@kohaku-eth/tornado-cash 0.0.2-alpha.11 → 0.0.2-alpha.13

package/dist/merkle-tree-worker.node.js

@@ -0,0 +1,3595 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod2) => function __require() {
+  return mod2 || (0, cb[__getOwnPropNames(cb)[0]])((mod2 = { exports: {} }).exports, mod2), mod2.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod2, isNodeMode, target) => (target = mod2 != null ? __create(__getProtoOf(mod2)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod2 || !mod2.__esModule ? __defProp(target, "default", { value: mod2, enumerable: true }) : target,
+  mod2
+));
+
+// ../../node_modules/.pnpm/fixed-merkle-tree@0.7.3/node_modules/fixed-merkle-tree/lib/simpleHash.js
+var require_simpleHash = __commonJS({
+  "../../node_modules/.pnpm/fixed-merkle-tree@0.7.3/node_modules/fixed-merkle-tree/lib/simpleHash.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.simpleHash = void 0;
+    function simpleHash(data, seed, hashLength = 40) {
+      const str = data.join("");
+      let i, l, hval = seed !== null && seed !== void 0 ? seed : 34658180293;
+      for (i = 0, l = str.length; i < l; i++) {
+        hval ^= str.charCodeAt(i);
+        hval += (hval << 1) + (hval << 4) + (hval << 6) + (hval << 8) + (hval << 24);
+      }
+      const hash = (hval >>> 0).toString(16);
+      return BigInt("0x" + hash.padEnd(hashLength - (hash.length - 1), "0")).toString(10);
+    }
+    exports.simpleHash = simpleHash;
+    exports.default = (left, right) => simpleHash([left, right]);
+  }
+});
+
+// ../../node_modules/.pnpm/fixed-merkle-tree@0.7.3/node_modules/fixed-merkle-tree/lib/BaseTree.js
+var require_BaseTree = __commonJS({
+  "../../node_modules/.pnpm/fixed-merkle-tree@0.7.3/node_modules/fixed-merkle-tree/lib/BaseTree.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.BaseTree = void 0;
+    var BaseTree = class {
+      get capacity() {
+        return 2 ** this.levels;
+      }
+      get layers() {
+        return this._layers.slice();
+      }
+      get zeros() {
+        return this._zeros.slice();
+      }
+      get elements() {
+        return this._layers[0].slice();
+      }
+      get root() {
+        var _a;
+        return (_a = this._layers[this.levels][0]) !== null && _a !== void 0 ? _a : this._zeros[this.levels];
+      }
+      /**
+       * Find an element in the tree
+       * @param elements elements of tree
+       * @param element An element to find
+       * @param comparator A function that checks leaf value equality
+       * @param fromIndex The index to start the search at. If the index is greater than or equal to the array's length, -1 is returned
+       * @returns {number} Index if element is found, otherwise -1
+       */
+      static indexOf(elements, element, fromIndex, comparator) {
+        if (comparator) {
+          return elements.findIndex((el) => comparator(element, el));
+        } else {
+          return elements.indexOf(element, fromIndex);
+        }
+      }
+      /**
+       * Insert new element into the tree
+       * @param element Element to insert
+       */
+      insert(element) {
+        if (this._layers[0].length >= this.capacity) {
+          throw new Error("Tree is full");
+        }
+        this.update(this._layers[0].length, element);
+      }
+      /*
+       * Insert multiple elements into the tree.
+       * @param {Array} elements Elements to insert
+       */
+      bulkInsert(elements) {
+        if (!elements.length) {
+          return;
+        }
+        if (this._layers[0].length + elements.length > this.capacity) {
+          throw new Error("Tree is full");
+        }
+        for (let i = 0; i < elements.length - 1; i++) {
+          this._layers[0].push(elements[i]);
+          let level = 0;
+          let index = this._layers[0].length - 1;
+          while (index % 2 === 1) {
+            level++;
+            index >>= 1;
+            const left = this._layers[level - 1][index * 2];
+            const right = this._layers[level - 1][index * 2 + 1];
+            this._layers[level][index] = this._hashFn(left, right);
+          }
+        }
+        this.insert(elements[elements.length - 1]);
+      }
+      /**
+       * Change an element in the tree
+       * @param {number} index Index of element to change
+       * @param element Updated element value
+       */
+      update(index, element) {
+        if (isNaN(Number(index)) || index < 0 || index > this._layers[0].length || index >= this.capacity) {
+          throw new Error("Insert index out of bounds: " + index);
+        }
+        this._layers[0][index] = element;
+        this._processUpdate(index);
+      }
+      /**
+       * Get merkle path to a leaf
+       * @param {number} index Leaf index to generate path for
+       * @returns {{pathElements: Object[], pathIndex: number[]}} An object containing adjacent elements and left-right index
+       */
+      path(index) {
+        if (isNaN(Number(index)) || index < 0 || index >= this._layers[0].length) {
+          throw new Error("Index out of bounds: " + index);
+        }
+        let elIndex = +index;
+        const pathElements = [];
+        const pathIndices = [];
+        const pathPositions = [];
+        for (let level = 0; level < this.levels; level++) {
+          pathIndices[level] = elIndex % 2;
+          const leafIndex = elIndex ^ 1;
+          if (leafIndex < this._layers[level].length) {
+            pathElements[level] = this._layers[level][leafIndex];
+            pathPositions[level] = leafIndex;
+          } else {
+            pathElements[level] = this._zeros[level];
+            pathPositions[level] = 0;
+          }
+          elIndex >>= 1;
+        }
+        return {
+          pathElements,
+          pathIndices,
+          pathPositions,
+          pathRoot: this.root
+        };
+      }
+      _buildZeros() {
+        this._zeros = [this.zeroElement];
+        for (let i = 1; i <= this.levels; i++) {
+          this._zeros[i] = this._hashFn(this._zeros[i - 1], this._zeros[i - 1]);
+        }
+      }
+      _processNodes(nodes, layerIndex) {
+        const length = nodes.length;
+        let currentLength = Math.ceil(length / 2);
+        const currentLayer = new Array(currentLength);
+        currentLength--;
+        const starFrom = length - (length % 2 ^ 1);
+        let j = 0;
+        for (let i = starFrom; i >= 0; i -= 2) {
+          if (nodes[i - 1] === void 0)
+            break;
+          const left = nodes[i - 1];
+          const right = i === starFrom && length % 2 === 1 ? this._zeros[layerIndex - 1] : nodes[i];
+          currentLayer[currentLength - j] = this._hashFn(left, right);
+          j++;
+        }
+        return currentLayer;
+      }
+      _processUpdate(index) {
+        for (let level = 1; level <= this.levels; level++) {
+          index >>= 1;
+          const left = this._layers[level - 1][index * 2];
+          const right = index * 2 + 1 < this._layers[level - 1].length ? this._layers[level - 1][index * 2 + 1] : this._zeros[level - 1];
+          this._layers[level][index] = this._hashFn(left, right);
+        }
+      }
+    };
+    exports.BaseTree = BaseTree;
+  }
+});
+
+// ../../node_modules/.pnpm/fixed-merkle-tree@0.7.3/node_modules/fixed-merkle-tree/lib/FixedMerkleTree.js
+var require_FixedMerkleTree = __commonJS({
+  "../../node_modules/.pnpm/fixed-merkle-tree@0.7.3/node_modules/fixed-merkle-tree/lib/FixedMerkleTree.js"(exports) {
+    "use strict";
+    var __importDefault = exports && exports.__importDefault || function(mod2) {
+      return mod2 && mod2.__esModule ? mod2 : { "default": mod2 };
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    var simpleHash_1 = __importDefault(require_simpleHash());
+    var BaseTree_1 = require_BaseTree();
+    var MerkleTree2 = class extends BaseTree_1.BaseTree {
+      constructor(levels, elements = [], { hashFunction = simpleHash_1.default, zeroElement = 0 } = {}) {
+        super();
+        this.levels = levels;
+        if (elements.length > this.capacity) {
+          throw new Error("Tree is full");
+        }
+        this._hashFn = hashFunction;
+        this.zeroElement = zeroElement;
+        this._layers = [];
+        const leaves = elements.slice();
+        this._layers = [leaves];
+        this._buildZeros();
+        this._buildHashes();
+      }
+      _buildHashes() {
+        for (let layerIndex = 1; layerIndex <= this.levels; layerIndex++) {
+          const nodes = this._layers[layerIndex - 1];
+          this._layers[layerIndex] = this._processNodes(nodes, layerIndex);
+        }
+      }
+      /**
+       * Insert multiple elements into the tree.
+       * @param {Array} elements Elements to insert
+       */
+      bulkInsert(elements) {
+        if (!elements.length) {
+          return;
+        }
+        if (this._layers[0].length + elements.length > this.capacity) {
+          throw new Error("Tree is full");
+        }
+        for (let i = 0; i < elements.length - 1; i++) {
+          this._layers[0].push(elements[i]);
+          let level = 0;
+          let index = this._layers[0].length - 1;
+          while (index % 2 === 1) {
+            level++;
+            index >>= 1;
+            this._layers[level][index] = this._hashFn(this._layers[level - 1][index * 2], this._layers[level - 1][index * 2 + 1]);
+          }
+        }
+        this.insert(elements[elements.length - 1]);
+      }
+      indexOf(element, comparator) {
+        return BaseTree_1.BaseTree.indexOf(this._layers[0], element, 0, comparator);
+      }
+      proof(element) {
+        const index = this.indexOf(element);
+        return this.path(index);
+      }
+      getTreeEdge(edgeIndex) {
+        const edgeElement = this._layers[0][edgeIndex];
+        if (edgeElement === void 0) {
+          throw new Error("Element not found");
+        }
+        const edgePath = this.path(edgeIndex);
+        return { edgePath, edgeElement, edgeIndex, edgeElementsCount: this._layers[0].length };
+      }
+      /**
+       * 🪓
+       * @param count
+       */
+      getTreeSlices(count = 4) {
+        const length = this._layers[0].length;
+        let size = Math.ceil(length / count);
+        if (size % 2)
+          size++;
+        const slices = [];
+        for (let i = 0; i < length; i += size) {
+          const edgeLeft = i;
+          const edgeRight = i + size;
+          slices.push({ edge: this.getTreeEdge(edgeLeft), elements: this.elements.slice(edgeLeft, edgeRight) });
+        }
+        return slices;
+      }
+      /**
+       * Serialize entire tree state including intermediate layers into a plain object
+       * Deserializing it back will not require to recompute any hashes
+       * Elements are not converted to a plain type, this is responsibility of the caller
+       */
+      serialize() {
+        return {
+          levels: this.levels,
+          _zeros: this._zeros,
+          _layers: this._layers
+        };
+      }
+      /**
+       * Deserialize data into a MerkleTree instance
+       * Make sure to provide the same hashFunction as was used in the source tree,
+       * otherwise the tree state will be invalid
+       */
+      static deserialize(data, hashFunction) {
+        const instance = Object.assign(Object.create(this.prototype), data);
+        instance._hashFn = hashFunction || simpleHash_1.default;
+        instance.zeroElement = instance._zeros[0];
+        return instance;
+      }
+      toString() {
+        return JSON.stringify(this.serialize());
+      }
+    };
+    exports.default = MerkleTree2;
+  }
+});
+
+// ../../node_modules/.pnpm/fixed-merkle-tree@0.7.3/node_modules/fixed-merkle-tree/lib/PartialMerkleTree.js
+var require_PartialMerkleTree = __commonJS({
+  "../../node_modules/.pnpm/fixed-merkle-tree@0.7.3/node_modules/fixed-merkle-tree/lib/PartialMerkleTree.js"(exports) {
+    "use strict";
+    var __importDefault = exports && exports.__importDefault || function(mod2) {
+      return mod2 && mod2.__esModule ? mod2 : { "default": mod2 };
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.PartialMerkleTree = void 0;
+    var simpleHash_1 = __importDefault(require_simpleHash());
+    var BaseTree_1 = require_BaseTree();
+    var PartialMerkleTree = class extends BaseTree_1.BaseTree {
+      constructor(levels, { edgePath, edgeElement, edgeIndex, edgeElementsCount }, leaves, { hashFunction, zeroElement } = {}) {
+        super();
+        if (edgeIndex + leaves.length !== edgeElementsCount)
+          throw new Error("Invalid number of elements");
+        this._edgeLeafProof = edgePath;
+        this._initialRoot = edgePath.pathRoot;
+        this.zeroElement = zeroElement !== null && zeroElement !== void 0 ? zeroElement : 0;
+        this._edgeLeaf = { data: edgeElement, index: edgeIndex };
+        this._leavesAfterEdge = leaves;
+        this.levels = levels;
+        this._hashFn = hashFunction || simpleHash_1.default;
+        this._createProofMap();
+        this._buildTree();
+      }
+      get edgeIndex() {
+        return this._edgeLeaf.index;
+      }
+      get edgeElement() {
+        return this._edgeLeaf.data;
+      }
+      get edgeLeafProof() {
+        return this._edgeLeafProof;
+      }
+      _createProofMap() {
+        this._proofMap = this.edgeLeafProof.pathPositions.reduce((p, c, i) => {
+          p.set(i, [c, this.edgeLeafProof.pathElements[i]]);
+          return p;
+        }, /* @__PURE__ */ new Map());
+        this._proofMap.set(this.levels, [0, this.edgeLeafProof.pathRoot]);
+      }
+      _buildTree() {
+        const edgeLeafIndex = this._edgeLeaf.index;
+        this._leaves = Array(edgeLeafIndex).concat(this._leavesAfterEdge);
+        if (this._proofMap.has(0)) {
+          const [proofPos, proofEl] = this._proofMap.get(0);
+          this._leaves[proofPos] = proofEl;
+        }
+        this._layers = [this._leaves];
+        this._buildZeros();
+        this._buildHashes();
+      }
+      _buildHashes() {
+        for (let layerIndex = 1; layerIndex <= this.levels; layerIndex++) {
+          const nodes = this._layers[layerIndex - 1];
+          const currentLayer = this._processNodes(nodes, layerIndex);
+          if (this._proofMap.has(layerIndex)) {
+            const [proofPos, proofEl] = this._proofMap.get(layerIndex);
+            if (!currentLayer[proofPos])
+              currentLayer[proofPos] = proofEl;
+          }
+          this._layers[layerIndex] = currentLayer;
+        }
+      }
+      /**
+       * Change an element in the tree
+       * @param {number} index Index of element to change
+       * @param element Updated element value
+       */
+      update(index, element) {
+        if (isNaN(Number(index)) || index < 0 || index > this._layers[0].length || index >= this.capacity) {
+          throw new Error("Insert index out of bounds: " + index);
+        }
+        if (index < this._edgeLeaf.index) {
+          throw new Error(`Index ${index} is below the edge: ${this._edgeLeaf.index}`);
+        }
+        this._layers[0][index] = element;
+        this._processUpdate(index);
+      }
+      path(index) {
+        var _a;
+        if (isNaN(Number(index)) || index < 0 || index >= this._layers[0].length) {
+          throw new Error("Index out of bounds: " + index);
+        }
+        if (index < this._edgeLeaf.index) {
+          throw new Error(`Index ${index} is below the edge: ${this._edgeLeaf.index}`);
+        }
+        let elIndex = Number(index);
+        const pathElements = [];
+        const pathIndices = [];
+        const pathPositions = [];
+        for (let level = 0; level < this.levels; level++) {
+          pathIndices[level] = elIndex % 2;
+          const leafIndex = elIndex ^ 1;
+          if (leafIndex < this._layers[level].length) {
+            pathElements[level] = this._layers[level][leafIndex];
+            pathPositions[level] = leafIndex;
+          } else {
+            pathElements[level] = this._zeros[level];
+            pathPositions[level] = 0;
+          }
+          const [proofPos, proofEl] = this._proofMap.get(level);
+          pathElements[level] = (_a = pathElements[level]) !== null && _a !== void 0 ? _a : proofPos === leafIndex ? proofEl : this._zeros[level];
+          elIndex >>= 1;
+        }
+        return {
+          pathElements,
+          pathIndices,
+          pathPositions,
+          pathRoot: this.root
+        };
+      }
+      indexOf(element, comparator) {
+        return BaseTree_1.BaseTree.indexOf(this._layers[0], element, this.edgeIndex, comparator);
+      }
+      proof(element) {
+        const index = this.indexOf(element);
+        return this.path(index);
+      }
+      /**
+       * Shifts edge of tree to left
+       * @param edge new TreeEdge below current edge
+       * @param elements leaves between old and new edge
+       */
+      shiftEdge(edge, elements) {
+        if (this._edgeLeaf.index <= edge.edgeIndex) {
+          throw new Error(`New edgeIndex should be smaller then ${this._edgeLeaf.index}`);
+        }
+        if (elements.length !== this._edgeLeaf.index - edge.edgeIndex) {
+          throw new Error(`Elements length should be ${this._edgeLeaf.index - edge.edgeIndex}`);
+        }
+        this._edgeLeafProof = edge.edgePath;
+        this._edgeLeaf = { index: edge.edgeIndex, data: edge.edgeElement };
+        this._leavesAfterEdge = [...elements, ...this._leavesAfterEdge];
+        this._createProofMap();
+        this._buildTree();
+      }
+      serialize() {
+        return {
+          _edgeLeafProof: this._edgeLeafProof,
+          _edgeLeaf: this._edgeLeaf,
+          _layers: this._layers,
+          _zeros: this._zeros,
+          levels: this.levels
+        };
+      }
+      static deserialize(data, hashFunction) {
+        const instance = Object.assign(Object.create(this.prototype), data);
+        instance._hashFn = hashFunction || simpleHash_1.default;
+        instance._initialRoot = data._edgeLeafProof.pathRoot;
+        instance.zeroElement = instance._zeros[0];
+        instance._leavesAfterEdge = instance._layers[0].slice(data._edgeLeaf.index);
+        instance._createProofMap();
+        return instance;
+      }
+      toString() {
+        return JSON.stringify(this.serialize());
+      }
+    };
+    exports.PartialMerkleTree = PartialMerkleTree;
+  }
+});
+
+// ../../node_modules/.pnpm/fixed-merkle-tree@0.7.3/node_modules/fixed-merkle-tree/lib/index.js
+var require_lib = __commonJS({
+  "../../node_modules/.pnpm/fixed-merkle-tree@0.7.3/node_modules/fixed-merkle-tree/lib/index.js"(exports) {
+    "use strict";
+    var __importDefault = exports && exports.__importDefault || function(mod2) {
+      return mod2 && mod2.__esModule ? mod2 : { "default": mod2 };
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.MerkleTree = exports.simpleHash = exports.PartialMerkleTree = void 0;
+    var FixedMerkleTree_1 = __importDefault(require_FixedMerkleTree());
+    Object.defineProperty(exports, "MerkleTree", { enumerable: true, get: function() {
+      return FixedMerkleTree_1.default;
+    } });
