
+  }
+  mt(r);
+}
+class Qe extends Ce {
+  // NOTE: we accept arguments in bytes instead of bits here.
+  constructor(t, r, n, s = !1, c = 24) {
+    if (super(), this.pos = 0, this.posOut = 0, this.finished = !1, this.destroyed = !1, this.enableXOF = !1, this.blockLen = t, this.suffix = r, this.outputLen = n, this.enableXOF = s, this.rounds = c, Zt(n), !(0 < t && t < 200))
+      throw new Error("only keccak-f1600 function is supported");
+    this.state = new Uint8Array(200), this.state32 = mr(this.state);
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  keccak() {
+    tn(this.state32), Vs(this.state32, this.rounds), tn(this.state32), this.posOut = 0, this.pos = 0;
+  }
+  update(t) {
+    Kt(this), t = Tt(t), J(t);
+    const { blockLen: r, state: n } = this, s = t.length;
+    for (let c = 0; c < s; ) {
+      const o = Math.min(r - this.pos, s - c);
+      for (let i = 0; i < o; i++)
+        n[this.pos++] ^= t[c++];
+      this.pos === r && this.keccak();
+    }
+    return this;
+  }
+  finish() {
+    if (this.finished)
+      return;
+    this.finished = !0;
+    const { state: t, suffix: r, pos: n, blockLen: s } = this;
+    t[n] ^= r, (r & 128) !== 0 && n === s - 1 && this.keccak(), t[s - 1] ^= 128, this.keccak();
+  }
+  writeInto(t) {
+    Kt(this, !1), J(t), this.finish();
+    const r = this.state, { blockLen: n } = this;
+    for (let s = 0, c = t.length; s < c; ) {
+      this.posOut >= n && this.keccak();
+      const o = Math.min(n - this.posOut, c - s);
+      t.set(r.subarray(this.posOut, this.posOut + o), s), this.posOut += o, s += o;
+    }
+    return t;
+  }
+  xofInto(t) {
+    if (!this.enableXOF)
+      throw new Error("XOF is not possible for this instance");
+    return this.writeInto(t);
+  }
+  xof(t) {
+    return Zt(t), this.xofInto(new Uint8Array(t));
+  }
+  digestInto(t) {
+    if (Hn(t, this), this.finished)
+      throw new Error("digest() was already called");
+    return this.writeInto(t), this.destroy(), t;
+  }
+  digest() {
+    return this.digestInto(new Uint8Array(this.outputLen));
+  }
+  destroy() {
+    this.destroyed = !0, mt(this.state);
+  }
+  _cloneInto(t) {
+    const { blockLen: r, suffix: n, outputLen: s, rounds: c, enableXOF: o } = this;
+    return t || (t = new Qe(r, n, s, o, c)), t.state32.set(this.state32), t.pos = this.pos, t.posOut = this.posOut, t.finished = this.finished, t.rounds = c, t.suffix = n, t.outputLen = s, t.enableXOF = o, t.destroyed = this.destroyed, t;
+  }
+}
+const zs = (e, t, r) => xr((n = {}) => new Qe(t, e, n.dkLen === void 0 ? r : n.dkLen, !0)), $s = zs(31, 136, 256 / 8);
+function js(e, t, r) {
+  return Fe(e), r === void 0 && (r = new Uint8Array(e.outputLen)), je(e, Tt(r), Tt(t));
+}
+const Re = /* @__PURE__ */ Uint8Array.from([0]), An = /* @__PURE__ */ Uint8Array.of();
+function Xs(e, t, r, n = 32) {
+  Fe(e), Zt(n);
+  const s = e.outputLen;
+  if (n > 255 * s)
+    throw new Error("Length should be <= 255*HashLen");
+  const c = Math.ceil(n / s);
+  r === void 0 && (r = An);
+  const o = new Uint8Array(c * s), i = je.create(e, t), a = i._cloneInto(), u = new Uint8Array(i.outputLen);
+  for (let l = 0; l < c; l++)
+    Re[0] = l + 1, a.update(l === 0 ? An : u).update(r).update(Re).digestInto(u), o.set(u, s * l), i._cloneInto(a);
+  return i.destroy(), a.destroy(), mt(u, Re), o.slice(0, n);
+}
+const Ws = (e, t, r, n, s) => Xs(e, js(e, t, r), n, s), it = 48, rt = 96;
+class De {
+  #t;
+  #e;
+  /**
+   * Create a random transport secret key
+   */
+  static random() {
+    return new De(P.utils.randomSecretKey());
+  }
+  /**
+   * Deserialize TransportSecretKey from a bytestring
+   *
+   * The passed value would typically be a string previously returned
+   * by calling serialize on a randomly-created TransportSecretKey.
