import { r as xe, a as Fe, g as $e } from "./index2.js";
function et(s, x) {
  for (var M = 0; M < x.length; M++) {
    const m = x[M];
    if (typeof m != "string" && !Array.isArray(m)) {
      for (const K in m)
        if (K !== "default" && !(K in s)) {
          const T = Object.getOwnPropertyDescriptor(m, K);
          T && Object.defineProperty(s, K, T.get ? T : {
            enumerable: !0,
            get: () => m[K]
          });
        }
    }
  }
  return Object.freeze(Object.defineProperty(s, Symbol.toStringTag, { value: "Module" }));
}
var be = {}, He = {}, Ie = {}, Ue = {}, Pe = {}, Me;
function tt() {
  return Me || (Me = 1, (function(s) {
    Object.defineProperty(s, "__esModule", { value: !0 }), s.hmac = s.HMAC = void 0;
    const x = /* @__PURE__ */ xe();
    class M extends x.Hash {
      constructor(T, ie) {
        super(), this.finished = !1, this.destroyed = !1, (0, x.ahash)(T);
        const Q = (0, x.toBytes)(ie);
        if (this.iHash = T.create(), typeof this.iHash.update != "function")
          throw new Error("Expected instance of class which extends utils.Hash");
        this.blockLen = this.iHash.blockLen, this.outputLen = this.iHash.outputLen;
        const ne = this.blockLen, oe = new Uint8Array(ne);
        oe.set(Q.length > ne ? T.create().update(Q).digest() : Q);
        for (let fe = 0; fe < oe.length; fe++)
          oe[fe] ^= 54;
        this.iHash.update(oe), this.oHash = T.create();
        for (let fe = 0; fe < oe.length; fe++)
          oe[fe] ^= 106;
        this.oHash.update(oe), (0, x.clean)(oe);
      }
      update(T) {
        return (0, x.aexists)(this), this.iHash.update(T), this;
      }
      digestInto(T) {
        (0, x.aexists)(this), (0, x.abytes)(T, this.outputLen), this.finished = !0, this.iHash.digestInto(T), this.oHash.update(T), this.oHash.digestInto(T), this.destroy();
      }
      digest() {
        const T = new Uint8Array(this.oHash.outputLen);
        return this.digestInto(T), T;
      }
      _cloneInto(T) {
        T || (T = Object.create(Object.getPrototypeOf(this), {}));
        const { oHash: ie, iHash: Q, finished: ne, destroyed: oe, blockLen: fe, outputLen: G } = this;
        return T = T, T.finished = ne, T.destroyed = oe, T.blockLen = fe, T.outputLen = G, T.oHash = ie._cloneInto(T.oHash), T.iHash = Q._cloneInto(T.iHash), T;
      }
      clone() {
        return this._cloneInto();
      }
      destroy() {
        this.destroyed = !0, this.oHash.destroy(), this.iHash.destroy();
      }
    }
    s.HMAC = M;
    const m = (K, T, ie) => new M(K, T).update(ie).digest();
    s.hmac = m, s.hmac.create = (K, T) => new M(K, T);
  })(Pe)), Pe;
}
var Le = {}, Ze;
function Ae() {
  return Ze || (Ze = 1, (function(s) {
    Object.defineProperty(s, "__esModule", { value: !0 }), s.notImplemented = s.bitMask = s.utf8ToBytes = s.randomBytes = s.isBytes = s.hexToBytes = s.concatBytes = s.bytesToUtf8 = s.bytesToHex = s.anumber = s.abytes = void 0, s.abool = T, s._abool2 = ie, s._abytes2 = Q, s.numberToHexUnpadded = ne, s.hexToNumber = oe, s.bytesToNumberBE = fe, s.bytesToNumberLE = G, s.numberToBytesBE = re, s.numberToBytesLE = H, s.numberToVarBytesBE = j, s.ensureBytes = X, s.equalBytes = D, s.copyBytes = se, s.asciiToBytes = J, s.inRange = ce, s.aInRange = le, s.bitLen = R, s.bitGet = y, s.bitSet = A, s.createHmacDrbg = q, s.validateObject = F, s.isHash = S, s._validateObject = v, s.memoized = a;
    /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
    const x = /* @__PURE__ */ xe();
    var M = /* @__PURE__ */ xe();
    Object.defineProperty(s, "abytes", { enumerable: !0, get: function() {
      return M.abytes;
    } }), Object.defineProperty(s, "anumber", { enumerable: !0, get: function() {
      return M.anumber;
    } }), Object.defineProperty(s, "bytesToHex", { enumerable: !0, get: function() {
      return M.bytesToHex;
    } }), Object.defineProperty(s, "bytesToUtf8", { enumerable: !0, get: function() {
      return M.bytesToUtf8;
    } }), Object.defineProperty(s, "concatBytes", { enumerable: !0, get: function() {
      return M.concatBytes;
    } }), Object.defineProperty(s, "hexToBytes", { enumerable: !0, get: function() {
      return M.hexToBytes;
    } }), Object.defineProperty(s, "isBytes", { enumerable: !0, get: function() {
      return M.isBytes;
    } }), Object.defineProperty(s, "randomBytes", { enumerable: !0, get: function() {
      return M.randomBytes;
    } }), Object.defineProperty(s, "utf8ToBytes", { enumerable: !0, get: function() {
      return M.utf8ToBytes;
    } });
    const m = /* @__PURE__ */ BigInt(0), K = /* @__PURE__ */ BigInt(1);
    function T(r, e) {
      if (typeof e != "boolean")
        throw new Error(r + " boolean expected, got " + e);
    }
    function ie(r, e = "") {
      if (typeof r != "boolean") {
        const f = e && `"${e}"`;
        throw new Error(f + "expected boolean, got type=" + typeof r);
      }
      return r;
    }
    function Q(r, e, f = "") {
      const g = (0, x.isBytes)(r), n = r == null ? void 0 : r.length, i = e !== void 0;
      if (!g || i && n !== e) {
        const c = f && `"${f}" `, h = i ? ` of length ${e}` : "", p = g ? `length=${n}` : `type=${typeof r}`;
        throw new Error(c + "expected Uint8Array" + h + ", got " + p);
      }
      return r;
    }
    function ne(r) {
      const e = r.toString(16);
      return e.length & 1 ? "0" + e : e;
    }
    function oe(r) {
      if (typeof r != "string")
        throw new Error("hex string expected, got " + typeof r);
      return r === "" ? m : BigInt("0x" + r);
    }
    function fe(r) {
      return oe((0, x.bytesToHex)(r));
    }
    function G(r) {
      return (0, x.abytes)(r), oe((0, x.bytesToHex)(Uint8Array.from(r).reverse()));
    }
    function re(r, e) {
      return (0, x.hexToBytes)(r.toString(16).padStart(e * 2, "0"));
    }
    function H(r, e) {
      return re(r, e).reverse();
    }
    function j(r) {
      return (0, x.hexToBytes)(ne(r));
    }
    function X(r, e, f) {
      let g;
      if (typeof e == "string")
        try {
          g = (0, x.hexToBytes)(e);
        } catch (i) {
          throw new Error(r + " must be hex string or Uint8Array, cause: " + i);
        }
      else if ((0, x.isBytes)(e))
        g = Uint8Array.from(e);
      else
        throw new Error(r + " must be hex string or Uint8Array");
      const n = g.length;
      if (typeof f == "number" && n !== f)
        throw new Error(r + " of length " + f + " expected, got " + n);
      return g;
    }
    function D(r, e) {
      if (r.length !== e.length)
        return !1;
      let f = 0;
      for (let g = 0; g < r.length; g++)
        f |= r[g] ^ e[g];
      return f === 0;
    }
    function se(r) {
      return Uint8Array.from(r);
    }
    function J(r) {
      return Uint8Array.from(r, (e, f) => {
        const g = e.charCodeAt(0);
        if (e.length !== 1 || g > 127)
          throw new Error(`string contains non-ASCII character "${r[f]}" with code ${g} at position ${f}`);
        return g;
      });
    }
    const $ = (r) => typeof r == "bigint" && m <= r;
    function ce(r, e, f) {
      return $(r) && $(e) && $(f) && e <= r && r < f;
    }
    function le(r, e, f, g) {
      if (!ce(e, f, g))
        throw new Error("expected valid " + r + ": " + f + " <= n < " + g + ", got " + e);
    }
    function R(r) {
      let e;
      for (e = 0; r > m; r >>= K, e += 1)
        ;
      return e;
    }
    function y(r, e) {
      return r >> BigInt(e) & K;
    }
    function A(r, e, f) {
      return r | (f ? K : m) << BigInt(e);
    }
    const O = (r) => (K << BigInt(r)) - K;
    s.bitMask = O;
    function q(r, e, f) {
      if (typeof r != "number" || r < 2)
        throw new Error("hashLen must be a number");
      if (typeof e != "number" || e < 2)
        throw new Error("qByteLen must be a number");
      if (typeof f != "function")
        throw new Error("hmacFn must be a function");
      const g = (U) => new Uint8Array(U), n = (U) => Uint8Array.of(U);
      let i = g(r), c = g(r), h = 0;
      const p = () => {
        i.fill(1), c.fill(0), h = 0;
      }, C = (...U) => f(c, i, ...U), Z = (U = g(0)) => {
        c = C(n(0), U), i = C(), U.length !== 0 && (c = C(n(1), U), i = C());
      }, _ = () => {
        if (h++ >= 1e3)
          throw new Error("drbg: tried 1000 values");
        let U = 0;
        const Y = [];
        for (; U < e; ) {
          i = C();
          const V = i.slice();
          Y.push(V), U += i.length;
        }
        return (0, x.concatBytes)(...Y);
      };
      return (U, Y) => {
        p(), Z(U);
        let V;
        for (; !(V = Y(_())); )
          Z();
        return p(), V;
      };
    }
    const z = {
      bigint: (r) => typeof r == "bigint",
      function: (r) => typeof r == "function",
      boolean: (r) => typeof r == "boolean",
      string: (r) => typeof r == "string",
      stringOrUint8Array: (r) => typeof r == "string" || (0, x.isBytes)(r),
      isSafeInteger: (r) => Number.isSafeInteger(r),
      array: (r) => Array.isArray(r),
      field: (r, e) => e.Fp.isValid(r),
      hash: (r) => typeof r == "function" && Number.isSafeInteger(r.outputLen)
    };
    function F(r, e, f = {}) {
      const g = (n, i, c) => {
        const h = z[i];
        if (typeof h != "function")
