{"version":3,"file":"secp256k1-D_nXaWtX.mjs","names":["_0n","_1n","_2n","_3n","_4n","_0n","_1n","_0n","_1n","_2n","concatBytes","concatBytes","concatBytes"],"sources":["../../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/hmac.js","../../../node_modules/.pnpm/@noble+curves@1.9.1/node_modules/@noble/curves/esm/abstract/modular.js","../../../node_modules/.pnpm/@noble+curves@1.9.1/node_modules/@noble/curves/esm/abstract/curve.js","../../../node_modules/.pnpm/@noble+curves@1.9.1/node_modules/@noble/curves/esm/abstract/weierstrass.js","../../../node_modules/.pnpm/@noble+curves@1.9.1/node_modules/@noble/curves/esm/_shortw_utils.js","../../../node_modules/.pnpm/@noble+curves@1.9.1/node_modules/@noble/curves/esm/abstract/hash-to-curve.js","../../../node_modules/.pnpm/@noble+curves@1.9.1/node_modules/@noble/curves/esm/secp256k1.js"],"sourcesContent":["/**\n * HMAC: RFC2104 message authentication code.\n * @module\n */\nimport { abytes, aexists, ahash, clean, Hash, toBytes } from \"./utils.js\";\nexport class HMAC extends Hash {\n    constructor(hash, _key) {\n        super();\n        this.finished = false;\n        this.destroyed = false;\n        ahash(hash);\n        const key = toBytes(_key);\n        this.iHash = hash.create();\n        if (typeof this.iHash.update !== 'function')\n            throw new Error('Expected instance of class which extends utils.Hash');\n        this.blockLen = this.iHash.blockLen;\n        this.outputLen = this.iHash.outputLen;\n        const blockLen = this.blockLen;\n        const pad = new Uint8Array(blockLen);\n        // blockLen can be bigger than outputLen\n        pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36;\n        this.iHash.update(pad);\n        // By doing update (processing of first block) of outer hash here we can re-use it between multiple calls via clone\n        this.oHash = hash.create();\n        // Undo internal XOR && apply outer XOR\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36 ^ 0x5c;\n        this.oHash.update(pad);\n        clean(pad);\n    }\n    update(buf) {\n        aexists(this);\n        this.iHash.update(buf);\n        return this;\n    }\n    digestInto(out) {\n        aexists(this);\n        abytes(out, this.outputLen);\n        this.finished = true;\n        this.iHash.digestInto(out);\n        this.oHash.update(out);\n        this.oHash.digestInto(out);\n        this.destroy();\n    }\n    digest() {\n        const out = new Uint8Array(this.oHash.outputLen);\n        this.digestInto(out);\n        return out;\n    }\n    _cloneInto(to) {\n        // Create new instance without calling constructor since key already in state and we don't know it.\n        to || (to = Object.create(Object.getPrototypeOf(this), {}));\n        const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;\n        to = to;\n        to.finished = finished;\n        to.destroyed = destroyed;\n        to.blockLen = blockLen;\n        to.outputLen = outputLen;\n        to.oHash = oHash._cloneInto(to.oHash);\n        to.iHash = iHash._cloneInto(to.iHash);\n        return to;\n    }\n    clone() {\n        return this._cloneInto();\n    }\n    destroy() {\n        this.destroyed = true;\n        this.oHash.destroy();\n        this.iHash.destroy();\n    }\n}\n/**\n * HMAC: RFC2104 message authentication code.\n * @param hash - function that would be used e.g. sha256\n * @param key - message key\n * @param message - message data\n * @example\n * import { hmac } from '@noble/hashes/hmac';\n * import { sha256 } from '@noble/hashes/sha2';\n * const mac1 = hmac(sha256, 'key', 'message');\n */\nexport const hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();\nhmac.create = (hash, key) => new HMAC(hash, key);\n//# sourceMappingURL=hmac.js.map","/**\n * Utils for modular division and finite fields.\n * A finite field over 11 is integer number operations `mod 11`.\n * There is no division: it is replaced by modular multiplicative inverse.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { anumber } from '@noble/hashes/utils';\nimport { bitMask, bytesToNumberBE, bytesToNumberLE, ensureBytes, numberToBytesBE, numberToBytesLE, validateObject, } from \"./utils.js\";\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _3n = /* @__PURE__ */ BigInt(3);\n// prettier-ignore\nconst _4n = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5), _8n = /* @__PURE__ */ BigInt(8);\n// Calculates a modulo b\nexport function mod(a, b) {\n    const result = a % b;\n    return result >= _0n ? result : b + result;\n}\n/**\n * Efficiently raise num to power and do modular division.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * TODO: remove.\n * @example\n * pow(2n, 6n, 11n) // 64n % 11n == 9n\n */\nexport function pow(num, power, modulo) {\n    return FpPow(Field(modulo), num, power);\n}\n/** Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)` */\nexport function pow2(x, power, modulo) {\n    let res = x;\n    while (power-- > _0n) {\n        res *= res;\n        res %= modulo;\n    }\n    return res;\n}\n/**\n * Inverses number over modulo.\n * Implemented using [Euclidean GCD](https://brilliant.org/wiki/extended-euclidean-algorithm/).\n */\nexport function invert(number, modulo) {\n    if (number === _0n)\n        throw new Error('invert: expected non-zero number');\n    if (modulo <= _0n)\n        throw new Error('invert: expected positive modulus, got ' + modulo);\n    // Fermat's little theorem \"CT-like\" version inv(n) = n^(m-2) mod m is 30x slower.\n    let a = mod(number, modulo);\n    let b = modulo;\n    // prettier-ignore\n    let x = _0n, y = _1n, u = _1n, v = _0n;\n    while (a !== _0n) {\n        // JIT applies optimization if those two lines follow each other\n        const q = b / a;\n        const r = b % a;\n        const m = x - u * q;\n        const n = y - v * q;\n        // prettier-ignore\n        b = a, a = r, x = u, y = v, u = m, v = n;\n    }\n    const gcd = b;\n    if (gcd !