+   */
+  static deserialize(t) {
+    if (t.length !== 32)
+      throw new Error("Invalid size for transport secret key");
+    return new De(t);
+  }
+  /**
+   * Return the encoding of the transport public key; this value is
+   * sent to the IC
+   */
+  publicKeyBytes() {
+    return this.#e.toBytes(!0);
+  }
+  /**
+   * Return the transport secret key value
+   *
+   * Applications would not normally need to call this
+   */
+  serialize() {
+    return this.#t;
+  }
+  /**
+   * @internal constructor
+   */
+  constructor(t) {
+    this.#t = t;
+    const r = P.G1.Point.BASE.multiply(
+      P.G1.Point.Fn.fromBytes(this.#t)
+    );
+    this.#e = r;
+  }
+}
+function ac(e) {
+  if (e.length != 48)
+    return !1;
+  try {
+    return P.G1.Point.fromHex(e), !0;
+  } catch {
+    return !1;
+  }
+}
+function Nt(e) {
+  let t = e.length;
+  const r = new Uint8Array(8 + t);
+  for (let n = 7; n >= 0; n--)
+    r[n] = t & 255, t >>>= 8;
+  return r.set(e, 8), r;
+}
+var Qs = /* @__PURE__ */ ((e) => (e.KEY_1 = "key_1", e.TEST_KEY_1 = "test_key_1", e))(Qs || {}), Js = /* @__PURE__ */ ((e) => (e.KEY_1 = "key_1", e.TEST_KEY_1 = "test_key_1", e.DFX_TEST_KEY = "dfx_test_key", e))(Js || {});
+function zt(e) {
+  const t = new Uint8Array(e.length / 2);
+  for (let r = 0; r < e.length; r += 2)
+    t[r / 2] = parseInt(e.substring(r, r + 2), 16);
+  return t;
+}
+class At {
+  #t;
+  /**
+   * Read a MasterPublicKey from the bytestring encoding
+   *
+   * Normally the bytes provided here will have been returned by
+   * the `vetkd_public_key` management canister interface.
+   */
+  static deserialize(t) {
+    return new At(P.G2.Point.fromHex(t));
+  }
+  /**
+   * Derive a canister master key from the subnet master key
+   *
+   * To create the derived public key in VetKD, a two step derivation is performed. The first step
+   * creates a key that is specific to the canister that is making VetKD requests to the
+   * management canister, sometimes called canister master key.
+   *
+   * This function can be used to compute canister master keys knowing just the subnet master key
+   * plus the canister identity. This avoids having to interact with the IC for performing this
+   * computation.