          throw new Error("invalid validator function");
        const p = r[n];
        if (!(c && p === void 0) && !h(p, r))
          throw new Error("param " + String(n) + " is invalid. Expected " + i + ", got " + p);
      };
      for (const [n, i] of Object.entries(e))
        g(n, i, !1);
      for (const [n, i] of Object.entries(f))
        g(n, i, !0);
      return r;
    }
    function S(r) {
      return typeof r == "function" && Number.isSafeInteger(r.outputLen);
    }
    function v(r, e, f = {}) {
      if (!r || typeof r != "object")
        throw new Error("expected valid options object");
      function g(n, i, c) {
        const h = r[n];
        if (c && h === void 0)
          return;
        const p = typeof h;
        if (p !== i || h === null)
          throw new Error(`param "${n}" is invalid: expected ${i}, got ${p}`);
      }
      Object.entries(e).forEach(([n, i]) => g(n, i, !1)), Object.entries(f).forEach(([n, i]) => g(n, i, !0));
    }
    const t = () => {
      throw new Error("not implemented");
    };
    s.notImplemented = t;
    function a(r) {
      const e = /* @__PURE__ */ new WeakMap();
      return (f, ...g) => {
        const n = e.get(f);
        if (n !== void 0)
          return n;
        const i = r(f, ...g);
        return e.set(f, i), i;
      };
    }
  })(Le)), Le;
}
var Te = {}, he = {}, De;
function Ne() {
  if (De) return he;
  De = 1, Object.defineProperty(he, "__esModule", { value: !0 }), he.isNegativeLE = void 0, he.mod = G, he.pow = re, he.pow2 = H, he.invert = j, he.tonelliShanks = $, he.FpSqrt = ce, he.validateField = y, he.FpPow = A, he.FpInvertBatch = O, he.FpDiv = q, he.FpLegendre = z, he.FpIsSquare = F, he.nLength = S, he.Field = v, he.FpSqrtOdd = t, he.FpSqrtEven = a, he.hashToPrivateScalar = r, he.getFieldBytesLength = e, he.getMinHashLength = f, he.mapHashToField = g;
  /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
  const s = /* @__PURE__ */ Ae(), x = BigInt(0), M = BigInt(1), m = /* @__PURE__ */ BigInt(2), K = /* @__PURE__ */ BigInt(3), T = /* @__PURE__ */ BigInt(4), ie = /* @__PURE__ */ BigInt(5), Q = /* @__PURE__ */ BigInt(7), ne = /* @__PURE__ */ BigInt(8), oe = /* @__PURE__ */ BigInt(9), fe = /* @__PURE__ */ BigInt(16);
  function G(n, i) {
    const c = n % i;
    return c >= x ? c : i + c;
  }
  function re(n, i, c) {
    return A(v(c), n, i);
  }
  function H(n, i, c) {
    let h = n;
    for (; i-- > x; )
      h *= h, h %= c;
    return h;
  }
  function j(n, i) {
    if (n === x)
      throw new Error("invert: expected non-zero number");
    if (i <= x)
      throw new Error("invert: expected positive modulus, got " + i);
    let c = G(n, i), h = i, p = x, C = M;
    for (; c !== x; ) {
      const _ = h / c, B = h % c, U = p - C * _;
      h = c, c = B, p = C, C = U;
    }
    if (h !== M)
      throw new Error("invert: does not exist");
    return G(p, i);
  }
  function X(n, i, c) {
    if (!n.eql(n.sqr(i), c))
      throw new Error("Cannot find square root");
  }
  function D(n, i) {
    const c = (n.ORDER + M) / T, h = n.pow(i, c);
    return X(n, h, i), h;
  }
  function se(n, i) {
    const c = (n.ORDER - ie) / ne, h = n.mul(i, m), p = n.pow(h, c), C = n.mul(i, p), Z = n.mul(n.mul(C, m), p), _ = n.mul(C, n.sub(Z, n.ONE));
    return X(n, _, i), _;
  }
  function J(n) {
    const i = v(n), c = $(n), h = c(i, i.neg(i.ONE)), p = c(i, h), C = c(i, i.neg(h)), Z = (n + Q) / fe;
    return (_, B) => {
      let U = _.pow(B, Z), Y = _.mul(U, h);
      const V = _.mul(U, p), l = _.mul(U, C), L = _.eql(_.sqr(Y), B), ee = _.eql(_.sqr(V), B);
      U = _.cmov(U, Y, L), Y = _.cmov(l, V, ee);
      const ye = _.eql(_.sqr(Y), B), Be = _.cmov(U, Y, ye);
      return X(_, Be, B), Be;
    };
  }
  function $(n) {
    if (n < K)
      throw new Error("sqrt is not defined for small field");
    let i = n - M, c = 0;
    for (; i % m === x; )
      i /= m, c++;
    let h = m;
    const p = v(n);
    for (; z(p, h) === 1; )
      if (h++ > 1e3)
        throw new Error("Cannot find square root: probably non-prime P");
    if (c === 1)
      return D;
    let C = p.pow(h, i);
    const Z = (i + M) / m;
    return function(B, U) {
      if (B.is0(U))
        return U;
      if (z(B, U) !== 1)
        throw new Error("Cannot find square root");
      let Y = c, V = B.mul(B.ONE, C), l = B.pow(U, i), L = B.pow(U, Z);
      for (; !B.eql(l, B.ONE); ) {
        if (B.is0(l))
          return B.ZERO;
        let ee = 1, ye = B.sqr(l);
        for (; !B.eql(ye, B.ONE); )
          if (ee++, ye = B.sqr(ye), ee === Y)
            throw new Error("Cannot find square root");
        const Be = M << BigInt(Y - ee - 1), ve = B.pow(V, Be);
        Y = ee, V = B.sqr(ve), l = B.mul(l, V), L = B.mul(L, ve);
      }
      return L;
    };
  }
  function ce(n) {
    return n % T === K ? D : n % ne === ie ? se : n % fe === oe ? J(n) : $(n);
  }
  const le = (n, i) => (G(n, i) & M) === M;
  he.isNegativeLE = le;
  const R = [
    "create",
    "isValid",
    "is0",
    "neg",
    "inv",
    "sqrt",
    "sqr",
    "eql",
    "add",
    "sub",
    "mul",
    "pow",
    "div",
    "addN",
    "subN",
    "mulN",
    "sqrN"
  ];
  function y(n) {
    const i = {
      ORDER: "bigint",
      MASK: "bigint",
      BYTES: "number",
      BITS: "number"
    }, c = R.reduce((h, p) => (h[p] = "function", h), i);
    return (0, s._validateObject)(n, c), n;
  }
  function A(n, i, c) {
    if (c < x)
      throw new Error("invalid exponent, negatives unsupported");
    if (c === x)
      return n.ONE;
    if (c === M)
      return i;
    let h = n.ONE, p = i;
    for (; c > x; )
      c & M && (h = n.mul(h, p)), p = n.sqr(p), c >>= M;
    return h;
  }
  function O(n, i, c = !1) {
    const h = new Array(i.length).fill(c ? n.ZERO : void 0), p = i.reduce((Z, _, B) => n.is0(_) ? Z : (h[B] = Z, n.mul(Z, _)), n.ONE), C = n.inv(p);
    return i.reduceRight((Z, _, B) => n.is0(_) ? Z : (h[B] = n.mul(Z, h[B]), n.mul(Z, _)), C), h;
  }
  function q(n, i, c) {
    return n.mul(i, typeof c == "bigint" ? j(c, n.ORDER) : n.inv(c));
  }
  function z(n, i) {
    const c = (n.ORDER - M) / m, h = n.pow(i, c), p = n.eql(h, n.ONE), C = n.eql(h, n.ZERO), Z = n.eql(h, n.neg(n.ONE));
    if (!p && !C && !Z)
      throw new Error("invalid Legendre symbol result");
    return p ? 1 : C ? 0 : -1;
  }
  function F(n, i) {
    return z(n, i) === 1;
  }
  function S(n, i) {
    i !== void 0 && (0, s.anumber)(i);
    const c = i !== void 0 ? i : n.toString(2).length, h = Math.ceil(c / 8);
    return { nBitLength: c, nByteLength: h };
  }
  function v(n, i, c = !1, h = {}) {
    if (n <= x)
      throw new Error("invalid field: expected ORDER > 0, got " + n);
    let p, C, Z = !1, _;
    if (typeof i == "object" && i != null) {
      if (h.sqrt || c)
        throw new Error("cannot specify opts in two arguments");
      const l = i;
      l.BITS && (p = l.BITS), l.sqrt && (C = l.sqrt), typeof l.isLE == "boolean" && (c = l.isLE), typeof l.modFromBytes == "boolean" && (Z = l.modFromBytes), _ = l.allowedLengths;
    } else
      typeof i == "number" && (p = i), h.sqrt && (C = h.sqrt);
    const { nBitLength: B, nByteLength: U } = S(n, p);
    if (U > 2048)
      throw new Error("invalid field: expected ORDER of <= 2048 bytes");
    let Y;
    const V = Object.freeze({
      ORDER: n,
      isLE: c,
      BITS: B,
      BYTES: U,
      MASK: (0, s.bitMask)(B),
      ZERO: x,
      ONE: M,
      allowedLengths: _,
      create: (l) => G(l, n),
      isValid: (l) => {
        if (typeof l != "bigint")
          throw new Error("invalid field element: expected bigint, got " + typeof l);
        return x <= l && l < n;
      },
      is0: (l) => l === x,
      // is valid and invertible
      isValidNot0: (l) => !V.is0(l) && V.isValid(l),
      isOdd: (l) => (l & M) === M,
      neg: (l) => G(-l, n),
      eql: (l, L) => l === L,
      sqr: (l) => G(l * l, n),
      add: (l, L) => G(l + L, n),
      sub: (l, L) => G(l - L, n),
      mul: (l, L) => G(l * L, n),
      pow: (l, L) => A(V, l, L),
      div: (l, L) => G(l * j(L, n), n),
      // Same as above, but doesn't normalize
      sqrN: (l) => l * l,
      addN: (l, L) => l + L,
      subN: (l, L) => l - L,
      mulN: (l, L) => l * L,
      inv: (l) => j(l, n),
      sqrt: C || ((l) => (Y || (Y = ce(n)), Y(V, l))),
      toBytes: (l) => c ? (0, s.numberToBytesLE)(l, U) : (0, s.numberToBytesBE)(l, U),
      fromBytes: (l, L = !0) => {
        if (_) {
          if (!_.includes(l.length) || l.length > U)
            throw new Error("Field.fromBytes: expected " + _ + " bytes, got " + l.length);
          const ye = new Uint8Array(U);
          ye.set(l, c ? 0 : ye.length - l.length), l = ye;
        }
        if (l.length !== U)
          throw new Error("Field.fromBytes: expected " + U + " bytes, got " + l.length);
        let ee = c ? (0, s.bytesToNumberLE)(l) : (0, s.bytesToNumberBE)(l);
        if (Z && (ee = G(ee, n)), !L && !V.isValid(ee))
          throw new Error("invalid field element: outside of range 0..ORDER");
        return ee;
      },
      // TODO: we don't need it here, move out to separate fn
      invertBatch: (l) => O(V, l),
      // We can't move this out because Fp6, Fp12 implement it
      // and it's unclear what to return in there.
