{"version":3,"file":"noble_curves.min.mjs","sources":["../../node_modules/@noble/hashes/esm/hmac.js","../../node_modules/@noble/curves/esm/abstract/utils.js","../../node_modules/@noble/curves/esm/abstract/modular.js","../../node_modules/@noble/curves/esm/abstract/curve.js","../../node_modules/@noble/curves/esm/abstract/weierstrass.js","../../node_modules/@noble/curves/esm/_shortw_utils.js","../../node_modules/@noble/curves/esm/p256.js","../../node_modules/@noble/curves/esm/p384.js","../../node_modules/@noble/curves/esm/p521.js","../../node_modules/@noble/curves/esm/abstract/edwards.js","../../node_modules/@noble/curves/esm/abstract/montgomery.js","../../node_modules/@noble/curves/esm/ed448.js","../../node_modules/@noble/curves/esm/secp256k1.js","../../../../../src/crypto/public_key/elliptic/brainpool/brainpoolP256r1.ts","../../../../../src/crypto/public_key/elliptic/brainpool/brainpoolP384r1.ts","../../../../../src/crypto/public_key/elliptic/brainpool/brainpoolP512r1.ts","../../src/crypto/public_key/elliptic/noble_curves.js"],"sourcesContent":["import { ahash, abytes, aexists } from './_assert.js';\nimport { Hash, toBytes } from './utils.js';\n// HMAC (RFC 2104)\nexport class HMAC extends Hash {\n    constructor(hash, _key) {\n        super();\n        this.finished = false;\n        this.destroyed = false;\n        ahash(hash);\n        const key = toBytes(_key);\n        this.iHash = hash.create();\n        if (typeof this.iHash.update !== 'function')\n            throw new Error('Expected instance of class which extends utils.Hash');\n        this.blockLen = this.iHash.blockLen;\n        this.outputLen = this.iHash.outputLen;\n        const blockLen = this.blockLen;\n        const pad = new Uint8Array(blockLen);\n        // blockLen can be bigger than outputLen\n        pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36;\n        this.iHash.update(pad);\n        // By doing update (processing of first block) of outer hash here we can re-use it between multiple calls via clone\n        this.oHash = hash.create();\n        // Undo internal XOR && apply outer XOR\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36 ^ 0x5c;\n        this.oHash.update(pad);\n        pad.fill(0);\n    }\n    update(buf) {\n        aexists(this);\n        this.iHash.update(buf);\n        return this;\n    }\n    digestInto(out) {\n        aexists(this);\n        abytes(out, this.outputLen);\n        this.finished = true;\n        this.iHash.digestInto(out);\n        this.oHash.update(out);\n        this.oHash.digestInto(out);\n        this.destroy();\n    }\n    digest() {\n        const out = new Uint8Array(this.oHash.outputLen);\n        this.digestInto(out);\n        return out;\n    }\n    _cloneInto(to) {\n        // Create new instance without calling constructor since key already in state and we don't know it.\n        to || (to = Object.create(Object.getPrototypeOf(this), {}));\n        const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;\n        to = to;\n        to.finished = finished;\n        to.destroyed = destroyed;\n        to.blockLen = blockLen;\n        to.outputLen = outputLen;\n        to.oHash = oHash._cloneInto(to.oHash);\n        to.iHash = iHash._cloneInto(to.iHash);\n        return to;\n    }\n    destroy() {\n        this.destroyed = true;\n        this.oHash.destroy();\n        this.iHash.destroy();\n    }\n}\n/**\n * HMAC: RFC2104 message authentication code.\n * @param hash - function that would be used e.g. sha256\n * @param key - message key\n * @param message - message data\n * @example\n * import { hmac } from '@noble/hashes/hmac';\n * import { sha256 } from '@noble/hashes/sha2';\n * const mac1 = hmac(sha256, 'key', 'message');\n */\nexport const hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();\nhmac.create = (hash, key) => new HMAC(hash, key);\n//# sourceMappingURL=hmac.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\n// 100 lines of code in the file are duplicated from noble-hashes (utils).\n// This is OK: `abstract` directory does not use noble-hashes.\n// User may opt-in into using different hashing library. This way, noble-hashes\n// won't be included into their bundle.\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\nconst _2n = /* @__PURE__ */ BigInt(2);\nexport function isBytes(a) {\n    return a instanceof Uint8Array || (ArrayBuffer.isView(a) && a.constructor.name === 'Uint8Array');\n}\nexport function abytes(item) {\n    if (!isBytes(item))\n        throw new Error('Uint8Array expected');\n}\nexport function abool(title, value) {\n    if (typeof value !== 'boolean')\n        throw new Error(title + ' boolean expected, got ' + value);\n}\n// Array where index 0xf0 (240) is mapped to string 'f0'\nconst hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));\n/**\n * @example bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])) // 'cafe0123'\n */\nexport function bytesToHex(bytes) {\n    abytes(bytes);\n    // pre-caching improves the speed 6x\n    let hex = '';\n    for (let i = 0; i < bytes.length; i++) {\n        hex += hexes[bytes[i]];\n    }\n    return hex;\n}\nexport function numberToHexUnpadded(num) {\n    const hex = num.toString(16);\n    return hex.length & 1 ? '0' + hex : hex;\n}\nexport function hexToNumber(hex) {\n    if (typeof hex !== 'string')\n        throw new Error('hex string expected, got ' + typeof hex);\n    return hex === '' ? _0n : BigInt('0x' + hex); // Big Endian\n}\n// We use optimized technique to convert hex string to byte array\nconst asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };\nfunction asciiToBase16(ch) {\n    if (ch >= asciis._0 && ch <= asciis._9)\n        return ch - asciis._0; // '2' => 50-48\n    if (ch >= asciis.A && ch <= asciis.F)\n        return ch - (asciis.A - 10); // 'B' => 66-(65-10)\n    if (ch >= asciis.a && ch <= asciis.f)\n        return ch - (asciis.a - 10); // 'b' => 98-(97-10)\n    return;\n}\n/**\n * @example hexToBytes('cafe0123') // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])\n */\nexport function hexToBytes(hex) {\n    if (typeof hex !== 'string')\n        throw new Error('hex string expected, got ' + typeof hex);\n    const hl = hex.length;\n    const al = hl / 2;\n    if (hl % 2)\n        throw new Error('hex string expected, got unpadded hex of length ' + hl);\n    const array = new Uint8Array(al);\n    for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {\n        const n1 = asciiToBase16(hex.charCodeAt(hi));\n        const n2 = asciiToBase16(hex.charCodeAt(hi + 1));\n        if (n1 === undefined || n2 === undefined) {\n            const char = hex[hi] + hex[hi + 1];\n            throw new Error('hex string expected, got non-hex character \"' + char + '\" at index ' + hi);\n        }\n        array[ai] = n1 * 16 + n2; // multiply first octet, e.g. 'a3' => 10*16+3 => 160 + 3 => 163\n    }\n    return array;\n}\n// BE: Big Endian, LE: Little Endian\nexport function bytesToNumberBE(bytes) {\n    return hexToNumber(bytesToHex(bytes));\n}\nexport function bytesToNumberLE(bytes) {\n    abytes(bytes);\n    return hexToNumber(bytesToHex(Uint8Array.from(bytes).reverse()));\n}\nexport function numberToBytesBE(n, len) {\n    return hexToBytes(n.toString(16).padStart(len * 2, '0'));\n}\nexport function numberToBytesLE(n, len) {\n    return numberToBytesBE(n, len).reverse();\n}\n// Unpadded, rarely used\nexport function numberToVarBytesBE(n) {\n    return hexToBytes(numberToHexUnpadded(n));\n}\n/**\n * Takes hex string or Uint8Array, converts to Uint8Array.\n * Validates output length.\n * Will throw error for other types.\n * @param title descriptive title for an error e.g. 'private key'\n * @param hex hex string or Uint8Array\n * @param expectedLength optional, will compare to result array's length\n * @returns\n */\nexport function ensureBytes(title, hex, expectedLength) {\n    let res;\n    if (typeof hex === 'string') {\n        try {\n            res = hexToBytes(hex);\n        }\n        catch (e) {\n            throw new Error(title + ' must be hex string or Uint8Array, cause: ' + e);\n        }\n    }\n    else if (isBytes(hex)) {\n        // Uint8Array.from() instead of hash.slice() because node.js Buffer\n        // is instance of Uint8Array, and its slice() creates **mutable** copy\n        res = Uint8Array.from(hex);\n    }\n    else {\n        throw new Error(title + ' must be hex string or Uint8Array');\n    }\n    const len = res.length;\n    if (typeof expectedLength === 'number' && len !== expectedLength)\n        throw new Error(title + ' of length ' + expectedLength + ' expected, got ' + len);\n    return res;\n}\n/**\n * Copies several Uint8Arrays into one.\n */\nexport function concatBytes(...arrays) {\n    let sum = 0;\n    for (let i = 0; i < arrays.length; i++) {\n        const a = arrays[i];\n        abytes(a);\n        sum += a.length;\n    }\n    const res = new Uint8Array(sum);\n    for (let i = 0, pad = 0; i < arrays.length; i++) {\n        const a = arrays[i];\n        res.set(a, pad);\n        pad += a.length;\n    }\n    return res;\n}\n// Compares 2 u8a-s in kinda constant time\nexport function equalBytes(a, b) {\n    if (a.length !== b.length)\n        return false;\n    let diff = 0;\n    for (let i = 0; i < a.length; i++)\n        diff |= a[i] ^ b[i];\n    return diff === 0;\n}\n/**\n * @example utf8ToBytes('abc') // new Uint8Array([97, 98, 99])\n */\nexport function utf8ToBytes(str) {\n    if (typeof str !== 'string')\n        throw new Error('string expected');\n    return new Uint8Array(new TextEncoder().encode(str)); // https://bugzil.la/1681809\n}\n// Is positive bigint\nconst isPosBig = (n) => typeof n === 'bigint' && _0n <= n;\nexport function inRange(n, min, max) {\n    return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;\n}\n/**\n * Asserts min <= n < max. NOTE: It's < max and not <= max.\n * @example\n * aInRange('x', x, 1n, 256n); // would assume x is in (1n..255n)\n */\nexport function aInRange(title, n, min, max) {\n    // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)?\n    // consider P=256n, min=0n, max=P\n    // - a for min=0 would require -1:          `inRange('x', x, -1n, P)`\n    // - b would commonly require subtraction:  `inRange('x', x, 0n, P - 1n)`\n    // - our way is the cleanest:               `inRange('x', x, 0n, P)\n    if (!inRange(n, min, max))\n        throw new Error('expected valid ' + title + ': ' + min + ' <= n < ' + max + ', got ' + n);\n}\n// Bit operations\n/**\n * Calculates amount of bits in a bigint.\n * Same as `n.toString(2).length`\n */\nexport function bitLen(n) {\n    let len;\n    for (len = 0; n > _0n; n >>= _1n, len += 1)\n        ;\n    return len;\n}\n/**\n * Gets single bit at position.\n * NOTE: first bit position is 0 (same as arrays)\n * Same as `!!+Array.from(n.toString(2)).reverse()[pos]`\n */\nexport function bitGet(n, pos) {\n    return (n >> BigInt(pos)) & _1n;\n}\n/**\n * Sets single bit at position.\n */\nexport function bitSet(n, pos, value) {\n    return n | ((value ? _1n : _0n) << BigInt(pos));\n}\n/**\n * Calculate mask for N bits. Not using ** operator with bigints because of old engines.\n * Same as BigInt(`0b${Array(i).fill('1').join('')}`)\n */\nexport const bitMask = (n) => (_2n << BigInt(n - 1)) - _1n;\n// DRBG\nconst u8n = (data) => new Uint8Array(data); // creates Uint8Array\nconst u8fr = (arr) => Uint8Array.from(arr); // another shortcut\n/**\n * Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n * @returns function that will call DRBG until 2nd arg returns something meaningful\n * @example\n *   const drbg = createHmacDRBG<Key>(32, 32, hmac);\n *   drbg(seed, bytesToKey); // bytesToKey must return Key or undefined\n */\nexport function createHmacDrbg(hashLen, qByteLen, hmacFn) {\n    if (typeof hashLen !== 'number' || hashLen < 2)\n        throw new Error('hashLen must be a number');\n    if (typeof qByteLen !== 'number' || qByteLen < 2)\n        throw new Error('qByteLen must be a number');\n    if (typeof hmacFn !== 'function')\n        throw new Error('hmacFn must be a function');\n    // Step B, Step C: set hashLen to 8*ceil(hlen/8)\n    let v = u8n(hashLen); // Minimal non-full-spec HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n    let k = u8n(hashLen); // Steps B and C of RFC6979 3.2: set hashLen, in our case always same\n    let i = 0; // Iterations counter, will throw when over 1000\n    const reset = () => {\n        v.fill(1);\n        k.fill(0);\n        i = 0;\n    };\n    const h = (...b) => hmacFn(k, v, ...b); // hmac(k)(v, ...values)\n    const reseed = (seed = u8n()) => {\n        // HMAC-DRBG reseed() function. Steps D-G\n        k = h(u8fr([0x00]), seed); // k = hmac(k || v || 0x00 || seed)\n        v = h(); // v = hmac(k || v)\n        if (seed.length === 0)\n            return;\n        k = h(u8fr([0x01]), seed); // k = hmac(k || v || 0x01 || seed)\n        v = h(); // v = hmac(k || v)\n    };\n    const gen = () => {\n        // HMAC-DRBG generate() function\n        if (i++ >= 1000)\n            throw new Error('drbg: tried 1000 values');\n        let len = 0;\n        const out = [];\n        while (len < qByteLen) {\n            v = h();\n            const sl = v.slice();\n            out.push(sl);\n            len += v.length;\n        }\n        return concatBytes(...out);\n    };\n    const genUntil = (seed, pred) => {\n        reset();\n        reseed(seed); // Steps D-G\n        let res = undefined; // Step H: grind until k is in [1..n-1]\n        while (!(res = pred(gen())))\n            reseed();\n        reset();\n        return res;\n    };\n    return genUntil;\n}\n// Validating curves and fields\nconst validatorFns = {\n    bigint: (val) => typeof val === 'bigint',\n    function: (val) => typeof val === 'function',\n    boolean: (val) => typeof val === 'boolean',\n    string: (val) => typeof val === 'string',\n    stringOrUint8Array: (val) => typeof val === 'string' || isBytes(val),\n    isSafeInteger: (val) => Number.isSafeInteger(val),\n    array: (val) => Array.isArray(val),\n    field: (val, object) => object.Fp.isValid(val),\n    hash: (val) => typeof val === 'function' && Number.isSafeInteger(val.outputLen),\n};\n// type Record<K extends string | number | symbol, T> = { [P in K]: T; }\nexport function validateObject(object, validators, optValidators = {}) {\n    const checkField = (fieldName, type, isOptional) => {\n        const checkVal = validatorFns[type];\n        if (typeof checkVal !== 'function')\n            throw new Error('invalid validator function');\n        const val = object[fieldName];\n        if (isOptional && val === undefined)\n            return;\n        if (!checkVal(val, object)) {\n            throw new Error('param ' + String(fieldName) + ' is invalid. Expected ' + type + ', got ' + val);\n        }\n    };\n    for (const [fieldName, type] of Object.entries(validators))\n        checkField(fieldName, type, false);\n    for (const [fieldName, type] of Object.entries(optValidators))\n        checkField(fieldName, type, true);\n    return object;\n}\n// validate type tests\n// const o: { a: number; b: number; c: number } = { a: 1, b: 5, c: 6 };\n// const z0 = validateObject(o, { a: 'isSafeInteger' }, { c: 'bigint' }); // Ok!\n// // Should fail type-check\n// const z1 = validateObject(o, { a: 'tmp' }, { c: 'zz' });\n// const z2 = validateObject(o, { a: 'isSafeInteger' }, { c: 'zz' });\n// const z3 = validateObject(o, { test: 'boolean', z: 'bug' });\n// const z4 = validateObject(o, { a: 'boolean', z: 'bug' });\n/**\n * throws not implemented error\n */\nexport const notImplemented = () => {\n    throw new Error('not implemented');\n};\n/**\n * Memoizes (caches) computation result.\n * Uses WeakMap: the value is going auto-cleaned by GC after last reference is removed.\n */\nexport function memoized(fn) {\n    const map = new WeakMap();\n    return (arg, ...args) => {\n        const val = map.get(arg);\n        if (val !== undefined)\n            return val;\n        const computed = fn(arg, ...args);\n        map.set(arg, computed);\n        return computed;\n    };\n}\n//# sourceMappingURL=utils.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\n// Utilities for modular arithmetics and finite fields\nimport { bitMask, bytesToNumberBE, bytesToNumberLE, ensureBytes, numberToBytesBE, numberToBytesLE, validateObject, } from './utils.js';\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _3n = /* @__PURE__ */ BigInt(3);\n// prettier-ignore\nconst _4n = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5), _8n = /* @__PURE__ */ BigInt(8);\n// prettier-ignore\nconst _9n = /* @__PURE__ */ BigInt(9), _16n = /* @__PURE__ */ BigInt(16);\n// Calculates a modulo b\nexport function mod(a, b) {\n    const result = a % b;\n    return result >= _0n ? result : b + result;\n}\n/**\n * Efficiently raise num to power and do modular division.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * @example\n * pow(2n, 6n, 11n) // 64n % 11n == 9n\n */\n// TODO: use field version && remove\nexport function pow(num, power, modulo) {\n    if (power < _0n)\n        throw new Error('invalid exponent, negatives unsupported');\n    if (modulo <= _0n)\n        throw new Error('invalid modulus');\n    if (modulo === _1n)\n        return _0n;\n    let res = _1n;\n    while (power > _0n) {\n        if (power & _1n)\n            res = (res * num) % modulo;\n        num = (num * num) % modulo;\n        power >>= _1n;\n    }\n    return res;\n}\n// Does x ^ (2 ^ power) mod p. pow2(30, 4) == 30 ^ (2 ^ 4)\nexport function pow2(x, power, modulo) {\n    let res = x;\n    while (power-- > _0n) {\n        res *= res;\n        res %= modulo;\n    }\n    return res;\n}\n// Inverses number over modulo\nexport function invert(number, modulo) {\n    if (number === _0n)\n        throw new Error('invert: expected non-zero number');\n    if (modulo <= _0n)\n        throw new Error('invert: expected positive modulus, got ' + modulo);\n    // Euclidean GCD https://brilliant.org/wiki/extended-euclidean-algorithm/\n    // Fermat's little theorem \"CT-like\" version inv(n) = n^(m-2) mod m is 30x slower.\n    let a = mod(number, modulo);\n    let b = modulo;\n    // prettier-ignore\n    let x = _0n, y = _1n, u = _1n, v = _0n;\n    while (a !== _0n) {\n        // JIT applies optimization if those two lines follow each other\n        const q = b / a;\n        const r = b % a;\n        const m = x - u * q;\n        const n = y - v * q;\n        // prettier-ignore\n        b = a, a = r, x = u, y = v, u = m, v = n;\n    }\n    const gcd = b;\n    if (gcd !== _1n)\n        throw new Error('invert: does not exist');\n    return mod(x, modulo);\n}\n/**\n * Tonelli-Shanks square root search algorithm.\n * 1. https://eprint.iacr.org/2012/685.pdf (page 12)\n * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks\n * Will start an infinite loop if field order P is not prime.\n * @param P field order\n * @returns function that takes field Fp (created from P) and number n\n */\nexport function tonelliShanks(P) {\n    // Legendre constant: used to calculate Legendre symbol (a | p),\n    // which denotes the value of a^((p-1)/2) (mod p).\n    // (a | p) ≡ 1    if a is a square (mod p)\n    // (a | p) ≡ -1   if a is not a square (mod p)\n    // (a | p) ≡ 0    if a ≡ 0 (mod p)\n    const legendreC = (P - _1n) / _2n;\n    let Q, S, Z;\n    // Step 1: By factoring out powers of 2 from p - 1,\n    // find q and s such that p - 1 = q*(2^s) with q odd\n    for (Q = P - _1n, S = 0; Q % _2n === _0n; Q /= _2n, S++)\n        ;\n    // Step 2: Select a non-square z such that (z | p) ≡ -1 and set c ≡ zq\n    for (Z = _2n; Z < P && pow(Z, legendreC, P) !== P - _1n; Z++) {\n        // Crash instead of infinity loop, we cannot reasonable count until P.\n        if (Z > 1000)\n            throw new Error('Cannot find square root: likely non-prime P');\n    }\n    // Fast-path\n    if (S === 1) {\n        const p1div4 = (P + _1n) / _4n;\n        return function tonelliFast(Fp, n) {\n            const root = Fp.pow(n, p1div4);\n            if (!Fp.eql(Fp.sqr(root), n))\n                throw new Error('Cannot find square root');\n            return root;\n        };\n    }\n    // Slow-path\n    const Q1div2 = (Q + _1n) / _2n;\n    return function tonelliSlow(Fp, n) {\n        // Step 0: Check that n is indeed a square: (n | p) should not be ≡ -1\n        if (Fp.pow(n, legendreC) === Fp.neg(Fp.ONE))\n            throw new Error('Cannot find square root');\n        let r = S;\n        // TODO: will fail at Fp2/etc\n        let g = Fp.pow(Fp.mul(Fp.ONE, Z), Q); // will update both x and b\n        let x = Fp.pow(n, Q1div2); // first guess at the square root\n        let b = Fp.pow(n, Q); // first guess at the fudge factor\n        while (!Fp.eql(b, Fp.ONE)) {\n            if (Fp.eql(b, Fp.ZERO))\n                return Fp.ZERO; // https://en.wikipedia.org/wiki/Tonelli%E2%80%93Shanks_algorithm (4. If t = 0, return r = 0)\n            // Find m such b^(2^m)==1\n            let m = 1;\n            for (let t2 = Fp.sqr(b); m < r; m++) {\n                if (Fp.eql(t2, Fp.ONE))\n                    break;\n                t2 = Fp.sqr(t2); // t2 *= t2\n            }\n            // NOTE: r-m-1 can be bigger than 32, need to convert to bigint before shift, otherwise there will be overflow\n            const ge = Fp.pow(g, _1n << BigInt(r - m - 1)); // ge = 2^(r-m-1)\n            g = Fp.sqr(ge); // g = ge * ge\n            x = Fp.mul(x, ge); // x *= ge\n            b = Fp.mul(b, g); // b *= g\n            r = m;\n        }\n        return x;\n    };\n}\nexport function FpSqrt(P) {\n    // NOTE: different algorithms can give different roots, it is up to user to decide which one they want.\n    // For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).\n    // P ≡ 3 (mod 4)\n    // √n = n^((P+1)/4)\n    if (P % _4n === _3n) {\n        // Not all roots possible!\n        // const ORDER =\n        //   0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaabn;\n        // const NUM = 72057594037927816n;\n        const p1div4 = (P + _1n) / _4n;\n        return function sqrt3mod4(Fp, n) {\n            const root = Fp.pow(n, p1div4);\n            // Throw if root**2 != n\n            if (!Fp.eql(Fp.sqr(root), n))\n                throw new Error('Cannot find square root');\n            return root;\n        };\n    }\n    // Atkin algorithm for q ≡ 5 (mod 8), https://eprint.iacr.org/2012/685.pdf (page 10)\n    if (P % _8n === _5n) {\n        const c1 = (P - _5n) / _8n;\n        return function sqrt5mod8(Fp, n) {\n            const n2 = Fp.mul(n, _2n);\n            const v = Fp.pow(n2, c1);\n            const nv = Fp.mul(n, v);\n            const i = Fp.mul(Fp.mul(nv, _2n), v);\n            const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));\n            if (!Fp.eql(Fp.sqr(root), n))\n                throw new Error('Cannot find square root');\n            return root;\n        };\n    }\n    // P ≡ 9 (mod 16)\n    if (P % _16n === _9n) {\n        // NOTE: tonelli is too slow for bls-Fp2 calculations even on start\n        // Means we cannot use sqrt for constants at all!\n        //\n        // const c1 = Fp.sqrt(Fp.negate(Fp.ONE)); //  1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F\n        // const c2 = Fp.sqrt(c1);                //  2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F\n        // const c3 = Fp.sqrt(Fp.negate(c1));     //  3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F\n        // const c4 = (P + _7n) / _16n;           //  4. c4 = (q + 7) / 16        # Integer arithmetic\n        // sqrt = (x) => {\n        //   let tv1 = Fp.pow(x, c4);             //  1. tv1 = x^c4\n        //   let tv2 = Fp.mul(c1, tv1);           //  2. tv2 = c1 * tv1\n        //   const tv3 = Fp.mul(c2, tv1);         //  3. tv3 = c2 * tv1\n        //   let tv4 = Fp.mul(c3, tv1);           //  4. tv4 = c3 * tv1\n        //   const e1 = Fp.equals(Fp.square(tv2), x); //  5.  e1 = (tv2^2) == x\n        //   const e2 = Fp.equals(Fp.square(tv3), x); //  6.  e2 = (tv3^2) == x\n        //   tv1 = Fp.cmov(tv1, tv2, e1); //  7. tv1 = CMOV(tv1, tv2, e1)  # Select tv2 if (tv2^2) == x\n        //   tv2 = Fp.cmov(tv4, tv3, e2); //  8. tv2 = CMOV(tv4, tv3, e2)  # Select tv3 if (tv3^2) == x\n        //   const e3 = Fp.equals(Fp.square(tv2), x); //  9.  e3 = (tv2^2) == x\n        //   return Fp.cmov(tv1, tv2, e3); //  10.  z = CMOV(tv1, tv2, e3)  # Select the sqrt from tv1 and tv2\n        // }\n    }\n    // Other cases: Tonelli-Shanks algorithm\n    return tonelliShanks(P);\n}\n// Little-endian check for first LE bit (last BE bit);\nexport const isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n) === _1n;\n// prettier-ignore\nconst FIELD_FIELDS = [\n    'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',\n    'eql', 'add', 'sub', 'mul', 'pow', 'div',\n    'addN', 'subN', 'mulN', 'sqrN'\n];\nexport function validateField(field) {\n    const initial = {\n        ORDER: 'bigint',\n        MASK: 'bigint',\n        BYTES: 'isSafeInteger',\n        BITS: 'isSafeInteger',\n    };\n    const opts = FIELD_FIELDS.reduce((map, val) => {\n        map[val] = 'function';\n        return map;\n    }, initial);\n    return validateObject(field, opts);\n}\n// Generic field functions\n/**\n * Same as `pow` but for Fp: non-constant-time.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n */\nexport function FpPow(f, num, power) {\n    // Should have same speed as pow for bigints\n    // TODO: benchmark!\n    if (power < _0n)\n        throw new Error('invalid exponent, negatives unsupported');\n    if (power === _0n)\n        return f.ONE;\n    if (power === _1n)\n        return num;\n    let p = f.ONE;\n    let d = num;\n    while (power > _0n) {\n        if (power & _1n)\n            p = f.mul(p, d);\n        d = f.sqr(d);\n        power >>= _1n;\n    }\n    return p;\n}\n/**\n * Efficiently invert an array of Field elements.\n * `inv(0)` will return `undefined` here: make sure to throw an error.\n */\nexport function FpInvertBatch(f, nums) {\n    const tmp = new Array(nums.length);\n    // Walk from first to last, multiply them by each other MOD p\n    const lastMultiplied = nums.reduce((acc, num, i) => {\n        if (f.is0(num))\n            return acc;\n        tmp[i] = acc;\n        return f.mul(acc, num);\n    }, f.ONE);\n    // Invert last element\n    const inverted = f.inv(lastMultiplied);\n    // Walk from last to first, multiply them by inverted each other MOD p\n    nums.reduceRight((acc, num, i) => {\n        if (f.is0(num))\n            return acc;\n        tmp[i] = f.mul(acc, tmp[i]);\n        return f.mul(acc, num);\n    }, inverted);\n    return tmp;\n}\nexport function FpDiv(f, lhs, rhs) {\n    return f.mul(lhs, typeof rhs === 'bigint' ? invert(rhs, f.ORDER) : f.inv(rhs));\n}\nexport function FpLegendre(order) {\n    // (a | p) ≡ 1    if a is a square (mod p), quadratic residue\n    // (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue\n    // (a | p) ≡ 0    if a ≡ 0 (mod p)\n    const legendreConst = (order - _1n) / _2n; // Integer arithmetic\n    return (f, x) => f.pow(x, legendreConst);\n}\n// This function returns True whenever the value x is a square in the field F.\nexport function FpIsSquare(f) {\n    const legendre = FpLegendre(f.ORDER);\n    return (x) => {\n        const p = legendre(f, x);\n        return f.eql(p, f.ZERO) || f.eql(p, f.ONE);\n    };\n}\n// CURVE.n lengths\nexport function nLength(n, nBitLength) {\n    // Bit size, byte size of CURVE.n\n    const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length;\n    const nByteLength = Math.ceil(_nBitLength / 8);\n    return { nBitLength: _nBitLength, nByteLength };\n}\n/**\n * Initializes a finite field over prime. **Non-primes are not supported.**\n * Do not init in loop: slow. Very fragile: always run a benchmark on a change.\n * Major performance optimizations:\n * * a) denormalized operations like mulN instead of mul\n * * b) same object shape: never add or remove keys\n * * c) Object.freeze\n * NOTE: operations don't check 'isValid' for all elements for performance reasons,\n * it is caller responsibility to check this.\n * This is low-level code, please make sure you know what you doing.