+    var PartialMerkleTree_1 = require_PartialMerkleTree();
+    Object.defineProperty(exports, "PartialMerkleTree", { enumerable: true, get: function() {
+      return PartialMerkleTree_1.PartialMerkleTree;
+    } });
+    var simpleHash_1 = require_simpleHash();
+    Object.defineProperty(exports, "simpleHash", { enumerable: true, get: function() {
+      return simpleHash_1.simpleHash;
+    } });
+    exports.default = FixedMerkleTree_1.default;
+  }
+});
+
+// ../mimc-tree/dist/MimcMerkleTreeWorker.js
+import { parentPort } from "worker_threads";
+
+// ../../node_modules/.pnpm/@noble+hashes@2.2.0/node_modules/@noble/hashes/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+function anumber(n, title = "") {
+  if (typeof n !== "number") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(`${prefix}expected number, got ${typeof n}`);
+  }
+  if (!Number.isSafeInteger(n) || n < 0) {
+    const prefix = title && `"${title}" `;
+    throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);
+  }
+}
+function abytes(value, length, title = "") {
+  const bytes = isBytes(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+    if (!bytes)
+      throw new TypeError(message);
+    throw new RangeError(message);
+  }
+  return value;
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput(out, instance) {
+  abytes(out, void 0, "digestInto() output");
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new RangeError('"digestInto() output" expected to be of length >=' + min);
+  }
+}
+function u32(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+function byteSwap(word) {
+  return word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
+}
+function byteSwap32(arr) {
+  for (let i = 0; i < arr.length; i++) {
+    arr[i] = byteSwap(arr[i]);
+  }
+  return arr;
+}
+var swap32IfBE = isLE ? (u) => u : byteSwap32;
+var hasHexBuiltin = /* @__PURE__ */ (() => (
+  // @ts-ignore
+  typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function"
+))();
+var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
+function bytesToHex(bytes) {
+  abytes(bytes);
+  if (hasHexBuiltin)
+    return bytes.toHex();
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) {
+    hex += hexes[bytes[i]];
+  }
+  return hex;
+}
+var asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
+function asciiToBase16(ch) {
+  if (ch >= asciis._0 && ch <= asciis._9)
+    return ch - asciis._0;
+  if (ch >= asciis.A && ch <= asciis.F)
+    return ch - (asciis.A - 10);
+  if (ch >= asciis.a && ch <= asciis.f)
+    return ch - (asciis.a - 10);
+  return;
+}
+function hexToBytes(hex) {
+  if (typeof hex !== "string")
+    throw new TypeError("hex string expected, got " + typeof hex);
+  if (hasHexBuiltin) {
+    try {
+      return Uint8Array.fromHex(hex);
+    } catch (error) {
+      if (error instanceof SyntaxError)
+        throw new RangeError(error.message);
+      throw error;
+    }
+  }
+  const hl = hex.length;
+  const al = hl / 2;
+  if (hl % 2)
+    throw new RangeError("hex string expected, got unpadded hex of length " + hl);
+  const array = new Uint8Array(al);
+  for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
+    const n1 = asciiToBase16(hex.charCodeAt(hi));
+    const n2 = asciiToBase16(hex.charCodeAt(hi + 1));
+    if (n1 === void 0 || n2 === void 0) {
+      const char = hex[hi] + hex[hi + 1];
+      throw new RangeError('hex string expected, got non-hex character "' + char + '" at index ' + hi);
+    }
+    array[ai] = n1 * 16 + n2;
+  }
+  return array;
+}
+function utf8ToBytes(str) {
+  if (typeof str !== "string")
+    throw new TypeError("string expected");
+  return new Uint8Array(new TextEncoder().encode(str));
+}
+function concatBytes(...arrays) {
+  let sum = 0;
+  for (let i = 0; i < arrays.length; i++) {
+    const a = arrays[i];
+    abytes(a);
+    sum += a.length;
+  }
+  const res = new Uint8Array(sum);
+  for (let i = 0, pad = 0; i < arrays.length; i++) {
+    const a = arrays[i];
+    res.set(a, pad);
+    pad += a.length;
+  }
+  return res;
+}
+function createHasher(hashCons, info = {}) {
+  const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+  const tmp = hashCons(void 0);
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.canXOF = tmp.canXOF;
+  hashC.create = (opts) => hashCons(opts);
+  Object.assign(hashC, info);
+  return Object.freeze(hashC);
+}
+function randomBytes(bytesLength = 32) {
+  anumber(bytesLength, "bytesLength");
+  const cr = typeof globalThis === "object" ? globalThis.crypto : null;
+  if (typeof cr?.getRandomValues !== "function")
+    throw new Error("crypto.getRandomValues must be defined");
+  if (bytesLength > 65536)
+    throw new RangeError(`"bytesLength" expected <= 65536, got ${bytesLength}`);
+  return cr.getRandomValues(new Uint8Array(bytesLength));
+}
+
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/utils.js
+var abytes2 = (value, length, title) => abytes(value, length, title);
+var anumber2 = anumber;
+var bytesToHex2 = bytesToHex;
+var concatBytes2 = (...arrays) => concatBytes(...arrays);
+var hexToBytes2 = (hex) => hexToBytes(hex);
+var randomBytes2 = (bytesLength) => randomBytes(bytesLength);
+var _0n = /* @__PURE__ */ BigInt(0);
+var _1n = /* @__PURE__ */ BigInt(1);
+function abool(value, title = "") {
+  if (typeof value !== "boolean") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(prefix + "expected boolean, got type=" + typeof value);
+  }
+  return value;
+}
+function abignumber(n) {
+  if (typeof n === "bigint") {
+    if (!isPosBig(n))
+      throw new RangeError("positive bigint expected, got " + n);
+  } else
+    anumber2(n);
+  return n;
+}
+function asafenumber(value, title = "") {
+  if (typeof value !== "number") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(prefix + "expected number, got type=" + typeof value);
+  }
+  if (!Number.isSafeInteger(value)) {
+    const prefix = title && `"${title}" `;
+    throw new RangeError(prefix + "expected safe integer, got " + value);
+  }
+}
+function numberToHexUnpadded(num) {
+  const hex = abignumber(num).toString(16);
+  return hex.length & 1 ? "0" + hex : hex;
+}
+function hexToNumber(hex) {
+  if (typeof hex !== "string")
+    throw new TypeError("hex string expected, got " + typeof hex);
+  return hex === "" ? _0n : BigInt("0x" + hex);
+}
+function bytesToNumberBE(bytes) {
+  return hexToNumber(bytesToHex(bytes));
+}
+function bytesToNumberLE(bytes) {
+  return hexToNumber(bytesToHex(copyBytes(abytes(bytes)).reverse()));
+}
+function numberToBytesBE(n, len) {
+  anumber(len);
+  if (len === 0)
+    throw new RangeError("zero length");
+  n = abignumber(n);
+  const hex = n.toString(16);
+  if (hex.length > len * 2)
+    throw new RangeError("number too large");
+  return hexToBytes(hex.padStart(len * 2, "0"));
+}
+function numberToBytesLE(n, len) {
+  return numberToBytesBE(n, len).reverse();
+}
+function copyBytes(bytes) {
+  return Uint8Array.from(abytes2(bytes));
+}
+var isPosBig = (n) => typeof n === "bigint" && _0n <= n;
+function inRange(n, min, max) {
+  return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;
+}
+function aInRange(title, n, min, max) {
+  if (!inRange(n, min, max))
+    throw new RangeError("expected valid " + title + ": " + min + " <= n < " + max + ", got " + n);
+}
+function bitLen(n) {
+  if (n < _0n)
+    throw new Error("expected non-negative bigint, got " + n);
+  let len;
+  for (len = 0; n > _0n; n >>= _1n, len += 1)
+    ;
+  return len;
+}
+function bitGet(n, pos) {
+  return n >> BigInt(pos) & _1n;
+}
+var bitMask = (n) => (_1n << BigInt(n)) - _1n;
+function validateObject(object, fields2 = {}, optFields = {}) {
+  if (Object.prototype.toString.call(object) !== "[object Object]")
+    throw new TypeError("expected valid options object");
+  function checkField(fieldName, expectedType, isOpt) {
+    if (!isOpt && expectedType !== "function" && !Object.hasOwn(object, fieldName))
+      throw new TypeError(`param "${fieldName}" is invalid: expected own property`);
+    const val = object[fieldName];
+    if (isOpt && val === void 0)
+      return;
+    const current = typeof val;
+    if (current !== expectedType || val === null)
+      throw new TypeError(`param "${fieldName}" is invalid: expected ${expectedType}, got ${current}`);
+  }
+  const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));
+  iter(fields2, false);
+  iter(optFields, true);
+}
+var notImplemented = () => {
+  throw new Error("not implemented");
+};
+
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/modular.js
+var _0n2 = /* @__PURE__ */ BigInt(0);
+var _1n2 = /* @__PURE__ */ BigInt(1);
+var _2n = /* @__PURE__ */ BigInt(2);
+var _3n = /* @__PURE__ */ BigInt(3);
+var _4n = /* @__PURE__ */ BigInt(4);
+var _5n = /* @__PURE__ */ BigInt(5);
+var _7n = /* @__PURE__ */ BigInt(7);
+var _8n = /* @__PURE__ */ BigInt(8);
+var _9n = /* @__PURE__ */ BigInt(9);
+var _16n = /* @__PURE__ */ BigInt(16);
+function mod(a, b) {
+  if (b <= _0n2)
+    throw new Error("mod: expected positive modulus, got " + b);
+  const result = a % b;
+  return result >= _0n2 ? result : b + result;
+}
+function invert(number, modulo) {
+  if (number === _0n2)
+    throw new Error("invert: expected non-zero number");
+  if (modulo <= _0n2)
+    throw new Error("invert: expected positive modulus, got " + modulo);
+  let a = mod(number, modulo);
+  let b = modulo;
+  let x = _0n2, y = _1n2, u = _1n2, v = _0n2;
+  while (a !== _0n2) {
+    const q = b / a;
+    const r = b - a * q;
+    const m = x - u * q;
+    const n = y - v * q;
+    b = a, a = r, x = u, y = v, u = m, v = n;
+  }
+  const gcd = b;
+  if (gcd !== _1n2)
+    throw new Error("invert: does not exist");
+  return mod(x, modulo);
+}
+function assertIsSquare(Fp3, root, n) {
+  const F = Fp3;
+  if (!F.eql(F.sqr(root), n))
+    throw new Error("Cannot find square root");
+}
+function sqrt3mod4(Fp3, n) {
+  const F = Fp3;
+  const p1div4 = (F.ORDER + _1n2) / _4n;
+  const root = F.pow(n, p1div4);
+  assertIsSquare(F, root, n);
+  return root;
+}
+function sqrt5mod8(Fp3, n) {
+  const F = Fp3;
+  const p5div8 = (F.ORDER - _5n) / _8n;
+  const n2 = F.mul(n, _2n);
+  const v = F.pow(n2, p5div8);
+  const nv = F.mul(n, v);
+  const i = F.mul(F.mul(nv, _2n), v);
+  const root = F.mul(nv, F.sub(i, F.ONE));
+  assertIsSquare(F, root, n);
+  return root;
+}
+function sqrt9mod16(P) {
+  const Fp_ = Field(P);
+  const tn = tonelliShanks(P);
+  const c1 = tn(Fp_, Fp_.neg(Fp_.ONE));
+  const c2 = tn(Fp_, c1);
+  const c3 = tn(Fp_, Fp_.neg(c1));
+  const c4 = (P + _7n) / _16n;
+  return ((Fp3, n) => {
+    const F = Fp3;
+    let tv1 = F.pow(n, c4);
+    let tv2 = F.mul(tv1, c1);
+    const tv3 = F.mul(tv1, c2);
+    const tv4 = F.mul(tv1, c3);
+    const e1 = F.eql(F.sqr(tv2), n);
+    const e2 = F.eql(F.sqr(tv3), n);
+    tv1 = F.cmov(tv1, tv2, e1);
+    tv2 = F.cmov(tv4, tv3, e2);
+    const e3 = F.eql(F.sqr(tv2), n);
+    const root = F.cmov(tv1, tv2, e3);
+    assertIsSquare(F, root, n);
+    return root;
+  });
+}
+function tonelliShanks(P) {
+  if (P < _3n)
+    throw new Error("sqrt is not defined for small field");
+  let Q = P - _1n2;
+  let S = 0;
+  while (Q % _2n === _0n2) {
+    Q /= _2n;
+    S++;
+  }
+  let Z = _2n;
+  const _Fp = Field(P);
+  while (FpLegendre(_Fp, Z) === 1) {
+    if (Z++ > 1e3)
+      throw new Error("Cannot find square root: probably non-prime P");
+  }
+  if (S === 1)
+    return sqrt3mod4;
+  let cc = _Fp.pow(Z, Q);
+  const Q1div2 = (Q + _1n2) / _2n;
+  return function tonelliSlow(Fp3, n) {
+    const F = Fp3;
+    if (F.is0(n))
+      return n;
+    if (FpLegendre(F, n) !== 1)
+      throw new Error("Cannot find square root");
+    let M = S;
+    let c = F.mul(F.ONE, cc);
+    let t = F.pow(n, Q);
+    let R = F.pow(n, Q1div2);
+    while (!F.eql(t, F.ONE)) {
+      if (F.is0(t))
+        return F.ZERO;
+      let i = 1;
+      let t_tmp = F.sqr(t);
+      while (!F.eql(t_tmp, F.ONE)) {
+        i++;
+        t_tmp = F.sqr(t_tmp);
+        if (i === M)
+          throw new Error("Cannot find square root");
+      }
+      const exponent = _1n2 << BigInt(M - i - 1);
+      const b = F.pow(c, exponent);
+      M = i;
+      c = F.sqr(b);
+      t = F.mul(t, c);
+      R = F.mul(R, b);
+    }
+    return R;
+  };
+}
+function FpSqrt(P) {
+  if (P % _4n === _3n)
+    return sqrt3mod4;
+  if (P % _8n === _5n)
+    return sqrt5mod8;
+  if (P % _16n === _9n)
+    return sqrt9mod16(P);
+  return tonelliShanks(P);
+}
+var FIELD_FIELDS = [
+  "create",
+  "isValid",
+  "is0",
+  "neg",
+  "inv",
+  "sqrt",
+  "sqr",
+  "eql",
+  "add",
+  "sub",
+  "mul",
+  "pow",
+  "div",
+  "addN",
+  "subN",
+  "mulN",
+  "sqrN"
+];
+function validateField(field) {
+  const initial = {
+    ORDER: "bigint",
+    BYTES: "number",
+    BITS: "number"
+  };
+  const opts = FIELD_FIELDS.reduce((map, val) => {
+    map[val] = "function";
+    return map;
+  }, initial);
+  validateObject(field, opts);
+  asafenumber(field.BYTES, "BYTES");
+  asafenumber(field.BITS, "BITS");
+  if (field.BYTES < 1 || field.BITS < 1)
+    throw new Error("invalid field: expected BYTES/BITS > 0");
+  if (field.ORDER <= _1n2)
+    throw new Error("invalid field: expected ORDER > 1, got " + field.ORDER);
+  return field;
+}
+function FpPow(Fp3, num, power) {
+  const F = Fp3;
+  if (power < _0n2)
+    throw new Error("invalid exponent, negatives unsupported");
+  if (power === _0n2)
+    return F.ONE;
+  if (power === _1n2)
+    return num;
+  let p = F.ONE;
+  let d = num;
+  while (power > _0n2) {
+    if (power & _1n2)
+      p = F.mul(p, d);
+    d = F.sqr(d);
+    power >>= _1n2;
+  }
+  return p;
+}
+function FpInvertBatch(Fp3, nums, passZero = false) {
+  const F = Fp3;
+  const inverted = new Array(nums.length).fill(passZero ? F.ZERO : void 0);
+  const multipliedAcc = nums.reduce((acc, num, i) => {
+    if (F.is0(num))
+      return acc;
+    inverted[i] = acc;
+    return F.mul(acc, num);
+  }, F.ONE);
+  const invertedAcc = F.inv(multipliedAcc);
+  nums.reduceRight((acc, num, i) => {
+    if (F.is0(num))
+      return acc;
+    inverted[i] = F.mul(acc, inverted[i]);
+    return F.mul(acc, num);
+  }, invertedAcc);
+  return inverted;
+}
+function FpLegendre(Fp3, n) {
+  const F = Fp3;
+  const p1mod2 = (F.ORDER - _1n2) / _2n;
+  const powered = F.pow(n, p1mod2);
+  const yes = F.eql(powered, F.ONE);
+  const zero = F.eql(powered, F.ZERO);
+  const no = F.eql(powered, F.neg(F.ONE));
+  if (!yes && !zero && !no)
+    throw new Error("invalid Legendre symbol result");
+  return yes ? 1 : zero ? 0 : -1;
+}
+function nLength(n, nBitLength) {
+  if (nBitLength !== void 0)
+    anumber2(nBitLength);
+  if (n <= _0n2)
+    throw new Error("invalid n length: expected positive n, got " + n);
+  if (nBitLength !== void 0 && nBitLength < 1)
+    throw new Error("invalid n length: expected positive bit length, got " + nBitLength);
+  const bits = bitLen(n);
+  if (nBitLength !== void 0 && nBitLength < bits)
+    throw new Error(`invalid n length: expected bit length (${bits}) >= n.length (${nBitLength})`);
+  const _nBitLength = nBitLength !== void 0 ? nBitLength : bits;
+  const nByteLength = Math.ceil(_nBitLength / 8);
+  return { nBitLength: _nBitLength, nByteLength };
+}
+var FIELD_SQRT = /* @__PURE__ */ new WeakMap();
+var _Field = class {
+  ORDER;
+  BITS;
+  BYTES;
+  isLE;
+  ZERO = _0n2;
+  ONE = _1n2;
+  _lengths;
+  _mod;
+  constructor(ORDER, opts = {}) {
+    if (ORDER <= _1n2)
+      throw new Error("invalid field: expected ORDER > 1, got " + ORDER);
+    let _nbitLength = void 0;
+    this.isLE = false;
+    if (opts != null && typeof opts === "object") {
+      if (typeof opts.BITS === "number")
+        _nbitLength = opts.BITS;
+      if (typeof opts.sqrt === "function")
+        Object.defineProperty(this, "sqrt", { value: opts.sqrt, enumerable: true });
+      if (typeof opts.isLE === "boolean")
+        this.isLE = opts.isLE;
+      if (opts.allowedLengths)
+        this._lengths = Object.freeze(opts.allowedLengths.slice());
+      if (typeof opts.modFromBytes === "boolean")
+        this._mod = opts.modFromBytes;
+    }
+    const { nBitLength, nByteLength } = nLength(ORDER, _nbitLength);
+    if (nByteLength > 2048)
+      throw new Error("invalid field: expected ORDER of <= 2048 bytes");
+    this.ORDER = ORDER;
+    this.BITS = nBitLength;
+    this.BYTES = nByteLength;
+    Object.freeze(this);
+  }
+  create(num) {
+    return mod(num, this.ORDER);
+  }
+  isValid(num) {
+    if (typeof num !== "bigint")
+      throw new TypeError("invalid field element: expected bigint, got " + typeof num);
+    return _0n2 <= num && num < this.ORDER;
+  }
+  is0(num) {
+    return num === _0n2;
+  }
+  // is valid and invertible
+  isValidNot0(num) {
+    return !this.is0(num) && this.isValid(num);
+  }
+  isOdd(num) {
+    return (num & _1n2) === _1n2;
+  }
+  neg(num) {
+    return mod(-num, this.ORDER);
+  }
+  eql(lhs, rhs) {
+    return lhs === rhs;
+  }
+  sqr(num) {
+    return mod(num * num, this.ORDER);
+  }
+  add(lhs, rhs) {
+    return mod(lhs + rhs, this.ORDER);
+  }
+  sub(lhs, rhs) {
+    return mod(lhs - rhs, this.ORDER);
+  }
+  mul(lhs, rhs) {
+    return mod(lhs * rhs, this.ORDER);
+  }
+  pow(num, power) {
+    return FpPow(this, num, power);
+  }
+  div(lhs, rhs) {
+    return mod(lhs * invert(rhs, this.ORDER), this.ORDER);
+  }
+  // Same as above, but doesn't normalize
+  sqrN(num) {
+    return num * num;
+  }
+  addN(lhs, rhs) {
+    return lhs + rhs;
+  }
+  subN(lhs, rhs) {
+    return lhs - rhs;
+  }
+  mulN(lhs, rhs) {
+    return lhs * rhs;
+  }
+  inv(num) {
+    return invert(num, this.ORDER);
+  }
+  sqrt(num) {
+    let sqrt = FIELD_SQRT.get(this);
+    if (!sqrt)
+      FIELD_SQRT.set(this, sqrt = FpSqrt(this.ORDER));
+    return sqrt(this, num);
+  }
+  toBytes(num) {
+    return this.isLE ? numberToBytesLE(num, this.BYTES) : numberToBytesBE(num, this.BYTES);
+  }
+  fromBytes(bytes, skipValidation = false) {
+    abytes2(bytes);
+    const { _lengths: allowedLengths, BYTES, isLE: isLE2, ORDER, _mod: modFromBytes } = this;
+    if (allowedLengths) {
+      if (bytes.length < 1 || !allowedLengths.includes(bytes.length) || bytes.length > BYTES) {
+        throw new Error("Field.fromBytes: expected " + allowedLengths + " bytes, got " + bytes.length);
+      }
+      const padded = new Uint8Array(BYTES);
+      padded.set(bytes, isLE2 ? 0 : padded.length - bytes.length);
+      bytes = padded;
+    }
+    if (bytes.length !== BYTES)
+      throw new Error("Field.fromBytes: expected " + BYTES + " bytes, got " + bytes.length);
+    let scalar = isLE2 ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);
+    if (modFromBytes)
+      scalar = mod(scalar, ORDER);
+    if (!skipValidation) {
+      if (!this.isValid(scalar))
+        throw new Error("invalid field element: outside of range 0..ORDER");
+    }
+    return scalar;
+  }
+  // TODO: we don't need it here, move out to separate fn
+  invertBatch(lst) {
+    return FpInvertBatch(this, lst);
+  }
+  // We can't move this out because Fp6, Fp12 implement it
+  // and it's unclear what to return in there.