      cmov: (l, L, ee) => ee ? L : l
    });
    return Object.freeze(V);
  }
  function t(n, i) {
    if (!n.isOdd)
      throw new Error("Field doesn't have isOdd");
    const c = n.sqrt(i);
    return n.isOdd(c) ? c : n.neg(c);
  }
  function a(n, i) {
    if (!n.isOdd)
      throw new Error("Field doesn't have isOdd");
    const c = n.sqrt(i);
    return n.isOdd(c) ? n.neg(c) : c;
  }
  function r(n, i, c = !1) {
    n = (0, s.ensureBytes)("privateHash", n);
    const h = n.length, p = S(i).nByteLength + 8;
    if (p < 24 || h < p || h > 1024)
      throw new Error("hashToPrivateScalar: expected " + p + "-1024 bytes of input, got " + h);
    const C = c ? (0, s.bytesToNumberLE)(n) : (0, s.bytesToNumberBE)(n);
    return G(C, i - M) + M;
  }
  function e(n) {
    if (typeof n != "bigint")
      throw new Error("field order must be bigint");
    const i = n.toString(2).length;
    return Math.ceil(i / 8);
  }
  function f(n) {
    const i = e(n);
    return i + Math.ceil(i / 2);
  }
  function g(n, i, c = !1) {
    const h = n.length, p = e(i), C = f(i);
    if (h < 16 || h < C || h > 1024)
      throw new Error("expected " + C + "-1024 bytes of input, got " + h);
    const Z = c ? (0, s.bytesToNumberLE)(n) : (0, s.bytesToNumberBE)(n), _ = G(Z, i - M) + M;
    return c ? (0, s.numberToBytesLE)(_, p) : (0, s.numberToBytesBE)(_, p);
  }
  return he;
}
var Ve;
function nt() {
  if (Ve) return Te;
  Ve = 1, Object.defineProperty(Te, "__esModule", { value: !0 }), Te.wNAF = void 0, Te.negateCt = K, Te.normalizeZ = T, Te.mulEndoUnsafe = D, Te.pippenger = se, Te.precomputeMSMUnsafe = J, Te.validateBasic = $, Te._createCurveFields = le;
  /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
  const s = /* @__PURE__ */ Ae(), x = /* @__PURE__ */ Ne(), M = BigInt(0), m = BigInt(1);
  function K(R, y) {
    const A = y.negate();
    return R ? A : y;
  }
  function T(R, y) {
    const A = (0, x.FpInvertBatch)(R.Fp, y.map((O) => O.Z));
    return y.map((O, q) => R.fromAffine(O.toAffine(A[q])));
  }
  function ie(R, y) {
    if (!Number.isSafeInteger(R) || R <= 0 || R > y)
      throw new Error("invalid window size, expected [1.." + y + "], got W=" + R);
  }
  function Q(R, y) {
    ie(R, y);
    const A = Math.ceil(y / R) + 1, O = 2 ** (R - 1), q = 2 ** R, z = (0, s.bitMask)(R), F = BigInt(R);
    return { windows: A, windowSize: O, mask: z, maxNumber: q, shiftBy: F };
  }
  function ne(R, y, A) {
    const { windowSize: O, mask: q, maxNumber: z, shiftBy: F } = A;
    let S = Number(R & q), v = R >> F;
    S > O && (S -= z, v += m);
    const t = y * O, a = t + Math.abs(S) - 1, r = S === 0, e = S < 0, f = y % 2 !== 0;
    return { nextN: v, offset: a, isZero: r, isNeg: e, isNegF: f, offsetF: t };
  }
  function oe(R, y) {
    if (!Array.isArray(R))
      throw new Error("array expected");
    R.forEach((A, O) => {
      if (!(A instanceof y))
        throw new Error("invalid point at index " + O);
    });
  }
  function fe(R, y) {
    if (!Array.isArray(R))
      throw new Error("array of scalars expected");
    R.forEach((A, O) => {
      if (!y.isValid(A))
        throw new Error("invalid scalar at index " + O);
    });
  }
  const G = /* @__PURE__ */ new WeakMap(), re = /* @__PURE__ */ new WeakMap();
  function H(R) {
    return re.get(R) || 1;
  }
  function j(R) {
    if (R !== M)
      throw new Error("invalid wNAF");
  }
  class X {
    // Parametrized with a given Point class (not individual point)
    constructor(y, A) {
      this.BASE = y.BASE, this.ZERO = y.ZERO, this.Fn = y.Fn, this.bits = A;
    }
    // non-const time multiplication ladder
    _unsafeLadder(y, A, O = this.ZERO) {
      let q = y;
      for (; A > M; )
        A & m && (O = O.add(q)), q = q.double(), A >>= m;
      return O;
    }
    /**
     * Creates a wNAF precomputation window. Used for caching.
     * Default window size is set by `utils.precompute()` and is equal to 8.
     * Number of precomputed points depends on the curve size:
     * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
     * - 𝑊 is the window size
     * - 𝑛 is the bitlength of the curve order.
     * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
     * @param point Point instance
     * @param W window size
     * @returns precomputed point tables flattened to a single array
     */
    precomputeWindow(y, A) {
      const { windows: O, windowSize: q } = Q(A, this.bits), z = [];
      let F = y, S = F;
      for (let v = 0; v < O; v++) {
        S = F, z.push(S);
        for (let t = 1; t < q; t++)
          S = S.add(F), z.push(S);
        F = S.double();
      }
      return z;
    }
    /**
     * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
     * More compact implementation:
     * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541
     * @returns real and fake (for const-time) points
     */
    wNAF(y, A, O) {
      if (!this.Fn.isValid(O))
        throw new Error("invalid scalar");
      let q = this.ZERO, z = this.BASE;
      const F = Q(y, this.bits);
      for (let S = 0; S < F.windows; S++) {
        const { nextN: v, offset: t, isZero: a, isNeg: r, isNegF: e, offsetF: f } = ne(O, S, F);
        O = v, a ? z = z.add(K(e, A[f])) : q = q.add(K(r, A[t]));
      }
      return j(O), { p: q, f: z };
    }
    /**
     * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.
     * @param acc accumulator point to add result of multiplication
     * @returns point
     */
    wNAFUnsafe(y, A, O, q = this.ZERO) {
      const z = Q(y, this.bits);
      for (let F = 0; F < z.windows && O !== M; F++) {
        const { nextN: S, offset: v, isZero: t, isNeg: a } = ne(O, F, z);
        if (O = S, !t) {
          const r = A[v];
          q = q.add(a ? r.negate() : r);
        }
      }
      return j(O), q;
    }
    getPrecomputes(y, A, O) {
      let q = G.get(A);
      return q || (q = this.precomputeWindow(A, y), y !== 1 && (typeof O == "function" && (q = O(q)), G.set(A, q))), q;
    }
    cached(y, A, O) {
      const q = H(y);
      return this.wNAF(q, this.getPrecomputes(q, y, O), A);
    }
    unsafe(y, A, O, q) {
      const z = H(y);
      return z === 1 ? this._unsafeLadder(y, A, q) : this.wNAFUnsafe(z, this.getPrecomputes(z, y, O), A, q);
    }
    // We calculate precomputes for elliptic curve point multiplication
    // using windowed method. This specifies window size and
    // stores precomputed values. Usually only base point would be precomputed.
    createCache(y, A) {
      ie(A, this.bits), re.set(y, A), G.delete(y);
    }
    hasCache(y) {
      return H(y) !== 1;
    }
  }
  Te.wNAF = X;
  function D(R, y, A, O) {
    let q = y, z = R.ZERO, F = R.ZERO;
    for (; A > M || O > M; )
      A & m && (z = z.add(q)), O & m && (F = F.add(q)), q = q.double(), A >>= m, O >>= m;
    return { p1: z, p2: F };
  }
  function se(R, y, A, O) {
    oe(A, R), fe(O, y);
    const q = A.length, z = O.length;
    if (q !== z)
      throw new Error("arrays of points and scalars must have equal length");
    const F = R.ZERO, S = (0, s.bitLen)(BigInt(q));
    let v = 1;
    S > 12 ? v = S - 3 : S > 4 ? v = S - 2 : S > 0 && (v = 2);
    const t = (0, s.bitMask)(v), a = new Array(Number(t) + 1).fill(F), r = Math.floor((y.BITS - 1) / v) * v;
    let e = F;
    for (let f = r; f >= 0; f -= v) {
      a.fill(F);
      for (let n = 0; n < z; n++) {
        const i = O[n], c = Number(i >> BigInt(f) & t);
        a[c] = a[c].add(A[n]);
      }
      let g = F;
      for (let n = a.length - 1, i = F; n > 0; n--)
        i = i.add(a[n]), g = g.add(i);
      if (e = e.add(g), f !== 0)
        for (let n = 0; n < v; n++)
          e = e.double();
    }
    return e;
  }
  function J(R, y, A, O) {
    ie(O, y.BITS), oe(A, R);
    const q = R.ZERO, z = 2 ** O - 1, F = Math.ceil(y.BITS / O), S = (0, s.bitMask)(O), v = A.map((t) => {
      const a = [];
      for (let r = 0, e = t; r < z; r++)
        a.push(e), e = e.add(t);
      return a;
    });
    return (t) => {
      if (fe(t, y), t.length > A.length)
        throw new Error("array of scalars must be smaller than array of points");
      let a = q;
      for (let r = 0; r < F; r++) {
        if (a !== q)
          for (let f = 0; f < O; f++)
            a = a.double();
        const e = BigInt(F * O - (r + 1) * O);
        for (let f = 0; f < t.length; f++) {
          const g = t[f], n = Number(g >> e & S);
          n && (a = a.add(v[f][n - 1]));
        }
      }
      return a;
    };
  }
  function $(R) {
    return (0, x.validateField)(R.Fp), (0, s.validateObject)(R, {
      n: "bigint",
      h: "bigint",
      Gx: "field",
      Gy: "field"
    }, {
      nBitLength: "isSafeInteger",
      nByteLength: "isSafeInteger"
    }), Object.freeze({
      ...(0, x.nLength)(R.n, R.nBitLength),
      ...R,
      p: R.Fp.ORDER
    });
  }
  function ce(R, y, A) {
    if (y) {
      if (y.ORDER !== R)
        throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
      return (0, x.validateField)(y), y;
    } else
      return (0, x.Field)(R, { isLE: A });
  }
  function le(R, y, A = {}, O) {
    if (O === void 0 && (O = R === "edwards"), !y || typeof y != "object")
      throw new Error(`expected valid ${R} CURVE object`);
    for (const v of ["p", "n", "h"]) {
      const t = y[v];
      if (!(typeof t == "bigint" && t > M))
        throw new Error(`CURVE.${v} must be positive bigint`);
    }
    const q = ce(y.p, A.Fp, O), z = ce(y.n, A.Fn, O), S = ["Gx", "Gy", "a", R === "weierstrass" ? "b" : "d"];
    for (const v of S)
      if (!q.isValid(y[v]))
        throw new Error(`CURVE.${v} must be valid field element of CURVE.Fp`);
    return y = Object.freeze(Object.assign({}, y)), { CURVE: y, Fp: q, Fn: z };
  }
  return Te;
}
var Ke;
function Qe() {
  return Ke || (Ke = 1, (function(s) {
    Object.defineProperty(s, "__esModule", { value: !0 }), s.DER = s.DERErr = void 0, s._splitEndoScalar = Q, s._normFnElement = D, s.weierstrassN = se, s.SWUFpSqrtRatio = $, s.mapToCurveSimpleSWU = ce, s.ecdh = R, s.ecdsa = y, s.weierstrassPoints = A, s._legacyHelperEquat = z, s.weierstrass = v;
    /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
    const x = /* @__PURE__ */ tt(), M = /* @__PURE__ */ xe(), m = /* @__PURE__ */ Ae(), K = /* @__PURE__ */ nt(), T = /* @__PURE__ */ Ne(), ie = (t, a) => (t + (t >= 0 ? a : -a) / H) / a;
    function Q(t, a, r) {
      const [[e, f], [g, n]] = a, i = ie(n * t, r), c = ie(-f * t, r);
      let h = t - i * e - c * g, p = -i * f - c * n;
      const C = h < G, Z = p < G;
      C && (h = -h), Z && (p = -p);
      const _ = (0, m.bitMask)(Math.ceil((0, m.bitLen)(r) / 2)) + re;
      if (h < G || h >= _ || p < G || p >= _)
        throw new Error("splitScalar (endomorphism): failed, k=" + t);
      return { k1neg: C, k1: h, k2neg: Z, k2: p };
    }
    function ne(t) {
      if (!["compact", "recovered", "der"].includes(t))
        throw new Error('Signature format must be "compact", "recovered", or "der"');
      return t;
    }
    function oe(t, a) {
      const r = {};
      for (let e of Object.keys(a))
        r[e] = t[e] === void 0 ? a[e] : t[e];
      return (0, m._abool2)(r.lowS, "lowS"), (0, m._abool2)(r.prehash, "prehash"), r.format !== void 0 && ne(r.format), r;
    }
    class fe extends Error {
      constructor(a = "") {
        super(a);
      }
    }
    s.DERErr = fe, s.DER = {
      // asn.1 DER encoding utils
      Err: fe,
      // Basic building block is TLV (Tag-Length-Value)
      _tlv: {
        encode: (t, a) => {
          const { Err: r } = s.DER;
          if (t < 0 || t > 256)
