;
! function() {
    try {
        var e = "undefined" != typeof globalThis ? globalThis : "undefined" != typeof global ? global : "undefined" != typeof window ? window : "undefined" != typeof self ? self : {},
            n = (new e.Error).stack;
        n && ((e._debugIds || (e._debugIds = {}))[n] = "a6f887bd-d081-4f48-b2b7-a292e39f3149")
    } catch (e) {}
}();
(globalThis.TURBOPACK || (globalThis.TURBOPACK = [])).push(["object" == typeof document ? document.currentScript : void 0, 241961, 432231, 65140, 553037, 166125, 675401, t => {
    "use strict";
    let e;
    var r = t.i(727830),
        n = t.i(354955);
    let i = BigInt(0),
        o = BigInt(1);

    function s(t, e = "") {
        if ("boolean" != typeof t) throw Error((e && `"${e}"`) + "expected boolean, got type=" + typeof t);
        return t
    }

    function a(t, e, r = "") {
        let i = (0, n.isBytes)(t),
            o = t ? .length,
            s = void 0 !== e;
        if (!i || s && o !== e) throw Error((r && `"${r}" `) + "expected Uint8Array" + (s ? ` of length ${e}` : "") + ", got " + (i ? `length=${o}` : `type=${typeof t}`));
        return t
    }

    function l(t) {
        let e = t.toString(16);
        return 1 & e.length ? "0" + e : e
    }

    function u(t) {
        if ("string" != typeof t) throw Error("hex string expected, got " + typeof t);
        return "" === t ? i : BigInt("0x" + t)
    }

    function f(t) {
        return u((0, n.bytesToHex)(t))
    }

    function c(t) {
        return (0, n.abytes)(t), u((0, n.bytesToHex)(Uint8Array.from(t).reverse()))
    }

    function d(t, e) {
        return (0, n.hexToBytes)(t.toString(16).padStart(2 * e, "0"))
    }

    function h(t, e) {
        return d(t, e).reverse()
    }

    function m(t, e, r) {
        let i;
        if ("string" == typeof e) try {
                i = (0, n.hexToBytes)(e)
            } catch (e) {
                throw Error(t + " must be hex string or Uint8Array, cause: " + e)
            } else if ((0, n.isBytes)(e)) i = Uint8Array.from(e);
            else throw Error(t + " must be hex string or Uint8Array");
        let o = i.length;
        if ("number" == typeof r && o !== r) throw Error(t + " of length " + r + " expected, got " + o);
        return i
    }

    function y(t, e) {
        if (t.length !== e.length) return !1;
        let r = 0;
        for (let n = 0; n < t.length; n++) r |= t[n] ^ e[n];
        return 0 === r
    }

    function p(t) {
        return Uint8Array.from(t)
    }
    let g = t => "bigint" == typeof t && i <= t;

    function E(t, e, r) {
        return g(t) && g(e) && g(r) && e <= t && t < r
    }

    function w(t, e, r, n) {
        if (!E(e, r, n)) throw Error("expected valid " + t + ": " + r + " <= n < " + n + ", got " + e)
    }

    function B(t) {
        let e;
        for (e = 0; t > i; t >>= o, e += 1);
        return e
    }
    let b = t => (o << BigInt(t)) - o;

    function v(t, e, r) {
        if ("number" != typeof t || t < 2) throw Error("hashLen must be a number");
        if ("number" != typeof e || e < 2) throw Error("qByteLen must be a number");
        if ("function" != typeof r) throw Error("hmacFn must be a function");
        let i = t => new Uint8Array(t),
            o = i(t),
            s = i(t),
            a = 0,
            l = () => {
                o.fill(1), s.fill(0), a = 0
            },
            u = (...t) => r(s, o, ...t),
            f = (t = i(0)) => {
                s = u(Uint8Array.of(0), t), o = u(), 0 !== t.length && (s = u(Uint8Array.of(1), t), o = u())
            },
            c = () => {
                if (a++ >= 1e3) throw Error("drbg: tried 1000 values");
                let t = 0,
                    r = [];
                for (; t < e;) {
                    let e = (o = u()).slice();
                    r.push(e), t += o.length
                }
                return (0, n.concatBytes)(...r)
            };
        return (t, e) => {
            let r;
            for (l(), f(t); !(r = e(c()));) f();
            return l(), r
        }
    }

    function x(t) {
        return "function" == typeof t && Number.isSafeInteger(t.outputLen)
    }

    function O(t, e, r = {}) {
        if (!t || "object" != typeof t) throw Error("expected valid options object");

        function n(e, r, n) {
            let i = t[e];
            if (n && void 0 === i) return;
            let o = typeof i;
            if (o !== r || null === i) throw Error(`param "${e}" is invalid: expected ${r}, got ${o}`)
        }
        Object.entries(e).forEach(([t, e]) => n(t, e, !1)), Object.entries(r).forEach(([t, e]) => n(t, e, !0))
    }
    let R = () => {
        throw Error("not implemented")
    };

    function S(t) {
        let e = new WeakMap;
        return (r, ...n) => {
            let i = e.get(r);
            if (void 0 !== i) return i;
            let o = t(r, ...n);
            return e.set(r, o), o
        }
    }
    t.s(["_abool2", 0, s, "_abytes2", 0, a, "_validateObject", 0, O, "aInRange", 0, w, "bitLen", 0, B, "bitMask", 0, b, "bytesToNumberBE", 0, f, "bytesToNumberLE", 0, c, "copyBytes", 0, p, "createHmacDrbg", 0, v, "ensureBytes", 0, m, "equalBytes", 0, y, "inRange", 0, E, "isHash", 0, x, "memoized", 0, S, "notImplemented", 0, R, "numberToBytesBE", 0, d, "numberToBytesLE", 0, h, "numberToHexUnpadded", 0, l], 432231);
    let I = BigInt(0),
        q = BigInt(1),
        A = BigInt(2),
        T = BigInt(3),
        F = BigInt(4),
        Z = BigInt(5),
        N = BigInt(7),
        V = BigInt(8),
        U = BigInt(9),
        P = BigInt(16);

    function C(t, e) {
        let r = t % e;
        return r >= I ? r : e + r
    }

    function _(t, e, r) {
        let n = t;
        for (; e-- > I;) n *= n, n %= r;
        return n
    }

    function K(t, e) {
        if (t === I) throw Error("invert: expected non-zero number");
        if (e <= I) throw Error("invert: expected positive modulus, got " + e);
        let r = C(t, e),
            n = e,
            i = I,
            o = q,
            s = q,
            a = I;
        for (; r !== I;) {
            let t = n / r,
                e = n % r,
                l = i - s * t,
                u = o - a * t;
            n = r, r = e, i = s, o = a, s = l, a = u
        }
        if (n !== q) throw Error("invert: does not exist");
        return C(i, e)
    }

    function H(t, e, r) {
        if (!t.eql(t.sqr(e), r)) throw Error("Cannot find square root")
    }

    function D(t, e) {
        let r = (t.ORDER + q) / F,
            n = t.pow(e, r);
        return H(t, n, e), n
    }

    function j(t, e) {
        let r = (t.ORDER - Z) / V,
            n = t.mul(e, A),
            i = t.pow(n, r),
            o = t.mul(e, i),
            s = t.mul(t.mul(o, A), i),
            a = t.mul(o, t.sub(s, t.ONE));
        return H(t, a, e), a
    }

    function L(t) {
        if (t < T) throw Error("sqrt is not defined for small field");
        let e = t - q,
            r = 0;
        for (; e % A === I;) e /= A, r++;
        let n = A,
            i = $(t);
        for (; 1 === G(i, n);)
            if (n++ > 1e3) throw Error("Cannot find square root: probably non-prime P");
        if (1 === r) return D;
        let o = i.pow(n, e),
            s = (e + q) / A;
        return function(t, n) {
            if (t.is0(n)) return n;
            if (1 !== G(t, n)) throw Error("Cannot find square root");
            let i = r,
                a = t.mul(t.ONE, o),
                l = t.pow(n, e),
                u = t.pow(n, s);
            for (; !t.eql(l, t.ONE);) {
                if (t.is0(l)) return t.ZERO;
                let e = 1,
                    r = t.sqr(l);
                for (; !t.eql(r, t.ONE);)
                    if (e++, r = t.sqr(r), e === i) throw Error("Cannot find square root");
                let n = q << BigInt(i - e - 1),
                    o = t.pow(a, n);
                i = e, a = t.sqr(o), l = t.mul(l, a), u = t.mul(u, o)
            }
            return u
        }
    }
    let Y = (t, e) => (C(t, e) & q) === q,
        z = ["create", "isValid", "is0", "neg", "inv", "sqrt", "sqr", "eql", "add", "sub", "mul", "pow", "div", "addN", "subN", "mulN", "sqrN"];

    function M(t) {
        return O(t, z.reduce((t, e) => (t[e] = "function", t), {
            ORDER: "bigint",
            MASK: "bigint",
            BYTES: "number",
            BITS: "number"
        })), t
    }

    function k(t, e, r = !1) {
        let n = Array(e.length).fill(r ? t.ZERO : void 0),
            i = e.reduce((e, r, i) => t.is0(r) ? e : (n[i] = e, t.mul(e, r)), t.ONE),
            o = t.inv(i);
        return e.reduceRight((e, r, i) => t.is0(r) ? e : (n[i] = t.mul(e, n[i]), t.mul(e, r)), o), n
    }

    function G(t, e) {
        let r = (t.ORDER - q) / A,
            n = t.pow(e, r),
            i = t.eql(n, t.ONE),
            o = t.eql(n, t.ZERO),
            s = t.eql(n, t.neg(t.ONE));
        if (!i && !o && !s) throw Error("invalid Legendre symbol result");
        return i ? 1 : o ? 0 : -1
    }

    function X(t, e) {
        void 0 !== e && (0, n.anumber)(e);
        let r = void 0 !== e ? e : t.toString(2).length,
            i = Math.ceil(r / 8);
        return {
            nBitLength: r,
            nByteLength: i
        }
    }