+  cmov(a, b, condition) {
+    abool(condition, "condition");
+    return condition ? b : a;
+  }
+};
+Object.freeze(_Field.prototype);
+function Field(ORDER, opts = {}) {
+  return new _Field(ORDER, opts);
+}
+function getFieldBytesLength(fieldOrder) {
+  if (typeof fieldOrder !== "bigint")
+    throw new Error("field order must be bigint");
+  if (fieldOrder <= _1n2)
+    throw new Error("field order must be greater than 1");
+  const bitLength = bitLen(fieldOrder - _1n2);
+  return Math.ceil(bitLength / 8);
+}
+function getMinHashLength(fieldOrder) {
+  const length = getFieldBytesLength(fieldOrder);
+  return length + Math.ceil(length / 2);
+}
+function mapHashToField(key, fieldOrder, isLE2 = false) {
+  abytes2(key);
+  const len = key.length;
+  const fieldLen = getFieldBytesLength(fieldOrder);
+  const minLen = Math.max(getMinHashLength(fieldOrder), 16);
+  if (len < minLen || len > 1024)
+    throw new Error("expected " + minLen + "-1024 bytes of input, got " + len);
+  const num = isLE2 ? bytesToNumberLE(key) : bytesToNumberBE(key);
+  const reduced = mod(num, fieldOrder - _1n2) + _1n2;
+  return isLE2 ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
+}
+
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/curve.js
+var _0n3 = /* @__PURE__ */ BigInt(0);
+var _1n3 = /* @__PURE__ */ BigInt(1);
+function negateCt(condition, item) {
+  const neg = item.negate();
+  return condition ? neg : item;
+}
+function normalizeZ(c, points) {
+  const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));
+  return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));
+}
+function validateW(W, bits) {
+  if (!Number.isSafeInteger(W) || W <= 0 || W > bits)
+    throw new Error("invalid window size, expected [1.." + bits + "], got W=" + W);
+}
+function calcWOpts(W, scalarBits) {
+  validateW(W, scalarBits);
+  const windows = Math.ceil(scalarBits / W) + 1;
+  const windowSize = 2 ** (W - 1);
+  const maxNumber = 2 ** W;
+  const mask = bitMask(W);
+  const shiftBy = BigInt(W);
+  return { windows, windowSize, mask, maxNumber, shiftBy };
+}
+function calcOffsets(n, window, wOpts) {
+  const { windowSize, mask, maxNumber, shiftBy } = wOpts;
+  let wbits = Number(n & mask);
+  let nextN = n >> shiftBy;
+  if (wbits > windowSize) {
+    wbits -= maxNumber;
+    nextN += _1n3;
+  }
+  const offsetStart = window * windowSize;
+  const offset = offsetStart + Math.abs(wbits) - 1;
+  const isZero = wbits === 0;
+  const isNeg = wbits < 0;
+  const isNegF = window % 2 !== 0;
+  const offsetF = offsetStart;
+  return { nextN, offset, isZero, isNeg, isNegF, offsetF };
+}
+var pointPrecomputes = /* @__PURE__ */ new WeakMap();
+var pointWindowSizes = /* @__PURE__ */ new WeakMap();
+function getW(P) {
+  return pointWindowSizes.get(P) || 1;
+}
+function assert0(n) {
+  if (n !== _0n3)
+    throw new Error("invalid wNAF");
+}
+var wNAF = class {
+  BASE;
+  ZERO;
+  Fn;
+  bits;
+  // Parametrized with a given Point class (not individual point)
+  constructor(Point, bits) {
+    this.BASE = Point.BASE;
+    this.ZERO = Point.ZERO;
+    this.Fn = Point.Fn;
+    this.bits = bits;
+  }
+  // non-const time multiplication ladder
+  _unsafeLadder(elm, n, p = this.ZERO) {
+    let d = elm;
+    while (n > _0n3) {
+      if (n & _1n3)
+        p = p.add(d);
+      d = d.double();
+      n >>= _1n3;
+    }
+    return p;
+  }
+  /**
+   * Creates a wNAF precomputation window. Used for caching.
+   * Default window size is set by `utils.precompute()` and is equal to 8.
+   * Number of precomputed points depends on the curve size:
+   * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+   * - 𝑊 is the window size
+   * - 𝑛 is the bitlength of the curve order.
+   * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+   * @param point - Point instance
+   * @param W - window size
+   * @returns precomputed point tables flattened to a single array
+   */
+  precomputeWindow(point, W) {
+    const { windows, windowSize } = calcWOpts(W, this.bits);
+    const points = [];
+    let p = point;
+    let base = p;
+    for (let window = 0; window < windows; window++) {
+      base = p;
+      points.push(base);
+      for (let i = 1; i < windowSize; i++) {
+        base = base.add(p);
+        points.push(base);
+      }
+      p = base.double();
+    }
+    return points;
+  }
+  /**
+   * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
+   * More compact implementation:
+   * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541
+   * @returns real and fake (for const-time) points
+   */
+  wNAF(W, precomputes, n) {
+    if (!this.Fn.isValid(n))
+      throw new Error("invalid scalar");
+    let p = this.ZERO;
+    let f = this.BASE;
+    const wo = calcWOpts(W, this.bits);
+    for (let window = 0; window < wo.windows; window++) {
+      const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);
+      n = nextN;
+      if (isZero) {
+        f = f.add(negateCt(isNegF, precomputes[offsetF]));
+      } else {
+        p = p.add(negateCt(isNeg, precomputes[offset]));
+      }
+    }
+    assert0(n);
+    return { p, f };
+  }
+  /**
+   * Implements unsafe EC multiplication using precomputed tables
+   * and w-ary non-adjacent form.
+   * @param acc - accumulator point to add result of multiplication
+   * @returns point
+   */
+  wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {
+    const wo = calcWOpts(W, this.bits);
+    for (let window = 0; window < wo.windows; window++) {
+      if (n === _0n3)
+        break;
+      const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);
+      n = nextN;
+      if (isZero) {
+        continue;
+      } else {
+        const item = precomputes[offset];
+        acc = acc.add(isNeg ? item.negate() : item);
+      }
+    }
+    assert0(n);
+    return acc;
+  }
+  getPrecomputes(W, point, transform) {
+    let comp = pointPrecomputes.get(point);
+    if (!comp) {
+      comp = this.precomputeWindow(point, W);
+      if (W !== 1) {
+        if (typeof transform === "function")
+          comp = transform(comp);
+        pointPrecomputes.set(point, comp);
+      }
+    }
+    return comp;
+  }
+  cached(point, scalar, transform) {
+    const W = getW(point);
+    return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);
+  }
+  unsafe(point, scalar, transform, prev) {
+    const W = getW(point);
+    if (W === 1)
+      return this._unsafeLadder(point, scalar, prev);
+    return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);
+  }
+  // We calculate precomputes for elliptic curve point multiplication
+  // using windowed method. This specifies window size and
+  // stores precomputed values. Usually only base point would be precomputed.
+  createCache(P, W) {
+    validateW(W, this.bits);
+    pointWindowSizes.set(P, W);
+    pointPrecomputes.delete(P);
+  }
+  hasCache(elm) {
+    return getW(elm) !== 1;
+  }
+};
+function mulEndoUnsafe(Point, point, k1, k2) {
+  let acc = point;
+  let p1 = Point.ZERO;
+  let p2 = Point.ZERO;
+  while (k1 > _0n3 || k2 > _0n3) {
+    if (k1 & _1n3)
+      p1 = p1.add(acc);
+    if (k2 & _1n3)
+      p2 = p2.add(acc);
+    acc = acc.double();
+    k1 >>= _1n3;
+    k2 >>= _1n3;
+  }
+  return { p1, p2 };
+}
+function createField(order, field, isLE2) {
+  if (field) {
+    if (field.ORDER !== order)
+      throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
+    validateField(field);
+    return field;
+  } else {
+    return Field(order, { isLE: isLE2 });
+  }
+}
+function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
+  if (FpFnLE === void 0)
+    FpFnLE = type === "edwards";
+  if (!CURVE || typeof CURVE !== "object")
+    throw new Error(`expected valid ${type} CURVE object`);
+  for (const p of ["p", "n", "h"]) {
+    const val = CURVE[p];
+    if (!(typeof val === "bigint" && val > _0n3))
+      throw new Error(`CURVE.${p} must be positive bigint`);
+  }
+  const Fp3 = createField(CURVE.p, curveOpts.Fp, FpFnLE);
+  const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);
+  const _b = type === "weierstrass" ? "b" : "d";
+  const params = ["Gx", "Gy", "a", _b];
+  for (const p of params) {
+    if (!Fp3.isValid(CURVE[p]))
+      throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);
+  }
+  CURVE = Object.freeze(Object.assign({}, CURVE));
+  return { CURVE, Fp: Fp3, Fn };
+}
+
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/weierstrass.js
+var divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n2) / den;
+function _splitEndoScalar(k, basis, n) {
+  aInRange("scalar", k, _0n4, n);
+  const [[a1, b1], [a2, b2]] = basis;
+  const c1 = divNearest(b2 * k, n);
+  const c2 = divNearest(-b1 * k, n);
+  let k1 = k - c1 * a1 - c2 * a2;
+  let k2 = -c1 * b1 - c2 * b2;
+  const k1neg = k1 < _0n4;
+  const k2neg = k2 < _0n4;
+  if (k1neg)
+    k1 = -k1;
+  if (k2neg)
+    k2 = -k2;
+  const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n4;
+  if (k1 < _0n4 || k1 >= MAX_NUM || k2 < _0n4 || k2 >= MAX_NUM) {
+    throw new Error("splitScalar (endomorphism): failed for k");
+  }
+  return { k1neg, k1, k2neg, k2 };
+}
+var DERErr = class extends Error {
+  constructor(m = "") {
+    super(m);
+  }
+};
+var DER = {
+  // asn.1 DER encoding utils
+  Err: DERErr,
+  // Basic building block is TLV (Tag-Length-Value)
+  _tlv: {
+    encode: (tag, data) => {
+      const { Err: E } = DER;
+      asafenumber(tag, "tag");
+      if (tag < 0 || tag > 255)
+        throw new E("tlv.encode: wrong tag");
+      if (typeof data !== "string")
+        throw new TypeError('"data" expected string, got type=' + typeof data);
+      if (data.length & 1)
+        throw new E("tlv.encode: unpadded data");
+      const dataLen = data.length / 2;
+      const len = numberToHexUnpadded(dataLen);
+      if (len.length / 2 & 128)
+        throw new E("tlv.encode: long form length too big");
+      const lenLen = dataLen > 127 ? numberToHexUnpadded(len.length / 2 | 128) : "";
+      const t = numberToHexUnpadded(tag);
+      return t + lenLen + len + data;
+    },
+    // v - value, l - left bytes (unparsed)
+    decode(tag, data) {
+      const { Err: E } = DER;
+      data = abytes2(data, void 0, "DER data");
+      let pos = 0;
+      if (tag < 0 || tag > 255)
+        throw new E("tlv.encode: wrong tag");
+      if (data.length < 2 || data[pos++] !== tag)
+        throw new E("tlv.decode: wrong tlv");
+      const first = data[pos++];
+      const isLong = !!(first & 128);
+      let length = 0;
+      if (!isLong)
+        length = first;
+      else {
+        const lenLen = first & 127;
+        if (!lenLen)
+          throw new E("tlv.decode(long): indefinite length not supported");
+        if (lenLen > 4)
+          throw new E("tlv.decode(long): byte length is too big");
+        const lengthBytes = data.subarray(pos, pos + lenLen);
+        if (lengthBytes.length !== lenLen)
+          throw new E("tlv.decode: length bytes not complete");
+        if (lengthBytes[0] === 0)
+          throw new E("tlv.decode(long): zero leftmost byte");
+        for (const b of lengthBytes)
+          length = length << 8 | b;
+        pos += lenLen;
+        if (length < 128)
+          throw new E("tlv.decode(long): not minimal encoding");
+      }
+      const v = data.subarray(pos, pos + length);
+      if (v.length !== length)
+        throw new E("tlv.decode: wrong value length");
+      return { v, l: data.subarray(pos + length) };
+    }
+  },
+  // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,
+  // since we always use positive integers here. It must always be empty:
+  // - add zero byte if exists
+  // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)
+  _int: {
+    encode(num) {
+      const { Err: E } = DER;
+      abignumber(num);
+      if (num < _0n4)
+        throw new E("integer: negative integers are not allowed");
+      let hex = numberToHexUnpadded(num);
+      if (Number.parseInt(hex[0], 16) & 8)
+        hex = "00" + hex;
+      if (hex.length & 1)
+        throw new E("unexpected DER parsing assertion: unpadded hex");
+      return hex;
+    },
+    decode(data) {
+      const { Err: E } = DER;
+      if (data.length < 1)
+        throw new E("invalid signature integer: empty");
+      if (data[0] & 128)
+        throw new E("invalid signature integer: negative");
+      if (data.length > 1 && data[0] === 0 && !(data[1] & 128))
+        throw new E("invalid signature integer: unnecessary leading zero");
+      return bytesToNumberBE(data);
+    }
+  },
+  toSig(bytes) {
+    const { Err: E, _int: int, _tlv: tlv } = DER;
+    const data = abytes2(bytes, void 0, "signature");
+    const { v: seqBytes, l: seqLeftBytes } = tlv.decode(48, data);
+    if (seqLeftBytes.length)
+      throw new E("invalid signature: left bytes after parsing");
+    const { v: rBytes, l: rLeftBytes } = tlv.decode(2, seqBytes);
+    const { v: sBytes, l: sLeftBytes } = tlv.decode(2, rLeftBytes);
+    if (sLeftBytes.length)
+      throw new E("invalid signature: left bytes after parsing");
+    return { r: int.decode(rBytes), s: int.decode(sBytes) };
+  },
+  hexFromSig(sig) {
+    const { _tlv: tlv, _int: int } = DER;
+    const rs = tlv.encode(2, int.encode(sig.r));
+    const ss = tlv.encode(2, int.encode(sig.s));
+    const seq = rs + ss;
+    return tlv.encode(48, seq);
+  }
+};
+Object.freeze(DER._tlv);
+Object.freeze(DER._int);
+Object.freeze(DER);
+var _0n4 = /* @__PURE__ */ BigInt(0);
+var _1n4 = /* @__PURE__ */ BigInt(1);
+var _2n2 = /* @__PURE__ */ BigInt(2);
+var _3n2 = /* @__PURE__ */ BigInt(3);
+var _4n2 = /* @__PURE__ */ BigInt(4);
+function weierstrass(params, extraOpts = {}) {
+  const validated = createCurveFields("weierstrass", params, extraOpts);
+  const Fp3 = validated.Fp;
+  const Fn = validated.Fn;
+  let CURVE = validated.CURVE;
+  const { h: cofactor, n: CURVE_ORDER } = CURVE;
+  validateObject(extraOpts, {}, {
+    allowInfinityPoint: "boolean",
+    clearCofactor: "function",
+    isTorsionFree: "function",
+    fromBytes: "function",
+    toBytes: "function",
+    endo: "object"
+  });
+  const { endo, allowInfinityPoint } = extraOpts;
+  if (endo) {
+    if (!Fp3.is0(CURVE.a) || typeof endo.beta !== "bigint" || !Array.isArray(endo.basises)) {
+      throw new Error('invalid endo: expected "beta": bigint and "basises": array');
+    }
+  }
+  const lengths = getWLengths(Fp3, Fn);