+   */
+  deriveCanisterKey(t) {
+    const r = "ic-vetkd-bls12-381-g2-canister-id", n = this.publicKeyBytes(), s = new Uint8Array([
+      ...Nt(n),
+      ...Nt(t)
+    ]), c = Je(s, r), o = P.G2.Point.BASE.multiply(c);
+    return new te(this.#t.add(o));
+  }
+  /**
+   * Return the bytestring encoding of the master public key
+   */
+  publicKeyBytes() {
+    return this.#t.toBytes(!0);
+  }
+  /**
+   * Return the hardcoded master public key used on IC
+   *
+   * This allows performing public key derivation offline
+   */
+  static productionKey(t = "key_1") {
+    if (t == "key_1")
+      return At.deserialize(
+        zt(
+          "a9caf9ae8af0c7c7272f8a122133e2e0c7c0899b75e502bda9e109ca8193ded3ef042ed96db1125e1bdaad77d8cc60d917e122fe2501c45b96274f43705edf0cfd455bc66c3c060faa2fcd15486e76351edf91fecb993797273bbc8beaa47404"
+        )
+      );
+    if (t == "test_key_1")
+      return At.deserialize(
+        zt(
+          "ad86e8ff845912f022a0838a502d763fdea547c9948f8cb20ea7738dd52c1c38dcb4c6ca9ac29f9ac690fc5ad7681cb41922b8dffbd65d94bff141f5fb5b6624eccc03bf850f222052df888cf9b1e47203556d7522271cbb879b2ef4b8c2bfb1"
+        )
+      );
+    throw new Error(
+      "Unknown MasterPublicKeyId value for productionKey"
+    );
+  }
+  /**
+   * Return the hardcoded master public key used in PocketIC
+   *
+   * This allows performing public key derivation offline
+   */
+  static pocketicKey(t = "key_1") {
+    if (t == "key_1")
+      return At.deserialize(
+        zt(
+          "8c800b5cff00463d26e8167369168827f1e48f4d8d60f71dd6a295580f65275b5f5f8e6a792c876b2c72492136530d0710a27522ee63977a76216c3cef9e70bfcb45b88736fc62142e7e0737848ce06cbb1f45a4a6a349b142ae5cf7853561e0"
+        )
+      );
+    if (t == "test_key_1")
+      return At.deserialize(
+        zt(
+          "9069b82c7aae418cef27678291e7f2cb1a008a500eceba7199bffca12421b07c158987c6a22618af3d1958738b2835691028801f7663d311799733286c557c8979184bb62cb559a4d582fca7d2e48b860f08ed6641aef66a059ec891889a6218"
+        )
+      );
+    if (t == "dfx_test_key")
+      return At.deserialize(
+        zt(
+          "b181c14cf9d04ba45d782c0067a44b0aaa9fc2acf94f1a875f0dae801af4f80339a7e6bf8b09fcf993824c8df3080b3f1409b688ca08cbd44d2cb28db9899f4aa3b5f06b9174240448e10be2f01f9f80079ea5431ce2d11d1c8d1c775333315f"
+        )
+      );
+    throw new Error(
+      "Unknown PocketIcMasterPublicKeyId value for pocketicKey"
+    );
+  }
+  /**
+   * @internal constructor
+   */
+  constructor(t) {
+    this.#t = t;
+  }
+}
+class te {
+  #t;
+  /**
+   * Read a DerivedPublicKey from the bytestring encoding
+   *
+   * Normally the bytes provided here will have been returned by
+   * the `vetkd_public_key` management canister interface.
+   */
+  static deserialize(t) {
+    return new te(P.G2.Point.fromHex(t));
+  }
+  /**
+   * Perform second-stage derivation of a public key
+   *
+   * To create the derived public key in VetKD, a two step derivation is performed. The first step
+   * creates a key that is specific to the canister that is making VetKD requests to the
+   * management canister, sometimes called canister master key. The second step incorporates the
+   * "derivation context" value provided to the `vetkd_public_key` management canister interface.
+   *
+   * If `vetkd_public_key` is invoked with an empty derivation context, it simply returns the
+   * canister master key. Then the second derivation step can be done offline, using this
+   * function. This is useful if you wish to derive multiple keys without having to interact with
+   * the IC each time.
+   *
+   * If `context` is empty, then this simply returns the underlying key. This matches the behavior
+   * of `vetkd_public_key`
+   */
+  deriveSubKey(t) {
+    if (t.length === 0)
+      return this;
+    {
+      const r = "ic-vetkd-bls12-381-g2-context", n = this.publicKeyBytes(), s = new Uint8Array([
+        ...Nt(n),
+        ...Nt(t)
+      ]), c = Je(s, r), o = P.G2.Point.BASE.multiply(c);
+      return new te(this.getPoint().add(o));
+    }
+  }
+  /**
+   * Return the bytestring encoding of the derived public key
+   *
+   * Applications would not normally need to call this, unless they
+   * are using VetKD for creating a random beacon, in which case
+   * these bytes are used by anyone verifying the beacon.
+   */
+  publicKeyBytes() {
+    return this.#t.toBytes(!0);
+  }
+  /**
+   * @internal getter returning the point element of the derived public key
+   *
+   * Applications would not normally need to call this
+   */
+  getPoint() {
+    return this.#t;
+  }
+  /**
+   * @internal constructor
+   *
+   * This is public for typing reasons but there should be no need
+   * for an application to call this.