    function $(t, e, r = !1, n = {}) {
        let i, o, s, a;
        if (t <= I) throw Error("invalid field: expected ORDER > 0, got " + t);
        let l = !1;
        if ("object" == typeof e && null != e) {
            if (n.sqrt || r) throw Error("cannot specify opts in two arguments");
            e.BITS && (o = e.BITS), e.sqrt && (s = e.sqrt), "boolean" == typeof e.isLE && (r = e.isLE), "boolean" == typeof e.modFromBytes && (l = e.modFromBytes), a = e.allowedLengths
        } else "number" == typeof e && (o = e), n.sqrt && (s = n.sqrt);
        let {
            nBitLength: u,
            nByteLength: m
        } = X(t, o);
        if (m > 2048) throw Error("invalid field: expected ORDER of <= 2048 bytes");
        let y = Object.freeze({
            ORDER: t,
            isLE: r,
            BITS: u,
            BYTES: m,
            MASK: b(u),
            ZERO: I,
            ONE: q,
            allowedLengths: a,
            create: e => C(e, t),
            isValid: e => {
                if ("bigint" != typeof e) throw Error("invalid field element: expected bigint, got " + typeof e);
                return I <= e && e < t
            },
            is0: t => t === I,
            isValidNot0: t => !y.is0(t) && y.isValid(t),
            isOdd: t => (t & q) === q,
            neg: e => C(-e, t),
            eql: (t, e) => t === e,
            sqr: e => C(e * e, t),
            add: (e, r) => C(e + r, t),
            sub: (e, r) => C(e - r, t),
            mul: (e, r) => C(e * r, t),
            pow: (t, e) => (function(t, e, r) {
                if (r < I) throw Error("invalid exponent, negatives unsupported");
                if (r === I) return t.ONE;
                if (r === q) return e;
                let n = t.ONE,
                    i = e;
                for (; r > I;) r & q && (n = t.mul(n, i)), i = t.sqr(i), r >>= q;
                return n
            })(y, t, e),
            div: (e, r) => C(e * K(r, t), t),
            sqrN: t => t * t,
            addN: (t, e) => t + e,
            subN: (t, e) => t - e,
            mulN: (t, e) => t * e,
            inv: e => K(e, t),
            sqrt: s || (e => (i || (i = function(t) {
                if (t % F === T) return D;
                if (t % V === Z) return j;
                if (t % P === U) {
                    let e, r, n, i, o, s;
                    return e = $(t), n = (r = L(t))(e, e.neg(e.ONE)), i = r(e, n), o = r(e, e.neg(n)), s = (t + N) / P, (t, e) => {
                        let r = t.pow(e, s),
                            a = t.mul(r, n),
                            l = t.mul(r, i),
                            u = t.mul(r, o),
                            f = t.eql(t.sqr(a), e),
                            c = t.eql(t.sqr(l), e);
                        r = t.cmov(r, a, f), a = t.cmov(u, l, c);
                        let d = t.eql(t.sqr(a), e),
                            h = t.cmov(r, a, d);
                        return H(t, h, e), h
                    }
                }
                return L(t)
            }(t)), i(y, e))),
            toBytes: t => r ? h(t, m) : d(t, m),
            fromBytes: (e, n = !0) => {
                if (a) {
                    if (!a.includes(e.length) || e.length > m) throw Error("Field.fromBytes: expected " + a + " bytes, got " + e.length);
                    let t = new Uint8Array(m);
                    t.set(e, r ? 0 : t.length - e.length), e = t
                }
                if (e.length !== m) throw Error("Field.fromBytes: expected " + m + " bytes, got " + e.length);
                let i = r ? c(e) : f(e);
                if (l && (i = C(i, t)), !n && !y.isValid(i)) throw Error("invalid field element: outside of range 0..ORDER");
                return i
            },
            invertBatch: t => k(y, t),
            cmov: (t, e, r) => r ? e : t
        });
        return Object.freeze(y)
    }

    function W(t, e) {
        if (!t.isOdd) throw Error("Field doesn't have isOdd");
        let r = t.sqrt(e);
        return t.isOdd(r) ? t.neg(r) : r
    }

    function J(t) {
        if ("bigint" != typeof t) throw Error("field order must be bigint");
        return Math.ceil(t.toString(2).length / 8)
    }

    function Q(t) {
        let e = J(t);
        return e + Math.ceil(e / 2)
    }

    function tt(t, e, r = !1) {
        let n = t.length,
            i = J(e),
            o = Q(e);
        if (n < 16 || n < o || n > 1024) throw Error("expected " + o + "-1024 bytes of input, got " + n);
        let s = C(r ? c(t) : f(t), e - q) + q;
        return r ? h(s, i) : d(s, i)
    }
    t.s(["Field", 0, $, "FpInvertBatch", 0, k, "FpSqrtEven", 0, W, "getMinHashLength", 0, Q, "isNegativeLE", 0, Y, "mapHashToField", 0, tt, "mod", 0, C, "nLength", 0, X, "pow2", 0, _, "validateField", 0, M], 65140);
    let te = BigInt(0),
        tr = BigInt(1);

    function tn(t, e) {
        let r = e.negate();
        return t ? r : e
    }

    function ti(t, e) {
        let r = k(t.Fp, e.map(t => t.Z));
        return e.map((e, n) => t.fromAffine(e.toAffine(r[n])))
    }

    function to(t, e) {
        if (!Number.isSafeInteger(t) || t <= 0 || t > e) throw Error("invalid window size, expected [1.." + e + "], got W=" + t)
    }

    function ts(t, e) {
        to(t, e);
        let r = Math.ceil(e / t) + 1,
            n = 2 ** (t - 1),
            i = 2 ** t;
        return {
            windows: r,
            windowSize: n,
            mask: b(t),
            maxNumber: i,
            shiftBy: BigInt(t)
        }
    }

    function ta(t, e, r) {
        let {
            windowSize: n,
            mask: i,
            maxNumber: o,
            shiftBy: s
        } = r, a = Number(t & i), l = t >> s;
        a > n && (a -= o, l += tr);
        let u = e * n,
            f = u + Math.abs(a) - 1,
            c = 0 === a;
        return {
            nextN: l,
            offset: f,
            isZero: c,
            isNeg: a < 0,
            isNegF: e % 2 != 0,
            offsetF: u
        }
    }
    let tl = new WeakMap,
        tu = new WeakMap;

    function tf(t) {
        return tu.get(t) || 1
    }

    function tc(t) {
        if (t !== te) throw Error("invalid wNAF")
    }
    class td {
        constructor(t, e) {
            this.BASE = t.BASE, this.ZERO = t.ZERO, this.Fn = t.Fn, this.bits = e
        }
        _unsafeLadder(t, e, r = this.ZERO) {
            let n = t;
            for (; e > te;) e & tr && (r = r.add(n)), n = n.double(), e >>= tr;
            return r
        }
        precomputeWindow(t, e) {
            let {
                windows: r,
                windowSize: n
            } = ts(e, this.bits), i = [], o = t, s = o;
            for (let t = 0; t < r; t++) {
                s = o, i.push(s);
                for (let t = 1; t < n; t++) s = s.add(o), i.push(s);
                o = s.double()
            }
            return i
        }
        wNAF(t, e, r) {
            if (!this.Fn.isValid(r)) throw Error("invalid scalar");
            let n = this.ZERO,
                i = this.BASE,
                o = ts(t, this.bits);
            for (let t = 0; t < o.windows; t++) {
                let {
                    nextN: s,
                    offset: a,
                    isZero: l,
                    isNeg: u,
                    isNegF: f,
                    offsetF: c
                } = ta(r, t, o);
                r = s, l ? i = i.add(tn(f, e[c])) : n = n.add(tn(u, e[a]))
            }
            return tc(r), {
                p: n,
                f: i
            }
        }
        wNAFUnsafe(t, e, r, n = this.ZERO) {
            let i = ts(t, this.bits);
            for (let t = 0; t < i.windows && r !== te; t++) {
                let {
                    nextN: o,
                    offset: s,
                    isZero: a,
                    isNeg: l
                } = ta(r, t, i);
                if (r = o, !a) {
                    let t = e[s];
                    n = n.add(l ? t.negate() : t)
                }
            }
            return tc(r), n
        }
        getPrecomputes(t, e, r) {
            let n = tl.get(e);
            return n || (n = this.precomputeWindow(e, t), 1 !== t && ("function" == typeof r && (n = r(n)), tl.set(e, n))), n
        }
        cached(t, e, r) {
            let n = tf(t);
            return this.wNAF(n, this.getPrecomputes(n, t, r), e)
        }
        unsafe(t, e, r, n) {
            let i = tf(t);
            return 1 === i ? this._unsafeLadder(t, e, n) : this.wNAFUnsafe(i, this.getPrecomputes(i, t, r), e, n)
        }
        createCache(t, e) {
            to(e, this.bits), tu.set(t, e), tl.delete(t)
        }
        hasCache(t) {
            return 1 !== tf(t)
        }
    }

    function th(t, e, r, n) {
        if (!Array.isArray(r)) throw Error("array expected");
        r.forEach((e, r) => {
            if (!(e instanceof t)) throw Error("invalid point at index " + r)
        });
        if (!Array.isArray(n)) throw Error("array of scalars expected");
        n.forEach((t, r) => {
            if (!e.isValid(t)) throw Error("invalid scalar at index " + r)
        });
        let i = r.length,
            o = n.length;
        if (i !== o) throw Error("arrays of points and scalars must have equal length");
        let s = t.ZERO,
            a = B(BigInt(i)),
            l = 1;
        a > 12 ? l = a - 3 : a > 4 ? l = a - 2 : a > 0 && (l = 2);
        let u = b(l),
            f = Array(Number(u) + 1).fill(s),
            c = Math.floor((e.BITS - 1) / l) * l,
            d = s;
        for (let t = c; t >= 0; t -= l) {
            f.fill(s);
            for (let e = 0; e < o; e++) {
                let i = Number(n[e] >> BigInt(t) & u);
                f[i] = f[i].add(r[e])
            }
            let e = s;
            for (let t = f.length - 1, r = s; t > 0; t--) r = r.add(f[t]), e = e.add(r);
            if (d = d.add(e), 0 !== t)
                for (let t = 0; t < l; t++) d = d.double()
        }
        return d
    }

    function tm(t, e, r) {
        if (!e) return $(t, {
            isLE: r
        });
        if (e.ORDER !== t) throw Error("Field.ORDER must match order: Fp == p, Fn == n");
        return M(e), e
    }

    function ty(t, e, r = {}, n) {
        if (void 0 === n && (n = "edwards" === t), !e || "object" != typeof e) throw Error(`expected valid ${t} CURVE object`);
        for (let t of ["p", "n", "h"]) {
            let r = e[t];
            if (!("bigint" == typeof r && r > te)) throw Error(`CURVE.${t} must be positive bigint`)
        }
        let i = tm(e.p, r.Fp, n),
            o = tm(e.n, r.Fn, n);
        for (let r of ["Gx", "Gy", "a", "weierstrass" === t ? "b" : "d"])
            if (!i.isValid(e[r])) throw Error(`CURVE.${r} must be valid field element of CURVE.Fp`);
        return {
            CURVE: e = Object.freeze(Object.assign({}, e)),
            Fp: i,
            Fn: o
        }
    }
    let tp = BigInt(0),
        tg = BigInt(1),
        tE = BigInt(2),
        tw = BigInt(8);
    class tB {
        constructor(t) {
            this.ep = t
        }
        static fromBytes(t) {
            R()
        }
        static fromHex(t) {
            R()
        }
        get x() {
            return this.toAffine().x
        }
        get y() {
            return this.toAffine().y
        }
        clearCofactor() {
            return this
        }
        assertValidity() {
            this.ep.assertValidity()
        }
        toAffine(t) {
            return this.ep.toAffine(t)
        }
        toHex() {
            return (0, n.bytesToHex)(this.toBytes())
        }
        toString() {
            return this.toHex()
        }
        isTorsionFree() {
            return !0
        }
        isSmallOrder() {
            return !1
        }
        add(t) {
            return this.assertSame(t), this.init(this.ep.add(t.ep))
        }
        subtract(t) {
            return this.assertSame(t), this.init(this.ep.subtract(t.ep))
        }
        multiply(t) {
            return this.init(this.ep.multiply(t))
        }
        multiplyUnsafe(t) {
            return this.init(this.ep.multiplyUnsafe(t))
        }
        double() {
            return this.init(this.ep.double())
        }
        negate() {
            return this.init(this.ep.negate())
        }
        precompute(t, e) {
            return this.init(this.ep.precompute(t, e))
        }
        toRawBytes() {
            return this.toBytes()
        }
    }