+  function assertCompressionIsSupported() {
+    if (!Fp3.isOdd)
+      throw new Error("compression is not supported: Field does not have .isOdd()");
+  }
+  function pointToBytes(_c, point, isCompressed) {
+    if (allowInfinityPoint && point.is0())
+      return Uint8Array.of(0);
+    const { x, y } = point.toAffine();
+    const bx = Fp3.toBytes(x);
+    abool(isCompressed, "isCompressed");
+    if (isCompressed) {
+      assertCompressionIsSupported();
+      const hasEvenY = !Fp3.isOdd(y);
+      return concatBytes2(pprefix(hasEvenY), bx);
+    } else {
+      return concatBytes2(Uint8Array.of(4), bx, Fp3.toBytes(y));
+    }
+  }
+  function pointFromBytes(bytes) {
+    abytes2(bytes, void 0, "Point");
+    const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths;
+    const length = bytes.length;
+    const head = bytes[0];
+    const tail = bytes.subarray(1);
+    if (allowInfinityPoint && length === 1 && head === 0)
+      return { x: Fp3.ZERO, y: Fp3.ZERO };
+    if (length === comp && (head === 2 || head === 3)) {
+      const x = Fp3.fromBytes(tail);
+      if (!Fp3.isValid(x))
+        throw new Error("bad point: is not on curve, wrong x");
+      const y2 = weierstrassEquation(x);
+      let y;
+      try {
+        y = Fp3.sqrt(y2);
+      } catch (sqrtError) {
+        const err = sqrtError instanceof Error ? ": " + sqrtError.message : "";
+        throw new Error("bad point: is not on curve, sqrt error" + err);
+      }
+      assertCompressionIsSupported();
+      const evenY = Fp3.isOdd(y);
+      const evenH = (head & 1) === 1;
+      if (evenH !== evenY)
+        y = Fp3.neg(y);
+      return { x, y };
+    } else if (length === uncomp && head === 4) {
+      const L = Fp3.BYTES;
+      const x = Fp3.fromBytes(tail.subarray(0, L));
+      const y = Fp3.fromBytes(tail.subarray(L, L * 2));
+      if (!isValidXY(x, y))
+        throw new Error("bad point: is not on curve");
+      return { x, y };
+    } else {
+      throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);
+    }
+  }
+  const encodePoint = extraOpts.toBytes === void 0 ? pointToBytes : extraOpts.toBytes;
+  const decodePoint = extraOpts.fromBytes === void 0 ? pointFromBytes : extraOpts.fromBytes;
+  function weierstrassEquation(x) {
+    const x2 = Fp3.sqr(x);
+    const x3 = Fp3.mul(x2, x);
+    return Fp3.add(Fp3.add(x3, Fp3.mul(x, CURVE.a)), CURVE.b);
+  }
+  function isValidXY(x, y) {
+    const left = Fp3.sqr(y);
+    const right = weierstrassEquation(x);
+    return Fp3.eql(left, right);
+  }
+  if (!isValidXY(CURVE.Gx, CURVE.Gy))
+    throw new Error("bad curve params: generator point");
+  const _4a3 = Fp3.mul(Fp3.pow(CURVE.a, _3n2), _4n2);
+  const _27b2 = Fp3.mul(Fp3.sqr(CURVE.b), BigInt(27));
+  if (Fp3.is0(Fp3.add(_4a3, _27b2)))
+    throw new Error("bad curve params: a or b");
+  function acoord(title, n, banZero = false) {
+    if (!Fp3.isValid(n) || banZero && Fp3.is0(n))
+      throw new Error(`bad point coordinate ${title}`);
+    return n;
+  }
+  function aprjpoint(other) {
+    if (!(other instanceof Point))
+      throw new Error("Weierstrass Point expected");
+  }
+  function splitEndoScalarN(k) {
+    if (!endo || !endo.basises)
+      throw new Error("no endo");
+    return _splitEndoScalar(k, endo.basises, Fn.ORDER);
+  }
+  function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {
+    k2p = new Point(Fp3.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);
+    k1p = negateCt(k1neg, k1p);
+    k2p = negateCt(k2neg, k2p);
+    return k1p.add(k2p);
+  }
+  class Point {
+    // base / generator point
+    static BASE = new Point(CURVE.Gx, CURVE.Gy, Fp3.ONE);
+    // zero / infinity / identity point
+    static ZERO = new Point(Fp3.ZERO, Fp3.ONE, Fp3.ZERO);
+    // 0, 1, 0
+    // math field
+    static Fp = Fp3;
+    // scalar field
+    static Fn = Fn;
+    X;
+    Y;
+    Z;
+    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
+    constructor(X, Y, Z) {
+      this.X = acoord("x", X);
+      this.Y = acoord("y", Y, true);
+      this.Z = acoord("z", Z);
+      Object.freeze(this);
+    }
+    static CURVE() {
+      return CURVE;
+    }
+    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
+    static fromAffine(p) {
+      const { x, y } = p || {};
+      if (!p || !Fp3.isValid(x) || !Fp3.isValid(y))
+        throw new Error("invalid affine point");
+      if (p instanceof Point)
+        throw new Error("projective point not allowed");
+      if (Fp3.is0(x) && Fp3.is0(y))
+        return Point.ZERO;
+      return new Point(x, y, Fp3.ONE);
+    }
+    static fromBytes(bytes) {
+      const P = Point.fromAffine(decodePoint(abytes2(bytes, void 0, "point")));
+      P.assertValidity();
+      return P;
+    }
+    static fromHex(hex) {
+      return Point.fromBytes(hexToBytes2(hex));
+    }
+    get x() {
+      return this.toAffine().x;
+    }
+    get y() {
+      return this.toAffine().y;
+    }
+    /**
+     *
+     * @param windowSize
+     * @param isLazy - true will defer table computation until the first multiplication
+     * @returns
+     */
+    precompute(windowSize = 8, isLazy = true) {
+      wnaf.createCache(this, windowSize);
+      if (!isLazy)
+        this.multiply(_3n2);
+      return this;
+    }
+    // TODO: return `this`
+    /** A point on curve is valid if it conforms to equation. */
+    assertValidity() {
+      const p = this;
+      if (p.is0()) {
+        if (extraOpts.allowInfinityPoint && Fp3.is0(p.X) && Fp3.eql(p.Y, Fp3.ONE) && Fp3.is0(p.Z))
+          return;
+        throw new Error("bad point: ZERO");
+      }
+      const { x, y } = p.toAffine();
+      if (!Fp3.isValid(x) || !Fp3.isValid(y))
+        throw new Error("bad point: x or y not field elements");
+      if (!isValidXY(x, y))
+        throw new Error("bad point: equation left != right");
+      if (!p.isTorsionFree())
+        throw new Error("bad point: not in prime-order subgroup");
+    }
+    hasEvenY() {
+      const { y } = this.toAffine();
+      if (!Fp3.isOdd)
+        throw new Error("Field doesn't support isOdd");
+      return !Fp3.isOdd(y);
+    }
+    /** Compare one point to another. */
+    equals(other) {
+      aprjpoint(other);
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      const { X: X2, Y: Y2, Z: Z2 } = other;
+      const U1 = Fp3.eql(Fp3.mul(X1, Z2), Fp3.mul(X2, Z1));
+      const U2 = Fp3.eql(Fp3.mul(Y1, Z2), Fp3.mul(Y2, Z1));
+      return U1 && U2;
+    }
+    /** Flips point to one corresponding to (x, -y) in Affine coordinates. */
+    negate() {
+      return new Point(this.X, Fp3.neg(this.Y), this.Z);
+    }
+    // Renes-Costello-Batina exception-free doubling formula.
+    // There is 30% faster Jacobian formula, but it is not complete.
+    // https://eprint.iacr.org/2015/1060, algorithm 3
+    // Cost: 8M + 3S + 3*a + 2*b3 + 15add.
+    double() {
+      const { a, b } = CURVE;
+      const b3 = Fp3.mul(b, _3n2);
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      let X3 = Fp3.ZERO, Y3 = Fp3.ZERO, Z3 = Fp3.ZERO;
+      let t0 = Fp3.mul(X1, X1);
+      let t1 = Fp3.mul(Y1, Y1);
+      let t2 = Fp3.mul(Z1, Z1);
+      let t3 = Fp3.mul(X1, Y1);
+      t3 = Fp3.add(t3, t3);
+      Z3 = Fp3.mul(X1, Z1);
+      Z3 = Fp3.add(Z3, Z3);
+      X3 = Fp3.mul(a, Z3);
+      Y3 = Fp3.mul(b3, t2);
+      Y3 = Fp3.add(X3, Y3);
+      X3 = Fp3.sub(t1, Y3);
+      Y3 = Fp3.add(t1, Y3);
+      Y3 = Fp3.mul(X3, Y3);
+      X3 = Fp3.mul(t3, X3);
+      Z3 = Fp3.mul(b3, Z3);
+      t2 = Fp3.mul(a, t2);
+      t3 = Fp3.sub(t0, t2);
+      t3 = Fp3.mul(a, t3);
+      t3 = Fp3.add(t3, Z3);
+      Z3 = Fp3.add(t0, t0);
+      t0 = Fp3.add(Z3, t0);
+      t0 = Fp3.add(t0, t2);
+      t0 = Fp3.mul(t0, t3);
+      Y3 = Fp3.add(Y3, t0);
+      t2 = Fp3.mul(Y1, Z1);
+      t2 = Fp3.add(t2, t2);
+      t0 = Fp3.mul(t2, t3);
+      X3 = Fp3.sub(X3, t0);
+      Z3 = Fp3.mul(t2, t1);
+      Z3 = Fp3.add(Z3, Z3);
+      Z3 = Fp3.add(Z3, Z3);
+      return new Point(X3, Y3, Z3);
+    }
+    // Renes-Costello-Batina exception-free addition formula.
+    // There is 30% faster Jacobian formula, but it is not complete.
+    // https://eprint.iacr.org/2015/1060, algorithm 1
+    // Cost: 12M + 0S + 3*a + 3*b3 + 23add.
+    add(other) {
+      aprjpoint(other);
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      const { X: X2, Y: Y2, Z: Z2 } = other;
+      let X3 = Fp3.ZERO, Y3 = Fp3.ZERO, Z3 = Fp3.ZERO;
+      const a = CURVE.a;
+      const b3 = Fp3.mul(CURVE.b, _3n2);
+      let t0 = Fp3.mul(X1, X2);
+      let t1 = Fp3.mul(Y1, Y2);
+      let t2 = Fp3.mul(Z1, Z2);
+      let t3 = Fp3.add(X1, Y1);
+      let t4 = Fp3.add(X2, Y2);
+      t3 = Fp3.mul(t3, t4);
+      t4 = Fp3.add(t0, t1);
+      t3 = Fp3.sub(t3, t4);
+      t4 = Fp3.add(X1, Z1);
+      let t5 = Fp3.add(X2, Z2);
+      t4 = Fp3.mul(t4, t5);
+      t5 = Fp3.add(t0, t2);
+      t4 = Fp3.sub(t4, t5);
+      t5 = Fp3.add(Y1, Z1);
+      X3 = Fp3.add(Y2, Z2);
+      t5 = Fp3.mul(t5, X3);
+      X3 = Fp3.add(t1, t2);
+      t5 = Fp3.sub(t5, X3);
+      Z3 = Fp3.mul(a, t4);
+      X3 = Fp3.mul(b3, t2);
+      Z3 = Fp3.add(X3, Z3);
+      X3 = Fp3.sub(t1, Z3);
+      Z3 = Fp3.add(t1, Z3);
+      Y3 = Fp3.mul(X3, Z3);
+      t1 = Fp3.add(t0, t0);
+      t1 = Fp3.add(t1, t0);
+      t2 = Fp3.mul(a, t2);
+      t4 = Fp3.mul(b3, t4);
+      t1 = Fp3.add(t1, t2);
+      t2 = Fp3.sub(t0, t2);
+      t2 = Fp3.mul(a, t2);
+      t4 = Fp3.add(t4, t2);
+      t0 = Fp3.mul(t1, t4);
+      Y3 = Fp3.add(Y3, t0);
+      t0 = Fp3.mul(t5, t4);
+      X3 = Fp3.mul(t3, X3);
+      X3 = Fp3.sub(X3, t0);
+      t0 = Fp3.mul(t3, t1);
+      Z3 = Fp3.mul(t5, Z3);
+      Z3 = Fp3.add(Z3, t0);
+      return new Point(X3, Y3, Z3);
+    }
+    subtract(other) {
+      aprjpoint(other);
+      return this.add(other.negate());
+    }
+    is0() {
+      return this.equals(Point.ZERO);
+    }
+    /**
+     * Constant time multiplication.
+     * Uses wNAF method. Windowed method may be 10% faster,
+     * but takes 2x longer to generate and consumes 2x memory.
+     * Uses precomputes when available.
+     * Uses endomorphism for Koblitz curves.
+     * @param scalar - by which the point would be multiplied
+     * @returns New point
+     */
+    multiply(scalar) {
+      const { endo: endo2 } = extraOpts;
+      if (!Fn.isValidNot0(scalar))
+        throw new RangeError("invalid scalar: out of range");
+      let point, fake;
+      const mul = (n) => wnaf.cached(this, n, (p) => normalizeZ(Point, p));
+      if (endo2) {
+        const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(scalar);
+        const { p: k1p, f: k1f } = mul(k1);
+        const { p: k2p, f: k2f } = mul(k2);
+        fake = k1f.add(k2f);
+        point = finishEndo(endo2.beta, k1p, k2p, k1neg, k2neg);
+      } else {
+        const { p, f } = mul(scalar);
+        point = p;
+        fake = f;
+      }
+      return normalizeZ(Point, [point, fake])[0];
+    }
+    /**
+     * Non-constant-time multiplication. Uses double-and-add algorithm.
+     * It's faster, but should only be used when you don't care about
+     * an exposed secret key e.g. sig verification, which works over *public* keys.
+     */
+    multiplyUnsafe(scalar) {
+      const { endo: endo2 } = extraOpts;
+      const p = this;
+      const sc = scalar;
+      if (!Fn.isValid(sc))
+        throw new RangeError("invalid scalar: out of range");
+      if (sc === _0n4 || p.is0())
+        return Point.ZERO;
+      if (sc === _1n4)
+        return p;
+      if (wnaf.hasCache(this))
+        return this.multiply(sc);
+      if (endo2) {
+        const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(sc);
+        const { p1, p2 } = mulEndoUnsafe(Point, p, k1, k2);
+        return finishEndo(endo2.beta, p1, p2, k1neg, k2neg);
+      } else {
+        return wnaf.unsafe(p, sc);
+      }
+    }
+    /**
+     * Converts Projective point to affine (x, y) coordinates.
+     * (X, Y, Z) ∋ (x=X/Z, y=Y/Z).
+     * @param invertedZ - Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch
+     */
+    toAffine(invertedZ) {
+      const p = this;
+      let iz = invertedZ;
+      const { X, Y, Z } = p;
+      if (Fp3.eql(Z, Fp3.ONE))
+        return { x: X, y: Y };
+      const is0 = p.is0();
+      if (iz == null)
+        iz = is0 ? Fp3.ONE : Fp3.inv(Z);
+      const x = Fp3.mul(X, iz);
+      const y = Fp3.mul(Y, iz);
+      const zz = Fp3.mul(Z, iz);
+      if (is0)
+        return { x: Fp3.ZERO, y: Fp3.ZERO };
+      if (!Fp3.eql(zz, Fp3.ONE))
+        throw new Error("invZ was invalid");
+      return { x, y };
+    }
+    /**
+     * Checks whether Point is free of torsion elements (is in prime subgroup).
+     * Always torsion-free for cofactor=1 curves.
+     */
+    isTorsionFree() {
+      const { isTorsionFree } = extraOpts;
+      if (cofactor === _1n4)
+        return true;
+      if (isTorsionFree)
+        return isTorsionFree(Point, this);
+      return wnaf.unsafe(this, CURVE_ORDER).is0();
+    }
+    clearCofactor() {
+      const { clearCofactor } = extraOpts;
+      if (cofactor === _1n4)
+        return this;
+      if (clearCofactor)
+        return clearCofactor(Point, this);
+      return this.multiplyUnsafe(cofactor);
+    }
+    isSmallOrder() {
+      if (cofactor === _1n4)
+        return this.is0();
+      return this.clearCofactor().is0();
+    }
+    toBytes(isCompressed = true) {
+      abool(isCompressed, "isCompressed");
+      this.assertValidity();
+      return encodePoint(Point, this, isCompressed);
+    }
+    toHex(isCompressed = true) {
+      return bytesToHex2(this.toBytes(isCompressed));
+    }
+    toString() {
+      return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
+    }
+  }
+  const bits = Fn.BITS;
+  const wnaf = new wNAF(Point, extraOpts.endo ? Math.ceil(bits / 2) : bits);
+  if (bits >= 8)
+    Point.BASE.precompute(8);
+  Object.freeze(Point.prototype);
+  Object.freeze(Point);
+  return Point;
+}
+function pprefix(hasEvenY) {
+  return Uint8Array.of(hasEvenY ? 2 : 3);
+}
+function getWLengths(Fp3, Fn) {
+  return {
+    secretKey: Fn.BYTES,
+    publicKey: 1 + Fp3.BYTES,
+    publicKeyUncompressed: 1 + 2 * Fp3.BYTES,
+    publicKeyHasPrefix: true,
+    // Raw compact `(r || s)` signature width; DER and recovered signatures use
+    // different lengths outside this helper.