+   */
+  constructor(t) {
+    this.#t = t;
+  }
+}
+function Je(e, t) {
+  return P.G2.hashToScalar(e, { DST: t });
+}
+function ke(e) {
+  if (typeof e == "string")
+    return new TextEncoder().encode(e);
+  const t = new Uint8Array(e.length);
+  return t.set(e), t;
+}
+function He(e, t) {
+  const r = new TextEncoder().encode(e), n = ke(t), s = new Uint8Array(r.length + n.length);
+  return s.set(r, 0), s.set(n, r.length), s;
+}
+function re(e, t, r) {
+  const n = new Uint8Array();
+  return Ws(Mn, e, n, t, r);
+}
+function tc(e, t) {
+  const r = "BLS_SIG_BLS12381G1_XMD:SHA-256_SSWU_RO_AUG_", n = e.publicKeyBytes(), s = new Uint8Array([...n, ...t]);
+  return P.G1.Point.fromAffine(
+    P.G1.hashToCurve(s, {
+      DST: r
+    }).toAffine()
+  );
+}
+function lr(e, t, r) {
+  const n = e.publicKeyBytes(), s = new Uint8Array([...n, ...t]), o = P.shortSignatures.hash(
+    s,
+    "BLS_SIG_BLS12381G1_XMD:SHA-256_SSWU_RO_AUG_"
+  );
+  return P.shortSignatures.verify(
+    r,
+    o,
+    e.getPoint()
+  );
+}
+class Ee {
+  #t;
+  #e;
+  /**
+   * Return the VetKey bytes, aka the BLS signature
+   *
+   * Use the raw bytes only if your design makes use of the fact that VetKeys
+   * are BLS signatures (eg for random beacon or threshold BLS signature
+   * generation). If you are using VetKD for key distribution, instead use
+   * deriveSymmetricKey or asHkdfCryptoKey
+   */
+  signatureBytes() {
+    return this.#e;
+  }
+  /**
+   * Return the serialization of the VetKey
+   *
+   * This is the byte encoding of the unencrypted VetKey.
+   */
+  serialize() {
+    return this.#e;
+  }
+  /**
+   * Derive a symmetric key of the requested length from the VetKey
+   *
+   * As an alternative to this function consider using asDerivedKeyMaterial,
+   * which uses the WebCrypto API and prevents export of the underlying key.
+   *
+   * The `domainSep` parameter should be a string unique to your application and
+   * also your usage of the resulting key. For example say your application
+   * "my-app" is deriving two keys, one for usage "foo" and the other for
+   * "bar". You might use as domain separators "my-app-foo" and "my-app-bar".
+   *
+   * The returned Uint8Array will be `outputLength` bytes long.
+   */
+  deriveSymmetricKey(t, r) {
+    return re(this.#e, t, r);
+  }
+  /**
+   * Return a DerivedKeyMaterial type which is suitable for further key derivation
+   */
+  async asDerivedKeyMaterial() {
+    return me.setup(this.#e);
+  }
+  /**
+   * Deserialize a VetKey from the 48 byte encoding of the BLS signature
+   *
+   * This deserializes the same value as returned by serialize (or signatureBytes)
+   */
+  static deserialize(t) {
+    return new Ee(P.G1.Point.fromHex(t));
+  }
+  /**
+   * @internal getter returning the point object of the VetKey
+   *
+   * Applications would not usually need to call this
+   */
+  getPoint() {
+    return this.#t;
+  }
+  /**
+   * @internal constructor
+   *
+   * This is public for typing reasons but there is no reason for an application
+   * to call this constructor.