    function tb(t, e) {
        if (tv(t), tv(e), t < 0 || t >= 1 << 8 * e) throw Error("invalid I2OSP input: " + t);
        let r = Array.from({
            length: e
        }).fill(0);
        for (let n = e - 1; n >= 0; n--) r[n] = 255 & t, t >>>= 8;
        return new Uint8Array(r)
    }

    function tv(t) {
        if (!Number.isSafeInteger(t)) throw Error("number expected")
    }

    function tx(t) {
        if (!(0, n.isBytes)(t) && "string" != typeof t) throw Error("DST must be Uint8Array or string");
        return "string" == typeof t ? (0, n.utf8ToBytes)(t) : t
    }

    function tO(t, e, r, i) {
        (0, n.abytes)(t), tv(r), (e = tx(e)).length > 255 && (e = i((0, n.concatBytes)((0, n.utf8ToBytes)("H2C-OVERSIZE-DST-"), e)));
        let {
            outputLen: o,
            blockLen: s
        } = i, a = Math.ceil(r / o);
        if (r > 65535 || a > 255) throw Error("expand_message_xmd: invalid lenInBytes");
        let l = (0, n.concatBytes)(e, tb(e.length, 1)),
            u = tb(0, s),
            f = tb(r, 2),
            c = Array(a),
            d = i((0, n.concatBytes)(u, t, f, tb(0, 1), l));
        c[0] = i((0, n.concatBytes)(d, tb(1, 1), l));
        for (let t = 1; t <= a; t++) {
            let e = [function(t, e) {
                let r = new Uint8Array(t.length);
                for (let n = 0; n < t.length; n++) r[n] = t[n] ^ e[n];
                return r
            }(d, c[t - 1]), tb(t + 1, 1), l];
            c[t] = i((0, n.concatBytes)(...e))
        }
        return (0, n.concatBytes)(...c).slice(0, r)
    }

    function tR(t, e, r) {
        let i;
        O(r, {
            p: "bigint",
            m: "number",
            k: "number",
            hash: "function"
        });
        let {
            p: o,
            k: s,
            m: a,
            hash: l,
            expand: u,
            DST: c
        } = r;
        if (!x(r.hash)) throw Error("expected valid hash");
        (0, n.abytes)(t), tv(e);
        let d = Math.ceil((o.toString(2).length + s) / 8),
            h = e * a * d;
        if ("xmd" === u) i = tO(t, c, h, l);
        else if ("xof" === u) i = function(t, e, r, i, o) {
            if ((0, n.abytes)(t), tv(r), (e = tx(e)).length > 255) {
                let t = Math.ceil(2 * i / 8);
                e = o.create({
                    dkLen: t
                }).update((0, n.utf8ToBytes)("H2C-OVERSIZE-DST-")).update(e).digest()
            }
            if (r > 65535 || e.length > 255) throw Error("expand_message_xof: invalid lenInBytes");
            return o.create({
                dkLen: r
            }).update(t).update(tb(r, 2)).update(e).update(tb(e.length, 1)).digest()
        }(t, c, h, s, l);
        else if ("_internal_pass" === u) i = t;
        else throw Error('expand must be "xmd" or "xof"');
        let m = Array(e);
        for (let t = 0; t < e; t++) {
            let e = Array(a);
            for (let r = 0; r < a; r++) {
                let n = d * (r + t * a),
                    s = i.subarray(n, n + d);
                e[r] = C(f(s), o)
            }
            m[t] = e
        }
        return m
    }
    let tS = (0, n.utf8ToBytes)("HashToScalar-");

    function tI(t, e, r) {
        if ("function" != typeof e) throw Error("mapToCurve() must be defined");

        function n(r) {
            return t.fromAffine(e(r))
        }

        function i(e) {
            let r = e.clearCofactor();
            return r.equals(t.ZERO) ? t.ZERO : (r.assertValidity(), r)
        }
        return {
            defaults: r,
            hashToCurve(t, e) {
                let o = tR(t, 2, Object.assign({}, r, e)),
                    s = n(o[0]),
                    a = n(o[1]);
                return i(s.add(a))
            },
            encodeToCurve(t, e) {
                let o = r.encodeDST ? {
                    DST: r.encodeDST
                } : {};
                return i(n(tR(t, 1, Object.assign({}, r, o, e))[0]))
            },
            mapToCurve(t) {
                if (!Array.isArray(t)) throw Error("expected array of bigints");
                for (let e of t)
                    if ("bigint" != typeof e) throw Error("expected array of bigints");
                return i(n(t))
            },
            hashToScalar: (e, n) => tR(e, 1, Object.assign({}, r, {
                p: t.Fn.ORDER,
                m: 1,
                DST: tS
            }, n))[0][0]
        }
    }
    t.s(["_DST_scalar", 0, tS, "createHasher", 0, tI, "expand_message_xmd", 0, tO, "isogenyMap", 0, function(t, e) {
        let r = e.map(t => Array.from(t).reverse());
        return (e, n) => {
            let [i, o, s, a] = r.map(r => r.reduce((r, n) => t.add(t.mul(r, e), n))), [l, u] = k(t, [o, a], !0);
            return e = t.mul(i, l), n = t.mul(n, t.mul(s, u)), {
                x: e,
                y: n
            }
        }
    }], 553037);
    let tq = BigInt(0),
        tA = BigInt(1),
        tT = BigInt(2),
        tF = BigInt(0),
        tZ = BigInt(1),
        tN = BigInt(2),
        tV = BigInt(3),
        tU = BigInt(5),
        tP = BigInt(8),
        tC = BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed"),
        t_ = {
            p: tC,
            n: BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),
            h: tP,
            a: BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),
            d: BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),
            Gx: BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),
            Gy: BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")
        };

    function tK(t) {
        let e = BigInt(10),
            r = BigInt(20),
            n = BigInt(40),
            i = BigInt(80),
            o = t * t % tC * t % tC,
            s = _(o, tN, tC) * o % tC,
            a = _(s, tZ, tC) * t % tC,
            l = _(a, tU, tC) * a % tC,
            u = _(l, e, tC) * l % tC,
            f = _(u, r, tC) * u % tC,
            c = _(f, n, tC) * f % tC,
            d = _(c, i, tC) * c % tC,
            h = _(d, i, tC) * c % tC,
            m = _(h, e, tC) * l % tC;
        return {
            pow_p_5_8: _(m, tN, tC) * t % tC,
            b2: o
        }
    }

    function tH(t) {
        return t[0] &= 248, t[31] &= 127, t[31] |= 64, t
    }
    let tD = BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");

    function tj(t, e) {
        let r = C(e * e * e, tC),
            n = tK(t * C(r * r * e, tC)).pow_p_5_8,
            i = C(t * r * n, tC),
            o = C(e * i * i, tC),
            s = i,
            a = C(i * tD, tC),
            l = o === t,
            u = o === C(-t, tC),
            f = o === C(-t * tD, tC);
        return l && (i = s), (u || f) && (i = a), Y(i, tC) && (i = C(-i, tC)), {
            isValid: l || u,
            value: i
        }
    }
    let tL = $(t_.p, {
            isLE: !0
        }),
        tY = $(t_.n, {
            isLE: !0
        }),
        tz = function(t) {
            let e, r, i, o, {
                    CURVE: l,
                    curveOpts: u,
                    hash: f,
                    eddsaOpts: d
                } = (e = {
                    a: t.a,
                    d: t.d,
                    p: t.Fp.ORDER,
                    n: t.n,
                    h: t.h,
                    Gx: t.Gx,
                    Gy: t.Gy
                }, r = {
                    Fp: t.Fp,
                    Fn: $(e.n, t.nBitLength, !0),
                    uvRatio: t.uvRatio
                }, i = {
                    randomBytes: t.randomBytes,
                    adjustScalarBytes: t.adjustScalarBytes,
                    domain: t.domain,
                    prehash: t.prehash,
                    mapToCurve: t.mapToCurve
                }, {
                    CURVE: e,
                    curveOpts: r,
                    hash: t.hash,
                    eddsaOpts: i
                }),
                h = function(t, e, r = {}) {
                    if ("function" != typeof e) throw Error('"hash" function param is required');
                    O(r, {}, {
                        adjustScalarBytes: "function",
                        randomBytes: "function",
                        domain: "function",
                        prehash: "function",
                        mapToCurve: "function"
                    });
                    let {
                        prehash: i
                    } = r, {
                        BASE: o,
                        Fp: l,
                        Fn: u
                    } = t, f = r.randomBytes || n.randomBytes, d = r.adjustScalarBytes || (t => t), h = r.domain || ((t, e, r) => {
                        if (s(r, "phflag"), e.length || r) throw Error("Contexts/pre-hash are not supported");
                        return t
                    });

                    function y(t) {
                        return u.create(c(t))
                    }

                    function p(t) {
                        var r;
                        let n, i, s, a, l, {
                                head: u,
                                prefix: f,
                                scalar: c
                            } = (r = m("private key", r = t, n = b.secretKey), s = d((i = m("hashed private key", e(r), 2 * n)).slice(0, n)), a = i.slice(n, 2 * n), l = y(s), {
                                head: s,
                                prefix: a,
                                scalar: l
                            }),
                            h = o.multiply(c),
                            p = h.toBytes();
                        return {
                            head: u,
                            prefix: f,
                            scalar: c,
                            point: h,
                            pointBytes: p
                        }
                    }

                    function g(t) {
                        return p(t).pointBytes
                    }

                    function E(t = Uint8Array.of(), ...r) {
                        return y(e(h((0, n.concatBytes)(...r), m("context", t), !!i)))
                    }
                    let w = {
                            zip215: !0
                        },
                        B = l.BYTES,
                        b = {
                            secretKey: B,
                            publicKey: B,
                            signature: 2 * B,
                            seed: B
                        };