+    signature: 2 * Fn.BYTES
+  };
+}
+
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/bls.js
+var _0n5 = BigInt(0);
+var _1n5 = BigInt(1);
+var _2n3 = BigInt(2);
+var _3n3 = BigInt(3);
+function NAfDecomposition(a) {
+  const res = [];
+  for (; a > _1n5; a >>= _1n5) {
+    if ((a & _1n5) === _0n5)
+      res.unshift(0);
+    else if ((a & _3n3) === _3n3) {
+      res.unshift(-1);
+      a += _1n5;
+    } else
+      res.unshift(1);
+  }
+  return res;
+}
+function createBlsPairing(fields2, G1, G2, params) {
+  const { Fr: Fr2, Fp2: Fp22, Fp12: Fp122 } = fields2;
+  const { twistType, ateLoopSize, xNegative, postPrecompute } = params;
+  let lineFunction;
+  if (twistType === "multiplicative") {
+    lineFunction = (c0, c1, c2, f, Px, Py) => Fp122.mul014(f, c0, Fp22.mul(c1, Px), Fp22.mul(c2, Py));
+  } else if (twistType === "divisive") {
+    lineFunction = (c0, c1, c2, f, Px, Py) => Fp122.mul034(f, Fp22.mul(c2, Py), Fp22.mul(c1, Px), c0);
+  } else
+    throw new Error("bls: unknown twist type");
+  const Fp2div2 = Fp22.div(Fp22.ONE, Fp22.mul(Fp22.ONE, _2n3));
+  function pointDouble(ell, Rx, Ry, Rz) {
+    const t0 = Fp22.sqr(Ry);
+    const t1 = Fp22.sqr(Rz);
+    const t2 = Fp22.mulByB(Fp22.mul(t1, _3n3));
+    const t3 = Fp22.mul(t2, _3n3);
+    const t4 = Fp22.sub(Fp22.sub(Fp22.sqr(Fp22.add(Ry, Rz)), t1), t0);
+    const c0 = Fp22.sub(t2, t0);
+    const c1 = Fp22.mul(Fp22.sqr(Rx), _3n3);
+    const c2 = Fp22.neg(t4);
+    ell.push([c0, c1, c2]);
+    Rx = Fp22.mul(Fp22.mul(Fp22.mul(Fp22.sub(t0, t3), Rx), Ry), Fp2div2);
+    Ry = Fp22.sub(Fp22.sqr(Fp22.mul(Fp22.add(t0, t3), Fp2div2)), Fp22.mul(Fp22.sqr(t2), _3n3));
+    Rz = Fp22.mul(t0, t4);
+    return { Rx, Ry, Rz };
+  }
+  function pointAdd(ell, Rx, Ry, Rz, Qx, Qy) {
+    const t0 = Fp22.sub(Ry, Fp22.mul(Qy, Rz));
+    const t1 = Fp22.sub(Rx, Fp22.mul(Qx, Rz));
+    const c0 = Fp22.sub(Fp22.mul(t0, Qx), Fp22.mul(t1, Qy));
+    const c1 = Fp22.neg(t0);
+    const c2 = t1;
+    ell.push([c0, c1, c2]);
+    const t2 = Fp22.sqr(t1);
+    const t3 = Fp22.mul(t2, t1);
+    const t4 = Fp22.mul(t2, Rx);
+    const t5 = Fp22.add(Fp22.sub(t3, Fp22.mul(t4, _2n3)), Fp22.mul(Fp22.sqr(t0), Rz));
+    Rx = Fp22.mul(t1, t5);
+    Ry = Fp22.sub(Fp22.mul(Fp22.sub(t4, t5), t0), Fp22.mul(t3, Ry));
+    Rz = Fp22.mul(Rz, t3);
+    return { Rx, Ry, Rz };
+  }
+  const ATE_NAF = NAfDecomposition(ateLoopSize);
+  const calcPairingPrecomputes = (point) => {
+    const p = point;
+    const { x, y } = p.toAffine();
+    const Qx = x, Qy = y, negQy = Fp22.neg(y);
+    let Rx = Qx, Ry = Qy, Rz = Fp22.ONE;
+    const ell = [];
+    for (const bit of ATE_NAF) {
+      const cur = [];
+      ({ Rx, Ry, Rz } = pointDouble(cur, Rx, Ry, Rz));
+      if (bit)
+        ({ Rx, Ry, Rz } = pointAdd(cur, Rx, Ry, Rz, Qx, bit === -1 ? negQy : Qy));
+      ell.push(cur);
+    }
+    if (postPrecompute) {
+      const last = ell[ell.length - 1];
+      postPrecompute(Rx, Ry, Rz, Qx, Qy, pointAdd.bind(null, last));
+    }
+    return ell;
+  };
+  function millerLoopBatch(pairs, withFinalExponent = false) {
+    let f12 = Fp122.ONE;
+    if (pairs.length) {
+      const ellLen = pairs[0][0].length;
+      for (let i = 0; i < ellLen; i++) {
+        f12 = Fp122.sqr(f12);
+        for (const [ell, Px, Py] of pairs) {
+          for (const [c0, c1, c2] of ell[i])
+            f12 = lineFunction(c0, c1, c2, f12, Px, Py);
+        }
+      }
+    }
+    if (xNegative)
+      f12 = Fp122.conjugate(f12);
+    return withFinalExponent ? Fp122.finalExponentiate(f12) : f12;
+  }
+  function pairingBatch(pairs, withFinalExponent = true) {
+    const res = [];
+    for (const { g1, g2 } of pairs) {
+      if (g1.is0() || g2.is0())
+        throw new Error("pairing is not available for ZERO point");
+      g1.assertValidity();
+      g2.assertValidity();
+      const Qa = g1.toAffine();
+      res.push([calcPairingPrecomputes(g2), Qa.x, Qa.y]);
+    }
+    return millerLoopBatch(res, withFinalExponent);
+  }
+  function pairing(Q, P, withFinalExponent = true) {
+    return pairingBatch([{ g1: Q, g2: P }], withFinalExponent);
+  }
+  const lengths = {
+    seed: getMinHashLength(Fr2.ORDER)
+  };
+  const rand = params.randomBytes === void 0 ? randomBytes2 : params.randomBytes;
+  const randomSecretKey = (seed) => {
+    seed = seed === void 0 ? rand(lengths.seed) : seed;
+    abytes2(seed, lengths.seed, "seed");
+    return mapHashToField(seed, Fr2.ORDER);
+  };
+  Object.freeze(lengths);
+  return {
+    lengths,
+    Fr: Fr2,
+    Fp12: Fp122,
+    // NOTE: we re-export Fp12 here because pairing results are Fp12!
+    millerLoopBatch,
+    pairing,
+    pairingBatch,
+    calcPairingPrecomputes,
+    randomSecretKey
+  };
+}
+function blsBasic(fields2, G1_Point, G2_Point, params) {
+  const { Fp: Fp3, Fr: Fr2, Fp2: Fp22, Fp6, Fp12: Fp122 } = fields2;
+  const G1 = { Point: G1_Point };
+  const G2 = { Point: G2_Point };
+  const pairingRes = createBlsPairing(fields2, G1_Point, G2_Point, params);
+  const { millerLoopBatch, pairing, pairingBatch, calcPairingPrecomputes, randomSecretKey, lengths } = pairingRes;
+  G1.Point.BASE.precompute(4);
+  Object.freeze(G1);
+  Object.freeze(G2);
+  return Object.freeze({
+    lengths: Object.freeze(lengths),
+    millerLoopBatch,
+    pairing,
+    pairingBatch,
+    G1,
+    G2,
+    fields: Object.freeze({ Fr: Fr2, Fp: Fp3, Fp2: Fp22, Fp6, Fp12: Fp122 }),
+    params: Object.freeze({
+      ateLoopSize: params.ateLoopSize,
+      twistType: params.twistType
+    }),
+    utils: Object.freeze({
+      randomSecretKey,
+      calcPairingPrecomputes
+    })
+  });
+}
+
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/tower.js
+var _0n6 = /* @__PURE__ */ BigInt(0);
+var _1n6 = /* @__PURE__ */ BigInt(1);
+var _2n4 = /* @__PURE__ */ BigInt(2);
+var _3n4 = /* @__PURE__ */ BigInt(3);
+var _6n = /* @__PURE__ */ BigInt(6);
+var _12n = /* @__PURE__ */ BigInt(12);
+var isObj = (value) => !!value && typeof value === "object";
+function calcFrobeniusCoefficients(Fp3, nonResidue, modulus, degree, num = 1, divisor) {
+  asafenumber(num, "num");
+  const F = Fp3;
+  if (num <= 0)
+    throw new Error("calcFrobeniusCoefficients: expected positive row count, got " + num);
+  const _divisor = BigInt(divisor === void 0 ? degree : divisor);
+  const towerModulus = modulus ** BigInt(degree);
+  const res = [];
+  for (let i = 0; i < num; i++) {
+    const a = BigInt(i + 1);
+    const powers = [];
+    for (let j = 0, qPower = _1n6; j < degree; j++) {
+      const numer = a * qPower - a;
+      if (numer % _divisor)
+        throw new Error("calcFrobeniusCoefficients: inexact tower exponent");
+      const power = numer / _divisor % towerModulus;
+      powers.push(F.pow(nonResidue, power));
+      qPower *= modulus;
+    }
+    res.push(powers);
+  }
+  return res;
+}
+function psiFrobenius(Fp3, Fp22, base) {
+  const PSI_X = Fp22.pow(base, (Fp3.ORDER - _1n6) / _3n4);
+  const PSI_Y = Fp22.pow(base, (Fp3.ORDER - _1n6) / _2n4);
+  function psi2(x, y) {
+    const x2 = Fp22.mul(Fp22.frobeniusMap(x, 1), PSI_X);
+    const y2 = Fp22.mul(Fp22.frobeniusMap(y, 1), PSI_Y);
+    return [x2, y2];
+  }
+  const PSI2_X = Fp22.pow(base, (Fp3.ORDER ** _2n4 - _1n6) / _3n4);
+  const PSI2_Y = Fp22.pow(base, (Fp3.ORDER ** _2n4 - _1n6) / _2n4);
+  if (!Fp22.eql(PSI2_Y, Fp22.neg(Fp22.ONE)))
+    throw new Error("psiFrobenius: PSI2_Y!==-1");
+  function psi22(x, y) {
+    return [Fp22.mul(x, PSI2_X), Fp22.neg(y)];
+  }
+  const mapAffine = (fn) => (c, P) => {
+    const affine = P.toAffine();
+    const p = fn(affine.x, affine.y);
+    return c.fromAffine({ x: p[0], y: p[1] });
+  };
+  const G2psi2 = mapAffine(psi2);
+  const G2psi22 = mapAffine(psi22);
+  return { psi: psi2, psi2: psi22, G2psi: G2psi2, G2psi2: G2psi22, PSI_X, PSI_Y, PSI2_X, PSI2_Y };
+}
+var _Field2 = class {
+  ORDER;
+  BITS;
+  BYTES;
+  isLE;
+  ZERO;
+  ONE;
+  Fp;
+  NONRESIDUE;
+  mulByB;
+  Fp_NONRESIDUE;
+  Fp_div2;
+  FROBENIUS_COEFFICIENTS;
+  constructor(Fp3, opts = {}) {
+    const { NONRESIDUE = BigInt(-1), FP2_NONRESIDUE, Fp2mulByB } = opts;
+    const ORDER = Fp3.ORDER;
+    const FP2_ORDER = ORDER * ORDER;
+    this.Fp = Fp3;
+    this.ORDER = FP2_ORDER;
+    this.BITS = bitLen(FP2_ORDER);
+    this.BYTES = Math.ceil(bitLen(FP2_ORDER) / 8);
+    this.isLE = Fp3.isLE;
+    this.ZERO = this.create({ c0: Fp3.ZERO, c1: Fp3.ZERO });
+    this.ONE = this.create({ c0: Fp3.ONE, c1: Fp3.ZERO });
+    this.Fp_NONRESIDUE = Fp3.create(NONRESIDUE);
+    this.Fp_div2 = Fp3.div(Fp3.ONE, _2n4);
+    this.NONRESIDUE = this.create({ c0: FP2_NONRESIDUE[0], c1: FP2_NONRESIDUE[1] });
+    this.FROBENIUS_COEFFICIENTS = Object.freeze(calcFrobeniusCoefficients(Fp3, this.Fp_NONRESIDUE, Fp3.ORDER, 2)[0]);
+    this.mulByB = (num) => {
+      const { c0, c1 } = Fp2mulByB(num);
+      return Object.freeze({ c0, c1 });
+    };
+    Object.freeze(this);
+  }
+  fromBigTuple(tuple) {
+    if (!Array.isArray(tuple) || tuple.length !== 2)
+      throw new Error("invalid Fp2.fromBigTuple");
+    const [c0, c1] = tuple;
+    if (typeof c0 !== "bigint" || typeof c1 !== "bigint")
+      throw new Error("invalid Fp2.fromBigTuple");
+    return this.create({ c0, c1 });
+  }
+  create(num) {
+    const { Fp: Fp3 } = this;
+    const c0 = Fp3.create(num.c0);
+    const c1 = Fp3.create(num.c1);
+    return Object.freeze({ c0, c1 });
+  }
+  isValid(num) {
+    if (!isObj(num))
+      throw new TypeError("invalid field element: expected object, got " + typeof num);
+    const { c0, c1 } = num;
+    const { Fp: Fp3 } = this;
+    return Fp3.isValid(c0) && Fp3.isValid(c1);
+  }
+  is0(num) {
+    if (!isObj(num))
+      return false;
+    const { c0, c1 } = num;
+    const { Fp: Fp3 } = this;
+    return Fp3.is0(c0) && Fp3.is0(c1);
+  }
+  isValidNot0(num) {
+    return !this.is0(num) && this.isValid(num);
+  }
+  eql({ c0, c1 }, { c0: r0, c1: r1 }) {
+    const { Fp: Fp3 } = this;
+    return Fp3.eql(c0, r0) && Fp3.eql(c1, r1);
+  }
+  neg({ c0, c1 }) {
+    const { Fp: Fp3 } = this;
+    return Object.freeze({ c0: Fp3.neg(c0), c1: Fp3.neg(c1) });
+  }
+  pow(num, power) {
+    return FpPow(this, num, power);
+  }
+  invertBatch(nums) {
+    return FpInvertBatch(this, nums);
+  }
+  // Normalized
+  add(f1, f2) {
+    const { Fp: Fp3 } = this;
+    const { c0, c1 } = f1;
+    const { c0: r0, c1: r1 } = f2;
+    return Object.freeze({
+      c0: Fp3.add(c0, r0),
+      c1: Fp3.add(c1, r1)
+    });
+  }
+  sub({ c0, c1 }, { c0: r0, c1: r1 }) {
+    const { Fp: Fp3 } = this;
+    return Object.freeze({
+      c0: Fp3.sub(c0, r0),
+      c1: Fp3.sub(c1, r1)
+    });
+  }
+  mul({ c0, c1 }, rhs) {
+    const { Fp: Fp3 } = this;
+    if (typeof rhs === "bigint")
+      return Object.freeze({ c0: Fp3.mul(c0, rhs), c1: Fp3.mul(c1, rhs) });
+    const { c0: r0, c1: r1 } = rhs;
+    let t1 = Fp3.mul(c0, r0);
+    let t2 = Fp3.mul(c1, r1);
+    const o0 = Fp3.sub(t1, t2);
+    const o1 = Fp3.sub(Fp3.mul(Fp3.add(c0, c1), Fp3.add(r0, r1)), Fp3.add(t1, t2));
+    return Object.freeze({ c0: o0, c1: o1 });
+  }
+  sqr({ c0, c1 }) {
+    const { Fp: Fp3 } = this;
+    const a = Fp3.add(c0, c1);
+    const b = Fp3.sub(c0, c1);
+    const c = Fp3.add(c0, c0);
+    return Object.freeze({ c0: Fp3.mul(a, b), c1: Fp3.mul(c, c1) });
+  }
+  // NonNormalized stuff
+  addN(a, b) {
+    return this.add(a, b);
+  }
+  subN(a, b) {
+    return this.sub(a, b);
+  }
+  mulN(a, b) {
+    return this.mul(a, b);
+  }
+  sqrN(a) {
+    return this.sqr(a);
+  }
+  // Why inversion for bigint inside Fp instead of Fp2? it is even used in that context?