+   */
+  constructor(t) {
+    this.#t = t, this.#e = new Uint8Array(t.toBytes(!0));
+  }
+}
+const kt = 12, vn = 2, Pe = "IC GCMv2", In = new TextEncoder().encode(
+  Pe
+), $t = 8;
+class me {
+  #t;
+  #e;
+  /**
+   * @internal constructor
+   */
+  constructor(t, r) {
+    this.#t = t, this.#e = r;
+  }
+  static async fromCryptoKey(t) {
+    const r = {
+      name: "HKDF",
+      hash: "SHA-256",
+      info: new TextEncoder().encode(
+        "ic-vetkd-bls12-381-g2-derived-key-material"
+      ),
+      salt: new Uint8Array()
+    }, n = {
+      name: "AES-GCM",
+      length: 256
+    }, s = await crypto.subtle.deriveKey(
+      r,
+      t,
+      n,
+      !0,
+      // exportable
+      ["encrypt"]
+    ), c = await crypto.subtle.exportKey(
+      "raw",
+      s
+    ), o = await crypto.subtle.importKey(
+      "raw",
+      c,
+      { name: "HKDF" },
+      !1,
+      ["deriveKey", "deriveBits"]
+    );
+    return new me(o, t);
+  }
+  /**
+   * @internal constructor
+   */
+  static async setup(t) {
+    const n = await globalThis.crypto.subtle.importKey(
+      "raw",
+      t,
+      "HKDF",
+      !1,
+      ["deriveKey", "deriveBits"]
+    );
+    return me.fromCryptoKey(n);
+  }
+  /**
+   * Return the CryptoKey
+   */
+  getCryptoKey() {
+    return this.#e;
+  }
+  /**
+   * Return a WebCrypto CryptoKey handle suitable for AES-GCM encryption/decryption
+   *
+   * The key is derived using HKDF with the provided domain separator
+   *
+   * The CryptoKey is not exportable
+   */
+  async deriveAesGcmCryptoKey(t, r) {
+    const n = {
+      name: "HKDF",
+      hash: "SHA-256",
+      length: 256,
+      info: He(
+        "ic-vetkd-bls12-381-g2-aes-gcm-v" + r.toString() + "-",
+        t
+      ),
+      salt: new Uint8Array()
+    }, s = {
+      name: "AES-GCM",
+      length: 256
+    };
+    return globalThis.crypto.subtle.deriveKey(
+      n,
+      this.#t,
+      s,
+      !1,
+      ["encrypt", "decrypt"]
+    );
+  }
+  /**
+   * Encrypt the provided message using AES-GCM and a key derived using HKDF
+   *
+   * The GCM key is derived using HKDF with the provided domain separator
+   */
+  async encryptMessage(t, r, n) {
+    const s = await this.deriveAesGcmCryptoKey(
+      r,
+      vn
+    ), c = globalThis.crypto.getRandomValues(
+      new Uint8Array(kt)
+    ), o = He(Pe, n), i = new Uint8Array(
+      await globalThis.crypto.subtle.encrypt(
+        { name: "AES-GCM", iv: c, additionalData: o },
+        s,
+        ke(t)
+      )
+    );
+    return new Uint8Array([
+      ...In,
+      ...c,
+      ...i
+    ]);
+  }
+  /**
+   * Decrypt the provided ciphertext using AES-GCM and a key derived using HKDF
+   *
+   * The GCM key is derived using HKDF with the provided domain separator
+   */
+  async decryptMessage(t, r, n) {
+    const c = $t + kt + 16;
+    if (t.length < c)
+      throw new Error(
+        "Invalid ciphertext, too short to possibly be valid"
+      );
+    const o = t.slice(0, $t);
+    if (!Me(o, In))
+      if (n.length == 0) {
+        const d = t.slice(
+          0,
+          kt
+        ), f = t.slice(
+          kt
+        ), h = {
+          name: "HKDF",
+          hash: "SHA-256",
+          length: 256,
+          info: ke(r),
+          salt: new Uint8Array()
+        }, m = {
+          name: "AES-GCM",
+          length: 256
+        }, g = await globalThis.crypto.subtle.deriveKey(
+          h,
+          this.#e,
+          m,
+          !1,
+          ["decrypt"]
+        );
+        try {
+          const y = await globalThis.crypto.subtle.decrypt(
+            { name: "AES-GCM", iv: d },
+            g,
+            f
+          );
+          return new Uint8Array(y);
+        } catch {
+          throw new Error("Decryption failed");
+        }
+      } else
+        throw new Error(