            throw new r("tlv.encode: wrong tag");
          if (a.length & 1)
            throw new r("tlv.encode: unpadded data");
          const e = a.length / 2, f = (0, m.numberToHexUnpadded)(e);
          if (f.length / 2 & 128)
            throw new r("tlv.encode: long form length too big");
          const g = e > 127 ? (0, m.numberToHexUnpadded)(f.length / 2 | 128) : "";
          return (0, m.numberToHexUnpadded)(t) + g + f + a;
        },
        // v - value, l - left bytes (unparsed)
        decode(t, a) {
          const { Err: r } = s.DER;
          let e = 0;
          if (t < 0 || t > 256)
            throw new r("tlv.encode: wrong tag");
          if (a.length < 2 || a[e++] !== t)
            throw new r("tlv.decode: wrong tlv");
          const f = a[e++], g = !!(f & 128);
          let n = 0;
          if (!g)
            n = f;
          else {
            const c = f & 127;
            if (!c)
              throw new r("tlv.decode(long): indefinite length not supported");
            if (c > 4)
              throw new r("tlv.decode(long): byte length is too big");
            const h = a.subarray(e, e + c);
            if (h.length !== c)
              throw new r("tlv.decode: length bytes not complete");
            if (h[0] === 0)
              throw new r("tlv.decode(long): zero leftmost byte");
            for (const p of h)
              n = n << 8 | p;
            if (e += c, n < 128)
              throw new r("tlv.decode(long): not minimal encoding");
          }
          const i = a.subarray(e, e + n);
          if (i.length !== n)
            throw new r("tlv.decode: wrong value length");
          return { v: i, l: a.subarray(e + n) };
        }
      },
      // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,
      // since we always use positive integers here. It must always be empty:
      // - add zero byte if exists
      // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)
      _int: {
        encode(t) {
          const { Err: a } = s.DER;
          if (t < G)
            throw new a("integer: negative integers are not allowed");
          let r = (0, m.numberToHexUnpadded)(t);
          if (Number.parseInt(r[0], 16) & 8 && (r = "00" + r), r.length & 1)
            throw new a("unexpected DER parsing assertion: unpadded hex");
          return r;
        },
        decode(t) {
          const { Err: a } = s.DER;
          if (t[0] & 128)
            throw new a("invalid signature integer: negative");
          if (t[0] === 0 && !(t[1] & 128))
            throw new a("invalid signature integer: unnecessary leading zero");
          return (0, m.bytesToNumberBE)(t);
        }
      },
      toSig(t) {
        const { Err: a, _int: r, _tlv: e } = s.DER, f = (0, m.ensureBytes)("signature", t), { v: g, l: n } = e.decode(48, f);
        if (n.length)
          throw new a("invalid signature: left bytes after parsing");
        const { v: i, l: c } = e.decode(2, g), { v: h, l: p } = e.decode(2, c);
        if (p.length)
          throw new a("invalid signature: left bytes after parsing");
        return { r: r.decode(i), s: r.decode(h) };
      },
      hexFromSig(t) {
        const { _tlv: a, _int: r } = s.DER, e = a.encode(2, r.encode(t.r)), f = a.encode(2, r.encode(t.s)), g = e + f;
        return a.encode(48, g);
      }
    };
    const G = BigInt(0), re = BigInt(1), H = BigInt(2), j = BigInt(3), X = BigInt(4);
    function D(t, a) {
      const { BYTES: r } = t;
      let e;
      if (typeof a == "bigint")
        e = a;
      else {
        let f = (0, m.ensureBytes)("private key", a);
        try {
          e = t.fromBytes(f);
        } catch {
          throw new Error(`invalid private key: expected ui8a of size ${r}, got ${typeof a}`);
        }
      }
      if (!t.isValidNot0(e))
        throw new Error("invalid private key: out of range [1..N-1]");
      return e;
    }
    function se(t, a = {}) {
      const r = (0, K._createCurveFields)("weierstrass", t, a), { Fp: e, Fn: f } = r;
      let g = r.CURVE;
      const { h: n, n: i } = g;
      (0, m._validateObject)(a, {}, {
        allowInfinityPoint: "boolean",
        clearCofactor: "function",
        isTorsionFree: "function",
        fromBytes: "function",
        toBytes: "function",
        endo: "object",
        wrapPrivateKey: "boolean"
      });
      const { endo: c } = a;
      if (c && (!e.is0(g.a) || typeof c.beta != "bigint" || !Array.isArray(c.basises)))
        throw new Error('invalid endo: expected "beta": bigint and "basises": array');
      const h = le(e, f);
      function p() {
        if (!e.isOdd)
          throw new Error("compression is not supported: Field does not have .isOdd()");
      }
      function C(ue, E, w) {
        const { x: d, y: N } = E.toAffine(), o = e.toBytes(d);
        if ((0, m._abool2)(w, "isCompressed"), w) {
          p();
          const u = !e.isOdd(N);
          return (0, m.concatBytes)(J(u), o);
        } else
          return (0, m.concatBytes)(Uint8Array.of(4), o, e.toBytes(N));
      }
      function Z(ue) {
        (0, m._abytes2)(ue, void 0, "Point");
        const { publicKey: E, publicKeyUncompressed: w } = h, d = ue.length, N = ue[0], o = ue.subarray(1);
        if (d === E && (N === 2 || N === 3)) {
          const u = e.fromBytes(o);
          if (!e.isValid(u))
            throw new Error("bad point: is not on curve, wrong x");
          const b = U(u);
          let I;
          try {
            I = e.sqrt(b);
          } catch (ge) {
            const de = ge instanceof Error ? ": " + ge.message : "";
            throw new Error("bad point: is not on curve, sqrt error" + de);
          }
          p();
          const k = e.isOdd(I);
          return (N & 1) === 1 !== k && (I = e.neg(I)), { x: u, y: I };
        } else if (d === w && N === 4) {
          const u = e.BYTES, b = e.fromBytes(o.subarray(0, u)), I = e.fromBytes(o.subarray(u, u * 2));
          if (!Y(b, I))
            throw new Error("bad point: is not on curve");
          return { x: b, y: I };
        } else
          throw new Error(`bad point: got length ${d}, expected compressed=${E} or uncompressed=${w}`);
      }
      const _ = a.toBytes || C, B = a.fromBytes || Z;
      function U(ue) {
        const E = e.sqr(ue), w = e.mul(E, ue);
        return e.add(e.add(w, e.mul(ue, g.a)), g.b);
      }
      function Y(ue, E) {
        const w = e.sqr(E), d = U(ue);
        return e.eql(w, d);
      }
      if (!Y(g.Gx, g.Gy))
        throw new Error("bad curve params: generator point");
      const V = e.mul(e.pow(g.a, j), X), l = e.mul(e.sqr(g.b), BigInt(27));
      if (e.is0(e.add(V, l)))
        throw new Error("bad curve params: a or b");
      function L(ue, E, w = !1) {
        if (!e.isValid(E) || w && e.is0(E))
          throw new Error(`bad point coordinate ${ue}`);
        return E;
      }
      function ee(ue) {
        if (!(ue instanceof te))
          throw new Error("ProjectivePoint expected");
      }
      function ye(ue) {
        if (!c || !c.basises)
          throw new Error("no endo");
        return Q(ue, c.basises, f.ORDER);
      }
      const Be = (0, m.memoized)((ue, E) => {
        const { X: w, Y: d, Z: N } = ue;
        if (e.eql(N, e.ONE))
          return { x: w, y: d };
        const o = ue.is0();
        E == null && (E = o ? e.ONE : e.inv(N));
        const u = e.mul(w, E), b = e.mul(d, E), I = e.mul(N, E);
        if (o)
          return { x: e.ZERO, y: e.ZERO };
        if (!e.eql(I, e.ONE))
          throw new Error("invZ was invalid");
        return { x: u, y: b };
      }), ve = (0, m.memoized)((ue) => {
        if (ue.is0()) {
          if (a.allowInfinityPoint && !e.is0(ue.Y))
            return;
          throw new Error("bad point: ZERO");
        }
        const { x: E, y: w } = ue.toAffine();
        if (!e.isValid(E) || !e.isValid(w))
          throw new Error("bad point: x or y not field elements");
        if (!Y(E, w))
          throw new Error("bad point: equation left != right");
        if (!ue.isTorsionFree())
          throw new Error("bad point: not in prime-order subgroup");
        return !0;
      });
      function _e(ue, E, w, d, N) {
        return w = new te(e.mul(w.X, ue), w.Y, w.Z), E = (0, K.negateCt)(d, E), w = (0, K.negateCt)(N, w), E.add(w);
      }
      class te {
        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
        constructor(E, w, d) {
          this.X = L("x", E), this.Y = L("y", w, !0), this.Z = L("z", d), Object.freeze(this);
        }
        static CURVE() {
          return g;
        }
        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
        static fromAffine(E) {
          const { x: w, y: d } = E || {};
          if (!E || !e.isValid(w) || !e.isValid(d))
            throw new Error("invalid affine point");
          if (E instanceof te)
            throw new Error("projective point not allowed");
          return e.is0(w) && e.is0(d) ? te.ZERO : new te(w, d, e.ONE);
        }
        static fromBytes(E) {
          const w = te.fromAffine(B((0, m._abytes2)(E, void 0, "point")));
          return w.assertValidity(), w;
        }
        static fromHex(E) {
          return te.fromBytes((0, m.ensureBytes)("pointHex", E));
        }
        get x() {
          return this.toAffine().x;
        }
        get y() {
          return this.toAffine().y;
        }
        /**
         *
         * @param windowSize
         * @param isLazy true will defer table computation until the first multiplication
         * @returns
         */
        precompute(E = 8, w = !0) {
          return Oe.createCache(this, E), w || this.multiply(j), this;
        }
        // TODO: return `this`
        /** A point on curve is valid if it conforms to equation. */
        assertValidity() {
          ve(this);
        }
        hasEvenY() {
          const { y: E } = this.toAffine();
          if (!e.isOdd)
            throw new Error("Field doesn't support isOdd");
          return !e.isOdd(E);
        }
        /** Compare one point to another. */
        equals(E) {
          ee(E);
          const { X: w, Y: d, Z: N } = this, { X: o, Y: u, Z: b } = E, I = e.eql(e.mul(w, b), e.mul(o, N)), k = e.eql(e.mul(d, b), e.mul(u, N));
          return I && k;
        }
        /** Flips point to one corresponding to (x, -y) in Affine coordinates. */
        negate() {
          return new te(this.X, e.neg(this.Y), this.Z);
        }
        // Renes-Costello-Batina exception-free doubling formula.
        // There is 30% faster Jacobian formula, but it is not complete.
        // https://eprint.iacr.org/2015/1060, algorithm 3
        // Cost: 8M + 3S + 3*a + 2*b3 + 15add.
        double() {
          const { a: E, b: w } = g, d = e.mul(w, j), { X: N, Y: o, Z: u } = this;
          let b = e.ZERO, I = e.ZERO, k = e.ZERO, W = e.mul(N, N), ge = e.mul(o, o), de = e.mul(u, u), ae = e.mul(N, o);
          return ae = e.add(ae, ae), k = e.mul(N, u), k = e.add(k, k), b = e.mul(E, k), I = e.mul(d, de), I = e.add(b, I), b = e.sub(ge, I), I = e.add(ge, I), I = e.mul(b, I), b = e.mul(ae, b), k = e.mul(d, k), de = e.mul(E, de), ae = e.sub(W, de), ae = e.mul(E, ae), ae = e.add(ae, k), k = e.add(W, W), W = e.add(k, W), W = e.add(W, de), W = e.mul(W, ae), I = e.add(I, W), de = e.mul(o, u), de = e.add(de, de), W = e.mul(de, ae), b = e.sub(b, W), k = e.mul(de, ge), k = e.add(k, k), k = e.add(k, k), new te(b, I, k);
        }
        // Renes-Costello-Batina exception-free addition formula.
        // There is 30% faster Jacobian formula, but it is not complete.