+  div(lhs, rhs) {
+    const { Fp: Fp3 } = this;
+    return this.mul(lhs, typeof rhs === "bigint" ? Fp3.inv(Fp3.create(rhs)) : this.inv(rhs));
+  }
+  inv({ c0: a, c1: b }) {
+    const { Fp: Fp3 } = this;
+    const factor = Fp3.inv(Fp3.create(a * a + b * b));
+    return Object.freeze({ c0: Fp3.mul(factor, Fp3.create(a)), c1: Fp3.mul(factor, Fp3.create(-b)) });
+  }
+  sqrt(num) {
+    const { Fp: Fp3 } = this;
+    const Fp22 = this;
+    const { c0, c1 } = num;
+    if (Fp3.is0(c1)) {
+      if (FpLegendre(Fp3, c0) === 1)
+        return Fp22.create({ c0: Fp3.sqrt(c0), c1: Fp3.ZERO });
+      else
+        return Fp22.create({ c0: Fp3.ZERO, c1: Fp3.sqrt(Fp3.div(c0, this.Fp_NONRESIDUE)) });
+    }
+    const a = Fp3.sqrt(Fp3.sub(Fp3.sqr(c0), Fp3.mul(Fp3.sqr(c1), this.Fp_NONRESIDUE)));
+    let d = Fp3.mul(Fp3.add(a, c0), this.Fp_div2);
+    const legendre = FpLegendre(Fp3, d);
+    if (legendre === -1)
+      d = Fp3.sub(d, a);
+    const a0 = Fp3.sqrt(d);
+    const candidateSqrt = Fp22.create({ c0: a0, c1: Fp3.div(Fp3.mul(c1, this.Fp_div2), a0) });
+    if (!Fp22.eql(Fp22.sqr(candidateSqrt), num))
+      throw new Error("Cannot find square root");
+    const x1 = candidateSqrt;
+    const x2 = Fp22.neg(x1);
+    const { re: re1, im: im1 } = Fp22.reim(x1);
+    const { re: re2, im: im2 } = Fp22.reim(x2);
+    if (im1 > im2 || im1 === im2 && re1 > re2)
+      return x1;
+    return x2;
+  }
+  // Same as sgn0_m_eq_2 in RFC 9380
+  isOdd(x) {
+    const { re: x0, im: x1 } = this.reim(x);
+    const sign_0 = x0 % _2n4;
+    const zero_0 = x0 === _0n6;
+    const sign_1 = x1 % _2n4;
+    return BigInt(sign_0 || zero_0 && sign_1) == _1n6;
+  }
+  // Bytes util
+  fromBytes(b) {
+    const { Fp: Fp3 } = this;
+    abytes2(b);
+    if (b.length !== this.BYTES)
+      throw new Error("fromBytes invalid length=" + b.length);
+    return this.create({
+      c0: Fp3.fromBytes(b.subarray(0, Fp3.BYTES)),
+      c1: Fp3.fromBytes(b.subarray(Fp3.BYTES))
+    });
+  }
+  toBytes({ c0, c1 }) {
+    return concatBytes2(this.Fp.toBytes(c0), this.Fp.toBytes(c1));
+  }
+  cmov({ c0, c1 }, { c0: r0, c1: r1 }, c) {
+    const { Fp: Fp3 } = this;
+    return this.create({
+      c0: Fp3.cmov(c0, r0, c),
+      c1: Fp3.cmov(c1, r1, c)
+    });
+  }
+  reim({ c0, c1 }) {
+    return { re: c0, im: c1 };
+  }
+  Fp4Square(a, b) {
+    const Fp22 = this;
+    const a2 = Fp22.sqr(a);
+    const b2 = Fp22.sqr(b);
+    return {
+      first: Fp22.add(Fp22.mulByNonresidue(b2), a2),
+      // b² * Nonresidue + a²
+      second: Fp22.sub(Fp22.sub(Fp22.sqr(Fp22.add(a, b)), a2), b2)
+      // (a + b)² - a² - b²
+    };
+  }
+  // multiply by u + 1
+  mulByNonresidue({ c0, c1 }) {
+    return this.mul({ c0, c1 }, this.NONRESIDUE);
+  }
+  frobeniusMap({ c0, c1 }, power) {
+    return Object.freeze({
+      c0,
+      c1: this.Fp.mul(c1, this.FROBENIUS_COEFFICIENTS[power % 2])
+    });
+  }
+};
+var _Field6 = class {
+  ORDER;
+  BITS;
+  BYTES;
+  isLE;
+  ZERO;
+  ONE;
+  Fp2;
+  constructor(Fp22) {
+    this.Fp2 = Fp22;
+    this.ORDER = Fp22.Fp.ORDER ** _6n;
+    this.BITS = 3 * Fp22.BITS;
+    this.BYTES = 3 * Fp22.BYTES;
+    this.isLE = Fp22.isLE;
+    this.ZERO = this.create({ c0: Fp22.ZERO, c1: Fp22.ZERO, c2: Fp22.ZERO });
+    this.ONE = this.create({ c0: Fp22.ONE, c1: Fp22.ZERO, c2: Fp22.ZERO });
+    Object.freeze(this);
+  }
+  // Most callers never touch Frobenius maps, so keep the sextic tables lazy:
+  // eagerly deriving them dominates `bls12-381.js` / `bn254.js` import time.
+  get FROBENIUS_COEFFICIENTS_1() {
+    const frob2 = _FROBENIUS_COEFFICIENTS_6.get(this);
+    if (frob2)
+      return frob2[0];
+    const { Fp2: Fp22 } = this;
+    const { Fp: Fp3 } = Fp22;
+    const rows = calcFrobeniusCoefficients(Fp22, Fp22.NONRESIDUE, Fp3.ORDER, 6, 2, 3);
+    const cache = [Object.freeze(rows[0]), Object.freeze(rows[1])];
+    _FROBENIUS_COEFFICIENTS_6.set(this, cache);
+    return cache[0];
+  }
+  get FROBENIUS_COEFFICIENTS_2() {
+    const frob2 = _FROBENIUS_COEFFICIENTS_6.get(this);
+    if (frob2)
+      return frob2[1];
+    void this.FROBENIUS_COEFFICIENTS_1;
+    return _FROBENIUS_COEFFICIENTS_6.get(this)[1];
+  }
+  add({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }) {
+    const { Fp2: Fp22 } = this;
+    return Object.freeze({
+      c0: Fp22.add(c0, r0),
+      c1: Fp22.add(c1, r1),
+      c2: Fp22.add(c2, r2)
+    });
+  }
+  sub({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }) {
+    const { Fp2: Fp22 } = this;
+    return Object.freeze({
+      c0: Fp22.sub(c0, r0),
+      c1: Fp22.sub(c1, r1),
+      c2: Fp22.sub(c2, r2)
+    });
+  }
+  mul({ c0, c1, c2 }, rhs) {
+    const { Fp2: Fp22 } = this;
+    if (typeof rhs === "bigint") {
+      return Object.freeze({
+        c0: Fp22.mul(c0, rhs),
+        c1: Fp22.mul(c1, rhs),
+        c2: Fp22.mul(c2, rhs)
+      });
+    }
+    const { c0: r0, c1: r1, c2: r2 } = rhs;
+    const t0 = Fp22.mul(c0, r0);
+    const t1 = Fp22.mul(c1, r1);
+    const t2 = Fp22.mul(c2, r2);
+    return Object.freeze({
+      // t0 + (c1 + c2) * (r1 * r2) - (T1 + T2) * (u + 1)
+      c0: Fp22.add(t0, Fp22.mulByNonresidue(Fp22.sub(Fp22.mul(Fp22.add(c1, c2), Fp22.add(r1, r2)), Fp22.add(t1, t2)))),
+      // (c0 + c1) * (r0 + r1) - (T0 + T1) + T2 * (u + 1)
+      c1: Fp22.add(Fp22.sub(Fp22.mul(Fp22.add(c0, c1), Fp22.add(r0, r1)), Fp22.add(t0, t1)), Fp22.mulByNonresidue(t2)),
+      // T1 + (c0 + c2) * (r0 + r2) - T0 + T2
+      c2: Fp22.sub(Fp22.add(t1, Fp22.mul(Fp22.add(c0, c2), Fp22.add(r0, r2))), Fp22.add(t0, t2))
+    });
+  }
+  sqr({ c0, c1, c2 }) {
+    const { Fp2: Fp22 } = this;
+    let t0 = Fp22.sqr(c0);
+    let t1 = Fp22.mul(Fp22.mul(c0, c1), _2n4);
+    let t3 = Fp22.mul(Fp22.mul(c1, c2), _2n4);
+    let t4 = Fp22.sqr(c2);
+    return Object.freeze({
+      c0: Fp22.add(Fp22.mulByNonresidue(t3), t0),
+      // T3 * (u + 1) + T0
+      c1: Fp22.add(Fp22.mulByNonresidue(t4), t1),
+      // T4 * (u + 1) + T1
+      // T1 + (c0 - c1 + c2)² + T3 - T0 - T4
+      c2: Fp22.sub(Fp22.sub(Fp22.add(Fp22.add(t1, Fp22.sqr(Fp22.add(Fp22.sub(c0, c1), c2))), t3), t0), t4)
+    });
+  }
+  addN(a, b) {
+    return this.add(a, b);
+  }
+  subN(a, b) {
+    return this.sub(a, b);
+  }
+  mulN(a, b) {
+    return this.mul(a, b);
+  }
+  sqrN(a) {
+    return this.sqr(a);
+  }
+  create(num) {
+    const { Fp2: Fp22 } = this;
+    const c0 = Fp22.create(num.c0);
+    const c1 = Fp22.create(num.c1);
+    const c2 = Fp22.create(num.c2);
+    return Object.freeze({ c0, c1, c2 });
+  }
+  isValid(num) {
+    if (!isObj(num))
+      throw new TypeError("invalid field element: expected object, got " + typeof num);
+    const { c0, c1, c2 } = num;
+    const { Fp2: Fp22 } = this;
+    return Fp22.isValid(c0) && Fp22.isValid(c1) && Fp22.isValid(c2);
+  }
+  is0(num) {
+    if (!isObj(num))
+      return false;
+    const { c0, c1, c2 } = num;
+    const { Fp2: Fp22 } = this;
+    return Fp22.is0(c0) && Fp22.is0(c1) && Fp22.is0(c2);
+  }
+  isValidNot0(num) {
+    return !this.is0(num) && this.isValid(num);
+  }
+  neg({ c0, c1, c2 }) {
+    const { Fp2: Fp22 } = this;
+    return Object.freeze({ c0: Fp22.neg(c0), c1: Fp22.neg(c1), c2: Fp22.neg(c2) });
+  }
+  eql({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }) {
+    const { Fp2: Fp22 } = this;
+    return Fp22.eql(c0, r0) && Fp22.eql(c1, r1) && Fp22.eql(c2, r2);
+  }
+  sqrt(_) {
+    return notImplemented();
+  }
+  // Do we need division by bigint at all? Should be done via order:
+  div(lhs, rhs) {
+    const { Fp2: Fp22 } = this;
+    const { Fp: Fp3 } = Fp22;
+    return this.mul(lhs, typeof rhs === "bigint" ? Fp3.inv(Fp3.create(rhs)) : this.inv(rhs));
+  }
+  pow(num, power) {
+    return FpPow(this, num, power);
+  }
+  invertBatch(nums) {
+    return FpInvertBatch(this, nums);
+  }
+  inv({ c0, c1, c2 }) {
+    const { Fp2: Fp22 } = this;
+    let t0 = Fp22.sub(Fp22.sqr(c0), Fp22.mulByNonresidue(Fp22.mul(c2, c1)));
+    let t1 = Fp22.sub(Fp22.mulByNonresidue(Fp22.sqr(c2)), Fp22.mul(c0, c1));
+    let t2 = Fp22.sub(Fp22.sqr(c1), Fp22.mul(c0, c2));
+    let t4 = Fp22.inv(Fp22.add(Fp22.mulByNonresidue(Fp22.add(Fp22.mul(c2, t1), Fp22.mul(c1, t2))), Fp22.mul(c0, t0)));
+    return Object.freeze({ c0: Fp22.mul(t4, t0), c1: Fp22.mul(t4, t1), c2: Fp22.mul(t4, t2) });
+  }
+  // Bytes utils
+  fromBytes(b) {
+    const { Fp2: Fp22 } = this;
+    abytes2(b);
+    if (b.length !== this.BYTES)
+      throw new Error("fromBytes invalid length=" + b.length);
+    const B2 = Fp22.BYTES;
+    return this.create({
+      c0: Fp22.fromBytes(b.subarray(0, B2)),
+      c1: Fp22.fromBytes(b.subarray(B2, B2 * 2)),
+      c2: Fp22.fromBytes(b.subarray(2 * B2))
+    });
+  }
+  toBytes({ c0, c1, c2 }) {
+    const { Fp2: Fp22 } = this;
+    return concatBytes2(Fp22.toBytes(c0), Fp22.toBytes(c1), Fp22.toBytes(c2));
+  }
+  cmov({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }, c) {
+    const { Fp2: Fp22 } = this;
+    return this.create({
+      c0: Fp22.cmov(c0, r0, c),
+      c1: Fp22.cmov(c1, r1, c),
+      c2: Fp22.cmov(c2, r2, c)
+    });
+  }
+  fromBigSix(tuple) {
+    const { Fp2: Fp22 } = this;
+    if (!Array.isArray(tuple) || tuple.length !== 6)
+      throw new Error("invalid Fp6.fromBigSix");
+    for (let i = 0; i < 6; i++)
+      if (typeof tuple[i] !== "bigint")
+        throw new Error("invalid Fp6.fromBigSix");
+    const t = tuple;
+    return this.create({
+      c0: Fp22.fromBigTuple(t.slice(0, 2)),
+      c1: Fp22.fromBigTuple(t.slice(2, 4)),
+      c2: Fp22.fromBigTuple(t.slice(4, 6))
+    });
+  }
+  frobeniusMap({ c0, c1, c2 }, power) {
+    const { Fp2: Fp22 } = this;
+    return Object.freeze({
+      c0: Fp22.frobeniusMap(c0, power),
+      c1: Fp22.mul(Fp22.frobeniusMap(c1, power), this.FROBENIUS_COEFFICIENTS_1[power % 6]),
+      c2: Fp22.mul(Fp22.frobeniusMap(c2, power), this.FROBENIUS_COEFFICIENTS_2[power % 6])
+    });
+  }
+  mulByFp2({ c0, c1, c2 }, rhs) {
+    const { Fp2: Fp22 } = this;
+    return Object.freeze({
+      c0: Fp22.mul(c0, rhs),
+      c1: Fp22.mul(c1, rhs),
+      c2: Fp22.mul(c2, rhs)
+    });
+  }
+  mulByNonresidue({ c0, c1, c2 }) {
+    const { Fp2: Fp22 } = this;
+    return Object.freeze({ c0: Fp22.mulByNonresidue(c2), c1: c0, c2: c1 });
+  }
+  // Sparse multiplication
+  mul1({ c0, c1, c2 }, b1) {
+    const { Fp2: Fp22 } = this;
+    return Object.freeze({
+      c0: Fp22.mulByNonresidue(Fp22.mul(c2, b1)),
+      c1: Fp22.mul(c0, b1),
+      c2: Fp22.mul(c1, b1)
+    });
+  }
+  // Sparse multiplication
+  mul01({ c0, c1, c2 }, b0, b1) {
+    const { Fp2: Fp22 } = this;
+    let t0 = Fp22.mul(c0, b0);
+    let t1 = Fp22.mul(c1, b1);
+    return Object.freeze({
+      // ((c1 + c2) * b1 - T1) * (u + 1) + T0
+      c0: Fp22.add(Fp22.mulByNonresidue(Fp22.sub(Fp22.mul(Fp22.add(c1, c2), b1), t1)), t0),
+      // (b0 + b1) * (c0 + c1) - T0 - T1
+      c1: Fp22.sub(Fp22.sub(Fp22.mul(Fp22.add(b0, b1), Fp22.add(c0, c1)), t0), t1),
+      // (c0 + c2) * b0 - T0 + T1
+      c2: Fp22.add(Fp22.sub(Fp22.mul(Fp22.add(c0, c2), b0), t0), t1)
+    });
+  }
+};
+var _FROBENIUS_COEFFICIENTS_6 = /* @__PURE__ */ new WeakMap();
+var _Field12 = class {
+  ORDER;
+  BITS;
+  BYTES;
+  isLE;
+  ZERO;
+  ONE;
+  Fp6;
+  X_LEN;
+  finalExponentiate;
+  constructor(Fp6, opts) {
+    const { X_LEN, Fp12finalExponentiate } = opts;
+    const { Fp2: Fp22 } = Fp6;
+    const { Fp: Fp3 } = Fp22;
+    this.Fp6 = Fp6;
+    this.ORDER = Fp3.ORDER ** _12n;
+    this.BITS = 2 * Fp6.BITS;
+    this.BYTES = 2 * Fp6.BYTES;
+    this.isLE = Fp6.isLE;
+    this.ZERO = this.create({ c0: Fp6.ZERO, c1: Fp6.ZERO });
+    this.ONE = this.create({ c0: Fp6.ONE, c1: Fp6.ZERO });
+    this.X_LEN = X_LEN;
+    this.finalExponentiate = (num) => {
+      const copy2 = ({ c0, c1 }) => Object.freeze({ c0, c1 });
+      const copy6 = ({ c0, c1, c2 }) => Object.freeze({ c0: copy2(c0), c1: copy2(c1), c2: copy2(c2) });
+      const res = Fp12finalExponentiate(num);
+      return Object.freeze({ c0: copy6(res.c0), c1: copy6(res.c1) });
+    };
+    Object.freeze(this);
+  }
+  // Keep the degree-12 Frobenius row lazy too; after the first lookup the cached
+  // array is reused exactly like the old eager table.