                    function v(t = f(b.seed)) {
                        return a(t, b.seed, "seed")
                    }
                    let x = {
                        getExtendedPublicKey: p,
                        randomSecretKey: v,
                        isValidSecretKey: function(t) {
                            return (0, n.isBytes)(t) && t.length === u.BYTES
                        },
                        isValidPublicKey: function(e, r) {
                            try {
                                return !!t.fromBytes(e, r)
                            } catch (t) {
                                return !1
                            }
                        },
                        toMontgomery(e) {
                            let {
                                y: r
                            } = t.fromBytes(e), n = b.publicKey, i = 32 === n;
                            if (!i && 57 !== n) throw Error("only defined for 25519 and 448");
                            let o = i ? l.div(tg + r, tg - r) : l.div(r - tg, r + tg);
                            return l.toBytes(o)
                        },
                        toMontgomerySecret(t) {
                            let r = b.secretKey;
                            return a(t, r), d(e(t.subarray(0, r))).subarray(0, r)
                        },
                        randomPrivateKey: v,
                        precompute: (e = 8, r = t.BASE) => r.precompute(e, !1)
                    };
                    return Object.freeze({
                        keygen: function(t) {
                            let e = x.randomSecretKey(t);
                            return {
                                secretKey: e,
                                publicKey: g(e)
                            }
                        },
                        getPublicKey: g,
                        sign: function(t, e, r = {}) {
                            t = m("message", t), i && (t = i(t));
                            let {
                                prefix: s,
                                scalar: l,
                                pointBytes: f
                            } = p(e), c = E(r.context, s, t), d = o.multiply(c).toBytes(), h = E(r.context, d, f, t), y = u.create(c + h * l);
                            if (!u.isValid(y)) throw Error("sign failed: invalid s");
                            return a((0, n.concatBytes)(d, u.toBytes(y)), b.signature, "result")
                        },
                        verify: function(e, r, n, a = w) {
                            let l, u, f, {
                                    context: d,
                                    zip215: h
                                } = a,
                                y = b.signature;
                            e = m("signature", e, y), r = m("message", r), n = m("publicKey", n, b.publicKey), void 0 !== h && s(h, "zip215"), i && (r = i(r));
                            let p = y / 2,
                                g = e.subarray(0, p),
                                B = c(e.subarray(p, y));
                            try {
                                l = t.fromBytes(n, h), u = t.fromBytes(g, h), f = o.multiplyUnsafe(B)
                            } catch (t) {
                                return !1
                            }
                            if (!h && l.isSmallOrder()) return !1;
                            let v = E(d, u.toBytes(), l.toBytes(), r);
                            return u.add(l.multiplyUnsafe(v)).subtract(f).clearCofactor().is0()
                        },
                        utils: x,
                        Point: t,
                        lengths: b
                    })
                }(function(t, e = {}) {
                    var r, i;
                    let o, l, u, f, d, h = ty("edwards", t, e, e.FpFnLE),
                        {
                            Fp: y,
                            Fn: g
                        } = h,
                        E = h.CURVE,
                        {
                            h: B
                        } = E;
                    O(e, {}, {
                        uvRatio: "function"
                    });
                    let b = tE << BigInt(8 * g.BYTES) - tg,
                        v = e.uvRatio || ((t, e) => {
                            try {
                                return {
                                    isValid: !0,
                                    value: y.sqrt(y.div(t, e))
                                }
                            } catch (t) {
                                return {
                                    isValid: !1,
                                    value: tp
                                }
                            }
                        });
                    if (r = E.Gx, i = E.Gy, o = y.sqr(r), l = y.sqr(i), u = y.add(y.mul(E.a, o), l), f = y.add(y.ONE, y.mul(E.d, y.mul(o, l))), !y.eql(u, f)) throw Error("bad curve params: generator point");

                    function x(t, e, r = !1) {
                        return w("coordinate " + t, e, r ? tg : tp, b), e
                    }

                    function R(t) {
                        if (!(t instanceof A)) throw Error("ExtendedPoint expected")
                    }
                    let I = S((t, e) => {
                            let r, n, {
                                    X: i,
                                    Y: o,
                                    Z: s
                                } = t,
                                a = t.is0();
                            null == e && (e = a ? tw : y.inv(s));
                            let l = (r = i * e, y.create(r)),
                                u = (n = o * e, y.create(n)),
                                f = y.mul(s, e);
                            if (a) return {
                                x: tp,
                                y: tg
                            };
                            if (f !== tg) throw Error("invZ was invalid");
                            return {
                                x: l,
                                y: u
                            }
                        }),
                        q = S(t => {
                            let e, r, n, i, o, s, a, l, u, f, c, d, {
                                a: h,
                                d: m
                            } = E;
                            if (t.is0()) throw Error("bad point: ZERO");
                            let {
                                X: p,
                                Y: g,
                                Z: w,
                                T: B
                            } = t, b = (e = p * p, y.create(e)), v = (r = g * g, y.create(r)), x = (n = w * w, y.create(n)), O = (i = x * x, y.create(i));
                            if (a = x * (o = b * h, s = y.create(o) + v, y.create(s)), y.create(a) !== (f = O + (u = m * (l = b * v, y.create(l)), y.create(u)), y.create(f))) throw Error("bad point: equation left != right (1)");
                            if (c = p * g, y.create(c) !== (d = w * B, y.create(d))) throw Error("bad point: equation left != right (2)");
                            return !0
                        });
                    class A {
                        constructor(t, e, r, n) {
                            this.X = x("x", t), this.Y = x("y", e), this.Z = x("z", r, !0), this.T = x("t", n), Object.freeze(this)
                        }
                        static CURVE() {
                            return E
                        }
                        static fromAffine(t) {
                            let e;
                            if (t instanceof A) throw Error("extended point not allowed");
                            let {
                                x: r,
                                y: n
                            } = t || {};
                            return x("x", r), x("y", n), new A(r, n, tg, (e = r * n, y.create(e)))
                        }
                        static fromBytes(t, e = !1) {
                            let r, n, i, o, l = y.BYTES,
                                {
                                    a: u,
                                    d: f
                                } = E;
                            t = p(a(t, l, "point")), s(e, "zip215");
                            let d = p(t),
                                h = t[l - 1];
                            d[l - 1] = -129 & h;
                            let m = c(d);
                            w("point.y", m, tp, e ? b : y.ORDER);
                            let g = (r = m * m, y.create(r)),
                                {
                                    isValid: B,
                                    value: x
                                } = v((n = g - tg, y.create(n)), (i = f * g - u, y.create(i)));
                            if (!B) throw Error("bad point: invalid y coordinate");
                            let O = (x & tg) === tg,
                                R = (128 & h) != 0;
                            if (!e && x === tp && R) throw Error("bad point: x=0 and x_0=1");
                            return R !== O && (o = -x, x = y.create(o)), A.fromAffine({
                                x,
                                y: m
                            })
                        }
                        static fromHex(t, e = !1) {
                            return A.fromBytes(m("point", t), e)
                        }
                        get x() {
                            return this.toAffine().x
                        }
                        get y() {
                            return this.toAffine().y
                        }
                        precompute(t = 8, e = !0) {
                            return T.createCache(this, t), e || this.multiply(tE), this
                        }
                        assertValidity() {
                            q(this)
                        }
                        equals(t) {
                            let e, r, n, i;
                            R(t);
                            let {
                                X: o,
                                Y: s,
                                Z: a
                            } = this, {
                                X: l,
                                Y: u,
                                Z: f
                            } = t, c = (e = o * f, y.create(e)), d = (r = l * a, y.create(r)), h = (n = s * f, y.create(n)), m = (i = u * a, y.create(i));
                            return c === d && h === m
                        }
                        is0() {
                            return this.equals(A.ZERO)
                        }
                        negate() {
                            let t, e;
                            return new A((t = -this.X, y.create(t)), this.Y, this.Z, (e = -this.T, y.create(e)))
                        }
                        double() {
                            let t, e, r, n, i, o, s, a, l, u, f, {
                                    a: c
                                } = E,
                                {
                                    X: d,
                                    Y: h,
                                    Z: m
                                } = this,
                                p = (t = d * d, y.create(t)),
                                g = (e = h * h, y.create(e)),
                                w = (n = tE * (r = m * m, y.create(r)), y.create(n)),
                                B = (i = c * p, y.create(i)),
                                b = d + h,
                                v = (o = b * b, s = y.create(o) - p - g, y.create(s)),
                                x = B + g,
                                O = x - w,
                                R = B - g,
                                S = (a = v * O, y.create(a)),
                                I = (l = x * R, y.create(l)),
                                q = (u = v * R, y.create(u));
                            return new A(S, I, (f = O * x, y.create(f)), q)
                        }
                        add(t) {
                            let e, r, n, i, o, s, a, l, u, f;
                            R(t);
                            let {
                                a: c,
                                d
                            } = E, {
                                X: h,
                                Y: m,
                                Z: p,
                                T: g
                            } = this, {
                                X: w,
                                Y: B,
                                Z: b,
                                T: v
                            } = t, x = (e = h * w, y.create(e)), O = (r = m * B, y.create(r)), S = (n = g * d * v, y.create(n)), I = (i = p * b, y.create(i)), q = (o = (h + m) * (w + B) - x - O, y.create(o)), T = I - S, F = I + S, Z = (s = O - c * x, y.create(s)), N = (a = q * T, y.create(a)), V = (l = F * Z, y.create(l)), U = (u = q * Z, y.create(u));
                            return new A(N, V, (f = T * F, y.create(f)), U)
                        }
                        subtract(t) {
                            return this.add(t.negate())
                        }
                        multiply(t) {
                            if (!g.isValidNot0(t)) throw Error("invalid scalar: expected 1 <= sc < curve.n");
                            let {
                                p: e,
                                f: r
                            } = T.cached(this, t, t => ti(A, t));
                            return ti(A, [e, r])[0]
                        }
                        multiplyUnsafe(t, e = A.ZERO) {
                            if (!g.isValid(t)) throw Error("invalid scalar: expected 0 <= sc < curve.n");
                            return t === tp ? A.ZERO : this.is0() || t === tg ? this : T.unsafe(this, t, t => ti(A, t), e)
                        }
                        isSmallOrder() {
                            return this.multiplyUnsafe(B).is0()
                        }
                        isTorsionFree() {
                            return T.unsafe(this, E.n).is0()
                        }
                        toAffine(t) {
                            return I(this, t)
                        }
                        clearCofactor() {
                            return B === tg ? this : this.multiplyUnsafe(B)
                        }
                        toBytes() {
                            let {
                                x: t,
                                y: e
                            } = this.toAffine(), r = y.toBytes(e);
                            return r[r.length - 1] |= t & tg ? 128 : 0, r
                        }
                        toHex() {
                            return (0, n.bytesToHex)(this.toBytes())
                        }
                        toString() {
                            return `<Point ${this.is0()?"ZERO":this.toHex()}>`
                        }
                        get ex() {
                            return this.X
                        }
                        get ey() {
                            return this.Y
                        }
                        get ez() {
                            return this.Z
                        }
                        get et() {
                            return this.T
                        }
                        static normalizeZ(t) {
                            return ti(A, t)
                        }
                        static msm(t, e) {
                            return th(A, g, t, e)
                        }
                        _setWindowSize(t) {
                            this.precompute(t)
                        }
                        toRawBytes() {
                            return this.toBytes()
                        }
                    }
                    A.BASE = new A(E.Gx, E.Gy, tg, (d = E.Gx * E.Gy, y.create(d))), A.ZERO = new A(tp, tg, tg, tp), A.Fp = y, A.Fn = g;
                    let T = new td(A, g.BITS);
                    return A.BASE.precompute(8), A
                }(l, u), f, d);
            return o = h.Point, Object.assign({}, h, {
                ExtendedPoint: o,
                CURVE: t,
                nBitLength: o.Fn.BITS,
                nByteLength: o.Fn.BYTES
            })
        }({ ...t_,
            Fp: tL,
            hash: r.sha512,
            adjustScalarBytes: tH,
            uvRatio: tj
        }),
        tM = function(t) {
            let {
                P: e,
                type: r,
                adjustScalarBytes: i,
                powPminus2: o,
                randomBytes: s
            } = (O(t, {
                adjustScalarBytes: "function",
                powPminus2: "function"
            }), Object.freeze({ ...t
            })), a = "x25519" === r;
            if (!a && "x448" !== r) throw Error("invalid type");
            let l = s || n.randomBytes,
                u = a ? 255 : 448,
                f = a ? 32 : 56,
                d = a ? BigInt(9) : BigInt(5),
                y = a ? BigInt(121665) : BigInt(39081),
                p = a ? tT ** BigInt(254) : tT ** BigInt(447),
                g = p + (a ? BigInt(8) * tT ** BigInt(251) - tA : BigInt(4) * tT ** BigInt(445) - tA) + tA,
                E = t => C(t, e),
                B = h(E(d), f);