\n * @param ORDER prime positive bigint\n * @param bitLen how many bits the field consumes\n * @param isLE (def: false) if encoding / decoding should be in little-endian\n * @param redef optional faster redefinitions of sqrt and other methods\n */\nexport function Field(ORDER, bitLen, isLE = false, redef = {}) {\n    if (ORDER <= _0n)\n        throw new Error('invalid field: expected ORDER > 0, got ' + ORDER);\n    const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, bitLen);\n    if (BYTES > 2048)\n        throw new Error('invalid field: expected ORDER of <= 2048 bytes');\n    let sqrtP; // cached sqrtP\n    const f = Object.freeze({\n        ORDER,\n        BITS,\n        BYTES,\n        MASK: bitMask(BITS),\n        ZERO: _0n,\n        ONE: _1n,\n        create: (num) => mod(num, ORDER),\n        isValid: (num) => {\n            if (typeof num !== 'bigint')\n                throw new Error('invalid field element: expected bigint, got ' + typeof num);\n            return _0n <= num && num < ORDER; // 0 is valid element, but it's not invertible\n        },\n        is0: (num) => num === _0n,\n        isOdd: (num) => (num & _1n) === _1n,\n        neg: (num) => mod(-num, ORDER),\n        eql: (lhs, rhs) => lhs === rhs,\n        sqr: (num) => mod(num * num, ORDER),\n        add: (lhs, rhs) => mod(lhs + rhs, ORDER),\n        sub: (lhs, rhs) => mod(lhs - rhs, ORDER),\n        mul: (lhs, rhs) => mod(lhs * rhs, ORDER),\n        pow: (num, power) => FpPow(f, num, power),\n        div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),\n        // Same as above, but doesn't normalize\n        sqrN: (num) => num * num,\n        addN: (lhs, rhs) => lhs + rhs,\n        subN: (lhs, rhs) => lhs - rhs,\n        mulN: (lhs, rhs) => lhs * rhs,\n        inv: (num) => invert(num, ORDER),\n        sqrt: redef.sqrt ||\n            ((n) => {\n                if (!sqrtP)\n                    sqrtP = FpSqrt(ORDER);\n                return sqrtP(f, n);\n            }),\n        invertBatch: (lst) => FpInvertBatch(f, lst),\n        // TODO: do we really need constant cmov?\n        // We don't have const-time bigints anyway, so probably will be not very useful\n        cmov: (a, b, c) => (c ? b : a),\n        toBytes: (num) => (isLE ? numberToBytesLE(num, BYTES) : numberToBytesBE(num, BYTES)),\n        fromBytes: (bytes) => {\n            if (bytes.length !== BYTES)\n                throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);\n            return isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n        },\n    });\n    return Object.freeze(f);\n}\nexport function FpSqrtOdd(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? root : Fp.neg(root);\n}\nexport function FpSqrtEven(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? Fp.neg(root) : root;\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Same as mapKeyToField, but accepts less bytes (40 instead of 48 for 32-byte field).\n * Which makes it slightly more biased, less secure.\n * @deprecated use mapKeyToField instead\n */\nexport function hashToPrivateScalar(hash, groupOrder, isLE = false) {\n    hash = ensureBytes('privateHash', hash);\n    const hashLen = hash.length;\n    const minLen = nLength(groupOrder).nByteLength + 8;\n    if (minLen < 24 || hashLen < minLen || hashLen > 1024)\n        throw new Error('hashToPrivateScalar: expected ' + minLen + '-1024 bytes of input, got ' + hashLen);\n    const num = isLE ? bytesToNumberLE(hash) : bytesToNumberBE(hash);\n    return mod(num, groupOrder - _1n) + _1n;\n}\n/**\n * Returns total number of bytes consumed by the field element.\n * For example, 32 bytes for usual 256-bit weierstrass curve.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of field\n */\nexport function getFieldBytesLength(fieldOrder) {\n    if (typeof fieldOrder !== 'bigint')\n        throw new Error('field order must be bigint');\n    const bitLength = fieldOrder.toString(2).length;\n    return Math.ceil(bitLength / 8);\n}\n/**\n * Returns minimal amount of bytes that can be safely reduced\n * by field order.\n * Should be 2^-128 for 128-bit curve such as P256.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of target hash\n */\nexport function getMinHashLength(fieldOrder) {\n    const length = getFieldBytesLength(fieldOrder);\n    return length + Math.ceil(length / 2);\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF\n * and convert them into private scalar, with the modulo bias being negligible.\n * Needs at least 48 bytes of input for 32-byte private key.\n * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/\n * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final\n * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5\n * @param hash hash output from SHA3 or a similar function\n * @param groupOrder size of subgroup - (e.g. secp256k1.CURVE.n)\n * @param isLE interpret hash bytes as LE num\n * @returns valid private scalar\n */\nexport function mapHashToField(key, fieldOrder, isLE = false) {\n    const len = key.length;\n    const fieldLen = getFieldBytesLength(fieldOrder);\n    const minLen = getMinHashLength(fieldOrder);\n    // No small numbers: need to understand bias story. No huge numbers: easier to detect JS timings.\n    if (len < 16 || len < minLen || len > 1024)\n        throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);\n    const num = isLE ? bytesToNumberBE(key) : bytesToNumberLE(key);\n    // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n    const reduced = mod(num, fieldOrder - _1n) + _1n;\n    return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);\n}\n//# sourceMappingURL=modular.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\n// Abelian group utilities\nimport { validateField, nLength } from './modular.js';\nimport { validateObject, bitLen } from './utils.js';\nconst _0n = BigInt(0);\nconst _1n = BigInt(1);\nfunction constTimeNegate(condition, item) {\n    const neg = item.negate();\n    return condition ? neg : item;\n}\nfunction validateW(W, bits) {\n    if (!Number.isSafeInteger(W) || W <= 0 || W > bits)\n        throw new Error('invalid window size, expected [1..' + bits + '], got W=' + W);\n}\nfunction calcWOpts(W, bits) {\n    validateW(W, bits);\n    const windows = Math.ceil(bits / W) + 1; // +1, because\n    const windowSize = 2 ** (W - 1); // -1 because we skip zero\n    return { windows, windowSize };\n}\nfunction validateMSMPoints(points, c) {\n    if (!Array.isArray(points))\n        throw new Error('array expected');\n    points.forEach((p, i) => {\n        if (!(p instanceof c))\n            throw new Error('invalid point at index ' + i);\n    });\n}\nfunction validateMSMScalars(scalars, field) {\n    if (!Array.isArray(scalars))\n        throw new Error('array of scalars expected');\n    scalars.forEach((s, i) => {\n        if (!field.isValid(s))\n            throw new Error('invalid scalar at index ' + i);\n    });\n}\n// Since points in different groups cannot be equal (different object constructor),\n// we can have single place to store precomputes\nconst pointPrecomputes = new WeakMap();\nconst pointWindowSizes = new WeakMap(); // This allows use make points immutable (nothing changes inside)\nfunction getW(P) {\n    return pointWindowSizes.get(P) || 1;\n}\n// Elliptic curve multiplication of Point by scalar. Fragile.\n// Scalars should always be less than curve order: this should be checked inside of a curve itself.\n// Creates precomputation tables for fast multiplication:\n// - private scalar is split by fixed size windows of W bits\n// - every window point is collected from window's table & added to accumulator\n// - since windows are different, same point inside tables won't be accessed more than once per calc\n// - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)\n// - +1 window is neccessary for wNAF\n// - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication\n// TODO: Research returning 2d JS array of windows, instead of a single window. This would allow\n// windows to be in different memory locations\nexport function wNAF(c, bits) {\n    return {\n        constTimeNegate,\n        hasPrecomputes(elm) {\n            return getW(elm) !== 1;\n        },\n        // non-const time multiplication ladder\n        unsafeLadder(elm, n, p = c.ZERO) {\n            let d = elm;\n            while (n > _0n) {\n                if (n & _1n)\n                    p = p.add(d);\n                d = d.double();\n                n >>= _1n;\n            }\n            return p;\n        },\n        /**\n         * Creates a wNAF precomputation window. Used for caching.\n         * Default window size is set by `utils.precompute()` and is equal to 8.\n         * Number of precomputed points depends on the curve size:\n         * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:\n         * - 𝑊 is the window size\n         * - 𝑛 is the bitlength of the curve order.\n         * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.\n         * @param elm Point instance\n         * @param W window size\n         * @returns precomputed point tables flattened to a single array\n         */\n        precomputeWindow(elm, W) {\n            const { windows, windowSize } = calcWOpts(W, bits);\n            const points = [];\n            let p = elm;\n            let base = p;\n            for (let window = 0; window < windows; window++) {\n                base = p;\n                points.push(base);\n                // =1, because we skip zero\n                for (let i = 1; i < windowSize; i++) {\n                    base = base.add(p);\n                    points.push(base);\n                }\n                p = base.double();\n            }\n            return points;\n        },\n        /**\n         * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.\n         * @param W window size\n         * @param precomputes precomputed tables\n         * @param n scalar (we don't check here, but should be less than curve order)\n         * @returns real and fake (for const-time) points\n         */\n        wNAF(W, precomputes, n) {\n            // TODO: maybe check that scalar is less than group order? wNAF behavious is undefined otherwise\n            // But need to carefully remove other checks before wNAF. ORDER == bits here\n            const { windows, windowSize } = calcWOpts(W, bits);\n            let p = c.ZERO;\n            let f = c.BASE;\n            const mask = BigInt(2 ** W - 1); // Create mask with W ones: 0b1111 for W=4 etc.\n            const maxNumber = 2 ** W;\n            const shiftBy = BigInt(W);\n            for (let window = 0; window < windows; window++) {\n                const offset = window * windowSize;\n                // Extract W bits.\n                let wbits = Number(n & mask);\n                // Shift number by W bits.\n                n >>= shiftBy;\n                // If the bits are bigger than max size, we'll split those.\n                // +224 => 256 - 32\n                if (wbits > windowSize) {\n                    wbits -= maxNumber;\n                    n += _1n;\n                }\n                // This code was first written with assumption that 'f' and 'p' will never be infinity point:\n                // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,\n                // there is negate now: it is possible that negated element from low value\n                // would be the same as high element, which will create carry into next window.\n                // It's not obvious how this can fail, but still worth investigating later.\n                // Check if we're onto Zero point.\n                // Add random point inside current window to f.\n                const offset1 = offset;\n                const offset2 = offset + Math.abs(wbits) - 1; // -1 because we skip zero\n                const cond1 = window % 2 !== 0;\n                const cond2 = wbits < 0;\n                if (wbits === 0) {\n                    // The most important part for const-time getPublicKey\n                    f = f.add(constTimeNegate(cond1, precomputes[offset1]));\n                }\n                else {\n                    p = p.add(constTimeNegate(cond2, precomputes[offset2]));\n                }\n            }\n            // JIT-compiler should not eliminate f here, since it will later be used in normalizeZ()\n            // Even if the variable is still unused, there are some checks which will\n            // throw an exception, so compiler needs to prove they won't happen, which is hard.\n            // At this point there is a way to F be infinity-point even if p is not,\n            // which makes it less const-time: around 1 bigint multiply.\n            return { p, f };\n        },\n        /**\n         * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.\n         * @param W window size\n         * @param precomputes precomputed tables\n         * @param n scalar (we don't check here, but should be less than curve order)\n         * @param acc accumulator point to add result of multiplication\n         * @returns point\n         */\n        wNAFUnsafe(W, precomputes, n, acc = c.ZERO) {\n            const { windows, windowSize } = calcWOpts(W, bits);\n            const mask = BigInt(2 ** W - 1); // Create mask with W ones: 0b1111 for W=4 etc.\n            const maxNumber = 2 ** W;\n            const shiftBy = BigInt(W);\n            for (let window = 0; window < windows; window++) {\n                const offset = window * windowSize;\n                if (n === _0n)\n                    break; // No need to go over empty scalar\n                // Extract W bits.\n                let wbits = Number(n & mask);\n                // Shift number by W bits.\n                n >>= shiftBy;\n                // If the bits are bigger than max size, we'll split those.\n                // +224 => 256 - 32\n                if (wbits > windowSize) {\n                    wbits -= maxNumber;\n                    n += _1n;\n                }\n                if (wbits === 0)\n                    continue;\n                let curr = precomputes[offset + Math.abs(wbits) - 1]; // -1 because we skip zero\n                if (wbits < 0)\n                    curr = curr.negate();\n                // NOTE: by re-using acc, we can save a lot of additions in case of MSM\n                acc = acc.add(curr);\n            }\n            return acc;\n        },\n        getPrecomputes(W, P, transform) {\n            // Calculate precomputes on a first run, reuse them after\n            let comp = pointPrecomputes.get(P);\n            if (!comp) {\n                comp = this.precomputeWindow(P, W);\n                if (W !== 1)\n                    pointPrecomputes.set(P, transform(comp));\n            }\n            return comp;\n        },\n        wNAFCached(P, n, transform) {\n            const W = getW(P);\n            return this.wNAF(W, this.getPrecomputes(W, P, transform), n);\n        },\n        wNAFCachedUnsafe(P, n, transform, prev) {\n            const W = getW(P);\n            if (W === 1)\n                return this.unsafeLadder(P, n, prev); // For W=1 ladder is ~x2 faster\n            return this.wNAFUnsafe(W, this.getPrecomputes(W, P, transform), n, prev);\n        },\n        // We calculate precomputes for elliptic curve point multiplication\n        // using windowed method. This specifies window size and\n        // stores precomputed values. Usually only base point would be precomputed.\n        setWindowSize(P, W) {\n            validateW(W, bits);\n            pointWindowSizes.set(P, W);\n            pointPrecomputes.delete(P);\n        },\n    };\n}\n/**\n * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * 30x faster vs naive addition on L=4096, 10x faster with precomputes.\n * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.\n * Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.\n * @param c Curve Point constructor\n * @param fieldN field over CURVE.N - important that it's not over CURVE.P\n * @param points array of L curve points\n * @param scalars array of L scalars (aka private keys / bigints)\n */\nexport function pippenger(c, fieldN, points, scalars) {\n    // If we split scalars by some window (let's say 8 bits), every chunk will only\n    // take 256 buckets even if there are 4096 scalars, also re-uses double.\n    // TODO:\n    // - https://eprint.iacr.org/2024/750.pdf\n    // - https://tches.iacr.org/index.php/TCHES/article/view/10287\n    // 0 is accepted in scalars\n    validateMSMPoints(points, c);\n    validateMSMScalars(scalars, fieldN);\n    if (points.length !== scalars.length)\n        throw new Error('arrays of points and scalars must have equal length');\n    const zero = c.ZERO;\n    const wbits = bitLen(BigInt(points.length));\n    const windowSize = wbits > 12 ? wbits - 3 : wbits > 4 ? wbits - 2 : wbits ? 2 : 1; // in bits\n    const MASK = (1 << windowSize) - 1;\n    const buckets = new Array(MASK + 1).fill(zero); // +1 for zero array\n    const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;\n    let sum = zero;\n    for (let i = lastBits; i >= 0; i -= windowSize) {\n        buckets.fill(zero);\n        for (let j = 0; j < scalars.length; j++) {\n            const scalar = scalars[j];\n            const wbits = Number((scalar >> BigInt(i)) & BigInt(MASK));\n            buckets[wbits] = buckets[wbits].add(points[j]);\n        }\n        let resI = zero; // not using this will do small speed-up, but will lose ct\n        // Skip first bucket, because it is zero\n        for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {\n            sumI = sumI.add(buckets[j]);\n            resI = resI.add(sumI);\n        }\n        sum = sum.add(resI);\n        if (i !== 0)\n            for (let j = 0; j < windowSize; j++)\n                sum = sum.double();\n    }\n    return sum;\n}\n/**\n * Precomputed multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * @param c Curve Point constructor\n * @param fieldN field over CURVE.N - important that it's not over CURVE.P\n * @param points array of L curve points\n * @returns function which multiplies points with scaars\n */\nexport function precomputeMSMUnsafe(c, fieldN, points, windowSize) {\n    /**\n     * Performance Analysis of Window-based Precomputation\n     *\n     * Base Case (256-bit scalar, 8-bit window):\n     * - Standard precomputation requires:\n     *   - 31 additions per scalar × 256 scalars = 7,936 ops\n     *   - Plus 255 summary additions = 8,191 total ops\n     *   Note: Summary additions can be optimized via accumulator\n     *\n     * Chunked Precomputation Analysis:\n     * - Using 32 chunks requires:\n     *   - 255 additions per chunk\n     *   - 256 doublings\n     *   - Total: (255 × 32) + 256 = 8,416 ops\n     *\n     * Memory Usage Comparison:\n     * Window Size | Standard Points | Chunked Points\n     * ------------|-----------------|---------------\n     *     4-bit   |     520         |      15\n     *     8-bit   |    4,224        |     255\n     *    10-bit   |   13,824        |   1,023\n     *    16-bit   |  557,056        |  65,535\n     *\n     * Key Advantages:\n     * 1. Enables larger window sizes due to reduced memory overhead\n     * 2. More efficient for smaller scalar counts:\n     *    - 16 chunks: (16 × 255) + 256 = 4,336 ops\n     *    - ~2x faster than standard 8,191 ops\n     *\n     * Limitations:\n     * - Not suitable for plain precomputes (requires 256 constant doublings)\n     * - Performance degrades with larger scalar counts:\n     *   - Optimal for ~256 scalars\n     *   - Less efficient for 4096+ scalars (Pippenger preferred)\n     */\n    validateW(windowSize, fieldN.BITS);\n    validateMSMPoints(points, c);\n    const zero = c.ZERO;\n    const tableSize = 2 ** windowSize - 1; // table size (without zero)\n    const chunks = Math.ceil(fieldN.BITS / windowSize); // chunks of item\n    const MASK = BigInt((1 << windowSize) - 1);\n    const tables = points.map((p) => {\n        const res = [];\n        for (let i = 0, acc = p; i < tableSize; i++) {\n            res.push(acc);\n            acc = acc.add(p);\n        }\n        return res;\n    });\n    return (scalars) => {\n        validateMSMScalars(scalars, fieldN);\n        if (scalars.length > points.length)\n            throw new Error('array of scalars must be smaller than array of points');\n        let res = zero;\n        for (let i = 0; i < chunks; i++) {\n            // No need to double if accumulator is still zero.\n            if (res !== zero)\n                for (let j = 0; j < windowSize; j++)\n                    res = res.double();\n            const shiftBy = BigInt(chunks * windowSize - (i + 1) * windowSize);\n            for (let j = 0; j < scalars.length; j++) {\n                const n = scalars[j];\n                const curr = Number((n >> shiftBy) & MASK);\n                if (!curr)\n                    continue; // skip zero scalars chunks\n                res = res.add(tables[j][curr - 1]);\n            }\n        }\n        return res;\n    };\n}\nexport function validateBasic(curve) {\n    validateField(curve.Fp);\n    validateObject(curve, {\n        n: 'bigint',\n        h: 'bigint',\n        Gx: 'field',\n        Gy: 'field',\n    }, {\n        nBitLength: 'isSafeInteger',\n        nByteLength: 'isSafeInteger',\n    });\n    // Set defaults\n    return Object.freeze({\n        ...nLength(curve.n, curve.nBitLength),\n        ...curve,\n        ...{ p: curve.Fp.ORDER },\n    });\n}\n//# sourceMappingURL=curve.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\n// Short Weierstrass curve. The formula is: y² = x³ + ax + b\nimport { validateBasic, wNAF, pippenger, } from './curve.js';\nimport * as mod from './modular.js';\nimport * as ut from './utils.js';\nimport { ensureBytes, memoized, abool } from './utils.js';\nfunction validateSigVerOpts(opts) {\n    if (opts.lowS !== undefined)\n        abool('lowS', opts.lowS);\n    if (opts.prehash !== undefined)\n        abool('prehash', opts.prehash);\n}\nfunction validatePointOpts(curve) {\n    const opts = validateBasic(curve);\n    ut.validateObject(opts, {\n        a: 'field',\n        b: 'field',\n    }, {\n        allowedPrivateKeyLengths: 'array',\n        wrapPrivateKey: 'boolean',\n        isTorsionFree: 'function',\n        clearCofactor: 'function',\n        allowInfinityPoint: 'boolean',\n        fromBytes: 'function',\n        toBytes: 'function',\n    });\n    const { endo, Fp, a } = opts;\n    if (endo) {\n        if (!Fp.eql(a, Fp.ZERO)) {\n            throw new Error('invalid endomorphism, can only be defined for Koblitz curves that have a=0');\n        }\n        if (typeof endo !== 'object' ||\n            typeof endo.beta !== 'bigint' ||\n            typeof endo.splitScalar !== 'function') {\n            throw new Error('invalid endomorphism, expected beta: bigint and splitScalar: function');\n        }\n    }\n    return Object.freeze({ ...opts });\n}\nconst { bytesToNumberBE: b2n, hexToBytes: h2b } = ut;\n/**\n * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:\n *\n *     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]\n *\n * Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html\n */\nexport const DER = {\n    // asn.1 DER encoding utils\n    Err: class DERErr extends Error {\n        constructor(m = '') {\n            super(m);\n        }\n    },\n    // Basic building block is TLV (Tag-Length-Value)\n    _tlv: {\n        encode: (tag, data) => {\n            const { Err: E } = DER;\n            if (tag < 0 || tag > 256)\n                throw new E('tlv.encode: wrong tag');\n            if (data.length & 1)\n                throw new E('tlv.encode: unpadded data');\n            const dataLen = data.length / 2;\n            const len = ut.numberToHexUnpadded(dataLen);\n            if ((len.length / 2) & 128)\n                throw new E('tlv.encode: long form length too big');\n            // length of length with long form flag\n            const lenLen = dataLen > 127 ? ut.numberToHexUnpadded((len.length / 2) | 128) : '';\n            const t = ut.numberToHexUnpadded(tag);\n            return t + lenLen + len + data;\n        },\n        // v - value, l - left bytes (unparsed)\n        decode(tag, data) {\n            const { Err: E } = DER;\n            let pos = 0;\n            if (tag < 0 || tag > 256)\n                throw new E('tlv.encode: wrong tag');\n            if (data.length < 2 || data[pos++] !== tag)\n                throw new E('tlv.decode: wrong tlv');\n            const first = data[pos++];\n            const isLong = !!(first & 128); // First bit of first length byte is flag for short/long form\n            let length = 0;\n            if (!isLong)\n                length = first;\n            else {\n                // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]\n                const lenLen = first & 127;\n                if (!lenLen)\n                    throw new E('tlv.decode(long): indefinite length not supported');\n                if (lenLen > 4)\n                    throw new E('tlv.decode(long): byte length is too big'); // this will overflow u32 in js\n                const lengthBytes = data.subarray(pos, pos + lenLen);\n                if (lengthBytes.length !== lenLen)\n                    throw new E('tlv.decode: length bytes not complete');\n                if (lengthBytes[0] === 0)\n                    throw new E('tlv.decode(long): zero leftmost byte');\n                for (const b of lengthBytes)\n                    length = (length << 8) | b;\n                pos += lenLen;\n                if (length < 128)\n                    throw new E('tlv.decode(long): not minimal encoding');\n            }\n            const v = data.subarray(pos, pos + length);\n            if (v.length !== length)\n                throw new E('tlv.decode: wrong value length');\n            return { v, l: data.subarray(pos + length) };\n        },\n    },\n    // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,\n    // since we always use positive integers here. It must always be empty:\n    // - add zero byte if exists\n    // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)\n    _int: {\n        encode(num) {\n            const { Err: E } = DER;\n            if (num < _0n)\n                throw new E('integer: negative integers are not allowed');\n            let hex = ut.numberToHexUnpadded(num);\n            // Pad with zero byte if negative flag is present\n            if (Number.parseInt(hex[0], 16) & 0b1000)\n                hex = '00' + hex;\n            if (hex.length & 1)\n                throw new E('unexpected DER parsing assertion: unpadded hex');\n            return hex;\n        },\n        decode(data) {\n            const { Err: E } = DER;\n            if (data[0] & 128)\n                throw new E('invalid signature integer: negative');\n            if (data[0] === 0x00 && !(data[1] & 128))\n                throw new E('invalid signature integer: unnecessary leading zero');\n            return b2n(data);\n        },\n    },\n    toSig(hex) {\n        // parse DER signature\n        const { Err: E, _int: int, _tlv: tlv } = DER;\n        const data = typeof hex === 'string' ? h2b(hex) : hex;\n        ut.abytes(data);\n        const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);\n        if (seqLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        const { v: rBytes, l: rLeftBytes } = tlv.decode(0x02, seqBytes);\n        const { v: sBytes, l: sLeftBytes } = tlv.decode(0x02, rLeftBytes);\n        if (sLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        return { r: int.decode(rBytes), s: int.decode(sBytes) };\n    },\n    hexFromSig(sig) {\n        const { _tlv: tlv, _int: int } = DER;\n        const rs = tlv.encode(0x02, int.encode(sig.r));\n        const ss = tlv.encode(0x02, int.encode(sig.s));\n        const seq = rs + ss;\n        return tlv.encode(0x30, seq);\n    },\n};\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);\nexport function weierstrassPoints(opts) {\n    const CURVE = validatePointOpts(opts);\n    const { Fp } = CURVE; // All curves has same field / group length as for now, but they can differ\n    const Fn = mod.Field(CURVE.n, CURVE.nBitLength);\n    const toBytes = CURVE.toBytes ||\n        ((_c, point, _isCompressed) => {\n            const a = point.toAffine();\n            return ut.concatBytes(Uint8Array.from([0x04]), Fp.toBytes(a.x), Fp.toBytes(a.y));\n        });\n    const fromBytes = CURVE.fromBytes ||\n        ((bytes) => {\n            // const head = bytes[0];\n            const tail = bytes.subarray(1);\n            // if (head !