== _1n)\n        throw new Error('invert: does not exist');\n    return mod(x, modulo);\n}\n// Not all roots are possible! Example which will throw:\n// const NUM =\n// n = 72057594037927816n;\n// Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'));\nfunction sqrt3mod4(Fp, n) {\n    const p1div4 = (Fp.ORDER + _1n) / _4n;\n    const root = Fp.pow(n, p1div4);\n    // Throw if root^2 != n\n    if (!Fp.eql(Fp.sqr(root), n))\n        throw new Error('Cannot find square root');\n    return root;\n}\nfunction sqrt5mod8(Fp, n) {\n    const p5div8 = (Fp.ORDER - _5n) / _8n;\n    const n2 = Fp.mul(n, _2n);\n    const v = Fp.pow(n2, p5div8);\n    const nv = Fp.mul(n, v);\n    const i = Fp.mul(Fp.mul(nv, _2n), v);\n    const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));\n    if (!Fp.eql(Fp.sqr(root), n))\n        throw new Error('Cannot find square root');\n    return root;\n}\n// TODO: Commented-out for now. Provide test vectors.\n// Tonelli is too slow for extension fields Fp2.\n// That means we can't use sqrt (c1, c2...) even for initialization constants.\n// if (P % _16n === _9n) return sqrt9mod16;\n// // prettier-ignore\n// function sqrt9mod16<T>(Fp: IField<T>, n: T, p7div16?: bigint) {\n//   if (p7div16 === undefined) p7div16 = (Fp.ORDER + BigInt(7)) / _16n;\n//   const c1 = Fp.sqrt(Fp.neg(Fp.ONE)); //  1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F\n//   const c2 = Fp.sqrt(c1);             //  2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F\n//   const c3 = Fp.sqrt(Fp.neg(c1));     //  3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F\n//   const c4 = p7div16;                 //  4. c4 = (q + 7) / 16        # Integer arithmetic\n//   let tv1 = Fp.pow(n, c4);            //  1. tv1 = x^c4\n//   let tv2 = Fp.mul(c1, tv1);          //  2. tv2 = c1 * tv1\n//   const tv3 = Fp.mul(c2, tv1);        //  3. tv3 = c2 * tv1\n//   let tv4 = Fp.mul(c3, tv1);          //  4. tv4 = c3 * tv1\n//   const e1 = Fp.eql(Fp.sqr(tv2), n);  //  5.  e1 = (tv2^2) == x\n//   const e2 = Fp.eql(Fp.sqr(tv3), n);  //  6.  e2 = (tv3^2) == x\n//   tv1 = Fp.cmov(tv1, tv2, e1); //  7. tv1 = CMOV(tv1, tv2, e1)  # Select tv2 if (tv2^2) == x\n//   tv2 = Fp.cmov(tv4, tv3, e2); //  8. tv2 = CMOV(tv4, tv3, e2)  # Select tv3 if (tv3^2) == x\n//   const e3 = Fp.eql(Fp.sqr(tv2), n);  //  9.  e3 = (tv2^2) == x\n//   return Fp.cmov(tv1, tv2, e3); // 10.  z = CMOV(tv1, tv2, e3) # Select the sqrt from tv1 and tv2\n// }\n/**\n * Tonelli-Shanks square root search algorithm.\n * 1. https://eprint.iacr.org/2012/685.pdf (page 12)\n * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks\n * @param P field order\n * @returns function that takes field Fp (created from P) and number n\n */\nexport function tonelliShanks(P) {\n    // Initialization (precomputation).\n    if (P < BigInt(3))\n        throw new Error('sqrt is not defined for small field');\n    // Factor P - 1 = Q * 2^S, where Q is odd\n    let Q = P - _1n;\n    let S = 0;\n    while (Q % _2n === _0n) {\n        Q /= _2n;\n        S++;\n    }\n    // Find the first quadratic non-residue Z >= 2\n    let Z = _2n;\n    const _Fp = Field(P);\n    while (FpLegendre(_Fp, Z) === 1) {\n        // Basic primality test for P. After x iterations, chance of\n        // not finding quadratic non-residue is 2^x, so 2^1000.\n        if (Z++ > 1000)\n            throw new Error('Cannot find square root: probably non-prime P');\n    }\n    // Fast-path; usually done before Z, but we do \"primality test\".\n    if (S === 1)\n        return sqrt3mod4;\n    // Slow-path\n    // TODO: test on Fp2 and others\n    let cc = _Fp.pow(Z, Q); // c = z^Q\n    const Q1div2 = (Q + _1n) / _2n;\n    return function tonelliSlow(Fp, n) {\n        if (Fp.is0(n))\n            return n;\n        // Check if n is a quadratic residue using Legendre symbol\n        if (FpLegendre(Fp, n) !== 1)\n            throw new Error('Cannot find square root');\n        // Initialize variables for the main loop\n        let M = S;\n        let c = Fp.mul(Fp.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp\n        let t = Fp.pow(n, Q); // t = n^Q, first guess at the fudge factor\n        let R = Fp.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root\n        // Main loop\n        // while t != 1\n        while (!Fp.eql(t, Fp.ONE)) {\n            if (Fp.is0(t))\n                return Fp.ZERO; // if t=0 return R=0\n            let i = 1;\n            // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P)\n            let t_tmp = Fp.sqr(t); // t^(2^1)\n            while (!Fp.eql(t_tmp, Fp.ONE)) {\n                i++;\n                t_tmp = Fp.sqr(t_tmp); // t^(2^2)...\n                if (i === M)\n                    throw new Error('Cannot find square root');\n            }\n            // Calculate the exponent for b: 2^(M - i - 1)\n            const exponent = _1n << BigInt(M - i - 1); // bigint is important\n            const b = Fp.pow(c, exponent); // b = 2^(M - i - 1)\n            // Update variables\n            M = i;\n            c = Fp.sqr(b); // c = b^2\n            t = Fp.mul(t, c); // t = (t * b^2)\n            R = Fp.mul(R, b); // R = R*b\n        }\n        return R;\n    };\n}\n/**\n * Square root for a finite field. Will try optimized versions first:\n *\n * 1. P ≡ 3 (mod 4)\n * 2. P ≡ 5 (mod 8)\n * 3. Tonelli-Shanks algorithm\n *\n * Different algorithms can give different roots, it is up to user to decide which one they want.\n * For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).