            function b(t, r) {
                let n, s = function(t, r) {
                    w("u", t, tq, e), w("scalar", r, p, g);
                    let n = tA,
                        i = tq,
                        s = t,
                        a = tA,
                        l = tq;
                    for (let e = BigInt(u - 1); e >= tq; e--) {
                        let o = r >> e & tA;
                        l ^= o, ({
                            x_2: n,
                            x_3: s
                        } = x(l, n, s)), ({
                            x_2: i,
                            x_3: a
                        } = x(l, i, a)), l = o;
                        let u = n + i,
                            f = E(u * u),
                            c = n - i,
                            d = E(c * c),
                            h = f - d,
                            m = s + a,
                            p = E((s - a) * u),
                            g = E(m * c),
                            w = p + g,
                            B = p - g;
                        s = E(w * w), a = E(t * E(B * B)), n = E(f * d), i = E(h * (f + E(y * h)))
                    }
                    return {
                        x_2: n,
                        x_3: s
                    } = x(l, n, s), {
                        x_2: i,
                        x_3: a
                    } = x(l, i, a), E(n * o(i))
                }((n = m("u coordinate", r, f), a && (n[31] &= 127), E(c(n))), c(i(m("scalar", t, f))));
                if (s === tq) throw Error("invalid private or public key received");
                return h(E(s), f)
            }

            function v(t) {
                return b(t, B)
            }

            function x(t, e, r) {
                let n = E(t * (e - r));
                return {
                    x_2: e = E(e - n),
                    x_3: r = E(r + n)
                }
            }
            let R = {
                    secretKey: f,
                    publicKey: f,
                    seed: f
                },
                S = (t = l(f)) => ((0, n.abytes)(t, R.seed), t);
            return {
                keygen: function(t) {
                    let e = S(t);
                    return {
                        secretKey: e,
                        publicKey: v(e)
                    }
                },
                getSharedSecret: (t, e) => b(t, e),
                getPublicKey: t => v(t),
                scalarMult: b,
                scalarMultBase: v,
                utils: {
                    randomSecretKey: S,
                    randomPrivateKey: S
                },
                GuBytes: B.slice(),
                lengths: R
            }
        }({
            P: e = tL.ORDER,
            type: "x25519",
            powPminus2: t => {
                let {
                    pow_p_5_8: r,
                    b2: n
                } = tK(t);
                return C(_(r, tV, e) * n, e)
            },
            adjustScalarBytes: tH
        }),
        tk = (tC + tV) / tP,
        tG = tL.pow(tN, tk),
        tX = tL.sqrt(tL.neg(tL.ONE)),
        t$ = W(tL, tL.neg(BigInt(486664)));
    tI(tz.Point, t => (function(t) {
        let e, r, n, i, o, s, a, l, u, f, c, d, h, m, y, p, g, E, w, B, b, v, x, {
                xMn: O,
                xMd: R,
                yMn: S,
                yMd: I
            } = (e = (tC - tU) / tP, r = BigInt(486662), n = tL.sqr(t), n = tL.mul(n, tN), i = tL.add(n, tL.ONE), o = tL.neg(r), s = tL.sqr(i), a = tL.mul(s, i), l = tL.mul(n, r), l = tL.mul(l, o), l = tL.add(l, s), l = tL.mul(l, o), u = tL.sqr(a), s = tL.sqr(u), u = tL.mul(u, a), u = tL.mul(u, l), s = tL.mul(s, u), f = tL.pow(s, e), f = tL.mul(f, u), c = tL.mul(f, tX), s = tL.sqr(f), s = tL.mul(s, a), d = tL.eql(s, l), h = tL.cmov(c, f, d), m = tL.mul(o, n), y = tL.mul(f, t), y = tL.mul(y, tG), p = tL.mul(y, tX), g = tL.mul(l, n), s = tL.sqr(y), s = tL.mul(s, a), E = tL.eql(s, g), w = tL.cmov(p, y, E), s = tL.sqr(h), s = tL.mul(s, a), B = tL.eql(s, l), b = tL.cmov(m, o, B), v = tL.cmov(w, h, B), x = tL.isOdd(v), {
                xMn: b,
                xMd: i,
                yMn: v = tL.cmov(v, tL.neg(v), B !== x),
                yMd: tZ
            }),
            q = tL.mul(O, I);
        q = tL.mul(q, t$);
        let A = tL.mul(R, S),
            T = tL.sub(O, R),
            F = tL.add(O, R),
            Z = tL.mul(A, F),
            N = tL.eql(Z, tL.ZERO);
        q = tL.cmov(q, tL.ZERO, N), A = tL.cmov(A, tL.ONE, N), T = tL.cmov(T, tL.ONE, N), F = tL.cmov(F, tL.ONE, N);
        let [V, U] = k(tL, [A, F], !0);
        return {
            x: tL.mul(q, V),
            y: tL.mul(T, U)
        }
    })(t[0]), {
        DST: "edwards25519_XMD:SHA-512_ELL2_RO_",
        encodeDST: "edwards25519_XMD:SHA-512_ELL2_NU_",
        p: tC,
        m: 1,
        k: 128,
        expand: "xmd",
        hash: r.sha512
    });
    let tW = BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235"),
        tJ = BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578"),
        tQ = BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838"),
        t0 = BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952"),
        t1 = BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"),
        t2 = t => tz.Point.Fp.create(c(t) & t1);

    function t6(t) {
        let e, r, n, i, o, s, a, l, u, f, c, d, h, m, y, {
                d: p
            } = t_,
            g = (e = tD * t * t, tL.create(e)),
            E = (r = (g + tZ) * tQ, tL.create(r)),
            w = BigInt(-1),
            B = (i = (w - p * g) * (n = g + p, tL.create(n)), tL.create(i)),
            {
                isValid: b,
                value: v
            } = tj(E, B),
            x = (o = v * t, tL.create(o));
        Y(x, tC) || (s = -x, x = tL.create(s)), b || (v = x), b || (w = g);
        let O = (a = w * (g - tZ) * t0 - B, tL.create(a)),
            R = v * v,
            S = (l = (v + v) * B, tL.create(l)),
            I = (u = O * tW, tL.create(u)),
            q = (f = tZ - R, tL.create(f)),
            A = (c = tZ + R, tL.create(c));
        return new tz.Point((d = S * A, tL.create(d)), (h = q * I, tL.create(h)), (m = I * A, tL.create(m)), (y = S * q, tL.create(y)))
    }
    class t5 extends tB {
        constructor(t) {
            super(t)
        }
        static fromAffine(t) {
            return new t5(tz.Point.fromAffine(t))
        }
        assertSame(t) {
            if (!(t instanceof t5)) throw Error("RistrettoPoint expected")
        }
        init(t) {
            return new t5(t)
        }
        static hashToCurve(t) {
            var e;
            let r, i;
            return e = m("ristrettoHash", t, 64), (0, n.abytes)(e, 64), r = t6(t2(e.subarray(0, 32))), i = t6(t2(e.subarray(32, 64))), new t5(r.add(i))
        }
        static fromBytes(t) {
            let e, r, i, o, s, a, l, u, f, c, d, h, m;
            (0, n.abytes)(t, 32);
            let {
                a: p,
                d: g
            } = t_, E = t2(t);
            if (!y(tL.toBytes(E), t) || Y(E, tC)) throw Error("invalid ristretto255 encoding 1");
            let w = (e = E * E, tL.create(e)),
                B = (r = tZ + p * w, tL.create(r)),
                b = (i = tZ - p * w, tL.create(i)),
                v = (o = B * B, tL.create(o)),
                x = (s = b * b, tL.create(s)),
                O = (a = p * g * v - x, tL.create(a)),
                {
                    isValid: R,
                    value: S
                } = (l = O * x, tj(tZ, tL.create(l))),
                I = (u = S * b, tL.create(u)),
                q = (f = S * I * O, tL.create(f)),
                A = (c = (E + E) * I, tL.create(c));
            Y(A, tC) && (d = -A, A = tL.create(d));
            let T = (h = B * q, tL.create(h)),
                F = (m = A * T, tL.create(m));
            if (!R || Y(F, tC) || T === tF) throw Error("invalid ristretto255 encoding 2");
            return new t5(new tz.Point(A, T, tZ, F))
        }
        static fromHex(t) {
            return t5.fromBytes(m("ristrettoHex", t, 32))
        }
        static msm(t, e) {
            return th(t5, tz.Point.Fn, t, e)
        }
        toBytes() {
            let t, e, r, n, i, o, s, a, l, u, f, c, d, {
                    X: h,
                    Y: m,
                    Z: y,
                    T: p
                } = this.ep,
                g = (t = y + m, r = tL.create(t) * (e = y - m, tL.create(e)), tL.create(r)),
                E = (n = h * m, tL.create(n)),
                {
                    value: w
                } = (o = g * (i = E * E, tL.create(i)), tj(tZ, tL.create(o))),
                B = (s = w * g, tL.create(s)),
                b = (a = w * E, tL.create(a)),
                v = (l = B * b * p, tL.create(l));
            if (Y(p * v, tC)) {
                let t, e, r = (t = m * tD, tL.create(t)),
                    n = (e = h * tD, tL.create(e));
                h = r, m = n, d = tL.create(B * tJ)
            } else d = b;
            Y(h * v, tC) && (u = -m, m = tL.create(u));
            let x = (f = (y - m) * d, tL.create(f));
            return Y(x, tC) && (c = -x, x = tL.create(c)), tL.toBytes(x)
        }
        equals(t) {
            let e, r, n, i;
            this.assertSame(t);
            let {
                X: o,
                Y: s
            } = this.ep, {
                X: a,
                Y: l
            } = t.ep, u = (e = o * l, tL.create(e) === (r = s * a, tL.create(r))), f = (n = s * l, tL.create(n) === (i = o * a, tL.create(i)));
            return u || f
        }
        is0() {
            return this.equals(t5.ZERO)
        }
    }
    t5.BASE = new t5(tz.Point.BASE), t5.ZERO = new t5(tz.Point.ZERO), t5.Fp = tL, t5.Fn = tY, t.s(["ed25519", 0, tz, "x25519", 0, tM], 241961);
    var t8 = t.i(388326);
    let t4 = (t, e) => (t + (t >= 0 ? e : -e) / er) / e;

    function t3(t) {
        if (!["compact", "recovered", "der"].includes(t)) throw Error('Signature format must be "compact", "recovered", or "der"');
        return t
    }