== 0x04) throw new Error('Only non-compressed encoding is supported');\n            const x = Fp.fromBytes(tail.subarray(0, Fp.BYTES));\n            const y = Fp.fromBytes(tail.subarray(Fp.BYTES, 2 * Fp.BYTES));\n            return { x, y };\n        });\n    /**\n     * y² = x³ + ax + b: Short weierstrass curve formula\n     * @returns y²\n     */\n    function weierstrassEquation(x) {\n        const { a, b } = CURVE;\n        const x2 = Fp.sqr(x); // x * x\n        const x3 = Fp.mul(x2, x); // x2 * x\n        return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x3 + a * x + b\n    }\n    // Validate whether the passed curve params are valid.\n    // We check if curve equation works for generator point.\n    // `assertValidity()` won't work: `isTorsionFree()` is not available at this point in bls12-381.\n    // ProjectivePoint class has not been initialized yet.\n    if (!Fp.eql(Fp.sqr(CURVE.Gy), weierstrassEquation(CURVE.Gx)))\n        throw new Error('bad generator point: equation left != right');\n    // Valid group elements reside in range 1..n-1\n    function isWithinCurveOrder(num) {\n        return ut.inRange(num, _1n, CURVE.n);\n    }\n    // Validates if priv key is valid and converts it to bigint.\n    // Supports options allowedPrivateKeyLengths and wrapPrivateKey.\n    function normPrivateKeyToScalar(key) {\n        const { allowedPrivateKeyLengths: lengths, nByteLength, wrapPrivateKey, n: N } = CURVE;\n        if (lengths && typeof key !== 'bigint') {\n            if (ut.isBytes(key))\n                key = ut.bytesToHex(key);\n            // Normalize to hex string, pad. E.g. P521 would norm 130-132 char hex to 132-char bytes\n            if (typeof key !== 'string' || !lengths.includes(key.length))\n                throw new Error('invalid private key');\n            key = key.padStart(nByteLength * 2, '0');\n        }\n        let num;\n        try {\n            num =\n                typeof key === 'bigint'\n                    ? key\n                    : ut.bytesToNumberBE(ensureBytes('private key', key, nByteLength));\n        }\n        catch (error) {\n            throw new Error('invalid private key, expected hex or ' + nByteLength + ' bytes, got ' + typeof key);\n        }\n        if (wrapPrivateKey)\n            num = mod.mod(num, N); // disabled by default, enabled for BLS\n        ut.aInRange('private key', num, _1n, N); // num in range [1..N-1]\n        return num;\n    }\n    function assertPrjPoint(other) {\n        if (!(other instanceof Point))\n            throw new Error('ProjectivePoint expected');\n    }\n    // Memoized toAffine / validity check. They are heavy. Points are immutable.\n    // Converts Projective point to affine (x, y) coordinates.\n    // Can accept precomputed Z^-1 - for example, from invertBatch.\n    // (x, y, z) ∋ (x=x/z, y=y/z)\n    const toAffineMemo = memoized((p, iz) => {\n        const { px: x, py: y, pz: z } = p;\n        // Fast-path for normalized points\n        if (Fp.eql(z, Fp.ONE))\n            return { x, y };\n        const is0 = p.is0();\n        // If invZ was 0, we return zero point. However we still want to execute\n        // all operations, so we replace invZ with a random number, 1.\n        if (iz == null)\n            iz = is0 ? Fp.ONE : Fp.inv(z);\n        const ax = Fp.mul(x, iz);\n        const ay = Fp.mul(y, iz);\n        const zz = Fp.mul(z, iz);\n        if (is0)\n            return { x: Fp.ZERO, y: Fp.ZERO };\n        if (!Fp.eql(zz, Fp.ONE))\n            throw new Error('invZ was invalid');\n        return { x: ax, y: ay };\n    });\n    // NOTE: on exception this will crash 'cached' and no value will be set.\n    // Otherwise true will be return\n    const assertValidMemo = memoized((p) => {\n        if (p.is0()) {\n            // (0, 1, 0) aka ZERO is invalid in most contexts.\n            // In BLS, ZERO can be serialized, so we allow it.\n            // (0, 0, 0) is invalid representation of ZERO.\n            if (CURVE.allowInfinityPoint && !Fp.is0(p.py))\n                return;\n            throw new Error('bad point: ZERO');\n        }\n        // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`\n        const { x, y } = p.toAffine();\n        // Check if x, y are valid field elements\n        if (!Fp.isValid(x) || !Fp.isValid(y))\n            throw new Error('bad point: x or y not FE');\n        const left = Fp.sqr(y); // y²\n        const right = weierstrassEquation(x); // x³ + ax + b\n        if (!Fp.eql(left, right))\n            throw new Error('bad point: equation left != right');\n        if (!p.isTorsionFree())\n            throw new Error('bad point: not in prime-order subgroup');\n        return true;\n    });\n    /**\n     * Projective Point works in 3d / projective (homogeneous) coordinates: (x, y, z) ∋ (x=x/z, y=y/z)\n     * Default Point works in 2d / affine coordinates: (x, y)\n     * We're doing calculations in projective, because its operations don't require costly inversion.\n     */\n    class Point {\n        constructor(px, py, pz) {\n            this.px = px;\n            this.py = py;\n            this.pz = pz;\n            if (px == null || !Fp.isValid(px))\n                throw new Error('x required');\n            if (py == null || !Fp.isValid(py))\n                throw new Error('y required');\n            if (pz == null || !Fp.isValid(pz))\n                throw new Error('z required');\n            Object.freeze(this);\n        }\n        // Does not validate if the point is on-curve.\n        // Use fromHex instead, or call assertValidity() later.\n        static fromAffine(p) {\n            const { x, y } = p || {};\n            if (!p || !Fp.isValid(x) || !Fp.isValid(y))\n                throw new Error('invalid affine point');\n            if (p instanceof Point)\n                throw new Error('projective point not allowed');\n            const is0 = (i) => Fp.eql(i, Fp.ZERO);\n            // fromAffine(x:0, y:0) would produce (x:0, y:0, z:1), but we need (x:0, y:1, z:0)\n            if (is0(x) && is0(y))\n                return Point.ZERO;\n            return new Point(x, y, Fp.ONE);\n        }\n        get x() {\n            return this.toAffine().x;\n        }\n        get y() {\n            return this.toAffine().y;\n        }\n        /**\n         * Takes a bunch of Projective Points but executes only one\n         * inversion on all of them. Inversion is very slow operation,\n         * so this improves performance massively.\n         * Optimization: converts a list of projective points to a list of identical points with Z=1.\n         */\n        static normalizeZ(points) {\n            const toInv = Fp.invertBatch(points.map((p) => p.pz));\n            return points.map((p, i) => p.toAffine(toInv[i])).map(Point.fromAffine);\n        }\n        /**\n         * Converts hash string or Uint8Array to Point.\n         * @param hex short/long ECDSA hex\n         */\n        static fromHex(hex) {\n            const P = Point.fromAffine(fromBytes(ensureBytes('pointHex', hex)));\n            P.assertValidity();\n            return P;\n        }\n        // Multiplies generator point by privateKey.\n        static fromPrivateKey(privateKey) {\n            return Point.BASE.multiply(normPrivateKeyToScalar(privateKey));\n        }\n        // Multiscalar Multiplication\n        static msm(points, scalars) {\n            return pippenger(Point, Fn, points, scalars);\n        }\n        // \"Private method\", don't use it directly\n        _setWindowSize(windowSize) {\n            wnaf.setWindowSize(this, windowSize);\n        }\n        // A point on curve is valid if it conforms to equation.\n        assertValidity() {\n            assertValidMemo(this);\n        }\n        hasEvenY() {\n            const { y } = this.toAffine();\n            if (Fp.isOdd)\n                return !Fp.isOdd(y);\n            throw new Error(\"Field doesn't support isOdd\");\n        }\n        /**\n         * Compare one point to another.\n         */\n        equals(other) {\n            assertPrjPoint(other);\n            const { px: X1, py: Y1, pz: Z1 } = this;\n            const { px: X2, py: Y2, pz: Z2 } = other;\n            const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));\n            const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));\n            return U1 && U2;\n        }\n        /**\n         * Flips point to one corresponding to (x, -y) in Affine coordinates.\n         */\n        negate() {\n            return new Point(this.px, Fp.neg(this.py), this.pz);\n        }\n        // Renes-Costello-Batina exception-free doubling formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 3\n        // Cost: 8M + 3S + 3*a + 2*b3 + 15add.\n        double() {\n            const { a, b } = CURVE;\n            const b3 = Fp.mul(b, _3n);\n            const { px: X1, py: Y1, pz: Z1 } = this;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            let t0 = Fp.mul(X1, X1); // step 1\n            let t1 = Fp.mul(Y1, Y1);\n            let t2 = Fp.mul(Z1, Z1);\n            let t3 = Fp.mul(X1, Y1);\n            t3 = Fp.add(t3, t3); // step 5\n            Z3 = Fp.mul(X1, Z1);\n            Z3 = Fp.add(Z3, Z3);\n            X3 = Fp.mul(a, Z3);\n            Y3 = Fp.mul(b3, t2);\n            Y3 = Fp.add(X3, Y3); // step 10\n            X3 = Fp.sub(t1, Y3);\n            Y3 = Fp.add(t1, Y3);\n            Y3 = Fp.mul(X3, Y3);\n            X3 = Fp.mul(t3, X3);\n            Z3 = Fp.mul(b3, Z3); // step 15\n            t2 = Fp.mul(a, t2);\n            t3 = Fp.sub(t0, t2);\n            t3 = Fp.mul(a, t3);\n            t3 = Fp.add(t3, Z3);\n            Z3 = Fp.add(t0, t0); // step 20\n            t0 = Fp.add(Z3, t0);\n            t0 = Fp.add(t0, t2);\n            t0 = Fp.mul(t0, t3);\n            Y3 = Fp.add(Y3, t0);\n            t2 = Fp.mul(Y1, Z1); // step 25\n            t2 = Fp.add(t2, t2);\n            t0 = Fp.mul(t2, t3);\n            X3 = Fp.sub(X3, t0);\n            Z3 = Fp.mul(t2, t1);\n            Z3 = Fp.add(Z3, Z3); // step 30\n            Z3 = Fp.add(Z3, Z3);\n            return new Point(X3, Y3, Z3);\n        }\n        // Renes-Costello-Batina exception-free addition formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 1\n        // Cost: 12M + 0S + 3*a + 3*b3 + 23add.\n        add(other) {\n            assertPrjPoint(other);\n            const { px: X1, py: Y1, pz: Z1 } = this;\n            const { px: X2, py: Y2, pz: Z2 } = other;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            const a = CURVE.a;\n            const b3 = Fp.mul(CURVE.b, _3n);\n            let t0 = Fp.mul(X1, X2); // step 1\n            let t1 = Fp.mul(Y1, Y2);\n            let t2 = Fp.mul(Z1, Z2);\n            let t3 = Fp.add(X1, Y1);\n            let t4 = Fp.add(X2, Y2); // step 5\n            t3 = Fp.mul(t3, t4);\n            t4 = Fp.add(t0, t1);\n            t3 = Fp.sub(t3, t4);\n            t4 = Fp.add(X1, Z1);\n            let t5 = Fp.add(X2, Z2); // step 10\n            t4 = Fp.mul(t4, t5);\n            t5 = Fp.add(t0, t2);\n            t4 = Fp.sub(t4, t5);\n            t5 = Fp.add(Y1, Z1);\n            X3 = Fp.add(Y2, Z2); // step 15\n            t5 = Fp.mul(t5, X3);\n            X3 = Fp.add(t1, t2);\n            t5 = Fp.sub(t5, X3);\n            Z3 = Fp.mul(a, t4);\n            X3 = Fp.mul(b3, t2); // step 20\n            Z3 = Fp.add(X3, Z3);\n            X3 = Fp.sub(t1, Z3);\n            Z3 = Fp.add(t1, Z3);\n            Y3 = Fp.mul(X3, Z3);\n            t1 = Fp.add(t0, t0); // step 25\n            t1 = Fp.add(t1, t0);\n            t2 = Fp.mul(a, t2);\n            t4 = Fp.mul(b3, t4);\n            t1 = Fp.add(t1, t2);\n            t2 = Fp.sub(t0, t2); // step 30\n            t2 = Fp.mul(a, t2);\n            t4 = Fp.add(t4, t2);\n            t0 = Fp.mul(t1, t4);\n            Y3 = Fp.add(Y3, t0);\n            t0 = Fp.mul(t5, t4); // step 35\n            X3 = Fp.mul(t3, X3);\n            X3 = Fp.sub(X3, t0);\n            t0 = Fp.mul(t3, t1);\n            Z3 = Fp.mul(t5, Z3);\n            Z3 = Fp.add(Z3, t0); // step 40\n            return new Point(X3, Y3, Z3);\n        }\n        subtract(other) {\n            return this.add(other.negate());\n        }\n        is0() {\n            return this.equals(Point.ZERO);\n        }\n        wNAF(n) {\n            return wnaf.wNAFCached(this, n, Point.normalizeZ);\n        }\n        /**\n         * Non-constant-time multiplication. Uses double-and-add algorithm.\n         * It's faster, but should only be used when you don't care about\n         * an exposed private key e.g. sig verification, which works over *public* keys.\n         */\n        multiplyUnsafe(sc) {\n            const { endo, n: N } = CURVE;\n            ut.aInRange('scalar', sc, _0n, N);\n            const I = Point.ZERO;\n            if (sc === _0n)\n                return I;\n            if (this.is0() || sc === _1n)\n                return this;\n            // Case a: no endomorphism. Case b: has precomputes.\n            if (!endo || wnaf.hasPrecomputes(this))\n                return wnaf.wNAFCachedUnsafe(this, sc, Point.normalizeZ);\n            // Case c: endomorphism\n            let { k1neg, k1, k2neg, k2 } = endo.splitScalar(sc);\n            let k1p = I;\n            let k2p = I;\n            let d = this;\n            while (k1 > _0n || k2 > _0n) {\n                if (k1 & _1n)\n                    k1p = k1p.add(d);\n                if (k2 & _1n)\n                    k2p = k2p.add(d);\n                d = d.double();\n                k1 >>= _1n;\n                k2 >>= _1n;\n            }\n            if (k1neg)\n                k1p = k1p.negate();\n            if (k2neg)\n                k2p = k2p.negate();\n            k2p = new Point(Fp.mul(k2p.px, endo.beta), k2p.py, k2p.pz);\n            return k1p.add(k2p);\n        }\n        /**\n         * Constant time multiplication.\n         * Uses wNAF method. Windowed method may be 10% faster,\n         * but takes 2x longer to generate and consumes 2x memory.\n         * Uses precomputes when available.\n         * Uses endomorphism for Koblitz curves.\n         * @param scalar by which the point would be multiplied\n         * @returns New point\n         */\n        multiply(scalar) {\n            const { endo, n: N } = CURVE;\n            ut.aInRange('scalar', scalar, _1n, N);\n            let point, fake; // Fake point is used to const-time mult\n            if (endo) {\n                const { k1neg, k1, k2neg, k2 } = endo.splitScalar(scalar);\n                let { p: k1p, f: f1p } = this.wNAF(k1);\n                let { p: k2p, f: f2p } = this.wNAF(k2);\n                k1p = wnaf.constTimeNegate(k1neg, k1p);\n                k2p = wnaf.constTimeNegate(k2neg, k2p);\n                k2p = new Point(Fp.mul(k2p.px, endo.beta), k2p.py, k2p.pz);\n                point = k1p.add(k2p);\n                fake = f1p.add(f2p);\n            }\n            else {\n                const { p, f } = this.wNAF(scalar);\n                point = p;\n                fake = f;\n            }\n            // Normalize `z` for both points, but return only real one\n            return Point.normalizeZ([point, fake])[0];\n        }\n        /**\n         * Efficiently calculate `aP + bQ`. Unsafe, can expose private key, if used incorrectly.\n         * Not using Strauss-Shamir trick: precomputation tables are faster.\n         * The trick could be useful if both P and Q are not G (not in our case).\n         * @returns non-zero affine point\n         */\n        multiplyAndAddUnsafe(Q, a, b) {\n            const G = Point.BASE; // No Strauss-Shamir trick: we have 10% faster G precomputes\n            const mul = (P, a // Select faster multiply() method\n            ) => (a === _0n || a === _1n || !P.equals(G) ? P.multiplyUnsafe(a) : P.multiply(a));\n            const sum = mul(this, a).add(mul(Q, b));\n            return sum.is0() ? undefined : sum;\n        }\n        // Converts Projective point to affine (x, y) coordinates.\n        // Can accept precomputed Z^-1 - for example, from invertBatch.\n        // (x, y, z) ∋ (x=x/z, y=y/z)\n        toAffine(iz) {\n            return toAffineMemo(this, iz);\n        }\n        isTorsionFree() {\n            const { h: cofactor, isTorsionFree } = CURVE;\n            if (cofactor === _1n)\n                return true; // No subgroups, always torsion-free\n            if (isTorsionFree)\n                return isTorsionFree(Point, this);\n            throw new Error('isTorsionFree() has not been declared for the elliptic curve');\n        }\n        clearCofactor() {\n            const { h: cofactor, clearCofactor } = CURVE;\n            if (cofactor === _1n)\n                return this; // Fast-path\n            if (clearCofactor)\n                return clearCofactor(Point, this);\n            return this.multiplyUnsafe(CURVE.h);\n        }\n        toRawBytes(isCompressed = true) {\n            abool('isCompressed', isCompressed);\n            this.assertValidity();\n            return toBytes(Point, this, isCompressed);\n        }\n        toHex(isCompressed = true) {\n            abool('isCompressed', isCompressed);\n            return ut.bytesToHex(this.toRawBytes(isCompressed));\n        }\n    }\n    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);\n    Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO);\n    const _bits = CURVE.nBitLength;\n    const wnaf = wNAF(Point, CURVE.endo ? Math.ceil(_bits / 2) : _bits);\n    // Validate if generator point is on curve\n    return {\n        CURVE,\n        ProjectivePoint: Point,\n        normPrivateKeyToScalar,\n        weierstrassEquation,\n        isWithinCurveOrder,\n    };\n}\nfunction validateOpts(curve) {\n    const opts = validateBasic(curve);\n    ut.validateObject(opts, {\n        hash: 'hash',\n        hmac: 'function',\n        randomBytes: 'function',\n    }, {\n        bits2int: 'function',\n        bits2int_modN: 'function',\n        lowS: 'boolean',\n    });\n    return Object.freeze({ lowS: true, ...opts });\n}\n/**\n * Creates short weierstrass curve and ECDSA signature methods for it.\n * @example\n * import { Field } from '@noble/curves/abstract/modular';\n * // Before that, define BigInt-s: a, b, p, n, Gx, Gy\n * const curve = weierstrass({ a, b, Fp: Field(p), n, Gx, Gy, h: 1n })\n */\nexport function weierstrass(curveDef) {\n    const CURVE = validateOpts(curveDef);\n    const { Fp, n: CURVE_ORDER } = CURVE;\n    const compressedLen = Fp.BYTES + 1; // e.g. 33 for 32\n    const uncompressedLen = 2 * Fp.BYTES + 1; // e.g. 65 for 32\n    function modN(a) {\n        return mod.mod(a, CURVE_ORDER);\n    }\n    function invN(a) {\n        return mod.invert(a, CURVE_ORDER);\n    }\n    const { ProjectivePoint: Point, normPrivateKeyToScalar, weierstrassEquation, isWithinCurveOrder, } = weierstrassPoints({\n        ...CURVE,\n        toBytes(_c, point, isCompressed) {\n            const a = point.toAffine();\n            const x = Fp.toBytes(a.x);\n            const cat = ut.concatBytes;\n            abool('isCompressed', isCompressed);\n            if (isCompressed) {\n                return cat(Uint8Array.from([point.hasEvenY() ? 0x02 : 0x03]), x);\n            }\n            else {\n                return cat(Uint8Array.from([0x04]), x, Fp.toBytes(a.y));\n            }\n        },\n        fromBytes(bytes) {\n            const len = bytes.length;\n            const head = bytes[0];\n            const tail = bytes.subarray(1);\n            // this.assertValidity() is done inside of fromHex\n            if (len === compressedLen && (head === 0x02 || head === 0x03)) {\n                const x = ut.bytesToNumberBE(tail);\n                if (!ut.inRange(x, _1n, Fp.ORDER))\n                    throw new Error('Point is not on curve');\n                const y2 = weierstrassEquation(x); // y² = x³ + ax + b\n                let y;\n                try {\n                    y = Fp.sqrt(y2); // y = y² ^ (p+1)/4\n                }\n                catch (sqrtError) {\n                    const suffix = sqrtError instanceof Error ? ': ' + sqrtError.message : '';\n                    throw new Error('Point is not on curve' + suffix);\n                }\n                const isYOdd = (y & _1n) === _1n;\n                // ECDSA\n                const isHeadOdd = (head & 1) === 1;\n                if (isHeadOdd !== isYOdd)\n                    y = Fp.neg(y);\n                return { x, y };\n            }\n            else if (len === uncompressedLen && head === 0x04) {\n                const x = Fp.fromBytes(tail.subarray(0, Fp.BYTES));\n                const y = Fp.fromBytes(tail.subarray(Fp.BYTES, 2 * Fp.BYTES));\n                return { x, y };\n            }\n            else {\n                const cl = compressedLen;\n                const ul = uncompressedLen;\n                throw new Error('invalid Point, expected length of ' + cl + ', or uncompressed ' + ul + ', got ' + len);\n            }\n        },\n    });\n    const numToNByteStr = (num) => ut.bytesToHex(ut.numberToBytesBE(num, CURVE.nByteLength));\n    function isBiggerThanHalfOrder(number) {\n        const HALF = CURVE_ORDER >> _1n;\n        return number > HALF;\n    }\n    function normalizeS(s) {\n        return isBiggerThanHalfOrder(s) ? modN(-s) : s;\n    }\n    // slice bytes num\n    const slcNum = (b, from, to) => ut.bytesToNumberBE(b.slice(from, to));\n    /**\n     * ECDSA signature with its (r, s) properties. Supports DER & compact representations.\n     */\n    class Signature {\n        constructor(r, s, recovery) {\n            this.r = r;\n            this.s = s;\n            this.recovery = recovery;\n            this.assertValidity();\n        }\n        // pair (bytes of r, bytes of s)\n        static fromCompact(hex) {\n            const l = CURVE.nByteLength;\n            hex = ensureBytes('compactSignature', hex, l * 2);\n            return new Signature(slcNum(hex, 0, l), slcNum(hex, l, 2 * l));\n        }\n        // DER encoded ECDSA signature\n        // https://bitcoin.stackexchange.com/questions/57644/what-are-the-parts-of-a-bitcoin-transaction-input-script\n        static fromDER(hex) {\n            const { r, s } = DER.toSig(ensureBytes('DER', hex));\n            return new Signature(r, s);\n        }\n        assertValidity() {\n            ut.aInRange('r', this.r, _1n, CURVE_ORDER); // r in [1..N]\n            ut.aInRange('s', this.s, _1n, CURVE_ORDER); // s in [1..N]\n        }\n        addRecoveryBit(recovery) {\n            return new Signature(this.r, this.s, recovery);\n        }\n        recoverPublicKey(msgHash) {\n            const { r, s, recovery: rec } = this;\n            const h = bits2int_modN(ensureBytes('msgHash', msgHash)); // Truncate hash\n            if (rec == null || ![0, 1, 2, 3].includes(rec))\n                throw new Error('recovery id invalid');\n            const radj = rec === 2 || rec === 3 ? r + CURVE.n : r;\n            if (radj >= Fp.ORDER)\n                throw new Error('recovery id 2 or 3 invalid');\n            const prefix = (rec & 1) === 0 ? '02' : '03';\n            const R = Point.fromHex(prefix + numToNByteStr(radj));\n            const ir = invN(radj); // r^-1\n            const u1 = modN(-h * ir); // -hr^-1\n            const u2 = modN(s * ir); // sr^-1\n            const Q = Point.BASE.multiplyAndAddUnsafe(R, u1, u2); // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1)\n            if (!Q)\n                throw new Error('point at infinify'); // unsafe is fine: no priv data leaked\n            Q.assertValidity();\n            return Q;\n        }\n        // Signatures should be low-s, to prevent malleability.\n        hasHighS() {\n            return isBiggerThanHalfOrder(this.s);\n        }\n        normalizeS() {\n            return this.hasHighS() ? new Signature(this.r, modN(-this.s), this.recovery) : this;\n        }\n        // DER-encoded\n        toDERRawBytes() {\n            return ut.hexToBytes(this.toDERHex());\n        }\n        toDERHex() {\n            return DER.hexFromSig({ r: this.r, s: this.s });\n        }\n        // padded bytes of r, then padded bytes of s\n        toCompactRawBytes() {\n            return ut.hexToBytes(this.toCompactHex());\n        }\n        toCompactHex() {\n            return numToNByteStr(this.r) + numToNByteStr(this.s);\n        }\n    }\n    const utils = {\n        isValidPrivateKey(privateKey) {\n            try {\n                normPrivateKeyToScalar(privateKey);\n                return true;\n            }\n            catch (error) {\n                return false;\n            }\n        },\n        normPrivateKeyToScalar: normPrivateKeyToScalar,\n        /**\n         * Produces cryptographically secure private key from random of size\n         * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.\n         */\n        randomPrivateKey: () => {\n            const length = mod.getMinHashLength(CURVE.n);\n            return mod.mapHashToField(CURVE.randomBytes(length), CURVE.n);\n        },\n        /**\n         * Creates precompute table for an arbitrary EC point. Makes point \"cached\".\n         * Allows to massively speed-up `point.multiply(scalar)`.\n         * @returns cached point\n         * @example\n         * const fast = utils.precompute(8, ProjectivePoint.fromHex(someonesPubKey));\n         * fast.multiply(privKey); // much faster ECDH now\n         */\n        precompute(windowSize = 8, point = Point.BASE) {\n            point._setWindowSize(windowSize);\n            point.multiply(BigInt(3)); // 3 is arbitrary, just need any number here\n            return point;\n        },\n    };\n    /**\n     * Computes public key for a private key. Checks for validity of the private key.\n     * @param privateKey private key\n     * @param isCompressed whether to return compact (default), or full key\n     * @returns Public key, full when isCompressed=false; short when isCompressed=true\n     */\n    function getPublicKey(privateKey, isCompressed = true) {\n        return Point.fromPrivateKey(privateKey).toRawBytes(isCompressed);\n    }\n    /**\n     * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.\n     */\n    function isProbPub(item) {\n        const arr = ut.isBytes(item);\n        const str = typeof item === 'string';\n        const len = (arr || str) && item.length;\n        if (arr)\n            return len === compressedLen || len === uncompressedLen;\n        if (str)\n            return len === 2 * compressedLen || len === 2 * uncompressedLen;\n        if (item instanceof Point)\n            return true;\n        return false;\n    }\n    /**\n     * ECDH (Elliptic Curve Diffie Hellman).\n     * Computes shared public key from private key and public key.\n     * Checks: 1) private key validity 2) shared key is on-curve.\n     * Does NOT hash the result.\n     * @param privateA private key\n     * @param publicB different public key\n     * @param isCompressed whether to return compact (default), or full key\n     * @returns shared public key\n     */\n    function getSharedSecret(privateA, publicB, isCompressed = true) {\n        if (isProbPub(privateA))\n            throw new Error('first arg must be private key');\n        if (!isProbPub(publicB))\n            throw new Error('second arg must be public key');\n        const b = Point.fromHex(publicB); // check for being on-curve\n        return b.multiply(normPrivateKeyToScalar(privateA)).toRawBytes(isCompressed);\n    }\n    // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.\n    // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.\n    // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.\n    // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors\n    const bits2int = CURVE.bits2int ||\n        function (bytes) {\n            // Our custom check \"just in case\"\n            if (bytes.length > 8192)\n                throw new Error('input is too large');\n            // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)\n            // for some cases, since bytes.length * 8 is not actual bitLength.\n            const num = ut.bytesToNumberBE(bytes); // check for == u8 done here\n            const delta = bytes.length * 8 - CURVE.nBitLength; // truncate to nBitLength leftmost bits\n            return delta > 0 ? num >> BigInt(delta) : num;\n        };\n    const bits2int_modN = CURVE.bits2int_modN ||\n        function (bytes) {\n            return modN(bits2int(bytes)); // can't use bytesToNumberBE here\n        };\n    // NOTE: pads output with zero as per spec\n    const ORDER_MASK = ut.bitMask(CURVE.nBitLength);\n    /**\n     * Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`.