+          "Unknown header for AES-GCM encrypted ciphertext"
+        );
+    const i = He(Pe, n), a = t.slice(
+      $t,
+      $t + kt
+    ), u = t.slice(
+      $t + kt
+    ), l = await this.deriveAesGcmCryptoKey(
+      r,
+      vn
+    );
+    try {
+      const d = await globalThis.crypto.subtle.decrypt(
+        { name: "AES-GCM", iv: a, additionalData: i },
+        l,
+        u
+      );
+      return new Uint8Array(d);
+    } catch {
+      throw new Error("Decryption failed");
+    }
+  }
+}
+class hr {
+  #t;
+  #e;
+  #n;
+  /**
+   * Parse an encrypted key returned by the `vetkd_derive_encrypted_key`
+   * managment canister interface
+   */
+  static deserialize(t) {
+    if (t.length !== it + rt + it)
+      throw new Error("Invalid EncryptedVetKey serialization");
+    const r = P.G1.Point.fromHex(t.subarray(0, it)), n = P.G2.Point.fromHex(
+      t.subarray(it, it + rt)
+    ), s = P.G1.Point.fromHex(
+      t.subarray(it + rt)
+    );
+    return new hr(r, n, s);
+  }
+  /**
+   * Decrypt the encrypted key returning a VetKey
+   */
+  decryptAndVerify(t, r, n) {
+    const s = P.G1.Point.BASE, c = P.G2.Point.BASE.negate(), o = P.fields.Fp12.ONE, i = P.pairingBatch([
+      { g1: this.#t, g2: c },
+      { g1: s, g2: this.#e }
+    ]);
+    if (!P.fields.Fp12.eql(i, o))
+      throw new Error("Invalid VetKey");
+    const a = this.#n.subtract(
+      this.#t.multiply(P.G1.Point.Fn.fromBytes(t.serialize()))
+    );
+    if (lr(r, n, a))
+      return new Ee(a);
+    throw new Error("Invalid VetKey");
+  }
+  /**
+   * @internal constructor
+   */
+  constructor(t, r, n) {
+    this.#t = t, this.#e = r, this.#n = n;
+  }
+}
+const On = new Uint8Array([
+  73,
+  67,
+  32,
+  73,
+  66,
+  69,
+  0,
+  1
+]), Et = 8;
+function Nn(e, t, r) {
+  const n = new Uint8Array([...e, ...t, ...r]);
+  return Je(
+    n,
+    "ic-vetkd-bls12-381-ibe-hash-to-mask"
+    /* HashToMask */
+  );
+}
+function br(e, t) {
+  if (e.length !== t.length)
+    throw new Error("xorBuf arguments should have the same length");
+  const r = new Uint8Array(e.length);
+  for (let n = 0; n < e.length; n++)
+    r[n] = e[n] ^ t[n];
+  return r;
+}
+function Tn(e, t) {
+  if (t.length !== 576)
+    throw new Error("Unexpected size for Gt element");
+  const r = re(
+    t,
+    "ic-vetkd-bls12-381-ibe-mask-seed",
+    e.length
+  );
+  return br(r, e);
+}
+function qn(e, t) {
+  const r = "ic-vetkd-bls12-381-ibe-mask-msg-".concat(
+    e.length.toString().padStart(20, "0")
+  ), n = re(t, r, 32), s = $s(n, { dkLen: e.length });
+  return br(e, s);
+}
+function Rn(e) {
+  const t = P.fields.Fp12.toBytes(e), r = new Uint8Array(576), n = [11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0];
+  for (let s = 0; s < 12; ++s)
+    for (let c = 0; c < 48; ++c)
+      r[48 * s + c] = t[48 * n[s] + c];
+  return r;
+}
+function Me(e, t) {
+  if (e.length !== t.length)
+    return !1;
+  let r = 0;
+  for (let n = 0; n < e.length; ++n)
+    r |= e[n] ^ t[n];
+  return r == 0;
+}
+class ae {
+  #t;
+  constructor(t) {
+    this.#t = t;
+  }
+  /**
+   * Create an identity from a byte string
+   */
+  static fromBytes(t) {
+    return new ae(t);
+  }
+  /**
+   * Create an identity from a string
+   */
+  static fromString(t) {
+    return ae.fromBytes(new TextEncoder().encode(t));
+  }
+  /**
+   * Create an identity from a Principal
+   */
+  static fromPrincipal(t) {
+    return ae.fromBytes(t.toUint8Array());
+  }
+  /**
+   * @internal getter returning the encoded
+   */
+  getBytes() {
+    return this.#t;
+  }
+}
+const St = 32;
+class fe {
+  #t;
+  constructor(t) {
+    if (t.length !== St)
+      throw new Error("IBE seed must be exactly IBE_SEED_BYTES long");
+    this.#t = t;
+  }
+  /**
+   * Create a seed for IBE encryption from a byte string
+   *
+   * This input should be randomly chosen by a secure random number generator.
