@prosopo/procaptcha-bundle 3.0.12 → 3.0.13

package/dist/bundle/nobleChunk-CQ4ENyKh.js

@@ -0,0 +1,3769 @@
+const Yt = typeof globalThis == "object" && "crypto" in globalThis ? globalThis.crypto : void 0;
+function pe(t) {
+  return t instanceof Uint8Array || ArrayBuffer.isView(t) && t.constructor.name === "Uint8Array";
+}
+function et(t) {
+  if (!Number.isSafeInteger(t) || t < 0)
+    throw new Error("positive integer expected, got " + t);
+}
+function W(t, ...e) {
+  if (!pe(t))
+    throw new Error("Uint8Array expected");
+  if (e.length > 0 && !e.includes(t.length))
+    throw new Error("Uint8Array expected of length " + e + ", got length=" + t.length);
+}
+function Cn(t) {
+  if (typeof t != "function" || typeof t.create != "function")
+    throw new Error("Hash should be wrapped by utils.createHasher");
+  et(t.outputLen), et(t.blockLen);
+}
+function Kt(t, e = !0) {
+  if (t.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (e && t.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function zn(t, e) {
+  W(t);
+  const n = e.outputLen;
+  if (t.length < n)
+    throw new Error("digestInto() expects output buffer of length at least " + n);
+}
+function Mt(t) {
+  return new Uint32Array(t.buffer, t.byteOffset, Math.floor(t.byteLength / 4));
+}
+function ft(...t) {
+  for (let e = 0; e < t.length; e++)
+    t[e].fill(0);
+}
+function be(t) {
+  return new DataView(t.buffer, t.byteOffset, t.byteLength);
+}
+function wt(t, e) {
+  return t << 32 - e | t >>> e;
+}
+function D(t, e) {
+  return t << e | t >>> 32 - e >>> 0;
+}
+const jn = new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68;
+function Vn(t) {
+  return t << 24 & 4278190080 | t << 8 & 16711680 | t >>> 8 & 65280 | t >>> 24 & 255;
+}
+const xt = jn ? (t) => t : (t) => Vn(t);
+function Nr(t) {
+  for (let e = 0; e < t.length; e++)
+    t[e] = Vn(t[e]);
+  return t;
+}
+const qt = jn ? (t) => t : Nr, Yn = /* @ts-ignore */ typeof Uint8Array.from([]).toHex == "function" && typeof Uint8Array.fromHex == "function", $r = /* @__PURE__ */ Array.from({ length: 256 }, (t, e) => e.toString(16).padStart(2, "0"));
+function ht(t) {
+  if (W(t), Yn)
+    return t.toHex();
+  let e = "";
+  for (let n = 0; n < t.length; n++)
+    e += $r[t[n]];
+  return e;
+}
+const gt = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
+function hn(t) {
+  if (t >= gt._0 && t <= gt._9)
+    return t - gt._0;
+  if (t >= gt.A && t <= gt.F)
+    return t - (gt.A - 10);
+  if (t >= gt.a && t <= gt.f)
+    return t - (gt.a - 10);
+}
+function ae(t) {
+  if (typeof t != "string")
+    throw new Error("hex string expected, got " + typeof t);
+  if (Yn)
+    return Uint8Array.fromHex(t);
+  const e = t.length, n = e / 2;
+  if (e % 2)
+    throw new Error("hex string expected, got unpadded hex of length " + e);
+  const r = new Uint8Array(n);
+  for (let i = 0, s = 0; i < n; i++, s += 2) {
+    const c = hn(t.charCodeAt(s)), o = hn(t.charCodeAt(s + 1));
+    if (c === void 0 || o === void 0) {
+      const f = t[s] + t[s + 1];
+      throw new Error('hex string expected, got non-hex character "' + f + '" at index ' + s);
+    }
+    r[i] = c * 16 + o;
+  }
+  return r;
+}
+function We(t) {
+  if (typeof t != "string")
+    throw new Error("string expected");
+  return new Uint8Array(new TextEncoder().encode(t));
+}
+function Ht(t) {
+  return typeof t == "string" && (t = We(t)), W(t), t;
+}
+function wn(t) {
+  return typeof t == "string" && (t = We(t)), W(t), t;
+}
+function ut(...t) {
+  let e = 0;
+  for (let r = 0; r < t.length; r++) {
+    const i = t[r];
+    W(i), e += i.length;
+  }
+  const n = new Uint8Array(e);
+  for (let r = 0, i = 0; r < t.length; r++) {
+    const s = t[r];
+    n.set(s, i), i += s.length;
+  }
+  return n;
+}
+function Gn(t, e) {
+  if (e !== void 0 && {}.toString.call(e) !== "[object Object]")
+    throw new Error("options should be object or undefined");
+  return Object.assign(t, e);
+}
+class Qe {
+}
+function Xn(t) {
+  const e = (r) => t().update(Ht(r)).digest(), n = t();
+  return e.outputLen = n.outputLen, e.blockLen = n.blockLen, e.create = () => t(), e;
+}
+function Hr(t) {
+  const e = (r, i) => t(i).update(Ht(r)).digest(), n = t({});
+  return e.outputLen = n.outputLen, e.blockLen = n.blockLen, e.create = (r) => t(r), e;
+}
+function Je(t = 32) {
+  if (Yt && typeof Yt.getRandomValues == "function")
+    return Yt.getRandomValues(new Uint8Array(t));
+  if (Yt && typeof Yt.randomBytes == "function")
+    return Uint8Array.from(Yt.randomBytes(t));
+  throw new Error("crypto.getRandomValues must be defined");
+}
+const kr = /* @__PURE__ */ Uint8Array.from([
+  0,
+  1,
+  2,
+  3,
+  4,
+  5,
+  6,
+  7,
+  8,
+  9,
+  10,
+  11,
+  12,
+  13,
+  14,
+  15,
+  14,
+  10,
+  4,
+  8,
+  9,
+  15,
+  13,
+  6,
+  1,
+  12,
+  0,
+  2,
+  11,
+  7,
+  5,
+  3,
+  11,
+  8,
+  12,
+  0,
+  5,
+  2,
+  15,
+  13,
+  10,
+  14,
+  3,
+  6,
+  7,
+  1,
+  9,
+  4,
+  7,
+  9,
+  3,
+  1,
+  13,
+  12,
+  11,
+  14,
+  2,
+  6,
+  5,
+  10,
+  4,
+  0,
+  15,
+  8,
+  9,
+  0,
+  5,
+  7,
+  2,
+  4,
+  10,
+  15,
+  14,
+  1,
+  11,
+  12,
+  6,
+  8,
+  3,
+  13,
+  2,
+  12,
+  6,
+  10,
+  0,
+  11,
+  8,
+  3,
+  4,
+  13,
+  7,
+  5,
+  15,
+  14,
+  1,
+  9,
+  12,
+  5,
+  1,
+  15,
+  14,
+  13,
+  4,
+  10,
+  0,
+  7,
+  6,
+  3,
+  9,
+  2,
+  8,
+  11,
+  13,
+  11,
+  7,
+  14,
+  12,
+  1,
+  3,
+  9,
+  5,
+  0,
+  15,
+  4,
+  8,
+  6,
+  2,
+  10,
+  6,
+  15,
+  14,
+  9,
+  11,
+  3,
+  0,
+  8,
+  12,
+  2,
+  13,
+  7,
+  1,
+  4,
+  10,
+  5,
+  10,
+  2,
+  8,
+  4,
+  7,
+  6,
+  1,
+  5,
+  15,
+  11,
+  9,
+  14,
+  3,
+  12,
+  13,
+  0,
+  0,
+  1,
+  2,
+  3,
+  4,
+  5,
+  6,
+  7,
+  8,
+  9,
+  10,
+  11,
+  12,
+  13,
+  14,
+  15,
+  14,
+  10,
+  4,
+  8,
+  9,
+  15,
+  13,
+  6,
+  1,
+  12,
+  0,
+  2,
+  11,
+  7,
+  5,
+  3,
+  // Blake1, unused in others
+  11,
+  8,
+  12,
+  0,
+  5,
+  2,
+  15,
+  13,
+  10,
+  14,
+  3,
+  6,
+  7,
+  1,
+  9,
+  4,
+  7,
+  9,
+  3,
+  1,
+  13,
+  12,
+  11,
+  14,
+  2,
+  6,
+  5,
+  10,
+  4,
+  0,
+  15,
+  8,
+  9,
+  0,
+  5,
+  7,
+  2,
+  4,
+  10,
+  15,
+  14,
+  1,
+  11,
+  12,
+  6,
+  8,
+  3,
+  13,
+  2,
+  12,
+  6,
+  10,
+  0,
+  11,
+  8,
+  3,
+  4,
+  13,
+  7,
+  5,
+  15,
+  14,
+  1,
+  9
+]);
+function Tr(t, e, n, r) {
+  if (typeof t.setBigUint64 == "function")
+    return t.setBigUint64(e, n, r);
+  const i = BigInt(32), s = BigInt(4294967295), c = Number(n >> i & s), o = Number(n & s), f = r ? 4 : 0, u = r ? 0 : 4;
+  t.setUint32(e + f, c, r), t.setUint32(e + u, o, r);
+}
+function Ur(t, e, n) {
+  return t & e ^ ~t & n;
+}
+function Zr(t, e, n) {
+  return t & e ^ t & n ^ e & n;
+}
+class Kn extends Qe {
+  constructor(e, n, r, i) {
+    super(), this.finished = !1, this.length = 0, this.pos = 0, this.destroyed = !1, this.blockLen = e, this.outputLen = n, this.padOffset = r, this.isLE = i, this.buffer = new Uint8Array(e), this.view = be(this.buffer);
+  }
+  update(e) {
+    Kt(this), e = Ht(e), W(e);
+    const { view: n, buffer: r, blockLen: i } = this, s = e.length;
+    for (let c = 0; c < s; ) {
+      const o = Math.min(i - this.pos, s - c);
+      if (o === i) {
+        const f = be(e);
+        for (; i <= s - c; c += i)
+          this.process(f, c);
+        continue;
+      }
+      r.set(e.subarray(c, c + o), this.pos), this.pos += o, c += o, this.pos === i && (this.process(n, 0), this.pos = 0);
+    }
+    return this.length += e.length, this.roundClean(), this;
+  }
+  digestInto(e) {
+    Kt(this), zn(e, this), this.finished = !0;
+    const { buffer: n, view: r, blockLen: i, isLE: s } = this;
+    let { pos: c } = this;
+    n[c++] = 128, ft(this.buffer.subarray(c)), this.padOffset > i - c && (this.process(r, 0), c = 0);
+    for (let w = c; w < i; w++)
+      n[w] = 0;
+    Tr(r, i - 8, BigInt(this.length * 8), s), this.process(r, 0);
+    const o = be(e), f = this.outputLen;
+    if (f % 4)
+      throw new Error("_sha2: outputLen should be aligned to 32bit");
+    const u = f / 4, a = this.get();
+    if (u > a.length)
+      throw new Error("_sha2: outputLen bigger than state");
+    for (let w = 0; w < u; w++)
+      o.setUint32(4 * w, a[w], s);
+  }
+  digest() {
+    const { buffer: e, outputLen: n } = this;
+    this.digestInto(e);
+    const r = e.slice(0, n);
+    return this.destroy(), r;
+  }
+  _cloneInto(e) {
+    e || (e = new this.constructor()), e.set(...this.get());
+    const { blockLen: n, buffer: r, length: i, finished: s, destroyed: c, pos: o } = this;
+    return e.destroyed = c, e.finished = s, e.length = i, e.pos = o, i % n && e.buffer.set(r), e;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+}
+const _t = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+const F = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  4089235720,
+  3144134277,
+  2227873595,
+  1013904242,
+  4271175723,
+  2773480762,
+  1595750129,
+  1359893119,
+  2917565137,
+  2600822924,
+  725511199,
+  528734635,
+  4215389547,
+  1541459225,
+  327033209
+]), de = /* @__PURE__ */ BigInt(2 ** 32 - 1), mn = /* @__PURE__ */ BigInt(32);
+function Pn(t, e = !1) {
+  return e ? { h: Number(t & de), l: Number(t >> mn & de) } : { h: Number(t >> mn & de) | 0, l: Number(t & de) | 0 };
+}
+function Wn(t, e = !1) {
+  const n = t.length;
+  let r = new Uint32Array(n), i = new Uint32Array(n);
+  for (let s = 0; s < n; s++) {
+    const { h: c, l: o } = Pn(t[s], e);
+    [r[s], i[s]] = [c, o];
+  }
+  return [r, i];
+}
+const bn = (t, e, n) => t >>> n, yn = (t, e, n) => t << 32 - n | e >>> n, Rt = (t, e, n) => t >>> n | e << 32 - n, Lt = (t, e, n) => t << 32 - n | e >>> n, ee = (t, e, n) => t << 64 - n | e >>> n - 32, ne = (t, e, n) => t >>> n - 32 | e << 64 - n, Dr = (t, e) => e, Mr = (t, e) => t, Cr = (t, e, n) => t << n | e >>> 32 - n, zr = (t, e, n) => e << n | t >>> 32 - n, jr = (t, e, n) => e << n - 32 | t >>> 64 - n, Vr = (t, e, n) => t << n - 32 | e >>> 64 - n;
+function at(t, e, n, r) {
+  const i = (e >>> 0) + (r >>> 0);
+  return { h: t + n + (i / 2 ** 32 | 0) | 0, l: i | 0 };
+}
+const Fe = (t, e, n) => (t >>> 0) + (e >>> 0) + (n >>> 0), tn = (t, e, n, r) => e + n + r + (t / 2 ** 32 | 0) | 0, Yr = (t, e, n, r) => (t >>> 0) + (e >>> 0) + (n >>> 0) + (r >>> 0), Gr = (t, e, n, r, i) => e + n + r + i + (t / 2 ** 32 | 0) | 0, Xr = (t, e, n, r, i) => (t >>> 0) + (e >>> 0) + (n >>> 0) + (r >>> 0) + (i >>> 0), Kr = (t, e, n, r, i, s) => e + n + r + i + s + (t / 2 ** 32 | 0) | 0, G = /* @__PURE__ */ Uint32Array.from([
+  4089235720,
+  1779033703,
+  2227873595,
+  3144134277,
+  4271175723,
+  1013904242,
+  1595750129,
+  2773480762,
+  2917565137,
+  1359893119,
+  725511199,
+  2600822924,
+  4215389547,
+  528734635,
+  327033209,
+  1541459225
+]), $ = /* @__PURE__ */ new Uint32Array(32);
+function vt(t, e, n, r, i, s) {
+  const c = i[s], o = i[s + 1];
+  let f = $[2 * t], u = $[2 * t + 1], a = $[2 * e], w = $[2 * e + 1], l = $[2 * n], d = $[2 * n + 1], p = $[2 * r], b = $[2 * r + 1], h = Fe(f, a, c);
+  u = tn(h, u, w, o), f = h | 0, { Dh: b, Dl: p } = { Dh: b ^ u, Dl: p ^ f }, { Dh: b, Dl: p } = { Dh: Dr(b, p), Dl: Mr(b) }, { h: d, l } = at(d, l, b, p), { Bh: w, Bl: a } = { Bh: w ^ d, Bl: a ^ l }, { Bh: w, Bl: a } = { Bh: Rt(w, a, 24), Bl: Lt(w, a, 24) }, $[2 * t] = f, $[2 * t + 1] = u, $[2 * e] = a, $[2 * e + 1] = w, $[2 * n] = l, $[2 * n + 1] = d, $[2 * r] = p, $[2 * r + 1] = b;
+}
+function St(t, e, n, r, i, s) {
+  const c = i[s], o = i[s + 1];
+  let f = $[2 * t], u = $[2 * t + 1], a = $[2 * e], w = $[2 * e + 1], l = $[2 * n], d = $[2 * n + 1], p = $[2 * r], b = $[2 * r + 1], h = Fe(f, a, c);
+  u = tn(h, u, w, o), f = h | 0, { Dh: b, Dl: p } = { Dh: b ^ u, Dl: p ^ f }, { Dh: b, Dl: p } = { Dh: Rt(b, p, 16), Dl: Lt(b, p, 16) }, { h: d, l } = at(d, l, b, p), { Bh: w, Bl: a } = { Bh: w ^ d, Bl: a ^ l }, { Bh: w, Bl: a } = { Bh: ee(w, a, 63), Bl: ne(w, a, 63) }, $[2 * t] = f, $[2 * t + 1] = u, $[2 * e] = a, $[2 * e + 1] = w, $[2 * n] = l, $[2 * n + 1] = d, $[2 * r] = p, $[2 * r + 1] = b;
+}
+function Pr(t, e = {}, n, r, i) {
+  if (et(n), t < 0 || t > n)
+    throw new Error("outputLen bigger than keyLen");
+  const { key: s, salt: c, personalization: o } = e;
+  if (s !== void 0 && (s.length < 1 || s.length > n))
+    throw new Error("key length must be undefined or 1.." + n);
+  if (c !== void 0 && c.length !== r)
+    throw new Error("salt must be undefined or " + r);
+  if (o !== void 0 && o.length !== i)
+    throw new Error("personalization must be undefined or " + i);
+}
+class Wr extends Qe {
+  constructor(e, n) {
+    super(), this.finished = !1, this.destroyed = !1, this.length = 0, this.pos = 0, et(e), et(n), this.blockLen = e, this.outputLen = n, this.buffer = new Uint8Array(e), this.buffer32 = Mt(this.buffer);
+  }
+  update(e) {
+    Kt(this), e = Ht(e), W(e);
+    const { blockLen: n, buffer: r, buffer32: i } = this, s = e.length, c = e.byteOffset, o = e.buffer;
+    for (let f = 0; f < s; ) {
+      this.pos === n && (qt(i), this.compress(i, 0, !1), qt(i), this.pos = 0);
+      const u = Math.min(n - this.pos, s - f), a = c + f;
+      if (u === n && !(a % 4) && f + u < s) {
+        const w = new Uint32Array(o, a, Math.floor((s - f) / 4));
+        qt(w);
+        for (let l = 0; f + n < s; l += i.length, f += n)
+          this.length += n, this.compress(w, l, !1);
+        qt(w);
+        continue;
+      }
+      r.set(e.subarray(f, f + u), this.pos), this.pos += u, this.length += u, f += u;
+    }
+    return this;
+  }
+  digestInto(e) {
+    Kt(this), zn(e, this);
+    const { pos: n, buffer32: r } = this;
+    this.finished = !0, ft(this.buffer.subarray(n)), qt(r), this.compress(r, 0, !0), qt(r);
+    const i = Mt(e);
+    this.get().forEach((s, c) => i[c] = xt(s));
+  }
+  digest() {
+    const { buffer: e, outputLen: n } = this;
+    this.digestInto(e);
+    const r = e.slice(0, n);
+    return this.destroy(), r;
+  }
+  _cloneInto(e) {
+    const { buffer: n, length: r, finished: i, destroyed: s, outputLen: c, pos: o } = this;
+    return e || (e = new this.constructor({ dkLen: c })), e.set(...this.get()), e.buffer.set(n), e.destroyed = s, e.finished = i, e.length = r, e.pos = o, e.outputLen = c, e;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+}
+class Qr extends Wr {
+  constructor(e = {}) {
+    const n = e.dkLen === void 0 ? 64 : e.dkLen;
+    super(128, n), this.v0l = G[0] | 0, this.v0h = G[1] | 0, this.v1l = G[2] | 0, this.v1h = G[3] | 0, this.v2l = G[4] | 0, this.v2h = G[5] | 0, this.v3l = G[6] | 0, this.v3h = G[7] | 0, this.v4l = G[8] | 0, this.v4h = G[9] | 0, this.v5l = G[10] | 0, this.v5h = G[11] | 0, this.v6l = G[12] | 0, this.v6h = G[13] | 0, this.v7l = G[14] | 0, this.v7h = G[15] | 0, Pr(n, e, 64, 16, 16);