\n     */\n    function int2octets(num) {\n        ut.aInRange('num < 2^' + CURVE.nBitLength, num, _0n, ORDER_MASK);\n        // works with order, can have different size than numToField!\n        return ut.numberToBytesBE(num, CURVE.nByteLength);\n    }\n    // Steps A, D of RFC6979 3.2\n    // Creates RFC6979 seed; converts msg/privKey to numbers.\n    // Used only in sign, not in verify.\n    // NOTE: we cannot assume here that msgHash has same amount of bytes as curve order,\n    // this will be invalid at least for P521. Also it can be bigger for P224 + SHA256\n    function prepSig(msgHash, privateKey, opts = defaultSigOpts) {\n        if (['recovered', 'canonical'].some((k) => k in opts))\n            throw new Error('sign() legacy options not supported');\n        const { hash, randomBytes } = CURVE;\n        let { lowS, prehash, extraEntropy: ent } = opts; // generates low-s sigs by default\n        if (lowS == null)\n            lowS = true; // RFC6979 3.2: we skip step A, because we already provide hash\n        msgHash = ensureBytes('msgHash', msgHash);\n        validateSigVerOpts(opts);\n        if (prehash)\n            msgHash = ensureBytes('prehashed msgHash', hash(msgHash));\n        // We can't later call bits2octets, since nested bits2int is broken for curves\n        // with nBitLength % 8 !== 0. Because of that, we unwrap it here as int2octets call.\n        // const bits2octets = (bits) => int2octets(bits2int_modN(bits))\n        const h1int = bits2int_modN(msgHash);\n        const d = normPrivateKeyToScalar(privateKey); // validate private key, convert to bigint\n        const seedArgs = [int2octets(d), int2octets(h1int)];\n        // extraEntropy. RFC6979 3.6: additional k' (optional).\n        if (ent != null && ent !== false) {\n            // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')\n            const e = ent === true ? randomBytes(Fp.BYTES) : ent; // generate random bytes OR pass as-is\n            seedArgs.push(ensureBytes('extraEntropy', e)); // check for being bytes\n        }\n        const seed = ut.concatBytes(...seedArgs); // Step D of RFC6979 3.2\n        const m = h1int; // NOTE: no need to call bits2int second time here, it is inside truncateHash!\n        // Converts signature params into point w r/s, checks result for validity.\n        function k2sig(kBytes) {\n            // RFC 6979 Section 3.2, step 3: k = bits2int(T)\n            const k = bits2int(kBytes); // Cannot use fields methods, since it is group element\n            if (!isWithinCurveOrder(k))\n                return; // Important: all mod() calls here must be done over N\n            const ik = invN(k); // k^-1 mod n\n            const q = Point.BASE.multiply(k).toAffine(); // q = Gk\n            const r = modN(q.x); // r = q.x mod n\n            if (r === _0n)\n                return;\n            // Can use scalar blinding b^-1(bm + bdr) where b ∈ [1,q−1] according to\n            // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. We've decided against it:\n            // a) dependency on CSPRNG b) 15% slowdown c) doesn't really help since bigints are not CT\n            const s = modN(ik * modN(m + r * d)); // Not using blinding here\n            if (s === _0n)\n                return;\n            let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3, when q.x > n)\n            let normS = s;\n            if (lowS && isBiggerThanHalfOrder(s)) {\n                normS = normalizeS(s); // if lowS was passed, ensure s is always\n                recovery ^= 1; // // in the bottom half of N\n            }\n            return new Signature(r, normS, recovery); // use normS, not s\n        }\n        return { seed, k2sig };\n    }\n    const defaultSigOpts = { lowS: CURVE.lowS, prehash: false };\n    const defaultVerOpts = { lowS: CURVE.lowS, prehash: false };\n    /**\n     * Signs message hash with a private key.\n     * ```\n     * sign(m, d, k) where\n     *   (x, y) = G × k\n     *   r = x mod n\n     *   s = (m + dr)/k mod n\n     * ```\n     * @param msgHash NOT message. msg needs to be hashed to `msgHash`, or use `prehash`.\n     * @param privKey private key\n     * @param opts lowS for non-malleable sigs. extraEntropy for mixing randomness into k. prehash will hash first arg.\n     * @returns signature with recovery param\n     */\n    function sign(msgHash, privKey, opts = defaultSigOpts) {\n        const { seed, k2sig } = prepSig(msgHash, privKey, opts); // Steps A, D of RFC6979 3.2.\n        const C = CURVE;\n        const drbg = ut.createHmacDrbg(C.hash.outputLen, C.nByteLength, C.hmac);\n        return drbg(seed, k2sig); // Steps B, C, D, E, F, G\n    }\n    // Enable precomputes. Slows down first publicKey computation by 20ms.\n    Point.BASE._setWindowSize(8);\n    // utils.precompute(8, ProjectivePoint.BASE)\n    /**\n     * Verifies a signature against message hash and public key.\n     * Rejects lowS signatures by default: to override,\n     * specify option `{lowS: false}`. Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:\n     *\n     * ```\n     * verify(r, s, h, P) where\n     *   U1 = hs^-1 mod n\n     *   U2 = rs^-1 mod n\n     *   R = U1⋅G - U2⋅P\n     *   mod(R.x, n) == r\n     * ```\n     */\n    function verify(signature, msgHash, publicKey, opts = defaultVerOpts) {\n        const sg = signature;\n        msgHash = ensureBytes('msgHash', msgHash);\n        publicKey = ensureBytes('publicKey', publicKey);\n        const { lowS, prehash, format } = opts;\n        // Verify opts, deduce signature format\n        validateSigVerOpts(opts);\n        if ('strict' in opts)\n            throw new Error('options.strict was renamed to lowS');\n        if (format !== undefined && format !== 'compact' && format !== 'der')\n            throw new Error('format must be compact or der');\n        const isHex = typeof sg === 'string' || ut.isBytes(sg);\n        const isObj = !isHex &&\n            !format &&\n            typeof sg === 'object' &&\n            sg !== null &&\n            typeof sg.r === 'bigint' &&\n            typeof sg.s === 'bigint';\n        if (!isHex && !isObj)\n            throw new Error('invalid signature, expected Uint8Array, hex string or Signature instance');\n        let _sig = undefined;\n        let P;\n        try {\n            if (isObj)\n                _sig = new Signature(sg.r, sg.s);\n            if (isHex) {\n                // Signature can be represented in 2 ways: compact (2*nByteLength) & DER (variable-length).\n                // Since DER can also be 2*nByteLength bytes, we check for it first.\n                try {\n                    if (format !== 'compact')\n                        _sig = Signature.fromDER(sg);\n                }\n                catch (derError) {\n                    if (!(derError instanceof DER.Err))\n                        throw derError;\n                }\n                if (!_sig && format !== 'der')\n                    _sig = Signature.fromCompact(sg);\n            }\n            P = Point.fromHex(publicKey);\n        }\n        catch (error) {\n            return false;\n        }\n        if (!_sig)\n            return false;\n        if (lowS && _sig.hasHighS())\n            return false;\n        if (prehash)\n            msgHash = CURVE.hash(msgHash);\n        const { r, s } = _sig;\n        const h = bits2int_modN(msgHash); // Cannot use fields methods, since it is group element\n        const is = invN(s); // s^-1\n        const u1 = modN(h * is); // u1 = hs^-1 mod n\n        const u2 = modN(r * is); // u2 = rs^-1 mod n\n        const R = Point.BASE.multiplyAndAddUnsafe(P, u1, u2)?.toAffine(); // R = u1⋅G + u2⋅P\n        if (!R)\n            return false;\n        const v = modN(R.x);\n        return v === r;\n    }\n    return {\n        CURVE,\n        getPublicKey,\n        getSharedSecret,\n        sign,\n        verify,\n        ProjectivePoint: Point,\n        Signature,\n        utils,\n    };\n}\n/**\n * Implementation of the Shallue and van de Woestijne method for any weierstrass curve.\n * TODO: check if there is a way to merge this with uvRatio in Edwards; move to modular.\n * b = True and y = sqrt(u / v) if (u / v) is square in F, and\n * b = False and y = sqrt(Z * (u / v)) otherwise.\n * @param Fp\n * @param Z\n * @returns\n */\nexport function SWUFpSqrtRatio(Fp, Z) {\n    // Generic implementation\n    const q = Fp.ORDER;\n    let l = _0n;\n    for (let o = q - _1n; o % _2n === _0n; o /= _2n)\n        l += _1n;\n    const c1 = l; // 1. c1, the largest integer such that 2^c1 divides q - 1.\n    // We need 2n ** c1 and 2n ** (c1-1). We can't use **; but we can use <<.\n    // 2n ** c1 == 2n << (c1-1)\n    const _2n_pow_c1_1 = _2n << (c1 - _1n - _1n);\n    const _2n_pow_c1 = _2n_pow_c1_1 * _2n;\n    const c2 = (q - _1n) / _2n_pow_c1; // 2. c2 = (q - 1) / (2^c1)  # Integer arithmetic\n    const c3 = (c2 - _1n) / _2n; // 3. c3 = (c2 - 1) / 2            # Integer arithmetic\n    const c4 = _2n_pow_c1 - _1n; // 4. c4 = 2^c1 - 1                # Integer arithmetic\n    const c5 = _2n_pow_c1_1; // 5. c5 = 2^(c1 - 1)                  # Integer arithmetic\n    const c6 = Fp.pow(Z, c2); // 6. c6 = Z^c2\n    const c7 = Fp.pow(Z, (c2 + _1n) / _2n); // 7. c7 = Z^((c2 + 1) / 2)\n    let sqrtRatio = (u, v) => {\n        let tv1 = c6; // 1. tv1 = c6\n        let tv2 = Fp.pow(v, c4); // 2. tv2 = v^c4\n        let tv3 = Fp.sqr(tv2); // 3. tv3 = tv2^2\n        tv3 = Fp.mul(tv3, v); // 4. tv3 = tv3 * v\n        let tv5 = Fp.mul(u, tv3); // 5. tv5 = u * tv3\n        tv5 = Fp.pow(tv5, c3); // 6. tv5 = tv5^c3\n        tv5 = Fp.mul(tv5, tv2); // 7. tv5 = tv5 * tv2\n        tv2 = Fp.mul(tv5, v); // 8. tv2 = tv5 * v\n        tv3 = Fp.mul(tv5, u); // 9. tv3 = tv5 * u\n        let tv4 = Fp.mul(tv3, tv2); // 10. tv4 = tv3 * tv2\n        tv5 = Fp.pow(tv4, c5); // 11. tv5 = tv4^c5\n        let isQR = Fp.eql(tv5, Fp.ONE); // 12. isQR = tv5 == 1\n        tv2 = Fp.mul(tv3, c7); // 13. tv2 = tv3 * c7\n        tv5 = Fp.mul(tv4, tv1); // 14. tv5 = tv4 * tv1\n        tv3 = Fp.cmov(tv2, tv3, isQR); // 15. tv3 = CMOV(tv2, tv3, isQR)\n        tv4 = Fp.cmov(tv5, tv4, isQR); // 16. tv4 = CMOV(tv5, tv4, isQR)\n        // 17. for i in (c1, c1 - 1, ..., 2):\n        for (let i = c1; i > _1n; i--) {\n            let tv5 = i - _2n; // 18.    tv5 = i - 2\n            tv5 = _2n << (tv5 - _1n); // 19.    tv5 = 2^tv5\n            let tvv5 = Fp.pow(tv4, tv5); // 20.    tv5 = tv4^tv5\n            const e1 = Fp.eql(tvv5, Fp.ONE); // 21.    e1 = tv5 == 1\n            tv2 = Fp.mul(tv3, tv1); // 22.    tv2 = tv3 * tv1\n            tv1 = Fp.mul(tv1, tv1); // 23.    tv1 = tv1 * tv1\n            tvv5 = Fp.mul(tv4, tv1); // 24.    tv5 = tv4 * tv1\n            tv3 = Fp.cmov(tv2, tv3, e1); // 25.    tv3 = CMOV(tv2, tv3, e1)\n            tv4 = Fp.cmov(tvv5, tv4, e1); // 26.    tv4 = CMOV(tv5, tv4, e1)\n        }\n        return { isValid: isQR, value: tv3 };\n    };\n    if (Fp.ORDER % _4n === _3n) {\n        // sqrt_ratio_3mod4(u, v)\n        const c1 = (Fp.ORDER - _3n) / _4n; // 1. c1 = (q - 3) / 4     # Integer arithmetic\n        const c2 = Fp.sqrt(Fp.neg(Z)); // 2. c2 = sqrt(-Z)\n        sqrtRatio = (u, v) => {\n            let tv1 = Fp.sqr(v); // 1. tv1 = v^2\n            const tv2 = Fp.mul(u, v); // 2. tv2 = u * v\n            tv1 = Fp.mul(tv1, tv2); // 3. tv1 = tv1 * tv2\n            let y1 = Fp.pow(tv1, c1); // 4. y1 = tv1^c1\n            y1 = Fp.mul(y1, tv2); // 5. y1 = y1 * tv2\n            const y2 = Fp.mul(y1, c2); // 6. y2 = y1 * c2\n            const tv3 = Fp.mul(Fp.sqr(y1), v); // 7. tv3 = y1^2; 8. tv3 = tv3 * v\n            const isQR = Fp.eql(tv3, u); // 9. isQR = tv3 == u\n            let y = Fp.cmov(y2, y1, isQR); // 10. y = CMOV(y2, y1, isQR)\n            return { isValid: isQR, value: y }; // 11. return (isQR, y) isQR ? y : y*c2\n        };\n    }\n    // No curves uses that\n    // if (Fp.ORDER % _8n === _5n) // sqrt_ratio_5mod8\n    return sqrtRatio;\n}\n/**\n * Simplified Shallue-van de Woestijne-Ulas Method\n * https://www.rfc-editor.org/rfc/rfc9380#section-6.6.2\n */\nexport function mapToCurveSimpleSWU(Fp, opts) {\n    mod.validateField(Fp);\n    if (!Fp.isValid(opts.A) || !Fp.isValid(opts.B) || !Fp.isValid(opts.Z))\n        throw new Error('mapToCurveSimpleSWU: invalid opts');\n    const sqrtRatio = SWUFpSqrtRatio(Fp, opts.Z);\n    if (!Fp.isOdd)\n        throw new Error('Fp.isOdd is not implemented!');\n    // Input: u, an element of F.\n    // Output: (x, y), a point on E.\n    return (u) => {\n        // prettier-ignore\n        let tv1, tv2, tv3, tv4, tv5, tv6, x, y;\n        tv1 = Fp.sqr(u); // 1.  tv1 = u^2\n        tv1 = Fp.mul(tv1, opts.Z); // 2.  tv1 = Z * tv1\n        tv2 = Fp.sqr(tv1); // 3.  tv2 = tv1^2\n        tv2 = Fp.add(tv2, tv1); // 4.  tv2 = tv2 + tv1\n        tv3 = Fp.add(tv2, Fp.ONE); // 5.  tv3 = tv2 + 1\n        tv3 = Fp.mul(tv3, opts.B); // 6.  tv3 = B * tv3\n        tv4 = Fp.cmov(opts.Z, Fp.neg(tv2), !Fp.eql(tv2, Fp.ZERO)); // 7.  tv4 = CMOV(Z, -tv2, tv2 != 0)\n        tv4 = Fp.mul(tv4, opts.A); // 8.  tv4 = A * tv4\n        tv2 = Fp.sqr(tv3); // 9.  tv2 = tv3^2\n        tv6 = Fp.sqr(tv4); // 10. tv6 = tv4^2\n        tv5 = Fp.mul(tv6, opts.A); // 11. tv5 = A * tv6\n        tv2 = Fp.add(tv2, tv5); // 12. tv2 = tv2 + tv5\n        tv2 = Fp.mul(tv2, tv3); // 13. tv2 = tv2 * tv3\n        tv6 = Fp.mul(tv6, tv4); // 14. tv6 = tv6 * tv4\n        tv5 = Fp.mul(tv6, opts.B); // 15. tv5 = B * tv6\n        tv2 = Fp.add(tv2, tv5); // 16. tv2 = tv2 + tv5\n        x = Fp.mul(tv1, tv3); // 17.   x = tv1 * tv3\n        const { isValid, value } = sqrtRatio(tv2, tv6); // 18. (is_gx1_square, y1) = sqrt_ratio(tv2, tv6)\n        y = Fp.mul(tv1, u); // 19.   y = tv1 * u  -> Z * u^3 * y1\n        y = Fp.mul(y, value); // 20.   y = y * y1\n        x = Fp.cmov(x, tv3, isValid); // 21.   x = CMOV(x, tv3, is_gx1_square)\n        y = Fp.cmov(y, value, isValid); // 22.   y = CMOV(y, y1, is_gx1_square)\n        const e1 = Fp.isOdd(u) === Fp.isOdd(y); // 23.  e1 = sgn0(u) == sgn0(y)\n        y = Fp.cmov(Fp.neg(y), y, e1); // 24.   y = CMOV(-y, y, e1)\n        x = Fp.div(x, tv4); // 25.   x = x / tv4\n        return { x, y };\n    };\n}\n//# sourceMappingURL=weierstrass.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { hmac } from '@noble/hashes/hmac';\nimport { concatBytes, randomBytes } from '@noble/hashes/utils';\nimport { weierstrass } from './abstract/weierstrass.js';\n// connects noble-curves to noble-hashes\nexport function getHash(hash) {\n    return {\n        hash,\n        hmac: (key, ...msgs) => hmac(hash, key, concatBytes(...msgs)),\n        randomBytes,\n    };\n}\nexport function createCurve(curveDef, defHash) {\n    const create = (hash) => weierstrass({ ...curveDef, ...getHash(hash) });\n    return Object.freeze({ ...create(defHash), create });\n}\n//# sourceMappingURL=_shortw_utils.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha256 } from '@noble/hashes/sha256';\nimport { createCurve } from './_shortw_utils.js';\nimport { createHasher } from './abstract/hash-to-curve.js';\nimport { Field } from './abstract/modular.js';\nimport { mapToCurveSimpleSWU } from './abstract/weierstrass.js';\n// NIST secp256r1 aka p256\n// https://www.secg.org/sec2-v2.pdf, https://neuromancer.sk/std/nist/P-256\nconst Fp256 = Field(BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff'));\nconst CURVE_A = Fp256.create(BigInt('-3'));\nconst CURVE_B = BigInt('0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b');\n// prettier-ignore\nexport const p256 = createCurve({\n    a: CURVE_A, // Equation params: a, b\n    b: CURVE_B,\n    Fp: Fp256, // Field: 2n**224n * (2n**32n-1n) + 2n**192n + 2n**96n-1n\n    // Curve order, total count of valid points in the field\n    n: BigInt('0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'),\n    // Base (generator) point (x, y)\n    Gx: BigInt('0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296'),\n    Gy: BigInt('0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5'),\n    h: BigInt(1),\n    lowS: false,\n}, sha256);\nexport const secp256r1 = p256;\nconst mapSWU = /* @__PURE__ */ (() => mapToCurveSimpleSWU(Fp256, {\n    A: CURVE_A,\n    B: CURVE_B,\n    Z: Fp256.create(BigInt('-10')),\n}))();\nconst htf = /* @__PURE__ */ (() => createHasher(secp256r1.ProjectivePoint, (scalars) => mapSWU(scalars[0]), {\n    DST: 'P256_XMD:SHA-256_SSWU_RO_',\n    encodeDST: 'P256_XMD:SHA-256_SSWU_NU_',\n    p: Fp256.ORDER,\n    m: 1,\n    k: 128,\n    expand: 'xmd',\n    hash: sha256,\n}))();\nexport const hashToCurve = /* @__PURE__ */ (() => htf.hashToCurve)();\nexport const encodeToCurve = /* @__PURE__ */ (() => htf.encodeToCurve)();\n//# sourceMappingURL=p256.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha384 } from '@noble/hashes/sha512';\nimport { createCurve } from './_shortw_utils.js';\nimport { createHasher } from './abstract/hash-to-curve.js';\nimport { Field } from './abstract/modular.js';\nimport { mapToCurveSimpleSWU } from './abstract/weierstrass.js';\n// NIST secp384r1 aka p384\n// https://www.secg.org/sec2-v2.pdf, https://neuromancer.sk/std/nist/P-384\n// Field over which we'll do calculations.\n// prettier-ignore\nconst P = BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff');\nconst Fp384 = Field(P);\nconst CURVE_A = Fp384.create(BigInt('-3'));\n// prettier-ignore\nconst CURVE_B = BigInt('0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef');\n// prettier-ignore\nexport const p384 = createCurve({\n    a: CURVE_A, // Equation params: a, b\n    b: CURVE_B,\n    Fp: Fp384, // Field: 2n**384n - 2n**128n - 2n**96n + 2n**32n - 1n\n    // Curve order, total count of valid points in the field.\n    n: BigInt('0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973'),\n    // Base (generator) point (x, y)\n    Gx: BigInt('0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7'),\n    Gy: BigInt('0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f'),\n    h: BigInt(1),\n    lowS: false,\n}, sha384);\nexport const secp384r1 = p384;\nconst mapSWU = /* @__PURE__ */ (() => mapToCurveSimpleSWU(Fp384, {\n    A: CURVE_A,\n    B: CURVE_B,\n    Z: Fp384.create(BigInt('-12')),\n}))();\nconst htf = /* @__PURE__ */ (() => createHasher(secp384r1.ProjectivePoint, (scalars) => mapSWU(scalars[0]), {\n    DST: 'P384_XMD:SHA-384_SSWU_RO_',\n    encodeDST: 'P384_XMD:SHA-384_SSWU_NU_',\n    p: Fp384.ORDER,\n    m: 1,\n    k: 192,\n    expand: 'xmd',\n    hash: sha384,\n}))();\nexport const hashToCurve = /* @__PURE__ */ (() => htf.hashToCurve)();\nexport const encodeToCurve = /* @__PURE__ */ (() => htf.encodeToCurve)();\n//# sourceMappingURL=p384.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha512 } from '@noble/hashes/sha512';\nimport { createCurve } from './_shortw_utils.js';\nimport { createHasher } from './abstract/hash-to-curve.js';\nimport { Field } from './abstract/modular.js';\nimport { mapToCurveSimpleSWU } from './abstract/weierstrass.js';\n// NIST secp521r1 aka p521\n// Note that it's 521, which differs from 512 of its hash function.\n// https://www.secg.org/sec2-v2.pdf, https://neuromancer.sk/std/nist/P-521\n// Field over which we'll do calculations.\n// prettier-ignore\nconst P = BigInt('0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff');\nconst Fp521 = Field(P);\nconst CURVE = {\n    a: Fp521.create(BigInt('-3')),\n    b: BigInt('0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00'),\n    Fp: Fp521,\n    n: BigInt('0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409'),\n    Gx: BigInt('0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66'),\n    Gy: BigInt('0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650'),\n    h: BigInt(1),\n};\n// prettier-ignore\nexport const p521 = createCurve({\n    a: CURVE.a, // Equation params: a, b\n    b: CURVE.b,\n    Fp: Fp521, // Field: 2n**521n - 1n\n    // Curve order, total count of valid points in the field\n    n: CURVE.n,\n    Gx: CURVE.Gx, // Base point (x, y) aka generator point\n    Gy: CURVE.Gy,\n    h: CURVE.h,\n    lowS: false,\n    allowedPrivateKeyLengths: [130, 131, 132] // P521 keys are variable-length. Normalize to 132b\n}, sha512);\nexport const secp521r1 = p521;\nconst mapSWU = /* @__PURE__ */ (() => mapToCurveSimpleSWU(Fp521, {\n    A: CURVE.a,\n    B: CURVE.b,\n    Z: Fp521.create(BigInt('-4')),\n}))();\nconst htf = /* @__PURE__ */ (() => createHasher(secp521r1.ProjectivePoint, (scalars) => mapSWU(scalars[0]), {\n    DST: 'P521_XMD:SHA-512_SSWU_RO_',\n    encodeDST: 'P521_XMD:SHA-512_SSWU_NU_',\n    p: Fp521.ORDER,\n    m: 1,\n    k: 256,\n    expand: 'xmd',\n    hash: sha512,\n}))();\nexport const hashToCurve = /* @__PURE__ */ (() => htf.hashToCurve)();\nexport const encodeToCurve = /* @__PURE__ */ (() => htf.encodeToCurve)();\n//# sourceMappingURL=p521.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\n// Twisted Edwards curve. The formula is: ax² + y² = 1 + dx²y²\nimport { validateBasic, wNAF, pippenger, } from './curve.js';\nimport { mod, Field } from './modular.js';\nimport * as ut from './utils.js';\nimport { ensureBytes, memoized, abool } from './utils.js';\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _8n = BigInt(8);\n// verification rule is either zip215 or rfc8032 / nist186-5. Consult fromHex:\nconst VERIFY_DEFAULT = { zip215: true };\nfunction validateOpts(curve) {\n    const opts = validateBasic(curve);\n    ut.validateObject(curve, {\n        hash: 'function',\n        a: 'bigint',\n        d: 'bigint',\n        randomBytes: 'function',\n    }, {\n        adjustScalarBytes: 'function',\n        domain: 'function',\n        uvRatio: 'function',\n        mapToCurve: 'function',\n    });\n    // Set defaults\n    return Object.freeze({ ...opts });\n}\n/**\n * Creates Twisted Edwards curve with EdDSA signatures.\n * @example\n * import { Field } from '@noble/curves/abstract/modular';\n * // Before that, define BigInt-s: a, d, p, n, Gx, Gy, h\n * const curve = twistedEdwards({ a, d, Fp: Field(p), n, Gx, Gy, h })\n */\nexport function twistedEdwards(curveDef) {\n    const CURVE = validateOpts(curveDef);\n    const { Fp, n: CURVE_ORDER, prehash: prehash, hash: cHash, randomBytes, nByteLength, h: cofactor, } = CURVE;\n    // Important:\n    // There are some places where Fp.BYTES is used instead of nByteLength.\n    // So far, everything has been tested with curves of Fp.BYTES == nByteLength.\n    // TODO: test and find curves which behave otherwise.\n    const MASK = _2n << (BigInt(nByteLength * 8) - _1n);\n    const modP = Fp.create; // Function overrides\n    const Fn = Field(CURVE.n, CURVE.nBitLength);\n    // sqrt(u/v)\n    const uvRatio = CURVE.uvRatio ||\n        ((u, v) => {\n            try {\n                return { isValid: true, value: Fp.sqrt(u * Fp.inv(v)) };\n            }\n            catch (e) {\n                return { isValid: false, value: _0n };\n            }\n        });\n    const adjustScalarBytes = CURVE.adjustScalarBytes || ((bytes) => bytes); // NOOP\n    const domain = CURVE.domain ||\n        ((data, ctx, phflag) => {\n            abool('phflag', phflag);\n            if (ctx.length || phflag)\n                throw new Error('Contexts/pre-hash are not supported');\n            return data;\n        }); // NOOP\n    // 0 <= n < MASK\n    // Coordinates larger than Fp.ORDER are allowed for zip215\n    function aCoordinate(title, n) {\n        ut.aInRange('coordinate ' + title, n, _0n, MASK);\n    }\n    function assertPoint(other) {\n        if (!(other instanceof Point))\n            throw new Error('ExtendedPoint expected');\n    }\n    // Converts Extended point to default (x, y) coordinates.\n    // Can accept precomputed Z^-1 - for example, from invertBatch.\n    const toAffineMemo = memoized((p, iz) => {\n        const { ex: x, ey: y, ez: z } = p;\n        const is0 = p.is0();\n        if (iz == null)\n            iz = is0 ? _8n : Fp.inv(z); // 8 was chosen arbitrarily\n        const ax = modP(x * iz);\n        const ay = modP(y * iz);\n        const zz = modP(z * iz);\n        if (is0)\n            return { x: _0n, y: _1n };\n        if (zz !== _1n)\n            throw new Error('invZ was invalid');\n        return { x: ax, y: ay };\n    });\n    const assertValidMemo = memoized((p) => {\n        const { a, d } = CURVE;\n        if (p.is0())\n            throw new Error('bad point: ZERO'); // TODO: optimize, with vars below?\n        // Equation in affine coordinates: ax² + y² = 1 + dx²y²\n        // Equation in projective coordinates (X/Z, Y/Z, Z):  (aX² + Y²)Z² = Z⁴ + dX²Y²\n        const { ex: X, ey: Y, ez: Z, et: T } = p;\n        const X2 = modP(X * X); // X²\n        const Y2 = modP(Y * Y); // Y²\n        const Z2 = modP(Z * Z); // Z²\n        const Z4 = modP(Z2 * Z2); // Z⁴\n        const aX2 = modP(X2 * a); // aX²\n        const left = modP(Z2 * modP(aX2 + Y2)); // (aX² + Y²)Z²\n        const right = modP(Z4 + modP(d * modP(X2 * Y2))); // Z⁴ + dX²Y²\n        if (left !== right)\n            throw new Error('bad point: equation left != right (1)');\n        // In Extended coordinates we also have T, which is x*y=T/Z: check X*Y == Z*T\n        const XY = modP(X * Y);\n        const ZT = modP(Z * T);\n        if (XY !== ZT)\n            throw new Error('bad point: equation left != right (2)');\n        return true;\n    });\n    // Extended Point works in extended coordinates: (x, y, z, t) ∋ (x=x/z, y=y/z, t=xy).\n    // https://en.wikipedia.org/wiki/Twisted_Edwards_curve#Extended_coordinates\n    class Point {\n        constructor(ex, ey, ez, et) {\n            this.ex = ex;\n            this.ey = ey;\n            this.ez = ez;\n            this.et = et;\n            aCoordinate('x', ex);\n            aCoordinate('y', ey);\n            aCoordinate('z', ez);\n            aCoordinate('t', et);\n            Object.freeze(this);\n        }\n        get x() {\n            return this.toAffine().x;\n        }\n        get y() {\n            return this.toAffine().y;\n        }\n        static fromAffine(p) {\n            if (p instanceof Point)\n                throw new Error('extended point not allowed');\n            const { x, y } = p || {};\n            aCoordinate('x', x);\n            aCoordinate('y', y);\n            return new Point(x, y, _1n, modP(x * y));\n        }\n        static normalizeZ(points) {\n            const toInv = Fp.invertBatch(points.map((p) => p.ez));\n            return points.map((p, i) => p.toAffine(toInv[i])).map(Point.fromAffine);\n        }\n        // Multiscalar Multiplication\n        static msm(points, scalars) {\n            return pippenger(Point, Fn, points, scalars);\n        }\n        // \"Private method\", don't use it directly\n        _setWindowSize(windowSize) {\n            wnaf.setWindowSize(this, windowSize);\n        }\n        // Not required for fromHex(), which always creates valid points.\n        // Could be useful for fromAffine().\n        assertValidity() {\n            assertValidMemo(this);\n        }\n        // Compare one point to another.\n        equals(other) {\n            assertPoint(other);\n            const { ex: X1, ey: Y1, ez: Z1 } = this;\n            const { ex: X2, ey: Y2, ez: Z2 } = other;\n            const X1Z2 = modP(X1 * Z2);\n            const X2Z1 = modP(X2 * Z1);\n            const Y1Z2 = modP(Y1 * Z2);\n            const Y2Z1 = modP(Y2 * Z1);\n            return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;\n        }\n        is0() {\n            return this.equals(Point.ZERO);\n        }\n        negate() {\n            // Flips point sign to a negative one (-x, y in affine coords)\n            return new Point(modP(-this.ex), this.ey, this.ez, modP(-this.et));\n        }\n        // Fast algo for doubling Extended Point.\n        // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd\n        // Cost: 4M + 4S + 1*a + 6add + 1*2.\n        double() {\n            const { a } = CURVE;\n            const { ex: X1, ey: Y1, ez: Z1 } = this;\n            const A = modP(X1 * X1); // A = X12\n            const B = modP(Y1 * Y1); // B = Y12\n            const C = modP(_2n * modP(Z1 * Z1)); // C = 2*Z12\n            const D = modP(a * A); // D = a*A\n            const x1y1 = X1 + Y1;\n            const E = modP(modP(x1y1 * x1y1) - A - B); // E = (X1+Y1)2-A-B\n            const G = D + B; // G = D+B\n            const F = G - C; // F = G-C\n            const H = D - B; // H = D-B\n            const X3 = modP(E * F); // X3 = E*F\n            const Y3 = modP(G * H); // Y3 = G*H\n            const T3 = modP(E * H); // T3 = E*H\n            const Z3 = modP(F * G); // Z3 = F*G\n            return new Point(X3, Y3, Z3, T3);\n        }\n        // Fast algo for adding 2 Extended Points.