+   * If the seed is not securely generated the IBE scheme will be insecure.
+   *
+   * At least 128 bits (16 bytes) must be provided.
+   *
+   * If the input is exactly 256 bits it is used directly. Otherwise the input
+   * is hashed with HKDF to produce a 256 bit seed.
+   */
+  static fromBytes(t) {
+    if (t.length < 16)
+      throw new Error(
+        "Insufficient input material for IbeSeed derivation"
+      );
+    return t.length == St ? new fe(t) : new fe(
+      re(
+        t,
+        "ic-vetkd-bls12-381-ibe-hash-seed",
+        St
+      )
+    );
+  }
+  /**
+   * Create a random seed for IBE encryption
+   */
+  static random() {
+    return new fe(
+      globalThis.crypto.getRandomValues(new Uint8Array(St))
+    );
+  }
+  /**
+   * @internal getter returning the seed bytes
+   */
+  getBytes() {
+    return this.#t;
+  }
+}
+const Ge = Et + St + rt;
+class Ze {
+  #t;
+  #e;
+  #n;
+  #r;
+  /**
+   * Helper function for determining the size of an IBE ciphertext in bytes.
+   */
+  static ciphertextSize(t) {
+    if (t < 0)
+      throw new Error(
+        "IbeCiphertext.ciphertextSize argument cannot be negative"
+      );
+    return t + Ge;
+  }
+  /**
+   * Helper function for determining the size of an IBE plaintext in bytes.
+   */
+  static plaintextSize(t) {
+    if (t < Ge)
+      throw new Error(
+        "IbeCiphertext.plaintextSize given ciphertext size is too small to be valid"
+      );
+    return t - Ge;
+  }
+  /**
+   * Serialize the IBE ciphertext to a bytestring
+   */
+  serialize() {
+    const t = this.#e.toBytes(!0);
+    return new Uint8Array([
+      ...this.#t,
+      ...t,
+      ...this.#n,
+      ...this.#r
+    ]);
+  }
+  /**
+   * Deserialize an IBE ciphertext
+   */
+  static deserialize(t) {
+    if (t.length < Et + rt + St)
+      throw new Error("Invalid IBE ciphertext");
+    const r = t.subarray(0, Et), n = P.G2.Point.fromHex(
+      t.subarray(Et, Et + rt)
+    ), s = t.subarray(
+      Et + rt,
+      Et + rt + St
+    ), c = t.subarray(Et + rt + St);
+    if (!Me(r, On))
+      throw new Error("Unexpected header for IBE ciphertext");
+    return new Ze(r, n, s, c);
+  }
+  /**
+   * Encrypt a message using IBE, returning the ciphertext
+   *
+   * Any user who is able to retrieve the VetKey for the specified derived public key and
+   * identity will be able to decrypt this message.
+   *
+   * There is no fixed upper bound on the size of the message that can be encrypted using
+   * this scheme. However, internally during the encryption process several heap allocations
+   * are performed which are approximately the same length as the message itself, so
+   * encrypting or decrypting very large messages may result in memory allocation errors.
+   *
+   * If you anticipate using IBE to encrypt very large messages, consider using IBE just to
+   * encrypt a symmetric key, and then using a standard cipher such as AES-GCM to encrypt the
+   * data.
+   *
+   * The seed parameter must be a randomly generated value that was generated just for this
+   * one message. Using it for a second message, or for any other purpose, compromises the
+   * security of the IBE scheme.