+    let { key: r, personalization: i, salt: s } = e, c = 0;
+    if (r !== void 0 && (r = Ht(r), c = r.length), this.v0l ^= this.outputLen | c << 8 | 65536 | 1 << 24, s !== void 0) {
+      s = Ht(s);
+      const o = Mt(s);
+      this.v4l ^= xt(o[0]), this.v4h ^= xt(o[1]), this.v5l ^= xt(o[2]), this.v5h ^= xt(o[3]);
+    }
+    if (i !== void 0) {
+      i = Ht(i);
+      const o = Mt(i);
+      this.v6l ^= xt(o[0]), this.v6h ^= xt(o[1]), this.v7l ^= xt(o[2]), this.v7h ^= xt(o[3]);
+    }
+    if (r !== void 0) {
+      const o = new Uint8Array(this.blockLen);
+      o.set(r), this.update(o);
+    }
+  }
+  // prettier-ignore
+  get() {
+    let { v0l: e, v0h: n, v1l: r, v1h: i, v2l: s, v2h: c, v3l: o, v3h: f, v4l: u, v4h: a, v5l: w, v5h: l, v6l: d, v6h: p, v7l: b, v7h: h } = this;
+    return [e, n, r, i, s, c, o, f, u, a, w, l, d, p, b, h];
+  }
+  // prettier-ignore
+  set(e, n, r, i, s, c, o, f, u, a, w, l, d, p, b, h) {
+    this.v0l = e | 0, this.v0h = n | 0, this.v1l = r | 0, this.v1h = i | 0, this.v2l = s | 0, this.v2h = c | 0, this.v3l = o | 0, this.v3h = f | 0, this.v4l = u | 0, this.v4h = a | 0, this.v5l = w | 0, this.v5h = l | 0, this.v6l = d | 0, this.v6h = p | 0, this.v7l = b | 0, this.v7h = h | 0;
+  }
+  compress(e, n, r) {
+    this.get().forEach((f, u) => $[u] = f), $.set(G, 16);
+    let { h: i, l: s } = Pn(BigInt(this.length));
+    $[24] = G[8] ^ s, $[25] = G[9] ^ i, r && ($[28] = ~$[28], $[29] = ~$[29]);
+    let c = 0;
+    const o = kr;
+    for (let f = 0; f < 12; f++)
+      vt(0, 4, 8, 12, e, n + 2 * o[c++]), St(0, 4, 8, 12, e, n + 2 * o[c++]), vt(1, 5, 9, 13, e, n + 2 * o[c++]), St(1, 5, 9, 13, e, n + 2 * o[c++]), vt(2, 6, 10, 14, e, n + 2 * o[c++]), St(2, 6, 10, 14, e, n + 2 * o[c++]), vt(3, 7, 11, 15, e, n + 2 * o[c++]), St(3, 7, 11, 15, e, n + 2 * o[c++]), vt(0, 5, 10, 15, e, n + 2 * o[c++]), St(0, 5, 10, 15, e, n + 2 * o[c++]), vt(1, 6, 11, 12, e, n + 2 * o[c++]), St(1, 6, 11, 12, e, n + 2 * o[c++]), vt(2, 7, 8, 13, e, n + 2 * o[c++]), St(2, 7, 8, 13, e, n + 2 * o[c++]), vt(3, 4, 9, 14, e, n + 2 * o[c++]), St(3, 4, 9, 14, e, n + 2 * o[c++]);
+    this.v0l ^= $[0] ^ $[16], this.v0h ^= $[1] ^ $[17], this.v1l ^= $[2] ^ $[18], this.v1h ^= $[3] ^ $[19], this.v2l ^= $[4] ^ $[20], this.v2h ^= $[5] ^ $[21], this.v3l ^= $[6] ^ $[22], this.v3h ^= $[7] ^ $[23], this.v4l ^= $[8] ^ $[24], this.v4h ^= $[9] ^ $[25], this.v5l ^= $[10] ^ $[26], this.v5h ^= $[11] ^ $[27], this.v6l ^= $[12] ^ $[28], this.v6h ^= $[13] ^ $[29], this.v7l ^= $[14] ^ $[30], this.v7h ^= $[15] ^ $[31], ft($);
+  }
+  destroy() {
+    this.destroyed = !0, ft(this.buffer32), this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+  }
+}
+const Jr = /* @__PURE__ */ Hr((t) => new Qr(t));
+const Ks = Jr;
+class Qn extends Qe {
+  constructor(e, n) {
+    super(), this.finished = !1, this.destroyed = !1, Cn(e);
+    const r = Ht(n);
+    if (this.iHash = e.create(), typeof this.iHash.update != "function")
+      throw new Error("Expected instance of class which extends utils.Hash");
+    this.blockLen = this.iHash.blockLen, this.outputLen = this.iHash.outputLen;
+    const i = this.blockLen, s = new Uint8Array(i);
+    s.set(r.length > i ? e.create().update(r).digest() : r);
+    for (let c = 0; c < s.length; c++)
+      s[c] ^= 54;
+    this.iHash.update(s), this.oHash = e.create();
+    for (let c = 0; c < s.length; c++)
+      s[c] ^= 106;
+    this.oHash.update(s), ft(s);
+  }
+  update(e) {
+    return Kt(this), this.iHash.update(e), this;
+  }
+  digestInto(e) {
+    Kt(this), W(e, this.outputLen), this.finished = !0, this.iHash.digestInto(e), this.oHash.update(e), this.oHash.digestInto(e), this.destroy();
+  }
+  digest() {
+    const e = new Uint8Array(this.oHash.outputLen);
+    return this.digestInto(e), e;
+  }
+  _cloneInto(e) {
+    e || (e = Object.create(Object.getPrototypeOf(this), {}));
+    const { oHash: n, iHash: r, finished: i, destroyed: s, blockLen: c, outputLen: o } = this;
+    return e = e, e.finished = i, e.destroyed = s, e.blockLen = c, e.outputLen = o, e.oHash = n._cloneInto(e.oHash), e.iHash = r._cloneInto(e.iHash), e;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  destroy() {
+    this.destroyed = !0, this.oHash.destroy(), this.iHash.destroy();
+  }
+}
+const en = (t, e, n) => new Qn(t, e).update(n).digest();
+en.create = (t, e) => new Qn(t, e);
+function Fr(t, e, n, r) {
+  Cn(t);
+  const i = Gn({ dkLen: 32, asyncTick: 10 }, r), { c: s, dkLen: c, asyncTick: o } = i;
+  if (et(s), et(c), et(o), s < 1)
+    throw new Error("iterations (c) should be >= 1");
+  const f = wn(e), u = wn(n), a = new Uint8Array(c), w = en.create(t, f), l = w._cloneInto().update(u);
+  return { c: s, dkLen: c, asyncTick: o, DK: a, PRF: w, PRFSalt: l };
+}
+function to(t, e, n, r, i) {
+  return t.destroy(), e.destroy(), r && r.destroy(), ft(i), n;
+}
+function Jn(t, e, n, r) {
+  const { c: i, dkLen: s, DK: c, PRF: o, PRFSalt: f } = Fr(t, e, n, r);
+  let u;
+  const a = new Uint8Array(4), w = be(a), l = new Uint8Array(o.outputLen);
+  for (let d = 1, p = 0; p < s; d++, p += o.outputLen) {
+    const b = c.subarray(p, p + o.outputLen);
+    w.setInt32(0, d, !1), (u = f._cloneInto(u)).update(a).digestInto(l), b.set(l.subarray(0, b.length));
+    for (let h = 1; h < i; h++) {
+      o._cloneInto(u).update(l).digestInto(l);
+      for (let x = 0; x < b.length; x++)
+        b[x] ^= l[x];
+    }
+  }
+  return to(o, f, c, u, l);
+}
+const eo = /* @__PURE__ */ Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]), At = /* @__PURE__ */ new Uint32Array(64);
+class no extends Kn {
+  constructor(e = 32) {
+    super(64, e, 8, !1), this.A = _t[0] | 0, this.B = _t[1] | 0, this.C = _t[2] | 0, this.D = _t[3] | 0, this.E = _t[4] | 0, this.F = _t[5] | 0, this.G = _t[6] | 0, this.H = _t[7] | 0;
+  }
+  get() {
+    const { A: e, B: n, C: r, D: i, E: s, F: c, G: o, H: f } = this;
+    return [e, n, r, i, s, c, o, f];
+  }
+  // prettier-ignore
+  set(e, n, r, i, s, c, o, f) {
+    this.A = e | 0, this.B = n | 0, this.C = r | 0, this.D = i | 0, this.E = s | 0, this.F = c | 0, this.G = o | 0, this.H = f | 0;
+  }
+  process(e, n) {
+    for (let w = 0; w < 16; w++, n += 4)
+      At[w] = e.getUint32(n, !1);
+    for (let w = 16; w < 64; w++) {
+      const l = At[w - 15], d = At[w - 2], p = wt(l, 7) ^ wt(l, 18) ^ l >>> 3, b = wt(d, 17) ^ wt(d, 19) ^ d >>> 10;
+      At[w] = b + At[w - 7] + p + At[w - 16] | 0;
+    }
+    let { A: r, B: i, C: s, D: c, E: o, F: f, G: u, H: a } = this;
+    for (let w = 0; w < 64; w++) {
+      const l = wt(o, 6) ^ wt(o, 11) ^ wt(o, 25), d = a + l + Ur(o, f, u) + eo[w] + At[w] | 0, b = (wt(r, 2) ^ wt(r, 13) ^ wt(r, 22)) + Zr(r, i, s) | 0;
+      a = u, u = f, f = o, o = c + d | 0, c = s, s = i, i = r, r = d + b | 0;
+    }
+    r = r + this.A | 0, i = i + this.B | 0, s = s + this.C | 0, c = c + this.D | 0, o = o + this.E | 0, f = f + this.F | 0, u = u + this.G | 0, a = a + this.H | 0, this.set(r, i, s, c, o, f, u, a);
+  }
+  roundClean() {
+    ft(At);
+  }
+  destroy() {
+    this.set(0, 0, 0, 0, 0, 0, 0, 0), ft(this.buffer);
+  }
+}
+const Fn = Wn([
+  "0x428a2f98d728ae22",
+  "0x7137449123ef65cd",
+  "0xb5c0fbcfec4d3b2f",
+  "0xe9b5dba58189dbbc",
+  "0x3956c25bf348b538",
+  "0x59f111f1b605d019",
+  "0x923f82a4af194f9b",
+  "0xab1c5ed5da6d8118",
+  "0xd807aa98a3030242",
+  "0x12835b0145706fbe",
+  "0x243185be4ee4b28c",
+  "0x550c7dc3d5ffb4e2",
+  "0x72be5d74f27b896f",
+  "0x80deb1fe3b1696b1",
+  "0x9bdc06a725c71235",
+  "0xc19bf174cf692694",
+  "0xe49b69c19ef14ad2",
+  "0xefbe4786384f25e3",
+  "0x0fc19dc68b8cd5b5",
+  "0x240ca1cc77ac9c65",
+  "0x2de92c6f592b0275",
+  "0x4a7484aa6ea6e483",
+  "0x5cb0a9dcbd41fbd4",
+  "0x76f988da831153b5",
+  "0x983e5152ee66dfab",
+  "0xa831c66d2db43210",
+  "0xb00327c898fb213f",
+  "0xbf597fc7beef0ee4",
+  "0xc6e00bf33da88fc2",
+  "0xd5a79147930aa725",
+  "0x06ca6351e003826f",
+  "0x142929670a0e6e70",
+  "0x27b70a8546d22ffc",
+  "0x2e1b21385c26c926",
+  "0x4d2c6dfc5ac42aed",
+  "0x53380d139d95b3df",
+  "0x650a73548baf63de",
+  "0x766a0abb3c77b2a8",
+  "0x81c2c92e47edaee6",
+  "0x92722c851482353b",
+  "0xa2bfe8a14cf10364",
+  "0xa81a664bbc423001",
+  "0xc24b8b70d0f89791",
+  "0xc76c51a30654be30",
+  "0xd192e819d6ef5218",
+  "0xd69906245565a910",
+  "0xf40e35855771202a",
+  "0x106aa07032bbd1b8",
+  "0x19a4c116b8d2d0c8",
+  "0x1e376c085141ab53",
+  "0x2748774cdf8eeb99",
+  "0x34b0bcb5e19b48a8",
+  "0x391c0cb3c5c95a63",
+  "0x4ed8aa4ae3418acb",
+  "0x5b9cca4f7763e373",
+  "0x682e6ff3d6b2b8a3",
+  "0x748f82ee5defb2fc",
+  "0x78a5636f43172f60",
+  "0x84c87814a1f0ab72",
+  "0x8cc702081a6439ec",
+  "0x90befffa23631e28",
+  "0xa4506cebde82bde9",
+  "0xbef9a3f7b2c67915",
+  "0xc67178f2e372532b",
+  "0xca273eceea26619c",
+  "0xd186b8c721c0c207",
+  "0xeada7dd6cde0eb1e",
+  "0xf57d4f7fee6ed178",
+  "0x06f067aa72176fba",
+  "0x0a637dc5a2c898a6",
+  "0x113f9804bef90dae",
+  "0x1b710b35131c471b",
+  "0x28db77f523047d84",
+  "0x32caab7b40c72493",
+  "0x3c9ebe0a15c9bebc",
+  "0x431d67c49c100d4c",
+  "0x4cc5d4becb3e42b6",
+  "0x597f299cfc657e2a",
+  "0x5fcb6fab3ad6faec",
+  "0x6c44198c4a475817"
+].map((t) => BigInt(t))), ro = Fn[0], oo = Fn[1], It = /* @__PURE__ */ new Uint32Array(80), Ot = /* @__PURE__ */ new Uint32Array(80);
+class so extends Kn {
+  constructor(e = 64) {
+    super(128, e, 16, !1), this.Ah = F[0] | 0, this.Al = F[1] | 0, this.Bh = F[2] | 0, this.Bl = F[3] | 0, this.Ch = F[4] | 0, this.Cl = F[5] | 0, this.Dh = F[6] | 0, this.Dl = F[7] | 0, this.Eh = F[8] | 0, this.El = F[9] | 0, this.Fh = F[10] | 0, this.Fl = F[11] | 0, this.Gh = F[12] | 0, this.Gl = F[13] | 0, this.Hh = F[14] | 0, this.Hl = F[15] | 0;
+  }
+  // prettier-ignore
+  get() {
+    const { Ah: e, Al: n, Bh: r, Bl: i, Ch: s, Cl: c, Dh: o, Dl: f, Eh: u, El: a, Fh: w, Fl: l, Gh: d, Gl: p, Hh: b, Hl: h } = this;
+    return [e, n, r, i, s, c, o, f, u, a, w, l, d, p, b, h];
+  }
+  // prettier-ignore
+  set(e, n, r, i, s, c, o, f, u, a, w, l, d, p, b, h) {
+    this.Ah = e | 0, this.Al = n | 0, this.Bh = r | 0, this.Bl = i | 0, this.Ch = s | 0, this.Cl = c | 0, this.Dh = o | 0, this.Dl = f | 0, this.Eh = u | 0, this.El = a | 0, this.Fh = w | 0, this.Fl = l | 0, this.Gh = d | 0, this.Gl = p | 0, this.Hh = b | 0, this.Hl = h | 0;
+  }
+  process(e, n) {
+    for (let A = 0; A < 16; A++, n += 4)
+      It[A] = e.getUint32(n), Ot[A] = e.getUint32(n += 4);
+    for (let A = 16; A < 80; A++) {
+      const L = It[A - 15] | 0, B = Ot[A - 15] | 0, R = Rt(L, B, 1) ^ Rt(L, B, 8) ^ bn(L, B, 7), N = Lt(L, B, 1) ^ Lt(L, B, 8) ^ yn(L, B, 7), q = It[A - 2] | 0, g = Ot[A - 2] | 0, _ = Rt(q, g, 19) ^ ee(q, g, 61) ^ bn(q, g, 6), m = Lt(q, g, 19) ^ ne(q, g, 61) ^ yn(q, g, 6), y = Yr(N, m, Ot[A - 7], Ot[A - 16]), E = Gr(y, R, _, It[A - 7], It[A - 16]);
+      It[A] = E | 0, Ot[A] = y | 0;
+    }
+    let { Ah: r, Al: i, Bh: s, Bl: c, Ch: o, Cl: f, Dh: u, Dl: a, Eh: w, El: l, Fh: d, Fl: p, Gh: b, Gl: h, Hh: x, Hl: v } = this;
+    for (let A = 0; A < 80; A++) {
+      const L = Rt(w, l, 14) ^ Rt(w, l, 18) ^ ee(w, l, 41), B = Lt(w, l, 14) ^ Lt(w, l, 18) ^ ne(w, l, 41), R = w & d ^ ~w & b, N = l & p ^ ~l & h, q = Xr(v, B, N, oo[A], Ot[A]), g = Kr(q, x, L, R, ro[A], It[A]), _ = q | 0, m = Rt(r, i, 28) ^ ee(r, i, 34) ^ ee(r, i, 39), y = Lt(r, i, 28) ^ ne(r, i, 34) ^ ne(r, i, 39), E = r & s ^ r & o ^ s & o, S = i & c ^ i & f ^ c & f;
+      x = b | 0, v = h | 0, b = d | 0, h = p | 0, d = w | 0, p = l | 0, { h: w, l } = at(u | 0, a | 0, g | 0, _ | 0), u = o | 0, a = f | 0, o = s | 0, f = c | 0, s = r | 0, c = i | 0;
+      const I = Fe(_, y, S);
+      r = tn(I, g, m, E), i = I | 0;
+    }
+    ({ h: r, l: i } = at(this.Ah | 0, this.Al | 0, r | 0, i | 0)), { h: s, l: c } = at(this.Bh | 0, this.Bl | 0, s | 0, c | 0), { h: o, l: f } = at(this.Ch | 0, this.Cl | 0, o | 0, f | 0), { h: u, l: a } = at(this.Dh | 0, this.Dl | 0, u | 0, a | 0), { h: w, l } = at(this.Eh | 0, this.El | 0, w | 0, l | 0), { h: d, l: p } = at(this.Fh | 0, this.Fl | 0, d | 0, p | 0), { h: b, l: h } = at(this.Gh | 0, this.Gl | 0, b | 0, h | 0), { h: x, l: v } = at(this.Hh | 0, this.Hl | 0, x | 0, v | 0), this.set(r, i, s, c, o, f, u, a, w, l, d, p, b, h, x, v);
+  }
+  roundClean() {
+    ft(It, Ot);
+  }
+  destroy() {
+    ft(this.buffer), this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+  }
+}
+const Ee = /* @__PURE__ */ Xn(() => new no()), nn = /* @__PURE__ */ Xn(() => new so());
+function gn(t, e, n, r, i, s) {
+  let c = t[e++] ^ n[r++], o = t[e++] ^ n[r++], f = t[e++] ^ n[r++], u = t[e++] ^ n[r++], a = t[e++] ^ n[r++], w = t[e++] ^ n[r++], l = t[e++] ^ n[r++], d = t[e++] ^ n[r++], p = t[e++] ^ n[r++], b = t[e++] ^ n[r++], h = t[e++] ^ n[r++], x = t[e++] ^ n[r++], v = t[e++] ^ n[r++], A = t[e++] ^ n[r++], L = t[e++] ^ n[r++], B = t[e++] ^ n[r++], R = c, N = o, q = f, g = u, _ = a, m = w, y = l, E = d, S = p, I = b, O = h, H = x, k = v, Z = A, U = L, T = B;
+  for (let M = 0; M < 8; M += 2)
+    _ ^= D(R + k | 0, 7), S ^= D(_ + R | 0, 9), k ^= D(S + _ | 0, 13), R ^= D(k + S | 0, 18), I ^= D(m + N | 0, 7), Z ^= D(I + m | 0, 9), N ^= D(Z + I | 0, 13), m ^= D(N + Z | 0, 18), U ^= D(O + y | 0, 7), q ^= D(U + O | 0, 9), y ^= D(q + U | 0, 13), O ^= D(y + q | 0, 18), g ^= D(T + H | 0, 7), E ^= D(g + T | 0, 9), H ^= D(E + g | 0, 13), T ^= D(H + E | 0, 18), N ^= D(R + g | 0, 7), q ^= D(N + R | 0, 9), g ^= D(q + N | 0, 13), R ^= D(g + q | 0, 18), y ^= D(m + _ | 0, 7), E ^= D(y + m | 0, 9), _ ^= D(E + y | 0, 13), m ^= D(_ + E | 0, 18), H ^= D(O + I | 0, 7), S ^= D(H + O | 0, 9), I ^= D(S + H | 0, 13), O ^= D(I + S | 0, 18), k ^= D(T + U | 0, 7), Z ^= D(k + T | 0, 9), U ^= D(Z + k | 0, 13), T ^= D(U + Z | 0, 18);
+  i[s++] = c + R | 0, i[s++] = o + N | 0, i[s++] = f + q | 0, i[s++] = u + g | 0, i[s++] = a + _ | 0, i[s++] = w + m | 0, i[s++] = l + y | 0, i[s++] = d + E | 0, i[s++] = p + S | 0, i[s++] = b + I | 0, i[s++] = h + O | 0, i[s++] = x + H | 0, i[s++] = v + k | 0, i[s++] = A + Z | 0, i[s++] = L + U | 0, i[s++] = B + T | 0;
+}
+function Ae(t, e, n, r, i) {
+  let s = r + 0, c = r + 16 * i;
+  for (let o = 0; o < 16; o++)
+    n[c + o] = t[e + (2 * i - 1) * 16 + o];
+  for (let o = 0; o < i; o++, s += 16, e += 16)
+    gn(n, c, t, e, n, s), o > 0 && (c += 16), gn(n, s, t, e += 16, n, c);
+}
+function io(t, e, n) {
+  const r = Gn({
+    dkLen: 32,
+    asyncTick: 10,
+    maxmem: 1073742848
+  }, n), { N: i, r: s, p: c, dkLen: o, asyncTick: f, maxmem: u, onProgress: a } = r;