        // https://eprint.iacr.org/2015/1060, algorithm 1
        // Cost: 12M + 0S + 3*a + 3*b3 + 23add.
        add(E) {
          ee(E);
          const { X: w, Y: d, Z: N } = this, { X: o, Y: u, Z: b } = E;
          let I = e.ZERO, k = e.ZERO, W = e.ZERO;
          const ge = g.a, de = e.mul(g.b, j);
          let ae = e.mul(w, o), me = e.mul(d, u), Ee = e.mul(N, b), Se = e.add(w, d), we = e.add(o, u);
          Se = e.mul(Se, we), we = e.add(ae, me), Se = e.sub(Se, we), we = e.add(w, N);
          let pe = e.add(o, b);
          return we = e.mul(we, pe), pe = e.add(ae, Ee), we = e.sub(we, pe), pe = e.add(d, N), I = e.add(u, b), pe = e.mul(pe, I), I = e.add(me, Ee), pe = e.sub(pe, I), W = e.mul(ge, we), I = e.mul(de, Ee), W = e.add(I, W), I = e.sub(me, W), W = e.add(me, W), k = e.mul(I, W), me = e.add(ae, ae), me = e.add(me, ae), Ee = e.mul(ge, Ee), we = e.mul(de, we), me = e.add(me, Ee), Ee = e.sub(ae, Ee), Ee = e.mul(ge, Ee), we = e.add(we, Ee), ae = e.mul(me, we), k = e.add(k, ae), ae = e.mul(pe, we), I = e.mul(Se, I), I = e.sub(I, ae), ae = e.mul(Se, me), W = e.mul(pe, W), W = e.add(W, ae), new te(I, k, W);
        }
        subtract(E) {
          return this.add(E.negate());
        }
        is0() {
          return this.equals(te.ZERO);
        }
        /**
         * Constant time multiplication.
         * Uses wNAF method. Windowed method may be 10% faster,
         * but takes 2x longer to generate and consumes 2x memory.
         * Uses precomputes when available.
         * Uses endomorphism for Koblitz curves.
         * @param scalar by which the point would be multiplied
         * @returns New point
         */
        multiply(E) {
          const { endo: w } = a;
          if (!f.isValidNot0(E))
            throw new Error("invalid scalar: out of range");
          let d, N;
          const o = (u) => Oe.cached(this, u, (b) => (0, K.normalizeZ)(te, b));
          if (w) {
            const { k1neg: u, k1: b, k2neg: I, k2: k } = ye(E), { p: W, f: ge } = o(b), { p: de, f: ae } = o(k);
            N = ge.add(ae), d = _e(w.beta, W, de, u, I);
          } else {
            const { p: u, f: b } = o(E);
            d = u, N = b;
          }
          return (0, K.normalizeZ)(te, [d, N])[0];
        }
        /**
         * Non-constant-time multiplication. Uses double-and-add algorithm.
         * It's faster, but should only be used when you don't care about
         * an exposed secret key e.g. sig verification, which works over *public* keys.
         */
        multiplyUnsafe(E) {
          const { endo: w } = a, d = this;
          if (!f.isValid(E))
            throw new Error("invalid scalar: out of range");
          if (E === G || d.is0())
            return te.ZERO;
          if (E === re)
            return d;
          if (Oe.hasCache(this))
            return this.multiply(E);
          if (w) {
            const { k1neg: N, k1: o, k2neg: u, k2: b } = ye(E), { p1: I, p2: k } = (0, K.mulEndoUnsafe)(te, d, o, b);
            return _e(w.beta, I, k, N, u);
          } else
            return Oe.unsafe(d, E);
        }
        multiplyAndAddUnsafe(E, w, d) {
          const N = this.multiplyUnsafe(w).add(E.multiplyUnsafe(d));
          return N.is0() ? void 0 : N;
        }
        /**
         * Converts Projective point to affine (x, y) coordinates.
         * @param invertedZ Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch
         */
        toAffine(E) {
          return Be(this, E);
        }
        /**
         * Checks whether Point is free of torsion elements (is in prime subgroup).
         * Always torsion-free for cofactor=1 curves.
         */
        isTorsionFree() {
          const { isTorsionFree: E } = a;
          return n === re ? !0 : E ? E(te, this) : Oe.unsafe(this, i).is0();
        }
        clearCofactor() {
          const { clearCofactor: E } = a;
          return n === re ? this : E ? E(te, this) : this.multiplyUnsafe(n);
        }
        isSmallOrder() {
          return this.multiplyUnsafe(n).is0();
        }
        toBytes(E = !0) {
          return (0, m._abool2)(E, "isCompressed"), this.assertValidity(), _(te, this, E);
        }
        toHex(E = !0) {
          return (0, m.bytesToHex)(this.toBytes(E));
        }
        toString() {
          return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
        }
        // TODO: remove
        get px() {
          return this.X;
        }
        get py() {
          return this.X;
        }
        get pz() {
          return this.Z;
        }
        toRawBytes(E = !0) {
          return this.toBytes(E);
        }
        _setWindowSize(E) {
          this.precompute(E);
        }
        static normalizeZ(E) {
          return (0, K.normalizeZ)(te, E);
        }
        static msm(E, w) {
          return (0, K.pippenger)(te, f, E, w);
        }
        static fromPrivateKey(E) {
          return te.BASE.multiply(D(f, E));
        }
      }
      te.BASE = new te(g.Gx, g.Gy, e.ONE), te.ZERO = new te(e.ZERO, e.ONE, e.ZERO), te.Fp = e, te.Fn = f;
      const Re = f.BITS, Oe = new K.wNAF(te, a.endo ? Math.ceil(Re / 2) : Re);
      return te.BASE.precompute(8), te;
    }
    function J(t) {
      return Uint8Array.of(t ? 2 : 3);
    }
    function $(t, a) {
      const r = t.ORDER;
      let e = G;
      for (let B = r - re; B % H === G; B /= H)
        e += re;
      const f = e, g = H << f - re - re, n = g * H, i = (r - re) / n, c = (i - re) / H, h = n - re, p = g, C = t.pow(a, i), Z = t.pow(a, (i + re) / H);
      let _ = (B, U) => {
        let Y = C, V = t.pow(U, h), l = t.sqr(V);
        l = t.mul(l, U);
        let L = t.mul(B, l);
        L = t.pow(L, c), L = t.mul(L, V), V = t.mul(L, U), l = t.mul(L, B);
        let ee = t.mul(l, V);
        L = t.pow(ee, p);
        let ye = t.eql(L, t.ONE);
        V = t.mul(l, Z), L = t.mul(ee, Y), l = t.cmov(V, l, ye), ee = t.cmov(L, ee, ye);
        for (let Be = f; Be > re; Be--) {
          let ve = Be - H;
          ve = H << ve - re;
          let _e = t.pow(ee, ve);
          const te = t.eql(_e, t.ONE);
          V = t.mul(l, Y), Y = t.mul(Y, Y), _e = t.mul(ee, Y), l = t.cmov(V, l, te), ee = t.cmov(_e, ee, te);
        }
        return { isValid: ye, value: l };
      };
      if (t.ORDER % X === j) {
        const B = (t.ORDER - j) / X, U = t.sqrt(t.neg(a));
        _ = (Y, V) => {
          let l = t.sqr(V);
          const L = t.mul(Y, V);
          l = t.mul(l, L);
          let ee = t.pow(l, B);
          ee = t.mul(ee, L);
          const ye = t.mul(ee, U), Be = t.mul(t.sqr(ee), V), ve = t.eql(Be, Y);
          let _e = t.cmov(ye, ee, ve);
          return { isValid: ve, value: _e };
        };
      }
      return _;
    }
    function ce(t, a) {
      (0, T.validateField)(t);
      const { A: r, B: e, Z: f } = a;
      if (!t.isValid(r) || !t.isValid(e) || !t.isValid(f))
        throw new Error("mapToCurveSimpleSWU: invalid opts");
      const g = $(t, f);
      if (!t.isOdd)
        throw new Error("Field does not have .isOdd()");
      return (n) => {
        let i, c, h, p, C, Z, _, B;
        i = t.sqr(n), i = t.mul(i, f), c = t.sqr(i), c = t.add(c, i), h = t.add(c, t.ONE), h = t.mul(h, e), p = t.cmov(f, t.neg(c), !t.eql(c, t.ZERO)), p = t.mul(p, r), c = t.sqr(h), Z = t.sqr(p), C = t.mul(Z, r), c = t.add(c, C), c = t.mul(c, h), Z = t.mul(Z, p), C = t.mul(Z, e), c = t.add(c, C), _ = t.mul(i, h);
        const { isValid: U, value: Y } = g(c, Z);
        B = t.mul(i, n), B = t.mul(B, Y), _ = t.cmov(_, h, U), B = t.cmov(B, Y, U);
        const V = t.isOdd(n) === t.isOdd(B);
        B = t.cmov(t.neg(B), B, V);
        const l = (0, T.FpInvertBatch)(t, [p], !0)[0];
        return _ = t.mul(_, l), { x: _, y: B };
      };
    }
    function le(t, a) {
      return {
        secretKey: a.BYTES,
        publicKey: 1 + t.BYTES,
        publicKeyUncompressed: 1 + 2 * t.BYTES,
        publicKeyHasPrefix: !0,
        signature: 2 * a.BYTES
      };
    }
    function R(t, a = {}) {
      const { Fn: r } = t, e = a.randomBytes || m.randomBytes, f = Object.assign(le(t.Fp, r), { seed: (0, T.getMinHashLength)(r.ORDER) });
      function g(_) {
        try {
          return !!D(r, _);
        } catch {
          return !1;
        }
      }
      function n(_, B) {
        const { publicKey: U, publicKeyUncompressed: Y } = f;
        try {
          const V = _.length;
          return B === !0 && V !== U || B === !1 && V !== Y ? !1 : !!t.fromBytes(_);
        } catch {
          return !1;
        }
      }
      function i(_ = e(f.seed)) {
        return (0, T.mapHashToField)((0, m._abytes2)(_, f.seed, "seed"), r.ORDER);
      }
      function c(_, B = !0) {
        return t.BASE.multiply(D(r, _)).toBytes(B);
      }
      function h(_) {
        const B = i(_);
        return { secretKey: B, publicKey: c(B) };
      }
      function p(_) {
        if (typeof _ == "bigint")
          return !1;
        if (_ instanceof t)
          return !0;
        const { secretKey: B, publicKey: U, publicKeyUncompressed: Y } = f;
        if (r.allowedLengths || B === U)
          return;
        const V = (0, m.ensureBytes)("key", _).length;
        return V === U || V === Y;
      }
      function C(_, B, U = !0) {
        if (p(_) === !0)
          throw new Error("first arg must be private key");
        if (p(B) === !1)
          throw new Error("second arg must be public key");
        const Y = D(r, _);
        return t.fromHex(B).multiply(Y).toBytes(U);
      }
      return Object.freeze({ getPublicKey: c, getSharedSecret: C, keygen: h, Point: t, utils: {
        isValidSecretKey: g,
        isValidPublicKey: n,
        randomSecretKey: i,
        // TODO: remove
        isValidPrivateKey: g,
        randomPrivateKey: i,
        normPrivateKeyToScalar: (_) => D(r, _),
        precompute(_ = 8, B = t.BASE) {
          return B.precompute(_, !1);
        }
      }, lengths: f });
    }
    function y(t, a, r = {}) {
      (0, M.ahash)(a), (0, m._validateObject)(r, {}, {
        hmac: "function",
        lowS: "boolean",
        randomBytes: "function",
        bits2int: "function",
        bits2int_modN: "function"
      });
      const e = r.randomBytes || m.randomBytes, f = r.hmac || ((w, ...d) => (0, x.hmac)(a, w, (0, m.concatBytes)(...d))), { Fp: g, Fn: n } = t, { ORDER: i, BITS: c } = n, { keygen: h, getPublicKey: p, getSharedSecret: C, utils: Z, lengths: _ } = R(t, r), B = {
        prehash: !1,
        lowS: typeof r.lowS == "boolean" ? r.lowS : !1,
        format: void 0,
        //'compact' as ECDSASigFormat,
        extraEntropy: !1
      }, U = "compact";
      function Y(w) {
        const d = i >> re;
        return w > d;
      }
      function V(w, d) {
        if (!n.isValidNot0(d))
          throw new Error(`invalid signature ${w}: out of range 1..Point.Fn.ORDER`);
        return d;
      }
      function l(w, d) {
        ne(d);
        const N = _.signature, o = d === "compact" ? N : d === "recovered" ? N + 1 : void 0;
        return (0, m._abytes2)(w, o, `${d} signature`);
      }
      class L {
        constructor(d, N, o) {
          this.r = V("r", d), this.s = V("s", N), o != null && (this.recovery = o), Object.freeze(this);
        }
        static fromBytes(d, N = U) {
          l(d, N);
          let o;
          if (N === "der") {
            const { r: k, s: W } = s.DER.toSig((0, m._abytes2)(d));
            return new L(k, W);
          }
          N === "recovered" && (o = d[0], N = "compact", d = d.subarray(1));
          const u = n.BYTES, b = d.subarray(0, u), I = d.subarray(u, u * 2);
          return new L(n.fromBytes(b), n.fromBytes(I), o);
        }
        static fromHex(d, N) {
          return this.fromBytes((0, m.hexToBytes)(d), N);
        }
        addRecoveryBit(d) {
          return new L(this.r, this.s, d);
        }
        recoverPublicKey(d) {
          const N = g.ORDER, { r: o, s: u, recovery: b } = this;
          if (b == null || ![0, 1, 2, 3].includes(b))
            throw new Error("recovery id invalid");
          if (i * H < N && b > 1)
            throw new Error("recovery id is ambiguous for h>1 curve");
          const k = b === 2 || b === 3 ? o + i : o;
          if (!g.isValid(k))
            throw new Error("recovery id 2 or 3 invalid");
          const W = g.toBytes(k), ge = t.fromBytes((0, m.concatBytes)(J((b & 1) === 0), W)), de = n.inv(k), ae = ye((0, m.ensureBytes)("msgHash", d)), me = n.create(-ae * de), Ee = n.create(u * de), Se = t.BASE.multiplyUnsafe(me).add(ge.multiplyUnsafe(Ee));
          if (Se.is0())
            throw new Error("point at infinify");
          return Se.assertValidity(), Se;
        }
        // Signatures should be low-s, to prevent malleability.