\n */\nexport function FpSqrt(P) {\n    // P ≡ 3 (mod 4) => √n = n^((P+1)/4)\n    if (P % _4n === _3n)\n        return sqrt3mod4;\n    // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf\n    if (P % _8n === _5n)\n        return sqrt5mod8;\n    // P ≡ 9 (mod 16) not implemented, see above\n    // Tonelli-Shanks algorithm\n    return tonelliShanks(P);\n}\n// Little-endian check for first LE bit (last BE bit);\nexport const isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n) === _1n;\n// prettier-ignore\nconst FIELD_FIELDS = [\n    'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',\n    'eql', 'add', 'sub', 'mul', 'pow', 'div',\n    'addN', 'subN', 'mulN', 'sqrN'\n];\nexport function validateField(field) {\n    const initial = {\n        ORDER: 'bigint',\n        MASK: 'bigint',\n        BYTES: 'isSafeInteger',\n        BITS: 'isSafeInteger',\n    };\n    const opts = FIELD_FIELDS.reduce((map, val) => {\n        map[val] = 'function';\n        return map;\n    }, initial);\n    return validateObject(field, opts);\n}\n// Generic field functions\n/**\n * Same as `pow` but for Fp: non-constant-time.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n */\nexport function FpPow(Fp, num, power) {\n    if (power < _0n)\n        throw new Error('invalid exponent, negatives unsupported');\n    if (power === _0n)\n        return Fp.ONE;\n    if (power === _1n)\n        return num;\n    let p = Fp.ONE;\n    let d = num;\n    while (power > _0n) {\n        if (power & _1n)\n            p = Fp.mul(p, d);\n        d = Fp.sqr(d);\n        power >>= _1n;\n    }\n    return p;\n}\n/**\n * Efficiently invert an array of Field elements.\n * Exception-free. Will return `undefined` for 0 elements.\n * @param passZero map 0 to 0 (instead of undefined)\n */\nexport function FpInvertBatch(Fp, nums, passZero = false) {\n    const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : undefined);\n    // Walk from first to last, multiply them by each other MOD p\n    const multipliedAcc = nums.reduce((acc, num, i) => {\n        if (Fp.is0(num))\n            return acc;\n        inverted[i] = acc;\n        return Fp.mul(acc, num);\n    }, Fp.ONE);\n    // Invert last element\n    const invertedAcc = Fp.inv(multipliedAcc);\n    // Walk from last to first, multiply them by inverted each other MOD p\n    nums.reduceRight((acc, num, i) => {\n        if (Fp.is0(num))\n            return acc;\n        inverted[i] = Fp.mul(acc, inverted[i]);\n        return Fp.mul(acc, num);\n    }, invertedAcc);\n    return inverted;\n}\n// TODO: remove\nexport function FpDiv(Fp, lhs, rhs) {\n    return Fp.mul(lhs, typeof rhs === 'bigint' ? invert(rhs, Fp.ORDER) : Fp.inv(rhs));\n}\n/**\n * Legendre symbol.\n * Legendre constant is used to calculate Legendre symbol (a | p)\n * which denotes the value of a^((p-1)/2) (mod p).\n *\n * * (a | p) ≡ 1    if a is a square (mod p), quadratic residue\n * * (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue\n * * (a | p) ≡ 0    if a ≡ 0 (mod p)\n */\nexport function FpLegendre(Fp, n) {\n    // We can use 3rd argument as optional cache of this value\n    // but seems unneeded for now. The operation is very fast.\n    const p1mod2 = (Fp.ORDER - _1n) / _2n;\n    const powered = Fp.pow(n, p1mod2);\n    const yes = Fp.eql(powered, Fp.ONE);\n    const zero = Fp.eql(powered, Fp.ZERO);\n    const no = Fp.eql(powered, Fp.neg(Fp.ONE));\n    if (!yes && !zero && !no)\n        throw new Error('invalid Legendre symbol result');\n    return yes ? 1 : zero ? 0 : -1;\n}\n// This function returns True whenever the value x is a square in the field F.\nexport function FpIsSquare(Fp, n) {\n    const l = FpLegendre(Fp, n);\n    return l === 1;\n}\n// CURVE.n lengths\nexport function nLength(n, nBitLength) {\n    // Bit size, byte size of CURVE.n\n    if (nBitLength !== undefined)\n        anumber(nBitLength);\n    const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length;\n    const nByteLength = Math.ceil(_nBitLength / 8);\n    return { nBitLength: _nBitLength, nByteLength };\n}\n/**\n * Initializes a finite field over prime.\n * Major performance optimizations:\n * * a) denormalized operations like mulN instead of mul\n * * b) same object shape: never add or remove keys\n * * c) Object.freeze\n * Fragile: always run a benchmark on a change.\n * Security note: operations don't check 'isValid' for all elements for performance reasons,\n * it is caller responsibility to check this.\n * This is low-level code, please make sure you know what you're doing.\n * @param ORDER prime positive bigint\n * @param bitLen how many bits the field consumes\n * @param isLE (def: false) if encoding / decoding should be in little-endian\n * @param redef optional faster redefinitions of sqrt and other methods\n */\nexport function Field(ORDER, bitLen, isLE = false, redef = {}) {\n    if (ORDER <= _0n)\n        throw new Error('invalid field: expected ORDER > 0, got ' + ORDER);\n    const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, bitLen);\n    if (BYTES > 2048)\n        throw new Error('invalid field: expected ORDER of <= 2048 bytes');\n    let sqrtP; // cached sqrtP\n    const f = Object.freeze({\n        ORDER,\n        isLE,\n        BITS,\n        BYTES,\n        MASK: bitMask(BITS),\n        ZERO: _0n,\n        ONE: _1n,\n        create: (num) => mod(num, ORDER),\n        isValid: (num) => {\n            if (typeof num !== 'bigint')\n                throw new Error('invalid field element: expected bigint, got ' + typeof num);\n            return _0n <= num && num < ORDER; // 0 is valid element, but it's not invertible\n        },\n        is0: (num) => num === _0n,\n        isOdd: (num) => (num & _1n) === _1n,\n        neg: (num) => mod(-num, ORDER),\n        eql: (lhs, rhs) => lhs === rhs,\n        sqr: (num) => mod(num * num, ORDER),\n        add: (lhs, rhs) => mod(lhs + rhs, ORDER),\n        sub: (lhs, rhs) => mod(lhs - rhs, ORDER),\n        mul: (lhs, rhs) => mod(lhs * rhs, ORDER),\n        pow: (num, power) => FpPow(f, num, power),\n        div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),\n        // Same as above, but doesn't normalize\n        sqrN: (num) => num * num,\n        addN: (lhs, rhs) => lhs + rhs,\n        subN: (lhs, rhs) => lhs - rhs,\n        mulN: (lhs, rhs) => lhs * rhs,\n        inv: (num) => invert(num, ORDER),\n        sqrt: redef.sqrt ||\n            ((n) => {\n                if (!sqrtP)\n                    sqrtP = FpSqrt(ORDER);\n                return sqrtP(f, n);\n            }),\n        toBytes: (num) => (isLE ? numberToBytesLE(num, BYTES) : numberToBytesBE(num, BYTES)),\n        fromBytes: (bytes) => {\n            if (bytes.length !