+  if (et(i), et(s), et(c), et(o), et(f), et(u), a !== void 0 && typeof a != "function")
+    throw new Error("progressCb should be function");
+  const w = 128 * s, l = w / 4, d = Math.pow(2, 32);
+  if (i <= 1 || (i & i - 1) !== 0 || i > d)
+    throw new Error("Scrypt: N must be larger than 1, a power of 2, and less than 2^32");
+  if (c < 0 || c > (d - 1) * 32 / w)
+    throw new Error("Scrypt: p must be a positive integer less than or equal to ((2^32 - 1) * 32) / (128 * r)");
+  if (o < 0 || o > (d - 1) * 32)
+    throw new Error("Scrypt: dkLen should be positive integer less than or equal to (2^32 - 1) * 32");
+  if (w * (i + c) > u)
+    throw new Error("Scrypt: memused is bigger than maxMem. Expected 128 * r * (N + p) > maxmem of " + u);
+  const b = Jn(Ee, t, e, { c: 1, dkLen: w * c }), h = Mt(b), x = Mt(new Uint8Array(w * i)), v = Mt(new Uint8Array(w));
+  let A = () => {
+  };
+  if (a) {
+    const L = 2 * i * c, B = Math.max(Math.floor(L / 1e4), 1);
+    let R = 0;
+    A = () => {
+      R++, a && (!(R % B) || R === L) && a(R / L);
+    };
+  }
+  return { N: i, r: s, p: c, dkLen: o, blockSize32: l, V: x, B32: h, B: b, tmp: v, blockMixCb: A, asyncTick: f };
+}
+function co(t, e, n, r, i) {
+  const s = Jn(Ee, t, n, { c: 1, dkLen: e });
+  return ft(n, r, i), s;
+}
+function Ps(t, e, n) {
+  const { N: r, r: i, p: s, dkLen: c, blockSize32: o, V: f, B32: u, B: a, tmp: w, blockMixCb: l } = io(t, e, n);
+  qt(u);
+  for (let d = 0; d < s; d++) {
+    const p = o * d;
+    for (let b = 0; b < o; b++)
+      f[b] = u[p + b];
+    for (let b = 0, h = 0; b < r - 1; b++)
+      Ae(f, h, f, h += o, i), l();
+    Ae(f, (r - 1) * o, u, p, i), l();
+    for (let b = 0; b < r; b++) {
+      const h = u[p + o - 16] % r;
+      for (let x = 0; x < o; x++)
+        w[x] = u[p + x] ^ f[h * o + x];
+      Ae(w, 0, u, p, i), l();
+    }
+  }
+  return qt(u), co(t, c, a, f, w);
+}
+const rn = /* @__PURE__ */ BigInt(0), De = /* @__PURE__ */ BigInt(1);
+function Me(t, e) {
+  if (typeof e != "boolean")
+    throw new Error(t + " boolean expected, got " + e);
+}
+function tr(t) {
+  if (typeof t != "string")
+    throw new Error("hex string expected, got " + typeof t);
+  return t === "" ? rn : BigInt("0x" + t);
+}
+function fo(t) {
+  return tr(ht(t));
+}
+function ce(t) {
+  return W(t), tr(ht(Uint8Array.from(t).reverse()));
+}
+function er(t, e) {
+  return ae(t.toString(16).padStart(e * 2, "0"));
+}
+function fe(t, e) {
+  return er(t, e).reverse();
+}
+function lt(t, e, n) {
+  let r;
+  if (typeof e == "string")
+    try {
+      r = ae(e);
+    } catch (s) {
+      throw new Error(t + " must be hex string or Uint8Array, cause: " + s);
+    }
+  else if (pe(e))
+    r = Uint8Array.from(e);
+  else
+    throw new Error(t + " must be hex string or Uint8Array");
+  const i = r.length;
+  if (typeof n == "number" && i !== n)
+    throw new Error(t + " of length " + n + " expected, got " + i);
+  return r;
+}
+function ao(t, e) {
+  if (t.length !== e.length)
+    return !1;
+  let n = 0;
+  for (let r = 0; r < t.length; r++)
+    n |= t[r] ^ e[r];
+  return n === 0;
+}
+const Ie = (t) => typeof t == "bigint" && rn <= t;
+function lo(t, e, n) {
+  return Ie(t) && Ie(e) && Ie(n) && e <= t && t < n;
+}
+function re(t, e, n, r) {
+  if (!lo(e, n, r))
+    throw new Error("expected valid " + t + ": " + n + " <= n < " + r + ", got " + e);
+}
+function uo(t) {
+  let e;
+  for (e = 0; t > rn; t >>= De, e += 1)
+    ;
+  return e;
+}
+const on = (t) => (De << BigInt(t)) - De;
+function sn(t, e, n = {}) {
+  if (!t || typeof t != "object")
+    throw new Error("expected valid options object");
+  function r(i, s, c) {
+    const o = t[i];
+    if (c && o === void 0)
+      return;
+    const f = typeof o;
+    if (f !== s || o === null)
+      throw new Error(`param "${i}" is invalid: expected ${s}, got ${f}`);
+  }
+  Object.entries(e).forEach(([i, s]) => r(i, s, !1)), Object.entries(n).forEach(([i, s]) => r(i, s, !0));
+}
+function xn(t) {
+  const e = /* @__PURE__ */ new WeakMap();
+  return (n, ...r) => {
+    const i = e.get(n);
+    if (i !== void 0)
+      return i;
+    const s = t(n, ...r);
+    return e.set(n, s), s;
+  };
+}
+const st = BigInt(0), ot = BigInt(1), Ut = /* @__PURE__ */ BigInt(2), nr = /* @__PURE__ */ BigInt(3), rr = /* @__PURE__ */ BigInt(4), or = /* @__PURE__ */ BigInt(5), ho = /* @__PURE__ */ BigInt(7), sr = /* @__PURE__ */ BigInt(8), wo = /* @__PURE__ */ BigInt(9), ir = /* @__PURE__ */ BigInt(16);
+function P(t, e) {
+  const n = t % e;
+  return n >= st ? n : e + n;
+}
+function mt(t, e, n) {
+  let r = t;
+  for (; e-- > st; )
+    r *= r, r %= n;
+  return r;
+}
+function pn(t, e) {
+  if (t === st)
+    throw new Error("invert: expected non-zero number");
+  if (e <= st)
+    throw new Error("invert: expected positive modulus, got " + e);
+  let n = P(t, e), r = e, i = st, s = ot;
+  for (; n !== st; ) {
+    const o = r / n, f = r % n, u = i - s * o;
+    r = n, n = f, i = s, s = u;
+  }
+  if (r !== ot)
+    throw new Error("invert: does not exist");
+  return P(i, e);
+}
+function cn(t, e, n) {
+  if (!t.eql(t.sqr(e), n))
+    throw new Error("Cannot find square root");
+}
+function cr(t, e) {
+  const n = (t.ORDER + ot) / rr, r = t.pow(e, n);
+  return cn(t, r, e), r;
+}
+function mo(t, e) {
+  const n = (t.ORDER - or) / sr, r = t.mul(e, Ut), i = t.pow(r, n), s = t.mul(e, i), c = t.mul(t.mul(s, Ut), i), o = t.mul(s, t.sub(c, t.ONE));
+  return cn(t, o, e), o;
+}
+function bo(t) {
+  const e = Jt(t), n = fr(t), r = n(e, e.neg(e.ONE)), i = n(e, r), s = n(e, e.neg(r)), c = (t + ho) / ir;
+  return (o, f) => {
+    let u = o.pow(f, c), a = o.mul(u, r);
+    const w = o.mul(u, i), l = o.mul(u, s), d = o.eql(o.sqr(a), f), p = o.eql(o.sqr(w), f);
+    u = o.cmov(u, a, d), a = o.cmov(l, w, p);
+    const b = o.eql(o.sqr(a), f), h = o.cmov(u, a, b);
+    return cn(o, h, f), h;
+  };
+}
+function fr(t) {
+  if (t < nr)
+    throw new Error("sqrt is not defined for small field");
+  let e = t - ot, n = 0;
+  for (; e % Ut === st; )
+    e /= Ut, n++;
+  let r = Ut;
+  const i = Jt(t);
+  for (; En(i, r) === 1; )
+    if (r++ > 1e3)
+      throw new Error("Cannot find square root: probably non-prime P");
+  if (n === 1)
+    return cr;
+  let s = i.pow(r, e);
+  const c = (e + ot) / Ut;
+  return function(f, u) {
+    if (f.is0(u))
+      return u;
+    if (En(f, u) !== 1)
+      throw new Error("Cannot find square root");
+    let a = n, w = f.mul(f.ONE, s), l = f.pow(u, e), d = f.pow(u, c);
+    for (; !f.eql(l, f.ONE); ) {
+      if (f.is0(l))
+        return f.ZERO;
+      let p = 1, b = f.sqr(l);
+      for (; !f.eql(b, f.ONE); )
+        if (p++, b = f.sqr(b), p === a)
+          throw new Error("Cannot find square root");
+      const h = ot << BigInt(a - p - 1), x = f.pow(w, h);
+      a = p, w = f.sqr(x), l = f.mul(l, w), d = f.mul(d, x);
+    }
+    return d;
+  };
+}
+function yo(t) {
+  return t % rr === nr ? cr : t % sr === or ? mo : t % ir === wo ? bo(t) : fr(t);
+}
+const Nt = (t, e) => (P(t, e) & ot) === ot, go = [
+  "create",
+  "isValid",
+  "is0",
+  "neg",
+  "inv",
+  "sqrt",
+  "sqr",
+  "eql",
+  "add",
+  "sub",
+  "mul",
+  "pow",
+  "div",
+  "addN",
+  "subN",
+  "mulN",
+  "sqrN"
+];
+function xo(t) {
+  const e = {
+    ORDER: "bigint",
+    MASK: "bigint",
+    BYTES: "number",
+    BITS: "number"
+  }, n = go.reduce((r, i) => (r[i] = "function", r), e);
+  return sn(t, n), t;
+}
+function po(t, e, n) {
+  if (n < st)
+    throw new Error("invalid exponent, negatives unsupported");
+  if (n === st)
+    return t.ONE;
+  if (n === ot)
+    return e;
+  let r = t.ONE, i = e;
+  for (; n > st; )
+    n & ot && (r = t.mul(r, i)), i = t.sqr(i), n >>= ot;
+  return r;
+}
+function ar(t, e, n = !1) {
+  const r = new Array(e.length).fill(n ? t.ZERO : void 0), i = e.reduce((c, o, f) => t.is0(o) ? c : (r[f] = c, t.mul(c, o)), t.ONE), s = t.inv(i);
+  return e.reduceRight((c, o, f) => t.is0(o) ? c : (r[f] = t.mul(c, r[f]), t.mul(c, o)), s), r;
+}
+function En(t, e) {
+  const n = (t.ORDER - ot) / Ut, r = t.pow(e, n), i = t.eql(r, t.ONE), s = t.eql(r, t.ZERO), c = t.eql(r, t.neg(t.ONE));
+  if (!i && !s && !c)
+    throw new Error("invalid Legendre symbol result");
+  return i ? 1 : s ? 0 : -1;
+}
+function Eo(t, e) {
+  e !== void 0 && et(e);
+  const n = e !== void 0 ? e : t.toString(2).length, r = Math.ceil(n / 8);
+  return { nBitLength: n, nByteLength: r };
+}
+function Jt(t, e, n = !1, r = {}) {
+  if (t <= st)
+    throw new Error("invalid field: expected ORDER > 0, got " + t);
+  let i, s, c = !1, o;
+  if (typeof e == "object" && e != null) {
+    if (r.sqrt || n)
+      throw new Error("cannot specify opts in two arguments");
+    const l = e;
+    l.BITS && (i = l.BITS), l.sqrt && (s = l.sqrt), typeof l.isLE == "boolean" && (n = l.isLE), typeof l.modOnDecode == "boolean" && (c = l.modOnDecode), o = l.allowedLengths;
+  } else
+    typeof e == "number" && (i = e), r.sqrt && (s = r.sqrt);
+  const { nBitLength: f, nByteLength: u } = Eo(t, i);
+  if (u > 2048)
+    throw new Error("invalid field: expected ORDER of <= 2048 bytes");
+  let a;
+  const w = Object.freeze({
+    ORDER: t,
+    isLE: n,
+    BITS: f,
+    BYTES: u,
+    MASK: on(f),
+    ZERO: st,
+    ONE: ot,
+    allowedLengths: o,
+    create: (l) => P(l, t),
+    isValid: (l) => {
+      if (typeof l != "bigint")
+        throw new Error("invalid field element: expected bigint, got " + typeof l);
+      return st <= l && l < t;
+    },
+    is0: (l) => l === st,
+    // is valid and invertible
+    isValidNot0: (l) => !w.is0(l) && w.isValid(l),
+    isOdd: (l) => (l & ot) === ot,
+    neg: (l) => P(-l, t),
+    eql: (l, d) => l === d,
+    sqr: (l) => P(l * l, t),
+    add: (l, d) => P(l + d, t),
+    sub: (l, d) => P(l - d, t),
+    mul: (l, d) => P(l * d, t),
+    pow: (l, d) => po(w, l, d),
+    div: (l, d) => P(l * pn(d, t), t),
+    // Same as above, but doesn't normalize
+    sqrN: (l) => l * l,
+    addN: (l, d) => l + d,
+    subN: (l, d) => l - d,
+    mulN: (l, d) => l * d,
+    inv: (l) => pn(l, t),
+    sqrt: s || ((l) => (a || (a = yo(t)), a(w, l))),
+    toBytes: (l) => n ? fe(l, u) : er(l, u),
+    fromBytes: (l, d = !0) => {
+      if (o) {
+        if (!o.includes(l.length) || l.length > u)
+          throw new Error("Field.fromBytes: expected " + o + " bytes, got " + l.length);
+        const b = new Uint8Array(u);
+        b.set(l, n ? 0 : b.length - l.length), l = b;
+      }
+      if (l.length !== u)
+        throw new Error("Field.fromBytes: expected " + u + " bytes, got " + l.length);
+      let p = n ? ce(l) : fo(l);
+      if (c && (p = P(p, t)), !d && !w.isValid(p))
+        throw new Error("invalid field element: outside of range 0..ORDER");
+      return p;
+    },
+    // TODO: we don't need it here, move out to separate fn
+    invertBatch: (l) => ar(w, l),
+    // We can't move this out because Fp6, Fp12 implement it
+    // and it's unclear what to return in there.
+    cmov: (l, d, p) => p ? d : l
+  });
+  return Object.freeze(w);
+}
+const ye = BigInt(0), Ce = BigInt(1);
+function Bn(t, e) {
+  const n = e.negate();
+  return t ? n : e;
+}
+function he(t, e) {
+  const n = ar(t.Fp, e.map((r) => r.Z));
+  return e.map((r, i) => t.fromAffine(r.toAffine(n[i])));
+}
+function lr(t, e) {
+  if (!Number.isSafeInteger(t) || t <= 0 || t > e)
+    throw new Error("invalid window size, expected [1.." + e + "], got W=" + t);
+}
+function Oe(t, e) {
+  lr(t, e);
+  const n = Math.ceil(e / t) + 1, r = 2 ** (t - 1), i = 2 ** t, s = on(t), c = BigInt(t);
+  return { windows: n, windowSize: r, mask: s, maxNumber: i, shiftBy: c };
+}
+function _n(t, e, n) {
+  const { windowSize: r, mask: i, maxNumber: s, shiftBy: c } = n;
+  let o = Number(t & i), f = t >> c;
+  o > r && (o -= s, f += Ce);
+  const u = e * r, a = u + Math.abs(o) - 1, w = o === 0, l = o < 0, d = e % 2 !== 0;
+  return { nextN: f, offset: a, isZero: w, isNeg: l, isNegF: d, offsetF: u };
+}
+function Bo(t, e) {
+  if (!Array.isArray(t))
+    throw new Error("array expected");
+  t.forEach((n, r) => {
+    if (!(n instanceof e))
+      throw new Error("invalid point at index " + r);
+  });
+}
+function _o(t, e) {
+  if (!Array.isArray(t))
+    throw new Error("array of scalars expected");
+  t.forEach((n, r) => {
+    if (!e.isValid(n))
+      throw new Error("invalid scalar at index " + r);
+  });
+}
+const qe = /* @__PURE__ */ new WeakMap(), ur = /* @__PURE__ */ new WeakMap();
+function Re(t) {
+  return ur.get(t) || 1;
+}
+function vn(t) {
+  if (t !== ye)
+    throw new Error("invalid wNAF");
+}
+let vo = class {
+  // Parametrized with a given Point class (not individual point)
+  constructor(e, n) {
+    this.BASE = e.BASE, this.ZERO = e.ZERO, this.Fn = e.Fn, this.bits = n;
+  }
+  // non-const time multiplication ladder
+  _unsafeLadder(e, n, r = this.ZERO) {
+    let i = e;
+    for (; n > ye; )
+      n & Ce && (r = r.add(i)), i = i.double(), n >>= Ce;
+    return r;
+  }
+  /**
+   * Creates a wNAF precomputation window. Used for caching.
+   * Default window size is set by `utils.precompute()` and is equal to 8.
+   * Number of precomputed points depends on the curve size:
+   * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+   * - 𝑊 is the window size
+   * - 𝑛 is the bitlength of the curve order.
+   * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+   * @param point Point instance
+   * @param W window size
+   * @returns precomputed point tables flattened to a single array
+   */
+  precomputeWindow(e, n) {
+    const { windows: r, windowSize: i } = Oe(n, this.bits), s = [];
+    let c = e, o = c;
+    for (let f = 0; f < r; f++) {
+      o = c, s.push(o);
+      for (let u = 1; u < i; u++)
+        o = o.add(c), s.push(o);
+      c = o.double();
+    }
+    return s;
+  }
+  /**
+   * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
+   * More compact implementation:
+   * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541
+   * @returns real and fake (for const-time) points
+   */
+  wNAF(e, n, r) {
+    if (!this.Fn.isValid(r))
+      throw new Error("invalid scalar");
+    let i = this.ZERO, s = this.BASE;
+    const c = Oe(e, this.bits);
+    for (let o = 0; o < c.windows; o++) {
+      const { nextN: f, offset: u, isZero: a, isNeg: w, isNegF: l, offsetF: d } = _n(r, o, c);
+      r = f, a ? s = s.add(Bn(l, n[d])) : i = i.add(Bn(w, n[u]));
+    }
+    return vn(r), { p: i, f: s };
+  }
+  /**
+   * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.