        hasHighS() {
          return Y(this.s);
        }
        toBytes(d = U) {
          if (ne(d), d === "der")
            return (0, m.hexToBytes)(s.DER.hexFromSig(this));
          const N = n.toBytes(this.r), o = n.toBytes(this.s);
          if (d === "recovered") {
            if (this.recovery == null)
              throw new Error("recovery bit must be present");
            return (0, m.concatBytes)(Uint8Array.of(this.recovery), N, o);
          }
          return (0, m.concatBytes)(N, o);
        }
        toHex(d) {
          return (0, m.bytesToHex)(this.toBytes(d));
        }
        // TODO: remove
        assertValidity() {
        }
        static fromCompact(d) {
          return L.fromBytes((0, m.ensureBytes)("sig", d), "compact");
        }
        static fromDER(d) {
          return L.fromBytes((0, m.ensureBytes)("sig", d), "der");
        }
        normalizeS() {
          return this.hasHighS() ? new L(this.r, n.neg(this.s), this.recovery) : this;
        }
        toDERRawBytes() {
          return this.toBytes("der");
        }
        toDERHex() {
          return (0, m.bytesToHex)(this.toBytes("der"));
        }
        toCompactRawBytes() {
          return this.toBytes("compact");
        }
        toCompactHex() {
          return (0, m.bytesToHex)(this.toBytes("compact"));
        }
      }
      const ee = r.bits2int || function(d) {
        if (d.length > 8192)
          throw new Error("input is too large");
        const N = (0, m.bytesToNumberBE)(d), o = d.length * 8 - c;
        return o > 0 ? N >> BigInt(o) : N;
      }, ye = r.bits2int_modN || function(d) {
        return n.create(ee(d));
      }, Be = (0, m.bitMask)(c);
      function ve(w) {
        return (0, m.aInRange)("num < 2^" + c, w, G, Be), n.toBytes(w);
      }
      function _e(w, d) {
        return (0, m._abytes2)(w, void 0, "message"), d ? (0, m._abytes2)(a(w), void 0, "prehashed message") : w;
      }
      function te(w, d, N) {
        if (["recovered", "canonical"].some((me) => me in N))
          throw new Error("sign() legacy options not supported");
        const { lowS: o, prehash: u, extraEntropy: b } = oe(N, B);
        w = _e(w, u);
        const I = ye(w), k = D(n, d), W = [ve(k), ve(I)];
        if (b != null && b !== !1) {
          const me = b === !0 ? e(_.secretKey) : b;
          W.push((0, m.ensureBytes)("extraEntropy", me));
        }
        const ge = (0, m.concatBytes)(...W), de = I;
        function ae(me) {
          const Ee = ee(me);
          if (!n.isValidNot0(Ee))
            return;
          const Se = n.inv(Ee), we = t.BASE.multiply(Ee).toAffine(), pe = n.create(we.x);
          if (pe === G)
            return;
          const qe = n.create(Se * n.create(de + pe * k));
          if (qe === G)
            return;
          let Ce = (we.x === pe ? 0 : 2) | Number(we.y & re), ke = qe;
          return o && Y(qe) && (ke = n.neg(qe), Ce ^= 1), new L(pe, ke, Ce);
        }
        return { seed: ge, k2sig: ae };
      }
      function Re(w, d, N = {}) {
        w = (0, m.ensureBytes)("message", w);
        const { seed: o, k2sig: u } = te(w, d, N);
        return (0, m.createHmacDrbg)(a.outputLen, n.BYTES, f)(o, u);
      }
      function Oe(w) {
        let d;
        const N = typeof w == "string" || (0, m.isBytes)(w), o = !N && w !== null && typeof w == "object" && typeof w.r == "bigint" && typeof w.s == "bigint";
        if (!N && !o)
          throw new Error("invalid signature, expected Uint8Array, hex string or Signature instance");
        if (o)
          d = new L(w.r, w.s);
        else if (N) {
          try {
            d = L.fromBytes((0, m.ensureBytes)("sig", w), "der");
          } catch (u) {
            if (!(u instanceof s.DER.Err))
              throw u;
          }
          if (!d)
            try {
              d = L.fromBytes((0, m.ensureBytes)("sig", w), "compact");
            } catch {
              return !1;
            }
        }
        return d || !1;
      }
      function ue(w, d, N, o = {}) {
        const { lowS: u, prehash: b, format: I } = oe(o, B);
        if (N = (0, m.ensureBytes)("publicKey", N), d = _e((0, m.ensureBytes)("message", d), b), "strict" in o)
          throw new Error("options.strict was renamed to lowS");
        const k = I === void 0 ? Oe(w) : L.fromBytes((0, m.ensureBytes)("sig", w), I);
        if (k === !1)
          return !1;
        try {
          const W = t.fromBytes(N);
          if (u && k.hasHighS())
            return !1;
          const { r: ge, s: de } = k, ae = ye(d), me = n.inv(de), Ee = n.create(ae * me), Se = n.create(ge * me), we = t.BASE.multiplyUnsafe(Ee).add(W.multiplyUnsafe(Se));
          return we.is0() ? !1 : n.create(we.x) === ge;
        } catch {
          return !1;
        }
      }
      function E(w, d, N = {}) {
        const { prehash: o } = oe(N, B);
        return d = _e(d, o), L.fromBytes(w, "recovered").recoverPublicKey(d).toBytes();
      }
      return Object.freeze({
        keygen: h,
        getPublicKey: p,
        getSharedSecret: C,
        utils: Z,
        lengths: _,
        Point: t,
        sign: Re,
        verify: ue,
        recoverPublicKey: E,
        Signature: L,
        hash: a
      });
    }
    function A(t) {
      const { CURVE: a, curveOpts: r } = O(t), e = se(a, r);
      return F(t, e);
    }
    function O(t) {
      const a = {
        a: t.a,
        b: t.b,
        p: t.Fp.ORDER,
        n: t.n,
        h: t.h,
        Gx: t.Gx,
        Gy: t.Gy
      }, r = t.Fp;
      let e = t.allowedPrivateKeyLengths ? Array.from(new Set(t.allowedPrivateKeyLengths.map((n) => Math.ceil(n / 2)))) : void 0;
      const f = (0, T.Field)(a.n, {
        BITS: t.nBitLength,
        allowedLengths: e,
        modFromBytes: t.wrapPrivateKey
      }), g = {
        Fp: r,
        Fn: f,
        allowInfinityPoint: t.allowInfinityPoint,
        endo: t.endo,
        isTorsionFree: t.isTorsionFree,
        clearCofactor: t.clearCofactor,
        fromBytes: t.fromBytes,
        toBytes: t.toBytes
      };
      return { CURVE: a, curveOpts: g };
    }
    function q(t) {
      const { CURVE: a, curveOpts: r } = O(t), e = {
        hmac: t.hmac,
        randomBytes: t.randomBytes,
        lowS: t.lowS,
        bits2int: t.bits2int,
        bits2int_modN: t.bits2int_modN
      };
      return { CURVE: a, curveOpts: r, hash: t.hash, ecdsaOpts: e };
    }
    function z(t, a, r) {
      function e(f) {
        const g = t.sqr(f), n = t.mul(g, f);
        return t.add(t.add(n, t.mul(f, a)), r);
      }
      return e;
    }
    function F(t, a) {
      const { Fp: r, Fn: e } = a;
      function f(n) {
        return (0, m.inRange)(n, re, e.ORDER);
      }
      const g = z(r, t.a, t.b);
      return Object.assign({}, {
        CURVE: t,
        Point: a,
        ProjectivePoint: a,
        normPrivateKeyToScalar: (n) => D(e, n),
        weierstrassEquation: g,
        isWithinCurveOrder: f
      });
    }
    function S(t, a) {
      const r = a.Point;
      return Object.assign({}, a, {
        ProjectivePoint: r,
        CURVE: Object.assign({}, t, (0, T.nLength)(r.Fn.ORDER, r.Fn.BITS))
      });
    }
    function v(t) {
      const { CURVE: a, curveOpts: r, hash: e, ecdsaOpts: f } = q(t), g = se(a, r), n = y(g, e, f);
      return S(t, n);
    }
  })(Ue)), Ue;
}
var ze;
function rt() {
  if (ze) return Ie;
  ze = 1, Object.defineProperty(Ie, "__esModule", { value: !0 }), Ie.getHash = x, Ie.createCurve = M;
  /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
  const s = /* @__PURE__ */ Qe();
  function x(m) {
    return { hash: m };
  }
  function M(m, K) {
    const T = (ie) => (0, s.weierstrass)({ ...m, hash: ie });
    return { ...T(K), create: T };
  }
  return Ie;
}
var je = {}, Ye;
function ot() {
  return Ye || (Ye = 1, (function(s) {
    Object.defineProperty(s, "__esModule", { value: !0 }), s._DST_scalar = void 0, s.expand_message_xmd = ne, s.expand_message_xof = oe, s.hash_to_field = fe, s.isogenyMap = G, s.createHasher = re;
    const x = /* @__PURE__ */ Ae(), M = /* @__PURE__ */ Ne(), m = x.bytesToNumberBE;
    function K(H, j) {
      if (ie(H), ie(j), H < 0 || H >= 1 << 8 * j)
        throw new Error("invalid I2OSP input: " + H);
      const X = Array.from({ length: j }).fill(0);
      for (let D = j - 1; D >= 0; D--)
        X[D] = H & 255, H >>>= 8;
      return new Uint8Array(X);
    }
    function T(H, j) {
      const X = new Uint8Array(H.length);
      for (let D = 0; D < H.length; D++)
        X[D] = H[D] ^ j[D];
      return X;
    }
    function ie(H) {
      if (!Number.isSafeInteger(H))
        throw new Error("number expected");
    }
    function Q(H) {
      if (!(0, x.isBytes)(H) && typeof H != "string")
        throw new Error("DST must be Uint8Array or string");
      return typeof H == "string" ? (0, x.utf8ToBytes)(H) : H;
    }
    function ne(H, j, X, D) {
      (0, x.abytes)(H), ie(X), j = Q(j), j.length > 255 && (j = D((0, x.concatBytes)((0, x.utf8ToBytes)("H2C-OVERSIZE-DST-"), j)));
      const { outputLen: se, blockLen: J } = D, $ = Math.ceil(X / se);
      if (X > 65535 || $ > 255)
        throw new Error("expand_message_xmd: invalid lenInBytes");
      const ce = (0, x.concatBytes)(j, K(j.length, 1)), le = K(0, J), R = K(X, 2), y = new Array($), A = D((0, x.concatBytes)(le, H, R, K(0, 1), ce));
      y[0] = D((0, x.concatBytes)(A, K(1, 1), ce));
      for (let q = 1; q <= $; q++) {
        const z = [T(A, y[q - 1]), K(q + 1, 1), ce];
        y[q] = D((0, x.concatBytes)(...z));
      }
      return (0, x.concatBytes)(...y).slice(0, X);
    }
    function oe(H, j, X, D, se) {
      if ((0, x.abytes)(H), ie(X), j = Q(j), j.length > 255) {
        const J = Math.ceil(2 * D / 8);
        j = se.create({ dkLen: J }).update((0, x.utf8ToBytes)("H2C-OVERSIZE-DST-")).update(j).digest();
      }
      if (X > 65535 || j.length > 255)