    function t7(t, e) {
        let r = {};
        for (let n of Object.keys(e)) r[n] = void 0 === t[n] ? e[n] : t[n];
        return s(r.lowS, "lowS"), s(r.prehash, "prehash"), void 0 !== r.format && t3(r.format), r
    }
    let t9 = {
            Err: class extends Error {
                constructor(t = "") {
                    super(t)
                }
            },
            _tlv: {
                encode: (t, e) => {
                    let {
                        Err: r
                    } = t9;
                    if (t < 0 || t > 256) throw new r("tlv.encode: wrong tag");
                    if (1 & e.length) throw new r("tlv.encode: unpadded data");
                    let n = e.length / 2,
                        i = l(n);
                    if (i.length / 2 & 128) throw new r("tlv.encode: long form length too big");
                    let o = n > 127 ? l(i.length / 2 | 128) : "";
                    return l(t) + o + i + e
                },
                decode(t, e) {
                    let {
                        Err: r
                    } = t9, n = 0;
                    if (t < 0 || t > 256) throw new r("tlv.encode: wrong tag");
                    if (e.length < 2 || e[n++] !== t) throw new r("tlv.decode: wrong tlv");
                    let i = e[n++],
                        o = 0;
                    if (128 & i) {
                        let t = 127 & i;
                        if (!t) throw new r("tlv.decode(long): indefinite length not supported");
                        if (t > 4) throw new r("tlv.decode(long): byte length is too big");
                        let s = e.subarray(n, n + t);
                        if (s.length !== t) throw new r("tlv.decode: length bytes not complete");
                        if (0 === s[0]) throw new r("tlv.decode(long): zero leftmost byte");
                        for (let t of s) o = o << 8 | t;
                        if (n += t, o < 128) throw new r("tlv.decode(long): not minimal encoding")
                    } else o = i;
                    let s = e.subarray(n, n + o);
                    if (s.length !== o) throw new r("tlv.decode: wrong value length");
                    return {
                        v: s,
                        l: e.subarray(n + o)
                    }
                }
            },
            _int: {
                encode(t) {
                    let {
                        Err: e
                    } = t9;
                    if (t < et) throw new e("integer: negative integers are not allowed");
                    let r = l(t);
                    if (8 & Number.parseInt(r[0], 16) && (r = "00" + r), 1 & r.length) throw new e("unexpected DER parsing assertion: unpadded hex");
                    return r
                },
                decode(t) {
                    let {
                        Err: e
                    } = t9;
                    if (128 & t[0]) throw new e("invalid signature integer: negative");
                    if (0 === t[0] && !(128 & t[1])) throw new e("invalid signature integer: unnecessary leading zero");
                    return f(t)
                }
            },
            toSig(t) {
                let {
                    Err: e,
                    _int: r,
                    _tlv: n
                } = t9, i = m("signature", t), {
                    v: o,
                    l: s
                } = n.decode(48, i);
                if (s.length) throw new e("invalid signature: left bytes after parsing");
                let {
                    v: a,
                    l: l
                } = n.decode(2, o), {
                    v: u,
                    l: f
                } = n.decode(2, l);
                if (f.length) throw new e("invalid signature: left bytes after parsing");
                return {
                    r: r.decode(a),
                    s: r.decode(u)
                }
            },
            hexFromSig(t) {
                let {
                    _tlv: e,
                    _int: r
                } = t9, n = e.encode(2, r.encode(t.r)), i = e.encode(2, r.encode(t.s));
                return e.encode(48, n + i)
            }
        },
        et = BigInt(0),
        ee = BigInt(1),
        er = BigInt(2),
        en = BigInt(3),
        ei = BigInt(4);

    function eo(t, e) {
        let r, {
            BYTES: n
        } = t;
        if ("bigint" == typeof e) r = e;
        else {
            let i = m("private key", e);
            try {
                r = t.fromBytes(i)
            } catch (t) {
                throw Error(`invalid private key: expected ui8a of size ${n}, got ${typeof e}`)
            }
        }
        if (!t.isValidNot0(r)) throw Error("invalid private key: out of range [1..N-1]");
        return r
    }

    function es(t) {
        return Uint8Array.of(t ? 2 : 3)
    }

    function ea(t, e) {
        return {
            secretKey: e.BYTES,
            publicKey: 1 + t.BYTES,
            publicKeyUncompressed: 1 + 2 * t.BYTES,
            publicKeyHasPrefix: !0,
            signature: 2 * e.BYTES
        }
    }

    function el(t) {
        let e, {
                CURVE: r,
                curveOpts: i,
                hash: o,
                ecdsaOpts: l
            } = function(t) {
                let e, r, n, i, {
                        CURVE: o,
                        curveOpts: s
                    } = (e = {
                        a: t.a,
                        b: t.b,
                        p: t.Fp.ORDER,
                        n: t.n,
                        h: t.h,
                        Gx: t.Gx,
                        Gy: t.Gy
                    }, r = t.Fp, n = t.allowedPrivateKeyLengths ? Array.from(new Set(t.allowedPrivateKeyLengths.map(t => Math.ceil(t / 2)))) : void 0, i = {
                        Fp: r,
                        Fn: $(e.n, {
                            BITS: t.nBitLength,
                            allowedLengths: n,
                            modFromBytes: t.wrapPrivateKey
                        }),
                        allowInfinityPoint: t.allowInfinityPoint,
                        endo: t.endo,
                        isTorsionFree: t.isTorsionFree,
                        clearCofactor: t.clearCofactor,
                        fromBytes: t.fromBytes,
                        toBytes: t.toBytes
                    }, {
                        CURVE: e,
                        curveOpts: i
                    }),
                    a = {
                        hmac: t.hmac,
                        randomBytes: t.randomBytes,
                        lowS: t.lowS,
                        bits2int: t.bits2int,
                        bits2int_modN: t.bits2int_modN
                    };
                return {
                    CURVE: o,
                    curveOpts: s,
                    hash: t.hash,
                    ecdsaOpts: a
                }
            }(t),
            u = function(t, e, r = {}) {
                (0, n.ahash)(e), O(r, {}, {
                    hmac: "function",
                    lowS: "boolean",
                    randomBytes: "function",
                    bits2int: "function",
                    bits2int_modN: "function"
                });
                let i = r.randomBytes || n.randomBytes,
                    o = r.hmac || ((t, ...r) => (0, t8.hmac)(e, t, (0, n.concatBytes)(...r))),
                    {
                        Fp: s,
                        Fn: l
                    } = t,
                    {
                        ORDER: u,
                        BITS: c
                    } = l,
                    {
                        keygen: d,
                        getPublicKey: h,
                        getSharedSecret: y,
                        utils: p,
                        lengths: g
                    } = function(t, e = {}) {
                        let {
                            Fn: r
                        } = t, i = e.randomBytes || n.randomBytes, o = Object.assign(ea(t.Fp, r), {
                            seed: Q(r.ORDER)
                        });

                        function s(t) {
                            try {
                                return !!eo(r, t)
                            } catch (t) {
                                return !1
                            }
                        }

                        function l(t = i(o.seed)) {
                            return tt(a(t, o.seed, "seed"), r.ORDER)
                        }

                        function u(e, n = !0) {
                            return t.BASE.multiply(eo(r, e)).toBytes(n)
                        }

                        function f(e) {
                            if ("bigint" == typeof e) return !1;
                            if (e instanceof t) return !0;
                            let {
                                secretKey: n,
                                publicKey: i,
                                publicKeyUncompressed: s
                            } = o;
                            if (r.allowedLengths || n === i) return;
                            let a = m("key", e).length;
                            return a === i || a === s
                        }
                        return Object.freeze({
                            getPublicKey: u,
                            getSharedSecret: function(e, n, i = !0) {
                                if (!0 === f(e)) throw Error("first arg must be private key");
                                if (!1 === f(n)) throw Error("second arg must be public key");
                                let o = eo(r, e);
                                return t.fromHex(n).multiply(o).toBytes(i)
                            },
                            keygen: function(t) {
                                let e = l(t);
                                return {
                                    secretKey: e,
                                    publicKey: u(e)
                                }
                            },
                            Point: t,
                            utils: {
                                isValidSecretKey: s,
                                isValidPublicKey: function(e, r) {
                                    let {
                                        publicKey: n,
                                        publicKeyUncompressed: i
                                    } = o;
                                    try {
                                        let o = e.length;
                                        if (!0 === r && o !== n || !1 === r && o !== i) return !1;
                                        return !!t.fromBytes(e)
                                    } catch (t) {
                                        return !1
                                    }
                                },
                                randomSecretKey: l,
                                isValidPrivateKey: s,
                                randomPrivateKey: l,
                                normPrivateKeyToScalar: t => eo(r, t),
                                precompute: (e = 8, r = t.BASE) => r.precompute(e, !1)
                            },
                            lengths: o
                        })
                    }(t, r),
                    E = {
                        prehash: !1,
                        lowS: "boolean" == typeof r.lowS && r.lowS,
                        format: void 0,
                        extraEntropy: !1
                    },
                    B = "compact";

                function x(t, e) {
                    if (!l.isValidNot0(e)) throw Error(`invalid signature ${t}: out of range 1..Point.Fn.ORDER`);
                    return e
                }
                class R {
                    constructor(t, e, r) {
                        this.r = x("r", t), this.s = x("s", e), null != r && (this.recovery = r), Object.freeze(this)
                    }
                    static fromBytes(t, e = B) {
                        var r, n;
                        let i, o;
                        if (r = t, t3(n = e), o = g.signature, a(r, "compact" === n ? o : "recovered" === n ? o + 1 : void 0, `${n} signature`), "der" === e) {
                            let {
                                r: e,
                                s: r
                            } = t9.toSig(a(t));
                            return new R(e, r)
                        }
                        "recovered" === e && (i = t[0], e = "compact", t = t.subarray(1));
                        let s = l.BYTES,
                            u = t.subarray(0, s),
                            f = t.subarray(s, 2 * s);
                        return new R(l.fromBytes(u), l.fromBytes(f), i)
                    }
                    static fromHex(t, e) {
                        return this.fromBytes((0, n.hexToBytes)(t), e)
                    }
                    addRecoveryBit(t) {
                        return new R(this.r, this.s, t)
                    }
                    recoverPublicKey(e) {
                        let r = s.ORDER,
                            {
                                r: i,
                                s: o,
                                recovery: a
                            } = this;
                        if (null == a || ![0, 1, 2, 3].includes(a)) throw Error("recovery id invalid");
                        if (u * er < r && a > 1) throw Error("recovery id is ambiguous for h>1 curve");
                        let f = 2 === a || 3 === a ? i + u : i;
                        if (!s.isValid(f)) throw Error("recovery id 2 or 3 invalid");
                        let c = s.toBytes(f),
                            d = t.fromBytes((0, n.concatBytes)(es((1 & a) == 0), c)),
                            h = l.inv(f),
                            y = I(m("msgHash", e)),
                            p = l.create(-y * h),
                            g = l.create(o * h),
                            E = t.BASE.multiplyUnsafe(p).add(d.multiplyUnsafe(g));
                        if (E.is0()) throw Error("point at infinify");
                        return E.assertValidity(), E
                    }
                    hasHighS() {
                        return this.s > u >> ee
                    }
                    toBytes(t = B) {
                        if (t3(t), "der" === t) return (0, n.hexToBytes)(t9.hexFromSig(this));
                        let e = l.toBytes(this.r),
                            r = l.toBytes(this.s);
                        if ("recovered" === t) {
                            if (null == this.recovery) throw Error("recovery bit must be present");
                            return (0, n.concatBytes)(Uint8Array.of(this.recovery), e, r)
                        }
                        return (0, n.concatBytes)(e, r)
                    }
                    toHex(t) {
                        return (0, n.bytesToHex)(this.toBytes(t))
                    }
                    assertValidity() {}
                    static fromCompact(t) {
                        return R.fromBytes(m("sig", t), "compact")
                    }
                    static fromDER(t) {
                        return R.fromBytes(m("sig", t), "der")
                    }
                    normalizeS() {
                        return this.hasHighS() ? new R(this.r, l.neg(this.s), this.recovery) : this
                    }
                    toDERRawBytes() {
                        return this.toBytes("der")
                    }
                    toDERHex() {
                        return (0, n.bytesToHex)(this.toBytes("der"))
                    }
                    toCompactRawBytes() {
                        return this.toBytes("compact")
                    }
                    toCompactHex() {
                        return (0, n.bytesToHex)(this.toBytes("compact"))
                    }
                }
                let S = r.bits2int || function(t) {
                        if (t.length > 8192) throw Error("input is too large");
                        let e = f(t),
                            r = 8 * t.length - c;
                        return r > 0 ? e >> BigInt(r) : e
                    },
                    I = r.bits2int_modN || function(t) {
                        return l.create(S(t))
                    },
                    q = b(c);