+   * @param acc accumulator point to add result of multiplication
+   * @returns point
+   */
+  wNAFUnsafe(e, n, r, i = this.ZERO) {
+    const s = Oe(e, this.bits);
+    for (let c = 0; c < s.windows && r !== ye; c++) {
+      const { nextN: o, offset: f, isZero: u, isNeg: a } = _n(r, c, s);
+      if (r = o, !u) {
+        const w = n[f];
+        i = i.add(a ? w.negate() : w);
+      }
+    }
+    return vn(r), i;
+  }
+  getPrecomputes(e, n, r) {
+    let i = qe.get(n);
+    return i || (i = this.precomputeWindow(n, e), e !== 1 && (typeof r == "function" && (i = r(i)), qe.set(n, i))), i;
+  }
+  cached(e, n, r) {
+    const i = Re(e);
+    return this.wNAF(i, this.getPrecomputes(i, e, r), n);
+  }
+  unsafe(e, n, r, i) {
+    const s = Re(e);
+    return s === 1 ? this._unsafeLadder(e, n, i) : this.wNAFUnsafe(s, this.getPrecomputes(s, e, r), n, i);
+  }
+  // We calculate precomputes for elliptic curve point multiplication
+  // using windowed method. This specifies window size and
+  // stores precomputed values. Usually only base point would be precomputed.
+  createCache(e, n) {
+    lr(n, this.bits), ur.set(e, n), qe.delete(e);
+  }
+  hasCache(e) {
+    return Re(e) !== 1;
+  }
+};
+function dr(t, e, n, r) {
+  Bo(n, t), _o(r, e);
+  const i = n.length, s = r.length;
+  if (i !== s)
+    throw new Error("arrays of points and scalars must have equal length");
+  const c = t.ZERO, o = uo(BigInt(i));
+  let f = 1;
+  o > 12 ? f = o - 3 : o > 4 ? f = o - 2 : o > 0 && (f = 2);
+  const u = on(f), a = new Array(Number(u) + 1).fill(c), w = Math.floor((e.BITS - 1) / f) * f;
+  let l = c;
+  for (let d = w; d >= 0; d -= f) {
+    a.fill(c);
+    for (let b = 0; b < s; b++) {
+      const h = r[b], x = Number(h >> BigInt(d) & u);
+      a[x] = a[x].add(n[b]);
+    }
+    let p = c;
+    for (let b = a.length - 1, h = c; b > 0; b--)
+      h = h.add(a[b]), p = p.add(h);
+    if (l = l.add(p), d !== 0)
+      for (let b = 0; b < f; b++)
+        l = l.double();
+  }
+  return l;
+}
+function Sn(t, e) {
+  if (e) {
+    if (e.ORDER !== t)
+      throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
+    return xo(e), e;
+  } else
+    return Jt(t);
+}
+function So(t, e, n = {}) {
+  if (!e || typeof e != "object")
+    throw new Error(`expected valid ${t} CURVE object`);
+  for (const o of ["p", "n", "h"]) {
+    const f = e[o];
+    if (!(typeof f == "bigint" && f > ye))
+      throw new Error(`CURVE.${o} must be positive bigint`);
+  }
+  const r = Sn(e.p, n.Fp), i = Sn(e.n, n.Fn), c = ["Gx", "Gy", "a", "d"];
+  for (const o of c)
+    if (!r.isValid(e[o]))
+      throw new Error(`CURVE.${o} must be valid field element of CURVE.Fp`);
+  return { Fp: r, Fn: i };
+}
+const bt = BigInt(0), X = BigInt(1), Le = BigInt(2), Ao = BigInt(8);
+function Io(t, e, n, r) {
+  const i = t.sqr(n), s = t.sqr(r), c = t.add(t.mul(e.a, i), s), o = t.add(t.ONE, t.mul(e.d, t.mul(i, s)));
+  return t.eql(c, o);
+}
+function Oo(t, e = {}) {
+  const { Fp: n, Fn: r } = So("edwards", t, e), { h: i, n: s } = t;
+  sn(e, {}, { uvRatio: "function" });
+  const c = Le << BigInt(r.BYTES * 8) - X, o = (b) => n.create(b), f = e.uvRatio || ((b, h) => {
+    try {
+      return { isValid: !0, value: n.sqrt(n.div(b, h)) };
+    } catch {
+      return { isValid: !1, value: bt };
+    }
+  });
+  if (!Io(n, t, t.Gx, t.Gy))
+    throw new Error("bad curve params: generator point");
+  function u(b, h, x = !1) {
+    const v = x ? X : bt;
+    return re("coordinate " + b, h, v, c), h;
+  }
+  function a(b) {
+    if (!(b instanceof d))
+      throw new Error("ExtendedPoint expected");
+  }
+  const w = xn((b, h) => {
+    const { X: x, Y: v, Z: A } = b, L = b.is0();
+    h == null && (h = L ? Ao : n.inv(A));
+    const B = o(x * h), R = o(v * h), N = n.mul(A, h);
+    if (L)
+      return { x: bt, y: X };
+    if (N !== X)
+      throw new Error("invZ was invalid");
+    return { x: B, y: R };
+  }), l = xn((b) => {
+    const { a: h, d: x } = t;
+    if (b.is0())
+      throw new Error("bad point: ZERO");
+    const { X: v, Y: A, Z: L, T: B } = b, R = o(v * v), N = o(A * A), q = o(L * L), g = o(q * q), _ = o(R * h), m = o(q * o(_ + N)), y = o(g + o(x * o(R * N)));
+    if (m !== y)
+      throw new Error("bad point: equation left != right (1)");
+    const E = o(v * A), S = o(L * B);
+    if (E !== S)
+      throw new Error("bad point: equation left != right (2)");
+    return !0;
+  });
+  class d {
+    constructor(h, x, v, A) {
+      this.X = u("x", h), this.Y = u("y", x), this.Z = u("z", v, !0), this.T = u("t", A), Object.freeze(this);
+    }
+    get x() {
+      return this.toAffine().x;
+    }
+    get y() {
+      return this.toAffine().y;
+    }
+    // TODO: remove
+    get ex() {
+      return this.X;
+    }
+    get ey() {
+      return this.Y;
+    }
+    get ez() {
+      return this.Z;
+    }
+    get et() {
+      return this.T;
+    }
+    static normalizeZ(h) {
+      return he(d, h);
+    }
+    static msm(h, x) {
+      return dr(d, r, h, x);
+    }
+    _setWindowSize(h) {
+      this.precompute(h);
+    }
+    static fromAffine(h) {
+      if (h instanceof d)
+        throw new Error("extended point not allowed");
+      const { x, y: v } = h || {};
+      return u("x", x), u("y", v), new d(x, v, X, o(x * v));
+    }
+    precompute(h = 8, x = !0) {
+      return p.createCache(this, h), x || this.multiply(Le), this;
+    }
+    // Useful in fromAffine() - not for fromBytes(), which always created valid points.
+    assertValidity() {
+      l(this);
+    }
+    // Compare one point to another.
+    equals(h) {
+      a(h);
+      const { X: x, Y: v, Z: A } = this, { X: L, Y: B, Z: R } = h, N = o(x * R), q = o(L * A), g = o(v * R), _ = o(B * A);
+      return N === q && g === _;
+    }
+    is0() {
+      return this.equals(d.ZERO);
+    }
+    negate() {
+      return new d(o(-this.X), this.Y, this.Z, o(-this.T));
+    }
+    // Fast algo for doubling Extended Point.
+    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
+    // Cost: 4M + 4S + 1*a + 6add + 1*2.
+    double() {
+      const { a: h } = t, { X: x, Y: v, Z: A } = this, L = o(x * x), B = o(v * v), R = o(Le * o(A * A)), N = o(h * L), q = x + v, g = o(o(q * q) - L - B), _ = N + B, m = _ - R, y = N - B, E = o(g * m), S = o(_ * y), I = o(g * y), O = o(m * _);
+      return new d(E, S, O, I);
+    }
+    // Fast algo for adding 2 Extended Points.
+    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
+    // Cost: 9M + 1*a + 1*d + 7add.
+    add(h) {
+      a(h);
+      const { a: x, d: v } = t, { X: A, Y: L, Z: B, T: R } = this, { X: N, Y: q, Z: g, T: _ } = h, m = o(A * N), y = o(L * q), E = o(R * v * _), S = o(B * g), I = o((A + L) * (N + q) - m - y), O = S - E, H = S + E, k = o(y - x * m), Z = o(I * O), U = o(H * k), T = o(I * k), M = o(O * H);
+      return new d(Z, U, M, T);
+    }
+    subtract(h) {
+      return this.add(h.negate());
+    }
+    // Constant-time multiplication.
+    multiply(h) {
+      const x = h;
+      re("scalar", x, X, s);
+      const { p: v, f: A } = p.cached(this, x, (L) => he(d, L));
+      return he(d, [v, A])[0];
+    }
+    // Non-constant-time multiplication. Uses double-and-add algorithm.
+    // It's faster, but should only be used when you don't care about
+    // an exposed private key e.g. sig verification.
+    // Does NOT allow scalars higher than CURVE.n.
+    // Accepts optional accumulator to merge with multiply (important for sparse scalars)
+    multiplyUnsafe(h, x = d.ZERO) {
+      const v = h;
+      return re("scalar", v, bt, s), v === bt ? d.ZERO : this.is0() || v === X ? this : p.unsafe(this, v, (A) => he(d, A), x);
+    }
+    // Checks if point is of small order.
+    // If you add something to small order point, you will have "dirty"
+    // point with torsion component.
+    // Multiplies point by cofactor and checks if the result is 0.
+    isSmallOrder() {
+      return this.multiplyUnsafe(i).is0();
+    }
+    // Multiplies point by curve order and checks if the result is 0.
+    // Returns `false` is the point is dirty.
+    isTorsionFree() {
+      return p.unsafe(this, s).is0();
+    }
+    // Converts Extended point to default (x, y) coordinates.
+    // Can accept precomputed Z^-1 - for example, from invertBatch.
+    toAffine(h) {
+      return w(this, h);
+    }
+    clearCofactor() {
+      return i === X ? this : this.multiplyUnsafe(i);
+    }
+    static fromBytes(h, x = !1) {
+      return W(h), d.fromHex(h, x);
+    }
+    // Converts hash string or Uint8Array to Point.
+    // Uses algo from RFC8032 5.1.3.
+    static fromHex(h, x = !1) {
+      const { d: v, a: A } = t, L = n.BYTES;
+      h = lt("pointHex", h, L), Me("zip215", x);
+      const B = h.slice(), R = h[L - 1];
+      B[L - 1] = R & -129;
+      const N = ce(B), q = x ? c : n.ORDER;
+      re("pointHex.y", N, bt, q);
+      const g = o(N * N), _ = o(g - X), m = o(v * g - A);
+      let { isValid: y, value: E } = f(_, m);
+      if (!y)
+        throw new Error("Point.fromHex: invalid y coordinate");
+      const S = (E & X) === X, I = (R & 128) !== 0;
+      if (!x && E === bt && I)
+        throw new Error("Point.fromHex: x=0 and x_0=1");
+      return I !== S && (E = o(-E)), d.fromAffine({ x: E, y: N });
+    }
+    toBytes() {
+      const { x: h, y: x } = this.toAffine(), v = fe(x, n.BYTES);
+      return v[v.length - 1] |= h & X ? 128 : 0, v;
+    }
+    /** @deprecated use `toBytes` */
+    toRawBytes() {
+      return this.toBytes();
+    }
+    toHex() {
+      return ht(this.toBytes());
+    }
+    toString() {
+      return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
+    }
+  }
+  d.BASE = new d(t.Gx, t.Gy, X, o(t.Gx * t.Gy)), d.ZERO = new d(bt, X, X, bt), d.Fp = n, d.Fn = r;
+  const p = new vo(d, r.BYTES * 8);
+  return d;
+}
+class qo {
+  constructor(e) {
+    this.ep = e;
+  }
+  // Static methods that must be implemented by subclasses
+  static fromBytes(e) {
+    throw new Error("fromBytes must be implemented by subclass");
+  }
+  static fromHex(e) {
+    throw new Error("fromHex must be implemented by subclass");
+  }
+  get x() {
+    return this.toAffine().x;
+  }
+  get y() {
+    return this.toAffine().y;
+  }
+  // Common implementations
+  clearCofactor() {
+    return this;
+  }
+  assertValidity() {
+    this.ep.assertValidity();
+  }
+  toAffine(e) {
+    return this.ep.toAffine(e);
+  }
+  /** @deprecated use `toBytes` */
+  toRawBytes() {
+    return this.toBytes();
+  }
+  toHex() {
+    return ht(this.toBytes());
+  }
+  toString() {
+    return this.toHex();
+  }
+  isTorsionFree() {
+    return !0;
+  }
+  isSmallOrder() {
+    return !1;
+  }
+  add(e) {
+    return this.assertSame(e), this.init(this.ep.add(e.ep));
+  }
+  subtract(e) {
+    return this.assertSame(e), this.init(this.ep.subtract(e.ep));
+  }
+  multiply(e) {
+    return this.init(this.ep.multiply(e));
+  }
+  multiplyUnsafe(e) {
+    return this.init(this.ep.multiplyUnsafe(e));
+  }
+  double() {
+    return this.init(this.ep.double());
+  }
+  negate() {
+    return this.init(this.ep.negate());
+  }
+  precompute(e, n) {
+    return this.init(this.ep.precompute(e, n));
+  }
+}
+function Ro(t, e, n) {
+  if (typeof e != "function")
+    throw new Error('"hash" function param is required');
+  sn(n, {}, {
+    adjustScalarBytes: "function",
+    randomBytes: "function",
+    domain: "function",
+    prehash: "function",
+    mapToCurve: "function"
+  });
+  const { prehash: r } = n, { BASE: i, Fp: s, Fn: c } = t, o = c.ORDER, f = n.randomBytes || Je, u = n.adjustScalarBytes || ((m) => m), a = n.domain || ((m, y, E) => {
+    if (Me("phflag", E), y.length || E)
+      throw new Error("Contexts/pre-hash are not supported");
+    return m;
+  });
+  function w(m) {
+    return c.create(m);
+  }
+  function l(m) {
+    return w(ce(m));
+  }
+  function d(m) {
+    const y = s.BYTES;
+    m = lt("private key", m, y);
+    const E = lt("hashed private key", e(m), 2 * y), S = u(E.slice(0, y)), I = E.slice(y, 2 * y), O = l(S);
+    return { head: S, prefix: I, scalar: O };
+  }
+  function p(m) {
+    const { head: y, prefix: E, scalar: S } = d(m), I = i.multiply(S), O = I.toBytes();
+    return { head: y, prefix: E, scalar: S, point: I, pointBytes: O };
+  }
+  function b(m) {
+    return p(m).pointBytes;
+  }
+  function h(m = Uint8Array.of(), ...y) {
+    const E = ut(...y);
+    return l(e(a(E, lt("context", m), !!r)));
+  }
+  function x(m, y, E = {}) {
+    m = lt("message", m), r && (m = r(m));
+    const { prefix: S, scalar: I, pointBytes: O } = p(y), H = h(E.context, S, m), k = i.multiply(H).toBytes(), Z = h(E.context, k, O, m), U = w(H + Z * I);
+    re("signature.s", U, bt, o);
+    const T = s.BYTES, M = ut(k, fe(U, T));
+    return lt("result", M, T * 2);
+  }
+  const v = { zip215: !0 };
+  function A(m, y, E, S = v) {
+    const { context: I, zip215: O } = S, H = s.BYTES;
+    m = lt("signature", m, 2 * H), y = lt("message", y), E = lt("publicKey", E, H), O !== void 0 && Me("zip215", O), r && (y = r(y));
+    const k = ce(m.slice(H, 2 * H));
+    let Z, U, T;
+    try {
+      Z = t.fromHex(E, O), U = t.fromHex(m.slice(0, H), O), T = i.multiplyUnsafe(k);
+    } catch {
+      return !1;
+    }
+    if (!O && Z.isSmallOrder())
+      return !1;
+    const M = h(I, U.toBytes(), Z.toBytes(), y);
+    return U.add(Z.multiplyUnsafe(M)).subtract(T).clearCofactor().is0();
+  }
+  i.precompute(8);
+  const L = s.BYTES, B = {
+    secret: L,
+    public: L,
+    signature: 2 * L,
+    seed: L
+  };
+  function R(m = f(B.seed)) {
+    return m;
+  }
+  const N = {
+    getExtendedPublicKey: p,
+    /** ed25519 priv keys are uniform 32b. No need to check for modulo bias, like in secp256k1. */
+    randomSecretKey: R,
+    isValidSecretKey: g,
+    isValidPublicKey: _,
+    randomPrivateKey: R,
+    /**
+     * Converts ed public key to x public key. Uses formula:
+     * - ed25519:
+     *   - `(u, v) = ((1+y)/(1-y), sqrt(-486664)*u/x)`
+     *   - `(x, y) = (sqrt(-486664)*u/v, (u-1)/(u+1))`
+     * - ed448:
+     *   - `(u, v) = ((y-1)/(y+1), sqrt(156324)*u/x)`
+     *   - `(x, y) = (sqrt(156324)*u/v, (1+u)/(1-u))`
+     *
+     * There is NO `fromMontgomery`:
+     * - There are 2 valid ed25519 points for every x25519, with flipped coordinate
+     * - Sometimes there are 0 valid ed25519 points, because x25519 *additionally*
+     *   accepts inputs on the quadratic twist, which can't be moved to ed25519
+     */
+    toMontgomery(m) {
+      const { y } = t.fromBytes(m), E = L === 32;
+      if (!E && L !== 57)
+        throw new Error("only defined for 25519 and 448");
+      const S = E ? s.div(X + y, X - y) : s.div(y - X, y + X);
+      return s.toBytes(S);
+    },
+    toMontgomeryPriv(m) {
+      W(m, L);
+      const y = e(m.subarray(0, L));
+      return u(y).subarray(0, L);
+    },
+    /**
+     * We're doing scalar multiplication (used in getPublicKey etc) with precomputed BASE_POINT
+     * values. This slows down first getPublicKey() by milliseconds (see Speed section),
+     * but allows to speed-up subsequent getPublicKey() calls up to 20x.
+     * @param windowSize 2, 4, 8, 16
+     */
+    precompute(m = 8, y = t.BASE) {
+      return y.precompute(m, !1);
+    }
+  };
+  function q(m) {
+    const y = N.randomSecretKey(m);
+    return { secretKey: y, publicKey: b(y) };
+  }
+  function g(m) {
+    try {
+      return !!c.fromBytes(m, !1);
+    } catch {
+      return !1;
+    }
+  }
+  function _(m, y) {
+    try {
+      return !!t.fromBytes(m, y);
+    } catch {
+      return !1;
+    }
+  }
+  return Object.freeze({
+    keygen: q,
+    getPublicKey: b,
+    sign: x,
+    verify: A,
+    utils: N,
+    Point: t,
+    info: { type: "edwards", lengths: B }
+  });
+}
+function Lo(t) {
+  const e = {
+    a: t.a,
+    d: t.d,
+    p: t.Fp.ORDER,
+    n: t.n,
+    h: t.h,
+    Gx: t.Gx,
+    Gy: t.Gy
+  }, n = t.Fp, r = Jt(e.n, t.nBitLength, !0), i = { Fp: n, Fn: r, uvRatio: t.uvRatio }, s = {
+    randomBytes: t.randomBytes,
+    adjustScalarBytes: t.adjustScalarBytes,
+    domain: t.domain,
+    prehash: t.prehash,
+    mapToCurve: t.mapToCurve
+  };
+  return { CURVE: e, curveOpts: i, hash: t.hash, eddsaOpts: s };
+}
+function No(t, e) {
+  return Object.assign({}, e, { ExtendedPoint: e.Point, CURVE: t });
+}
+function $o(t) {
+  const { CURVE: e, curveOpts: n, hash: r, eddsaOpts: i } = Lo(t), s = Oo(e, n), c = Ro(s, r, i);
+  return No(t, c);
+}
+const Qs = We("HashToScalar-");
+const Js = BigInt(0), Fs = BigInt(1), ti = BigInt(2);
+const Ho = BigInt(0), Et = BigInt(1), An = BigInt(2), ei = BigInt(3), ko = BigInt(5), To = BigInt(8), le = {
+  p: BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed"),
+  n: BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),
+  h: To,
+  a: BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),
+  d: BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),
+  Gx: BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),
+  Gy: BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")
+};
+function Uo(t) {
+  const e = BigInt(10), n = BigInt(20), r = BigInt(40), i = BigInt(80), s = le.p, o = t * t % s * t % s, f = mt(o, An, s) * o % s, u = mt(f, Et, s) * t % s, a = mt(u, ko, s) * u % s, w = mt(a, e, s) * a % s, l = mt(w, n, s) * w % s, d = mt(l, r, s) * l % s, p = mt(d, i, s) * d % s, b = mt(p, i, s) * d % s, h = mt(b, e, s) * a % s;
+  return { pow_p_5_8: mt(h, An, s) * t % s, b2: o };
+}
+function Zo(t) {
+  return t[0] &= 248, t[31] &= 127, t[31] |= 64, t;
+}
+const ze = /* @__PURE__ */ BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");
+function fn(t, e) {
+  const n = le.p, r = P(e * e * e, n), i = P(r * r * e, n), s = Uo(t * i).pow_p_5_8;
+  let c = P(t * r * s, n);
+  const o = P(e * c * c, n), f = c, u = P(c * ze, n), a = o === t, w = o === P(-t, n), l = o === P(-t * ze, n);
+  return a && (c = f), (w || l) && (c = u), Nt(c, n) && (c = P(-c, n)), { isValid: a || w, value: c };
+}
+const Tt = Jt(le.p, { isLE: !0 }), Do = Jt(le.n, { isLE: !0 }), Mo = {
+  ...le,
+  Fp: Tt,
+  hash: nn,
+  adjustScalarBytes: Zo,
+  // dom2
+  // Ratio of u to v. Allows us to combine inversion and square root. Uses algo from RFC8032 5.1.3.