+   */
+  static encrypt(t, r, n, s) {
+    const c = On, o = Nn(c, s.getBytes(), n), i = tc(t, r.getBytes()), a = P.fields.Fp12.pow(
+      P.pairing(i, t.getPoint()),
+      o
+    ), u = P.G2.Point.BASE.multiply(o), l = Tn(s.getBytes(), Rn(a)), d = qn(n, s.getBytes());
+    return new Ze(c, u, l, d);
+  }
+  /**
+   * Decrypt an IBE ciphertext, returning the message
+   *
+   * There is no fixed upper bound on the size of the message that can be encrypted using
+   * this scheme. However, internally during the encryption process several heap allocations
+   * are performed which are approximately the same length as the message itself, so
+   * encrypting or decrypting very large messages may result in memory allocation errors.
+   */
+  decrypt(t) {
+    const r = Tn(
+      this.#n,
+      Rn(P.pairing(t.getPoint(), this.#e))
+    ), n = qn(this.#r, r), s = Nn(this.#t, r, n);
+    if (Me(
+      P.G2.Point.BASE.multiply(s).toBytes(!0),
+      this.#e.toBytes(!0)
+    ))
+      return n;
+    throw new Error("Decryption failed");
+  }
+  /**
+   * Private constructor
+   */
+  constructor(t, r, n, s) {
+    this.#t = t, this.#e = r, this.#n = n, this.#r = s;
+  }
+}
+const ec = 32;
+class Ke {
+  #t;
+  #e;
+  #n;
+  #r;
+  static computeVrfHash(t, r, n) {
+    const s = new Uint8Array([
+      ...Nt(t.serialize()),
+      ...Nt(r.publicKeyBytes()),
+      ...Nt(n)
+    ]);
+    return re(
+      s,
+      "ic-vetkd-bls12-381-g2-vrf",
+      ec
+    );
+  }
+  /**
+   * Serialize a VrfOutput to a byte string
+   */
+  serialize() {
+    return new Uint8Array([
+      ...this.#t.serialize(),
+      ...this.#e.publicKeyBytes(),
+      ...this.#n
+    ]);
+  }
+  /**
+   * Deserialize and verify a VrfOutput
+   *
+   * Note this verifies the VrfOutput with respect to the derived public key
+   * and VRF input which are included in the struct. It is the responsibility
+   * of the application to examine the return value of `publicKey` and `input`
+   * and ensure these values make sense in the context where this VRF is being
+   * used.
+   */
+  static deserialize(t) {
+    if (t.length < it + rt)
+      throw new Error(
+        "VrfOutput.deserialize input too short to possibly be valid"
+      );
+    const r = Ee.deserialize(t.slice(0, it)), n = te.deserialize(
+      t.slice(it, it + rt)
+    ), s = t.slice(it + rt);
+    if (!lr(n, s, r.getPoint()))
+      throw new Error("VrfOutput.deserialize proof is invalid");
+    return new Ke(r, n, s);
+  }
+  /**
+   * Return the public key under which this VRF output was derived
+   */
+  publicKey() {
+    return this.#e;
+  }
+  /**
+   * Return the input that was used to create this VRF output
+   */
+  input() {
+    return this.#n;
+  }
+  /**
+   * Return the VRF output
+   *
+   * This is a random-looking value which was provably generated by some party with
+   * access to the VRF secret key.
+   */
+  output() {
+    return this.#r;
+  }
+  /**
+   * Private constructor
+   */
+  constructor(t, r, n) {
+    this.#t = t, this.#e = r, this.#n = n, this.#r = Ke.computeVrfHash(t, r, n);
+  }
+}
+export {
+  fe as A,
+  Qs as B,
+  Ke as C,
+  te as D,
+  hr as E,
+  Yt as F,
+  tc as G,
+  re as H,
+  Ze as I,
+  Je as J,
+  ac as K,
+  lr as L,
+  At as M,
+  Js as P,
+  De as T,
+  Ee as V,
+  ns as _,
+  me as a,
+  Xt as b,
+  C as c,
+  Mn as d,
+  P as e,
+  ze as f,
+  cn as g,
+  Un as h,
+  sc as i,
+  on as j,
+  Kn as k,
+  cc as l,
+  Ft as m,
+  jt as n,
+  ge as o,
+  es as p,
+  Ue as q,
+  Er as r,
+  nc as s,
+  rc as t,
+  ee as u,
+  nt as v,
+  Jr as w,
+  oc as x,
+  ic as y,
+  ae as z
+};