                function A(t) {
                    return w("num < 2^" + c, t, et, q), l.toBytes(t)
                }

                function T(t, r) {
                    return a(t, void 0, "message"), r ? a(e(t), void 0, "prehashed message") : t
                }
                return Object.freeze({
                    keygen: d,
                    getPublicKey: h,
                    getSharedSecret: y,
                    utils: p,
                    lengths: g,
                    Point: t,
                    sign: function(r, s, a = {}) {
                        let {
                            seed: f,
                            k2sig: c
                        } = function(e, r, o) {
                            if (["recovered", "canonical"].some(t => t in o)) throw Error("sign() legacy options not supported");
                            let {
                                lowS: s,
                                prehash: a,
                                extraEntropy: f
                            } = t7(o, E), c = I(e = T(e, a)), d = eo(l, r), h = [A(d), A(c)];
                            if (null != f && !1 !== f) {
                                let t = !0 === f ? i(g.secretKey) : f;
                                h.push(m("extraEntropy", t))
                            }
                            return {
                                seed: (0, n.concatBytes)(...h),
                                k2sig: function(e) {
                                    let r = S(e);
                                    if (!l.isValidNot0(r)) return;
                                    let n = l.inv(r),
                                        i = t.BASE.multiply(r).toAffine(),
                                        o = l.create(i.x);
                                    if (o === et) return;
                                    let a = l.create(n * l.create(c + o * d));
                                    if (a === et) return;
                                    let f = 2 * (i.x !== o) | Number(i.y & ee),
                                        h = a;
                                    return s && a > u >> ee && (h = l.neg(a), f ^= 1), new R(o, h, f)
                                }
                            }
                        }(r = m("message", r), s, a);
                        return v(e.outputLen, l.BYTES, o)(f, c)
                    },
                    verify: function(e, r, i, o = {}) {
                        let {
                            lowS: s,
                            prehash: a,
                            format: u
                        } = t7(o, E);
                        if (i = m("publicKey", i), r = T(m("message", r), a), "strict" in o) throw Error("options.strict was renamed to lowS");
                        let f = void 0 === u ? function(t) {
                            let e, r = "string" == typeof t || (0, n.isBytes)(t),
                                i = !r && null !== t && "object" == typeof t && "bigint" == typeof t.r && "bigint" == typeof t.s;
                            if (!r && !i) throw Error("invalid signature, expected Uint8Array, hex string or Signature instance");
                            if (i) e = new R(t.r, t.s);
                            else if (r) {
                                try {
                                    e = R.fromBytes(m("sig", t), "der")
                                } catch (t) {
                                    if (!(t instanceof t9.Err)) throw t
                                }
                                if (!e) try {
                                    e = R.fromBytes(m("sig", t), "compact")
                                } catch (t) {
                                    return !1
                                }
                            }
                            return !!e && e
                        }(e) : R.fromBytes(m("sig", e), u);
                        if (!1 === f) return !1;
                        try {
                            let e = t.fromBytes(i);
                            if (s && f.hasHighS()) return !1;
                            let {
                                r: n,
                                s: o
                            } = f, a = I(r), u = l.inv(o), c = l.create(a * u), d = l.create(n * u), h = t.BASE.multiplyUnsafe(c).add(e.multiplyUnsafe(d));
                            if (h.is0()) return !1;
                            return l.create(h.x) === n
                        } catch (t) {
                            return !1
                        }
                    },
                    recoverPublicKey: function(t, e, r = {}) {
                        let {
                            prehash: n
                        } = t7(r, E);
                        return e = T(e, n), R.fromBytes(t, "recovered").recoverPublicKey(e).toBytes()
                    },
                    Signature: R,
                    hash: e
                })
            }(function(t, e = {}) {
                let r = ty("weierstrass", t, e),
                    {
                        Fp: i,
                        Fn: o
                    } = r,
                    l = r.CURVE,
                    {
                        h: u,
                        n: f
                    } = l;
                O(e, {}, {
                    allowInfinityPoint: "boolean",
                    clearCofactor: "function",
                    isTorsionFree: "function",
                    fromBytes: "function",
                    toBytes: "function",
                    endo: "object",
                    wrapPrivateKey: "boolean"
                });
                let {
                    endo: c
                } = e;
                if (c && (!i.is0(l.a) || "bigint" != typeof c.beta || !Array.isArray(c.basises))) throw Error('invalid endo: expected "beta": bigint and "basises": array');
                let d = ea(i, o);

                function h() {
                    if (!i.isOdd) throw Error("compression is not supported: Field does not have .isOdd()")
                }
                let y = e.toBytes || function(t, e, r) {
                        let {
                            x: o,
                            y: a
                        } = e.toAffine(), l = i.toBytes(o);
                        if (s(r, "isCompressed"), !r) return (0, n.concatBytes)(Uint8Array.of(4), l, i.toBytes(a)); {
                            h();
                            let t = !i.isOdd(a);
                            return (0, n.concatBytes)(es(t), l)
                        }
                    },
                    p = e.fromBytes || function(t) {
                        a(t, void 0, "Point");
                        let {
                            publicKey: e,
                            publicKeyUncompressed: r
                        } = d, n = t.length, o = t[0], s = t.subarray(1);
                        if (n === e && (2 === o || 3 === o)) {
                            let t, e = i.fromBytes(s);
                            if (!i.isValid(e)) throw Error("bad point: is not on curve, wrong x");
                            let r = g(e);
                            try {
                                t = i.sqrt(r)
                            } catch (t) {
                                throw Error("bad point: is not on curve, sqrt error" + (t instanceof Error ? ": " + t.message : ""))
                            }
                            return h(), (1 & o) == 1 !== i.isOdd(t) && (t = i.neg(t)), {
                                x: e,
                                y: t
                            }
                        }
                        if (n === r && 4 === o) {
                            let t = i.BYTES,
                                e = i.fromBytes(s.subarray(0, t)),
                                r = i.fromBytes(s.subarray(t, 2 * t));
                            if (!E(e, r)) throw Error("bad point: is not on curve");
                            return {
                                x: e,
                                y: r
                            }
                        }
                        throw Error(`bad point: got length ${n}, expected compressed=${e} or uncompressed=${r}`)
                    };

                function g(t) {
                    let e = i.sqr(t),
                        r = i.mul(e, t);
                    return i.add(i.add(r, i.mul(t, l.a)), l.b)
                }

                function E(t, e) {
                    let r = i.sqr(e),
                        n = g(t);
                    return i.eql(r, n)
                }
                if (!E(l.Gx, l.Gy)) throw Error("bad curve params: generator point");
                let w = i.mul(i.pow(l.a, en), ei),
                    v = i.mul(i.sqr(l.b), BigInt(27));
                if (i.is0(i.add(w, v))) throw Error("bad curve params: a or b");

                function x(t, e, r = !1) {
                    if (!i.isValid(e) || r && i.is0(e)) throw Error(`bad point coordinate ${t}`);
                    return e
                }

                function R(t) {
                    if (!(t instanceof F)) throw Error("ProjectivePoint expected")
                }

                function I(t) {
                    if (!c || !c.basises) throw Error("no endo");
                    return function(t, e, r) {
                        let [
                            [n, i],
                            [o, s]
                        ] = e, a = t4(s * t, r), l = t4(-i * t, r), u = t - a * n - l * o, f = -a * i - l * s, c = u < et, d = f < et;
                        c && (u = -u), d && (f = -f);
                        let h = b(Math.ceil(B(r) / 2)) + ee;
                        if (u < et || u >= h || f < et || f >= h) throw Error("splitScalar (endomorphism): failed, k=" + t);
                        return {
                            k1neg: c,
                            k1: u,
                            k2neg: d,
                            k2: f
                        }
                    }(t, c.basises, o.ORDER)
                }
                let q = S((t, e) => {
                        let {
                            X: r,
                            Y: n,
                            Z: o
                        } = t;
                        if (i.eql(o, i.ONE)) return {
                            x: r,
                            y: n
                        };
                        let s = t.is0();
                        null == e && (e = s ? i.ONE : i.inv(o));
                        let a = i.mul(r, e),
                            l = i.mul(n, e),
                            u = i.mul(o, e);
                        if (s) return {
                            x: i.ZERO,
                            y: i.ZERO
                        };
                        if (!i.eql(u, i.ONE)) throw Error("invZ was invalid");
                        return {
                            x: a,
                            y: l
                        }
                    }),
                    A = S(t => {
                        if (t.is0()) {
                            if (e.allowInfinityPoint && !i.is0(t.Y)) return;
                            throw Error("bad point: ZERO")
                        }
                        let {
                            x: r,
                            y: n
                        } = t.toAffine();
                        if (!i.isValid(r) || !i.isValid(n)) throw Error("bad point: x or y not field elements");
                        if (!E(r, n)) throw Error("bad point: equation left != right");
                        if (!t.isTorsionFree()) throw Error("bad point: not in prime-order subgroup");
                        return !0
                    });