+  // Constant-time, u/√v
+  uvRatio: fn
+}, dt = $o(Mo);
+const je = ze, Co = /* @__PURE__ */ BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235"), zo = /* @__PURE__ */ BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578"), jo = /* @__PURE__ */ BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838"), Vo = /* @__PURE__ */ BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952"), In = (t) => fn(Et, t), Yo = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"), Ve = (t) => dt.CURVE.Fp.create(ce(t) & Yo);
+function On(t) {
+  const { d: e } = dt.CURVE, n = dt.CURVE.Fp.ORDER, r = dt.CURVE.Fp.create, i = r(je * t * t), s = r((i + Et) * jo);
+  let c = BigInt(-1);
+  const o = r((c - e * i) * r(i + e));
+  let { isValid: f, value: u } = fn(s, o), a = r(u * t);
+  Nt(a, n) || (a = r(-a)), f || (u = a), f || (c = i);
+  const w = r(c * (i - Et) * Vo - o), l = u * u, d = r((u + u) * o), p = r(w * Co), b = r(Et - l), h = r(Et + l);
+  return new dt.Point(r(d * h), r(b * p), r(p * h), r(d * b));
+}
+function Go(t) {
+  W(t, 64);
+  const e = Ve(t.subarray(0, 32)), n = On(e), r = Ve(t.subarray(32, 64)), i = On(r);
+  return new tt(n.add(i));
+}
+class tt extends qo {
+  constructor(e) {
+    super(e);
+  }
+  static fromAffine(e) {
+    return new tt(dt.Point.fromAffine(e));
+  }
+  assertSame(e) {
+    if (!(e instanceof tt))
+      throw new Error("RistrettoPoint expected");
+  }
+  init(e) {
+    return new tt(e);
+  }
+  /** @deprecated use `import { ristretto255_hasher } from '@noble/curves/ed25519.js';` */
+  static hashToCurve(e) {
+    return Go(lt("ristrettoHash", e, 64));
+  }
+  static fromBytes(e) {
+    W(e, 32);
+    const { a: n, d: r } = dt.CURVE, i = Tt.ORDER, s = Tt.create, c = Ve(e);
+    if (!ao(fe(c, 32), e) || Nt(c, i))
+      throw new Error("invalid ristretto255 encoding 1");
+    const o = s(c * c), f = s(Et + n * o), u = s(Et - n * o), a = s(f * f), w = s(u * u), l = s(n * r * a - w), { isValid: d, value: p } = In(s(l * w)), b = s(p * u), h = s(p * b * l);
+    let x = s((c + c) * b);
+    Nt(x, i) && (x = s(-x));
+    const v = s(f * h), A = s(x * v);
+    if (!d || Nt(A, i) || v === Ho)
+      throw new Error("invalid ristretto255 encoding 2");
+    return new tt(new dt.Point(x, v, Et, A));
+  }
+  /**
+   * Converts ristretto-encoded string to ristretto point.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).
+   * @param hex Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
+   */
+  static fromHex(e) {
+    return tt.fromBytes(lt("ristrettoHex", e, 32));
+  }
+  static msm(e, n) {
+    return dr(tt, dt.Point.Fn, e, n);
+  }
+  /**
+   * Encodes ristretto point to Uint8Array.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode).
+   */
+  toBytes() {
+    let { X: e, Y: n, Z: r, T: i } = this.ep;
+    const s = Tt.ORDER, c = Tt.create, o = c(c(r + n) * c(r - n)), f = c(e * n), u = c(f * f), { value: a } = In(c(o * u)), w = c(a * o), l = c(a * f), d = c(w * l * i);
+    let p;
+    if (Nt(i * d, s)) {
+      let h = c(n * je), x = c(e * je);
+      e = h, n = x, p = c(w * zo);
+    } else
+      p = l;
+    Nt(e * d, s) && (n = c(-n));
+    let b = c((r - n) * p);
+    return Nt(b, s) && (b = c(-b)), fe(b, 32);
+  }
+  /**
+   * Compares two Ristretto points.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals).
+   */
+  equals(e) {
+    this.assertSame(e);
+    const { X: n, Y: r } = this.ep, { X: i, Y: s } = e.ep, c = Tt.create, o = c(n * s) === c(r * i), f = c(r * s) === c(n * i);
+    return o || f;
+  }
+  is0() {
+    return this.equals(tt.ZERO);
+  }
+}
+tt.BASE = new tt(dt.Point.BASE);
+tt.ZERO = new tt(dt.Point.ZERO);
+tt.Fp = Tt;
+tt.Fn = Do;
+const ni = tt, Xo = BigInt(0), te = BigInt(1), Ko = BigInt(2), Po = BigInt(7), Wo = BigInt(256), Qo = BigInt(113), hr = [], wr = [], mr = [];
+for (let t = 0, e = te, n = 1, r = 0; t < 24; t++) {
+  [n, r] = [r, (2 * n + 3 * r) % 5], hr.push(2 * (5 * r + n)), wr.push((t + 1) * (t + 2) / 2 % 64);
+  let i = Xo;
+  for (let s = 0; s < 7; s++)
+    e = (e << te ^ (e >> Po) * Qo) % Wo, e & Ko && (i ^= te << (te << /* @__PURE__ */ BigInt(s)) - te);
+  mr.push(i);
+}
+const br = Wn(mr, !0), Jo = br[0], Fo = br[1], qn = (t, e, n) => n > 32 ? jr(t, e, n) : Cr(t, e, n), Rn = (t, e, n) => n > 32 ? Vr(t, e, n) : zr(t, e, n);
+function ri(t, e = 24) {
+  const n = new Uint32Array(10);
+  for (let r = 24 - e; r < 24; r++) {
+    for (let c = 0; c < 10; c++)
+      n[c] = t[c] ^ t[c + 10] ^ t[c + 20] ^ t[c + 30] ^ t[c + 40];
+    for (let c = 0; c < 10; c += 2) {
+      const o = (c + 8) % 10, f = (c + 2) % 10, u = n[f], a = n[f + 1], w = qn(u, a, 1) ^ n[o], l = Rn(u, a, 1) ^ n[o + 1];
+      for (let d = 0; d < 50; d += 10)
+        t[c + d] ^= w, t[c + d + 1] ^= l;
+    }
+    let i = t[2], s = t[3];
+    for (let c = 0; c < 24; c++) {
+      const o = wr[c], f = qn(i, s, o), u = Rn(i, s, o), a = hr[c];
+      i = t[a], s = t[a + 1], t[a] = f, t[a + 1] = u;
+    }
+    for (let c = 0; c < 50; c += 10) {
+      for (let o = 0; o < 10; o++)
+        n[o] = t[c + o];
+      for (let o = 0; o < 10; o++)
+        t[c + o] ^= ~n[(o + 2) % 10] & n[(o + 4) % 10];
+    }
+    t[0] ^= Jo[r], t[1] ^= Fo[r];
+  }
+  ft(n);
+}
+const oi = nn, si = Ee;
+const an = /* @__PURE__ */ BigInt(0), Ye = /* @__PURE__ */ BigInt(1);
+function Ct(t, e) {
+  if (typeof e != "boolean")
+    throw new Error(t + " boolean expected, got " + e);
+}
+function we(t) {
+  const e = t.toString(16);
+  return e.length & 1 ? "0" + e : e;
+}
+function yr(t) {
+  if (typeof t != "string")
+    throw new Error("hex string expected, got " + typeof t);
+  return t === "" ? an : BigInt("0x" + t);
+}
+function Be(t) {
+  return yr(ht(t));
+}
+function Pt(t) {
+  return W(t), yr(ht(Uint8Array.from(t).reverse()));
+}
+function ln(t, e) {
+  return ae(t.toString(16).padStart(e * 2, "0"));
+}
+function Wt(t, e) {
+  return ln(t, e).reverse();
+}
+function z(t, e, n) {
+  let r;
+  if (typeof e == "string")
+    try {
+      r = ae(e);
+    } catch (s) {
+      throw new Error(t + " must be hex string or Uint8Array, cause: " + s);
+    }
+  else if (pe(e))
+    r = Uint8Array.from(e);
+  else
+    throw new Error(t + " must be hex string or Uint8Array");
+  const i = r.length;
+  if (typeof n == "number" && i !== n)
+    throw new Error(t + " of length " + n + " expected, got " + i);
+  return r;
+}
+function ts(t, e) {
+  if (t.length !== e.length)
+    return !1;
+  let n = 0;
+  for (let r = 0; r < t.length; r++)
+    n |= t[r] ^ e[r];
+  return n === 0;
+}
+const Ne = (t) => typeof t == "bigint" && an <= t;
+function es(t, e, n) {
+  return Ne(t) && Ne(e) && Ne(n) && e <= t && t < n;
+}
+function Xt(t, e, n, r) {
+  if (!es(e, n, r))
+    throw new Error("expected valid " + t + ": " + n + " <= n < " + r + ", got " + e);
+}
+function ns(t) {
+  let e;
+  for (e = 0; t > an; t >>= Ye, e += 1)
+    ;
+  return e;
+}
+const _e = (t) => (Ye << BigInt(t)) - Ye;
+function rs(t, e, n) {
+  if (typeof t != "number" || t < 2)
+    throw new Error("hashLen must be a number");
+  if (typeof e != "number" || e < 2)
+    throw new Error("qByteLen must be a number");
+  if (typeof n != "function")
+    throw new Error("hmacFn must be a function");
+  const r = (d) => new Uint8Array(d), i = (d) => Uint8Array.of(d);
+  let s = r(t), c = r(t), o = 0;
+  const f = () => {
+    s.fill(1), c.fill(0), o = 0;
+  }, u = (...d) => n(c, s, ...d), a = (d = r(0)) => {
+    c = u(i(0), d), s = u(), d.length !== 0 && (c = u(i(1), d), s = u());
+  }, w = () => {
+    if (o++ >= 1e3)
+      throw new Error("drbg: tried 1000 values");
+    let d = 0;
+    const p = [];
+    for (; d < e; ) {
+      s = u();
+      const b = s.slice();
+      p.push(b), d += s.length;
+    }
+    return ut(...p);
+  };
+  return (d, p) => {
+    f(), a(d);
+    let b;
+    for (; !(b = p(w())); )
+      a();
+    return f(), b;
+  };
+}
+function ue(t, e, n = {}) {
+  if (!t || typeof t != "object")
+    throw new Error("expected valid options object");
+  function r(i, s, c) {
+    const o = t[i];
+    if (c && o === void 0)
+      return;
+    const f = typeof o;
+    if (f !== s || o === null)
+      throw new Error(`param "${i}" is invalid: expected ${s}, got ${f}`);
+  }
+  Object.entries(e).forEach(([i, s]) => r(i, s, !1)), Object.entries(n).forEach(([i, s]) => r(i, s, !0));
+}
+function ge(t) {
+  const e = /* @__PURE__ */ new WeakMap();
+  return (n, ...r) => {
+    const i = e.get(n);
+    if (i !== void 0)
+      return i;
+    const s = t(n, ...r);
+    return e.set(n, s), s;
+  };
+}
+const it = BigInt(0), J = BigInt(1), Zt = /* @__PURE__ */ BigInt(2), os = /* @__PURE__ */ BigInt(3), gr = /* @__PURE__ */ BigInt(4), xr = /* @__PURE__ */ BigInt(5), pr = /* @__PURE__ */ BigInt(8);
+function V(t, e) {
+  const n = t % e;
+  return n >= it ? n : e + n;
+}
+function j(t, e, n) {
+  let r = t;
+  for (; e-- > it; )
+    r *= r, r %= n;
+  return r;
+}
+function Ln(t, e) {
+  if (t === it)
+    throw new Error("invert: expected non-zero number");
+  if (e <= it)
+    throw new Error("invert: expected positive modulus, got " + e);
+  let n = V(t, e), r = e, i = it, s = J;
+  for (; n !== it; ) {
+    const o = r / n, f = r % n, u = i - s * o;
+    r = n, n = f, i = s, s = u;
+  }
+  if (r !== J)
+    throw new Error("invert: does not exist");
+  return V(i, e);
+}
+function Er(t, e) {
+  const n = (t.ORDER + J) / gr, r = t.pow(e, n);
+  if (!t.eql(t.sqr(r), e))
+    throw new Error("Cannot find square root");
+  return r;
+}
+function ss(t, e) {
+  const n = (t.ORDER - xr) / pr, r = t.mul(e, Zt), i = t.pow(r, n), s = t.mul(e, i), c = t.mul(t.mul(s, Zt), i), o = t.mul(s, t.sub(c, t.ONE));
+  if (!t.eql(t.sqr(o), e))
+    throw new Error("Cannot find square root");
+  return o;
+}
+function is(t) {
+  if (t < BigInt(3))
+    throw new Error("sqrt is not defined for small field");
+  let e = t - J, n = 0;
+  for (; e % Zt === it; )
+    e /= Zt, n++;
+  let r = Zt;
+  const i = zt(t);
+  for (; Nn(i, r) === 1; )
+    if (r++ > 1e3)
+      throw new Error("Cannot find square root: probably non-prime P");
+  if (n === 1)
+    return Er;
+  let s = i.pow(r, e);
+  const c = (e + J) / Zt;
+  return function(f, u) {
+    if (f.is0(u))
+      return u;
+    if (Nn(f, u) !== 1)
+      throw new Error("Cannot find square root");
+    let a = n, w = f.mul(f.ONE, s), l = f.pow(u, e), d = f.pow(u, c);
+    for (; !f.eql(l, f.ONE); ) {
+      if (f.is0(l))
+        return f.ZERO;
+      let p = 1, b = f.sqr(l);
+      for (; !f.eql(b, f.ONE); )
+        if (p++, b = f.sqr(b), p === a)
+          throw new Error("Cannot find square root");
+      const h = J << BigInt(a - p - 1), x = f.pow(w, h);
+      a = p, w = f.sqr(x), l = f.mul(l, w), d = f.mul(d, x);
+    }
+    return d;
+  };
+}
+function cs(t) {
+  return t % gr === os ? Er : t % pr === xr ? ss : is(t);
+}
+const $t = (t, e) => (V(t, e) & J) === J, fs = [
+  "create",
+  "isValid",
+  "is0",
+  "neg",
+  "inv",
+  "sqrt",
+  "sqr",
+  "eql",
+  "add",
+  "sub",
+  "mul",
+  "pow",
+  "div",
+  "addN",
+  "subN",
+  "mulN",
+  "sqrN"
+];
+function as(t) {
+  const e = {
+    ORDER: "bigint",
+    MASK: "bigint",
+    BYTES: "number",
+    BITS: "number"
+  }, n = fs.reduce((r, i) => (r[i] = "function", r), e);
+  return ue(t, n), t;
+}
+function ls(t, e, n) {
+  if (n < it)
+    throw new Error("invalid exponent, negatives unsupported");
+  if (n === it)
+    return t.ONE;
+  if (n === J)
+    return e;
+  let r = t.ONE, i = e;
+  for (; n > it; )
+    n & J && (r = t.mul(r, i)), i = t.sqr(i), n >>= J;
+  return r;
+}
+function Br(t, e, n = !1) {
+  const r = new Array(e.length).fill(n ? t.ZERO : void 0), i = e.reduce((c, o, f) => t.is0(o) ? c : (r[f] = c, t.mul(c, o)), t.ONE), s = t.inv(i);
+  return e.reduceRight((c, o, f) => t.is0(o) ? c : (r[f] = t.mul(c, r[f]), t.mul(c, o)), s), r;
+}
+function Nn(t, e) {
+  const n = (t.ORDER - J) / Zt, r = t.pow(e, n), i = t.eql(r, t.ONE), s = t.eql(r, t.ZERO), c = t.eql(r, t.neg(t.ONE));
+  if (!i && !s && !c)
+    throw new Error("invalid Legendre symbol result");
+  return i ? 1 : s ? 0 : -1;
+}
+function us(t, e) {
+  e !== void 0 && et(e);
+  const n = e !== void 0 ? e : t.toString(2).length, r = Math.ceil(n / 8);
+  return { nBitLength: n, nByteLength: r };
+}
+function zt(t, e, n = !1, r = {}) {
+  if (t <= it)
+    throw new Error("invalid field: expected ORDER > 0, got " + t);
+  let i, s;
+  if (typeof e == "object" && e != null) {
+    if (r.sqrt || n)
+      throw new Error("cannot specify opts in two arguments");
+    const a = e;
+    a.BITS && (i = a.BITS), a.sqrt && (s = a.sqrt), typeof a.isLE == "boolean" && (n = a.isLE);
+  } else
+    typeof e == "number" && (i = e), r.sqrt && (s = r.sqrt);
+  const { nBitLength: c, nByteLength: o } = us(t, i);
+  if (o > 2048)
+    throw new Error("invalid field: expected ORDER of <= 2048 bytes");
+  let f;
+  const u = Object.freeze({
+    ORDER: t,
+    isLE: n,
+    BITS: c,
+    BYTES: o,
+    MASK: _e(c),
+    ZERO: it,
+    ONE: J,
+    create: (a) => V(a, t),
+    isValid: (a) => {
+      if (typeof a != "bigint")
+        throw new Error("invalid field element: expected bigint, got " + typeof a);
+      return it <= a && a < t;
+    },
+    is0: (a) => a === it,
+    // is valid and invertible
+    isValidNot0: (a) => !u.is0(a) && u.isValid(a),
+    isOdd: (a) => (a & J) === J,
+    neg: (a) => V(-a, t),
+    eql: (a, w) => a === w,
+    sqr: (a) => V(a * a, t),
+    add: (a, w) => V(a + w, t),
+    sub: (a, w) => V(a - w, t),
+    mul: (a, w) => V(a * w, t),
+    pow: (a, w) => ls(u, a, w),
+    div: (a, w) => V(a * Ln(w, t), t),
+    // Same as above, but doesn't normalize
+    sqrN: (a) => a * a,
+    addN: (a, w) => a + w,
+    subN: (a, w) => a - w,
+    mulN: (a, w) => a * w,
+    inv: (a) => Ln(a, t),
+    sqrt: s || ((a) => (f || (f = cs(t)), f(u, a))),
+    toBytes: (a) => n ? Wt(a, o) : ln(a, o),
+    fromBytes: (a) => {
+      if (a.length !== o)
+        throw new Error("Field.fromBytes: expected " + o + " bytes, got " + a.length);
+      return n ? Pt(a) : Be(a);
+    },
+    // TODO: we don't need it here, move out to separate fn
+    invertBatch: (a) => Br(u, a),
+    // We can't move this out because Fp6, Fp12 implement it
+    // and it's unclear what to return in there.