\n        // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd\n        // Cost: 9M + 1*a + 1*d + 7add.\n        add(other) {\n            assertPoint(other);\n            const { a, d } = CURVE;\n            const { ex: X1, ey: Y1, ez: Z1, et: T1 } = this;\n            const { ex: X2, ey: Y2, ez: Z2, et: T2 } = other;\n            // Faster algo for adding 2 Extended Points when curve's a=-1.\n            // http://hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html#addition-add-2008-hwcd-4\n            // Cost: 8M + 8add + 2*2.\n            // Note: It does not check whether the `other` point is valid.\n            if (a === BigInt(-1)) {\n                const A = modP((Y1 - X1) * (Y2 + X2));\n                const B = modP((Y1 + X1) * (Y2 - X2));\n                const F = modP(B - A);\n                if (F === _0n)\n                    return this.double(); // Same point. Tests say it doesn't affect timing\n                const C = modP(Z1 * _2n * T2);\n                const D = modP(T1 * _2n * Z2);\n                const E = D + C;\n                const G = B + A;\n                const H = D - C;\n                const X3 = modP(E * F);\n                const Y3 = modP(G * H);\n                const T3 = modP(E * H);\n                const Z3 = modP(F * G);\n                return new Point(X3, Y3, Z3, T3);\n            }\n            const A = modP(X1 * X2); // A = X1*X2\n            const B = modP(Y1 * Y2); // B = Y1*Y2\n            const C = modP(T1 * d * T2); // C = T1*d*T2\n            const D = modP(Z1 * Z2); // D = Z1*Z2\n            const E = modP((X1 + Y1) * (X2 + Y2) - A - B); // E = (X1+Y1)*(X2+Y2)-A-B\n            const F = D - C; // F = D-C\n            const G = D + C; // G = D+C\n            const H = modP(B - a * A); // H = B-a*A\n            const X3 = modP(E * F); // X3 = E*F\n            const Y3 = modP(G * H); // Y3 = G*H\n            const T3 = modP(E * H); // T3 = E*H\n            const Z3 = modP(F * G); // Z3 = F*G\n            return new Point(X3, Y3, Z3, T3);\n        }\n        subtract(other) {\n            return this.add(other.negate());\n        }\n        wNAF(n) {\n            return wnaf.wNAFCached(this, n, Point.normalizeZ);\n        }\n        // Constant-time multiplication.\n        multiply(scalar) {\n            const n = scalar;\n            ut.aInRange('scalar', n, _1n, CURVE_ORDER); // 1 <= scalar < L\n            const { p, f } = this.wNAF(n);\n            return Point.normalizeZ([p, f])[0];\n        }\n        // Non-constant-time multiplication. Uses double-and-add algorithm.\n        // It's faster, but should only be used when you don't care about\n        // an exposed private key e.g. sig verification.\n        // Does NOT allow scalars higher than CURVE.n.\n        // Accepts optional accumulator to merge with multiply (important for sparse scalars)\n        multiplyUnsafe(scalar, acc = Point.ZERO) {\n            const n = scalar;\n            ut.aInRange('scalar', n, _0n, CURVE_ORDER); // 0 <= scalar < L\n            if (n === _0n)\n                return I;\n            if (this.is0() || n === _1n)\n                return this;\n            return wnaf.wNAFCachedUnsafe(this, n, Point.normalizeZ, acc);\n        }\n        // Checks if point is of small order.\n        // If you add something to small order point, you will have \"dirty\"\n        // point with torsion component.\n        // Multiplies point by cofactor and checks if the result is 0.\n        isSmallOrder() {\n            return this.multiplyUnsafe(cofactor).is0();\n        }\n        // Multiplies point by curve order and checks if the result is 0.\n        // Returns `false` is the point is dirty.\n        isTorsionFree() {\n            return wnaf.unsafeLadder(this, CURVE_ORDER).is0();\n        }\n        // Converts Extended point to default (x, y) coordinates.\n        // Can accept precomputed Z^-1 - for example, from invertBatch.\n        toAffine(iz) {\n            return toAffineMemo(this, iz);\n        }\n        clearCofactor() {\n            const { h: cofactor } = CURVE;\n            if (cofactor === _1n)\n                return this;\n            return this.multiplyUnsafe(cofactor);\n        }\n        // Converts hash string or Uint8Array to Point.\n        // Uses algo from RFC8032 5.1.3.\n        static fromHex(hex, zip215 = false) {\n            const { d, a } = CURVE;\n            const len = Fp.BYTES;\n            hex = ensureBytes('pointHex', hex, len); // copy hex to a new array\n            abool('zip215', zip215);\n            const normed = hex.slice(); // copy again, we'll manipulate it\n            const lastByte = hex[len - 1]; // select last byte\n            normed[len - 1] = lastByte & ~0x80; // clear last bit\n            const y = ut.bytesToNumberLE(normed);\n            // zip215=true is good for consensus-critical apps. =false follows RFC8032 / NIST186-5.\n            // RFC8032 prohibits >= p, but ZIP215 doesn't\n            // zip215=true:  0 <= y < MASK (2^256 for ed25519)\n            // zip215=false: 0 <= y < P (2^255-19 for ed25519)\n            const max = zip215 ? MASK : Fp.ORDER;\n            ut.aInRange('pointHex.y', y, _0n, max);\n            // Ed25519: x² = (y²-1)/(dy²+1) mod p. Ed448: x² = (y²-1)/(dy²-1) mod p. Generic case:\n            // ax²+y²=1+dx²y² => y²-1=dx²y²-ax² => y²-1=x²(dy²-a) => x²=(y²-1)/(dy²-a)\n            const y2 = modP(y * y); // denominator is always non-0 mod p.\n            const u = modP(y2 - _1n); // u = y² - 1\n            const v = modP(d * y2 - a); // v = d y² + 1.\n            let { isValid, value: x } = uvRatio(u, v); // √(u/v)\n            if (!isValid)\n                throw new Error('Point.fromHex: invalid y coordinate');\n            const isXOdd = (x & _1n) === _1n; // There are 2 square roots. Use x_0 bit to select proper\n            const isLastByteOdd = (lastByte & 0x80) !== 0; // x_0, last bit\n            if (!zip215 && x === _0n && isLastByteOdd)\n                // if x=0 and x_0 = 1, fail\n                throw new Error('Point.fromHex: x=0 and x_0=1');\n            if (isLastByteOdd !== isXOdd)\n                x = modP(-x); // if x_0 != x mod 2, set x = p-x\n            return Point.fromAffine({ x, y });\n        }\n        static fromPrivateKey(privKey) {\n            return getExtendedPublicKey(privKey).point;\n        }\n        toRawBytes() {\n            const { x, y } = this.toAffine();\n            const bytes = ut.numberToBytesLE(y, Fp.BYTES); // each y has 2 x values (x, -y)\n            bytes[bytes.length - 1] |= x & _1n ? 0x80 : 0; // when compressing, it's enough to store y\n            return bytes; // and use the last byte to encode sign of x\n        }\n        toHex() {\n            return ut.bytesToHex(this.toRawBytes()); // Same as toRawBytes, but returns string.\n        }\n    }\n    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, _1n, modP(CURVE.Gx * CURVE.Gy));\n    Point.ZERO = new Point(_0n, _1n, _1n, _0n); // 0, 1, 1, 0\n    const { BASE: G, ZERO: I } = Point;\n    const wnaf = wNAF(Point, nByteLength * 8);\n    function modN(a) {\n        return mod(a, CURVE_ORDER);\n    }\n    // Little-endian SHA512 with modulo n\n    function modN_LE(hash) {\n        return modN(ut.bytesToNumberLE(hash));\n    }\n    /** Convenience method that creates public key and other stuff. RFC8032 5.1.5 */\n    function getExtendedPublicKey(key) {\n        const len = Fp.BYTES;\n        key = ensureBytes('private key', key, len);\n        // Hash private key with curve's hash function to produce uniformingly random input\n        // Check byte lengths: ensure(64, h(ensure(32, key)))\n        const hashed = ensureBytes('hashed private key', cHash(key), 2 * len);\n        const head = adjustScalarBytes(hashed.slice(0, len)); // clear first half bits, produce FE\n        const prefix = hashed.slice(len, 2 * len); // second half is called key prefix (5.1.6)\n        const scalar = modN_LE(head); // The actual private scalar\n        const point = G.multiply(scalar); // Point on Edwards curve aka public key\n        const pointBytes = point.toRawBytes(); // Uint8Array representation\n        return { head, prefix, scalar, point, pointBytes };\n    }\n    // Calculates EdDSA pub key. RFC8032 5.1.5. Privkey is hashed. Use first half with 3 bits cleared\n    function getPublicKey(privKey) {\n        return getExtendedPublicKey(privKey).pointBytes;\n    }\n    // int('LE', SHA512(dom2(F, C) || msgs)) mod N\n    function hashDomainToScalar(context = new Uint8Array(), ...msgs) {\n        const msg = ut.concatBytes(...msgs);\n        return modN_LE(cHash(domain(msg, ensureBytes('context', context), !!prehash)));\n    }\n    /** Signs message with privateKey. RFC8032 5.1.6 */\n    function sign(msg, privKey, options = {}) {\n        msg = ensureBytes('message', msg);\n        if (prehash)\n            msg = prehash(msg); // for ed25519ph etc.\n        const { prefix, scalar, pointBytes } = getExtendedPublicKey(privKey);\n        const r = hashDomainToScalar(options.context, prefix, msg); // r = dom2(F, C) || prefix || PH(M)\n        const R = G.multiply(r).toRawBytes(); // R = rG\n        const k = hashDomainToScalar(options.context, R, pointBytes, msg); // R || A || PH(M)\n        const s = modN(r + k * scalar); // S = (r + k * s) mod L\n        ut.aInRange('signature.s', s, _0n, CURVE_ORDER); // 0 <= s < l\n        const res = ut.concatBytes(R, ut.numberToBytesLE(s, Fp.BYTES));\n        return ensureBytes('result', res, Fp.BYTES * 2); // 64-byte signature\n    }\n    const verifyOpts = VERIFY_DEFAULT;\n    /**\n     * Verifies EdDSA signature against message and public key. RFC8032 5.1.7.\n     * An extended group equation is checked.\n     */\n    function verify(sig, msg, publicKey, options = verifyOpts) {\n        const { context, zip215 } = options;\n        const len = Fp.BYTES; // Verifies EdDSA signature against message and public key. RFC8032 5.1.7.\n        sig = ensureBytes('signature', sig, 2 * len); // An extended group equation is checked.\n        msg = ensureBytes('message', msg);\n        publicKey = ensureBytes('publicKey', publicKey, len);\n        if (zip215 !== undefined)\n            abool('zip215', zip215);\n        if (prehash)\n            msg = prehash(msg); // for ed25519ph, etc\n        const s = ut.bytesToNumberLE(sig.slice(len, 2 * len));\n        let A, R, SB;\n        try {\n            // zip215=true is good for consensus-critical apps. =false follows RFC8032 / NIST186-5.\n            // zip215=true:  0 <= y < MASK (2^256 for ed25519)\n            // zip215=false: 0 <= y < P (2^255-19 for ed25519)\n            A = Point.fromHex(publicKey, zip215);\n            R = Point.fromHex(sig.slice(0, len), zip215);\n            SB = G.multiplyUnsafe(s); // 0 <= s < l is done inside\n        }\n        catch (error) {\n            return false;\n        }\n        if (!zip215 && A.isSmallOrder())\n            return false;\n        const k = hashDomainToScalar(context, R.toRawBytes(), A.toRawBytes(), msg);\n        const RkA = R.add(A.multiplyUnsafe(k));\n        // Extended group equation\n        // [8][S]B = [8]R + [8][k]A'\n        return RkA.subtract(SB).clearCofactor().equals(Point.ZERO);\n    }\n    G._setWindowSize(8); // Enable precomputes. Slows down first publicKey computation by 20ms.\n    const utils = {\n        getExtendedPublicKey,\n        // ed25519 private keys are uniform 32b. No need to check for modulo bias, like in secp256k1.\n        randomPrivateKey: () => randomBytes(Fp.BYTES),\n        /**\n         * We're doing scalar multiplication (used in getPublicKey etc) with precomputed BASE_POINT\n         * values. This slows down first getPublicKey() by milliseconds (see Speed section),\n         * but allows to speed-up subsequent getPublicKey() calls up to 20x.\n         * @param windowSize 2, 4, 8, 16\n         */\n        precompute(windowSize = 8, point = Point.BASE) {\n            point._setWindowSize(windowSize);\n            point.multiply(BigInt(3));\n            return point;\n        },\n    };\n    return {\n        CURVE,\n        getPublicKey,\n        sign,\n        verify,\n        ExtendedPoint: Point,\n        utils,\n    };\n}\n//# sourceMappingURL=edwards.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { mod, pow } from './modular.js';\nimport { aInRange, bytesToNumberLE, ensureBytes, numberToBytesLE, validateObject, } from './utils.js';\nconst _0n = BigInt(0);\nconst _1n = BigInt(1);\nfunction validateOpts(curve) {\n    validateObject(curve, {\n        a: 'bigint',\n    }, {\n        montgomeryBits: 'isSafeInteger',\n        nByteLength: 'isSafeInteger',\n        adjustScalarBytes: 'function',\n        domain: 'function',\n        powPminus2: 'function',\n        Gu: 'bigint',\n    });\n    // Set defaults\n    return Object.freeze({ ...curve });\n}\n// NOTE: not really montgomery curve, just bunch of very specific methods for X25519/X448 (RFC 7748, https://www.rfc-editor.org/rfc/rfc7748)\n// Uses only one coordinate instead of two\nexport function montgomery(curveDef) {\n    const CURVE = validateOpts(curveDef);\n    const { P } = CURVE;\n    const modP = (n) => mod(n, P);\n    const montgomeryBits = CURVE.montgomeryBits;\n    const montgomeryBytes = Math.ceil(montgomeryBits / 8);\n    const fieldLen = CURVE.nByteLength;\n    const adjustScalarBytes = CURVE.adjustScalarBytes || ((bytes) => bytes);\n    const powPminus2 = CURVE.powPminus2 || ((x) => pow(x, P - BigInt(2), P));\n    // cswap from RFC7748. But it is not from RFC7748!\n    /*\n      cswap(swap, x_2, x_3):\n           dummy = mask(swap) AND (x_2 XOR x_3)\n           x_2 = x_2 XOR dummy\n           x_3 = x_3 XOR dummy\n           Return (x_2, x_3)\n    Where mask(swap) is the all-1 or all-0 word of the same length as x_2\n     and x_3, computed, e.g., as mask(swap) = 0 - swap.\n    */\n    function cswap(swap, x_2, x_3) {\n        const dummy = modP(swap * (x_2 - x_3));\n        x_2 = modP(x_2 - dummy);\n        x_3 = modP(x_3 + dummy);\n        return [x_2, x_3];\n    }\n    // x25519 from 4\n    // The constant a24 is (486662 - 2) / 4 = 121665 for curve25519/X25519\n    const a24 = (CURVE.a - BigInt(2)) / BigInt(4);\n    /**\n     *\n     * @param pointU u coordinate (x) on Montgomery Curve 25519\n     * @param scalar by which the point would be multiplied\n     * @returns new Point on Montgomery curve\n     */\n    function montgomeryLadder(u, scalar) {\n        aInRange('u', u, _0n, P);\n        aInRange('scalar', scalar, _0n, P);\n        // Section 5: Implementations MUST accept non-canonical values and process them as\n        // if they had been reduced modulo the field prime.\n        const k = scalar;\n        const x_1 = u;\n        let x_2 = _1n;\n        let z_2 = _0n;\n        let x_3 = u;\n        let z_3 = _1n;\n        let swap = _0n;\n        let sw;\n        for (let t = BigInt(montgomeryBits - 1); t >= _0n; t--) {\n            const k_t = (k >> t) & _1n;\n            swap ^= k_t;\n            sw = cswap(swap, x_2, x_3);\n            x_2 = sw[0];\n            x_3 = sw[1];\n            sw = cswap(swap, z_2, z_3);\n            z_2 = sw[0];\n            z_3 = sw[1];\n            swap = k_t;\n            const A = x_2 + z_2;\n            const AA = modP(A * A);\n            const B = x_2 - z_2;\n            const BB = modP(B * B);\n            const E = AA - BB;\n            const C = x_3 + z_3;\n            const D = x_3 - z_3;\n            const DA = modP(D * A);\n            const CB = modP(C * B);\n            const dacb = DA + CB;\n            const da_cb = DA - CB;\n            x_3 = modP(dacb * dacb);\n            z_3 = modP(x_1 * modP(da_cb * da_cb));\n            x_2 = modP(AA * BB);\n            z_2 = modP(E * (AA + modP(a24 * E)));\n        }\n        // (x_2, x_3) = cswap(swap, x_2, x_3)\n        sw = cswap(swap, x_2, x_3);\n        x_2 = sw[0];\n        x_3 = sw[1];\n        // (z_2, z_3) = cswap(swap, z_2, z_3)\n        sw = cswap(swap, z_2, z_3);\n        z_2 = sw[0];\n        z_3 = sw[1];\n        // z_2^(p - 2)\n        const z2 = powPminus2(z_2);\n        // Return x_2 * (z_2^(p - 2))\n        return modP(x_2 * z2);\n    }\n    function encodeUCoordinate(u) {\n        return numberToBytesLE(modP(u), montgomeryBytes);\n    }\n    function decodeUCoordinate(uEnc) {\n        // Section 5: When receiving such an array, implementations of X25519\n        // MUST mask the most significant bit in the final byte.\n        const u = ensureBytes('u coordinate', uEnc, montgomeryBytes);\n        if (fieldLen === 32)\n            u[31] &= 127; // 0b0111_1111\n        return bytesToNumberLE(u);\n    }\n    function decodeScalar(n) {\n        const bytes = ensureBytes('scalar', n);\n        const len = bytes.length;\n        if (len !== montgomeryBytes && len !== fieldLen) {\n            let valid = '' + montgomeryBytes + ' or ' + fieldLen;\n            throw new Error('invalid scalar, expected ' + valid + ' bytes, got ' + len);\n        }\n        return bytesToNumberLE(adjustScalarBytes(bytes));\n    }\n    function scalarMult(scalar, u) {\n        const pointU = decodeUCoordinate(u);\n        const _scalar = decodeScalar(scalar);\n        const pu = montgomeryLadder(pointU, _scalar);\n        // The result was not contributory\n        // https://cr.yp.to/ecdh.html#validate\n        if (pu === _0n)\n            throw new Error('invalid private or public key received');\n        return encodeUCoordinate(pu);\n    }\n    // Computes public key from private. By doing scalar multiplication of base point.\n    const GuBytes = encodeUCoordinate(CURVE.Gu);\n    function scalarMultBase(scalar) {\n        return scalarMult(scalar, GuBytes);\n    }\n    return {\n        scalarMult,\n        scalarMultBase,\n        getSharedSecret: (privateKey, publicKey) => scalarMult(privateKey, publicKey),\n        getPublicKey: (privateKey) => scalarMultBase(privateKey),\n        utils: { randomPrivateKey: () => CURVE.randomBytes(CURVE.nByteLength) },\n        GuBytes: GuBytes,\n    };\n}\n//# sourceMappingURL=montgomery.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { shake256 } from '@noble/hashes/sha3';\nimport { concatBytes, randomBytes, utf8ToBytes, wrapConstructor } from '@noble/hashes/utils';\nimport { twistedEdwards } from './abstract/edwards.js';\nimport { createHasher, expand_message_xof } from './abstract/hash-to-curve.js';\nimport { Field, isNegativeLE, mod, pow2 } from './abstract/modular.js';\nimport { montgomery } from './abstract/montgomery.js';\nimport { bytesToHex, bytesToNumberLE, ensureBytes, equalBytes, numberToBytesLE, } from './abstract/utils.js';\n/**\n * Edwards448 (not Ed448-Goldilocks) curve with following addons:\n * - X448 ECDH\n * - Decaf cofactor elimination\n * - Elligator hash-to-group / point indistinguishability\n * Conforms to RFC 8032 https://www.rfc-editor.org/rfc/rfc8032.html#section-5.2\n */\nconst shake256_114 = wrapConstructor(() => shake256.create({ dkLen: 114 }));\nconst shake256_64 = wrapConstructor(() => shake256.create({ dkLen: 64 }));\nconst ed448P = BigInt('726838724295606890549323807888004534353641360687318060281490199180612328166730772686396383698676545930088884461843637361053498018365439');\n// prettier-ignore\nconst _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4), _11n = BigInt(11);\n// prettier-ignore\nconst _22n = BigInt(22), _44n = BigInt(44), _88n = BigInt(88), _223n = BigInt(223);\n// powPminus3div4 calculates z = x^k mod p, where k = (p-3)/4.\n// Used for efficient square root calculation.\n// ((P-3)/4).toString(2) would produce bits [223x 1, 0, 222x 1]\nfunction ed448_pow_Pminus3div4(x) {\n    const P = ed448P;\n    const b2 = (x * x * x) % P;\n    const b3 = (b2 * b2 * x) % P;\n    const b6 = (pow2(b3, _3n, P) * b3) % P;\n    const b9 = (pow2(b6, _3n, P) * b3) % P;\n    const b11 = (pow2(b9, _2n, P) * b2) % P;\n    const b22 = (pow2(b11, _11n, P) * b11) % P;\n    const b44 = (pow2(b22, _22n, P) * b22) % P;\n    const b88 = (pow2(b44, _44n, P) * b44) % P;\n    const b176 = (pow2(b88, _88n, P) * b88) % P;\n    const b220 = (pow2(b176, _44n, P) * b44) % P;\n    const b222 = (pow2(b220, _2n, P) * b2) % P;\n    const b223 = (pow2(b222, _1n, P) * x) % P;\n    return (pow2(b223, _223n, P) * b222) % P;\n}\nfunction adjustScalarBytes(bytes) {\n    // Section 5: Likewise, for X448, set the two least significant bits of the first byte to 0, and the most\n    // significant bit of the last byte to 1.\n    bytes[0] &= 252; // 0b11111100\n    // and the most significant bit of the last byte to 1.\n    bytes[55] |= 128; // 0b10000000\n    // NOTE: is is NOOP for 56 bytes scalars (X25519/X448)\n    bytes[56] = 0; // Byte outside of group (456 buts vs 448 bits)\n    return bytes;\n}\n// Constant-time ratio of u to v. Allows to combine inversion and square root u/√v.\n// Uses algo from RFC8032 5.1.3.\nfunction uvRatio(u, v) {\n    const P = ed448P;\n    // https://www.rfc-editor.org/rfc/rfc8032#section-5.2.3\n    // To compute the square root of (u/v), the first step is to compute the\n    //   candidate root x = (u/v)^((p+1)/4).  This can be done using the\n    // following trick, to use a single modular powering for both the\n    // inversion of v and the square root:\n    // x = (u/v)^((p+1)/4)   = u³v(u⁵v³)^((p-3)/4)   (mod p)\n    const u2v = mod(u * u * v, P); // u²v\n    const u3v = mod(u2v * u, P); // u³v\n    const u5v3 = mod(u3v * u2v * v, P); // u⁵v³\n    const root = ed448_pow_Pminus3div4(u5v3);\n    const x = mod(u3v * root, P);\n    // Verify that root is exists\n    const x2 = mod(x * x, P); // x²\n    // If vx² = u, the recovered x-coordinate is x.  Otherwise, no\n    // square root exists, and the decoding fails.\n    return { isValid: mod(x2 * v, P) === u, value: x };\n}\nconst Fp = Field(ed448P, 456, true);\nconst ED448_DEF = {\n    // Param: a\n    a: BigInt(1),\n    // -39081. Negative number is P - number\n    d: BigInt('726838724295606890549323807888004534353641360687318060281490199180612328166730772686396383698676545930088884461843637361053498018326358'),\n    // Finite field 𝔽p over which we'll do calculations; 2n**448n - 2n**224n - 1n\n    Fp,\n    // Subgroup order: how many points curve has;\n    // 2n**446n - 13818066809895115352007386748515426880336692474882178609894547503885n\n    n: BigInt('181709681073901722637330951972001133588410340171829515070372549795146003961539585716195755291692375963310293709091662304773755859649779'),\n    // RFC 7748 has 56-byte keys, RFC 8032 has 57-byte keys\n    nBitLength: 456,\n    // Cofactor\n    h: BigInt(4),\n    // Base point (x, y) aka generator point\n    Gx: BigInt('224580040295924300187604334099896036246789641632564134246125461686950415467406032909029192869357953282578032075146446173674602635247710'),\n    Gy: BigInt('298819210078481492676017930443930673437544040154080242095928241372331506189835876003536878655418784733982303233503462500531545062832660'),\n    // SHAKE256(dom4(phflag,context)||x, 114)\n    hash: shake256_114,\n    randomBytes,\n    adjustScalarBytes,\n    // dom4\n    domain: (data, ctx, phflag) => {\n        if (ctx.length > 255)\n            throw new Error('context must be smaller than 255, got: ' + ctx.length);\n        return concatBytes(utf8ToBytes('SigEd448'), new Uint8Array([phflag ? 1 : 0, ctx.length]), ctx, data);\n    },\n    uvRatio,\n};\nexport const ed448 = /* @__PURE__ */ twistedEdwards(ED448_DEF);\n// NOTE: there is no ed448ctx, since ed448 supports ctx by default\nexport const ed448ph = /* @__PURE__ */ twistedEdwards({ ...ED448_DEF, prehash: shake256_64 });\nexport const x448 = /* @__PURE__ */ (() => montgomery({\n    a: BigInt(156326),\n    // RFC 7748 has 56-byte keys, RFC 8032 has 57-byte keys\n    montgomeryBits: 448,\n    nByteLength: 56,\n    P: ed448P,\n    Gu: BigInt(5),\n    powPminus2: (x) => {\n        const P = ed448P;\n        const Pminus3div4 = ed448_pow_Pminus3div4(x);\n        const Pminus3 = pow2(Pminus3div4, BigInt(2), P);\n        return mod(Pminus3 * x, P); // Pminus3 * x = Pminus2\n    },\n    adjustScalarBytes,\n    randomBytes,\n}))();\n/**\n * Converts edwards448 public key to x448 public key. Uses formula:\n * * `(u, v) = ((y-1)/(y+1), sqrt(156324)*u/x)`\n * * `(x, y) = (sqrt(156324)*u/v, (1+u)/(1-u))`\n * @example\n *   const aPub = ed448.getPublicKey(utils.randomPrivateKey());\n *   x448.getSharedSecret(edwardsToMontgomery(aPub), edwardsToMontgomery(someonesPub))\n */\nexport function edwardsToMontgomeryPub(edwardsPub) {\n    const { y } = ed448.ExtendedPoint.fromHex(edwardsPub);\n    const _1n = BigInt(1);\n    return Fp.toBytes(Fp.create((y - _1n) * Fp.inv(y + _1n)));\n}\nexport const edwardsToMontgomery = edwardsToMontgomeryPub; // deprecated\n// TODO: add edwardsToMontgomeryPriv, similar to ed25519 version\n// Hash To Curve Elligator2 Map\nconst ELL2_C1 = (Fp.ORDER - BigInt(3)) / BigInt(4); // 1. c1 = (q - 3) / 4         # Integer arithmetic\nconst ELL2_J = BigInt(156326);\nfunction map_to_curve_elligator2_curve448(u) {\n    let tv1 = Fp.sqr(u); // 1.  tv1 = u^2\n    let e1 = Fp.eql(tv1, Fp.ONE); // 2.   e1 = tv1 == 1\n    tv1 = Fp.cmov(tv1, Fp.ZERO, e1); // 3.  tv1 = CMOV(tv1, 0, e1)  # If Z * u^2 == -1, set tv1 = 0\n    let xd = Fp.sub(Fp.ONE, tv1); // 4.   xd = 1 - tv1\n    let x1n = Fp.neg(ELL2_J); // 5.  x1n = -J\n    let tv2 = Fp.sqr(xd); // 6.  tv2 = xd^2\n    let gxd = Fp.mul(tv2, xd); // 7.  gxd = tv2 * xd          # gxd = xd^3\n    let gx1 = Fp.mul(tv1, Fp.neg(ELL2_J)); // 8.  gx1 = -J * tv1          # x1n + J * xd\n    gx1 = Fp.mul(gx1, x1n); // 9.  gx1 = gx1 * x1n         # x1n^2 + J * x1n * xd\n    gx1 = Fp.add(gx1, tv2); // 10. gx1 = gx1 + tv2         # x1n^2 + J * x1n * xd + xd^2\n    gx1 = Fp.mul(gx1, x1n); // 11. gx1 = gx1 * x1n         # x1n^3 + J * x1n^2 * xd + x1n * xd^2\n    let tv3 = Fp.sqr(gxd); // 12. tv3 = gxd^2\n    tv2 = Fp.mul(gx1, gxd); // 13. tv2 = gx1 * gxd         # gx1 * gxd\n    tv3 = Fp.mul(tv3, tv2); // 14. tv3 = tv3 * tv2         # gx1 * gxd^3\n    let y1 = Fp.pow(tv3, ELL2_C1); // 15.  y1 = tv3^c1            # (gx1 * gxd^3)^((p - 3) / 4)\n    y1 = Fp.mul(y1, tv2); // 16.  y1 = y1 * tv2          # gx1 * gxd * (gx1 * gxd^3)^((p - 3) / 4)\n    let x2n = Fp.mul(x1n, Fp.neg(tv1)); // 17. x2n = -tv1 * x1n        # x2 = x2n / xd = -1 * u^2 * x1n / xd\n    let y2 = Fp.mul(y1, u); // 18.  y2 = y1 * u\n    y2 = Fp.cmov(y2, Fp.ZERO, e1); // 19.  y2 = CMOV(y2, 0, e1)\n    tv2 = Fp.sqr(y1); // 20. tv2 = y1^2\n    tv2 = Fp.mul(tv2, gxd); // 21. tv2 = tv2 * gxd\n    let e2 = Fp.eql(tv2, gx1); // 22.  e2 = tv2 == gx1\n    let xn = Fp.cmov(x2n, x1n, e2); // 23.  xn = CMOV(x2n, x1n, e2)  # If e2, x = x1, else x = x2\n    let y = Fp.cmov(y2, y1, e2); // 24.   y = CMOV(y2, y1, e2)    # If e2, y = y1, else y = y2\n    let e3 = Fp.isOdd(y); // 25.  e3 = sgn0(y) == 1        # Fix sign of y\n    y = Fp.cmov(y, Fp.neg(y), e2 !== e3); // 26.   y = CMOV(y, -y, e2 XOR e3)\n    return { xn, xd, yn: y, yd: Fp.ONE }; // 27. return (xn, xd, y, 1)\n}\nfunction map_to_curve_elligator2_edwards448(u) {\n    let { xn, xd, yn, yd } = map_to_curve_elligator2_curve448(u); // 1. (xn, xd, yn, yd) = map_to_curve_elligator2_curve448(u)\n    let xn2 = Fp.sqr(xn); // 2.  xn2 = xn^2\n    let xd2 = Fp.sqr(xd); // 3.  xd2 = xd^2\n    let xd4 = Fp.sqr(xd2); // 4.  xd4 = xd2^2\n    let yn2 = Fp.sqr(yn); // 5.  yn2 = yn^2\n    let yd2 = Fp.sqr(yd); // 6.  yd2 = yd^2\n    let xEn = Fp.sub(xn2, xd2); // 7.  xEn = xn2 - xd2\n    let tv2 = Fp.sub(xEn, xd2); // 8.  tv2 = xEn - xd2\n    xEn = Fp.mul(xEn, xd2); // 9.  xEn = xEn * xd2\n    xEn = Fp.mul(xEn, yd); // 10. xEn = xEn * yd\n    xEn = Fp.mul(xEn, yn); // 11. xEn = xEn * yn\n    xEn = Fp.mul(xEn, _4n); // 12. xEn = xEn * 4\n    tv2 = Fp.mul(tv2, xn2); // 13. tv2 = tv2 * xn2\n    tv2 = Fp.mul(tv2, yd2); // 14. tv2 = tv2 * yd2\n    let tv3 = Fp.mul(yn2, _4n); // 15. tv3 = 4 * yn2\n    let tv1 = Fp.add(tv3, yd2); // 16. tv1 = tv3 + yd2\n    tv1 = Fp.mul(tv1, xd4); // 17. tv1 = tv1 * xd4\n    let xEd = Fp.add(tv1, tv2); // 18. xEd = tv1 + tv2\n    tv2 = Fp.mul(tv2, xn); // 19. tv2 = tv2 * xn\n    let tv4 = Fp.mul(xn, xd4); // 20. tv4 = xn * xd4\n    let yEn = Fp.sub(tv3, yd2); // 21. yEn = tv3 - yd2\n    yEn = Fp.mul(yEn, tv4); // 22. yEn = yEn * tv4\n    yEn = Fp.sub(yEn, tv2); // 23. yEn = yEn - tv2\n    tv1 = Fp.add(xn2, xd2); // 24. tv1 = xn2 + xd2\n    tv1 = Fp.mul(tv1, xd2); // 25. tv1 = tv1 * xd2\n    tv1 = Fp.mul(tv1, xd); // 26. tv1 = tv1 * xd\n    tv1 = Fp.mul(tv1, yn2); // 27. tv1 = tv1 * yn2\n    tv1 = Fp.mul(tv1, BigInt(-2)); // 28. tv1 = -2 * tv1\n    let yEd = Fp.add(tv2, tv1); // 29. yEd = tv2 + tv1\n    tv4 = Fp.mul(tv4, yd2); // 30. tv4 = tv4 * yd2\n    yEd = Fp.add(yEd, tv4); // 31. yEd = yEd + tv4\n    tv1 = Fp.mul(xEd, yEd); // 32. tv1 = xEd * yEd\n    let e = Fp.eql(tv1, Fp.ZERO); // 33.   