        throw new Error("expand_message_xof: invalid lenInBytes");
      return se.create({ dkLen: X }).update(H).update(K(X, 2)).update(j).update(K(j.length, 1)).digest();
    }
    function fe(H, j, X) {
      (0, x._validateObject)(X, {
        p: "bigint",
        m: "number",
        k: "number",
        hash: "function"
      });
      const { p: D, k: se, m: J, hash: $, expand: ce, DST: le } = X;
      if (!(0, x.isHash)(X.hash))
        throw new Error("expected valid hash");
      (0, x.abytes)(H), ie(j);
      const R = D.toString(2).length, y = Math.ceil((R + se) / 8), A = j * J * y;
      let O;
      if (ce === "xmd")
        O = ne(H, le, A, $);
      else if (ce === "xof")
        O = oe(H, le, A, se, $);
      else if (ce === "_internal_pass")
        O = H;
      else
        throw new Error('expand must be "xmd" or "xof"');
      const q = new Array(j);
      for (let z = 0; z < j; z++) {
        const F = new Array(J);
        for (let S = 0; S < J; S++) {
          const v = y * (S + z * J), t = O.subarray(v, v + y);
          F[S] = (0, M.mod)(m(t), D);
        }
        q[z] = F;
      }
      return q;
    }
    function G(H, j) {
      const X = j.map((D) => Array.from(D).reverse());
      return (D, se) => {
        const [J, $, ce, le] = X.map((A) => A.reduce((O, q) => H.add(H.mul(O, D), q))), [R, y] = (0, M.FpInvertBatch)(H, [$, le], !0);
        return D = H.mul(J, R), se = H.mul(se, H.mul(ce, y)), { x: D, y: se };
      };
    }
    s._DST_scalar = (0, x.utf8ToBytes)("HashToScalar-");
    function re(H, j, X) {
      if (typeof j != "function")
        throw new Error("mapToCurve() must be defined");
      function D(J) {
        return H.fromAffine(j(J));
      }
      function se(J) {
        const $ = J.clearCofactor();
        return $.equals(H.ZERO) ? H.ZERO : ($.assertValidity(), $);
      }
      return {
        defaults: X,
        hashToCurve(J, $) {
          const ce = Object.assign({}, X, $), le = fe(J, 2, ce), R = D(le[0]), y = D(le[1]);
          return se(R.add(y));
        },
        encodeToCurve(J, $) {
          const ce = X.encodeDST ? { DST: X.encodeDST } : {}, le = Object.assign({}, X, ce, $), R = fe(J, 1, le), y = D(R[0]);
          return se(y);
        },
        /** See {@link H2CHasher} */
        mapToCurve(J) {
          if (!Array.isArray(J))
            throw new Error("expected array of bigints");
          for (const $ of J)
            if (typeof $ != "bigint")
              throw new Error("expected array of bigints");
          return se(D(J));
        },
        // hash_to_scalar can produce 0: https://www.rfc-editor.org/errata/eid8393
        // RFC 9380, draft-irtf-cfrg-bbs-signatures-08
        hashToScalar(J, $) {
          const ce = H.Fn.ORDER, le = Object.assign({}, X, { p: ce, m: 1, DST: s._DST_scalar }, $);
          return fe(J, 1, le)[0][0];
        }
      };
    }
  })(je)), je;
}
var Xe;
function st() {
  return Xe || (Xe = 1, (function(s) {
    Object.defineProperty(s, "__esModule", { value: !0 }), s.encodeToCurve = s.hashToCurve = s.secp256k1_hasher = s.schnorr = s.secp256k1 = void 0;
    /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
    const x = /* @__PURE__ */ Fe(), M = /* @__PURE__ */ xe(), m = /* @__PURE__ */ rt(), K = /* @__PURE__ */ ot(), T = /* @__PURE__ */ Ne(), ie = /* @__PURE__ */ Qe(), Q = /* @__PURE__ */ Ae(), ne = {
      p: BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f"),
      n: BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"),
      h: BigInt(1),
      a: BigInt(0),
      b: BigInt(7),
      Gx: BigInt("0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"),
      Gy: BigInt("0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8")
    }, oe = {
      beta: BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),
      basises: [
        [BigInt("0x3086d221a7d46bcde86c90e49284eb15"), -BigInt("0xe4437ed6010e88286f547fa90abfe4c3")],
        [BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"), BigInt("0x3086d221a7d46bcde86c90e49284eb15")]
      ]
    }, fe = /* @__PURE__ */ BigInt(0), G = /* @__PURE__ */ BigInt(1), re = /* @__PURE__ */ BigInt(2);
    function H(S) {
      const v = ne.p, t = BigInt(3), a = BigInt(6), r = BigInt(11), e = BigInt(22), f = BigInt(23), g = BigInt(44), n = BigInt(88), i = S * S * S % v, c = i * i * S % v, h = (0, T.pow2)(c, t, v) * c % v, p = (0, T.pow2)(h, t, v) * c % v, C = (0, T.pow2)(p, re, v) * i % v, Z = (0, T.pow2)(C, r, v) * C % v, _ = (0, T.pow2)(Z, e, v) * Z % v, B = (0, T.pow2)(_, g, v) * _ % v, U = (0, T.pow2)(B, n, v) * B % v, Y = (0, T.pow2)(U, g, v) * _ % v, V = (0, T.pow2)(Y, t, v) * c % v, l = (0, T.pow2)(V, f, v) * Z % v, L = (0, T.pow2)(l, a, v) * i % v, ee = (0, T.pow2)(L, re, v);
      if (!j.eql(j.sqr(ee), S))
        throw new Error("Cannot find square root");
      return ee;
    }
    const j = (0, T.Field)(ne.p, { sqrt: H });
    s.secp256k1 = (0, m.createCurve)({ ...ne, Fp: j, lowS: !0, endo: oe }, x.sha256);
    const X = {};
    function D(S, ...v) {
      let t = X[S];
      if (t === void 0) {
        const a = (0, x.sha256)((0, Q.utf8ToBytes)(S));
        t = (0, Q.concatBytes)(a, a), X[S] = t;
      }
      return (0, x.sha256)((0, Q.concatBytes)(t, ...v));
    }
    const se = (S) => S.toBytes(!0).slice(1), J = s.secp256k1.Point, $ = (S) => S % re === fe;
    function ce(S) {
      const { Fn: v, BASE: t } = J, a = (0, ie._normFnElement)(v, S), r = t.multiply(a);
      return { scalar: $(r.y) ? a : v.neg(a), bytes: se(r) };
    }
    function le(S) {
      const v = j;
      if (!v.isValidNot0(S))
        throw new Error("invalid x: Fail if x ≥ p");
      const t = v.create(S * S), a = v.create(t * S + BigInt(7));
      let r = v.sqrt(a);
      $(r) || (r = v.neg(r));
      const e = J.fromAffine({ x: S, y: r });
      return e.assertValidity(), e;
    }
    const R = Q.bytesToNumberBE;
    function y(...S) {
      return J.Fn.create(R(D("BIP0340/challenge", ...S)));
    }
    function A(S) {
      return ce(S).bytes;
    }
    function O(S, v, t = (0, M.randomBytes)(32)) {
      const { Fn: a } = J, r = (0, Q.ensureBytes)("message", S), { bytes: e, scalar: f } = ce(v), g = (0, Q.ensureBytes)("auxRand", t, 32), n = a.toBytes(f ^ R(D("BIP0340/aux", g))), i = D("BIP0340/nonce", n, e, r), { bytes: c, scalar: h } = ce(i), p = y(c, e, r), C = new Uint8Array(64);
      if (C.set(c, 0), C.set(a.toBytes(a.create(h + p * f)), 32), !q(C, r, e))
        throw new Error("sign: Invalid signature produced");
      return C;
    }
    function q(S, v, t) {
      const { Fn: a, BASE: r } = J, e = (0, Q.ensureBytes)("signature", S, 64), f = (0, Q.ensureBytes)("message", v), g = (0, Q.ensureBytes)("publicKey", t, 32);
      try {
        const n = le(R(g)), i = R(e.subarray(0, 32));
        if (!(0, Q.inRange)(i, G, ne.p))
          return !1;
        const c = R(e.subarray(32, 64));
        if (!(0, Q.inRange)(c, G, ne.n))
          return !1;
        const h = y(a.toBytes(i), se(n), f), p = r.multiplyUnsafe(c).add(n.multiplyUnsafe(a.neg(h))), { x: C, y: Z } = p.toAffine();
        return !(p.is0() || !$(Z) || C !== i);
      } catch {
        return !1;
      }
    }
    s.schnorr = (() => {
      const t = (r = (0, M.randomBytes)(48)) => (0, T.mapHashToField)(r, ne.n);
      s.secp256k1.utils.randomSecretKey;
      function a(r) {
        const e = t(r);
        return { secretKey: e, publicKey: A(e) };
      }
      return {
        keygen: a,
        getPublicKey: A,
        sign: O,
        verify: q,
        Point: J,
        utils: {
          randomSecretKey: t,
          randomPrivateKey: t,
          taggedHash: D,
          // TODO: remove
          lift_x: le,
          pointToBytes: se,
          numberToBytesBE: Q.numberToBytesBE,
          bytesToNumberBE: Q.bytesToNumberBE,
          mod: T.mod
        },
        lengths: {
          secretKey: 32,
          publicKey: 32,
          publicKeyHasPrefix: !1,
          signature: 64,
          seed: 48
        }
      };
    })();
    const z = (0, K.isogenyMap)(j, [
      // xNum
      [
        "0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7",
        "0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581",
        "0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262",
        "0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c"
      ],
      // xDen
      [
        "0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b",
        "0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14",
        "0x0000000000000000000000000000000000000000000000000000000000000001"
        // LAST 1
      ],
      // yNum
      [
        "0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c",
        "0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3",
        "0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931",
        "0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84"
      ],
      // yDen
      [
        "0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b",
        "0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573",
        "0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f",
        "0x0000000000000000000000000000000000000000000000000000000000000001"
        // LAST 1
      ]
    ].map((S) => S.map((v) => BigInt(v)))), F = (0, ie.mapToCurveSimpleSWU)(j, {
      A: BigInt("0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533"),
      B: BigInt("1771"),
      Z: j.create(BigInt("-11"))
    });
    s.secp256k1_hasher = (0, K.createHasher)(s.secp256k1.Point, (S) => {
      const { x: v, y: t } = F(j.create(S[0]));
      return z(v, t);
    }, {
      DST: "secp256k1_XMD:SHA-256_SSWU_RO_",
      encodeDST: "secp256k1_XMD:SHA-256_SSWU_NU_",
      p: j.ORDER,
      m: 1,
      k: 128,
      expand: "xmd",
      hash: x.sha256
    }), s.hashToCurve = s.secp256k1_hasher.hashToCurve, s.encodeToCurve = s.secp256k1_hasher.encodeToCurve;