+  get FROBENIUS_COEFFICIENTS() {
+    const frob2 = _FROBENIUS_COEFFICIENTS_12.get(this);
+    if (frob2)
+      return frob2;
+    const { Fp2: Fp22 } = this.Fp6;
+    const { Fp: Fp3 } = Fp22;
+    const cache = Object.freeze(calcFrobeniusCoefficients(Fp22, Fp22.NONRESIDUE, Fp3.ORDER, 12, 1, 6)[0]);
+    _FROBENIUS_COEFFICIENTS_12.set(this, cache);
+    return cache;
+  }
+  create(num) {
+    const { Fp6 } = this;
+    const c0 = Fp6.create(num.c0);
+    const c1 = Fp6.create(num.c1);
+    return Object.freeze({ c0, c1 });
+  }
+  isValid(num) {
+    if (!isObj(num))
+      throw new TypeError("invalid field element: expected object, got " + typeof num);
+    const { c0, c1 } = num;
+    const { Fp6 } = this;
+    return Fp6.isValid(c0) && Fp6.isValid(c1);
+  }
+  is0(num) {
+    if (!isObj(num))
+      return false;
+    const { c0, c1 } = num;
+    const { Fp6 } = this;
+    return Fp6.is0(c0) && Fp6.is0(c1);
+  }
+  isValidNot0(num) {
+    return !this.is0(num) && this.isValid(num);
+  }
+  neg({ c0, c1 }) {
+    const { Fp6 } = this;
+    return Object.freeze({ c0: Fp6.neg(c0), c1: Fp6.neg(c1) });
+  }
+  eql({ c0, c1 }, { c0: r0, c1: r1 }) {
+    const { Fp6 } = this;
+    return Fp6.eql(c0, r0) && Fp6.eql(c1, r1);
+  }
+  sqrt(_) {
+    return notImplemented();
+  }
+  inv({ c0, c1 }) {
+    const { Fp6 } = this;
+    let t = Fp6.inv(Fp6.sub(Fp6.sqr(c0), Fp6.mulByNonresidue(Fp6.sqr(c1))));
+    return Object.freeze({ c0: Fp6.mul(c0, t), c1: Fp6.neg(Fp6.mul(c1, t)) });
+  }
+  div(lhs, rhs) {
+    const { Fp6 } = this;
+    const { Fp2: Fp22 } = Fp6;
+    const { Fp: Fp3 } = Fp22;
+    return this.mul(lhs, typeof rhs === "bigint" ? Fp3.inv(Fp3.create(rhs)) : this.inv(rhs));
+  }
+  pow(num, power) {
+    return FpPow(this, num, power);
+  }
+  invertBatch(nums) {
+    return FpInvertBatch(this, nums);
+  }
+  // Normalized
+  add({ c0, c1 }, { c0: r0, c1: r1 }) {
+    const { Fp6 } = this;
+    return Object.freeze({
+      c0: Fp6.add(c0, r0),
+      c1: Fp6.add(c1, r1)
+    });
+  }
+  sub({ c0, c1 }, { c0: r0, c1: r1 }) {
+    const { Fp6 } = this;
+    return Object.freeze({
+      c0: Fp6.sub(c0, r0),
+      c1: Fp6.sub(c1, r1)
+    });
+  }
+  mul({ c0, c1 }, rhs) {
+    const { Fp6 } = this;
+    if (typeof rhs === "bigint")
+      return Object.freeze({ c0: Fp6.mul(c0, rhs), c1: Fp6.mul(c1, rhs) });
+    let { c0: r0, c1: r1 } = rhs;
+    let t1 = Fp6.mul(c0, r0);
+    let t2 = Fp6.mul(c1, r1);
+    return Object.freeze({
+      c0: Fp6.add(t1, Fp6.mulByNonresidue(t2)),
+      // T1 + T2 * v
+      // (c0 + c1) * (r0 + r1) - (T1 + T2)
+      c1: Fp6.sub(Fp6.mul(Fp6.add(c0, c1), Fp6.add(r0, r1)), Fp6.add(t1, t2))
+    });
+  }
+  sqr({ c0, c1 }) {
+    const { Fp6 } = this;
+    let ab = Fp6.mul(c0, c1);
+    return Object.freeze({
+      // (c1 * v + c0) * (c0 + c1) - AB - AB * v
+      c0: Fp6.sub(Fp6.sub(Fp6.mul(Fp6.add(Fp6.mulByNonresidue(c1), c0), Fp6.add(c0, c1)), ab), Fp6.mulByNonresidue(ab)),
+      c1: Fp6.add(ab, ab)
+    });
+  }
+  // NonNormalized stuff
+  addN(a, b) {
+    return this.add(a, b);
+  }
+  subN(a, b) {
+    return this.sub(a, b);
+  }
+  mulN(a, b) {
+    return this.mul(a, b);
+  }
+  sqrN(a) {
+    return this.sqr(a);
+  }
+  // Bytes utils
+  fromBytes(b) {
+    const { Fp6 } = this;
+    abytes2(b);
+    if (b.length !== this.BYTES)
+      throw new Error("fromBytes invalid length=" + b.length);
+    return this.create({
+      c0: Fp6.fromBytes(b.subarray(0, Fp6.BYTES)),
+      c1: Fp6.fromBytes(b.subarray(Fp6.BYTES))
+    });
+  }
+  toBytes({ c0, c1 }) {
+    const { Fp6 } = this;
+    return concatBytes2(Fp6.toBytes(c0), Fp6.toBytes(c1));
+  }
+  cmov({ c0, c1 }, { c0: r0, c1: r1 }, c) {
+    const { Fp6 } = this;
+    return this.create({
+      c0: Fp6.cmov(c0, r0, c),
+      c1: Fp6.cmov(c1, r1, c)
+    });
+  }
+  // Utils
+  // toString() {
+  //   return '' + 'Fp12(' + this.c0 + this.c1 + '* w');
+  // },
+  // fromTuple(c: [Fp6, Fp6]) {
+  //   return new Fp12(...c);
+  // }
+  fromBigTwelve(tuple) {
+    const { Fp6 } = this;
+    if (!Array.isArray(tuple) || tuple.length !== 12)
+      throw new Error("invalid Fp12.fromBigTwelve");
+    for (let i = 0; i < 12; i++)
+      if (typeof tuple[i] !== "bigint")
+        throw new Error("invalid Fp12.fromBigTwelve");
+    const t = tuple;
+    return this.create({
+      c0: Fp6.fromBigSix(t.slice(0, 6)),
+      c1: Fp6.fromBigSix(t.slice(6, 12))
+    });
+  }
+  // Raises to q**i -th power
+  frobeniusMap(lhs, power) {
+    const { Fp6 } = this;
+    const { Fp2: Fp22 } = Fp6;
+    const { c0, c1, c2 } = Fp6.frobeniusMap(lhs.c1, power);
+    const coeff = this.FROBENIUS_COEFFICIENTS[power % 12];
+    return Object.freeze({
+      c0: Fp6.frobeniusMap(lhs.c0, power),
+      c1: Object.freeze({
+        c0: Fp22.mul(c0, coeff),
+        c1: Fp22.mul(c1, coeff),
+        c2: Fp22.mul(c2, coeff)
+      })
+    });
+  }
+  mulByFp2({ c0, c1 }, rhs) {
+    const { Fp6 } = this;
+    return Object.freeze({
+      c0: Fp6.mulByFp2(c0, rhs),
+      c1: Fp6.mulByFp2(c1, rhs)
+    });
+  }
+  conjugate({ c0, c1 }) {
+    return Object.freeze({ c0, c1: this.Fp6.neg(c1) });
+  }
+  // Sparse multiplication
+  mul014({ c0, c1 }, o0, o1, o4) {
+    const { Fp6 } = this;
+    const { Fp2: Fp22 } = Fp6;
+    let t0 = Fp6.mul01(c0, o0, o1);
+    let t1 = Fp6.mul1(c1, o4);
+    return Object.freeze({
+      c0: Fp6.add(Fp6.mulByNonresidue(t1), t0),
+      // T1 * v + T0
+      // (c1 + c0) * [o0, o1+o4] - T0 - T1
+      c1: Fp6.sub(Fp6.sub(Fp6.mul01(Fp6.add(c1, c0), o0, Fp22.add(o1, o4)), t0), t1)
+    });
+  }
+  mul034({ c0, c1 }, o0, o3, o4) {
+    const { Fp6 } = this;
+    const { Fp2: Fp22 } = Fp6;
+    const a = Object.freeze({
+      c0: Fp22.mul(c0.c0, o0),
+      c1: Fp22.mul(c0.c1, o0),
+      c2: Fp22.mul(c0.c2, o0)
+    });
+    const b = Fp6.mul01(c1, o3, o4);
+    const e = Fp6.mul01(Fp6.add(c0, c1), Fp22.add(o0, o3), o4);
+    return Object.freeze({
+      c0: Fp6.add(Fp6.mulByNonresidue(b), a),
+      c1: Fp6.sub(e, Fp6.add(a, b))
+    });
+  }
+  // A cyclotomic group is a subgroup of Fp^n defined by
+  //   GΦₙ(p) = {α ∈ Fpⁿ : α^Φₙ(p) = 1}
+  // The result of any pairing is in a cyclotomic subgroup
+  // https://eprint.iacr.org/2009/565.pdf
+  // https://eprint.iacr.org/2010/354.pdf
+  _cyclotomicSquare({ c0, c1 }) {
+    const { Fp6 } = this;
+    const { Fp2: Fp22 } = Fp6;
+    const { c0: c0c0, c1: c0c1, c2: c0c2 } = c0;
+    const { c0: c1c0, c1: c1c1, c2: c1c2 } = c1;
+    const { first: t3, second: t4 } = Fp22.Fp4Square(c0c0, c1c1);
+    const { first: t5, second: t6 } = Fp22.Fp4Square(c1c0, c0c2);
+    const { first: t7, second: t8 } = Fp22.Fp4Square(c0c1, c1c2);
+    const t9 = Fp22.mulByNonresidue(t8);
+    return Object.freeze({
+      c0: Object.freeze({
+        c0: Fp22.add(Fp22.mul(Fp22.sub(t3, c0c0), _2n4), t3),
+        // 2 * (T3 - c0c0)  + T3
+        c1: Fp22.add(Fp22.mul(Fp22.sub(t5, c0c1), _2n4), t5),
+        // 2 * (T5 - c0c1)  + T5
+        c2: Fp22.add(Fp22.mul(Fp22.sub(t7, c0c2), _2n4), t7)
+      }),
+      // 2 * (T7 - c0c2)  + T7
+      c1: Object.freeze({
+        c0: Fp22.add(Fp22.mul(Fp22.add(t9, c1c0), _2n4), t9),
+        // 2 * (T9 + c1c0) + T9
+        c1: Fp22.add(Fp22.mul(Fp22.add(t4, c1c1), _2n4), t4),
+        // 2 * (T4 + c1c1) + T4
+        c2: Fp22.add(Fp22.mul(Fp22.add(t6, c1c2), _2n4), t6)
+      })
+    });
+  }
+  // https://eprint.iacr.org/2009/565.pdf
+  _cyclotomicExp(num, n) {
+    aInRange("cyclotomic exponent", n, _0n6, _1n6 << BigInt(this.X_LEN));
+    let z = this.ONE;
+    for (let i = this.X_LEN - 1; i >= 0; i--) {
+      z = this._cyclotomicSquare(z);
+      if (bitGet(n, i))
+        z = this.mul(z, num);
+    }
+    return z;
+  }
+};
+var _FROBENIUS_COEFFICIENTS_12 = /* @__PURE__ */ new WeakMap();
+function tower12(opts) {
+  validateObject(opts, {
+    ORDER: "bigint",
+    X_LEN: "number",
+    FP2_NONRESIDUE: "object",
+    Fp2mulByB: "function",
+    Fp12finalExponentiate: "function"
+  }, { NONRESIDUE: "bigint" });
+  asafenumber(opts.X_LEN, "X_LEN");
+  if (opts.X_LEN < 1)
+    throw new Error("invalid X_LEN");
+  const nonresidue = opts.FP2_NONRESIDUE;
+  if (!Array.isArray(nonresidue) || nonresidue.length !== 2)
+    throw new Error("invalid FP2_NONRESIDUE");
+  if (typeof nonresidue[0] !== "bigint" || typeof nonresidue[1] !== "bigint")
+    throw new Error("invalid FP2_NONRESIDUE");
+  const Fp3 = Field(opts.ORDER);
+  const Fp22 = new _Field2(Fp3, opts);
+  const Fp6 = new _Field6(Fp22);
+  const Fp122 = new _Field12(Fp6, opts);
+  return { Fp: Fp3, Fp2: Fp22, Fp6, Fp12: Fp122 };
+}
+
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/bn254.js
+var _0n7 = /* @__PURE__ */ BigInt(0);
+var _1n7 = /* @__PURE__ */ BigInt(1);
+var _2n5 = /* @__PURE__ */ BigInt(2);
+var _3n5 = /* @__PURE__ */ BigInt(3);
+var _6n2 = /* @__PURE__ */ BigInt(6);
+var BN_X = /* @__PURE__ */ BigInt("4965661367192848881");
+var BN_X_LEN = /* @__PURE__ */ (() => bitLen(BN_X))();
+var SIX_X_SQUARED = /* @__PURE__ */ (() => _6n2 * BN_X ** _2n5)();
+var bn254_G1_CURVE = {
+  p: BigInt("0x30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47"),
+  n: BigInt("0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000001"),
+  // The Ethereum specs define G1 as prime-order but do not spell out the
+  // cofactor separately; `h = 1` is the implementation-derived value.
+  h: _1n7,
+  a: _0n7,
+  b: _3n5,
+  Gx: _1n7,
+  Gy: BigInt(2)
+};
+var bn254_Fr = /* @__PURE__ */ (() => Field(bn254_G1_CURVE.n))();
+var Fp2B = /* @__PURE__ */ (() => ({
+  c0: BigInt("19485874751759354771024239261021720505790618469301721065564631296452457478373"),
+  c1: BigInt("266929791119991161246907387137283842545076965332900288569378510910307636690")
+}))();
+var Fp12;
+var tower = /* @__PURE__ */ (() => {
+  const res = tower12({
+    ORDER: bn254_G1_CURVE.p,
+    X_LEN: BN_X_LEN,
+    // Public `Fp2.NONRESIDUE` below is the sextic-tower seed `(9, 1)`, not the
+    // quadratic relation `i^2 + 1 = 0` from the EIP text.
+    FP2_NONRESIDUE: [BigInt(9), _1n7],
+    Fp2mulByB: (num) => Fp2.mul(num, Fp2B),
+    Fp12finalExponentiate: (num) => {
+      const powMinusX = (num2) => Fp12.conjugate(Fp12._cyclotomicExp(num2, BN_X));
+      const r0 = Fp12.mul(Fp12.conjugate(num), Fp12.inv(num));
+      const r = Fp12.mul(Fp12.frobeniusMap(r0, 2), r0);
+      const y1 = Fp12._cyclotomicSquare(powMinusX(r));
+      const y2 = Fp12.mul(Fp12._cyclotomicSquare(y1), y1);
+      const y4 = powMinusX(y2);
+      const y6 = powMinusX(Fp12._cyclotomicSquare(y4));
+      const y8 = Fp12.mul(Fp12.mul(Fp12.conjugate(y6), y4), Fp12.conjugate(y2));
+      const y9 = Fp12.mul(y8, y1);
+      return Fp12.mul(Fp12.frobeniusMap(Fp12.mul(Fp12.conjugate(r), y9), 3), Fp12.mul(Fp12.frobeniusMap(y8, 2), Fp12.mul(Fp12.frobeniusMap(y9, 1), Fp12.mul(Fp12.mul(y8, y4), r))));
+    }
+  });
+  Fp12 = res.Fp12;
+  return res;
+})();
+var Fp = /* @__PURE__ */ (() => tower.Fp)();
+var Fp2 = /* @__PURE__ */ (() => tower.Fp2)();
+var frob;
+var getFrob = () => frob || (frob = psiFrobenius(Fp, Fp2, Fp2.NONRESIDUE));
+var psi = (x, y) => {
+  const fn = getFrob().psi;
+  psi = fn;
+  return fn(x, y);
+};
+var G2psi = (c, P) => {
+  const fn = getFrob().G2psi;
+  G2psi = fn;
+  return fn(c, P);
+};
+var _postPrecompute = (Rx, Ry, Rz, Qx, Qy, pointAdd) => {
+  const q = psi(Qx, Qy);
+  ({ Rx, Ry, Rz } = pointAdd(Rx, Ry, Rz, q[0], q[1]));
+  const q2 = psi(q[0], q[1]);
+  pointAdd(Rx, Ry, Rz, q2[0], Fp2.neg(q2[1]));
+};
+var bn254_G2_CURVE = /* @__PURE__ */ (() => ({
+  p: Fp2.ORDER,
+  n: bn254_G1_CURVE.n,
+  // As with G1, the Ethereum specs do not spell out the G2 cofactor
+  // separately; this literal is the implementation-derived value.
+  h: BigInt("0x30644e72e131a029b85045b68181585e06ceecda572a2489345f2299c0f9fa8d"),
+  a: Fp2.ZERO,
+  b: Fp2B,
+  Gx: Fp2.fromBigTuple([
+    BigInt("10857046999023057135944570762232829481370756359578518086990519993285655852781"),
+    BigInt("11559732032986387107991004021392285783925812861821192530917403151452391805634")
+  ]),
+  Gy: Fp2.fromBigTuple([
+    BigInt("8495653923123431417604973247489272438418190587263600148770280649306958101930"),
+    BigInt("4082367875863433681332203403145435568316851327593401208105741076214120093531")
+  ])
+}))();
+var fields = /* @__PURE__ */ (() => ({ Fp, Fp2, Fp6: tower.Fp6, Fp12, Fr: bn254_Fr }))();
+var bn254_G1 = /* @__PURE__ */ weierstrass(bn254_G1_CURVE, {
+  Fp,
+  Fn: bn254_Fr,
+  // Ethereum encodes infinity as `(0, 0)`, so the public point API accepts it
+  // even though it is not an affine curve point, and `fromAffine()` stays lazy:
+  // adversarial inputs still need `assertValidity()`.
+  allowInfinityPoint: true
+});
+var bn254_G2 = /* @__PURE__ */ weierstrass(bn254_G2_CURVE, {
+  Fp: Fp2,
+  Fn: bn254_Fr,
+  // Ethereum encodes infinity as `((0, 0), (0, 0))`, so the public point API
+  // accepts it even though it is not an affine curve point.
+  allowInfinityPoint: true,
+  // Optimized BN254 G2 subgroup test used to satisfy the EIP-197 order check.
+  isTorsionFree: (c, P) => P.multiplyUnsafe(SIX_X_SQUARED).equals(G2psi(c, P))
+  // [p]P = [6X^2]P
+});
+var bn254_params = /* @__PURE__ */ (() => ({
+  // Optimal-ate Miller loop parameter derived from the positive BN seed.
+  ateLoopSize: BN_X * _6n2 + _2n5,
+  r: bn254_Fr.ORDER,
+  xNegative: false,
+  // EIP-197 writes G2 as `y^2 = x^3 + 3 / (i + 9)`, so the pairing
+  // configuration uses the divisive twist convention.