== BYTES)\n                throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);\n            return isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n        },\n        // TODO: we don't need it here, move out to separate fn\n        invertBatch: (lst) => FpInvertBatch(f, lst),\n        // We can't move this out because Fp6, Fp12 implement it\n        // and it's unclear what to return in there.\n        cmov: (a, b, c) => (c ? b : a),\n    });\n    return Object.freeze(f);\n}\nexport function FpSqrtOdd(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? root : Fp.neg(root);\n}\nexport function FpSqrtEven(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? Fp.neg(root) : root;\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Same as mapKeyToField, but accepts less bytes (40 instead of 48 for 32-byte field).\n * Which makes it slightly more biased, less secure.\n * @deprecated use `mapKeyToField` instead\n */\nexport function hashToPrivateScalar(hash, groupOrder, isLE = false) {\n    hash = ensureBytes('privateHash', hash);\n    const hashLen = hash.length;\n    const minLen = nLength(groupOrder).nByteLength + 8;\n    if (minLen < 24 || hashLen < minLen || hashLen > 1024)\n        throw new Error('hashToPrivateScalar: expected ' + minLen + '-1024 bytes of input, got ' + hashLen);\n    const num = isLE ? bytesToNumberLE(hash) : bytesToNumberBE(hash);\n    return mod(num, groupOrder - _1n) + _1n;\n}\n/**\n * Returns total number of bytes consumed by the field element.\n * For example, 32 bytes for usual 256-bit weierstrass curve.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of field\n */\nexport function getFieldBytesLength(fieldOrder) {\n    if (typeof fieldOrder !== 'bigint')\n        throw new Error('field order must be bigint');\n    const bitLength = fieldOrder.toString(2).length;\n    return Math.ceil(bitLength / 8);\n}\n/**\n * Returns minimal amount of bytes that can be safely reduced\n * by field order.\n * Should be 2^-128 for 128-bit curve such as P256.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of target hash\n */\nexport function getMinHashLength(fieldOrder) {\n    const length = getFieldBytesLength(fieldOrder);\n    return length + Math.ceil(length / 2);\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF\n * and convert them into private scalar, with the modulo bias being negligible.\n * Needs at least 48 bytes of input for 32-byte private key.\n * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/\n * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final\n * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5\n * @param hash hash output from SHA3 or a similar function\n * @param groupOrder size of subgroup - (e.g. secp256k1.CURVE.n)\n * @param isLE interpret hash bytes as LE num\n * @returns valid private scalar\n */\nexport function mapHashToField(key, fieldOrder, isLE = false) {\n    const len = key.length;\n    const fieldLen = getFieldBytesLength(fieldOrder);\n    const minLen = getMinHashLength(fieldOrder);\n    // No small numbers: need to understand bias story. No huge numbers: easier to detect JS timings.\n    if (len < 16 || len < minLen || len > 1024)\n        throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);\n    const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);\n    // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n    const reduced = mod(num, fieldOrder - _1n) + _1n;\n    return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);\n}\n//# sourceMappingURL=modular.js.map","/**\n * Methods for elliptic curve multiplication by scalars.\n * Contains wNAF, pippenger\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { nLength, validateField } from \"./modular.js\";\nimport { bitLen, bitMask, validateObject } from \"./utils.js\";\nconst _0n = BigInt(0);\nconst _1n = BigInt(1);\nfunction constTimeNegate(condition, item) {\n    const neg = item.negate();\n    return condition ? neg : item;\n}\nfunction validateW(W, bits) {\n    if (!Number.isSafeInteger(W) || W <= 0 || W > bits)\n        throw new Error('invalid window size, expected [1..' + bits + '], got W=' + W);\n}\nfunction calcWOpts(W, scalarBits) {\n    validateW(W, scalarBits);\n    const windows = Math.ceil(scalarBits / W) + 1; // W=8 33. Not 32, because we skip zero\n    const windowSize = 2 ** (W - 1); // W=8 128. Not 256, because we skip zero\n    const maxNumber = 2 ** W; // W=8 256\n    const mask = bitMask(W); // W=8 255 == mask 0b11111111\n    const shiftBy = BigInt(W); // W=8 8\n    return { windows, windowSize, mask, maxNumber, shiftBy };\n}\nfunction calcOffsets(n, window, wOpts) {\n    const { windowSize, mask, maxNumber, shiftBy } = wOpts;\n    let wbits = Number(n & mask); // extract W bits.\n    let nextN = n >> shiftBy; // shift number by W bits.\n    // What actually happens here:\n    // const highestBit = Number(mask ^ (mask >> 1n));\n    // let wbits2 = wbits - 1; // skip zero\n    // if (wbits2 & highestBit) { wbits2 ^= Number(mask); // (~);\n    // split if bits > max: +224 => 256-32\n    if (wbits > windowSize) {\n        // we skip zero, which means instead of `>= size-1`, we do `> size`\n        wbits -= maxNumber; // -32, can be maxNumber - wbits, but then we need to set isNeg here.