e = tv1 == 0\n    xEn = Fp.cmov(xEn, Fp.ZERO, e); // 34. xEn = CMOV(xEn, 0, e)\n    xEd = Fp.cmov(xEd, Fp.ONE, e); // 35. xEd = CMOV(xEd, 1, e)\n    yEn = Fp.cmov(yEn, Fp.ONE, e); // 36. yEn = CMOV(yEn, 1, e)\n    yEd = Fp.cmov(yEd, Fp.ONE, e); // 37. yEd = CMOV(yEd, 1, e)\n    const inv = Fp.invertBatch([xEd, yEd]); // batch division\n    return { x: Fp.mul(xEn, inv[0]), y: Fp.mul(yEn, inv[1]) }; // 38. return (xEn, xEd, yEn, yEd)\n}\nconst htf = /* @__PURE__ */ (() => createHasher(ed448.ExtendedPoint, (scalars) => map_to_curve_elligator2_edwards448(scalars[0]), {\n    DST: 'edwards448_XOF:SHAKE256_ELL2_RO_',\n    encodeDST: 'edwards448_XOF:SHAKE256_ELL2_NU_',\n    p: Fp.ORDER,\n    m: 1,\n    k: 224,\n    expand: 'xof',\n    hash: shake256,\n}))();\nexport const hashToCurve = /* @__PURE__ */ (() => htf.hashToCurve)();\nexport const encodeToCurve = /* @__PURE__ */ (() => htf.encodeToCurve)();\nfunction assertDcfPoint(other) {\n    if (!(other instanceof DcfPoint))\n        throw new Error('DecafPoint expected');\n}\n// 1-d\nconst ONE_MINUS_D = BigInt('39082');\n// 1-2d\nconst ONE_MINUS_TWO_D = BigInt('78163');\n// √(-d)\nconst SQRT_MINUS_D = BigInt('98944233647732219769177004876929019128417576295529901074099889598043702116001257856802131563896515373927712232092845883226922417596214');\n// 1 / √(-d)\nconst INVSQRT_MINUS_D = BigInt('315019913931389607337177038330951043522456072897266928557328499619017160722351061360252776265186336876723201881398623946864393857820716');\n// Calculates 1/√(number)\nconst invertSqrt = (number) => uvRatio(_1n, number);\nconst MAX_448B = BigInt('0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff');\nconst bytes448ToNumberLE = (bytes) => ed448.CURVE.Fp.create(bytesToNumberLE(bytes) & MAX_448B);\n// Computes Elligator map for Decaf\n// https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-ristretto255-decaf448-07#name-element-derivation-2\nfunction calcElligatorDecafMap(r0) {\n    const { d } = ed448.CURVE;\n    const P = ed448.CURVE.Fp.ORDER;\n    const mod = ed448.CURVE.Fp.create;\n    const r = mod(-(r0 * r0)); // 1\n    const u0 = mod(d * (r - _1n)); // 2\n    const u1 = mod((u0 + _1n) * (u0 - r)); // 3\n    const { isValid: was_square, value: v } = uvRatio(ONE_MINUS_TWO_D, mod((r + _1n) * u1)); // 4\n    let v_prime = v; // 5\n    if (!was_square)\n        v_prime = mod(r0 * v);\n    let sgn = _1n; // 6\n    if (!was_square)\n        sgn = mod(-_1n);\n    const s = mod(v_prime * (r + _1n)); // 7\n    let s_abs = s;\n    if (isNegativeLE(s, P))\n        s_abs = mod(-s);\n    const s2 = s * s;\n    const W0 = mod(s_abs * _2n); // 8\n    const W1 = mod(s2 + _1n); // 9\n    const W2 = mod(s2 - _1n); // 10\n    const W3 = mod(v_prime * s * (r - _1n) * ONE_MINUS_TWO_D + sgn); // 11\n    return new ed448.ExtendedPoint(mod(W0 * W3), mod(W2 * W1), mod(W1 * W3), mod(W0 * W2));\n}\n/**\n * Each ed448/ExtendedPoint has 4 different equivalent points. This can be\n * a source of bugs for protocols like ring signatures. Decaf was created to solve this.\n * Decaf point operates in X:Y:Z:T extended coordinates like ExtendedPoint,\n * but it should work in its own namespace: do not combine those two.\n * https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-ristretto255-decaf448\n */\nclass DcfPoint {\n    // Private property to discourage combining ExtendedPoint + DecafPoint\n    // Always use Decaf encoding/decoding instead.\n    constructor(ep) {\n        this.ep = ep;\n    }\n    static fromAffine(ap) {\n        return new DcfPoint(ed448.ExtendedPoint.fromAffine(ap));\n    }\n    /**\n     * Takes uniform output of 112-byte hash function like shake256 and converts it to `DecafPoint`.\n     * The hash-to-group operation applies Elligator twice and adds the results.\n     * **Note:** this is one-way map, there is no conversion from point to hash.\n     * https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-ristretto255-decaf448-07#name-element-derivation-2\n     * @param hex 112-byte output of a hash function\n     */\n    static hashToCurve(hex) {\n        hex = ensureBytes('decafHash', hex, 112);\n        const r1 = bytes448ToNumberLE(hex.slice(0, 56));\n        const R1 = calcElligatorDecafMap(r1);\n        const r2 = bytes448ToNumberLE(hex.slice(56, 112));\n        const R2 = calcElligatorDecafMap(r2);\n        return new DcfPoint(R1.add(R2));\n    }\n    /**\n     * Converts decaf-encoded string to decaf point.\n     * https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-ristretto255-decaf448-07#name-decode-2\n     * @param hex Decaf-encoded 56 bytes. Not every 56-byte string is valid decaf encoding\n     */\n    static fromHex(hex) {\n        hex = ensureBytes('decafHex', hex, 56);\n        const { d } = ed448.CURVE;\n        const P = ed448.CURVE.Fp.ORDER;\n        const mod = ed448.CURVE.Fp.create;\n        const emsg = 'DecafPoint.fromHex: the hex is not valid encoding of DecafPoint';\n        const s = bytes448ToNumberLE(hex);\n        // 1. Check that s_bytes is the canonical encoding of a field element, or else abort.\n        // 2. Check that s is non-negative, or else abort\n        if (!equalBytes(numberToBytesLE(s, 56), hex) || isNegativeLE(s, P))\n            throw new Error(emsg);\n        const s2 = mod(s * s); // 1\n        const u1 = mod(_1n + s2); // 2\n        const u1sq = mod(u1 * u1);\n        const u2 = mod(u1sq - _4n * d * s2); // 3\n        const { isValid, value: invsqrt } = invertSqrt(mod(u2 * u1sq)); // 4\n        let u3 = mod((s + s) * invsqrt * u1 * SQRT_MINUS_D); // 5\n        if (isNegativeLE(u3, P))\n            u3 = mod(-u3);\n        const x = mod(u3 * invsqrt * u2 * INVSQRT_MINUS_D); // 6\n        const y = mod((_1n - s2) * invsqrt * u1); // 7\n        const t = mod(x * y); // 8\n        if (!isValid)\n            throw new Error(emsg);\n        return new DcfPoint(new ed448.ExtendedPoint(x, y, _1n, t));\n    }\n    /**\n     * Encodes decaf point to Uint8Array.\n     * https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-ristretto255-decaf448-07#name-encode-2\n     */\n    toRawBytes() {\n        let { ex: x, ey: _y, ez: z, et: t } = this.ep;\n        const P = ed448.CURVE.Fp.ORDER;\n        const mod = ed448.CURVE.Fp.create;\n        const u1 = mod(mod(x + t) * mod(x - t)); // 1\n        const x2 = mod(x * x);\n        const { value: invsqrt } = invertSqrt(mod(u1 * ONE_MINUS_D * x2)); // 2\n        let ratio = mod(invsqrt * u1 * SQRT_MINUS_D); // 3\n        if (isNegativeLE(ratio, P))\n            ratio = mod(-ratio);\n        const u2 = mod(INVSQRT_MINUS_D * ratio * z - t); // 4\n        let s = mod(ONE_MINUS_D * invsqrt * x * u2); // 5\n        if (isNegativeLE(s, P))\n            s = mod(-s);\n        return numberToBytesLE(s, 56);\n    }\n    toHex() {\n        return bytesToHex(this.toRawBytes());\n    }\n    toString() {\n        return this.toHex();\n    }\n    // Compare one point to another.\n    // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-ristretto255-decaf448-07#name-equals-2\n    equals(other) {\n        assertDcfPoint(other);\n        const { ex: X1, ey: Y1 } = this.ep;\n        const { ex: X2, ey: Y2 } = other.ep;\n        const mod = ed448.CURVE.Fp.create;\n        // (x1 * y2 == y1 * x2)\n        return mod(X1 * Y2) === mod(Y1 * X2);\n    }\n    add(other) {\n        assertDcfPoint(other);\n        return new DcfPoint(this.ep.add(other.ep));\n    }\n    subtract(other) {\n        assertDcfPoint(other);\n        return new DcfPoint(this.ep.subtract(other.ep));\n    }\n    multiply(scalar) {\n        return new DcfPoint(this.ep.multiply(scalar));\n    }\n    multiplyUnsafe(scalar) {\n        return new DcfPoint(this.ep.multiplyUnsafe(scalar));\n    }\n    double() {\n        return new DcfPoint(this.ep.double());\n    }\n    negate() {\n        return new DcfPoint(this.ep.negate());\n    }\n}\nexport const DecafPoint = /* @__PURE__ */ (() => {\n    // decaf448 base point is ed448 base x 2\n    // https://github.com/dalek-cryptography/curve25519-dalek/blob/59837c6ecff02b77b9d5ff84dbc239d0cf33ef90/vendor/ristretto.sage#L699\n    if (!DcfPoint.BASE)\n        DcfPoint.BASE = new DcfPoint(ed448.ExtendedPoint.BASE).multiply(_2n);\n    if (!DcfPoint.ZERO)\n        DcfPoint.ZERO = new DcfPoint(ed448.ExtendedPoint.ZERO);\n    return DcfPoint;\n})();\n// Hashing to decaf448. https://www.rfc-editor.org/rfc/rfc9380#appendix-C\nexport const hashToDecaf448 = (msg, options) => {\n    const d = options.DST;\n    const DST = typeof d === 'string' ? utf8ToBytes(d) : d;\n    const uniform_bytes = expand_message_xof(msg, DST, 112, 224, shake256);\n    const P = DcfPoint.hashToCurve(uniform_bytes);\n    return P;\n};\nexport const hash_to_decaf448 = hashToDecaf448; // legacy\n//# sourceMappingURL=ed448.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha256 } from '@noble/hashes/sha256';\nimport { randomBytes } from '@noble/hashes/utils';\nimport { createCurve } from './_shortw_utils.js';\nimport { createHasher, isogenyMap } from './abstract/hash-to-curve.js';\nimport { Field, mod, pow2 } from './abstract/modular.js';\nimport { inRange, aInRange, bytesToNumberBE, concatBytes, ensureBytes, numberToBytesBE, } from './abstract/utils.js';\nimport { mapToCurveSimpleSWU } from './abstract/weierstrass.js';\nconst secp256k1P = BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f');\nconst secp256k1N = BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141');\nconst _1n = BigInt(1);\nconst _2n = BigInt(2);\nconst divNearest = (a, b) => (a + b / _2n) / b;\n/**\n * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.\n * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]\n */\nfunction sqrtMod(y) {\n    const P = secp256k1P;\n    // prettier-ignore\n    const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);\n    // prettier-ignore\n    const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);\n    const b2 = (y * y * y) % P; // x^3, 11\n    const b3 = (b2 * b2 * y) % P; // x^7\n    const b6 = (pow2(b3, _3n, P) * b3) % P;\n    const b9 = (pow2(b6, _3n, P) * b3) % P;\n    const b11 = (pow2(b9, _2n, P) * b2) % P;\n    const b22 = (pow2(b11, _11n, P) * b11) % P;\n    const b44 = (pow2(b22, _22n, P) * b22) % P;\n    const b88 = (pow2(b44, _44n, P) * b44) % P;\n    const b176 = (pow2(b88, _88n, P) * b88) % P;\n    const b220 = (pow2(b176, _44n, P) * b44) % P;\n    const b223 = (pow2(b220, _3n, P) * b3) % P;\n    const t1 = (pow2(b223, _23n, P) * b22) % P;\n    const t2 = (pow2(t1, _6n, P) * b2) % P;\n    const root = pow2(t2, _2n, P);\n    if (!Fpk1.eql(Fpk1.sqr(root), y))\n        throw new Error('Cannot find square root');\n    return root;\n}\nconst Fpk1 = Field(secp256k1P, undefined, undefined, { sqrt: sqrtMod });\n/**\n * secp256k1 short weierstrass curve and ECDSA signatures over it.\n */\nexport const secp256k1 = createCurve({\n    a: BigInt(0), // equation params: a, b\n    b: BigInt(7), // Seem to be rigid: bitcointalk.org/index.php?topic=289795.msg3183975#msg3183975\n    Fp: Fpk1, // Field's prime: 2n**256n - 2n**32n - 2n**9n - 2n**8n - 2n**7n - 2n**6n - 2n**4n - 1n\n    n: secp256k1N, // Curve order, total count of valid points in the field\n    // Base point (x, y) aka generator point\n    Gx: BigInt('55066263022277343669578718895168534326250603453777594175500187360389116729240'),\n    Gy: BigInt('32670510020758816978083085130507043184471273380659243275938904335757337482424'),\n    h: BigInt(1), // Cofactor\n    lowS: true, // Allow only low-S signatures by default in sign() and verify()\n    /**\n     * secp256k1 belongs to Koblitz curves: it has efficiently computable endomorphism.\n     * Endomorphism uses 2x less RAM, speeds up precomputation by 2x and ECDH / key recovery by 20%.\n     * For precomputed wNAF it trades off 1/2 init time & 1/3 ram for 20% perf hit.\n     * Explanation: https://gist.github.com/paulmillr/eb670806793e84df628a7c434a873066\n     */\n    endo: {\n        beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),\n        splitScalar: (k) => {\n            const n = secp256k1N;\n            const a1 = BigInt('0x3086d221a7d46bcde86c90e49284eb15');\n            const b1 = -_1n * BigInt('0xe4437ed6010e88286f547fa90abfe4c3');\n            const a2 = BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8');\n            const b2 = a1;\n            const POW_2_128 = BigInt('0x100000000000000000000000000000000'); // (2n**128n).toString(16)\n            const c1 = divNearest(b2 * k, n);\n            const c2 = divNearest(-b1 * k, n);\n            let k1 = mod(k - c1 * a1 - c2 * a2, n);\n            let k2 = mod(-c1 * b1 - c2 * b2, n);\n            const k1neg = k1 > POW_2_128;\n            const k2neg = k2 > POW_2_128;\n            if (k1neg)\n                k1 = n - k1;\n            if (k2neg)\n                k2 = n - k2;\n            if (k1 > POW_2_128 || k2 > POW_2_128) {\n                throw new Error('splitScalar: Endomorphism failed, k=' + k);\n            }\n            return { k1neg, k1, k2neg, k2 };\n        },\n    },\n}, sha256);\n// Schnorr signatures are superior to ECDSA from above. Below is Schnorr-specific BIP0340 code.\n// https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\nconst _0n = BigInt(0);\n/** An object mapping tags to their tagged hash prefix of [SHA256(tag) | SHA256(tag)] */\nconst TAGGED_HASH_PREFIXES = {};\nfunction taggedHash(tag, ...messages) {\n    let tagP = TAGGED_HASH_PREFIXES[tag];\n    if (tagP === undefined) {\n        const tagH = sha256(Uint8Array.from(tag, (c) => c.charCodeAt(0)));\n        tagP = concatBytes(tagH, tagH);\n        TAGGED_HASH_PREFIXES[tag] = tagP;\n    }\n    return sha256(concatBytes(tagP, ...messages));\n}\n// ECDSA compact points are 33-byte. Schnorr is 32: we strip first byte 0x02 or 0x03\nconst pointToBytes = (point) => point.toRawBytes(true).slice(1);\nconst numTo32b = (n) => numberToBytesBE(n, 32);\nconst modP = (x) => mod(x, secp256k1P);\nconst modN = (x) => mod(x, secp256k1N);\nconst Point = secp256k1.ProjectivePoint;\nconst GmulAdd = (Q, a, b) => Point.BASE.multiplyAndAddUnsafe(Q, a, b);\n// Calculate point, scalar and bytes\nfunction schnorrGetExtPubKey(priv) {\n    let d_ = secp256k1.utils.normPrivateKeyToScalar(priv); // same method executed in fromPrivateKey\n    let p = Point.fromPrivateKey(d_); // P = d'⋅G; 0 < d' < n check is done inside\n    const scalar = p.hasEvenY() ? d_ : modN(-d_);\n    return { scalar: scalar, bytes: pointToBytes(p) };\n}\n/**\n * lift_x from BIP340. Convert 32-byte x coordinate to elliptic curve point.\n * @returns valid point checked for being on-curve\n */\nfunction lift_x(x) {\n    aInRange('x', x, _1n, secp256k1P); // Fail if x ≥ p.\n    const xx = modP(x * x);\n    const c = modP(xx * x + BigInt(7)); // Let c = x³ + 7 mod p.\n    let y = sqrtMod(c); // Let y = c^(p+1)/4 mod p.\n    if (y % _2n !== _0n)\n        y = modP(-y); // Return the unique point P such that x(P) = x and\n    const p = new Point(x, y, _1n); // y(P) = y if y mod 2 = 0 or y(P) = p-y otherwise.\n    p.assertValidity();\n    return p;\n}\nconst num = bytesToNumberBE;\n/**\n * Create tagged hash, convert it to bigint, reduce modulo-n.\n */\nfunction challenge(...args) {\n    return modN(num(taggedHash('BIP0340/challenge', ...args)));\n}\n/**\n * Schnorr public key is just `x` coordinate of Point as per BIP340.\n */\nfunction schnorrGetPublicKey(privateKey) {\n    return schnorrGetExtPubKey(privateKey).bytes; // d'=int(sk). Fail if d'=0 or d'≥n. Ret bytes(d'⋅G)\n}\n/**\n * Creates Schnorr signature as per BIP340. Verifies itself before returning anything.\n * auxRand is optional and is not the sole source of k generation: bad CSPRNG won't be dangerous.\n */\nfunction schnorrSign(message, privateKey, auxRand = randomBytes(32)) {\n    const m = ensureBytes('message', message);\n    const { bytes: px, scalar: d } = schnorrGetExtPubKey(privateKey); // checks for isWithinCurveOrder\n    const a = ensureBytes('auxRand', auxRand, 32); // Auxiliary random data a: a 32-byte array\n    const t = numTo32b(d ^ num(taggedHash('BIP0340/aux', a))); // Let t be the byte-wise xor of bytes(d) and hash/aux(a)\n    const rand = taggedHash('BIP0340/nonce', t, px, m); // Let rand = hash/nonce(t || bytes(P) || m)\n    const k_ = modN(num(rand)); // Let k' = int(rand) mod n\n    if (k_ === _0n)\n        throw new Error('sign failed: k is zero'); // Fail if k' = 0.\n    const { bytes: rx, scalar: k } = schnorrGetExtPubKey(k_); // Let R = k'⋅G.\n    const e = challenge(rx, px, m); // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.\n    const sig = new Uint8Array(64); // Let sig = bytes(R) || bytes((k + ed) mod n).\n    sig.set(rx, 0);\n    sig.set(numTo32b(modN(k + e * d)), 32);\n    // If Verify(bytes(P), m, sig) (see below) returns failure, abort\n    if (!schnorrVerify(sig, m, px))\n        throw new Error('sign: Invalid signature produced');\n    return sig;\n}\n/**\n * Verifies Schnorr signature.\n * Will swallow errors & return false except for initial type validation of arguments.\n */\nfunction schnorrVerify(signature, message, publicKey) {\n    const sig = ensureBytes('signature', signature, 64);\n    const m = ensureBytes('message', message);\n    const pub = ensureBytes('publicKey', publicKey, 32);\n    try {\n        const P = lift_x(num(pub)); // P = lift_x(int(pk)); fail if that fails\n        const r = num(sig.subarray(0, 32)); // Let r = int(sig[0:32]); fail if r ≥ p.\n        if (!inRange(r, _1n, secp256k1P))\n            return false;\n        const s = num(sig.subarray(32, 64)); // Let s = int(sig[32:64]); fail if s ≥ n.\n        if (!inRange(s, _1n, secp256k1N))\n            return false;\n        const e = challenge(numTo32b(r), pointToBytes(P), m); // int(challenge(bytes(r)||bytes(P)||m))%n\n        const R = GmulAdd(P, s, modN(-e)); // R = s⋅G - e⋅P\n        if (!R || !R.hasEvenY() || R.toAffine().x !== r)\n            return false; // -eP == (n-e)P\n        return true; // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.\n    }\n    catch (error) {\n        return false;\n    }\n}\n/**\n * Schnorr signatures over secp256k1.\n */\nexport const schnorr = /* @__PURE__ */ (() => ({\n    getPublicKey: schnorrGetPublicKey,\n    sign: schnorrSign,\n    verify: schnorrVerify,\n    utils: {\n        randomPrivateKey: secp256k1.utils.randomPrivateKey,\n        lift_x,\n        pointToBytes,\n        numberToBytesBE,\n        bytesToNumberBE,\n        taggedHash,\n        mod,\n    },\n}))();\nconst isoMap = /* @__PURE__ */ (() => isogenyMap(Fpk1, [\n    // xNum\n    [\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7',\n        '0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581',\n        '0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262',\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c',\n    ],\n    // xDen\n    [\n        '0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b',\n        '0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n    // yNum\n    [\n        '0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c',\n        '0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3',\n        '0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931',\n        '0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84',\n    ],\n    // yDen\n    [\n        '0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b',\n        '0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573',\n        '0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n].map((i) => i.map((j) => BigInt(j)))))();\nconst mapSWU = /* @__PURE__ */ (() => mapToCurveSimpleSWU(Fpk1, {\n    A: BigInt('0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533'),\n    B: BigInt('1771'),\n    Z: Fpk1.create(BigInt('-11')),\n}))();\nconst htf = /* @__PURE__ */ (() => createHasher(secp256k1.ProjectivePoint, (scalars) => {\n    const { x, y } = mapSWU(Fpk1.create(scalars[0]));\n    return isoMap(x, y);\n}, {\n    DST: 'secp256k1_XMD:SHA-256_SSWU_RO_',\n    encodeDST: 'secp256k1_XMD:SHA-256_SSWU_NU_',\n    p: Fpk1.ORDER,\n    m: 1,\n    k: 128,\n    expand: 'xmd',\n    hash: sha256,\n}))();\nexport const hashToCurve = /* @__PURE__ */ (() => htf.hashToCurve)();\nexport const encodeToCurve = /* @__PURE__ */ (() => htf.encodeToCurve)();\n//# sourceMappingURL=secp256k1.js.map","import { createCurve } from '@noble/curves/_shortw_utils';\nimport { sha256 } from '@noble/hashes/sha256';\nimport { Field } from '@noble/curves/abstract/modular';\n\n// brainpoolP256r1: https://datatracker.ietf.org/doc/html/rfc5639#section-3.4\n\n// eslint-disable-next-line new-cap\nconst Fp = Field(BigInt('0xa9fb57dba1eea9bc3e660a909d838d726e3bf623d52620282013481d1f6e5377'));\nconst CURVE_A = Fp.create(BigInt('0x7d5a0975fc2c3057eef67530417affe7fb8055c126dc5c6ce94a4b44f330b5d9'));\nconst CURVE_B = BigInt('0x26dc5c6ce94a4b44f330b5d9bbd77cbf958416295cf7e1ce6bccdc18ff8c07b6');\n\n// prettier-ignore\nexport const brainpoolP256r1 = createCurve({\n  a: CURVE_A, // Equation params: a, b\n  b: CURVE_B,\n  Fp,\n  // Curve order (q), total count of valid points in the field\n  n: BigInt('0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974856a7'),\n  // Base (generator) point (x, y)\n  Gx: BigInt('0x8bd2aeb9cb7e57cb2c4b482ffc81b7afb9de27e1e3bd23c23a4453bd9ace3262'),\n  Gy: BigInt('0x547ef835c3dac4fd97f8461a14611dc9c27745132ded8e545c1d54c72f046997'),\n  h: BigInt(1),\n  lowS: false\n} as const, sha256);\n","import { createCurve } from '@noble/curves/_shortw_utils';\nimport { sha384 } from '@noble/hashes/sha512';\nimport { Field } from '@noble/curves/abstract/modular';\n\n// brainpoolP384 r1: https://datatracker.ietf.org/doc/html/rfc5639#section-3.6\n\n// eslint-disable-next-line new-cap\nconst Fp = Field(BigInt('0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b412b1da197fb71123acd3a729901d1a71874700133107ec53'));\nconst CURVE_A = Fp.create(BigInt('0x7bc382c63d8c150c3c72080ace05afa0c2bea28e4fb22787139165efba91f90f8aa5814a503ad4eb04a8c7dd22ce2826'));\nconst CURVE_B = BigInt('0x04a8c7dd22ce28268b39b55416f0447c2fb77de107dcd2a62e880ea53eeb62d57cb4390295dbc9943ab78696fa504c11');\n\n// prettier-ignore\nexport const brainpoolP384r1 = createCurve({\n  a: CURVE_A, // Equation params: a, b\n  b: CURVE_B,\n  Fp,\n  // Curve order (q), total count of valid points in the field\n  n: BigInt('0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e9046565'),\n  // Base (generator) point (x, y)\n  Gx: BigInt('0x1d1c64f068cf45ffa2a63a81b7c13f6b8847a3e77ef14fe3db7fcafe0cbd10e8e826e03436d646aaef87b2e247d4af1e'),\n  Gy: BigInt('0x8abe1d7520f9c2a45cb1eb8e95cfd55262b70b29feec5864e19c054ff99129280e4646217791811142820341263c5315'),\n  h: BigInt(1),\n  lowS: false\n} as const, sha384);\n","import { createCurve } from '@noble/curves/_shortw_utils';\nimport { sha512 } from '@noble/hashes/sha512';\nimport { Field } from '@noble/curves/abstract/modular';\n\n// brainpoolP512r1: https://datatracker.ietf.org/doc/html/rfc5639#section-3.7\n\n// eslint-disable-next-line new-cap\nconst Fp = Field(BigInt('0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca703308717d4d9b009bc66842aecda12ae6a380e62881ff2f2d82c68528aa6056583a48f3'));\nconst CURVE_A = Fp.create(BigInt('0x7830a3318b603b89e2327145ac234cc594cbdd8d3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94ca'));\nconst CURVE_B = BigInt('0x3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94cadc083e67984050b75ebae5dd2809bd638016f723');\n\n// prettier-ignore\nexport const brainpoolP512r1 = createCurve({\n  a: CURVE_A, // Equation params: a, b\n  b: CURVE_B,\n  Fp,\n  // Curve order (q), total count of valid points in the field\n  n: BigInt('0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90069'),\n  // Base (generator) point (x, y)\n  Gx: BigInt('0x81aee4bdd82ed9645a21322e9c4c6a9385ed9f70b5d916c1b43b62eef4d0098eff3b1f78e2d0d48d50d1687b93b97d5f7c6d5047406a5e688b352209bcb9f822'),\n  Gy: BigInt('0x7dde385d566332ecc0eabfa9cf7822fdf209f70024a57b1aa000c55b881f8111b2dcde494a5f485e5bca4bd88a2763aed1ca2b2fa8f0540678cd1e0f3ad80892'),\n  h: BigInt(1),\n  lowS: false\n} as const, sha512);\n","/**\n * This file is needed to dynamic import the noble-curves.\n * Separate dynamic imports are not convenient as they result in too many chunks,\n * which share a lot of code anyway.