  })(He)), He;
}
var P = {}, We;
function it() {
  if (We) return P;
  We = 1, Object.defineProperty(P, "__esModule", { value: !0 }), P.isHash = P.validateObject = P.memoized = P.notImplemented = P.createHmacDrbg = P.bitMask = P.bitSet = P.bitGet = P.bitLen = P.aInRange = P.inRange = P.asciiToBytes = P.copyBytes = P.equalBytes = P.ensureBytes = P.numberToVarBytesBE = P.numberToBytesLE = P.numberToBytesBE = P.bytesToNumberLE = P.bytesToNumberBE = P.hexToNumber = P.numberToHexUnpadded = P.abool = P.utf8ToBytes = P.randomBytes = P.isBytes = P.hexToBytes = P.concatBytes = P.bytesToUtf8 = P.bytesToHex = P.anumber = P.abytes = void 0;
  const s = /* @__PURE__ */ Ae();
  return P.abytes = s.abytes, P.anumber = s.anumber, P.bytesToHex = s.bytesToHex, P.bytesToUtf8 = s.bytesToUtf8, P.concatBytes = s.concatBytes, P.hexToBytes = s.hexToBytes, P.isBytes = s.isBytes, P.randomBytes = s.randomBytes, P.utf8ToBytes = s.utf8ToBytes, P.abool = s.abool, P.numberToHexUnpadded = s.numberToHexUnpadded, P.hexToNumber = s.hexToNumber, P.bytesToNumberBE = s.bytesToNumberBE, P.bytesToNumberLE = s.bytesToNumberLE, P.numberToBytesBE = s.numberToBytesBE, P.numberToBytesLE = s.numberToBytesLE, P.numberToVarBytesBE = s.numberToVarBytesBE, P.ensureBytes = s.ensureBytes, P.equalBytes = s.equalBytes, P.copyBytes = s.copyBytes, P.asciiToBytes = s.asciiToBytes, P.inRange = s.inRange, P.aInRange = s.aInRange, P.bitLen = s.bitLen, P.bitGet = s.bitGet, P.bitSet = s.bitSet, P.bitMask = s.bitMask, P.createHmacDrbg = s.createHmacDrbg, P.notImplemented = s.notImplemented, P.memoized = s.memoized, P.validateObject = s.validateObject, P.isHash = s.isHash, P;
}
var Ge;
function ct() {
  if (Ge) return be;
  Ge = 1;
  var s = /* @__PURE__ */ st(), x = /* @__PURE__ */ Ne(), M = /* @__PURE__ */ it();
  function m(o) {
    var u = /* @__PURE__ */ Object.create(null);
    return o && Object.keys(o).forEach(function(b) {
      if (b !== "default") {
        var I = Object.getOwnPropertyDescriptor(o, b);
        Object.defineProperty(u, b, I.get ? I : {
          enumerable: !0,
          get: function() {
            return o[b];
          }
        });
      }
    }), u.default = o, Object.freeze(u);
  }
  var K = /* @__PURE__ */ m(x), T = /* @__PURE__ */ m(M);
  const ie = s.secp256k1.ProjectivePoint, Q = "Expected Private", ne = "Expected Point", oe = "Expected Tweak", fe = "Expected Hash", G = "Expected Signature", re = "Expected Extra Data (32 bytes)", H = "Expected Scalar", j = "Bad Recovery Id", X = 32, D = 32, se = new Uint8Array([
    255,
    255,
    255,
    255,
    255,
    255,
    255,
    255,
    255,
    255,
    255,
    255,
    255,
    255,
    255,
    254,
    186,
    174,
    220,
    230,
    175,
    72,
    160,
    59,
    191,
    210,
    94,
    140,
    208,
    54,
    65,
    65
  ]), J = 32, $ = new Uint8Array(32), ce = new Uint8Array([
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    1,
    69,
    81,
    35,
    25,
    80,
    183,
    95,
    196,
    64,
    45,
    161,
    114,
    47,
    201,
    186,
    238
  ]), le = BigInt(1);
  function R(o) {
    return o instanceof Uint8Array;
  }
  function y(o, u) {
    for (let b = 0; b < 32; ++b)
      if (o[b] !== u[b])
        return o[b] < u[b] ? -1 : 1;
    return 0;
  }
  function A(o) {
    return y(o, $) === 0;
  }
  function O(o) {
    return !(!(o instanceof Uint8Array) || o.length !== D || y(o, se) >= 0);
  }
  function q(o) {
    return o instanceof Uint8Array && o.length === 64 && y(o.subarray(0, 32), se) < 0 && y(o.subarray(32, 64), se) < 0;
  }
  function z(o) {
    return R(o) && o.length === 64 && y(o.subarray(0, 32), ce) < 0;
  }
  function F(o) {
    return !(A(o.subarray(0, 32)) || A(o.subarray(32, 64)));
  }
  function S(o) {
    return o instanceof Uint8Array && o.length === X;
  }
  function v(o) {
    return o === void 0 || o instanceof Uint8Array && o.length === J;
  }
  function t(o) {
    let u;
    if (typeof o == "bigint")
      u = o;
    else if (typeof o == "number" && Number.isSafeInteger(o) && o >= 0)
      u = BigInt(o);
    else if (typeof o == "string") {
      if (o.length !== 64)
        throw new Error("Expected 32 bytes of private scalar");
      u = T.hexToNumber(o);
    } else if (o instanceof Uint8Array) {
      if (o.length !== 32)
        throw new Error("Expected 32 bytes of private scalar");
      u = T.bytesToNumberBE(o);
    } else
      throw new TypeError("Expected valid private scalar");
    if (u < 0) throw new Error("Expected private scalar >= 0");
    return u;
  }
  function a(o) {
    return s.secp256k1.utils.normPrivateKeyToScalar(o);
  }
  function r(o, u) {
    const b = a(o), I = t(u), k = T.numberToBytesBE(K.mod(b + I, s.secp256k1.CURVE.n), 32);
    return s.secp256k1.utils.isValidPrivateKey(k) ? k : null;
  }
  function e(o, u) {
    const b = a(o), I = t(u), k = T.numberToBytesBE(K.mod(b - I, s.secp256k1.CURVE.n), 32);
    return s.secp256k1.utils.isValidPrivateKey(k) ? k : null;
  }
  function f(o) {
    const u = a(o), b = T.numberToBytesBE(s.secp256k1.CURVE.n - u, 32);
    return s.secp256k1.utils.isValidPrivateKey(b) ? b : null;
  }
  function g(o, u, b) {
    const I = p(o), k = t(u), W = ie.BASE.multiplyAndAddUnsafe(I, k, le);
    if (!W) throw new Error("Tweaked point at infinity");
    return W.toRawBytes(b);
  }
  function n(o, u, b) {
    const I = p(o), k = typeof u == "string" ? u : T.bytesToHex(u), W = T.hexToNumber(k);
    return I.multiply(W).toRawBytes(b);
  }
  function i(o, u) {
    return o === void 0 ? u !== void 0 ? _(u) : !0 : !!o;
  }
  function c(o) {
    try {
      return o();
    } catch {
      return null;
    }
  }
  function h(o) {
    return s.schnorr.utils.lift_x(T.bytesToNumberBE(o));
  }
  function p(o) {
    return o.length === 32 ? h(o) : ie.fromHex(o);
  }
  function C(o, u) {
    if (o.length === 32 !== u) return !1;
    try {
      return u ? !!h(o) : !!ie.fromHex(o);
    } catch {
      return !1;
    }
  }
  function Z(o) {
    return C(o, !1);
  }
  function _(o) {
    return C(o, !1) && o.length === 33;
  }
  function B(o) {
    return s.secp256k1.utils.isValidPrivateKey(o);
  }
  function U(o) {
    return C(o, !0);
  }
  function Y(o, u) {
    if (!U(o))
      throw new Error(ne);
    if (!O(u))
      throw new Error(oe);
    return c(() => {
      const b = g(o, u, !0);
      return { parity: b[0] % 2 === 1 ? 1 : 0, xOnlyPubkey: b.slice(1) };
    });
  }
  function V(o) {
    if (!Z(o))
      throw new Error(ne);
    return o.slice(1, 33);
  }
  function l(o, u) {
    if (!B(o))
      throw new Error(Q);
    return c(
      () => s.secp256k1.getPublicKey(o, i(u))
    );
  }
  function L(o) {
    if (!B(o))
      throw new Error(Q);
    return V(l(o));
  }
  function ee(o, u) {
    if (!Z(o))
      throw new Error(ne);
    return p(o).toRawBytes(i(u, o));
  }
  function ye(o, u, b) {
    if (!Z(o))
      throw new Error(ne);
    if (!O(u))
      throw new Error(oe);
    return c(
      () => n(o, u, i(b, o))
    );
  }
  function Be(o, u, b) {
    if (!Z(o) || !Z(u))
      throw new Error(ne);
    return c(() => {
      const I = p(o), k = p(u);
      return I.equals(k.negate()) ? null : I.add(k).toRawBytes(i(b, o));
    });
  }
  function ve(o, u, b) {
    if (!Z(o))
      throw new Error(ne);
    if (!O(u))
      throw new Error(oe);
    return c(
      () => g(o, u, i(b, o))
    );
  }
  function _e(o, u) {
    if (!B(o))
      throw new Error(Q);
    if (!O(u))
      throw new Error(oe);
    return c(() => r(o, u));
  }
  function te(o, u) {
    if (!B(o))
      throw new Error(Q);
    if (!O(u))
      throw new Error(oe);
    return c(() => e(o, u));
  }
  function Re(o) {
    if (!B(o))
      throw new Error(Q);
    return f(o);
  }
  function Oe(o, u, b) {
    if (!B(u))
      throw new Error(Q);
    if (!S(o))
      throw new Error(H);
    if (!v(b))
      throw new Error(re);
    return s.secp256k1.sign(o, u, { extraEntropy: b }).toCompactRawBytes();
  }
  function ue(o, u, b) {
    if (!B(u))
      throw new Error(Q);
    if (!S(o))
      throw new Error(H);
    if (!v(b))
      throw new Error(re);
    const I = s.secp256k1.sign(o, u, { extraEntropy: b });
    return {
      signature: I.toCompactRawBytes(),
      recoveryId: I.recovery
    };
  }
  function E(o, u, b) {
    if (!B(u))
      throw new Error(Q);
    if (!S(o))
      throw new Error(H);
    if (!v(b))
      throw new Error(re);
    return s.schnorr.sign(o, u, b);
  }
  function w(o, u, b, I) {
    if (!S(o))
      throw new Error(fe);
    if (!q(u) || !F(u))
      throw new Error(G);
    if (b & 2 && !z(u))
      throw new Error(j);
    if (!U(u.subarray(0, 32)))
      throw new Error(G);
    const W = s.secp256k1.Signature.fromCompact(u).addRecoveryBit(b).recoverPublicKey(o);
    if (!W) throw new Error(G);
    return W.toRawBytes(i(I));
  }
  function d(o, u, b, I) {
    if (!Z(u))
      throw new Error(ne);
    if (!q(b))
      throw new Error(G);
    if (!S(o))
      throw new Error(H);
    return s.secp256k1.verify(b, o, u, { lowS: I });
  }
  function N(o, u, b) {
    if (!U(u))
      throw new Error(ne);
    if (!q(b))
      throw new Error(G);
    if (!S(o))
      throw new Error(H);
    return s.schnorr.verify(b, o, u);
  }
  return be.isPoint = Z, be.isPointCompressed = _, be.isPrivate = B, be.isXOnlyPoint = U, be.pointAdd = Be, be.pointAddScalar = ve, be.pointCompress = ee, be.pointFromScalar = l, be.pointMultiply = ye, be.privateAdd = _e, be.privateNegate = Re, be.privateSub = te, be.recover = w, be.sign = Oe, be.signRecoverable = ue, be.signSchnorr = E, be.verify = d, be.verifySchnorr = N, be.xOnlyPointAddTweak = Y, be.xOnlyPointFromPoint = V, be.xOnlyPointFromScalar = L, be;
}
var Je = ct();
const at = /* @__PURE__ */ $e(Je), ft = /* @__PURE__ */ et({
  __proto__: null,
  default: at
}, [Je]);
export {
  ft as i
};
//# sourceMappingURL=index3.js.map