\n        nextN += _1n; // +256 (carry)\n    }\n    const offsetStart = window * windowSize;\n    const offset = offsetStart + Math.abs(wbits) - 1; // -1 because we skip zero\n    const isZero = wbits === 0; // is current window slice a 0?\n    const isNeg = wbits < 0; // is current window slice negative?\n    const isNegF = window % 2 !== 0; // fake random statement for noise\n    const offsetF = offsetStart; // fake offset for noise\n    return { nextN, offset, isZero, isNeg, isNegF, offsetF };\n}\nfunction validateMSMPoints(points, c) {\n    if (!Array.isArray(points))\n        throw new Error('array expected');\n    points.forEach((p, i) => {\n        if (!(p instanceof c))\n            throw new Error('invalid point at index ' + i);\n    });\n}\nfunction validateMSMScalars(scalars, field) {\n    if (!Array.isArray(scalars))\n        throw new Error('array of scalars expected');\n    scalars.forEach((s, i) => {\n        if (!field.isValid(s))\n            throw new Error('invalid scalar at index ' + i);\n    });\n}\n// Since points in different groups cannot be equal (different object constructor),\n// we can have single place to store precomputes.\n// Allows to make points frozen / immutable.\nconst pointPrecomputes = new WeakMap();\nconst pointWindowSizes = new WeakMap();\nfunction getW(P) {\n    return pointWindowSizes.get(P) || 1;\n}\n/**\n * Elliptic curve multiplication of Point by scalar. Fragile.\n * Scalars should always be less than curve order: this should be checked inside of a curve itself.\n * Creates precomputation tables for fast multiplication:\n * - private scalar is split by fixed size windows of W bits\n * - every window point is collected from window's table & added to accumulator\n * - since windows are different, same point inside tables won't be accessed more than once per calc\n * - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)\n * - +1 window is neccessary for wNAF\n * - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication\n *\n * @todo Research returning 2d JS array of windows, instead of a single window.\n * This would allow windows to be in different memory locations\n */\nexport function wNAF(c, bits) {\n    return {\n        constTimeNegate,\n        hasPrecomputes(elm) {\n            return getW(elm) !== 1;\n        },\n        // non-const time multiplication ladder\n        unsafeLadder(elm, n, p = c.ZERO) {\n            let d = elm;\n            while (n > _0n) {\n                if (n & _1n)\n                    p = p.add(d);\n                d = d.double();\n                n >>= _1n;\n            }\n            return p;\n        },\n        /**\n         * Creates a wNAF precomputation window. Used for caching.\n         * Default window size is set by `utils.precompute()` and is equal to 8.\n         * Number of precomputed points depends on the curve size:\n         * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:\n         * - 𝑊 is the window size\n         * - 𝑛 is the bitlength of the curve order.\n         * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.\n         * @param elm Point instance\n         * @param W window size\n         * @returns precomputed point tables flattened to a single array\n         */\n        precomputeWindow(elm, W) {\n            const { windows, windowSize } = calcWOpts(W, bits);\n            const points = [];\n            let p = elm;\n            let base = p;\n            for (let window = 0; window < windows; window++) {\n                base = p;\n                points.push(base);\n                // i=1, bc we skip 0\n                for (let i = 1; i < windowSize; i++) {\n                    base = base.add(p);\n                    points.push(base);\n                }\n                p = base.double();\n            }\n            return points;\n        },\n        /**\n         * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.\n         * @param W window size\n         * @param precomputes precomputed tables\n         * @param n scalar (we don't check here, but should be less than curve order)\n         * @returns real and fake (for const-time) points\n         */\n        wNAF(W, precomputes, n) {\n            // Smaller version:\n            // https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541\n            // TODO: check the scalar is less than group order?\n            // wNAF behavior is undefined otherwise. But have to carefully remove\n            // other checks before wNAF. ORDER == bits here.\n            // Accumulators\n            let p = c.ZERO;\n            let f = c.BASE;\n            // This code was first written with assumption that 'f' and 'p' will never be infinity point:\n            // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,\n            // there is negate now: it is possible that negated element from low value\n            // would be the same as high element, which will create carry into next window.\n            // It's not obvious how this can fail, but still worth investigating later.\n            const wo = calcWOpts(W, bits);\n            for (let window = 0; window < wo.windows; window++) {\n                // (n === _0n) is handled and not early-exited. isEven and offsetF are used for noise\n                const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);\n                n = nextN;\n                if (isZero) {\n                    // bits are 0: add garbage to fake point\n                    // Important part for const-time getPublicKey: add random \"noise\" point to f.\n                    f = f.add(constTimeNegate(isNegF, precomputes[offsetF]));\n                }\n                else {\n                    // bits are 1: add to result point\n                    p = p.add(constTimeNegate(isNeg, precomputes[offset]));\n                }\n            }\n            // Return both real and fake points: JIT won't eliminate f.