+    cmov: (a, w, l) => l ? w : a
+  });
+  return Object.freeze(u);
+}
+function _r(t) {
+  if (typeof t != "bigint")
+    throw new Error("field order must be bigint");
+  const e = t.toString(2).length;
+  return Math.ceil(e / 8);
+}
+function vr(t) {
+  const e = _r(t);
+  return e + Math.ceil(e / 2);
+}
+function ds(t, e, n = !1) {
+  const r = t.length, i = _r(e), s = vr(e);
+  if (r < 16 || r < s || r > 1024)
+    throw new Error("expected " + s + "-1024 bytes of input, got " + r);
+  const c = n ? Pt(t) : Be(t), o = V(c, e - J) + J;
+  return n ? Wt(o, i) : ln(o, i);
+}
+const Qt = BigInt(0), Dt = BigInt(1);
+function oe(t, e) {
+  const n = e.negate();
+  return t ? n : e;
+}
+function Sr(t, e, n) {
+  const r = e === "pz" ? (c) => c.pz : (c) => c.ez, i = Br(t.Fp, n.map(r));
+  return n.map((c, o) => c.toAffine(i[o])).map(t.fromAffine);
+}
+function Ar(t, e) {
+  if (!Number.isSafeInteger(t) || t <= 0 || t > e)
+    throw new Error("invalid window size, expected [1.." + e + "], got W=" + t);
+}
+function $e(t, e) {
+  Ar(t, e);
+  const n = Math.ceil(e / t) + 1, r = 2 ** (t - 1), i = 2 ** t, s = _e(t), c = BigInt(t);
+  return { windows: n, windowSize: r, mask: s, maxNumber: i, shiftBy: c };
+}
+function $n(t, e, n) {
+  const { windowSize: r, mask: i, maxNumber: s, shiftBy: c } = n;
+  let o = Number(t & i), f = t >> c;
+  o > r && (o -= s, f += Dt);
+  const u = e * r, a = u + Math.abs(o) - 1, w = o === 0, l = o < 0, d = e % 2 !== 0;
+  return { nextN: f, offset: a, isZero: w, isNeg: l, isNegF: d, offsetF: u };
+}
+function hs(t, e) {
+  if (!Array.isArray(t))
+    throw new Error("array expected");
+  t.forEach((n, r) => {
+    if (!(n instanceof e))
+      throw new Error("invalid point at index " + r);
+  });
+}
+function ws(t, e) {
+  if (!Array.isArray(t))
+    throw new Error("array of scalars expected");
+  t.forEach((n, r) => {
+    if (!e.isValid(n))
+      throw new Error("invalid scalar at index " + r);
+  });
+}
+const He = /* @__PURE__ */ new WeakMap(), Ir = /* @__PURE__ */ new WeakMap();
+function ke(t) {
+  return Ir.get(t) || 1;
+}
+function Hn(t) {
+  if (t !== Qt)
+    throw new Error("invalid wNAF");
+}
+function Or(t, e) {
+  return {
+    constTimeNegate: oe,
+    hasPrecomputes(n) {
+      return ke(n) !== 1;
+    },
+    // non-const time multiplication ladder
+    unsafeLadder(n, r, i = t.ZERO) {
+      let s = n;
+      for (; r > Qt; )
+        r & Dt && (i = i.add(s)), s = s.double(), r >>= Dt;
+      return i;
+    },
+    /**
+     * Creates a wNAF precomputation window. Used for caching.
+     * Default window size is set by `utils.precompute()` and is equal to 8.
+     * Number of precomputed points depends on the curve size:
+     * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+     * - 𝑊 is the window size
+     * - 𝑛 is the bitlength of the curve order.
+     * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+     * @param elm Point instance
+     * @param W window size
+     * @returns precomputed point tables flattened to a single array
+     */
+    precomputeWindow(n, r) {
+      const { windows: i, windowSize: s } = $e(r, e), c = [];
+      let o = n, f = o;
+      for (let u = 0; u < i; u++) {
+        f = o, c.push(f);
+        for (let a = 1; a < s; a++)
+          f = f.add(o), c.push(f);
+        o = f.double();
+      }
+      return c;
+    },
+    /**
+     * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
+     * @param W window size
+     * @param precomputes precomputed tables
+     * @param n scalar (we don't check here, but should be less than curve order)
+     * @returns real and fake (for const-time) points
+     */
+    wNAF(n, r, i) {
+      let s = t.ZERO, c = t.BASE;
+      const o = $e(n, e);
+      for (let f = 0; f < o.windows; f++) {
+        const { nextN: u, offset: a, isZero: w, isNeg: l, isNegF: d, offsetF: p } = $n(i, f, o);
+        i = u, w ? c = c.add(oe(d, r[p])) : s = s.add(oe(l, r[a]));
+      }
+      return Hn(i), { p: s, f: c };
+    },
+    /**
+     * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.
+     * @param W window size
+     * @param precomputes precomputed tables
+     * @param n scalar (we don't check here, but should be less than curve order)
+     * @param acc accumulator point to add result of multiplication
+     * @returns point
+     */
+    wNAFUnsafe(n, r, i, s = t.ZERO) {
+      const c = $e(n, e);
+      for (let o = 0; o < c.windows && i !== Qt; o++) {
+        const { nextN: f, offset: u, isZero: a, isNeg: w } = $n(i, o, c);
+        if (i = f, !a) {
+          const l = r[u];
+          s = s.add(w ? l.negate() : l);
+        }
+      }
+      return Hn(i), s;
+    },
+    getPrecomputes(n, r, i) {
+      let s = He.get(r);
+      return s || (s = this.precomputeWindow(r, n), n !== 1 && (typeof i == "function" && (s = i(s)), He.set(r, s))), s;
+    },
+    wNAFCached(n, r, i) {
+      const s = ke(n);
+      return this.wNAF(s, this.getPrecomputes(s, n, i), r);
+    },
+    wNAFCachedUnsafe(n, r, i, s) {
+      const c = ke(n);
+      return c === 1 ? this.unsafeLadder(n, r, s) : this.wNAFUnsafe(c, this.getPrecomputes(c, n, i), r, s);
+    },
+    // We calculate precomputes for elliptic curve point multiplication
+    // using windowed method. This specifies window size and
+    // stores precomputed values. Usually only base point would be precomputed.
+    setWindowSize(n, r) {
+      Ar(r, e), Ir.set(n, r), He.delete(n);
+    }
+  };
+}
+function ms(t, e, n, r) {
+  let i = e, s = t.ZERO, c = t.ZERO;
+  for (; n > Qt || r > Qt; )
+    n & Dt && (s = s.add(i)), r & Dt && (c = c.add(i)), i = i.double(), n >>= Dt, r >>= Dt;
+  return { p1: s, p2: c };
+}
+function un(t, e, n, r) {
+  hs(n, t), ws(r, e);
+  const i = n.length, s = r.length;
+  if (i !== s)
+    throw new Error("arrays of points and scalars must have equal length");
+  const c = t.ZERO, o = ns(BigInt(i));
+  let f = 1;
+  o > 12 ? f = o - 3 : o > 4 ? f = o - 2 : o > 0 && (f = 2);
+  const u = _e(f), a = new Array(Number(u) + 1).fill(c), w = Math.floor((e.BITS - 1) / f) * f;
+  let l = c;
+  for (let d = w; d >= 0; d -= f) {
+    a.fill(c);
+    for (let b = 0; b < s; b++) {
+      const h = r[b], x = Number(h >> BigInt(d) & u);
+      a[x] = a[x].add(n[b]);
+    }
+    let p = c;
+    for (let b = a.length - 1, h = c; b > 0; b--)
+      h = h.add(a[b]), p = p.add(h);
+    if (l = l.add(p), d !== 0)
+      for (let b = 0; b < f; b++)
+        l = l.double();
+  }
+  return l;
+}
+function kn(t, e) {
+  if (e) {
+    if (e.ORDER !== t)
+      throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
+    return as(e), e;
+  } else
+    return zt(t);
+}
+function qr(t, e, n = {}) {
+  if (!e || typeof e != "object")
+    throw new Error(`expected valid ${t} CURVE object`);
+  for (const o of ["p", "n", "h"]) {
+    const f = e[o];
+    if (!(typeof f == "bigint" && f > Qt))
+      throw new Error(`CURVE.${o} must be positive bigint`);
+  }
+  const r = kn(e.p, n.Fp), i = kn(e.n, n.Fn), c = ["Gx", "Gy", "a", t === "weierstrass" ? "b" : "d"];
+  for (const o of c)
+    if (!r.isValid(e[o]))
+      throw new Error(`CURVE.${o} must be valid field element of CURVE.Fp`);
+  return { Fp: r, Fn: i };
+}
+function Tn(t) {
+  t.lowS !== void 0 && Ct("lowS", t.lowS), t.prehash !== void 0 && Ct("prehash", t.prehash);
+}
+class bs extends Error {
+  constructor(e = "") {
+    super(e);
+  }
+}
+const pt = {
+  // asn.1 DER encoding utils
+  Err: bs,
+  // Basic building block is TLV (Tag-Length-Value)
+  _tlv: {
+    encode: (t, e) => {
+      const { Err: n } = pt;
+      if (t < 0 || t > 256)
+        throw new n("tlv.encode: wrong tag");
+      if (e.length & 1)
+        throw new n("tlv.encode: unpadded data");
+      const r = e.length / 2, i = we(r);
+      if (i.length / 2 & 128)
+        throw new n("tlv.encode: long form length too big");
+      const s = r > 127 ? we(i.length / 2 | 128) : "";
+      return we(t) + s + i + e;
+    },
+    // v - value, l - left bytes (unparsed)
+    decode(t, e) {
+      const { Err: n } = pt;
+      let r = 0;
+      if (t < 0 || t > 256)
+        throw new n("tlv.encode: wrong tag");
+      if (e.length < 2 || e[r++] !== t)
+        throw new n("tlv.decode: wrong tlv");
+      const i = e[r++], s = !!(i & 128);
+      let c = 0;
+      if (!s)
+        c = i;
+      else {
+        const f = i & 127;
+        if (!f)
+          throw new n("tlv.decode(long): indefinite length not supported");
+        if (f > 4)
+          throw new n("tlv.decode(long): byte length is too big");
+        const u = e.subarray(r, r + f);
+        if (u.length !== f)
+          throw new n("tlv.decode: length bytes not complete");
+        if (u[0] === 0)
+          throw new n("tlv.decode(long): zero leftmost byte");
+        for (const a of u)
+          c = c << 8 | a;
+        if (r += f, c < 128)
+          throw new n("tlv.decode(long): not minimal encoding");
+      }
+      const o = e.subarray(r, r + c);
+      if (o.length !== c)
+        throw new n("tlv.decode: wrong value length");
+      return { v: o, l: e.subarray(r + c) };
+    }
+  },
+  // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,
+  // since we always use positive integers here. It must always be empty:
+  // - add zero byte if exists
+  // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)
+  _int: {
+    encode(t) {
+      const { Err: e } = pt;
+      if (t < se)
+        throw new e("integer: negative integers are not allowed");
+      let n = we(t);
+      if (Number.parseInt(n[0], 16) & 8 && (n = "00" + n), n.length & 1)
+        throw new e("unexpected DER parsing assertion: unpadded hex");
+      return n;
+    },
+    decode(t) {
+      const { Err: e } = pt;
+      if (t[0] & 128)
+        throw new e("invalid signature integer: negative");
+      if (t[0] === 0 && !(t[1] & 128))
+        throw new e("invalid signature integer: unnecessary leading zero");
+      return Be(t);
+    }
+  },
+  toSig(t) {
+    const { Err: e, _int: n, _tlv: r } = pt, i = z("signature", t), { v: s, l: c } = r.decode(48, i);
+    if (c.length)
+      throw new e("invalid signature: left bytes after parsing");
+    const { v: o, l: f } = r.decode(2, s), { v: u, l: a } = r.decode(2, f);
+    if (a.length)
+      throw new e("invalid signature: left bytes after parsing");
+    return { r: n.decode(o), s: n.decode(u) };
+  },
+  hexFromSig(t) {
+    const { _tlv: e, _int: n } = pt, r = e.encode(2, n.encode(t.r)), i = e.encode(2, n.encode(t.s)), s = r + i;
+    return e.encode(48, s);
+  }
+}, se = BigInt(0), ie = BigInt(1), ys = BigInt(2), me = BigInt(3), gs = BigInt(4);
+function xs(t, e, n) {
+  function r(i) {
+    const s = t.sqr(i), c = t.mul(s, i);
+    return t.add(t.add(c, t.mul(i, e)), n);
+  }
+  return r;
+}
+function Rr(t, e, n) {
+  const { BYTES: r } = t;
+  function i(s) {
+    let c;
+    if (typeof s == "bigint")
+      c = s;
+    else {
+      let o = z("private key", s);
+      if (e) {
+        if (!e.includes(o.length * 2))
+          throw new Error("invalid private key");
+        const f = new Uint8Array(r);
+        f.set(o, f.length - o.length), o = f;
+      }
+      try {
+        c = t.fromBytes(o);
+      } catch {
+        throw new Error(`invalid private key: expected ui8a of size ${r}, got ${typeof s}`);
+      }
+    }
+    if (n && (c = t.create(c)), !t.isValidNot0(c))
+      throw new Error("invalid private key: out of range [1..N-1]");
+    return c;
+  }
+  return i;
+}
+function ps(t, e = {}) {
+  const { Fp: n, Fn: r } = qr("weierstrass", t, e), { h: i, n: s } = t;
+  ue(e, {}, {
+    allowInfinityPoint: "boolean",
+    clearCofactor: "function",
+    isTorsionFree: "function",
+    fromBytes: "function",
+    toBytes: "function",
+    endo: "object",
+    wrapPrivateKey: "boolean"
+  });
+  const { endo: c } = e;
+  if (c && (!n.is0(t.a) || typeof c.beta != "bigint" || typeof c.splitScalar != "function"))
+    throw new Error('invalid endo: expected "beta": bigint and "splitScalar": function');
+  function o() {
+    if (!n.isOdd)
+      throw new Error("compression is not supported: Field does not have .isOdd()");
+  }
+  function f(q, g, _) {
+    const { x: m, y } = g.toAffine(), E = n.toBytes(m);
+    if (Ct("isCompressed", _), _) {
+      o();
+      const S = !n.isOdd(y);
+      return ut(Lr(S), E);
+    } else
+      return ut(Uint8Array.of(4), E, n.toBytes(y));
+  }
+  function u(q) {
+    W(q);
+    const g = n.BYTES, _ = g + 1, m = 2 * g + 1, y = q.length, E = q[0], S = q.subarray(1);
+    if (y === _ && (E === 2 || E === 3)) {
+      const I = n.fromBytes(S);
+      if (!n.isValid(I))
+        throw new Error("bad point: is not on curve, wrong x");
+      const O = l(I);
+      let H;
+      try {
+        H = n.sqrt(O);
+      } catch (U) {
+        const T = U instanceof Error ? ": " + U.message : "";
+        throw new Error("bad point: is not on curve, sqrt error" + T);
+      }
+      o();
+      const k = n.isOdd(H);
+      return (E & 1) === 1 !== k && (H = n.neg(H)), { x: I, y: H };
+    } else if (y === m && E === 4) {
+      const I = n.fromBytes(S.subarray(g * 0, g * 1)), O = n.fromBytes(S.subarray(g * 1, g * 2));
+      if (!d(I, O))
+        throw new Error("bad point: is not on curve");
+      return { x: I, y: O };
+    } else
+      throw new Error(`bad point: got length ${y}, expected compressed=${_} or uncompressed=${m}`);
+  }
+  const a = e.toBytes || f, w = e.fromBytes || u, l = xs(n, t.a, t.b);
+  function d(q, g) {
+    const _ = n.sqr(g), m = l(q);
+    return n.eql(_, m);
+  }
+  if (!d(t.Gx, t.Gy))
+    throw new Error("bad curve params: generator point");
+  const p = n.mul(n.pow(t.a, me), gs), b = n.mul(n.sqr(t.b), BigInt(27));
+  if (n.is0(n.add(p, b)))
+    throw new Error("bad curve params: a or b");
+  function h(q, g, _ = !1) {
+    if (!n.isValid(g) || _ && n.is0(g))
+      throw new Error(`bad point coordinate ${q}`);
+    return g;
+  }
+  function x(q) {
+    if (!(q instanceof B))
+      throw new Error("ProjectivePoint expected");
+  }
+  const v = ge((q, g) => {
+    const { px: _, py: m, pz: y } = q;
+    if (n.eql(y, n.ONE))
+      return { x: _, y: m };
+    const E = q.is0();
+    g == null && (g = E ? n.ONE : n.inv(y));
+    const S = n.mul(_, g), I = n.mul(m, g), O = n.mul(y, g);
+    if (E)
+      return { x: n.ZERO, y: n.ZERO };
+    if (!n.eql(O, n.ONE))
+      throw new Error("invZ was invalid");
+    return { x: S, y: I };
+  }), A = ge((q) => {
+    if (q.is0()) {
+      if (e.allowInfinityPoint && !n.is0(q.py))
+        return;
+      throw new Error("bad point: ZERO");
+    }
+    const { x: g, y: _ } = q.toAffine();
+    if (!n.isValid(g) || !n.isValid(_))
+      throw new Error("bad point: x or y not field elements");
+    if (!d(g, _))
+      throw new Error("bad point: equation left != right");
+    if (!q.isTorsionFree())
+      throw new Error("bad point: not in prime-order subgroup");
+    return !0;
+  });
+  function L(q, g, _, m, y) {
+    return _ = new B(n.mul(_.px, q), _.py, _.pz), g = oe(m, g), _ = oe(y, _), g.add(_);
+  }
+  class B {
+    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
+    constructor(g, _, m) {
+      this.px = h("x", g), this.py = h("y", _, !0), this.pz = h("z", m), Object.freeze(this);
+    }
+    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
+    static fromAffine(g) {
+      const { x: _, y: m } = g || {};
+      if (!g || !n.isValid(_) || !n.isValid(m))
+        throw new Error("invalid affine point");
+      if (g instanceof B)
+        throw new Error("projective point not allowed");
+      return n.is0(_) && n.is0(m) ? B.ZERO : new B(_, m, n.ONE);
+    }
+    get x() {
+      return this.toAffine().x;
+    }
+    get y() {
+      return this.toAffine().y;
+    }
+    static normalizeZ(g) {
+      return Sr(B, "pz", g);
+    }
+    static fromBytes(g) {
+      return W(g), B.fromHex(g);
+    }
+    /** Converts hash string or Uint8Array to Point. */
+    static fromHex(g) {
+      const _ = B.fromAffine(w(z("pointHex", g)));
+      return _.assertValidity(), _;
+    }
+    /** Multiplies generator point by privateKey. */
+    static fromPrivateKey(g) {
+      const _ = Rr(r, e.allowedPrivateKeyLengths, e.wrapPrivateKey);
+      return B.BASE.multiply(_(g));
+    }
+    /** Multiscalar Multiplication */
+    static msm(g, _) {
+      return un(B, r, g, _);
+    }
+    /**
+     *
+     * @param windowSize
+     * @param isLazy true will defer table computation until the first multiplication
+     * @returns
+     */
+    precompute(g = 8, _ = !0) {
+      return N.setWindowSize(this, g), _ || this.multiply(me), this;
+    }
+    /** "Private method", don't use it directly */
+    _setWindowSize(g) {
+      this.precompute(g);
+    }
+    // TODO: return `this`
+    /** A point on curve is valid if it conforms to equation. */
+    assertValidity() {
+      A(this);
+    }
+    hasEvenY() {
+      const { y: g } = this.toAffine();
+      if (!n.isOdd)
+        throw new Error("Field doesn't support isOdd");
+      return !n.isOdd(g);
+    }
+    /** Compare one point to another. */
+    equals(g) {
+      x(g);
+      const { px: _, py: m, pz: y } = this, { px: E, py: S, pz: I } = g, O = n.eql(n.mul(_, I), n.mul(E, y)), H = n.eql(n.mul(m, I), n.mul(S, y));
+      return O && H;
+    }
+    /** Flips point to one corresponding to (x, -y) in Affine coordinates. */
+    negate() {
+      return new B(this.px, n.neg(this.py), this.pz);
+    }
+    // Renes-Costello-Batina exception-free doubling formula.