                function T(t, e, r, n, o) {
                    return r = new F(i.mul(r.X, t), r.Y, r.Z), e = tn(n, e), r = tn(o, r), e.add(r)
                }
                class F {
                    constructor(t, e, r) {
                        this.X = x("x", t), this.Y = x("y", e, !0), this.Z = x("z", r), Object.freeze(this)
                    }
                    static CURVE() {
                        return l
                    }
                    static fromAffine(t) {
                        let {
                            x: e,
                            y: r
                        } = t || {};
                        if (!t || !i.isValid(e) || !i.isValid(r)) throw Error("invalid affine point");
                        if (t instanceof F) throw Error("projective point not allowed");
                        return i.is0(e) && i.is0(r) ? F.ZERO : new F(e, r, i.ONE)
                    }
                    static fromBytes(t) {
                        let e = F.fromAffine(p(a(t, void 0, "point")));
                        return e.assertValidity(), e
                    }
                    static fromHex(t) {
                        return F.fromBytes(m("pointHex", t))
                    }
                    get x() {
                        return this.toAffine().x
                    }
                    get y() {
                        return this.toAffine().y
                    }
                    precompute(t = 8, e = !0) {
                        return N.createCache(this, t), e || this.multiply(en), this
                    }
                    assertValidity() {
                        A(this)
                    }
                    hasEvenY() {
                        let {
                            y: t
                        } = this.toAffine();
                        if (!i.isOdd) throw Error("Field doesn't support isOdd");
                        return !i.isOdd(t)
                    }
                    equals(t) {
                        R(t);
                        let {
                            X: e,
                            Y: r,
                            Z: n
                        } = this, {
                            X: o,
                            Y: s,
                            Z: a
                        } = t, l = i.eql(i.mul(e, a), i.mul(o, n)), u = i.eql(i.mul(r, a), i.mul(s, n));
                        return l && u
                    }
                    negate() {
                        return new F(this.X, i.neg(this.Y), this.Z)
                    }
                    double() {
                        let {
                            a: t,
                            b: e
                        } = l, r = i.mul(e, en), {
                            X: n,
                            Y: o,
                            Z: s
                        } = this, a = i.ZERO, u = i.ZERO, f = i.ZERO, c = i.mul(n, n), d = i.mul(o, o), h = i.mul(s, s), m = i.mul(n, o);
                        return m = i.add(m, m), f = i.mul(n, s), f = i.add(f, f), a = i.mul(t, f), u = i.mul(r, h), u = i.add(a, u), a = i.sub(d, u), u = i.add(d, u), u = i.mul(a, u), a = i.mul(m, a), f = i.mul(r, f), h = i.mul(t, h), m = i.sub(c, h), m = i.mul(t, m), m = i.add(m, f), f = i.add(c, c), c = i.add(f, c), c = i.add(c, h), c = i.mul(c, m), u = i.add(u, c), h = i.mul(o, s), h = i.add(h, h), c = i.mul(h, m), a = i.sub(a, c), f = i.mul(h, d), f = i.add(f, f), new F(a, u, f = i.add(f, f))
                    }
                    add(t) {
                        R(t);
                        let {
                            X: e,
                            Y: r,
                            Z: n
                        } = this, {
                            X: o,
                            Y: s,
                            Z: a
                        } = t, u = i.ZERO, f = i.ZERO, c = i.ZERO, d = l.a, h = i.mul(l.b, en), m = i.mul(e, o), y = i.mul(r, s), p = i.mul(n, a), g = i.add(e, r), E = i.add(o, s);
                        g = i.mul(g, E), E = i.add(m, y), g = i.sub(g, E), E = i.add(e, n);
                        let w = i.add(o, a);
                        return E = i.mul(E, w), w = i.add(m, p), E = i.sub(E, w), w = i.add(r, n), u = i.add(s, a), w = i.mul(w, u), u = i.add(y, p), w = i.sub(w, u), c = i.mul(d, E), u = i.mul(h, p), c = i.add(u, c), u = i.sub(y, c), c = i.add(y, c), f = i.mul(u, c), y = i.add(m, m), y = i.add(y, m), p = i.mul(d, p), E = i.mul(h, E), y = i.add(y, p), p = i.sub(m, p), p = i.mul(d, p), E = i.add(E, p), m = i.mul(y, E), f = i.add(f, m), m = i.mul(w, E), u = i.mul(g, u), u = i.sub(u, m), m = i.mul(g, y), c = i.mul(w, c), new F(u, f, c = i.add(c, m))
                    }
                    subtract(t) {
                        return this.add(t.negate())
                    }
                    is0() {
                        return this.equals(F.ZERO)
                    }
                    multiply(t) {
                        let r, n, {
                            endo: i
                        } = e;
                        if (!o.isValidNot0(t)) throw Error("invalid scalar: out of range");
                        let s = t => N.cached(this, t, t => ti(F, t));
                        if (i) {
                            let {
                                k1neg: e,
                                k1: o,
                                k2neg: a,
                                k2: l
                            } = I(t), {
                                p: u,
                                f: f
                            } = s(o), {
                                p: c,
                                f: d
                            } = s(l);
                            n = f.add(d), r = T(i.beta, u, c, e, a)
                        } else {
                            let {
                                p: e,
                                f: i
                            } = s(t);
                            r = e, n = i
                        }
                        return ti(F, [r, n])[0]
                    }
                    multiplyUnsafe(t) {
                        let {
                            endo: r
                        } = e;
                        if (!o.isValid(t)) throw Error("invalid scalar: out of range");
                        if (t === et || this.is0()) return F.ZERO;
                        if (t === ee) return this;
                        if (N.hasCache(this)) return this.multiply(t);
                        if (!r) return N.unsafe(this, t); {
                            let {
                                k1neg: e,
                                k1: n,
                                k2neg: i,
                                k2: o
                            } = I(t), {
                                p1: s,
                                p2: a
                            } = function(t, e, r, n) {
                                let i = e,
                                    o = t.ZERO,
                                    s = t.ZERO;
                                for (; r > te || n > te;) r & tr && (o = o.add(i)), n & tr && (s = s.add(i)), i = i.double(), r >>= tr, n >>= tr;
                                return {
                                    p1: o,
                                    p2: s
                                }
                            }(F, this, n, o);
                            return T(r.beta, s, a, e, i)
                        }
                    }
                    multiplyAndAddUnsafe(t, e, r) {
                        let n = this.multiplyUnsafe(e).add(t.multiplyUnsafe(r));
                        return n.is0() ? void 0 : n
                    }
                    toAffine(t) {
                        return q(this, t)
                    }
                    isTorsionFree() {
                        let {
                            isTorsionFree: t
                        } = e;
                        return u === ee || (t ? t(F, this) : N.unsafe(this, f).is0())
                    }
                    clearCofactor() {
                        let {
                            clearCofactor: t
                        } = e;
                        return u === ee ? this : t ? t(F, this) : this.multiplyUnsafe(u)
                    }
                    isSmallOrder() {
                        return this.multiplyUnsafe(u).is0()
                    }
                    toBytes(t = !0) {
                        return s(t, "isCompressed"), this.assertValidity(), y(F, this, t)
                    }
                    toHex(t = !0) {
                        return (0, n.bytesToHex)(this.toBytes(t))
                    }
                    toString() {
                        return `<Point ${this.is0()?"ZERO":this.toHex()}>`
                    }
                    get px() {
                        return this.X
                    }
                    get py() {
                        return this.X
                    }
                    get pz() {
                        return this.Z
                    }
                    toRawBytes(t = !0) {
                        return this.toBytes(t)
                    }
                    _setWindowSize(t) {
                        this.precompute(t)
                    }
                    static normalizeZ(t) {
                        return ti(F, t)
                    }
                    static msm(t, e) {
                        return th(F, o, t, e)
                    }
                    static fromPrivateKey(t) {
                        return F.BASE.multiply(eo(o, t))
                    }
                }
                F.BASE = new F(l.Gx, l.Gy, i.ONE), F.ZERO = new F(i.ZERO, i.ONE, i.ZERO), F.Fp = i, F.Fn = o;
                let Z = o.BITS,
                    N = new td(F, e.endo ? Math.ceil(Z / 2) : Z);
                return F.BASE.precompute(8), F
            }(r, i), o, l);
        return e = u.Point, Object.assign({}, u, {
            ProjectivePoint: e,
            CURVE: Object.assign({}, t, X(e.Fn.ORDER, e.Fn.BITS))
        })
    }
    t.s(["_normFnElement", 0, eo, "mapToCurveSimpleSWU", 0, function(t, e) {
        M(t);
        let {
            A: r,
            B: n,
            Z: i
        } = e;
        if (!t.isValid(r) || !t.isValid(n) || !t.isValid(i)) throw Error("mapToCurveSimpleSWU: invalid opts");
        let o = function(t, e) {
            let r = t.ORDER,
                n = et;
            for (let t = r - ee; t % er === et; t /= er) n += ee;
            let i = n,
                o = er << i - ee - ee,
                s = o * er,
                a = (r - ee) / s,
                l = (a - ee) / er,
                u = s - ee,
                f = t.pow(e, a),
                c = t.pow(e, (a + ee) / er),
                d = (e, r) => {
                    let n = f,
                        s = t.pow(r, u),
                        a = t.sqr(s);
                    a = t.mul(a, r);
                    let d = t.mul(e, a);
                    d = t.pow(d, l), d = t.mul(d, s), s = t.mul(d, r), a = t.mul(d, e);
                    let h = t.mul(a, s);
                    d = t.pow(h, o);
                    let m = t.eql(d, t.ONE);
                    s = t.mul(a, c), d = t.mul(h, n), a = t.cmov(s, a, m), h = t.cmov(d, h, m);
                    for (let e = i; e > ee; e--) {
                        let r = e - er;
                        r = er << r - ee;
                        let i = t.pow(h, r),
                            o = t.eql(i, t.ONE);
                        s = t.mul(a, n), n = t.mul(n, n), i = t.mul(h, n), a = t.cmov(s, a, o), h = t.cmov(i, h, o)
                    }
                    return {
                        isValid: m,
                        value: a
                    }
                };
            if (t.ORDER % ei === en) {
                let r = (t.ORDER - en) / ei,
                    n = t.sqrt(t.neg(e));
                d = (e, i) => {
                    let o = t.sqr(i),
                        s = t.mul(e, i);
                    o = t.mul(o, s);
                    let a = t.pow(o, r);
                    a = t.mul(a, s);
                    let l = t.mul(a, n),
                        u = t.mul(t.sqr(a), i),
                        f = t.eql(u, e),
                        c = t.cmov(l, a, f);
                    return {
                        isValid: f,
                        value: c
                    }
                }
            }
            return d
        }(t, i);
        if (!t.isOdd) throw Error("Field does not have .isOdd()");
        return e => {
            let s, a, l, u, f, c, d, h;
            s = t.sqr(e), s = t.mul(s, i), a = t.sqr(s), a = t.add(a, s), l = t.add(a, t.ONE), l = t.mul(l, n), u = t.cmov(i, t.neg(a), !t.eql(a, t.ZERO)), u = t.mul(u, r), a = t.sqr(l), c = t.sqr(u), f = t.mul(c, r), a = t.add(a, f), a = t.mul(a, l), c = t.mul(c, u), f = t.mul(c, n), a = t.add(a, f), d = t.mul(s, l);
            let {
                isValid: m,
                value: y
            } = o(a, c);
            h = t.mul(s, e), h = t.mul(h, y), d = t.cmov(d, l, m), h = t.cmov(h, y, m);
            let p = t.isOdd(e) === t.isOdd(h);
            h = t.cmov(t.neg(h), h, p);
            let g = k(t, [u], !0)[0];
            return {
                x: d = t.mul(d, g),
                y: h
            }
        }
    }, "weierstrass", 0, el], 166125), t.s(["createCurve", 0, function(t, e) {
        let r = e => el({ ...t,
            hash: e
        });
        return { ...r(e),
            create: r
        }
    }], 675401)
}]);

//# debugId=a6f887bd-d081-4f48-b2b7-a292e39f3149