+  twistType: "divisive",
+  postPrecompute: _postPrecompute
+}))();
+var bn254 = /* @__PURE__ */ blsBasic(fields, bn254_G1, bn254_G2, bn254_params);
+
+// ../../node_modules/.pnpm/@noble+hashes@2.2.0/node_modules/@noble/hashes/_u64.js
+var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+var _32n = /* @__PURE__ */ BigInt(32);
+function fromBig(n, le = false) {
+  if (le)
+    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
+  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+}
+function split(lst, le = false) {
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i = 0; i < len; i++) {
+    const { h, l } = fromBig(lst[i], le);
+    [Ah[i], Al[i]] = [h, l];
+  }
+  return [Ah, Al];
+}
+var rotlSH = (h, l, s) => h << s | l >>> 32 - s;
+var rotlSL = (h, l, s) => l << s | h >>> 32 - s;
+var rotlBH = (h, l, s) => l << s - 32 | h >>> 64 - s;
+var rotlBL = (h, l, s) => h << s - 32 | l >>> 64 - s;
+
+// ../../node_modules/.pnpm/@noble+hashes@2.2.0/node_modules/@noble/hashes/sha3.js
+var _0n8 = BigInt(0);
+var _1n8 = BigInt(1);
+var _2n6 = BigInt(2);
+var _7n2 = BigInt(7);
+var _256n = BigInt(256);
+var _0x71n = BigInt(113);
+var SHA3_PI = [];
+var SHA3_ROTL = [];
+var _SHA3_IOTA = [];
+for (let round = 0, R = _1n8, x = 1, y = 0; round < 24; round++) {
+  [x, y] = [y, (2 * x + 3 * y) % 5];
+  SHA3_PI.push(2 * (5 * y + x));
+  SHA3_ROTL.push((round + 1) * (round + 2) / 2 % 64);
+  let t = _0n8;
+  for (let j = 0; j < 7; j++) {
+    R = (R << _1n8 ^ (R >> _7n2) * _0x71n) % _256n;
+    if (R & _2n6)
+      t ^= _1n8 << (_1n8 << BigInt(j)) - _1n8;
+  }
+  _SHA3_IOTA.push(t);
+}
+var IOTAS = split(_SHA3_IOTA, true);
+var SHA3_IOTA_H = IOTAS[0];
+var SHA3_IOTA_L = IOTAS[1];
+var rotlH = (h, l, s) => s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s);
+var rotlL = (h, l, s) => s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s);
+function keccakP(s, rounds = 24) {
+  anumber(rounds, "rounds");
+  if (rounds < 1 || rounds > 24)
+    throw new Error('"rounds" expected integer 1..24');
+  const B = new Uint32Array(5 * 2);
+  for (let round = 24 - rounds; round < 24; round++) {
+    for (let x = 0; x < 10; x++)
+      B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];
+    for (let x = 0; x < 10; x += 2) {
+      const idx1 = (x + 8) % 10;
+      const idx0 = (x + 2) % 10;
+      const B0 = B[idx0];
+      const B1 = B[idx0 + 1];
+      const Th = rotlH(B0, B1, 1) ^ B[idx1];
+      const Tl = rotlL(B0, B1, 1) ^ B[idx1 + 1];
+      for (let y = 0; y < 50; y += 10) {
+        s[x + y] ^= Th;
+        s[x + y + 1] ^= Tl;
+      }
+    }
+    let curH = s[2];
+    let curL = s[3];
+    for (let t = 0; t < 24; t++) {
+      const shift = SHA3_ROTL[t];
+      const Th = rotlH(curH, curL, shift);
+      const Tl = rotlL(curH, curL, shift);
+      const PI = SHA3_PI[t];
+      curH = s[PI];
+      curL = s[PI + 1];
+      s[PI] = Th;
+      s[PI + 1] = Tl;
+    }
+    for (let y = 0; y < 50; y += 10) {
+      const b0 = s[y], b1 = s[y + 1], b2 = s[y + 2], b3 = s[y + 3];
+      s[y] ^= ~s[y + 2] & s[y + 4];
+      s[y + 1] ^= ~s[y + 3] & s[y + 5];
+      s[y + 2] ^= ~s[y + 4] & s[y + 6];
+      s[y + 3] ^= ~s[y + 5] & s[y + 7];
+      s[y + 4] ^= ~s[y + 6] & s[y + 8];
+      s[y + 5] ^= ~s[y + 7] & s[y + 9];
+      s[y + 6] ^= ~s[y + 8] & b0;
+      s[y + 7] ^= ~s[y + 9] & b1;
+      s[y + 8] ^= ~b0 & b2;
+      s[y + 9] ^= ~b1 & b3;
+    }
+    s[0] ^= SHA3_IOTA_H[round];
+    s[1] ^= SHA3_IOTA_L[round];
+  }
+  clean(B);
+}
+var Keccak = class _Keccak {
+  state;
+  pos = 0;
+  posOut = 0;
+  finished = false;
+  state32;
+  destroyed = false;
+  blockLen;
+  suffix;
+  outputLen;
+  canXOF;
+  enableXOF = false;
+  rounds;
+  // NOTE: we accept arguments in bytes instead of bits here.
+  constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {
+    this.blockLen = blockLen;
+    this.suffix = suffix;
+    this.outputLen = outputLen;
+    this.enableXOF = enableXOF;
+    this.canXOF = enableXOF;
+    this.rounds = rounds;
+    anumber(outputLen, "outputLen");
+    if (!(0 < blockLen && blockLen < 200))
+      throw new Error("only keccak-f1600 function is supported");
+    this.state = new Uint8Array(200);
+    this.state32 = u32(this.state);
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  keccak() {
+    swap32IfBE(this.state32);
+    keccakP(this.state32, this.rounds);
+    swap32IfBE(this.state32);
+    this.posOut = 0;
+    this.pos = 0;
+  }
+  update(data) {
+    aexists(this);
+    abytes(data);
+    const { blockLen, state } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      for (let i = 0; i < take; i++)
+        state[this.pos++] ^= data[pos++];
+      if (this.pos === blockLen)
+        this.keccak();
+    }
+    return this;
+  }
+  finish() {
+    if (this.finished)
+      return;
+    this.finished = true;
+    const { state, suffix, pos, blockLen } = this;
+    state[pos] ^= suffix;
+    if ((suffix & 128) !== 0 && pos === blockLen - 1)
+      this.keccak();
+    state[blockLen - 1] ^= 128;
+    this.keccak();
+  }
+  writeInto(out) {
+    aexists(this, false);
+    abytes(out);
+    this.finish();
+    const bufferOut = this.state;
+    const { blockLen } = this;
+    for (let pos = 0, len = out.length; pos < len; ) {
+      if (this.posOut >= blockLen)
+        this.keccak();
+      const take = Math.min(blockLen - this.posOut, len - pos);
+      out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
+      this.posOut += take;
+      pos += take;
+    }
+    return out;
+  }
+  xofInto(out) {
+    if (!this.enableXOF)
+      throw new Error("XOF is not possible for this instance");
+    return this.writeInto(out);
+  }
+  xof(bytes) {
+    anumber(bytes);
+    return this.xofInto(new Uint8Array(bytes));
+  }
+  digestInto(out) {
+    aoutput(out, this);
+    if (this.finished)
+      throw new Error("digest() was already called");
+    this.writeInto(out.subarray(0, this.outputLen));
+    this.destroy();
+  }
+  digest() {
+    const out = new Uint8Array(this.outputLen);
+    this.digestInto(out);
+    return out;
+  }
+  destroy() {
+    this.destroyed = true;
+    clean(this.state);
+  }
+  _cloneInto(to) {
+    const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
+    to ||= new _Keccak(blockLen, suffix, outputLen, enableXOF, rounds);
+    to.blockLen = blockLen;
+    to.state32.set(this.state32);
+    to.pos = this.pos;
+    to.posOut = this.posOut;
+    to.finished = this.finished;
+    to.rounds = rounds;
+    to.suffix = suffix;
+    to.outputLen = outputLen;
+    to.enableXOF = enableXOF;
+    to.canXOF = this.canXOF;
+    to.destroyed = this.destroyed;
+    return to;
+  }
+};
+var genKeccak = (suffix, blockLen, outputLen, info = {}) => createHasher(() => new Keccak(blockLen, suffix, outputLen), info);
+var keccak_256 = /* @__PURE__ */ genKeccak(1, 136, 32);
+
+// ../../node_modules/.pnpm/micro-zk-proofs@0.3.1/node_modules/micro-zk-proofs/mimcsponge.js
+var Fr = bn254.fields.Fr;
+var SEED = "mimcsponge";
+var NROUNDS = 220;
+function getConstants(seed = SEED, nRounds = NROUNDS) {
+  if (typeof seed !== "string")
+    throw new TypeError('"seed" expected string, got type=' + typeof seed);
+  anumber(nRounds, "nRounds");
+  if (nRounds < 2)
+    throw new RangeError(`expected nRounds >= 2, got ${nRounds}`);
+  const cts = [BigInt(0)];
+  let c = keccak_256(utf8ToBytes(seed));
+  for (let i = 0; i < nRounds - 2; i++)
+    cts.push(Fr.create(Fr.fromBytes(c = keccak_256(c), true)));
+  cts.push(BigInt(0));
+  return cts;
+}
+
+// ../../node_modules/.pnpm/micro-wrkr@0.2.0/node_modules/micro-wrkr/utils.js
+var checkChunks = (numChunks, name = "numChunks") => {
+  if (typeof numChunks !== "number")
+    throw new TypeError(`expected ${name} number, got ${typeof numChunks}`);
+  if (!Number.isSafeInteger(numChunks) || numChunks <= 0)
+    throw new RangeError(`${name} must be > 0`);
+  return numChunks;
+};
+function splitChunks(list, numChunks) {
+  numChunks = checkChunks(numChunks);
+  const chunkSize = Math.ceil(list.length / numChunks);
+  const res = [];
+  for (let i = 0; i < list.length; i += chunkSize)
+    res.push(list.slice(i, i + chunkSize));
+  return res;
+}
+var stringifyError = (e) => "" + (e instanceof Error ? e.message : e);
+var getConcurrencyFromPlatform = (platform) => {
+  const cpus = platform.cpus();
+  return cpus === void 0 ? 1 : cpus;
+};
+function initBatchGen(platform, getWorker, reducers, threads) {
+  if (threads == null)
+    threads = getConcurrencyFromPlatform(platform);
+  let id = 0;
+  const workers = [];
+  const WAIT = {};
+  const errHandler = (err) => {
+    for (const i in WAIT)
+      WAIT[i].reject(err);
+  };
+  const msgHandler = (msg) => {
+    const { id: id2, res, err } = msg;
+    const handler = WAIT[id2];
+    delete WAIT[id2];
+    if (!handler)
+      throw new Error("unknown id");
+    if (err !== void 0)
+      handler.reject(new Error(err));
+    else
+      handler.resolve(res);
+  };
+  for (let i = 0; i < threads; i++) {
+    workers.push(platform.createWorker(getWorker, msgHandler, errHandler));
+  }
+  const methods = {};
+  for (const fn in reducers) {
+    methods[fn] = async (input, _threads) => {
+      const requested = checkChunks(_threads !== void 0 ? _threads : threads, "threads");
+      const count = requested > workers.length ? workers.length : requested;
+      const chunks = splitChunks(input, count);
+      const promises = chunks.map((chunk, i) => {
+        const currId = id++;
+        const thread = workers[i];
+        const p = new Promise((resolve, reject) => {
+          if (WAIT[currId] !== void 0)
+            reject(new Error("worker: id re-use"));
+          WAIT[currId] = { resolve, reject };
+        });
+        thread.send({ id: currId, fn, payload: chunk });
+        return p;
+      });
+      const results = await Promise.all(promises);
+      const reducer = reducers[fn];
+      return reducer ? reducer(results) : results.flat(1);
+    };
+  }
+  const terminate = () => {
+    errHandler(new Error("worker stopped"));
+    for (const w of workers)
+      w.terminate();
+  };
+  return { methods, terminate };
+}
+function initWrkr(platform) {
+  return {
+    getConcurrency: () => getConcurrencyFromPlatform(platform),
+    // WorkerPlatform hooks are receiver-free function properties.
+    // Custom platforms should close over state instead of using `this`.
+    initWorker: platform.initWorker,
+    initBatch: (getWorker, reducers, threads) => initBatchGen(platform, getWorker, reducers, threads)
+  };
+}
+
+// ../mimc-tree/dist/MimcMerkleTree.js
+var import_fixed_merkle_tree = __toESM(require_lib(), 1);
+var MIMC_MERKLE_TREE_ZERO_VALUE = "21663839004416932945382355908790599225266501822907911457504978515578255421292";
+var BN254_SCALAR_FIELD_SIZE = BigInt("0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000001");
+var MONTGOMERY_BITS = 256n;
+var MONTGOMERY_R = 1n << MONTGOMERY_BITS;
+var MONTGOMERY_MASK = MONTGOMERY_R - 1n;
+var MONTGOMERY_R2 = MONTGOMERY_R * MONTGOMERY_R % BN254_SCALAR_FIELD_SIZE;
+var MONTGOMERY_NEG_FIELD_INVERSE = getMontgomeryNegFieldInverse(BN254_SCALAR_FIELD_SIZE);
+var MIMC_SPONGE_ROUNDS = 220;
+var MIMC_SPONGE_CONSTANTS = getConstants("mimcsponge", MIMC_SPONGE_ROUNDS);
+var MIMC_SPONGE_CONSTANTS_MONTGOMERY = MIMC_SPONGE_CONSTANTS.map(mimcMontgomeryFromField);
+var MIMC_MERKLE_TREE_ZERO_VALUE_BIGINT = BigInt(MIMC_MERKLE_TREE_ZERO_VALUE);
+var MIMC_MERKLE_TREE_ZERO_VALUE_MONTGOMERY = mimcMontgomeryFromField(MIMC_MERKLE_TREE_ZERO_VALUE_BIGINT);
+var mimcBrowserWrkr = initWrkr({
+  cpus: () => {
+    const browserGlobal = globalThis;
+    return browserGlobal.navigator?.hardwareConcurrency;
+  },
+  initWorker(handlers) {
+    const workerScope = globalThis;
+    if (!workerScope.postMessage || !workerScope.addEventListener) {
+      throw new Error("MiMC browser worker must be started as a Web Worker.");
+    }
+    workerScope.addEventListener("message", (event) => {
+      const { id, fn, payload } = event.data;
+      try {
+        workerScope.postMessage?.({
+          id,
+          res: handlers[fn](payload)
+        });
+      } catch (error) {
+        workerScope.postMessage?.({
+          id,
+          err: stringifyError(error)
+        });
+      }
+    });
+  },
+  createWorker(getWorker, onMessage, onError) {
+    const worker = getWorker();
+    worker.addEventListener("message", (event) => {
+      onMessage(event.data);
+    });
+    worker.addEventListener("error", (event) => {
+      onError(getBrowserWorkerErrorMessage(event));
+    });
+    worker.addEventListener("messageerror", (event) => {
+      onError(getBrowserWorkerErrorMessage(event));
+    });
+    return {
+      send: (message) => worker.postMessage(message),
+      terminate: () => {
+        worker.terminate();
+      }
+    };
+  }
+});
+function getMontgomeryNegFieldInverse(modulus) {
+  let inverse = 1n;
+  for (let i = 0; i < 8; i++) {
+    inverse = inverse * (2n - modulus * inverse) & MONTGOMERY_MASK;
+  }
+  return -inverse & MONTGOMERY_MASK;
+}
+function mimcFieldMod(value) {
+  const result = value % BN254_SCALAR_FIELD_SIZE;
+  return result >= 0n ? result : result + BN254_SCALAR_FIELD_SIZE;
+}
+function mimcMontgomeryReduce(value) {
+  const quotient = (value & MONTGOMERY_MASK) * MONTGOMERY_NEG_FIELD_INVERSE & MONTGOMERY_MASK;
+  let reduced = value + quotient * BN254_SCALAR_FIELD_SIZE >> MONTGOMERY_BITS;
+  if (reduced >= BN254_SCALAR_FIELD_SIZE)
+    reduced -= BN254_SCALAR_FIELD_SIZE;
+  return reduced;
+}
+function mimcMontgomeryMultiply(left, right) {
+  return mimcMontgomeryReduce(left * right);
+}
+function mimcMontgomeryFromField(value) {
+  return mimcMontgomeryMultiply(mimcFieldMod(value), MONTGOMERY_R2);
+}
+function mimcSpongeUpdateMontgomery(input, spongeLeft, spongeRight) {
+  const constants = MIMC_SPONGE_CONSTANTS_MONTGOMERY;
+  const fieldSize = BN254_SCALAR_FIELD_SIZE;
+  const inverse = MONTGOMERY_NEG_FIELD_INVERSE;
+  const mask = MONTGOMERY_MASK;
+  let left = spongeLeft + input;
+  if (left >= fieldSize)
+    left -= fieldSize;
+  let right = spongeRight;
+  for (let round = 0; round < MIMC_SPONGE_ROUNDS; round++) {
+    let t = left + constants[round];
+    if (t >= fieldSize)
+      t -= fieldSize;
+    let product = t * t;
+    let quotient = (product & mask) * inverse & mask;
+    let squared = product + quotient * fieldSize >> MONTGOMERY_BITS;
+    if (squared >= fieldSize)
+      squared -= fieldSize;
+    product = squared * squared;
+    quotient = (product & mask) * inverse & mask;
+    let fourthPower = product + quotient * fieldSize >> MONTGOMERY_BITS;
+    if (fourthPower >= fieldSize)
+      fourthPower -= fieldSize;
+    product = fourthPower * t;
+    quotient = (product & mask) * inverse & mask;
+    let fifthPower = product + quotient * fieldSize >> MONTGOMERY_BITS;
+    if (fifthPower >= fieldSize)
+      fifthPower -= fieldSize;
+    let nextRight = right + fifthPower;
+    if (nextRight >= fieldSize)
+      nextRight -= fieldSize;
+    if (round < MIMC_SPONGE_ROUNDS - 1) {
+      right = left;
+      left = nextRight;
+    } else {
+      right = nextRight;
+    }
+  }
+  return [left, right];
+}
+function mimcMerkleTreeHashMontgomery(left, right) {
+  const [firstLeft, firstRight] = mimcSpongeUpdateMontgomery(left, 0n, 0n);
+  return mimcSpongeUpdateMontgomery(right, firstLeft, firstRight)[0];
+}
+function __mimcHashLayerMontgomery(nodes, zero, startNodeIndex = 0, previousLayerLength = nodes.length) {
+  const currentLayerLength = Math.ceil(nodes.length / 2);
+  const currentLayer = new Array(currentLayerLength);
+  for (let nodeIndex = 0, parentIndex = 0; nodeIndex < nodes.length; nodeIndex += 2, parentIndex++) {
+    const globalNodeIndex = startNodeIndex + nodeIndex;
+    const left = nodes[nodeIndex];
+    const right = globalNodeIndex + 1 < previousLayerLength ? nodes[nodeIndex + 1] : zero;
+    currentLayer[parentIndex] = mimcMerkleTreeHashMontgomery(left, right);
+  }
+  return currentLayer;
+}
+function getBrowserWorkerErrorMessage(event) {
+  if (event.error instanceof Error) {
+    return event.error.message;
+  }
+  if (event.error !== void 0) {
+    return String(event.error);
+  }
+  return event.message ?? "MiMC browser worker failed.";
+}
+
+// ../mimc-tree/dist/MimcMerkleTreeWorker.js
+if (!parentPort) {
+  throw new Error("MiMC worker must be started as a worker thread.");
+}
+parentPort.on("message", (value) => {
+  const request = value;
+  const signal = new Int32Array(request.signal);
+  try {
+    request.port.postMessage({
+      nodes: __mimcHashLayerMontgomery(request.nodes, request.zero, request.startNodeIndex, request.previousLayerLength)
+    });
+  } catch (error) {
+    request.port.postMessage({
+      error: error instanceof Error ? error.message : String(error)
+    });
+  } finally {
+    request.port.close();
+    Atomics.store(signal, 0, 1);
+    Atomics.notify(signal, 0);
+  }
+});
+/*! Bundled license information:
+
+@noble/curves/utils.js:
+@noble/curves/abstract/modular.js:
+@noble/curves/abstract/curve.js:
+@noble/curves/abstract/weierstrass.js:
+@noble/curves/abstract/bls.js:
+@noble/curves/abstract/tower.js:
+@noble/curves/bn254.js:
+  (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
+*/