+    // There is 30% faster Jacobian formula, but it is not complete.
+    // https://eprint.iacr.org/2015/1060, algorithm 3
+    // Cost: 8M + 3S + 3*a + 2*b3 + 15add.
+    double() {
+      const { a: g, b: _ } = t, m = n.mul(_, me), { px: y, py: E, pz: S } = this;
+      let I = n.ZERO, O = n.ZERO, H = n.ZERO, k = n.mul(y, y), Z = n.mul(E, E), U = n.mul(S, S), T = n.mul(y, E);
+      return T = n.add(T, T), H = n.mul(y, S), H = n.add(H, H), I = n.mul(g, H), O = n.mul(m, U), O = n.add(I, O), I = n.sub(Z, O), O = n.add(Z, O), O = n.mul(I, O), I = n.mul(T, I), H = n.mul(m, H), U = n.mul(g, U), T = n.sub(k, U), T = n.mul(g, T), T = n.add(T, H), H = n.add(k, k), k = n.add(H, k), k = n.add(k, U), k = n.mul(k, T), O = n.add(O, k), U = n.mul(E, S), U = n.add(U, U), k = n.mul(U, T), I = n.sub(I, k), H = n.mul(U, Z), H = n.add(H, H), H = n.add(H, H), new B(I, O, H);
+    }
+    // Renes-Costello-Batina exception-free addition formula.
+    // There is 30% faster Jacobian formula, but it is not complete.
+    // https://eprint.iacr.org/2015/1060, algorithm 1
+    // Cost: 12M + 0S + 3*a + 3*b3 + 23add.
+    add(g) {
+      x(g);
+      const { px: _, py: m, pz: y } = this, { px: E, py: S, pz: I } = g;
+      let O = n.ZERO, H = n.ZERO, k = n.ZERO;
+      const Z = t.a, U = n.mul(t.b, me);
+      let T = n.mul(_, E), M = n.mul(m, S), Y = n.mul(y, I), Q = n.add(_, m), C = n.add(E, S);
+      Q = n.mul(Q, C), C = n.add(T, M), Q = n.sub(Q, C), C = n.add(_, y);
+      let nt = n.add(E, I);
+      return C = n.mul(C, nt), nt = n.add(T, Y), C = n.sub(C, nt), nt = n.add(m, y), O = n.add(S, I), nt = n.mul(nt, O), O = n.add(M, Y), nt = n.sub(nt, O), k = n.mul(Z, C), O = n.mul(U, Y), k = n.add(O, k), O = n.sub(M, k), k = n.add(M, k), H = n.mul(O, k), M = n.add(T, T), M = n.add(M, T), Y = n.mul(Z, Y), C = n.mul(U, C), M = n.add(M, Y), Y = n.sub(T, Y), Y = n.mul(Z, Y), C = n.add(C, Y), T = n.mul(M, C), H = n.add(H, T), T = n.mul(nt, C), O = n.mul(Q, O), O = n.sub(O, T), T = n.mul(Q, M), k = n.mul(nt, k), k = n.add(k, T), new B(O, H, k);
+    }
+    subtract(g) {
+      return this.add(g.negate());
+    }
+    is0() {
+      return this.equals(B.ZERO);
+    }
+    /**
+     * Constant time multiplication.
+     * Uses wNAF method. Windowed method may be 10% faster,
+     * but takes 2x longer to generate and consumes 2x memory.
+     * Uses precomputes when available.
+     * Uses endomorphism for Koblitz curves.
+     * @param scalar by which the point would be multiplied
+     * @returns New point
+     */
+    multiply(g) {
+      const { endo: _ } = e;
+      if (!r.isValidNot0(g))
+        throw new Error("invalid scalar: out of range");
+      let m, y;
+      const E = (S) => N.wNAFCached(this, S, B.normalizeZ);
+      if (_) {
+        const { k1neg: S, k1: I, k2neg: O, k2: H } = _.splitScalar(g), { p: k, f: Z } = E(I), { p: U, f: T } = E(H);
+        y = Z.add(T), m = L(_.beta, k, U, S, O);
+      } else {
+        const { p: S, f: I } = E(g);
+        m = S, y = I;
+      }
+      return B.normalizeZ([m, y])[0];
+    }
+    /**
+     * Non-constant-time multiplication. Uses double-and-add algorithm.
+     * It's faster, but should only be used when you don't care about
+     * an exposed private key e.g. sig verification, which works over *public* keys.
+     */
+    multiplyUnsafe(g) {
+      const { endo: _ } = e, m = this;
+      if (!r.isValid(g))
+        throw new Error("invalid scalar: out of range");
+      if (g === se || m.is0())
+        return B.ZERO;
+      if (g === ie)
+        return m;
+      if (N.hasPrecomputes(this))
+        return this.multiply(g);
+      if (_) {
+        const { k1neg: y, k1: E, k2neg: S, k2: I } = _.splitScalar(g), { p1: O, p2: H } = ms(B, m, E, I);
+        return L(_.beta, O, H, y, S);
+      } else
+        return N.wNAFCachedUnsafe(m, g);
+    }
+    multiplyAndAddUnsafe(g, _, m) {
+      const y = this.multiplyUnsafe(_).add(g.multiplyUnsafe(m));
+      return y.is0() ? void 0 : y;
+    }
+    /**
+     * Converts Projective point to affine (x, y) coordinates.
+     * @param invertedZ Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch
+     */
+    toAffine(g) {
+      return v(this, g);
+    }
+    /**
+     * Checks whether Point is free of torsion elements (is in prime subgroup).
+     * Always torsion-free for cofactor=1 curves.
+     */
+    isTorsionFree() {
+      const { isTorsionFree: g } = e;
+      return i === ie ? !0 : g ? g(B, this) : N.wNAFCachedUnsafe(this, s).is0();
+    }
+    clearCofactor() {
+      const { clearCofactor: g } = e;
+      return i === ie ? this : g ? g(B, this) : this.multiplyUnsafe(i);
+    }
+    toBytes(g = !0) {
+      return Ct("isCompressed", g), this.assertValidity(), a(B, this, g);
+    }
+    /** @deprecated use `toBytes` */
+    toRawBytes(g = !0) {
+      return this.toBytes(g);
+    }
+    toHex(g = !0) {
+      return ht(this.toBytes(g));
+    }
+    toString() {
+      return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
+    }
+  }
+  B.BASE = new B(t.Gx, t.Gy, n.ONE), B.ZERO = new B(n.ZERO, n.ONE, n.ZERO), B.Fp = n, B.Fn = r;
+  const R = r.BITS, N = Or(B, e.endo ? Math.ceil(R / 2) : R);
+  return B;
+}
+function Lr(t) {
+  return Uint8Array.of(t ? 2 : 3);
+}
+function Es(t, e, n = {}) {
+  ue(e, { hash: "function" }, {
+    hmac: "function",
+    lowS: "boolean",
+    randomBytes: "function",
+    bits2int: "function",
+    bits2int_modN: "function"
+  });
+  const r = e.randomBytes || Je, i = e.hmac || ((m, ...y) => en(e.hash, m, ut(...y))), { Fp: s, Fn: c } = t, { ORDER: o, BITS: f } = c;
+  function u(m) {
+    const y = o >> ie;
+    return m > y;
+  }
+  function a(m) {
+    return u(m) ? c.neg(m) : m;
+  }
+  function w(m, y) {
+    if (!c.isValidNot0(y))
+      throw new Error(`invalid signature ${m}: out of range 1..CURVE.n`);
+  }
+  class l {
+    constructor(y, E, S) {
+      w("r", y), w("s", E), this.r = y, this.s = E, S != null && (this.recovery = S), Object.freeze(this);
+    }
+    // pair (bytes of r, bytes of s)
+    static fromCompact(y) {
+      const E = c.BYTES, S = z("compactSignature", y, E * 2);
+      return new l(c.fromBytes(S.subarray(0, E)), c.fromBytes(S.subarray(E, E * 2)));
+    }
+    // DER encoded ECDSA signature
+    // https://bitcoin.stackexchange.com/questions/57644/what-are-the-parts-of-a-bitcoin-transaction-input-script
+    static fromDER(y) {
+      const { r: E, s: S } = pt.toSig(z("DER", y));
+      return new l(E, S);
+    }
+    /**
+     * @todo remove
+     * @deprecated
+     */
+    assertValidity() {
+    }
+    addRecoveryBit(y) {
+      return new l(this.r, this.s, y);
+    }
+    // ProjPointType<bigint>
+    recoverPublicKey(y) {
+      const E = s.ORDER, { r: S, s: I, recovery: O } = this;
+      if (O == null || ![0, 1, 2, 3].includes(O))
+        throw new Error("recovery id invalid");
+      if (o * ys < E && O > 1)
+        throw new Error("recovery id is ambiguous for h>1 curve");
+      const k = O === 2 || O === 3 ? S + o : S;
+      if (!s.isValid(k))
+        throw new Error("recovery id 2 or 3 invalid");
+      const Z = s.toBytes(k), U = t.fromHex(ut(Lr((O & 1) === 0), Z)), T = c.inv(k), M = A(z("msgHash", y)), Y = c.create(-M * T), Q = c.create(I * T), C = t.BASE.multiplyUnsafe(Y).add(U.multiplyUnsafe(Q));
+      if (C.is0())
+        throw new Error("point at infinify");
+      return C.assertValidity(), C;
+    }
+    // Signatures should be low-s, to prevent malleability.
+    hasHighS() {
+      return u(this.s);
+    }
+    normalizeS() {
+      return this.hasHighS() ? new l(this.r, c.neg(this.s), this.recovery) : this;
+    }
+    toBytes(y) {
+      if (y === "compact")
+        return ut(c.toBytes(this.r), c.toBytes(this.s));
+      if (y === "der")
+        return ae(pt.hexFromSig(this));
+      throw new Error("invalid format");
+    }
+    // DER-encoded
+    toDERRawBytes() {
+      return this.toBytes("der");
+    }
+    toDERHex() {
+      return ht(this.toBytes("der"));
+    }
+    // padded bytes of r, then padded bytes of s
+    toCompactRawBytes() {
+      return this.toBytes("compact");
+    }
+    toCompactHex() {
+      return ht(this.toBytes("compact"));
+    }
+  }
+  const d = Rr(c, n.allowedPrivateKeyLengths, n.wrapPrivateKey), p = {
+    isValidPrivateKey(m) {
+      try {
+        return d(m), !0;
+      } catch {
+        return !1;
+      }
+    },
+    normPrivateKeyToScalar: d,
+    /**
+     * Produces cryptographically secure private key from random of size
+     * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.
+     */
+    randomPrivateKey: () => {
+      const m = o;
+      return ds(r(vr(m)), m);
+    },
+    precompute(m = 8, y = t.BASE) {
+      return y.precompute(m, !1);
+    }
+  };
+  function b(m, y = !0) {
+    return t.fromPrivateKey(m).toBytes(y);
+  }
+  function h(m) {
+    if (typeof m == "bigint")
+      return !1;
+    if (m instanceof t)
+      return !0;
+    const E = z("key", m).length, S = s.BYTES, I = S + 1, O = 2 * S + 1;
+    if (!(n.allowedPrivateKeyLengths || c.BYTES === I))
+      return E === I || E === O;
+  }
+  function x(m, y, E = !0) {
+    if (h(m) === !0)
+      throw new Error("first arg must be private key");
+    if (h(y) === !1)
+      throw new Error("second arg must be public key");
+    return t.fromHex(y).multiply(d(m)).toBytes(E);
+  }
+  const v = e.bits2int || function(m) {
+    if (m.length > 8192)
+      throw new Error("input is too large");
+    const y = Be(m), E = m.length * 8 - f;
+    return E > 0 ? y >> BigInt(E) : y;
+  }, A = e.bits2int_modN || function(m) {
+    return c.create(v(m));
+  }, L = _e(f);
+  function B(m) {
+    return Xt("num < 2^" + f, m, se, L), c.toBytes(m);
+  }
+  function R(m, y, E = N) {
+    if (["recovered", "canonical"].some((Q) => Q in E))
+      throw new Error("sign() legacy options not supported");
+    const { hash: S } = e;
+    let { lowS: I, prehash: O, extraEntropy: H } = E;
+    I == null && (I = !0), m = z("msgHash", m), Tn(E), O && (m = z("prehashed msgHash", S(m)));
+    const k = A(m), Z = d(y), U = [B(Z), B(k)];
+    if (H != null && H !== !1) {
+      const Q = H === !0 ? r(s.BYTES) : H;
+      U.push(z("extraEntropy", Q));
+    }
+    const T = ut(...U), M = k;
+    function Y(Q) {
+      const C = v(Q);
+      if (!c.isValidNot0(C))
+        return;
+      const nt = c.inv(C), Ft = t.BASE.multiply(C).toAffine(), jt = c.create(Ft.x);
+      if (jt === se)
+        return;
+      const kt = c.create(nt * c.create(M + jt * Z));
+      if (kt === se)
+        return;
+      let Se = (Ft.x === jt ? 0 : 2) | Number(Ft.y & ie), Vt = kt;
+      return I && u(kt) && (Vt = a(kt), Se ^= 1), new l(jt, Vt, Se);
+    }
+    return { seed: T, k2sig: Y };
+  }
+  const N = { lowS: e.lowS, prehash: !1 }, q = { lowS: e.lowS, prehash: !1 };
+  function g(m, y, E = N) {
+    const { seed: S, k2sig: I } = R(m, y, E);
+    return rs(e.hash.outputLen, c.BYTES, i)(S, I);
+  }
+  t.BASE.precompute(8);
+  function _(m, y, E, S = q) {
+    const I = m;
+    y = z("msgHash", y), E = z("publicKey", E), Tn(S);
+    const { lowS: O, prehash: H, format: k } = S;
+    if ("strict" in S)
+      throw new Error("options.strict was renamed to lowS");
+    if (k !== void 0 && !["compact", "der", "js"].includes(k))
+      throw new Error('format must be "compact", "der" or "js"');
+    const Z = typeof I == "string" || pe(I), U = !Z && !k && typeof I == "object" && I !== null && typeof I.r == "bigint" && typeof I.s == "bigint";
+    if (!Z && !U)
+      throw new Error("invalid signature, expected Uint8Array, hex string or Signature instance");
+    let T, M;
+    try {
+      if (U)
+        if (k === void 0 || k === "js")
+          T = new l(I.r, I.s);
+        else
+          throw new Error("invalid format");
+      if (Z) {
+        try {
+          k !== "compact" && (T = l.fromDER(I));
+        } catch (Vt) {
+          if (!(Vt instanceof pt.Err))
+            throw Vt;
+        }
+        !T && k !== "der" && (T = l.fromCompact(I));
+      }
+      M = t.fromHex(E);
+    } catch {
+      return !1;
+    }
+    if (!T || O && T.hasHighS())
+      return !1;
+    H && (y = e.hash(y));
+    const { r: Y, s: Q } = T, C = A(y), nt = c.inv(Q), Ft = c.create(C * nt), jt = c.create(Y * nt), kt = t.BASE.multiplyUnsafe(Ft).add(M.multiplyUnsafe(jt));
+    return kt.is0() ? !1 : c.create(kt.x) === Y;
+  }
+  return Object.freeze({
+    getPublicKey: b,
+    getSharedSecret: x,
+    sign: g,
+    verify: _,
+    utils: p,
+    Point: t,
+    Signature: l
+  });
+}
+function Bs(t) {
+  const e = {
+    a: t.a,
+    b: t.b,
+    p: t.Fp.ORDER,
+    n: t.n,
+    h: t.h,
+    Gx: t.Gx,
+    Gy: t.Gy
+  }, n = t.Fp, r = zt(e.n, t.nBitLength), i = {
+    Fp: n,
+    Fn: r,
+    allowedPrivateKeyLengths: t.allowedPrivateKeyLengths,
+    allowInfinityPoint: t.allowInfinityPoint,
+    endo: t.endo,
+    wrapPrivateKey: t.wrapPrivateKey,
+    isTorsionFree: t.isTorsionFree,
+    clearCofactor: t.clearCofactor,
+    fromBytes: t.fromBytes,
+    toBytes: t.toBytes
+  };
+  return { CURVE: e, curveOpts: i };
+}
+function _s(t) {
+  const { CURVE: e, curveOpts: n } = Bs(t), r = {
+    hash: t.hash,
+    hmac: t.hmac,
+    randomBytes: t.randomBytes,
+    lowS: t.lowS,
+    bits2int: t.bits2int,
+    bits2int_modN: t.bits2int_modN
+  };
+  return { CURVE: e, curveOpts: n, ecdsaOpts: r };
+}
+function vs(t, e) {
+  return Object.assign({}, e, {
+    ProjectivePoint: e.Point,
+    CURVE: t
+  });
+}
+function Ss(t) {
+  const { CURVE: e, curveOpts: n, ecdsaOpts: r } = _s(t), i = ps(e, n), s = Es(i, r, n);
+  return vs(t, s);
+}
+function As(t, e) {
+  const n = (r) => Ss({ ...t, hash: r });
+  return { ...n(e), create: n };
+}
+const xe = {
+  p: BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f"),
+  n: BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"),
+  h: BigInt(1),
+  a: BigInt(0),
+  b: BigInt(7),
+  Gx: BigInt("0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"),
+  Gy: BigInt("0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8")
+};
+BigInt(0);
+const Is = BigInt(1), Ge = BigInt(2), Un = (t, e) => (t + e / Ge) / e;
+function Os(t) {
+  const e = xe.p, n = BigInt(3), r = BigInt(6), i = BigInt(11), s = BigInt(22), c = BigInt(23), o = BigInt(44), f = BigInt(88), u = t * t * t % e, a = u * u * t % e, w = j(a, n, e) * a % e, l = j(w, n, e) * a % e, d = j(l, Ge, e) * u % e, p = j(d, i, e) * d % e, b = j(p, s, e) * p % e, h = j(b, o, e) * b % e, x = j(h, f, e) * h % e, v = j(x, o, e) * b % e, A = j(v, n, e) * a % e, L = j(A, c, e) * p % e, B = j(L, r, e) * u % e, R = j(B, Ge, e);
+  if (!Xe.eql(Xe.sqr(R), t))
+    throw new Error("Cannot find square root");
+  return R;
+}
+const Xe = zt(xe.p, void 0, void 0, { sqrt: Os }), ii = As({
+  ...xe,
+  Fp: Xe,
+  lowS: !0,
+  // Allow only low-S signatures by default in sign() and verify()
+  endo: {
+    // Endomorphism, see above
+    beta: BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),
+    splitScalar: (t) => {
+      const e = xe.n, n = BigInt("0x3086d221a7d46bcde86c90e49284eb15"), r = -Is * BigInt("0xe4437ed6010e88286f547fa90abfe4c3"), i = BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"), s = n, c = BigInt("0x100000000000000000000000000000000"), o = Un(s * t, e), f = Un(-r * t, e);
+      let u = V(t - o * n - f * i, e), a = V(-o * r - f * s, e);
+      const w = u > c, l = a > c;
+      if (w && (u = e - u), l && (a = e - a), u > c || a > c)
+        throw new Error("splitScalar: Endomorphism failed, k=" + t);
+      return { k1neg: w, k1: u, k2neg: l, k2: a };
+    }
+  }
+}, Ee);
+const yt = BigInt(0), rt = BigInt(1), Te = BigInt(2), qs = BigInt(8), Rs = { zip215: !0 };
+function Ls(t, e, n, r) {
+  const i = t.sqr(n), s = t.sqr(r), c = t.add(t.mul(e.a, i), s), o = t.add(t.ONE, t.mul(e.d, t.mul(i, s)));
+  return t.eql(c, o);
+}
+function Ns(t, e = {}) {
+  const { Fp: n, Fn: r } = qr("edwards", t, e), { h: i, n: s } = t;
+  ue(e, {}, { uvRatio: "function" });
+  const c = Te << BigInt(r.BYTES * 8) - rt, o = (b) => n.create(b), f = e.uvRatio || ((b, h) => {
+    try {
+      return { isValid: !0, value: n.sqrt(n.div(b, h)) };
+    } catch {
+      return { isValid: !1, value: yt };
+    }
+  });
+  if (!Ls(n, t, t.Gx, t.Gy))
+    throw new Error("bad curve params: generator point");
+  function u(b, h, x = !1) {
+    const v = x ? rt : yt;
+    return Xt("coordinate " + b, h, v, c), h;
+  }
+  function a(b) {
+    if (!(b instanceof d))
+      throw new Error("ExtendedPoint expected");
+  }
+  const w = ge((b, h) => {
+    const { ex: x, ey: v, ez: A } = b, L = b.is0();
+    h == null && (h = L ? qs : n.inv(A));
+    const B = o(x * h), R = o(v * h), N = o(A * h);
+    if (L)
+      return { x: yt, y: rt };
+    if (N !== rt)
+      throw new Error("invZ was invalid");
+    return { x: B, y: R };
+  }), l = ge((b) => {
+    const { a: h, d: x } = t;
+    if (b.is0())
+      throw new Error("bad point: ZERO");
+    const { ex: v, ey: A, ez: L, et: B } = b, R = o(v * v), N = o(A * A), q = o(L * L), g = o(q * q), _ = o(R * h), m = o(q * o(_ + N)), y = o(g + o(x * o(R * N)));
+    if (m !== y)
+      throw new Error("bad point: equation left != right (1)");
+    const E = o(v * A), S = o(L * B);
+    if (E !== S)
+      throw new Error("bad point: equation left != right (2)");
+    return !0;
+  });
+  class d {
+    constructor(h, x, v, A) {
+      this.ex = u("x", h), this.ey = u("y", x), this.ez = u("z", v, !0), this.et = u("t", A), Object.freeze(this);
+    }
+    get x() {
+      return this.toAffine().x;
+    }
+    get y() {
+      return this.toAffine().y;
+    }
+    static fromAffine(h) {
+      if (h instanceof d)
+        throw new Error("extended point not allowed");
+      const { x, y: v } = h || {};
+      return u("x", x), u("y", v), new d(x, v, rt, o(x * v));
+    }
+    static normalizeZ(h) {
+      return Sr(d, "ez", h);
+    }
+    // Multiscalar Multiplication
+    static msm(h, x) {
+      return un(d, r, h, x);
+    }
+    // "Private method", don't use it directly
+    _setWindowSize(h) {
+      this.precompute(h);
+    }
+    precompute(h = 8, x = !0) {
+      return p.setWindowSize(this, h), x || this.multiply(Te), this;
+    }
+    // Not required for fromHex(), which always creates valid points.