\n */\n\nimport { p256 as nistP256 } from '@noble/curves/p256';\nimport { p384 as nistP384 } from '@noble/curves/p384';\nimport { p521 as nistP521 } from '@noble/curves/p521';\nimport { x448, ed448 } from '@noble/curves/ed448';\nimport { secp256k1 } from '@noble/curves/secp256k1';\nimport { brainpoolP256r1 } from './brainpool/brainpoolP256r1';\nimport { brainpoolP384r1 } from './brainpool/brainpoolP384r1';\nimport { brainpoolP512r1 } from './brainpool/brainpoolP512r1';\n\nexport const nobleCurves = new Map(Object.entries({\n  nistP256,\n  nistP384,\n  nistP521,\n  brainpoolP256r1,\n  brainpoolP384r1,\n  brainpoolP512r1,\n  secp256k1,\n  x448,\n  ed448\n}));\n\n"],"names":["HMAC","Hash","constructor","hash","_key","super","this","finished","destroyed","ahash","key","toBytes","iHash","create","update","Error","blockLen","outputLen","pad","Uint8Array","set","length","digest","i","oHash","fill","buf","aexists","digestInto","out","abytes","destroy","_cloneInto","to","Object","getPrototypeOf","hmac","message","_0n","BigInt","_1n","_2n","isBytes","a","ArrayBuffer","isView","name","item","abool","title","value","hexes","Array","from","_","toString","padStart","bytesToHex","bytes","hex","numberToHexUnpadded","num","hexToNumber","asciis","_0","_9","A","F","f","asciiToBase16","ch","hexToBytes","hl","al","array","ai","hi","n1","charCodeAt","n2","undefined","char","bytesToNumberBE","bytesToNumberLE","reverse","numberToBytesBE","n","len","numberToBytesLE","ensureBytes","expectedLength","res","e","concatBytes","arrays","sum","isPosBig","inRange","min","max","aInRange","bitLen","bitMask","u8n","data","u8fr","arr","createHmacDrbg","hashLen","qByteLen","hmacFn","v","k","reset","h","b","reseed","seed","gen","sl","slice","push","pred","validatorFns","bigint","val","function","boolean","string","stringOrUint8Array","isSafeInteger","Number","isArray","field","object","Fp","isValid","validateObject","validators","optValidators","checkField","fieldName","type","isOptional","checkVal","entries","memoized","fn","map","WeakMap","arg","args","get","computed","pos","diff","str","TextEncoder","encode","_3n","_4n","_5n","_8n","mod","result","pow","power","modulo","pow2","x","invert","number","u","r","m","FpSqrt","P","p1div4","root","eql","sqr","c1","mul","nv","sub","ONE","legendreC","Q","S","Z","Q1div2","neg","g","ZERO","t2","ge","tonelliShanks","FIELD_FIELDS","nLength","nBitLength","_nBitLength","nByteLength","Math","ceil","Field","ORDER","isLE","redef","BITS","BYTES","sqrtP","freeze","MASK","is0","isOdd","lhs","rhs","add","p","d","FpPow","div","sqrN","addN","subN","mulN","inv","sqrt","invertBatch","lst","nums","tmp","lastMultiplied","reduce","acc","inverted","reduceRight","FpInvertBatch","cmov","c","fromBytes","getFieldBytesLength","fieldOrder","bitLength","getMinHashLength","constTimeNegate","condition","negate","validateW","W","bits","calcWOpts","windows","windowSize","pointPrecomputes","pointWindowSizes","getW","wNAF","hasPrecomputes","elm","unsafeLadder","double","precomputeWindow","points","base","window","precomputes","BASE","mask","maxNumber","shiftBy","offset","wbits","offset1","offset2","abs","cond1","cond2","wNAFUnsafe","curr","getPrecomputes","transform","comp","wNAFCached","wNAFCachedUnsafe","prev","setWindowSize","delete","pippenger","fieldN","scalars","forEach","validateMSMPoints","s","validateMSMScalars","zero","buckets","floor","j","scalar","resI","sumI","validateBasic","curve","Gx","Gy","validateSigVerOpts","opts","lowS","prehash","b2n","h2b","ut","DER","Err","_tlv","tag","E","dataLen","ut.numberToHexUnpadded","lenLen","decode","first","lengthBytes","subarray","l","_int","parseInt","toSig","int","tlv","ut.abytes","seqBytes","seqLeftBytes","rBytes","rLeftBytes","sBytes","sLeftBytes","hexFromSig","sig","seq","weierstrassPoints","CURVE","ut.validateObject","allowedPrivateKeyLengths","wrapPrivateKey","isTorsionFree","clearCofactor","allowInfinityPoint","endo","beta","splitScalar","validatePointOpts","Fn","mod.Field","_c","point","_isCompressed","toAffine","ut.concatBytes","y","tail","weierstrassEquation","x2","x3","normPrivateKeyToScalar","lengths","N","ut.isBytes","ut.bytesToHex","includes","ut.bytesToNumberBE","error","mod.mod","ut.aInRange","assertPrjPoint","other","Point","toAffineMemo","iz","px","py","pz","z","ax","ay","zz","assertValidMemo","left","right","fromAffine","normalizeZ","toInv","fromHex","assertValidity","fromPrivateKey","privateKey","multiply","msm","_setWindowSize","wnaf","hasEvenY","equals","X1","Y1","Z1","X2","Y2","Z2","U1","U2","b3","X3","Y3","Z3","t0","t1","t3","t4","t5","subtract","multiplyUnsafe","sc","I","k1neg","k1","k2neg","k2","k1p","k2p","fake","f1p","f2p","multiplyAndAddUnsafe","G","cofactor","toRawBytes","isCompressed","toHex","_bits","ProjectivePoint","isWithinCurveOrder","ut.inRange","weierstrass","curveDef","randomBytes","bits2int","bits2int_modN","validateOpts","CURVE_ORDER","compressedLen","uncompressedLen","modN","invN","mod.invert","cat","head","y2","sqrtError","suffix","numToNByteStr","ut.numberToBytesBE","isBiggerThanHalfOrder","slcNum","Signature","recovery","fromCompact","fromDER","addRecoveryBit","recoverPublicKey","msgHash","rec","radj","prefix","R","ir","u1","u2","hasHighS","normalizeS","toDERRawBytes","ut.hexToBytes","toDERHex","toCompactRawBytes","toCompactHex","utils","isValidPrivateKey","randomPrivateKey","mod.getMinHashLength","fieldLen","minLen","reduced","mod.mapHashToField","precompute","isProbPub","delta","ORDER_MASK","ut.bitMask","int2octets","prepSig","defaultSigOpts","some","extraEntropy","ent","h1int","seedArgs","k2sig","kBytes","ik","q","normS","defaultVerOpts","getPublicKey","getSharedSecret","privateA","publicB","sign","privKey","C","ut.createHmacDrbg","drbg","verify","signature","publicKey","sg","format","isHex","isObj","_sig","derError","is","getHash","msgs","createCurve","defHash","Fp256","p256","sha256","Fp384","p384","sha384","Fp521","p521","sha512","VERIFY_DEFAULT","zip215","twistedEdwards","adjustScalarBytes","domain","uvRatio","mapToCurve","cHash","modP","ctx","phflag","aCoordinate","assertPoint","ex","ey","ez","X","Y","et","T","Z4","aX2","X1Z2","X2Z1","Y1Z2","Y2Z1","B","D","x1y1","H","T3","T1","T2","isSmallOrder","normed","lastByte","ut.bytesToNumberLE","isXOdd","isLastByteOdd","getExtendedPublicKey","ut.numberToBytesLE","modN_LE","hashed","pointBytes","hashDomainToScalar","context","msg","verifyOpts","options","SB","ExtendedPoint","montgomery","montgomeryBits","powPminus2","Gu","montgomeryBytes","cswap","swap","x_2","x_3","dummy","a24","encodeUCoordinate","scalarMult","pointU","uEnc","decodeUCoordinate","pu","x_1","sw","z_2","z_3","t","k_t","AA","BB","DA","CB","dacb","da_cb","z2","montgomeryLadder","decodeScalar","GuBytes","scalarMultBase","shake256_114","wrapConstructor","shake256","dkLen","ed448P","_11n","_22n","_44n","_88n","_223n","ed448_pow_Pminus3div4","b2","b6","b9","b11","b22","b44","b88","b176","b220","b222","b223","ED448_DEF","utf8ToBytes","u2v","u3v","u5v3","ed448","x448","secp256k1P","secp256k1N","divNearest","Fpk1","_6n","_23n","secp256k1","a1","b1","a2","POW_2_128","c2","brainpoolP256r1","brainpoolP384r1","brainpoolP512r1","nobleCurves","Map","nistP256","nistP384","nistP521"],"mappings":";mPAGO,MAAMA,UAAaC,EACtB,WAAAC,CAAYC,EAAMC,GACdC,QACAC,KAAKC,UAAW,EAChBD,KAAKE,WAAY,EACjBC,EAAMN,GACN,MAAMO,EAAMC,EAAQP,GAEpB,GADAE,KAAKM,MAAQT,EAAKU,SACe,mBAAtBP,KAAKM,MAAME,OAClB,MAAUC,MAAM,uDACpBT,KAAKU,SAAWV,KAAKM,MAAMI,SAC3BV,KAAKW,UAAYX,KAAKM,MAAMK,UAC5B,MAAMD,EAAWV,KAAKU,SAChBE,EAAM,IAAIC,WAAWH,GAE3BE,EAAIE,IAAIV,EAAIW,OAASL,EAAWb,EAAKU,SAASC,OAAOJ,GAAKY,SAAWZ,GACrE,IAAK,IAAIa,EAAI,EAAGA,EAAIL,EAAIG,OAAQE,IAC5BL,EAAIK,IAAM,GACdjB,KAAKM,MAAME,OAAOI,GAElBZ,KAAKkB,MAAQrB,EAAKU,SAElB,IAAK,IAAIU,EAAI,EAAGA,EAAIL,EAAIG,OAAQE,IAC5BL,EAAIK,IAAM,IACdjB,KAAKkB,MAAMV,OAAOI,GAClBA,EAAIO,KAAK,EACjB,CACI,MAAAX,CAAOY,GAGH,OAFAC,EAAQrB,MACRA,KAAKM,MAAME,OAAOY,GACXpB,IACf,CACI,UAAAsB,CAAWC,GACPF,EAAQrB,MACRwB,EAAOD,EAAKvB,KAAKW,WACjBX,KAAKC,UAAW,EAChBD,KAAKM,MAAMgB,WAAWC,GACtBvB,KAAKkB,MAAMV,OAAOe,GAClBvB,KAAKkB,MAAMI,WAAWC,GACtBvB,KAAKyB,SACb,CACI,MAAAT,GACI,MAAMO,EAAM,IAAIV,WAAWb,KAAKkB,MAAMP,WAEtC,OADAX,KAAKsB,WAAWC,GACTA,CACf,CACI,UAAAG,CAAWC,GAEPA,IAAOA,EAAKC,OAAOrB,OAAOqB,OAAOC,eAAe7B,MAAO,CAAA,IACvD,MAAMkB,MAAEA,EAAKZ,MAAEA,EAAKL,SAAEA,EAAQC,UAAEA,EAASQ,SAAEA,EAAQC,UAAEA,GAAcX,KAQnE,OANA2B,EAAG1B,SAAWA,EACd0B,EAAGzB,UAAYA,EACfyB,EAAGjB,SAAWA,EACdiB,EAAGhB,UAAYA,EACfgB,EAAGT,MAAQA,EAAMQ,WAAWC,EAAGT,OAC/BS,EAAGrB,MAAQA,EAAMoB,WAAWC,EAAGrB,OACxBqB,CACf,CACI,OAAAF,GACIzB,KAAKE,WAAY,EACjBF,KAAKkB,MAAMO,UACXzB,KAAKM,MAAMmB,SACnB,EAYO,MAAMK,EAAO,CAACjC,EAAMO,EAAK2B,IAAY,IAAIrC,EAAKG,EAAMO,GAAKI,OAAOuB,GAASf,SAChFc,EAAKvB,OAAS,CAACV,EAAMO,IAAQ,IAAIV,EAAKG,EAAMO;uEC1E5C,MAAM4B,iBAAsBC,OAAO,GAC7BC,iBAAsBD,OAAO,GAC7BE,iBAAsBF,OAAO,GAC5B,SAASG,EAAQC,GACpB,OAAOA,aAAaxB,YAAeyB,YAAYC,OAAOF,IAA6B,eAAvBA,EAAEzC,YAAY4C,IAC9E,CACO,SAAShB,EAAOiB,GACnB,IAAKL,EAAQK,GACT,MAAUhC,MAAM,sBACxB,CACO,SAASiC,EAAMC,EAAOC,GACzB,GAAqB,kBAAVA,EACP,MAAUnC,MAAMkC,EAAQ,0BAA4BC,EAC5D,CAEA,MAAMC,iBAAwBC,MAAMC,KAAK,CAAEhC,OAAQ,MAAO,CAACiC,EAAG/B,IAAMA,EAAEgC,SAAS,IAAIC,SAAS,EAAG,OAIxF,SAASC,EAAWC,GACvB5B,EAAO4B,GAEP,IAAIC,EAAM,GACV,IAAK,IAAIpC,EAAI,EAAGA,EAAImC,EAAMrC,OAAQE,IAC9BoC,GAAOR,EAAMO,EAAMnC,IAEvB,OAAOoC,CACX,CACO,SAASC,EAAoBC,GAChC,MAAMF,EAAME,EAAIN,SAAS,IACzB,OAAoB,EAAbI,EAAItC,OAAa,IAAMsC,EAAMA,CACxC,CACO,SAASG,EAAYH,GACxB,GAAmB,iBAARA,EACP,MAAU5C,MAAM,mCAAqC4C,GACzD,MAAe,KAARA,EAAarB,EAAMC,OAAO,KAAOoB,EAC5C,CAEA,MAAMI,EAAS,CAAEC,GAAI,GAAIC,GAAI,GAAIC,EAAG,GAAIC,EAAG,GAAIxB,EAAG,GAAIyB,EAAG,KACzD,SAASC,EAAcC,GACnB,OAAIA,GAAMP,EAAOC,IAAMM,GAAMP,EAAOE,GACzBK,EAAKP,EAAOC,GACnBM,GAAMP,EAAOG,GAAKI,GAAMP,EAAOI,EACxBG,GAAMP,EAAOG,EAAI,IACxBI,GAAMP,EAAOpB,GAAK2B,GAAMP,EAAOK,EACxBE,GAAMP,EAAOpB,EAAI,SAD5B,CAGJ,CAIO,SAAS4B,EAAWZ,GACvB,GAAmB,iBAARA,EACP,MAAU5C,MAAM,mCAAqC4C,GACzD,MAAMa,EAAKb,EAAItC,OACToD,EAAKD,EAAK,EAChB,GAAIA,EAAK,EACL,MAAUzD,MAAM,mDAAqDyD,GACzE,MAAME,EAAQ,IAAIvD,WAAWsD,GAC7B,IAAK,IAAIE,EAAK,EAAGC,EAAK,EAAGD,EAAKF,EAAIE,IAAMC,GAAM,EAAG,CAC7C,MAAMC,EAAKR,EAAcV,EAAImB,WAAWF,IAClCG,EAAKV,EAAcV,EAAImB,WAAWF,EAAK,IAC7C,QAAWI,IAAPH,QAA2BG,IAAPD,EAAkB,CACtC,MAAME,EAAOtB,EAAIiB,GAAMjB,EAAIiB,EAAK,GAChC,MAAU7D,MAAM,+CAAiDkE,EAAO,cAAgBL,EACpG,CACQF,EAAMC,GAAW,GAALE,EAAUE,CAC9B,CACI,OAAOL,CACX,CAEO,SAASQ,EAAgBxB,GAC5B,OAAOI,EAAYL,EAAWC,GAClC,CACO,SAASyB,EAAgBzB,GAE5B,OADA5B,EAAO4B,GACAI,EAAYL,EAAWtC,WAAWkC,KAAKK,GAAO0B,WACzD,CACO,SAASC,EAAgBC,EAAGC,GAC/B,OAAOhB,EAAWe,EAAE/B,SAAS,IAAIC,SAAe,EAAN+B,EAAS,KACvD,CACO,SAASC,EAAgBF,EAAGC,GAC/B,OAAOF,EAAgBC,EAAGC,GAAKH,SACnC,CAcO,SAASK,EAAYxC,EAAOU,EAAK+B,GACpC,IAAIC,EACJ,GAAmB,iBAARhC,EACP,IACIgC,EAAMpB,EAAWZ,EAC7B,CACQ,MAAOiC,GACH,MAAU7E,MAAMkC,EAAQ,6CAA+C2C,EACnF,KAES,KAAIlD,EAAQiB,GAMb,MAAU5C,MAAMkC,EAAQ,qCAHxB0C,EAAMxE,WAAWkC,KAAKM,EAI9B,CACI,MAAM4B,EAAMI,EAAItE,OAChB,GAA8B,iBAAnBqE,GAA+BH,IAAQG,EAC9C,MAAU3E,MAAMkC,EAAQ,cAAgByC,EAAiB,kBAAoBH,GACjF,OAAOI,CACX,CAIO,SAASE,KAAeC,GAC3B,IAAIC,EAAM,EACV,IAAK,IAAIxE,EAAI,EAAGA,EAAIuE,EAAOzE,OAAQE,IAAK,CACpC,MAAMoB,EAAImD,EAAOvE,GACjBO,EAAOa,GACPoD,GAAOpD,EAAEtB,MACjB,CACI,MAAMsE,EAAM,IAAIxE,WAAW4E,GAC3B,IAAK,IAAIxE,EAAI,EAAGL,EAAM,EAAGK,EAAIuE,EAAOzE,OAAQE,IAAK,CAC7C,MAAMoB,EAAImD,EAAOvE,GACjBoE,EAAIvE,IAAIuB,EAAGzB,GACXA,GAAOyB,EAAEtB,MACjB,CACI,OAAOsE,CACX,CAmBA,MAAMK,EAAYV,GAAmB,iBAANA,GAAkBhD,GAAOgD,EACjD,SAASW,EAAQX,EAAGY,EAAKC,GAC5B,OAAOH,EAASV,IAAMU,EAASE,IAAQF,EAASG,IAAQD,GAAOZ,GAAKA,EAAIa,CAC5E,CAMO,SAASC,EAASnD,EAAOqC,EAAGY,EAAKC,GAMpC,IAAKF,EAAQX,EAAGY,EAAKC,GACjB,MAAUpF,MAAM,kBAAoBkC,EAAQ,KAAOiD,EAAM,WAAaC,EAAM,SAAWb,EAC/F,CAMO,SAASe,EAAOf,GACnB,IAAIC,EACJ,IAAKA,EAAM,EAAGD,EAAIhD,EAAKgD,IAAM9C,EAAK+C,GAAO,GAEzC,OAAOA,CACX,CAmBO,MAAMe,EAAWhB,IAAO7C,GAAOF,OAAO+C,EAAI,IAAM9C,EAEjD+D,EAAOC,GAAS,IAAIrF,WAAWqF,GAC/BC,EAAQC,GAAQvF,WAAWkC,KAAKqD,GAQ/B,SAASC,EAAeC,EAASC,EAAUC,GAC9C,GAAuB,iBAAZF,GAAwBA,EAAU,EACzC,MAAU7F,MAAM,4BACpB,GAAwB,iBAAb8F,GAAyBA,EAAW,EAC3C,MAAU9F,MAAM,6BACpB,GAAsB,mBAAX+F,EACP,MAAU/F,MAAM,6BAEpB,IAAIgG,EAAIR,EAAIK,GACRI,EAAIT,EAAIK,GACRrF,EAAI,EACR,MAAM0F,EAAQ,KACVF,EAAEtF,KAAK,GACPuF,EAAEvF,KAAK,GACPF,EAAI,CAAC,EAEH2F,EAAI,IAAIC,IAAML,EAAOE,EAAGD,KAAMI,GAC9BC,EAAS,CAACC,EAAOd,OAEnBS,EAAIE,EAAET,EAAK,CAAC,IAAQY,GACpBN,EAAIG,IACgB,IAAhBG,EAAKhG,SAET2F,EAAIE,EAAET,EAAK,CAAC,IAAQY,GACpBN,EAAIG,IAAG,EAELI,EAAM,KAER,GAAI/F,KAAO,IACP,MAAUR,MAAM,2BACpB,IAAIwE,EAAM,EACV,MAAM1D,EAAM,GACZ,KAAO0D,EAAMsB,GAAU,CACnBE,EAAIG,IACJ,MAAMK,EAAKR,EAAES,QACb3F,EAAI4F,KAAKF,GACThC,GAAOwB,EAAE1F,MACrB,CACQ,OAAOwE,KAAehE,EAAI,EAW9B,MATiB,CAACwF,EAAMK,KAGpB,IAAI/B,EACJ,IAHAsB,IACAG,EAAOC,KAEE1B,EAAM+B,EAAKJ,OAChBF,IAEJ,OADAH,IACOtB,CAAG,CAGlB,CAEA,MAAMgC,EAAe,CACjBC,OAASC,GAAuB,iBAARA,EACxBC,SAAWD,GAAuB,mBAARA,EAC1BE,QAAUF,GAAuB,kBAARA,EACzBG,OAASH,GAAuB,iBAARA,EACxBI,mBAAqBJ,GAAuB,iBAARA,GAAoBnF,EAAQmF,GAChEK,cAAgBL,GAAQM,OAAOD,cAAcL,GAC7CnD,MAAQmD,GAAQzE,MAAMgF,QAAQP,GAC9BQ,MAAO,CAACR,EAAKS,IAAWA,EAAOC,GAAGC,QAAQX,GAC1C1H,KAAO0H,GAAuB,mBAARA,GAAsBM,OAAOD,cAAcL,EAAI5G,YAGlE,SAASwH,EAAeH,EAAQI,EAAYC,EAAgB,CAAA,GAC/D,MAAMC,EAAa,CAACC,EAAWC,EAAMC,KACjC,MAAMC,EAAWrB,EAAamB,GAC9B,GAAwB,mBAAbE,EACP,MAAUjI,MAAM,8BACpB,MAAM8G,EAAMS,EAAOO,GACnB,KAAIE,QAAsB/D,IAAR6C,GAEbmB,EAASnB,EAAKS,IACf,MAAUvH,MAAM,SAAkB8H,EAAa,yBAA2BC,EAAO,SAAWjB,EACxG,EAEI,IAAK,MAAOgB,EAAWC,KAAS5G,OAAO+G,QAAQP,GAC3CE,EAAWC,EAAWC,GAAM,GAChC,IAAK,MAAOD,EAAWC,KAAS5G,OAAO+G,QAAQN,GAC3CC,EAAWC,EAAWC,GAAM,GAChC,OAAOR,CACX,CAmBO,SAASY,EAASC,GACrB,MAAMC,EAAM,IAAIC,QAChB,MAAO,CAACC,KAAQC,KACZ,MAAM1B,EAAMuB,EAAII,IAAIF,GACpB,QAAYtE,IAAR6C,EACA,OAAOA,EACX,MAAM4B,EAAWN,EAAGG,KAAQC,GAE5B,OADAH,EAAIhI,IAAIkI,EAAKG,GACNA,CAAQ,CAEvB,qFAtIO,SAAgBnE,EAAGoE,GACtB,OAAQpE,GAAK/C,OAAOmH,GAAQlH,CAChC,4BAIO,SAAgB8C,EAAGoE,EAAKxG,GAC3B,OAAOoC,GAAMpC,EAAQV,EAAMF,IAAQC,OAAOmH,EAC9C,2GA3DO,SAAoB/G,EAAGwE,GAC1B,GAAIxE,EAAEtB,SAAW8F,EAAE9F,OACf,OAAO,EACX,IAAIsI,EAAO,EACX,IAAK,IAAIpI,EAAI,EAAGA,EAAIoB,EAAEtB,OAAQE,IAC1BoI,GAAQhH,EAAEpB,GAAK4F,EAAE5F,GACrB,OAAgB,IAAToI,CACX,2EAiK8B,KAC1B,MAAU5I,MAAM,kBAAkB,+EA/N/B,SAA4BuE,GAC/B,OAAOf,EAAWX,EAAoB0B,GAC1C,cA+DO,SAAqBsE,GACxB,GAAmB,iBAARA,EACP,MAAU7I,MAAM,mBACpB,OAAO,IAAII,YAAW,IAAI0I,aAAcC,OAAOF,GACnD;sEC3JA,MAAMtH,EAAMC,OAAO,GAAIC,EAAMD,OAAO,GAAIE,iBAAsBF,OAAO,GAAIwH,iBAAsBxH,OAAO,GAEhGyH,iBAAsBzH,OAAO,GAAI0H,iBAAsB1H,OAAO,GAAI2H,iBAAsB3H,OAAO,GAI9F,SAAS4H,EAAIxH,EAAGwE,GACnB,MAAMiD,EAASzH,EAAIwE,EACnB,OAAOiD,GAAU9H,EAAM8H,EAASjD,EAAIiD,CACxC,CAQO,SAASC,GAAIxG,EAAKyG,EAAOC,GAC5B,GAAID,EAAQhI,EACR,MAAUvB,MAAM,2CACpB,GAAIwJ,GAAUjI,EACV,MAAUvB,MAAM,mBACpB,GAAIwJ,IAAW/H,EACX,OAAOF,EACX,IAAIqD,EAAMnD,EACV,KAAO8H,EAAQhI,GACPgI,EAAQ9H,IACRmD,EAAOA,EAAM9B,EAAO0G,GACxB1G,EAAOA,EAAMA,EAAO0G,EACpBD,IAAU9H,EAEd,OAAOmD,CACX,CAEO,SAAS6E,GAAKC,EAAGH,EAAOC,GAC3B,IAAI5E,EAAM8E,EACV,KAAOH,KAAUhI,GACbqD,GAAOA,EACPA,GAAO4E,EAEX,OAAO5E,CACX,CAEO,SAAS+E,GAAOC,EAAQJ,GAC3B,GAAII,IAAWrI,EACX,MAAUvB,MAAM,oCACpB,GAAIwJ,GAAUjI,EACV,MAAUvB,MAAM,0CAA4CwJ,GAGhE,IAAI5H,EAAIwH,EAAIQ,EAAQJ,GAChBpD,EAAIoD,EAEJE,EAAInI,EAAcsI,EAAIpI,EAC1B,KAAOG,IAAML,GAAK,CAEd,MACMuI,EAAI1D,EAAIxE,EACRmI,EAAIL,EAAIG,GAFJzD,EAAIxE,GAKdwE,EAAIxE,EAAGA,EAAIkI,EAAGJ,EAAIG,EAAUA,EAAIE,CACxC,CAEI,GADY3D,IACA3E,EACR,MAAUzB,MAAM,0BACpB,OAAOoJ,EAAIM,EAAGF,EAClB,CAoEO,SAASQ,GAAOC,GAKnB,GAAIA,EAAIhB,IAAQD,EAAK,CAKjB,MAAMkB,GAAUD,EAAIxI,GAAOwH,EAC3B,OAAO,SAAmBzB,EAAIjD,GAC1B,MAAM4F,EAAO3C,EAAG8B,IAAI/E,EAAG2F,GAEvB,IAAK1C,EAAG4C,IAAI5C,EAAG6C,IAAIF,GAAO5F,GACtB,MAAUvE,MAAM,2BACpB,OAAOmK,CACV,CACT,CAEI,GAAIF,EAAId,IAAQD,EAAK,CACjB,MAAMoB,GAAML,EAAIf,GAAOC,EACvB,OAAO,SAAmB3B,EAAIjD,GAC1B,MAAMP,EAAKwD,EAAG+C,IAAIhG,EAAG7C,GACfsE,EAAIwB,EAAG8B,IAAItF,EAAIsG,GACfE,EAAKhD,EAAG+C,IAAIhG,EAAGyB,GACfxF,EAAIgH,EAAG+C,IAAI/C,EAAG+C,IAAIC,EAAI9I,GAAMsE,GAC5BmE,EAAO3C,EAAG+C,IAAIC,EAAIhD,EAAGiD,IAAIjK,EAAGgH,EAAGkD,MACrC,IAAKlD,EAAG4C,IAAI5C,EAAG6C,IAAIF,GAAO5F,GACtB,MAAUvE,MAAM,2BACpB,OAAOmK,CACV,CACT,CAwBI,OAnHG,SAAuBF,GAM1B,MAAMU,GAAaV,EAAIxI,GAAOC,EAC9B,IAAIkJ,EAAGC,EAAGC,EAGV,IAAKF,EAAIX,EAAIxI,EAAKoJ,EAAI,EAAGD,EAAIlJ,IAAQH,EAAKqJ,GAAKlJ,EAAKmJ,KAGpD,IAAKC,EAAIpJ,EAAKoJ,EAAIb,GAAKX,GAAIwB,EAAGH,EAAWV,KAAOA,EAAIxI,EAAKqJ,IAErD,GAAIA,EAAI,IACJ,MAAU9K,MAAM,+CAGxB,GAAU,IAAN6K,EAAS,CACT,MAAMX,GAAUD,EAAIxI,GAAOwH,EAC3B,OAAO,SAAqBzB,EAAIjD,GAC5B,MAAM4F,EAAO3C,EAAG8B,IAAI/E,EAAG2F,GACvB,IAAK1C,EAAG4C,IAAI5C,EAAG6C,IAAIF,GAAO5F,GACtB,MAAUvE,MAAM,2BACpB,OAAOmK,CACV,CACT,CAEI,MAAMY,GAAUH,EAAInJ,GAAOC,EAC3B,OAAO,SAAqB8F,EAAIjD,GAE5B,GAAIiD,EAAG8B,IAAI/E,EAAGoG,KAAenD,EAAGwD,IAAIxD,EAAGkD,KACnC,MAAU1K,MAAM,2BACpB,IAAI8J,EAAIe,EAEJI,EAAIzD,EAAG8B,IAAI9B,EAAG+C,IAAI/C,EAAGkD,IAAKI,GAAIF,GAC9BlB,EAAIlC,EAAG8B,IAAI/E,EAAGwG,GACd3E,EAAIoB,EAAG8B,IAAI/E,EAAGqG,GAClB,MAAQpD,EAAG4C,IAAIhE,EAAGoB,EAAGkD,MAAM,CACvB,GAAIlD,EAAG4C,IAAIhE,EAAGoB,EAAG0D,MACb,OAAO1D,EAAG0D,KAEd,IAAInB,EAAI,EACR,IAAK,IAAIoB,EAAK3D,EAAG6C,IAAIjE,GAAI2D,EAAID,IACrBtC,EAAG4C,IAAIe,EAAI3D,EAAGkD,KADUX,IAG5BoB,EAAK3D,EAAG6C,IAAIc,GAGhB,MAAMC,EAAK5D,EAAG8B,IAAI2B,EAAGxJ,GAAOD,OAAOsI,EAAIC,EAAI,IAC3CkB,EAAIzD,EAAG6C,IAAIe,GACX1B,EAAIlC,EAAG+C,IAAIb,EAAG0B,GACdhF,EAAIoB,EAAG+C,IAAInE,EAAG6E,GACdnB,EAAIC,CAChB,CACQ,OAAOL,CACV,CACL,CAyDW2B,CAAcpB,EACzB,CAIA,MAAMqB,GAAe,CACjB,SAAU,UAAW,MAAO,MAAO,MAAO,OAAQ,MAClD,MAAO,MAAO,MAAO,MAAO,MAAO,MACnC,OAAQ,OAAQ,OAAQ,QAkFrB,SAASC,GAAQhH,EAAGiH,GAEvB,MAAMC,OAA6BxH,IAAfuH,EAA2BA,EAAajH,EAAE/B,SAAS,GAAGlC,OAE1E,MAAO,CAAEkL,WAAYC,EAAaC,YADdC,KAAKC,KAAKH,EAAc,GAEhD,CAgBO,SAASI,GAAMC,EAAOxG,EAAQyG,GAAO,EAAOC,EAAQ,IACvD,GAAIF,GAASvK,EACT,MAAUvB,MAAM,0CAA4C8L,GAChE,MAAQN,WAAYS,EAAMP,YAAaQ,GAAUX,GAAQO,EAAOxG,GAChE,GAAI4G,EAAQ,KACR,MAAUlM,MAAM,kDACpB,IAAImM,EACJ,MAAM9I,EAAIlC,OAAOiL,OAAO,CACpBN,QACAG,OACAC,QACAG,KAAM9G,EAAQ0G,GACdf,KAAM3J,EACNmJ,IAAKjJ,EACL3B,OAASgD,GAAQsG,EAAItG,EAAKgJ,GAC1BrE,QAAU3E,IACN,GAAmB,iBAARA,EACP,MAAU9C,MAAM,sDAAwD8C,GAC5E,OAAOvB,GAAOuB,GAAOA,EAAMgJ,CAAK,EAEpCQ,IAAMxJ,GAAQA,IAAQvB,EACtBgL,MAAQzJ,IAASA,EAAMrB,KAASA,EAChCuJ,IAAMlI,GAAQsG,GAAKtG,EAAKgJ,GACxB1B,IAAK,CAACoC,EAAKC,IAAQD,IAAQC,EAC3BpC,IAAMvH,GAAQsG,EAAItG,EAAMA,EAAKgJ,GAC7BY,IAAK,CAACF,EAAKC,IAAQrD,EAAIoD,EAAMC,EAAKX,GAClCrB,IAAK,CAAC+B,EAAKC,IAAQrD,EAAIoD,EAAMC,EAAKX,GAClCvB,IAAK,CAACiC,EAAKC,IAAQrD,EAAIoD,EAAMC,EAAKX,GAClCxC,IAAK,CAACxG,EAAKyG,IA/GZ,SAAelG,EAAGP,EAAKyG,GAG1B,GAAIA,EAAQhI,EACR,MAAUvB,MAAM,2CACpB,GAAIuJ,IAAUhI,EACV,OAAO8B,EAAEqH,IACb,GAAInB,IAAU9H,EACV,OAAOqB,EACX,IAAI6J,EAAItJ,EAAEqH,IACNkC,EAAI9J,EACR,KAAOyG,EAAQhI,GACPgI,EAAQ9H,IACRkL,EAAItJ,EAAEkH,IAAIoC,EAAGC,IACjBA,EAAIvJ,EAAEgH,IAAIuC,GACVrD,IAAU9H,EAEd,OAAOkL,CACX,CA6F6BE,CAAMxJ,EAAGP,EAAKyG,GACnCuD,IAAK,CAACN,EAAKC,IAAQrD,EAAIoD,EAAM7C,GAAO8C,EAAKX,GAAQA,GAEjDiB,KAAOjK,GAAQA,EAAMA,EACrBkK,KAAM,CAACR,EAAKC,IAAQD,EAAMC,EAC1BQ,KAAM,CAACT,EAAKC,IAAQD,EAAMC,EAC1BS,KAAM,CAACV,EAAKC,IAAQD,EAAMC,EAC1BU,IAAMrK,GAAQ6G,GAAO7G,EAAKgJ,GAC1BsB,KAAMpB,EAAMoB,MACP,CAAC7I,IACO4H,IACDA,EAAQnC,GAAO8B,IACZK,EAAM9I,EAAGkB,KAExB8I,YAAcC,GAtGf,SAAuBjK,EAAGkK,GAC7B,MAAMC,EAAUnL,MAAMkL,EAAKjN,QAErBmN,EAAiBF,EAAKG,QAAO,CAACC,EAAK7K,EAAKtC,IACtC6C,EAAEiJ,IAAIxJ,GACC6K,GACXH,EAAIhN,GAAKmN,EACFtK,EAAEkH,IAAIoD,EAAK7K,KACnBO,EAAEqH,KAECkD,EAAWvK,EAAE8J,IAAIM,GAQvB,OANAF,EAAKM,aAAY,CAACF,EAAK7K,EAAKtC,IACpB6C,EAAEiJ,IAAIxJ,GACC6K,GACXH,EAAIhN,GAAK6C,EAAEkH,IAAIoD,EAAKH,EAAIhN,IACjB6C,EAAEkH,IAAIoD,EAAK7K,KACnB8K,GACIJ,CACX,CAmF8BM,CAAczK,EAAGiK,GAGvCS,KAAM,CAACnM,EAAGwE,EAAG4H,IAAOA,EAAI5H,EAAIxE,EAC5BhC,QAAUkD,GAASiJ,EAAOtH,EAAgB3B,EAAKoJ,GAAS5H,EAAgBxB,EAAKoJ,GAC7E+B,UAAYtL,IACR,GAAIA,EAAMrC,SAAW4L,EACjB,MAAUlM,MAAM,6BAA+BkM,EAAQ,eAAiBvJ,EAAMrC,QAClF,OAAOyL,EAAO3H,EAAgBzB,GAASwB,EAAgBxB,EAAM,IAGrE,OAAOxB,OAAOiL,OAAO/I,EACzB,CAkCO,SAAS6K,GAAoBC,GAChC,GAA0B,iBAAfA,EACP,MAAUnO,MAAM,8BACpB,MAAMoO,EAAYD,EAAW3L,SAAS,GAAGlC,OACzC,OAAOqL,KAAKC,KAAKwC,EAAY,EACjC,CAQO,SAASC,GAAiBF,GAC7B,MAAM7N,EAAS4N,GAAoBC,GACnC,OAAO7N,EAASqL,KAAKC,KAAKtL,EAAS,EACvC;;ACtZA,MAAMiB,GAAMC,OAAO,GACbC,GAAMD,OAAO,GACnB,SAAS8M,GAAgBC,EAAWvM,GAChC,MAAMgJ,EAAMhJ,EAAKwM,SACjB,OAAOD,EAAYvD,EAAMhJ,CAC7B,CACA,SAASyM,GAAUC,EAAGC,GAClB,IAAKvH,OAAOD,cAAcuH,IAAMA,GAAK,GAAKA,EAAIC,EAC1C,MAAU3O,MAAM,qCAAuC2O,EAAO,YAAcD,EACpF,CACA,SAASE,GAAUF,EAAGC,GAClBF,GAAUC,EAAGC,GAGb,MAAO,CAAEE,QAFOlD,KAAKC,KAAK+C,EAAOD,GAAK,EAEpBI,WADC,IAAMJ,EAAI,GAEjC,CAmBA,MAAMK,GAAmB,IAAIzG,QACvB0G,GAAmB,IAAI1G,QAC7B,SAAS2G,GAAKhF,GACV,OAAO+E,GAAiBvG,IAAIwB,IAAM,CACtC,CAYO,SAASiF,GAAKlB,EAAGW,GACpB,MAAO,CACHL,mBACAa,eAAeC,GACU,IAAdH,GAAKG,GAGhB,YAAAC,CAAaD,EAAK7K,EAAGoI,EAAIqB,EAAE9C,MACvB,IAAI0B,EAAIwC,EACR,KAAO7K,EAAIhD,IACHgD,EAAI9C,KACJkL,EAAIA,EAAED,IAAIE,IACdA,EAAIA,EAAE0C,SACN/K,IAAM9C,GAEV,OAAOkL,CACV,EAaD,gBAAA4C,CAAiBH,EAAKV,GAClB,MAAMG,QAAEA,EAAOC,WAAEA,GAAeF,GAAUF,EAAGC,GACvCa,EAAS,GACf,IAAI7C,EAAIyC,EACJK,EAAO9C,EACX,IAAK,IAAI+C,EAAS,EAAGA,EAASb,EAASa,IAAU,CAC7CD,EAAO9C,EACP6C,EAAO9I,KAAK+I,GAEZ,IAAK,IAAIjP,EAAI,EAAGA,EAAIsO,EAAYtO,IAC5BiP,EAAOA,EAAK/C,IAAIC,GAChB6C,EAAO9I,KAAK+I,GAEhB9C,EAAI8C,EAAKH,QACzB,CACY,OAAOE,CACV,EAQD,IAAAN,CAAKR,EAAGiB,EAAapL,GAGjB,MAAMsK,QAAEA,EAAOC,WAAEA,GAAeF,GAAUF,EAAGC,GAC7C,IAAIhC,EAAIqB,EAAE9C,KACN7H,EAAI2K,EAAE4B,KACV,MAAMC,EAAOrO,OAAO,GAAKkN,EAAI,GACvBoB,EAAY,GAAKpB,EACjBqB,EAAUvO,OAAOkN,GACvB,IAAK,IAAIgB,EAAS,EAAGA,EAASb,EAASa,IAAU,CAC7C,MAAMM,EAASN,EAASZ,EAExB,IAAImB,EAAQ7I,OAAO7C,EAAIsL,GAEvBtL,IAAMwL,EAGFE,EAAQnB,IACRmB,GAASH,EACTvL,GAAK9C,IAST,MAAMyO,EAAUF,EACVG,EAAUH,EAASrE,KAAKyE,IAAIH,GAAS,EACrCI,EAAQX,EAAS,GAAM,EACvBY,EAAQL,EAAQ,EACR,IAAVA,EAEA5M,EAAIA,EAAEqJ,IAAI4B,GAAgB+B,EAAOV,EAAYO,KAG7CvD,EAAIA,EAAED,IAAI4B,GAAgBgC,EAAOX,EAAYQ,IAEjE,CAMY,MAAO,CAAExD,IAAGtJ,IACf,EASD,UAAAkN,CAAW7B,EAAGiB,EAAapL,EAAGoJ,EAAMK,EAAE9C,MAClC,MAAM2D,QAAEA,EAAOC,WAAEA,GAAeF,GAAUF,EAAGC,GACvCkB,EAAOrO,OAAO,GAAKkN,EAAI,GACvBoB,EAAY,GAAKpB,EACjBqB,EAAUvO,OAAOkN,GACvB,IAAK,IAAIgB,EAAS,EAAGA,EAASb,EAASa,IAAU,CAC7C,MAAMM,EAASN,EAASZ,EACxB,GAAIvK,IAAMhD,GACN,MAEJ,IAAI0O,EAAQ7I,OAAO7C,EAAIsL,GASvB,GAPAtL,IAAMwL,EAGFE,EAAQnB,IACRmB,GAASH,EACTvL,GAAK9C,IAEK,IAAVwO,EACA,SACJ,IAAIO,EAAOb,EAAYK,EAASrE,KAAKyE,IAAIH,GAAS,GAC9CA,EAAQ,IACRO,EAAOA,EAAKhC,UAEhBb,EAAMA,EAAIjB,IAAI8D,EAC9B,CACY,OAAO7C,CACV,EACD,cAAA8C,CAAe/B,EAAGzE,EAAGyG,GAEjB,IAAIC,EAAO5B,GAAiBtG,IAAIwB,GAMhC,OALK0G,IACDA,EAAOpR,KAAKgQ,iBAAiBtF,EAAGyE,GACtB,IAANA,GACAK,GAAiB1O,IAAI4J,EAAGyG,EAAUC,KAEnCA,CACV,EACD,UAAAC,CAAW3G,EAAG1F,EAAGmM,GACb,MAAMhC,EAAIO,GAAKhF,GACf,OAAO1K,KAAK2P,KAAKR,EAAGnP,KAAKkR,eAAe/B,EAAGzE,EAAGyG,GAAYnM,EAC7D,EACD,gBAAAsM,CAAiB5G,EAAG1F,EAAGmM,EAAWI,GAC9B,MAAMpC,EAAIO,GAAKhF,GACf,OAAU,IAANyE,EACOnP,KAAK8P,aAAapF,EAAG1F,EAAGuM,GAC5BvR,KAAKgR,WAAW7B,EAAGnP,KAAKkR,eAAe/B,EAAGzE,EAAGyG,GAAYnM,EAAGuM,EACtE,EAID,aAAAC,CAAc9G,EAAGyE,GACbD,GAAUC,EAAGC,GACbK,GAAiB3O,IAAI4J,EAAGyE,GACxBK,GAAiBiC,OAAO/G,EAC3B,EAET,CAWO,SAASgH,GAAUjD,EAAGkD,EAAQ1B,EAAQ2B,GASzC,GA5NJ,SAA2B3B,EAAQxB,GAC/B,IAAK3L,MAAMgF,QAAQmI,GACf,MAAUxP,MAAM,kBACpBwP,EAAO4B,SAAQ,CAACzE,EAAGnM,KACf,KAAMmM,aAAaqB,GACf,MAAUhO,MAAM,0BAA4BQ,EAAE,GAE1D,CAmNI6Q,CAAkB7B,EAAQxB,GAlN9B,SAA4BmD,EAAS7J,GACjC,IAAKjF,MAAMgF,QAAQ8J,GACf,MAAUnR,MAAM,6BACpBmR,EAAQC,SAAQ,CAACE,EAAG9Q,KAChB,IAAK8G,EAAMG,QAAQ6J,GACf,MAAUtR,MAAM,2BAA6BQ,EAAE,GAE3D,CA4MI+Q,CAAmBJ,EAASD,GACxB1B,EAAOlP,SAAW6Q,EAAQ7Q,OAC1B,MAAUN,MAAM,uDACpB,MAAMwR,EAAOxD,EAAE9C,KACT+E,EAAQ3K,EAAO9D,OAAOgO,EAAOlP,SAC7BwO,EAAamB,EAAQ,GAAKA,EAAQ,EAAIA,EAAQ,EAAIA,EAAQ,EAAIA,EAAQ,EAAI,EAC1E5D,GAAQ,GAAKyC,GAAc,EAC3B2C,EAAcpP,MAAMgK,EAAO,GAAG3L,KAAK8Q,GAEzC,IAAIxM,EAAMwM,EACV,IAAK,IAAIhR,EAFQmL,KAAK+F,OAAOR,EAAOjF,KAAO,GAAK6C,GAAcA,EAEvCtO,GAAK,EAAGA,GAAKsO,EAAY,CAC5C2C,EAAQ/Q,KAAK8Q,GACb,IAAK,IAAIG,EAAI,EAAGA,EAAIR,EAAQ7Q,OAAQqR,IAAK,CACrC,MAAMC,EAAST,EAAQQ,GACjB1B,EAAQ7I,OAAQwK,GAAUpQ,OAAOhB,GAAMgB,OAAO6K,IACpDoF,EAAQxB,GAASwB,EAAQxB,GAAOvD,IAAI8C,EAAOmC,GACvD,CACQ,IAAIE,EAAOL,EAEX,IAAK,IAAIG,EAAIF,EAAQnR,OAAS,EAAGwR,EAAON,EAAMG,EAAI,EAAGA,IACjDG,EAAOA,EAAKpF,IAAI+E,EAAQE,IACxBE,EAAOA,EAAKnF,IAAIoF,GAGpB,GADA9M,EAAMA,EAAI0H,IAAImF,GACJ,IAANrR,EACA,IAAK,IAAImR,EAAI,EAAGA,EAAI7C,EAAY6C,IAC5B3M,EAAMA,EAAIsK,QAC1B,CACI,OAAOtK,CACX,CAgFO,SAAS+M,GAAcC,GAY1B,ODhJOtK,ECqIOsK,EAAMxK,GDzIP8D,GAAaoC,QAAO,CAACrF,EAAKvB,KACnCuB,EAAIvB,GAAO,WACJuB,IARK,CACZyD,MAAO,SACPO,KAAM,SACNH,MAAO,gBACPD,KAAM,mBC4IVvE,EAAesK,EAAO,CAClBzN,EAAG,SACH4B,EAAG,SACH8L,GAAI,QACJC,GAAI,SACL,CACC1G,WAAY,gBACZE,YAAa,kBAGVvK,OAAOiL,OAAO,IACdb,GAAQyG,EAAMzN,EAAGyN,EAAMxG,eACvBwG,EACErF,EAAGqF,EAAMxK,GAAGsE,OAEzB;sECvWA,SAASqG,GAAmBC,QACNnO,IAAdmO,EAAKC,MACLpQ,EAAM,OAAQmQ,EAAKC,WACFpO,IAAjBmO,EAAKE,SACLrQ,EAAM,UAAWmQ,EAAKE,QAC9B,CA4BA,MAAQnO,gBAAiBoO,GAAK/O,WAAYgP,IAAQC,EAQrCC,GAAM,CAEfC,IAAK,cAAqB3S,MACtB,WAAAb,CAAY4K,EAAI,IACZzK,MAAMyK,EAClB,GAGI6I,KAAM,CACF7J,OAAQ,CAAC8J,EAAKpN,KACV,MAAQkN,IAAKG,GAAMJ,GACnB,GAAIG,EAAM,GAAKA,EAAM,IACjB,MAAM,IAAIC,EAAE,yBAChB,GAAkB,EAAdrN,EAAKnF,OACL,MAAM,IAAIwS,EAAE,6BAChB,MAAMC,EAAUtN,EAAKnF,OAAS,EACxBkE,EAAMwO,EAAuBD,GACnC,GAAKvO,EAAIlE,OAAS,EAAK,IACnB,MAAM,IAAIwS,EAAE,wCAEhB,MAAMG,EAASF,EAAU,IAAMC,EAAwBxO,EAAIlE,OAAS,EAAK,KAAO,GAEhF,OADU0S,EAAuBH,GACtBI,EAASzO,EAAMiB,CAAI,EAGlC,MAAAyN,CAAOL,EAAKpN,GACR,MAAQkN,IAAKG,GAAMJ,GACnB,IAAI/J,EAAM,EACV,GAAIkK,EAAM,GAAKA,EAAM,IACjB,MAAM,IAAIC,EAAE,yBAChB,GAAIrN,EAAKnF,OAAS,GAAKmF,EAAKkD,OAAWkK,EACnC,MAAM,IAAIC,EAAE,yBAChB,MAAMK,EAAQ1N,EAAKkD,KAEnB,IAAIrI,EAAS,EACb,MAF0B,IAAR6S,GAIb,CAED,MAAMF,EAAiB,IAARE,EACf,IAAKF,EACD,MAAM,IAAIH,EAAE,qDAChB,GAAIG,EAAS,EACT,MAAM,IAAIH,EAAE,4CAChB,MAAMM,EAAc3N,EAAK4N,SAAS1K,EAAKA,EAAMsK,GAC7C,GAAIG,EAAY9S,SAAW2S,EACvB,MAAM,IAAIH,EAAE,yCAChB,GAAuB,IAAnBM,EAAY,GACZ,MAAM,IAAIN,EAAE,wCAChB,IAAK,MAAM1M,KAAKgN,EACZ9S,EAAUA,GAAU,EAAK8F,EAE7B,GADAuC,GAAOsK,EACH3S,EAAS,IACT,MAAM,IAAIwS,EAAE,yCAChC,MAlBgBxS,EAAS6S,EAmBb,MAAMnN,EAAIP,EAAK4N,SAAS1K,EAAKA,EAAMrI,GACnC,GAAI0F,EAAE1F,SAAWA,EACb,MAAM,IAAIwS,EAAE,kCAChB,MAAO,CAAE9M,IAAGsN,EAAG7N,EAAK4N,SAAS1K,EAAMrI,GACtC,GAMLiT,KAAM,CACF,MAAAxK,CAAOjG,GACH,MAAQ6P,IAAKG,GAAMJ,GACnB,GAAI5P,EAAMvB,GACN,MAAM,IAAIuR,EAAE,8CAChB,IAAIlQ,EAAMoQ,EAAuBlQ,GAIjC,GAFkC,EAA9BsE,OAAOoM,SAAS5Q,EAAI,GAAI,MACxBA,EAAM,KAAOA,GACA,EAAbA,EAAItC,OACJ,MAAM,IAAIwS,EAAE,kDAChB,OAAOlQ,CACV,EACD,MAAAsQ,CAAOzN,GACH,MAAQkN,IAAKG,GAAMJ,GACnB,GAAc,IAAVjN,EAAK,GACL,MAAM,IAAIqN,EAAE,uCAChB,GAAgB,IAAZrN,EAAK,MAA2B,IAAVA,EAAK,IAC3B,MAAM,IAAIqN,EAAE,uDAChB,OAAOP,GAAI9M,EACd,GAEL,KAAAgO,CAAM7Q,GAEF,MAAQ+P,IAAKG,EAAGS,KAAMG,EAAKd,KAAMe,GAAQjB,GACnCjN,EAAsB,iBAAR7C,EAAmB4P,GAAI5P,GAAOA,EAClDgR,EAAUnO,GACV,MAAQO,EAAG6N,EAAUP,EAAGQ,GAAiBH,EAAIT,OAAO,GAAMzN,GAC1D,GAAIqO,EAAaxT,OACb,MAAM,IAAIwS,EAAE,+CAChB,MAAQ9M,EAAG+N,EAAQT,EAAGU,GAAeL,EAAIT,OAAO,EAAMW,IAC9C7N,EAAGiO,EAAQX,EAAGY,GAAeP,EAAIT,OAAO,EAAMc,GACtD,GAAIE,EAAW5T,OACX,MAAM,IAAIwS,EAAE,+CAChB,MAAO,CAAEhJ,EAAG4J,EAAIR,OAAOa,GAASzC,EAAGoC,EAAIR,OAAOe,GACjD,EACD,UAAAE,CAAWC,GACP,MAAQxB,KAAMe,EAAKJ,KAAMG,GAAQhB,GAG3B2B,EAFKV,EAAI5K,OAAO,EAAM2K,EAAI3K,OAAOqL,EAAItK,IAChC6J,EAAI5K,OAAO,EAAM2K,EAAI3K,OAAOqL,EAAI9C,IAE3C,OAAOqC,EAAI5K,OAAO,GAAMsL,EAC3B,GAIC9S,GAAMC,OAAO,GAAIC,GAAMD,OAAO,GAAUA,OAAO,GAAG,MAACwH,GAAMxH,OAAO,GAC/D,SAAS8S,GAAkBlC,GAC9B,MAAMmC,EApJV,SAA2BvC,GACvB,MAAMI,EAAOL,GAAcC,GAC3BwC,EAAkBpC,EAAM,CACpBxQ,EAAG,QACHwE,EAAG,SACJ,CACCqO,yBAA0B,QAC1BC,eAAgB,UAChBC,cAAe,WACfC,cAAe,WACfC,mBAAoB,UACpB5G,UAAW,WACXrO,QAAS,aAEb,MAAMkV,KAAEA,EAAItN,GAAEA,EAAE5F,EAAEA,GAAMwQ,EACxB,GAAI0C,EAAM,CACN,IAAKtN,EAAG4C,IAAIxI,EAAG4F,EAAG0D,MACd,MAAUlL,MAAM,8EAEpB,GAAoB,iBAAT8U,GACc,iBAAdA,EAAKC,MACgB,mBAArBD,EAAKE,YACZ,MAAUhV,MAAM,wEAE5B,CACI,OAAOmB,OAAOiL,OAAO,IAAKgG,GAC9B,CA0HkB6C,CAAkB7C,IAC1B5K,GAAEA,GAAO+M,EACTW,EAAKC,GAAUZ,EAAMhQ,EAAGgQ,EAAM/I,YAC9B5L,EAAU2U,EAAM3U,SAC1B,EAAUwV,EAAIC,EAAOC,KACT,MAAM1T,EAAIyT,EAAME,WAChB,OAAOC,EAAepV,WAAWkC,KAAK,CAAC,IAAQkF,EAAG5H,QAAQgC,EAAE8H,GAAIlC,EAAG5H,QAAQgC,EAAE6T,GAChF,GACCxH,EAAYsG,EAAMtG,WACnB,CAACtL,IAEE,MAAM+S,EAAO/S,EAAM0Q,SAAS,GAI5B,MAAO,CAAE3J,EAFClC,EAAGyG,UAAUyH,EAAKrC,SAAS,EAAG7L,EAAG0E,QAE/BuJ,EADFjO,EAAGyG,UAAUyH,EAAKrC,SAAS7L,EAAG0E,MAAO,EAAI1E,EAAG0E,QAEzD,GAKL,SAASyJ,EAAoBjM,GACzB,MAAM9H,EAAEA,EAACwE,EAAEA,GAAMmO,EACXqB,EAAKpO,EAAG6C,IAAIX,GACZmM,EAAKrO,EAAG+C,IAAIqL,EAAIlM,GACtB,OAAOlC,EAAGkF,IAAIlF,EAAGkF,IAAImJ,EAAIrO,EAAG+C,IAAIb,EAAG9H,IAAKwE,EAChD,CAKI,IAAKoB,EAAG4C,IAAI5C,EAAG6C,IAAIkK,EAAMrC,IAAKyD,EAAoBpB,EAAMtC,KACpD,MAAUjS,MAAM,+CAOpB,SAAS8V,EAAuBnW,GAC5B,MAAQ8U,yBAA0BsB,EAAOrK,YAAEA,EAAWgJ,eAAEA,EAAgBnQ,EAAGyR,GAAMzB,EACjF,GAAIwB,GAA0B,iBAARpW,EAAkB,CAIpC,GAHIsW,EAAWtW,KACXA,EAAMuW,EAAcvW,IAEL,iBAARA,IAAqBoW,EAAQI,SAASxW,EAAIW,QACjD,MAAUN,MAAM,uBACpBL,EAAMA,EAAI8C,SAAuB,EAAdiJ,EAAiB,IAChD,CACQ,IAAI5I,EACJ,IACIA,EACmB,iBAARnD,EACDA,EACAyW,EAAmB1R,EAAY,cAAe/E,EAAK+L,GACzE,CACQ,MAAO2K,GACH,MAAUrW,MAAM,wCAA0C0L,EAAc,sBAAwB/L,EAC5G,CAIQ,OAHI+U,IACA5R,EAAMwT,EAAQxT,EAAKkT,IACvBO,EAAY,cAAezT,EAAKrB,GAAKuU,GAC9BlT,CACf,CACI,SAAS0T,EAAeC,GACpB,KAAMA,aAAiBC,GACnB,MAAU1W,MAAM,2BAC5B,CAKI,MAAM2W,EAAexO,GAAS,CAACwE,EAAGiK,KAC9B,MAAQC,GAAInN,EAAGoN,GAAIrB,EAAGsB,GAAIC,GAAMrK,EAEhC,GAAInF,EAAG4C,IAAI4M,EAAGxP,EAAGkD,KACb,MAAO,CAAEhB,IAAG+L,KAChB,MAAMnJ,EAAMK,EAAEL,MAGJ,MAANsK,IACAA,EAAKtK,EAAM9E,EAAGkD,IAAMlD,EAAG2F,IAAI6J,IAC/B,MAAMC,EAAKzP,EAAG+C,IAAIb,EAAGkN,GACfM,EAAK1P,EAAG+C,IAAIkL,EAAGmB,GACfO,EAAK3P,EAAG+C,IAAIyM,EAAGJ,GACrB,GAAItK,EACA,MAAO,CAAE5C,EAAGlC,EAAG0D,KAAMuK,EAAGjO,EAAG0D,MAC/B,IAAK1D,EAAG4C,IAAI+M,EAAI3P,EAAGkD,KACf,MAAU1K,MAAM,oBACpB,MAAO,CAAE0J,EAAGuN,EAAIxB,EAAGyB,EAAI,IAIrBE,EAAkBjP,GAAUwE,IAC9B,GAAIA,EAAEL,MAAO,CAIT,GAAIiI,EAAMM,qBAAuBrN,EAAG8E,IAAIK,EAAEmK,IACtC,OACJ,MAAU9W,MAAM,kBAC5B,CAEQ,MAAM0J,EAAEA,EAAC+L,EAAEA,GAAM9I,EAAE4I,WAEnB,IAAK/N,EAAGC,QAAQiC,KAAOlC,EAAGC,QAAQgO,GAC9B,MAAUzV,MAAM,4BACpB,MAAMqX,EAAO7P,EAAG6C,IAAIoL,GACd6B,EAAQ3B,EAAoBjM,GAClC,IAAKlC,EAAG4C,IAAIiN,EAAMC,GACd,MAAUtX,MAAM,qCACpB,IAAK2M,EAAEgI,gBACH,MAAU3U,MAAM,0CACpB,OAAO,CAAI,IAOf,MAAM0W,EACF,WAAAvX,CAAY0X,EAAIC,EAAIC,GAIhB,GAHAxX,KAAKsX,GAAKA,EACVtX,KAAKuX,GAAKA,EACVvX,KAAKwX,GAAKA,EACA,MAANF,IAAerP,EAAGC,QAAQoP,GAC1B,MAAU7W,MAAM,cACpB,GAAU,MAAN8W,IAAetP,EAAGC,QAAQqP,GAC1B,MAAU9W,MAAM,cACpB,GAAU,MAAN+W,IAAevP,EAAGC,QAAQsP,GAC1B,MAAU/W,MAAM,cACpBmB,OAAOiL,OAAO7M,KAC1B,CAGQ,iBAAOgY,CAAW5K,GACd,MAAMjD,EAAEA,EAAC+L,EAAEA,GAAM9I,GAAK,CAAE,EACxB,IAAKA,IAAMnF,EAAGC,QAAQiC,KAAOlC,EAAGC,QAAQgO,GACpC,MAAUzV,MAAM,wBACpB,GAAI2M,aAAa+J,EACb,MAAU1W,MAAM,gCACpB,MAAMsM,EAAO9L,GAAMgH,EAAG4C,IAAI5J,EAAGgH,EAAG0D,MAEhC,OAAIoB,EAAI5C,IAAM4C,EAAImJ,GACPiB,EAAMxL,KACV,IAAIwL,EAAMhN,EAAG+L,EAAGjO,EAAGkD,IACtC,CACQ,KAAIhB,GACA,OAAOnK,KAAKgW,WAAW7L,CACnC,CACQ,KAAI+L,GACA,OAAOlW,KAAKgW,WAAWE,CACnC,CAOQ,iBAAO+B,CAAWhI,GACd,MAAMiI,EAAQjQ,EAAG6F,YAAYmC,EAAOnH,KAAKsE,GAAMA,EAAEoK,MACjD,OAAOvH,EAAOnH,KAAI,CAACsE,EAAGnM,IAAMmM,EAAE4I,SAASkC,EAAMjX,MAAK6H,IAAIqO,EAAMa,WACxE,CAKQ,cAAOG,CAAQ9U,GACX,MAAMqH,EAAIyM,EAAMa,WAAWtJ,EAAUvJ,EAAY,WAAY9B,KAE7D,OADAqH,EAAE0N,iBACK1N,CACnB,CAEQ,qBAAO2N,CAAeC,GAClB,OAAOnB,EAAM9G,KAAKkI,SAAShC,EAAuB+B,GAC9D,CAEQ,UAAOE,CAAIvI,EAAQ2B,GACf,OAAOF,GAAUyF,EAAOxB,EAAI1F,EAAQ2B,EAChD,CAEQ,cAAA6G,CAAelJ,GACXmJ,EAAKlH,cAAcxR,KAAMuP,EACrC,CAEQ,cAAA6I,GACIP,EAAgB7X,KAC5B,CACQ,QAAA2Y,GACI,MAAMzC,EAAEA,GAAMlW,KAAKgW,WACnB,GAAI/N,EAAG+E,MACH,OAAQ/E,EAAG+E,MAAMkJ,GACrB,MAAUzV,MAAM,8BAC5B,CAIQ,MAAAmY,CAAO1B,GACHD,EAAeC,GACf,MAAQI,GAAIuB,EAAItB,GAAIuB,EAAItB,GAAIuB,GAAO/Y,MAC3BsX,GAAI0B,EAAIzB,GAAI0B,EAAIzB,GAAI0B,GAAOhC,EAC7BiC,EAAKlR,EAAG4C,IAAI5C,EAAG+C,IAAI6N,EAAIK,GAAKjR,EAAG+C,IAAIgO,EAAID,IACvCK,EAAKnR,EAAG4C,IAAI5C,EAAG+C,IAAI8N,EAAII,GAAKjR,EAAG+C,IAAIiO,EAAIF,IAC7C,OAAOI,GAAMC,CACzB,CAIQ,MAAAnK,GACI,OAAO,IAAIkI,EAAMnX,KAAKsX,GAAIrP,EAAGwD,IAAIzL,KAAKuX,IAAKvX,KAAKwX,GAC5D,CAKQ,MAAAzH,GACI,MAAM1N,EAAEA,EAACwE,EAAEA,GAAMmO,EACXqE,EAAKpR,EAAG+C,IAAInE,EAAG4C,KACb6N,GAAIuB,EAAItB,GAAIuB,EAAItB,GAAIuB,GAAO/Y,KACnC,IAAIsZ,EAAKrR,EAAG0D,KAAM4N,EAAKtR,EAAG0D,KAAM6N,EAAKvR,EAAG0D,KACpC8N,EAAKxR,EAAG+C,IAAI6N,EAAIA,GAChBa,EAAKzR,EAAG+C,IAAI8N,EAAIA,GAChBlN,EAAK3D,EAAG+C,IAAI+N,EAAIA,GAChBY,EAAK1R,EAAG+C,IAAI6N,EAAIC,GA4BpB,OA3BAa,EAAK1R,EAAGkF,IAAIwM,EAAIA,GAChBH,EAAKvR,EAAG+C,IAAI6N,EAAIE,GAChBS,EAAKvR,EAAGkF,IAAIqM,EAAIA,GAChBF,EAAKrR,EAAG+C,IAAI3I,EAAGmX,GACfD,EAAKtR,EAAG+C,IAAIqO,EAAIzN,GAChB2N,EAAKtR,EAAGkF,IAAImM,EAAIC,GAChBD,EAAKrR,EAAGiD,IAAIwO,EAAIH,GAChBA,EAAKtR,EAAGkF,IAAIuM,EAAIH,GAChBA,EAAKtR,EAAG+C,IAAIsO,EAAIC,GAChBD,EAAKrR,EAAG+C,IAAI2O,EAAIL,GAChBE,EAAKvR,EAAG+C,IAAIqO,EAAIG,GAChB5N,EAAK3D,EAAG+C,IAAI3I,EAAGuJ,GACf+N,EAAK1R,EAAGiD,IAAIuO,EAAI7N,GAChB+N,EAAK1R,EAAG+C,IAAI3I,EAAGsX,GACfA,EAAK1R,EAAGkF,IAAIwM,EAAIH,GAChBA,EAAKvR,EAAGkF,IAAIsM,EAAIA,GAChBA,EAAKxR,EAAGkF,IAAIqM,EAAIC,GAChBA,EAAKxR,EAAGkF,IAAIsM,EAAI7N,GAChB6N,EAAKxR,EAAG+C,IAAIyO,EAAIE,GAChBJ,EAAKtR,EAAGkF,IAAIoM,EAAIE,GAChB7N,EAAK3D,EAAG+C,IAAI8N,EAAIC,GAChBnN,EAAK3D,EAAGkF,IAAIvB,EAAIA,GAChB6N,EAAKxR,EAAG+C,IAAIY,EAAI+N,GAChBL,EAAKrR,EAAGiD,IAAIoO,EAAIG,GAChBD,EAAKvR,EAAG+C,IAAIY,EAAI8N,GAChBF,EAAKvR,EAAGkF,IAAIqM,EAAIA,GAChBA,EAAKvR,EAAGkF,IAAIqM,EAAIA,GACT,IAAIrC,EAAMmC,EAAIC,EAAIC,EACrC,CAKQ,GAAArM,CAAI+J,GACAD,EAAeC,GACf,MAAQI,GAAIuB,EAAItB,GAAIuB,EAAItB,GAAIuB,GAAO/Y,MAC3BsX,GAAI0B,EAAIzB,GAAI0B,EAAIzB,GAAI0B,GAAOhC,EACnC,IAAIoC,EAAKrR,EAAG0D,KAAM4N,EAAKtR,EAAG0D,KAAM6N,EAAKvR,EAAG0D,KACxC,MAAMtJ,EAAI2S,EAAM3S,EACVgX,EAAKpR,EAAG+C,IAAIgK,EAAMnO,EAAG4C,IAC3B,IAAIgQ,EAAKxR,EAAG+C,IAAI6N,EAAIG,GAChBU,EAAKzR,EAAG+C,IAAI8N,EAAIG,GAChBrN,EAAK3D,EAAG+C,IAAI+N,EAAIG,GAChBS,EAAK1R,EAAGkF,IAAI0L,EAAIC,GAChBc,EAAK3R,EAAGkF,IAAI6L,EAAIC,GACpBU,EAAK1R,EAAG+C,IAAI2O,EAAIC,GAChBA,EAAK3R,EAAGkF,IAAIsM,EAAIC,GAChBC,EAAK1R,EAAGiD,IAAIyO,EAAIC,GAChBA,EAAK3R,EAAGkF,IAAI0L,EAAIE,GAChB,IAAIc,EAAK5R,EAAGkF,IAAI6L,EAAIE,GA+BpB,OA9BAU,EAAK3R,EAAG+C,IAAI4O,EAAIC,GAChBA,EAAK5R,EAAGkF,IAAIsM,EAAI7N,GAChBgO,EAAK3R,EAAGiD,IAAI0O,EAAIC,GAChBA,EAAK5R,EAAGkF,IAAI2L,EAAIC,GAChBO,EAAKrR,EAAGkF,IAAI8L,EAAIC,GAChBW,EAAK5R,EAAG+C,IAAI6O,EAAIP,GAChBA,EAAKrR,EAAGkF,IAAIuM,EAAI9N,GAChBiO,EAAK5R,EAAGiD,IAAI2O,EAAIP,GAChBE,EAAKvR,EAAG+C,IAAI3I,EAAGuX,GACfN,EAAKrR,EAAG+C,IAAIqO,EAAIzN,GAChB4N,EAAKvR,EAAGkF,IAAImM,EAAIE,GAChBF,EAAKrR,EAAGiD,IAAIwO,EAAIF,GAChBA,EAAKvR,EAAGkF,IAAIuM,EAAIF,GAChBD,EAAKtR,EAAG+C,IAAIsO,EAAIE,GAChBE,EAAKzR,EAAGkF,IAAIsM,EAAIA,GAChBC,EAAKzR,EAAGkF,IAAIuM,EAAID,GAChB7N,EAAK3D,EAAG+C,IAAI3I,EAAGuJ,GACfgO,EAAK3R,EAAG+C,IAAIqO,EAAIO,GAChBF,EAAKzR,EAAGkF,IAAIuM,EAAI9N,GAChBA,EAAK3D,EAAGiD,IAAIuO,EAAI7N,GAChBA,EAAK3D,EAAG+C,IAAI3I,EAAGuJ,GACfgO,EAAK3R,EAAGkF,IAAIyM,EAAIhO,GAChB6N,EAAKxR,EAAG+C,IAAI0O,EAAIE,GAChBL,EAAKtR,EAAGkF,IAAIoM,EAAIE,GAChBA,EAAKxR,EAAG+C,IAAI6O,EAAID,GAChBN,EAAKrR,EAAG+C,IAAI2O,EAAIL,GAChBA,EAAKrR,EAAGiD,IAAIoO,EAAIG,GAChBA,EAAKxR,EAAG+C,IAAI2O,EAAID,GAChBF,EAAKvR,EAAG+C,IAAI6O,EAAIL,GAChBA,EAAKvR,EAAGkF,IAAIqM,EAAIC,GACT,IAAItC,EAAMmC,EAAIC,EAAIC,EACrC,CACQ,QAAAM,CAAS5C,GACL,OAAOlX,KAAKmN,IAAI+J,EAAMjI,SAClC,CACQ,GAAAlC,GACI,OAAO/M,KAAK4Y,OAAOzB,EAAMxL,KACrC,CACQ,IAAAgE,CAAK3K,GACD,OAAO0T,EAAKrH,WAAWrR,KAAMgF,EAAGmS,EAAMc,WAClD,CAMQ,cAAA8B,CAAeC,GACX,MAAMzE,KAAEA,EAAMvQ,EAAGyR,GAAMzB,EACvBgC,EAAY,SAAUgD,EAAIhY,GAAKyU,GAC/B,MAAMwD,EAAI9C,EAAMxL,KAChB,GAAIqO,IAAOhY,GACP,OAAOiY,EACX,GAAIja,KAAK+M,OAASiN,IAAO9X,GACrB,OAAOlC,KAEX,IAAKuV,GAAQmD,EAAK9I,eAAe5P,MAC7B,OAAO0Y,EAAKpH,iBAAiBtR,KAAMga,EAAI7C,EAAMc,YAEjD,IAAIiC,MAAEA,EAAKC,GAAEA,EAAEC,MAAEA,EAAKC,GAAEA,GAAO9E,EAAKE,YAAYuE,GAC5CM,EAAML,EACNM,EAAMN,EACN5M,EAAIrN,KACR,KAAOma,EAAKnY,IAAOqY,EAAKrY,IAChBmY,EAAKjY,KACLoY,EAAMA,EAAInN,IAAIE,IACdgN,EAAKnY,KACLqY,EAAMA,EAAIpN,IAAIE,IAClBA,EAAIA,EAAE0C,SACNoK,IAAOjY,GACPmY,IAAOnY,GAOX,OALIgY,IACAI,EAAMA,EAAIrL,UACVmL,IACAG,EAAMA,EAAItL,UACdsL,EAAM,IAAIpD,EAAMlP,EAAG+C,IAAIuP,EAAIjD,GAAI/B,EAAKC,MAAO+E,EAAIhD,GAAIgD,EAAI/C,IAChD8C,EAAInN,IAAIoN,EAC3B,CAUQ,QAAAhC,CAASlG,GACL,MAAMkD,KAAEA,EAAMvQ,EAAGyR,GAAMzB,EAEvB,IAAIc,EAAO0E,EACX,GAFAxD,EAAY,SAAU3E,EAAQnQ,GAAKuU,GAE/BlB,EAAM,CACN,MAAM2E,MAAEA,EAAKC,GAAEA,EAAEC,MAAEA,EAAKC,GAAEA,GAAO9E,EAAKE,YAAYpD,GAClD,IAAMjF,EAAGkN,EAAKxW,EAAG2W,GAAQza,KAAK2P,KAAKwK,IAC7B/M,EAAGmN,EAAKzW,EAAG4W,GAAQ1a,KAAK2P,KAAK0K,GACnCC,EAAM5B,EAAK3J,gBAAgBmL,EAAOI,GAClCC,EAAM7B,EAAK3J,gBAAgBqL,EAAOG,GAClCA,EAAM,IAAIpD,EAAMlP,EAAG+C,IAAIuP,EAAIjD,GAAI/B,EAAKC,MAAO+E,EAAIhD,GAAIgD,EAAI/C,IACvD1B,EAAQwE,EAAInN,IAAIoN,GAChBC,EAAOC,EAAItN,IAAIuN,EAC/B,KACiB,CACD,MAAMtN,EAAEA,EAACtJ,EAAEA,GAAM9D,KAAK2P,KAAK0C,GAC3ByD,EAAQ1I,EACRoN,EAAO1W,CACvB,CAEY,OAAOqT,EAAMc,WAAW,CAACnC,EAAO0E,IAAO,EACnD,CAOQ,oBAAAG,CAAqBtP,EAAGhJ,EAAGwE,GACvB,MAAM+T,EAAIzD,EAAM9G,KACVrF,EAAM,CAACN,EAAGrI,IACVA,IAAML,IAAOK,IAAMH,IAAQwI,EAAEkO,OAAOgC,GAA2BlQ,EAAE6N,SAASlW,GAAjCqI,EAAEqP,eAAe1X,GAC1DoD,EAAMuF,EAAIhL,KAAMqC,GAAG8K,IAAInC,EAAIK,EAAGxE,IACpC,OAAOpB,EAAIsH,WAAQrI,EAAYe,CAC3C,CAIQ,QAAAuQ,CAASqB,GACL,OAAOD,EAAapX,KAAMqX,EACtC,CACQ,aAAAjC,GACI,MAAQxO,EAAGiU,EAAQzF,cAAEA,GAAkBJ,EACvC,GAAI6F,IAAa3Y,GACb,OAAO,EACX,GAAIkT,EACA,OAAOA,EAAc+B,EAAOnX,MAChC,MAAUS,MAAM,+DAC5B,CACQ,aAAA4U,GACI,MAAQzO,EAAGiU,EAAQxF,cAAEA,GAAkBL,EACvC,OAAI6F,IAAa3Y,GACNlC,KACPqV,EACOA,EAAc8B,EAAOnX,MACzBA,KAAK+Z,eAAe/E,EAAMpO,EAC7C,CACQ,UAAAkU,CAAWC,GAAe,GAGtB,OAFArY,EAAM,eAAgBqY,GACtB/a,KAAKoY,iBACE/X,EAAQ8W,EAAOnX,KAAM+a,EACxC,CACQ,KAAAC,CAAMD,GAAe,GAEjB,OADArY,EAAM,eAAgBqY,GACfpE,EAAc3W,KAAK8a,WAAWC,GACjD,EAEI5D,EAAM9G,KAAO,IAAI8G,EAAMnC,EAAMtC,GAAIsC,EAAMrC,GAAI1K,EAAGkD,KAC9CgM,EAAMxL,KAAO,IAAIwL,EAAMlP,EAAG0D,KAAM1D,EAAGkD,IAAKlD,EAAG0D,MAC3C,MAAMsP,EAAQjG,EAAM/I,WACdyM,EAAO/I,GAAKwH,EAAOnC,EAAMO,KAAOnJ,KAAKC,KAAK4O,EAAQ,GAAKA,GAE7D,MAAO,CACHjG,QACAkG,gBAAiB/D,EACjBZ,yBACAH,sBACA+E,mBApZJ,SAA4B5X,GACxB,OAAO6X,EAAW7X,EAAKrB,GAAK8S,EAAMhQ,EAC1C,EAoZA,CAqBO,SAASqW,GAAYC,GACxB,MAAMtG,EArBV,SAAsBvC,GAClB,MAAMI,EAAOL,GAAcC,GAU3B,OATAwC,EAAkBpC,EAAM,CACpBhT,KAAM,OACNiC,KAAM,WACNyZ,YAAa,YACd,CACCC,SAAU,WACVC,cAAe,WACf3I,KAAM,YAEHlR,OAAOiL,OAAO,CAAEiG,MAAM,KAASD,GAC1C,CASkB6I,CAAaJ,IACrBrT,GAAEA,EAAIjD,EAAG2W,GAAgB3G,EACzB4G,EAAgB3T,EAAG0E,MAAQ,EAC3BkP,EAAkB,EAAI5T,EAAG0E,MAAQ,EACvC,SAASmP,EAAKzZ,GACV,OAAO0U,EAAQ1U,EAAGsZ,EAC1B,CACI,SAASI,EAAK1Z,GACV,OAAO2Z,GAAW3Z,EAAGsZ,EAC7B,CACI,MAAQT,gBAAiB/D,EAAKZ,uBAAEA,EAAsBH,oBAAEA,EAAmB+E,mBAAEA,GAAwBpG,GAAkB,IAChHC,EACH,OAAA3U,CAAQwV,EAAIC,EAAOiF,GACf,MAAM1Y,EAAIyT,EAAME,WACV7L,EAAIlC,EAAG5H,QAAQgC,EAAE8H,GACjB8R,EAAMhG,EAEZ,OADAvT,EAAM,eAAgBqY,GAClBA,EACOkB,EAAIpb,WAAWkC,KAAK,CAAC+S,EAAM6C,WAAa,EAAO,IAAQxO,GAGvD8R,EAAIpb,WAAWkC,KAAK,CAAC,IAAQoH,EAAGlC,EAAG5H,QAAQgC,EAAE6T,GAE3D,EACD,SAAAxH,CAAUtL,GACN,MAAM6B,EAAM7B,EAAMrC,OACZmb,EAAO9Y,EAAM,GACb+S,EAAO/S,EAAM0Q,SAAS,GAE5B,GAAI7O,IAAQ2W,GAA2B,IAATM,GAA0B,IAATA,EAoB1C,IAAIjX,IAAQ4W,GAA4B,IAATK,EAAe,CAG/C,MAAO,CAAE/R,EAFClC,EAAGyG,UAAUyH,EAAKrC,SAAS,EAAG7L,EAAG0E,QAE/BuJ,EADFjO,EAAGyG,UAAUyH,EAAKrC,SAAS7L,EAAG0E,MAAO,EAAI1E,EAAG0E,QAEtE,CAIgB,MAAUlM,MAAM,qCAFLmb,EAEiD,qBADjDC,EAC6E,SAAW5W,EACnH,CA7B2E,CAC3D,MAAMkF,EAAI0M,EAAmBV,GAC7B,IAAKiF,EAAWjR,EAAGjI,GAAK+F,EAAGsE,OACvB,MAAU9L,MAAM,yBACpB,MAAM0b,EAAK/F,EAAoBjM,GAC/B,IAAI+L,EACJ,IACIA,EAAIjO,EAAG4F,KAAKsO,EAChC,CACgB,MAAOC,GACH,MAAMC,EAASD,aAAqB3b,MAAQ,KAAO2b,EAAUra,QAAU,GACvE,MAAUtB,MAAM,wBAA0B4b,EAC9D,CAMgB,QAHiC,GAAdH,OAFHhG,EAAIhU,MAASA,MAIzBgU,EAAIjO,EAAGwD,IAAIyK,IACR,CAAE/L,IAAG+L,IAC5B,CAWS,IAECoG,EAAiB/Y,GAAQoT,EAAc4F,EAAmBhZ,EAAKyR,EAAM7I,cAC3E,SAASqQ,EAAsBnS,GAE3B,OAAOA,EADMsR,GAAezZ,EAEpC,CAKI,MAAMua,EAAS,CAAC5V,EAAG9D,EAAMpB,IAAOkV,EAAmBhQ,EAAEK,MAAMnE,EAAMpB,IAIjE,MAAM+a,EACF,WAAA9c,CAAY2K,EAAGwH,EAAG4K,GACd3c,KAAKuK,EAAIA,EACTvK,KAAK+R,EAAIA,EACT/R,KAAK2c,SAAWA,EAChB3c,KAAKoY,gBACjB,CAEQ,kBAAOwE,CAAYvZ,GACf,MAAM0Q,EAAIiB,EAAM7I,YAEhB,OADA9I,EAAM8B,EAAY,mBAAoB9B,EAAS,EAAJ0Q,GACpC,IAAI2I,EAAUD,EAAOpZ,EAAK,EAAG0Q,GAAI0I,EAAOpZ,EAAK0Q,EAAG,EAAIA,GACvE,CAGQ,cAAO8I,CAAQxZ,GACX,MAAMkH,EAAEA,EAACwH,EAAEA,GAAMoB,GAAIe,MAAM/O,EAAY,MAAO9B,IAC9C,OAAO,IAAIqZ,EAAUnS,EAAGwH,EACpC,CACQ,cAAAqG,GACIpB,EAAY,IAAKhX,KAAKuK,EAAGrI,GAAKyZ,GAC9B3E,EAAY,IAAKhX,KAAK+R,EAAG7P,GAAKyZ,EAC1C,CACQ,cAAAmB,CAAeH,GACX,OAAO,IAAID,EAAU1c,KAAKuK,EAAGvK,KAAK+R,EAAG4K,EACjD,CACQ,gBAAAI,CAAiBC,GACb,MAAMzS,EAAGwH,EAAEA,EAAG4K,SAAUM,GAAQjd,KAC1B4G,EAAI6U,EAActW,EAAY,UAAW6X,IAC/C,GAAW,MAAPC,IAAgB,CAAC,EAAG,EAAG,EAAG,GAAGrG,SAASqG,GACtC,MAAUxc,MAAM,uBACpB,MAAMyc,EAAe,IAARD,GAAqB,IAARA,EAAY1S,EAAIyK,EAAMhQ,EAAIuF,EACpD,GAAI2S,GAAQjV,EAAGsE,MACX,MAAU9L,MAAM,8BACpB,MAAM0c,EAAgB,EAANF,EAAwB,KAAP,KAC3BG,EAAIjG,EAAMgB,QAAQgF,EAASb,EAAcY,IACzCG,EAAKtB,EAAKmB,GACVI,EAAKxB,GAAMlV,EAAIyW,GACfE,EAAKzB,EAAK/J,EAAIsL,GACdhS,EAAI8L,EAAM9G,KAAKsK,qBAAqByC,EAAGE,EAAIC,GACjD,IAAKlS,EACD,MAAU5K,MAAM,qBAEpB,OADA4K,EAAE+M,iBACK/M,CACnB,CAEQ,QAAAmS,GACI,OAAOhB,EAAsBxc,KAAK+R,EAC9C,CACQ,UAAA0L,GACI,OAAOzd,KAAKwd,WAAa,IAAId,EAAU1c,KAAKuK,EAAGuR,GAAM9b,KAAK+R,GAAI/R,KAAK2c,UAAY3c,IAC3F,CAEQ,aAAA0d,GACI,OAAOC,EAAc3d,KAAK4d,WACtC,CACQ,QAAAA,GACI,OAAOzK,GAAIyB,WAAW,CAAErK,EAAGvK,KAAKuK,EAAGwH,EAAG/R,KAAK+R,GACvD,CAEQ,iBAAA8L,GACI,OAAOF,EAAc3d,KAAK8d,eACtC,CACQ,YAAAA,GACI,OAAOxB,EAActc,KAAKuK,GAAK+R,EAActc,KAAK+R,EAC9D,EAEI,MAAMgM,EAAQ,CACV,iBAAAC,CAAkB1F,GACd,IAEI,OADA/B,EAAuB+B,IAChB,CACvB,CACY,MAAOxB,GACH,OAAO,CACvB,CACS,EACDP,uBAAwBA,EAKxB0H,iBAAkB,KACd,MAAMld,EAASmd,GAAqBlJ,EAAMhQ,GAC1C,OFpWL,SAAwB5E,EAAKwO,EAAYpC,GAAO,GACnD,MAAMvH,EAAM7E,EAAIW,OACVod,EAAWxP,GAAoBC,GAC/BwP,EAAStP,GAAiBF,GAEhC,GAAI3J,EAAM,IAAMA,EAAMmZ,GAAUnZ,EAAM,KAClC,MAAUxE,MAAM,YAAc2d,EAAS,6BAA+BnZ,GAC1E,MAEMoZ,EAAUxU,EAFJ2C,EAAO5H,EAAgBxE,GAAOyE,EAAgBzE,GAEjCwO,EAAa1M,GAAOA,EAC7C,OAAOsK,EAAOtH,EAAgBmZ,EAASF,GAAYpZ,EAAgBsZ,EAASF,EAChF,CEyVmBG,CAAmBtJ,EAAMuG,YAAYxa,GAASiU,EAAMhQ,EAAE,EAUjEuZ,WAAU,CAAChP,EAAa,EAAGuG,EAAQqB,EAAM9G,QACrCyF,EAAM2C,eAAelJ,GACrBuG,EAAMyC,SAAStW,OAAO,IACf6T,IAef,SAAS0I,EAAU/b,GACf,MAAM2D,EAAMsQ,EAAWjU,GACjB6G,EAAsB,iBAAT7G,EACbwC,GAAOmB,GAAOkD,IAAQ7G,EAAK1B,OACjC,OAAIqF,EACOnB,IAAQ2W,GAAiB3W,IAAQ4W,EACxCvS,EACOrE,IAAQ,EAAI2W,GAAiB3W,IAAQ,EAAI4W,EAChDpZ,aAAgB0U,CAG5B,CAuBI,MAAMqE,EAAWxG,EAAMwG,UACnB,SAAUpY,GAEN,GAAIA,EAAMrC,OAAS,KACf,MAAUN,MAAM,sBAGpB,MAAM8C,EAAMsT,EAAmBzT,GACzBqb,EAAuB,EAAfrb,EAAMrC,OAAaiU,EAAM/I,WACvC,OAAOwS,EAAQ,EAAIlb,GAAOtB,OAAOwc,GAASlb,CAC7C,EACCkY,EAAgBzG,EAAMyG,eACxB,SAAUrY,GACN,OAAO0Y,EAAKN,EAASpY,GACxB,EAECsb,EAAaC,EAAW3J,EAAM/I,YAIpC,SAAS2S,EAAWrb,GAGhB,OAFAyT,EAAY,WAAahC,EAAM/I,WAAY1I,EAAKvB,GAAK0c,GAE9CnC,EAAmBhZ,EAAKyR,EAAM7I,YAC7C,CAMI,SAAS0S,EAAQ7B,EAAS1E,EAAYzF,EAAOiM,GACzC,GAAI,CAAC,YAAa,aAAaC,MAAMrY,GAAMA,KAAKmM,IAC5C,MAAUpS,MAAM,uCACpB,MAAMZ,KAAEA,EAAI0b,YAAEA,GAAgBvG,EAC9B,IAAIlC,KAAEA,EAAIC,QAAEA,EAASiM,aAAcC,GAAQpM,EAC/B,MAARC,IACAA,GAAO,GACXkK,EAAU7X,EAAY,UAAW6X,GACjCpK,GAAmBC,GACfE,IACAiK,EAAU7X,EAAY,oBAAqBtF,EAAKmd,KAIpD,MAAMkC,EAAQzD,EAAcuB,GACtB3P,EAAIkJ,EAAuB+B,GAC3B6G,EAAW,CAACP,EAAWvR,GAAIuR,EAAWM,IAE5C,GAAW,MAAPD,IAAuB,IAARA,EAAe,CAE9B,MAAM3Z,GAAY,IAAR2Z,EAAe1D,EAAYtT,EAAG0E,OAASsS,EACjDE,EAAShY,KAAKhC,EAAY,eAAgBG,GACtD,CACQ,MAAMyB,EAAOkP,KAAkBkJ,GACzB3U,EAAI0U,EA0BV,MAAO,CAAEnY,OAAMqY,MAxBf,SAAeC,GAEX,MAAM3Y,EAAI8U,EAAS6D,GACnB,IAAKlE,EAAmBzU,GACpB,OACJ,MAAM4Y,EAAKvD,EAAKrV,GACV6Y,EAAIpI,EAAM9G,KAAKkI,SAAS7R,GAAGsP,WAC3BzL,EAAIuR,EAAKyD,EAAEpV,GACjB,GAAII,IAAMvI,GACN,OAIJ,MAAM+P,EAAI+J,EAAKwD,EAAKxD,EAAKtR,EAAID,EAAI8C,IACjC,GAAI0E,IAAM/P,GACN,OACJ,IAAI2a,GAAY4C,EAAEpV,IAAMI,EAAI,EAAI,GAAK1C,OAAO0X,EAAErJ,EAAIhU,IAC9Csd,EAAQzN,EAKZ,OAJIe,GAAQ0J,EAAsBzK,KAC9ByN,EArOZ,SAAoBzN,GAChB,OAAOyK,EAAsBzK,GAAK+J,GAAM/J,GAAKA,CACrD,CAmOwB0L,CAAW1L,GACnB4K,GAAY,GAET,IAAID,EAAUnS,EAAGiV,EAAO7C,EAC3C,EAEA,CACI,MAAMmC,EAAiB,CAAEhM,KAAMkC,EAAMlC,KAAMC,SAAS,GAC9C0M,EAAiB,CAAE3M,KAAMkC,EAAMlC,KAAMC,SAAS,GAiGpD,OA5EAoE,EAAM9G,KAAKoI,eAAe,GA4EnB,CACHzD,QACA0K,aA9NJ,SAAsBpH,EAAYyC,GAAe,GAC7C,OAAO5D,EAAMkB,eAAeC,GAAYwC,WAAWC,EAC3D,EA6NQ4E,gBAnMJ,SAAyBC,EAAUC,EAAS9E,GAAe,GACvD,GAAIyD,EAAUoB,GACV,MAAUnf,MAAM,iCACpB,IAAK+d,EAAUqB,GACX,MAAUpf,MAAM,iCAEpB,OADU0W,EAAMgB,QAAQ0H,GACftH,SAAShC,EAAuBqJ,IAAW9E,WAAWC,EACvE,EA6LQ+E,KAvFJ,SAAc9C,EAAS+C,EAASlN,EAAOiM,GACnC,MAAM/X,KAAEA,EAAIqY,MAAEA,GAAUP,EAAQ7B,EAAS+C,EAASlN,GAC5CmN,EAAIhL,EAEV,OADaiL,EAAkBD,EAAEngB,KAAKc,UAAWqf,EAAE7T,YAAa6T,EAAEle,KAC3Doe,CAAKnZ,EAAMqY,EAC1B,EAmFQe,OAlEJ,SAAgBC,EAAWpD,EAASqD,EAAWxN,EAAO4M,GAClD,MAAMa,EAAKF,EACXpD,EAAU7X,EAAY,UAAW6X,GACjCqD,EAAYlb,EAAY,YAAakb,GACrC,MAAMvN,KAAEA,EAAIC,QAAEA,EAAOwN,OAAEA,GAAW1N,EAGlC,GADAD,GAAmBC,GACf,WAAYA,EACZ,MAAUpS,MAAM,sCACpB,QAAeiE,IAAX6b,GAAmC,YAAXA,GAAmC,QAAXA,EAChD,MAAU9f,MAAM,iCACpB,MAAM+f,EAAsB,iBAAPF,GAAmB5J,EAAW4J,GAC7CG,GAASD,IACVD,GACa,iBAAPD,GACA,OAAPA,GACgB,iBAATA,EAAG/V,GACM,iBAAT+V,EAAGvO,EACd,IAAKyO,IAAUC,EACX,MAAUhgB,MAAM,4EACpB,IAAIigB,EACAhW,EACJ,IAGI,GAFI+V,IACAC,EAAO,IAAIhE,EAAU4D,EAAG/V,EAAG+V,EAAGvO,IAC9ByO,EAAO,CAGP,IACmB,YAAXD,IACAG,EAAOhE,EAAUG,QAAQyD,GACjD,CACgB,MAAOK,GACH,KAAMA,aAAoBxN,GAAIC,KAC1B,MAAMuN,CAC9B,CACqBD,GAAmB,QAAXH,IACTG,EAAOhE,EAAUE,YAAY0D,GACjD,CACY5V,EAAIyM,EAAMgB,QAAQkI,EAC9B,CACQ,MAAOvJ,GACH,OAAO,CACnB,CACQ,IAAK4J,EACD,OAAO,EACX,GAAI5N,GAAQ4N,EAAKlD,WACb,OAAO,EACPzK,IACAiK,EAAUhI,EAAMnV,KAAKmd,IACzB,MAAMzS,EAAEA,EAACwH,EAAEA,GAAM2O,EACX9Z,EAAI6U,EAAcuB,GAClB4D,EAAK7E,EAAKhK,GACVuL,EAAKxB,EAAKlV,EAAIga,GACdrD,EAAKzB,EAAKvR,EAAIqW,GACdxD,EAAIjG,EAAM9G,KAAKsK,qBAAqBjQ,EAAG4S,EAAIC,IAAKvH,WACtD,QAAKoH,GAEKtB,EAAKsB,EAAEjT,KACJI,CACrB,EAOQ2Q,gBAAiB/D,EACjBuF,YACAqB,QAER;sECngCO,SAAS8C,GAAQhhB,GACpB,MAAO,CACHA,OACAiC,KAAM,CAAC1B,KAAQ0gB,IAAShf,EAAKjC,EAAMO,EAAKmF,KAAeub,IACvDvF,cAER,CACO,SAASwF,GAAYzF,EAAU0F,GAClC,MAAMzgB,EAAUV,GAASwb,GAAY,IAAKC,KAAauF,GAAQhhB,KAC/D,OAAO+B,OAAOiL,OAAO,IAAKtM,EAAOygB,GAAUzgB,UAC/C;sED+IgF0B,OAAO,GEtJvF,MAAMgf,GAAQ3U,GAAMrK,OAAO,uEAIdif,GAAOH,GAAY,CAC5B1e,EAJY4e,GAAM1gB,OAAO0B,OAAO,OAKhC4E,EAJY5E,OAAO,sEAKnBgG,GAAIgZ,GAEJjc,EAAG/C,OAAO,sEAEVyQ,GAAIzQ,OAAO,sEACX0Q,GAAI1Q,OAAO,sEACX2E,EAAG3E,OAAO,GACV6Q,MAAM,GACPqO,GCZGC,GAAQ9U,GADJrK,OAAO,uGAMJof,GAAON,GAAY,CAC5B1e,EALY+e,GAAM7gB,OAAO0B,OAAO,OAMhC4E,EAJY5E,OAAO,sGAKnBgG,GAAImZ,GAEJpc,EAAG/C,OAAO,sGAEVyQ,GAAIzQ,OAAO,sGACX0Q,GAAI1Q,OAAO,sGACX2E,EAAG3E,OAAO,GACV6Q,MAAM,GACPwO,GCfGC,GAAQjV,GADJrK,OAAO,0IAEX+S,GAAQ,CACV3S,EAAGkf,GAAMhhB,OAAO0B,OAAO,OACvB4E,EAAG5E,OAAO,0IACVgG,GAAIsZ,GACJvc,EAAG/C,OAAO,0IACVyQ,GAAIzQ,OAAO,0IACX0Q,GAAI1Q,OAAO,0IACX2E,EAAG3E,OAAO,IAGDuf,GAAOT,GAAY,CAC5B1e,EAAG2S,GAAM3S,EACTwE,EAAGmO,GAAMnO,EACToB,GAAIsZ,GAEJvc,EAAGgQ,GAAMhQ,EACT0N,GAAIsC,GAAMtC,GACVC,GAAIqC,GAAMrC,GACV/L,EAAGoO,GAAMpO,EACTkM,MAAM,EACNoC,yBAA0B,CAAC,IAAK,IAAK,MACtCuM,GC1BGzf,GAAMC,OAAO,GAAIC,GAAMD,OAAO,GAAIE,GAAMF,OAAO,GAAI2H,GAAM3H,OAAO,GAEhEyf,GAAiB,CAAEC,QAAQ,GAwB1B,SAASC,GAAetG,GAC3B,MAAMtG,EAxBV,SAAsBvC,GAClB,MAAMI,EAAOL,GAAcC,GAa3B,OAZAwC,EAAkBxC,EAAO,CACrB5S,KAAM,WACNwC,EAAG,SACHgL,EAAG,SACHkO,YAAa,YACd,CACCsG,kBAAmB,WACnBC,OAAQ,WACRC,QAAS,WACTC,WAAY,aAGTpgB,OAAOiL,OAAO,IAAKgG,GAC9B,CASkB6I,CAAaJ,IACrBrT,GAAEA,EAAIjD,EAAG2W,EAAa5I,QAASA,EAASlT,KAAMoiB,EAAK1G,YAAEA,EAAWpP,YAAEA,EAAavF,EAAGiU,GAAc7F,EAKhGlI,EAAO3K,IAAQF,OAAqB,EAAdkK,GAAmBjK,GACzCggB,EAAOja,EAAG1H,OACVoV,EAAKrJ,GAAM0I,EAAMhQ,EAAGgQ,EAAM/I,YAE1B8V,EAAU/M,EAAM+M,SAC1B,EAAUzX,EAAG7D,KACD,IACI,MAAO,CAAEyB,SAAS,EAAMtF,MAAOqF,EAAG4F,KAAKvD,EAAIrC,EAAG2F,IAAInH,IAClE,CACY,MAAOnB,GACH,MAAO,CAAE4C,SAAS,EAAOtF,MAAOZ,GAChD,CACS,GACC6f,EAAoB7M,EAAM6M,mBAAsB,CAACze,GAAUA,GAC3D0e,EAAS9M,EAAM8M,QACzB,EAAU5b,EAAMic,EAAKC,KAET,GADA1f,EAAM,SAAU0f,GACZD,EAAIphB,QAAUqhB,EACd,MAAU3hB,MAAM,uCACpB,OAAOyF,CACV,GAGL,SAASmc,EAAY1f,EAAOqC,GACxBgS,EAAY,cAAgBrU,EAAOqC,EAAGhD,GAAK8K,EACnD,CACI,SAASwV,EAAYpL,GACjB,KAAMA,aAAiBC,GACnB,MAAU1W,MAAM,yBAC5B,CAGI,MAAM2W,EAAexO,GAAS,CAACwE,EAAGiK,KAC9B,MAAQkL,GAAIpY,EAAGqY,GAAItM,EAAGuM,GAAIhL,GAAMrK,EAC1BL,EAAMK,EAAEL,MACJ,MAANsK,IACAA,EAAKtK,EAAMnD,GAAM3B,EAAG2F,IAAI6J,IAC5B,MAAMC,EAAKwK,EAAK/X,EAAIkN,GACdM,EAAKuK,EAAKhM,EAAImB,GACdO,EAAKsK,EAAKzK,EAAIJ,GACpB,GAAItK,EACA,MAAO,CAAE5C,EAAGnI,GAAKkU,EAAGhU,IACxB,GAAI0V,IAAO1V,GACP,MAAUzB,MAAM,oBACpB,MAAO,CAAE0J,EAAGuN,EAAIxB,EAAGyB,EAAI,IAErBE,EAAkBjP,GAAUwE,IAC9B,MAAM/K,EAAEA,EAACgL,EAAEA,GAAM2H,EACjB,GAAI5H,EAAEL,MACF,MAAUtM,MAAM,mBAGpB,MAAQ8hB,GAAIG,EAAGF,GAAIG,EAAGF,GAAIlX,EAAGqX,GAAIC,GAAMzV,EACjC4L,EAAKkJ,EAAKQ,EAAIA,GACdzJ,EAAKiJ,EAAKS,EAAIA,GACdzJ,EAAKgJ,EAAK3W,EAAIA,GACduX,EAAKZ,EAAKhJ,EAAKA,GACf6J,EAAMb,EAAKlJ,EAAK3W,GAGtB,GAFa6f,EAAKhJ,EAAKgJ,EAAKa,EAAM9J,MACpBiJ,EAAKY,EAAKZ,EAAK7U,EAAI6U,EAAKlJ,EAAKC,KAEvC,MAAUxY,MAAM,yCAIpB,GAFWyhB,EAAKQ,EAAIC,KACTT,EAAK3W,EAAIsX,GAEhB,MAAUpiB,MAAM,yCACpB,OAAO,CAAI,IAIf,MAAM0W,EACF,WAAAvX,CAAY2iB,EAAIC,EAAIC,EAAIG,GACpB5iB,KAAKuiB,GAAKA,EACVviB,KAAKwiB,GAAKA,EACVxiB,KAAKyiB,GAAKA,EACVziB,KAAK4iB,GAAKA,EACVP,EAAY,IAAKE,GACjBF,EAAY,IAAKG,GACjBH,EAAY,IAAKI,GACjBJ,EAAY,IAAKO,GACjBhhB,OAAOiL,OAAO7M,KAC1B,CACQ,KAAImK,GACA,OAAOnK,KAAKgW,WAAW7L,CACnC,CACQ,KAAI+L,GACA,OAAOlW,KAAKgW,WAAWE,CACnC,CACQ,iBAAO8B,CAAW5K,GACd,GAAIA,aAAa+J,EACb,MAAU1W,MAAM,8BACpB,MAAM0J,EAAEA,EAAC+L,EAAEA,GAAM9I,GAAK,CAAE,EAGxB,OAFAiV,EAAY,IAAKlY,GACjBkY,EAAY,IAAKnM,GACV,IAAIiB,EAAMhN,EAAG+L,EAAGhU,GAAKggB,EAAK/X,EAAI+L,GACjD,CACQ,iBAAO+B,CAAWhI,GACd,MAAMiI,EAAQjQ,EAAG6F,YAAYmC,EAAOnH,KAAKsE,GAAMA,EAAEqV,MACjD,OAAOxS,EAAOnH,KAAI,CAACsE,EAAGnM,IAAMmM,EAAE4I,SAASkC,EAAMjX,MAAK6H,IAAIqO,EAAMa,WACxE,CAEQ,UAAOQ,CAAIvI,EAAQ2B,GACf,OAAOF,GAAUyF,EAAOxB,EAAI1F,EAAQ2B,EAChD,CAEQ,cAAA6G,CAAelJ,GACXmJ,EAAKlH,cAAcxR,KAAMuP,EACrC,CAGQ,cAAA6I,GACIP,EAAgB7X,KAC5B,CAEQ,MAAA4Y,CAAO1B,GACHoL,EAAYpL,GACZ,MAAQqL,GAAI1J,EAAI2J,GAAI1J,EAAI2J,GAAI1J,GAAO/Y,MAC3BuiB,GAAIvJ,EAAIwJ,GAAIvJ,EAAIwJ,GAAIvJ,GAAOhC,EAC7B8L,EAAOd,EAAKrJ,EAAKK,GACjB+J,EAAOf,EAAKlJ,EAAKD,GACjBmK,EAAOhB,EAAKpJ,EAAKI,GACjBiK,EAAOjB,EAAKjJ,EAAKF,GACvB,OAAOiK,IAASC,GAAQC,IAASC,CAC7C,CACQ,GAAApW,GACI,OAAO/M,KAAK4Y,OAAOzB,EAAMxL,KACrC,CACQ,MAAAsD,GAEI,OAAO,IAAIkI,EAAM+K,GAAMliB,KAAKuiB,IAAKviB,KAAKwiB,GAAIxiB,KAAKyiB,GAAIP,GAAMliB,KAAK4iB,IAC1E,CAIQ,MAAA7S,GACI,MAAM1N,EAAEA,GAAM2S,GACNuN,GAAI1J,EAAI2J,GAAI1J,EAAI2J,GAAI1J,GAAO/Y,KAC7B4D,EAAIse,EAAKrJ,EAAKA,GACduK,EAAIlB,EAAKpJ,EAAKA,GACdkH,EAAIkC,EAAK/f,GAAM+f,EAAKnJ,EAAKA,IACzBsK,EAAInB,EAAK7f,EAAIuB,GACb0f,EAAOzK,EAAKC,EACZvF,EAAI2O,EAAKA,EAAKoB,EAAOA,GAAQ1f,EAAIwf,GACjCxI,EAAIyI,EAAID,EACRvf,EAAI+W,EAAIoF,EACRuD,EAAIF,EAAID,EACR9J,EAAK4I,EAAK3O,EAAI1P,GACd0V,EAAK2I,EAAKtH,EAAI2I,GACdC,EAAKtB,EAAK3O,EAAIgQ,GACd/J,EAAK0I,EAAKre,EAAI+W,GACpB,OAAO,IAAIzD,EAAMmC,EAAIC,EAAIC,EAAIgK,EACzC,CAIQ,GAAArW,CAAI+J,GACAoL,EAAYpL,GACZ,MAAM7U,EAAEA,EAACgL,EAAEA,GAAM2H,GACTuN,GAAI1J,EAAI2J,GAAI1J,EAAI2J,GAAI1J,EAAI6J,GAAIa,GAAOzjB,MACnCuiB,GAAIvJ,EAAIwJ,GAAIvJ,EAAIwJ,GAAIvJ,EAAI0J,GAAIc,GAAOxM,EAK3C,GAAI7U,IAAMJ,QAAQ,GAAI,CAClB,MAAM2B,EAAIse,GAAMpJ,EAAKD,IAAOI,EAAKD,IAC3BoK,EAAIlB,GAAMpJ,EAAKD,IAAOI,EAAKD,IAC3BnV,EAAIqe,EAAKkB,EAAIxf,GACnB,GAAIC,IAAM7B,GACN,OAAOhC,KAAK+P,SAChB,MAAMiQ,EAAIkC,EAAKnJ,EAAK5W,GAAMuhB,GACpBL,EAAInB,EAAKuB,EAAKthB,GAAM+W,GACpB3F,EAAI8P,EAAIrD,EACRpF,EAAIwI,EAAIxf,EACR2f,EAAIF,EAAIrD,EACR1G,EAAK4I,EAAK3O,EAAI1P,GACd0V,EAAK2I,EAAKtH,EAAI2I,GACdC,EAAKtB,EAAK3O,EAAIgQ,GACd/J,EAAK0I,EAAKre,EAAI+W,GACpB,OAAO,IAAIzD,EAAMmC,EAAIC,EAAIC,EAAIgK,EAC7C,CACY,MAAM5f,EAAIse,EAAKrJ,EAAKG,GACdoK,EAAIlB,EAAKpJ,EAAKG,GACd+G,EAAIkC,EAAKuB,EAAKpW,EAAIqW,GAClBL,EAAInB,EAAKnJ,EAAKG,GACd3F,EAAI2O,GAAMrJ,EAAKC,IAAOE,EAAKC,GAAMrV,EAAIwf,GACrCvf,EAAIwf,EAAIrD,EACRpF,EAAIyI,EAAIrD,EACRuD,EAAIrB,EAAKkB,EAAI/gB,EAAIuB,GACjB0V,EAAK4I,EAAK3O,EAAI1P,GACd0V,EAAK2I,EAAKtH,EAAI2I,GACdC,EAAKtB,EAAK3O,EAAIgQ,GACd/J,EAAK0I,EAAKre,EAAI+W,GACpB,OAAO,IAAIzD,EAAMmC,EAAIC,EAAIC,EAAIgK,EACzC,CACQ,QAAA1J,CAAS5C,GACL,OAAOlX,KAAKmN,IAAI+J,EAAMjI,SAClC,CACQ,IAAAU,CAAK3K,GACD,OAAO0T,EAAKrH,WAAWrR,KAAMgF,EAAGmS,EAAMc,WAClD,CAEQ,QAAAM,CAASlG,GACL,MAAMrN,EAAIqN,EACV2E,EAAY,SAAUhS,EAAG9C,GAAKyZ,GAC9B,MAAMvO,EAAEA,EAACtJ,GAAQ9D,KAAK2P,KAAK3K,GAC3B,OAAOmS,EAAMc,WAAW,CAAC7K,EAAGtJ,IAAI,EAC5C,CAMQ,cAAAiW,CAAe1H,EAAQjE,EAAM+I,EAAMxL,MAC/B,MAAM3G,EAAIqN,EAEV,OADA2E,EAAY,SAAUhS,EAAGhD,GAAK2Z,GAC1B3W,IAAMhD,GACCiY,EACPja,KAAK+M,OAAS/H,IAAM9C,GACblC,KACJ0Y,EAAKpH,iBAAiBtR,KAAMgF,EAAGmS,EAAMc,WAAY7J,EACpE,CAKQ,YAAAuV,GACI,OAAO3jB,KAAK+Z,eAAec,GAAU9N,KACjD,CAGQ,aAAAqI,GACI,OAAOsD,EAAK5I,aAAa9P,KAAM2b,GAAa5O,KACxD,CAGQ,QAAAiJ,CAASqB,GACL,OAAOD,EAAapX,KAAMqX,EACtC,CACQ,aAAAhC,GACI,MAAQzO,EAAGiU,GAAa7F,EACxB,OAAI6F,IAAa3Y,GACNlC,KACJA,KAAK+Z,eAAec,EACvC,CAGQ,cAAO1C,CAAQ9U,EAAKse,GAAS,GACzB,MAAMtU,EAAEA,EAAChL,EAAEA,GAAM2S,EACX/P,EAAMgD,EAAG0E,MACftJ,EAAM8B,EAAY,WAAY9B,EAAK4B,GACnCvC,EAAM,SAAUif,GAChB,MAAMiC,EAASvgB,EAAI6D,QACb2c,EAAWxgB,EAAI4B,EAAM,GAC3B2e,EAAO3e,EAAM,IAAgB,IAAX4e,EAClB,MAAM3N,EAAI4N,EAAmBF,GAKvB/d,EAAM8b,EAAS7U,EAAO7E,EAAGsE,MAC/ByK,EAAY,aAAcd,EAAGlU,GAAK6D,GAGlC,MAAMsW,EAAK+F,EAAKhM,EAAIA,GACd5L,EAAI4X,EAAK/F,EAAKja,IACduE,EAAIyb,EAAK7U,EAAI8O,EAAK9Z,GACxB,IAAI6F,QAAEA,EAAStF,MAAOuH,GAAM4X,EAAQzX,EAAG7D,GACvC,IAAKyB,EACD,MAAUzH,MAAM,uCACpB,MAAMsjB,GAAU5Z,EAAIjI,MAASA,GACvB8hB,KAA4B,IAAXH,GACvB,IAAKlC,GAAUxX,IAAMnI,IAAOgiB,EAExB,MAAUvjB,MAAM,gCAGpB,OAFIujB,IAAkBD,IAClB5Z,EAAI+X,GAAM/X,IACPgN,EAAMa,WAAW,CAAE7N,IAAG+L,KACzC,CACQ,qBAAOmC,CAAe0H,GAClB,OAAOkE,EAAqBlE,GAASjK,KACjD,CACQ,UAAAgF,GACI,MAAM3Q,EAAEA,EAAC+L,EAAEA,GAAMlW,KAAKgW,WAChB5S,EAAQ8gB,EAAmBhO,EAAGjO,EAAG0E,OAEvC,OADAvJ,EAAMA,EAAMrC,OAAS,IAAMoJ,EAAIjI,GAAM,IAAO,EACrCkB,CACnB,CACQ,KAAA4X,GACI,OAAOrE,EAAc3W,KAAK8a,aACtC,EAEI3D,EAAM9G,KAAO,IAAI8G,EAAMnC,EAAMtC,GAAIsC,EAAMrC,GAAIzQ,GAAKggB,EAAKlN,EAAMtC,GAAKsC,EAAMrC,KACtEwE,EAAMxL,KAAO,IAAIwL,EAAMnV,GAAKE,GAAKA,GAAKF,IACtC,MAAQqO,KAAMuK,EAAGjP,KAAMsO,GAAM9C,EACvBuB,EAAO/I,GAAKwH,EAAqB,EAAdhL,GACzB,SAAS2P,EAAKzZ,GACV,OAAOwH,EAAIxH,EAAGsZ,EACtB,CAEI,SAASwI,EAAQtkB,GACb,OAAOic,EAAKgI,EAAmBjkB,GACvC,CAEI,SAASokB,EAAqB7jB,GAC1B,MAAM6E,EAAMgD,EAAG0E,MACfvM,EAAM+E,EAAY,cAAe/E,EAAK6E,GAGtC,MAAMmf,EAASjf,EAAY,qBAAsB8c,EAAM7hB,GAAM,EAAI6E,GAC3DiX,EAAO2F,EAAkBuC,EAAOld,MAAM,EAAGjC,IACzCkY,EAASiH,EAAOld,MAAMjC,EAAK,EAAIA,GAC/BoN,EAAS8R,EAAQjI,GACjBpG,EAAQ8E,EAAErC,SAASlG,GACnBgS,EAAavO,EAAMgF,aACzB,MAAO,CAAEoB,OAAMiB,SAAQ9K,SAAQyD,QAAOuO,aAC9C,CAMI,SAASC,EAAmBC,EAAU,IAAI1jB,cAAiBigB,GACvD,MAAM0D,EAAMvO,KAAkB6K,GAC9B,OAAOqD,EAAQlC,EAAMH,EAAO0C,EAAKrf,EAAY,UAAWof,KAAYxR,IAC5E,CAeI,MAAM0R,EAAa/C,GAoCnB9G,EAAEnC,eAAe,GAiBjB,MAAO,CACHzD,QACA0K,aA7EJ,SAAsBK,GAClB,OAAOkE,EAAqBlE,GAASsE,UAC7C,EA4EQvE,KArEJ,SAAc0E,EAAKzE,EAAS2E,EAAU,CAAA,GAClCF,EAAMrf,EAAY,UAAWqf,GACzBzR,IACAyR,EAAMzR,EAAQyR,IAClB,MAAMrH,OAAEA,EAAM9K,OAAEA,EAAMgS,WAAEA,GAAeJ,EAAqBlE,GACtDxV,EAAI+Z,EAAmBI,EAAQH,QAASpH,EAAQqH,GAChDpH,EAAIxC,EAAErC,SAAShO,GAAGuQ,aAElB/I,EAAI+J,EAAKvR,EADL+Z,EAAmBI,EAAQH,QAASnH,EAAGiH,EAAYG,GACtCnS,GAGvB,OAFA2E,EAAY,cAAejF,EAAG/P,GAAK2Z,GAE5BxW,EAAY,SADP8Q,EAAemH,EAAG8G,EAAmBnS,EAAG9J,EAAG0E,QACV,EAAX1E,EAAG0E,MAC7C,EA0DQwT,OApDJ,SAAgBtL,EAAK2P,EAAKnE,EAAWqE,EAAUD,GAC3C,MAAMF,QAAEA,EAAO5C,OAAEA,GAAW+C,EACtBzf,EAAMgD,EAAG0E,MACfkI,EAAM1P,EAAY,YAAa0P,EAAK,EAAI5P,GACxCuf,EAAMrf,EAAY,UAAWqf,GAC7BnE,EAAYlb,EAAY,YAAakb,EAAWpb,QACjCP,IAAXid,GACAjf,EAAM,SAAUif,GAChB5O,IACAyR,EAAMzR,EAAQyR,IAClB,MAAMzS,EAAI+R,EAAmBjP,EAAI3N,MAAMjC,EAAK,EAAIA,IAChD,IAAIrB,EAAGwZ,EAAGuH,EACV,IAII/gB,EAAIuT,EAAMgB,QAAQkI,EAAWsB,GAC7BvE,EAAIjG,EAAMgB,QAAQtD,EAAI3N,MAAM,EAAGjC,GAAM0c,GACrCgD,EAAK/J,EAAEb,eAAehI,EAClC,CACQ,MAAO+E,GACH,OAAO,CACnB,CACQ,IAAK6K,GAAU/d,EAAE+f,eACb,OAAO,EACX,MAAMjd,EAAI4d,EAAmBC,EAASnH,EAAEtC,aAAclX,EAAEkX,aAAc0J,GAItE,OAHYpH,EAAEjQ,IAAIvJ,EAAEmW,eAAerT,IAGxBoT,SAAS6K,GAAItP,gBAAgBuD,OAAOzB,EAAMxL,KAC7D,EAuBQiZ,cAAezN,EACf4G,MAtBU,CACVkG,uBAEAhG,iBAAkB,IAAM1C,EAAYtT,EAAG0E,OAOvC4R,WAAU,CAAChP,EAAa,EAAGuG,EAAQqB,EAAM9G,QACrCyF,EAAM2C,eAAelJ,GACrBuG,EAAMyC,SAAStW,OAAO,IACf6T,IAWnB;sECxbA,MAAM9T,GAAMC,OAAO,GACbC,GAAMD,OAAO,GAiBZ,SAAS4iB,GAAWvJ,GACvB,MAAMtG,GAhBN7M,EADkBsK,EAiBS6I,EAhBL,CAClBjZ,EAAG,UACJ,CACCyiB,eAAgB,gBAChB3Y,YAAa,gBACb0V,kBAAmB,WACnBC,OAAQ,WACRiD,WAAY,WACZC,GAAI,WAGDpjB,OAAOiL,OAAO,IAAK4F,KAZ9B,IAAsBA,EAkBlB,MAAM/H,EAAEA,GAAMsK,EACRkN,EAAQld,GAAM6E,EAAI7E,EAAG0F,GACrBoa,EAAiB9P,EAAM8P,eACvBG,EAAkB7Y,KAAKC,KAAKyY,EAAiB,GAC7C3G,EAAWnJ,EAAM7I,YACjB0V,EAAoB7M,EAAM6M,mBAAiB,CAAMze,GAAUA,GAC3D2hB,EAAa/P,EAAM+P,YAAU,CAAM5a,GAAMJ,GAAII,EAAGO,EAAIzI,OAAO,GAAIyI,IAWrE,SAASwa,EAAMC,EAAMC,EAAKC,GACtB,MAAMC,EAAQpD,EAAKiD,GAAQC,EAAMC,IAGjC,MAAO,CAFPD,EAAMlD,EAAKkD,EAAME,GACjBD,EAAMnD,EAAKmD,EAAMC,GAEzB,CAGI,MAAMC,GAAOvQ,EAAM3S,EAAIJ,OAAO,IAAMA,OAAO,GA2D3C,SAASujB,EAAkBlb,GACvB,OAAOpF,EAAgBgd,EAAK5X,GAAI2a,EACxC,CAkBI,SAASQ,EAAWpT,EAAQ/H,GACxB,MAAMob,EAlBV,SAA2BC,GAGvB,MAAMrb,EAAInF,EAAY,eAAgBwgB,EAAMV,GAG5C,OAFiB,KAAb9G,IACA7T,EAAE,KAAO,KACNzF,EAAgByF,EAC/B,CAWuBsb,CAAkBtb,GAE3Bub,EA3EV,SAA0Bvb,EAAG+H,GACzBvM,EAAS,IAAKwE,EAAGtI,GAAK0I,GACtB5E,EAAS,SAAUuM,EAAQrQ,GAAK0I,GAGhC,MAAMhE,EAAI2L,EACJyT,EAAMxb,EACZ,IAKIyb,EALAX,EAAMljB,GACN8jB,EAAMhkB,GACNqjB,EAAM/a,EACN2b,EAAM/jB,GACNijB,EAAOnjB,GAEX,IAAK,IAAIkkB,EAAIjkB,OAAO6iB,EAAiB,GAAIoB,GAAKlkB,GAAKkkB,IAAK,CACpD,MAAMC,EAAOzf,GAAKwf,EAAKhkB,GACvBijB,GAAQgB,EACRJ,EAAKb,EAAMC,EAAMC,EAAKC,GACtBD,EAAMW,EAAG,GACTV,EAAMU,EAAG,GACTA,EAAKb,EAAMC,EAAMa,EAAKC,GACtBD,EAAMD,EAAG,GACTE,EAAMF,EAAG,GACTZ,EAAOgB,EACP,MAAMviB,EAAIwhB,EAAMY,EACVI,EAAKlE,EAAKte,EAAIA,GACdwf,EAAIgC,EAAMY,EACVK,EAAKnE,EAAKkB,EAAIA,GACd7P,EAAI6S,EAAKC,EACTrG,EAAIqF,EAAMY,EAEVK,EAAKpE,GADDmD,EAAMY,GACIriB,GACd2iB,EAAKrE,EAAKlC,EAAIoD,GACdoD,EAAOF,EAAKC,EACZE,EAAQH,EAAKC,EACnBlB,EAAMnD,EAAKsE,EAAOA,GAClBP,EAAM/D,EAAK4D,EAAM5D,EAAKuE,EAAQA,IAC9BrB,EAAMlD,EAAKkE,EAAKC,GAChBL,EAAM9D,EAAK3O,GAAK6S,EAAKlE,EAAKqD,EAAMhS,IAC5C,CAEQwS,EAAKb,EAAMC,EAAMC,EAAKC,GACtBD,EAAMW,EAAG,GACTV,EAAMU,EAAG,GAETA,EAAKb,EAAMC,EAAMa,EAAKC,GACtBD,EAAMD,EAAG,GACTE,EAAMF,EAAG,GAET,MAAMW,EAAK3B,EAAWiB,GAEtB,OAAO9D,EAAKkD,EAAMsB,EAC1B,CAwBmBC,CAAiBjB,EAZhC,SAAsB1gB,GAClB,MAAM5B,EAAQ+B,EAAY,SAAUH,GAC9BC,EAAM7B,EAAMrC,OAClB,GAAIkE,IAAQggB,GAAmBhgB,IAAQkZ,EAEnC,MAAU1d,MAAM,4BADCwkB,EAAkB,OAAS9G,EACU,eAAiBlZ,GAE3E,OAAOJ,EAAgBgd,EAAkBze,GACjD,CAGwBwjB,CAAavU,IAI7B,GAAIwT,IAAO7jB,GACP,MAAUvB,MAAM,0CACpB,OAAO+kB,EAAkBK,EACjC,CAEI,MAAMgB,EAAUrB,EAAkBxQ,EAAMgQ,IACxC,SAAS8B,EAAezU,GACpB,OAAOoT,EAAWpT,EAAQwU,EAClC,CACI,MAAO,CACHpB,aACAqB,iBACAnH,gBAAiB,CAACrH,EAAY+H,IAAcoF,EAAWnN,EAAY+H,GACnEX,aAAepH,GAAewO,EAAexO,GAC7CyF,MAAO,CAAEE,iBAAkB,IAAMjJ,EAAMuG,YAAYvG,EAAM7I,cACzD0a,QAASA,EAEjB;sECvIA,MAAME,GAAeC,GAAgB,IAAMC,EAAS1mB,OAAO,CAAE2mB,MAAO,QAE9DC,IADcH,GAAgB,IAAMC,EAAS1mB,OAAO,CAAE2mB,MAAO,OACpDjlB,OAAO,4IAEhBC,GAAMD,OAAO,GAAIE,GAAMF,OAAO,GAAIwH,GAAMxH,OAAO,GAAUA,OAAO,GAAI,MAAAmlB,GAAOnlB,OAAO,IAElFolB,GAAOplB,OAAO,IAAKqlB,GAAOrlB,OAAO,IAAKslB,GAAOtlB,OAAO,IAAKulB,GAAQvlB,OAAO,KAI9E,SAASwlB,GAAsBtd,GAC3B,MAAMO,EAAIyc,GACJO,EAAMvd,EAAIA,EAAIA,EAAKO,EACnB2O,EAAMqO,EAAKA,EAAKvd,EAAKO,EACrBid,EAAMzd,GAAKmP,EAAI5P,GAAKiB,GAAK2O,EAAM3O,EAC/Bkd,EAAM1d,GAAKyd,EAAIle,GAAKiB,GAAK2O,EAAM3O,EAC/Bmd,EAAO3d,GAAK0d,EAAIzlB,GAAKuI,GAAKgd,EAAMhd,EAChCod,EAAO5d,GAAK2d,EAAKT,GAAM1c,GAAKmd,EAAOnd,EACnCqd,EAAO7d,GAAK4d,EAAKT,GAAM3c,GAAKod,EAAOpd,EACnCsd,EAAO9d,GAAK6d,EAAKT,GAAM5c,GAAKqd,EAAOrd,EACnCud,EAAQ/d,GAAK8d,EAAKT,GAAM7c,GAAKsd,EAAOtd,EACpCwd,EAAQhe,GAAK+d,EAAMX,GAAM5c,GAAKqd,EAAOrd,EACrCyd,EAAQje,GAAKge,EAAM/lB,GAAKuI,GAAKgd,EAAMhd,EACnC0d,EAAQle,GAAKie,EAAMjmB,GAAKwI,GAAKP,EAAKO,EACxC,OAAQR,GAAKke,EAAMZ,GAAO9c,GAAKyd,EAAQzd,CAC3C,CACA,SAASmX,GAAkBze,GAQvB,OALAA,EAAM,IAAM,IAEZA,EAAM,KAAO,IAEbA,EAAM,IAAM,EACLA,CACX,CAsBA,MAAM6E,GAAKqE,GAAM6a,GAAQ,KAAK,GACxBkB,GAAY,CAEdhmB,EAAGJ,OAAO,GAEVoL,EAAGpL,OAAO,2IAEdgG,GAAIA,GAGAjD,EAAG/C,OAAO,2IAEVgK,WAAY,IAEZrF,EAAG3E,OAAO,GAEVyQ,GAAIzQ,OAAO,2IACX0Q,GAAI1Q,OAAO,2IAEXpC,KAAMknB,GACNxL,cACAsG,qBAEAC,OAAQ,CAAC5b,EAAMic,EAAKC,KAChB,GAAID,EAAIphB,OAAS,IACb,MAAUN,MAAM,0CAA4C0hB,EAAIphB,QACpE,OAAOwE,EAAY+iB,EAAY,YAAa,IAAIznB,WAAW,CAACuhB,EAAS,EAAI,EAAGD,EAAIphB,SAAUohB,EAAKjc,EAAK,EAExG6b,QA/CJ,SAAiBzX,EAAG7D,GAChB,MAAMiE,EAAIyc,GAOJoB,EAAM1e,EAAIS,EAAIA,EAAI7D,EAAGiE,GACrB8d,EAAM3e,EAAI0e,EAAMje,EAAGI,GACnB+d,EAAO5e,EAAI2e,EAAMD,EAAM9hB,EAAGiE,GAE1BP,EAAIN,EAAI2e,EADDf,GAAsBgB,GACT/d,GAEpB2L,EAAKxM,EAAIM,EAAIA,EAAGO,GAGtB,MAAO,CAAExC,QAAS2B,EAAIwM,EAAK5P,EAAGiE,KAAOJ,EAAG1H,MAAOuH,EACnD,GA+Baue,kBAAwB9G,GAAeyG,IAGvCM,kBAAuB,KAAO9D,GAAW,CAClDxiB,EAAGJ,OAAO,QAEV6iB,eAAgB,IAChB3Y,YAAa,GACbzB,EAAGyc,GACHnC,GAAI/iB,OAAO,GACX8iB,WAAa5a,IACT,MAAMO,EAAIyc,GAGV,OAAOtd,EADSK,GADIud,GAAsBtd,GACRlI,OAAO,GAAIyI,GACxBP,EAAGO,EAAE,EAE9BmX,qBACAtG,gBAdgC,GAgCnBtT,GAAGsE,MAAQtK,OAAO,GAAMA,OAAO,GACjCA,OAAO,QAuFFA,OAAO,SAEHA,OAAO,SAEVA,OAAO,0IAEJA,OAAO,2IAGdA,OAAO;;AClOxB,MAAM2mB,GAAa3mB,OAAO,sEACpB4mB,GAAa5mB,OAAO,sEACpBC,GAAMD,OAAO,GACbE,GAAMF,OAAO,GACb6mB,GAAa,CAACzmB,EAAGwE,KAAOxE,EAAIwE,EAAI1E,IAAO0E,EA6B7C,MAAMkiB,GAAOzc,GAAMsc,QAAYlkB,OAAWA,EAAW,CAAEmJ,KAxBvD,SAAiBqI,GACb,MAAMxL,EAAIke,GAEJnf,EAAMxH,OAAO,GAAI+mB,EAAM/mB,OAAO,GAAImlB,EAAOnlB,OAAO,IAAKolB,EAAOplB,OAAO,IAEnEgnB,EAAOhnB,OAAO,IAAKqlB,EAAOrlB,OAAO,IAAKslB,EAAOtlB,OAAO,IACpDylB,EAAMxR,EAAIA,EAAIA,EAAKxL,EACnB2O,EAAMqO,EAAKA,EAAKxR,EAAKxL,EACrBid,EAAMzd,GAAKmP,EAAI5P,EAAKiB,GAAK2O,EAAM3O,EAC/Bkd,EAAM1d,GAAKyd,EAAIle,EAAKiB,GAAK2O,EAAM3O,EAC/Bmd,EAAO3d,GAAK0d,EAAIzlB,GAAKuI,GAAKgd,EAAMhd,EAChCod,EAAO5d,GAAK2d,EAAKT,EAAM1c,GAAKmd,EAAOnd,EACnCqd,EAAO7d,GAAK4d,EAAKT,EAAM3c,GAAKod,EAAOpd,EACnCsd,EAAO9d,GAAK6d,EAAKT,EAAM5c,GAAKqd,EAAOrd,EACnCud,EAAQ/d,GAAK8d,EAAKT,EAAM7c,GAAKsd,EAAOtd,EACpCwd,EAAQhe,GAAK+d,EAAMX,EAAM5c,GAAKqd,EAAOrd,EACrC0d,EAAQle,GAAKge,EAAMze,EAAKiB,GAAK2O,EAAM3O,EACnCgP,EAAMxP,GAAKke,EAAMa,EAAMve,GAAKod,EAAOpd,EACnCkB,EAAM1B,GAAKwP,EAAIsP,EAAKte,GAAKgd,EAAMhd,EAC/BE,EAAOV,GAAK0B,EAAIzJ,GAAKuI,GAC3B,IAAKqe,GAAKle,IAAIke,GAAKje,IAAIF,GAAOsL,GAC1B,MAAUzV,MAAM,2BACpB,OAAOmK,CACX,IAKase,GAAYnI,GAAY,CACjC1e,EAAGJ,OAAO,GACV4E,EAAG5E,OAAO,GACVgG,GAAI8gB,GACJ/jB,EAAG6jB,GAEHnW,GAAIzQ,OAAO,iFACX0Q,GAAI1Q,OAAO,iFACX2E,EAAG3E,OAAO,GACV6Q,MAAM,EAONyC,KAAM,CACFC,KAAMvT,OAAO,sEACbwT,YAAc/O,IACV,MAAM1B,EAAI6jB,GACJM,EAAKlnB,OAAO,sCACZmnB,GAAMlnB,GAAMD,OAAO,sCACnBonB,EAAKpnB,OAAO,uCACZylB,EAAKyB,EACLG,EAAYrnB,OAAO,uCACnB8I,EAAK+d,GAAWpB,EAAKhhB,EAAG1B,GACxBukB,EAAKT,IAAYM,EAAK1iB,EAAG1B,GAC/B,IAAImV,EAAKtQ,EAAInD,EAAIqE,EAAKoe,EAAKI,EAAKF,EAAIrkB,GAChCqV,EAAKxQ,GAAKkB,EAAKqe,EAAKG,EAAK7B,EAAI1iB,GACjC,MAAMkV,EAAQC,EAAKmP,EACblP,EAAQC,EAAKiP,EAKnB,GAJIpP,IACAC,EAAKnV,EAAImV,GACTC,IACAC,EAAKrV,EAAIqV,GACTF,EAAKmP,GAAajP,EAAKiP,EACvB,MAAU7oB,MAAM,uCAAyCiG,GAE7D,MAAO,CAAEwT,QAAOC,KAAIC,QAAOC,KAAI,IAGxC8G,GAGSlf,OAAO,GAiBLinB,GAAUhO,gBCnGxB,MAAMjT,GAAKqE,GAAMrK,OAAO,uEAKXunB,GAAkBzI,GAAY,CACzC1e,EALc4F,GAAG1H,OAAO0B,OAAO,uEAM/B4E,EALc5E,OAAO,yEAMrBgG,GAEAjD,EAAG/C,OAAO,sEAEVyQ,GAAIzQ,OAAO,sEACX0Q,GAAI1Q,OAAO,sEACX2E,EAAG3E,OAAO,GACV6Q,MAAM,GACIqO,GChBNlZ,GAAKqE,GAAMrK,OAAO,uGAKXwnB,GAAkB1I,GAAY,CACzC1e,EALc4F,GAAG1H,OAAO0B,OAAO,uGAM/B4E,EALc5E,OAAO,yGAMrBgG,GAEAjD,EAAG/C,OAAO,sGAEVyQ,GAAIzQ,OAAO,sGACX0Q,GAAI1Q,OAAO,sGACX2E,EAAG3E,OAAO,GACV6Q,MAAM,GACIwO,GChBNrZ,GAAKqE,GAAMrK,OAAO,uIAKXynB,GAAkB3I,GAAY,CACzC1e,EALc4F,GAAG1H,OAAO0B,OAAO,uIAM/B4E,EALc5E,OAAO,sIAMrBgG,MAEAjD,EAAG/C,OAAO,sIAEVyQ,GAAIzQ,OAAO,sIACX0Q,GAAI1Q,OAAO,sIACX2E,EAAG3E,OAAO,GACV6Q,MAAM,GACI2O,GCRCkI,GAAc,IAAIC,IAAIhoB,OAAO+G,QAAQ,CAClDkhB,SAAEA,GACFC,SAAEA,GACFC,SAAEA,GACAP,mBACAC,mBACAC,mBACAR,aACAP,QACAD","x_google_ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11,12]}