\n            // At this point there is a way to F be infinity-point even if p is not,\n            // which makes it less const-time: around 1 bigint multiply.\n            return { p, f };\n        },\n        /**\n         * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.\n         * @param W window size\n         * @param precomputes precomputed tables\n         * @param n scalar (we don't check here, but should be less than curve order)\n         * @param acc accumulator point to add result of multiplication\n         * @returns point\n         */\n        wNAFUnsafe(W, precomputes, n, acc = c.ZERO) {\n            const wo = calcWOpts(W, bits);\n            for (let window = 0; window < wo.windows; window++) {\n                if (n === _0n)\n                    break; // Early-exit, skip 0 value\n                const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);\n                n = nextN;\n                if (isZero) {\n                    // Window bits are 0: skip processing.\n                    // Move to next window.\n                    continue;\n                }\n                else {\n                    const item = precomputes[offset];\n                    acc = acc.add(isNeg ? item.negate() : item); // Re-using acc allows to save adds in MSM\n                }\n            }\n            return acc;\n        },\n        getPrecomputes(W, P, transform) {\n            // Calculate precomputes on a first run, reuse them after\n            let comp = pointPrecomputes.get(P);\n            if (!comp) {\n                comp = this.precomputeWindow(P, W);\n                if (W !== 1)\n                    pointPrecomputes.set(P, transform(comp));\n            }\n            return comp;\n        },\n        wNAFCached(P, n, transform) {\n            const W = getW(P);\n            return this.wNAF(W, this.getPrecomputes(W, P, transform), n);\n        },\n        wNAFCachedUnsafe(P, n, transform, prev) {\n            const W = getW(P);\n            if (W === 1)\n                return this.unsafeLadder(P, n, prev); // For W=1 ladder is ~x2 faster\n            return this.wNAFUnsafe(W, this.getPrecomputes(W, P, transform), n, prev);\n        },\n        // We calculate precomputes for elliptic curve point multiplication\n        // using windowed method. This specifies window size and\n        // stores precomputed values. Usually only base point would be precomputed.\n        setWindowSize(P, W) {\n            validateW(W, bits);\n            pointWindowSizes.set(P, W);\n            pointPrecomputes.delete(P);\n        },\n    };\n}\n/**\n * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * 30x faster vs naive addition on L=4096, 10x faster than precomputes.\n * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.\n * Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.\n * @param c Curve Point constructor\n * @param fieldN field over CURVE.N - important that it's not over CURVE.P\n * @param points array of L curve points\n * @param scalars array of L scalars (aka private keys / bigints)\n */\nexport function pippenger(c, fieldN, points, scalars) {\n    // If we split scalars by some window (let's say 8 bits), every chunk will only\n    // take 256 buckets even if there are 4096 scalars, also re-uses double.\n    // TODO:\n    // - https://eprint.iacr.org/2024/750.pdf\n    // - https://tches.iacr.org/index.php/TCHES/article/view/10287\n    // 0 is accepted in scalars\n    validateMSMPoints(points, c);\n    validateMSMScalars(scalars, fieldN);\n    const plength = points.length;\n    const slength = scalars.length;\n    if (plength !== slength)\n        throw new Error('arrays of points and scalars must have equal length');\n    // if (plength === 0) throw new Error('array must be of length >= 2');\n    const zero = c.ZERO;\n    const wbits = bitLen(BigInt(plength));\n    let windowSize = 1; // bits\n    if (wbits > 12)\n        windowSize = wbits - 3;\n    else if (wbits > 4)\n        windowSize = wbits - 2;\n    else if (wbits > 0)\n        windowSize = 2;\n    const MASK = bitMask(windowSize);\n    const buckets = new Array(Number(MASK) + 1).fill(zero); // +1 for zero array\n    const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;\n    let sum = zero;\n    for (let i = lastBits; i >= 0; i -= windowSize) {\n        buckets.fill(zero);\n        for (let j = 0; j < slength; j++) {\n            const scalar = scalars[j];\n            const wbits = Number((scalar >> BigInt(i)) & MASK);\n            buckets[wbits] = buckets[wbits].add(points[j]);\n        }\n        let resI = zero; // not using this will do small speed-up, but will lose ct\n        // Skip first bucket, because it is zero\n        for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {\n            sumI = sumI.add(buckets[j]);\n            resI = resI.add(sumI);\n        }\n        sum = sum.add(resI);\n        if (i !== 0)\n            for (let j = 0; j < windowSize; j++)\n                sum = sum.double();\n    }\n    return sum;\n}\n/**\n * Precomputed multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * @param c Curve Point constructor\n * @param fieldN field over CURVE.N - important that it's not over CURVE.P\n * @param points array of L curve points\n * @returns function which multiplies points with scaars\n */\nexport function precomputeMSMUnsafe(c, fieldN, points, windowSize) {\n    /**\n     * Performance Analysis of Window-based Precomputation\n     *\n     * Base Case (256-bit scalar, 8-bit window):\n     * - Standard precomputation requires:\n     *   - 31 additions per scalar × 256 scalars = 7,936 ops\n     *   - Plus 255 summary additions = 8,191 total ops\n     *   Note: Summary additions can be optimized via accumulator\n     *\n     * Chunked Precomputation Analysis:\n     * - Using 32 chunks requires:\n     *   - 255 additions per chunk\n     *   - 256 doublings\n     *   - Total: (255 × 32) + 256 = 8,416 ops\n     *\n     * Memory Usage Comparison:\n     * Window Size | Standard Points | Chunked Points\n     * ------------|-----------------|---------------\n     *     4-bit   |     520         |      15\n     *     8-bit   |    4,224        |     255\n     *    10-bit   |   13,824        |   1,023\n     *    16-bit   |  557,056        |  65,535\n     *\n     * Key Advantages:\n     * 1. Enables larger window sizes due to reduced memory overhead\n     * 2. More efficient for smaller scalar counts:\n     *    - 16 chunks: (16 × 255) + 256 = 4,336 ops\n     *    - ~2x faster than standard 8,191 ops\n     *\n     * Limitations:\n     * - Not suitable for plain precomputes (requires 256 constant doublings)\n     * - Performance degrades with larger scalar counts:\n     *   - Optimal for ~256 scalars\n     *   - Less efficient for 4096+ scalars (Pippenger preferred)\n     */\n    validateW(windowSize, fieldN.BITS);\n    validateMSMPoints(points, c);\n    const zero = c.ZERO;\n    const tableSize = 2 ** windowSize - 1; // table size (without zero)\n    const chunks = Math.ceil(fieldN.BITS / windowSize); // chunks of item\n    const MASK = bitMask(windowSize);\n    const tables = points.map((p) => {\n        const res = [];\n        for (let i = 0, acc = p; i < tableSize; i++) {\n            res.push(acc);\n            acc = acc.add(p);\n        }\n        return res;\n    });\n    return (scalars) => {\n        validateMSMScalars(scalars, fieldN);\n        if (scalars.length > points.length)\n            throw new Error('array of scalars must be smaller than array of points');\n        let res = zero;\n        for (let i = 0; i < chunks; i++) {\n            // No need to double if accumulator is still zero.\n            if (res !== zero)\n                for (let j = 0; j < windowSize; j++)\n                    res = res.double();\n            const shiftBy = BigInt(chunks * windowSize - (i + 1) * windowSize);\n            for (let j = 0; j < scalars.length; j++) {\n                const n = scalars[j];\n                const curr = Number((n >> shiftBy) & MASK);\n                if (!curr)\n                    continue; // skip zero scalars chunks\n                res = res.add(tables[j][curr - 1]);\n            }\n        }\n        return res;\n    };\n}\nexport function validateBasic(curve) {\n    validateField(curve.Fp);\n    validateObject(curve, {\n        n: 'bigint',\n        h: 'bigint',\n        Gx: 'field',\n        Gy: 'field',\n    }, {\n        nBitLength: 'isSafeInteger',\n        nByteLength: 'isSafeInteger',\n    });\n    // Set defaults\n    return Object.freeze({\n        ...nLength(curve.n, curve.nBitLength),\n        ...curve,\n        ...{ p: curve.Fp.ORDER },\n    });\n}\n//# sourceMappingURL=curve.js.map","/**\n * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.\n *\n * ### Parameters\n *\n * To initialize a weierstrass curve, one needs to pass following params:\n *\n * * a: formula param\n * * b: formula param\n * * Fp: finite field of prime characteristic P; may be complex (Fp2). Arithmetics is done in field\n * * n: order of prime subgroup a.k.a total amount of valid curve points\n * * Gx: Base point (x, y) aka generator point. Gx = x coordinate\n * * Gy: ...y coordinate\n * * h: cofactor, usually 1. h*n = curve group order (n is only subgroup order)\n * * lowS: whether to enable (default) or disable \"low-s\" non-malleable signatures\n *\n * ### Design rationale for types\n *\n * * Interaction between classes from different curves should fail:\n *   `k256.Point.BASE.add(p256.Point.BASE)`\n * * For this purpose we want to use `instanceof` operator, which is fast and works during runtime\n * * Different calls of `curve()` would return different classes -\n *   `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,\n *   it won't affect others\n *\n * TypeScript can't infer types for classes created inside a function. Classes is one instance\n * of nominative types in TypeScript and interfaces only check for shape, so it's hard to create\n * unique type for every function call.\n *\n * We can use generic types via some param, like curve opts, but that would:\n *     1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)\n *     which is hard to debug.\n *     2. Params can be generic and we can't enforce them to be constant value:\n *     if somebody creates curve from non-constant params,\n *     it would be allowed to interact with other curves with non-constant params\n *\n * @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\n// prettier-ignore\nimport { pippenger, validateBasic, wNAF } from \"./curve.js\";\n// prettier-ignore\nimport { Field, FpInvertBatch, getMinHashLength, invert, mapHashToField, mod, validateField } from \"./modular.js\";\n// prettier-ignore\nimport { aInRange, abool, bitMask, bytesToHex, bytesToNumberBE, concatBytes, createHmacDrbg, ensureBytes, hexToBytes, inRange, isBytes, memoized, numberToBytesBE, numberToHexUnpadded, validateObject } from \"./utils.js\";\nfunction validateSigVerOpts(opts) {\n    if (opts.lowS !== undefined)\n        abool('lowS', opts.lowS);\n    if (opts.prehash !== undefined)\n        abool('prehash', opts.prehash);\n}\nfunction validatePointOpts(curve) {\n    const opts = validateBasic(curve);\n    validateObject(opts, {\n        a: 'field',\n        b: 'field',\n    }, {\n        allowInfinityPoint: 'boolean',\n        allowedPrivateKeyLengths: 'array',\n        clearCofactor: 'function',\n        fromBytes: 'function',\n        isTorsionFree: 'function',\n        toBytes: 'function',\n        wrapPrivateKey: 'boolean',\n    });\n    const { endo, Fp, a } = opts;\n    if (endo) {\n        if (!Fp.eql(a, Fp.ZERO)) {\n            throw new Error('invalid endo: CURVE.a must be 0');\n        }\n        if (typeof endo !== 'object' ||\n            typeof endo.beta !