+    // Could be useful for fromAffine().
+    assertValidity() {
+      l(this);
+    }
+    // Compare one point to another.
+    equals(h) {
+      a(h);
+      const { ex: x, ey: v, ez: A } = this, { ex: L, ey: B, ez: R } = h, N = o(x * R), q = o(L * A), g = o(v * R), _ = o(B * A);
+      return N === q && g === _;
+    }
+    is0() {
+      return this.equals(d.ZERO);
+    }
+    negate() {
+      return new d(o(-this.ex), this.ey, this.ez, o(-this.et));
+    }
+    // Fast algo for doubling Extended Point.
+    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
+    // Cost: 4M + 4S + 1*a + 6add + 1*2.
+    double() {
+      const { a: h } = t, { ex: x, ey: v, ez: A } = this, L = o(x * x), B = o(v * v), R = o(Te * o(A * A)), N = o(h * L), q = x + v, g = o(o(q * q) - L - B), _ = N + B, m = _ - R, y = N - B, E = o(g * m), S = o(_ * y), I = o(g * y), O = o(m * _);
+      return new d(E, S, O, I);
+    }
+    // Fast algo for adding 2 Extended Points.
+    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
+    // Cost: 9M + 1*a + 1*d + 7add.
+    add(h) {
+      a(h);
+      const { a: x, d: v } = t, { ex: A, ey: L, ez: B, et: R } = this, { ex: N, ey: q, ez: g, et: _ } = h, m = o(A * N), y = o(L * q), E = o(R * v * _), S = o(B * g), I = o((A + L) * (N + q) - m - y), O = S - E, H = S + E, k = o(y - x * m), Z = o(I * O), U = o(H * k), T = o(I * k), M = o(O * H);
+      return new d(Z, U, M, T);
+    }
+    subtract(h) {
+      return this.add(h.negate());
+    }
+    // Constant-time multiplication.
+    multiply(h) {
+      const x = h;
+      Xt("scalar", x, rt, s);
+      const { p: v, f: A } = p.wNAFCached(this, x, d.normalizeZ);
+      return d.normalizeZ([v, A])[0];
+    }
+    // Non-constant-time multiplication. Uses double-and-add algorithm.
+    // It's faster, but should only be used when you don't care about
+    // an exposed private key e.g. sig verification.
+    // Does NOT allow scalars higher than CURVE.n.
+    // Accepts optional accumulator to merge with multiply (important for sparse scalars)
+    multiplyUnsafe(h, x = d.ZERO) {
+      const v = h;
+      return Xt("scalar", v, yt, s), v === yt ? d.ZERO : this.is0() || v === rt ? this : p.wNAFCachedUnsafe(this, v, d.normalizeZ, x);
+    }
+    // Checks if point is of small order.
+    // If you add something to small order point, you will have "dirty"
+    // point with torsion component.
+    // Multiplies point by cofactor and checks if the result is 0.
+    isSmallOrder() {
+      return this.multiplyUnsafe(i).is0();
+    }
+    // Multiplies point by curve order and checks if the result is 0.
+    // Returns `false` is the point is dirty.
+    isTorsionFree() {
+      return p.wNAFCachedUnsafe(this, s).is0();
+    }
+    // Converts Extended point to default (x, y) coordinates.
+    // Can accept precomputed Z^-1 - for example, from invertBatch.
+    toAffine(h) {
+      return w(this, h);
+    }
+    clearCofactor() {
+      return i === rt ? this : this.multiplyUnsafe(i);
+    }
+    static fromBytes(h, x = !1) {
+      return W(h), this.fromHex(h, x);
+    }
+    // Converts hash string or Uint8Array to Point.
+    // Uses algo from RFC8032 5.1.3.
+    static fromHex(h, x = !1) {
+      const { d: v, a: A } = t, L = n.BYTES;
+      h = z("pointHex", h, L), Ct("zip215", x);
+      const B = h.slice(), R = h[L - 1];
+      B[L - 1] = R & -129;
+      const N = Pt(B), q = x ? c : n.ORDER;
+      Xt("pointHex.y", N, yt, q);
+      const g = o(N * N), _ = o(g - rt), m = o(v * g - A);
+      let { isValid: y, value: E } = f(_, m);
+      if (!y)
+        throw new Error("Point.fromHex: invalid y coordinate");
+      const S = (E & rt) === rt, I = (R & 128) !== 0;
+      if (!x && E === yt && I)
+        throw new Error("Point.fromHex: x=0 and x_0=1");
+      return I !== S && (E = o(-E)), d.fromAffine({ x: E, y: N });
+    }
+    static fromPrivateScalar(h) {
+      return d.BASE.multiply(h);
+    }
+    toBytes() {
+      const { x: h, y: x } = this.toAffine(), v = Wt(x, n.BYTES);
+      return v[v.length - 1] |= h & rt ? 128 : 0, v;
+    }
+    /** @deprecated use `toBytes` */
+    toRawBytes() {
+      return this.toBytes();
+    }
+    toHex() {
+      return ht(this.toBytes());
+    }
+    toString() {
+      return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
+    }
+  }
+  d.BASE = new d(t.Gx, t.Gy, rt, o(t.Gx * t.Gy)), d.ZERO = new d(yt, rt, rt, yt), d.Fp = n, d.Fn = r;
+  const p = Or(d, r.BYTES * 8);
+  return d;
+}
+function $s(t, e) {
+  ue(e, {
+    hash: "function"
+  }, {
+    adjustScalarBytes: "function",
+    randomBytes: "function",
+    domain: "function",
+    prehash: "function",
+    mapToCurve: "function"
+  });
+  const { prehash: n, hash: r } = e, { BASE: i, Fp: s, Fn: c } = t, o = c.ORDER, f = e.randomBytes || Je, u = e.adjustScalarBytes || ((B) => B), a = e.domain || ((B, R, N) => {
+    if (Ct("phflag", N), R.length || N)
+      throw new Error("Contexts/pre-hash are not supported");
+    return B;
+  });
+  function w(B) {
+    return c.create(B);
+  }
+  function l(B) {
+    return w(Pt(B));
+  }
+  function d(B) {
+    const R = s.BYTES;
+    B = z("private key", B, R);
+    const N = z("hashed private key", r(B), 2 * R), q = u(N.slice(0, R)), g = N.slice(R, 2 * R), _ = l(q);
+    return { head: q, prefix: g, scalar: _ };
+  }
+  function p(B) {
+    const { head: R, prefix: N, scalar: q } = d(B), g = i.multiply(q), _ = g.toBytes();
+    return { head: R, prefix: N, scalar: q, point: g, pointBytes: _ };
+  }
+  function b(B) {
+    return p(B).pointBytes;
+  }
+  function h(B = Uint8Array.of(), ...R) {
+    const N = ut(...R);
+    return l(r(a(N, z("context", B), !!n)));
+  }
+  function x(B, R, N = {}) {
+    B = z("message", B), n && (B = n(B));
+    const { prefix: q, scalar: g, pointBytes: _ } = p(R), m = h(N.context, q, B), y = i.multiply(m).toBytes(), E = h(N.context, y, _, B), S = w(m + E * g);
+    Xt("signature.s", S, yt, o);
+    const I = s.BYTES, O = ut(y, Wt(S, I));
+    return z("result", O, I * 2);
+  }
+  const v = Rs;
+  function A(B, R, N, q = v) {
+    const { context: g, zip215: _ } = q, m = s.BYTES;
+    B = z("signature", B, 2 * m), R = z("message", R), N = z("publicKey", N, m), _ !== void 0 && Ct("zip215", _), n && (R = n(R));
+    const y = Pt(B.slice(m, 2 * m));
+    let E, S, I;
+    try {
+      E = t.fromHex(N, _), S = t.fromHex(B.slice(0, m), _), I = i.multiplyUnsafe(y);
+    } catch {
+      return !1;
+    }
+    if (!_ && E.isSmallOrder())
+      return !1;
+    const O = h(g, S.toBytes(), E.toBytes(), R);
+    return S.add(E.multiplyUnsafe(O)).subtract(I).clearCofactor().is0();
+  }
+  return i.precompute(8), { getPublicKey: b, sign: x, verify: A, utils: {
+    getExtendedPublicKey: p,
+    /** ed25519 priv keys are uniform 32b. No need to check for modulo bias, like in secp256k1. */
+    randomPrivateKey: () => f(s.BYTES),
+    /**
+     * We're doing scalar multiplication (used in getPublicKey etc) with precomputed BASE_POINT
+     * values. This slows down first getPublicKey() by milliseconds (see Speed section),
+     * but allows to speed-up subsequent getPublicKey() calls up to 20x.
+     * @param windowSize 2, 4, 8, 16
+     */
+    precompute(B = 8, R = t.BASE) {
+      return R.precompute(B, !1);
+    }
+  }, Point: t };
+}
+function Hs(t) {
+  const e = {
+    a: t.a,
+    d: t.d,
+    p: t.Fp.ORDER,
+    n: t.n,
+    h: t.h,
+    Gx: t.Gx,
+    Gy: t.Gy
+  }, n = t.Fp, r = zt(e.n, t.nBitLength, !0), i = { Fp: n, Fn: r, uvRatio: t.uvRatio }, s = {
+    hash: t.hash,
+    randomBytes: t.randomBytes,
+    adjustScalarBytes: t.adjustScalarBytes,
+    domain: t.domain,
+    prehash: t.prehash,
+    mapToCurve: t.mapToCurve
+  };
+  return { CURVE: e, curveOpts: i, eddsaOpts: s };
+}
+function ks(t, e) {
+  return Object.assign({}, e, { ExtendedPoint: e.Point, CURVE: t });
+}
+function Ts(t) {
+  const { CURVE: e, curveOpts: n, eddsaOpts: r } = Hs(t), i = Ns(e, n), s = $s(i, r);
+  return ks(t, s);
+}
+const ci = BigInt(0), fi = BigInt(1), ai = BigInt(2);
+const Us = BigInt(0), Bt = BigInt(1), Zn = BigInt(2), li = BigInt(3), Zs = BigInt(5), Ds = BigInt(8), ve = {
+  p: BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed"),
+  n: BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),
+  h: Ds,
+  a: BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),
+  d: BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),
+  Gx: BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),
+  Gy: BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")
+};
+function Ms(t) {
+  const e = BigInt(10), n = BigInt(20), r = BigInt(40), i = BigInt(80), s = ve.p, o = t * t % s * t % s, f = j(o, Zn, s) * o % s, u = j(f, Bt, s) * t % s, a = j(u, Zs, s) * u % s, w = j(a, e, s) * a % s, l = j(w, n, s) * w % s, d = j(l, r, s) * l % s, p = j(d, i, s) * d % s, b = j(p, i, s) * d % s, h = j(b, e, s) * a % s;
+  return { pow_p_5_8: j(h, Zn, s) * t % s, b2: o };
+}
+function Cs(t) {
+  return t[0] &= 248, t[31] &= 127, t[31] |= 64, t;
+}
+const Ke = /* @__PURE__ */ BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");
+function dn(t, e) {
+  const n = ve.p, r = V(e * e * e, n), i = V(r * r * e, n), s = Ms(t * i).pow_p_5_8;
+  let c = V(t * r * s, n);
+  const o = V(e * c * c, n), f = c, u = V(c * Ke, n), a = o === t, w = o === V(-t, n), l = o === V(-t * Ke, n);
+  return a && (c = f), (w || l) && (c = u), $t(c, n) && (c = V(-c, n)), { isValid: a || w, value: c };
+}
+const Gt = zt(ve.p, void 0, !0), zs = {
+  ...ve,
+  Fp: Gt,
+  hash: nn,
+  adjustScalarBytes: Cs,
+  // dom2
+  // Ratio of u to v. Allows us to combine inversion and square root. Uses algo from RFC8032 5.1.3.
+  // Constant-time, u/√v
+  uvRatio: dn
+}, ct = Ts(zs);
+function Ue(t) {
+  if (!(t instanceof K))
+    throw new Error("RistrettoPoint expected");
+}
+const Pe = Ke, js = /* @__PURE__ */ BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235"), Vs = /* @__PURE__ */ BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578"), Ys = /* @__PURE__ */ BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838"), Gs = /* @__PURE__ */ BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952"), Dn = (t) => dn(Bt, t), Xs = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"), Ze = (t) => ct.CURVE.Fp.create(Pt(t) & Xs);
+function Mn(t) {
+  const { d: e } = ct.CURVE, n = ct.CURVE.Fp.ORDER, r = ct.CURVE.Fp.create, i = r(Pe * t * t), s = r((i + Bt) * Ys);
+  let c = BigInt(-1);
+  const o = r((c - e * i) * r(i + e));
+  let { isValid: f, value: u } = dn(s, o), a = r(u * t);
+  $t(a, n) || (a = r(-a)), f || (u = a), f || (c = i);
+  const w = r(c * (i - Bt) * Gs - o), l = u * u, d = r((u + u) * o), p = r(w * js), b = r(Bt - l), h = r(Bt + l);
+  return new ct.Point(r(d * h), r(b * p), r(p * h), r(d * b));
+}
+class K {
+  // Private property to discourage combining ExtendedPoint + RistrettoPoint
+  // Always use Ristretto encoding/decoding instead.
+  constructor(e) {
+    this.ep = e;
+  }
+  static fromAffine(e) {
+    return new K(ct.Point.fromAffine(e));
+  }
+  /**
+   * Takes uniform output of 64-byte hash function like sha512 and converts it to `RistrettoPoint`.
+   * The hash-to-group operation applies Elligator twice and adds the results.
+   * **Note:** this is one-way map, there is no conversion from point to hash.
+   * Described in [RFC9380](https://www.rfc-editor.org/rfc/rfc9380#appendix-B) and on
+   * the [website](https://ristretto.group/formulas/elligator.html).
+   * @param hex 64-byte output of a hash function
+   */
+  static hashToCurve(e) {
+    e = z("ristrettoHash", e, 64);
+    const n = Ze(e.slice(0, 32)), r = Mn(n), i = Ze(e.slice(32, 64)), s = Mn(i);
+    return new K(r.add(s));
+  }
+  static fromBytes(e) {
+    return W(e), this.fromHex(e);
+  }
+  /**
+   * Converts ristretto-encoded string to ristretto point.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).
+   * @param hex Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
+   */
+  static fromHex(e) {
+    e = z("ristrettoHex", e, 32);
+    const { a: n, d: r } = ct.CURVE, i = Gt.ORDER, s = Gt.create, c = "RistrettoPoint.fromHex: the hex is not valid encoding of RistrettoPoint", o = Ze(e);
+    if (!ts(Wt(o, 32), e) || $t(o, i))
+      throw new Error(c);
+    const f = s(o * o), u = s(Bt + n * f), a = s(Bt - n * f), w = s(u * u), l = s(a * a), d = s(n * r * w - l), { isValid: p, value: b } = Dn(s(d * l)), h = s(b * a), x = s(b * h * d);
+    let v = s((o + o) * h);
+    $t(v, i) && (v = s(-v));
+    const A = s(u * x), L = s(v * A);
+    if (!p || $t(L, i) || A === Us)
+      throw new Error(c);
+    return new K(new ct.Point(v, A, Bt, L));
+  }
+  static msm(e, n) {
+    const r = zt(ct.CURVE.n, ct.CURVE.nBitLength);
+    return un(K, r, e, n);
+  }
+  /**
+   * Encodes ristretto point to Uint8Array.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode).
+   */
+  toBytes() {
+    let { ex: e, ey: n, ez: r, et: i } = this.ep;
+    const s = Gt.ORDER, c = Gt.create, o = c(c(r + n) * c(r - n)), f = c(e * n), u = c(f * f), { value: a } = Dn(c(o * u)), w = c(a * o), l = c(a * f), d = c(w * l * i);
+    let p;
+    if ($t(i * d, s)) {
+      let h = c(n * Pe), x = c(e * Pe);
+      e = h, n = x, p = c(w * Vs);
+    } else
+      p = l;
+    $t(e * d, s) && (n = c(-n));
+    let b = c((r - n) * p);
+    return $t(b, s) && (b = c(-b)), Wt(b, 32);
+  }
+  /** @deprecated use `toBytes` */
+  toRawBytes() {
+    return this.toBytes();
+  }
+  toHex() {
+    return ht(this.toBytes());
+  }
+  toString() {
+    return this.toHex();
+  }
+  /**
+   * Compares two Ristretto points.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals).
+   */
+  equals(e) {
+    Ue(e);
+    const { ex: n, ey: r } = this.ep, { ex: i, ey: s } = e.ep, c = Gt.create, o = c(n * s) === c(r * i), f = c(r * s) === c(n * i);
+    return o || f;
+  }
+  add(e) {
+    return Ue(e), new K(this.ep.add(e.ep));
+  }
+  subtract(e) {
+    return Ue(e), new K(this.ep.subtract(e.ep));
+  }
+  multiply(e) {
+    return new K(this.ep.multiply(e));
+  }
+  multiplyUnsafe(e) {
+    return new K(this.ep.multiplyUnsafe(e));
+  }
+  double() {
+    return new K(this.ep.double());
+  }
+  negate() {
+    return new K(this.ep.negate());
+  }
+}
+const ui = (K.BASE || (K.BASE = new K(ct.Point.BASE)), K.ZERO || (K.ZERO = new K(ct.Point.ZERO)), K);
+export {
+  ni as R,
+  oi as a,
+  Ks as b,
+  ut as c,
+  ce as d,
+  re as e,
+  dt as f,
+  Mt as g,
+  on as h,
+  pe as i,
+  si as j,
+  ri as k,
+  ii as l,
+  P as m,
+  fe as n,
+  Pt as o,
+  Jn as p,
+  ui as q,
+  Je as r,
+  Ps as s,
+  We as u
+};