== 'bigint' ||\n            typeof endo.splitScalar !== 'function') {\n            throw new Error('invalid endo: expected \"beta\": bigint and \"splitScalar\": function');\n        }\n    }\n    return Object.freeze({ ...opts });\n}\nexport class DERErr extends Error {\n    constructor(m = '') {\n        super(m);\n    }\n}\n/**\n * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:\n *\n *     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]\n *\n * Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html\n */\nexport const DER = {\n    // asn.1 DER encoding utils\n    Err: DERErr,\n    // Basic building block is TLV (Tag-Length-Value)\n    _tlv: {\n        encode: (tag, data) => {\n            const { Err: E } = DER;\n            if (tag < 0 || tag > 256)\n                throw new E('tlv.encode: wrong tag');\n            if (data.length & 1)\n                throw new E('tlv.encode: unpadded data');\n            const dataLen = data.length / 2;\n            const len = numberToHexUnpadded(dataLen);\n            if ((len.length / 2) & 128)\n                throw new E('tlv.encode: long form length too big');\n            // length of length with long form flag\n            const lenLen = dataLen > 127 ? numberToHexUnpadded((len.length / 2) | 128) : '';\n            const t = numberToHexUnpadded(tag);\n            return t + lenLen + len + data;\n        },\n        // v - value, l - left bytes (unparsed)\n        decode(tag, data) {\n            const { Err: E } = DER;\n            let pos = 0;\n            if (tag < 0 || tag > 256)\n                throw new E('tlv.encode: wrong tag');\n            if (data.length < 2 || data[pos++] !== tag)\n                throw new E('tlv.decode: wrong tlv');\n            const first = data[pos++];\n            const isLong = !!(first & 128); // First bit of first length byte is flag for short/long form\n            let length = 0;\n            if (!isLong)\n                length = first;\n            else {\n                // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]\n                const lenLen = first & 127;\n                if (!lenLen)\n                    throw new E('tlv.decode(long): indefinite length not supported');\n                if (lenLen > 4)\n                    throw new E('tlv.decode(long): byte length is too big'); // this will overflow u32 in js\n                const lengthBytes = data.subarray(pos, pos + lenLen);\n                if (lengthBytes.length !== lenLen)\n                    throw new E('tlv.decode: length bytes not complete');\n                if (lengthBytes[0] === 0)\n                    throw new E('tlv.decode(long): zero leftmost byte');\n                for (const b of lengthBytes)\n                    length = (length << 8) | b;\n                pos += lenLen;\n                if (length < 128)\n                    throw new E('tlv.decode(long): not minimal encoding');\n            }\n            const v = data.subarray(pos, pos + length);\n            if (v.length !== length)\n                throw new E('tlv.decode: wrong value length');\n            return { v, l: data.subarray(pos + length) };\n        },\n    },\n    // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,\n    // since we always use positive integers here. It must always be empty:\n    // - add zero byte if exists\n    // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)\n    _int: {\n        encode(num) {\n            const { Err: E } = DER;\n            if (num < _0n)\n                throw new E('integer: negative integers are not allowed');\n            let hex = numberToHexUnpadded(num);\n            // Pad with zero byte if negative flag is present\n            if (Number.parseInt(hex[0], 16) & 0b1000)\n                hex = '00' + hex;\n            if (hex.length & 1)\n                throw new E('unexpected DER parsing assertion: unpadded hex');\n            return hex;\n        },\n        decode(data) {\n            const { Err: E } = DER;\n            if (data[0] & 128)\n                throw new E('invalid signature integer: negative');\n            if (data[0] === 0x00 && !(data[1] & 128))\n                throw new E('invalid signature integer: unnecessary leading zero');\n            return bytesToNumberBE(data);\n        },\n    },\n    toSig(hex) {\n        // parse DER signature\n        const { Err: E, _int: int, _tlv: tlv } = DER;\n        const data = ensureBytes('signature', hex);\n        const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);\n        if (seqLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        const { v: rBytes, l: rLeftBytes } = tlv.decode(0x02, seqBytes);\n        const { v: sBytes, l: sLeftBytes } = tlv.decode(0x02, rLeftBytes);\n        if (sLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        return { r: int.decode(rBytes), s: int.decode(sBytes) };\n    },\n    hexFromSig(sig) {\n        const { _tlv: tlv, _int: int } = DER;\n        const rs = tlv.encode(0x02, int.encode(sig.r));\n        const ss = tlv.encode(0x02, int.encode(sig.s));\n        const seq = rs + ss;\n        return tlv.encode(0x30, seq);\n    },\n};\nfunction numToSizedHex(num, size) {\n    return bytesToHex(numberToBytesBE(num, size));\n}\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);\nexport function weierstrassPoints(opts) {\n    const CURVE = validatePointOpts(opts);\n    const { Fp } = CURVE; // All curves has same field / group length as for now, but they can differ\n    const Fn = Field(CURVE.n, CURVE.nBitLength);\n    const toBytes = CURVE.toBytes ||\n        ((_c, point, _isCompressed) => {\n            const a = point.toAffine();\n            return concatBytes(Uint8Array.from([0x04]), Fp.toBytes(a.x), Fp.toBytes(a.y));\n        });\n    const fromBytes = CURVE.fromBytes ||\n        ((bytes) => {\n            // const head = bytes[0];\n            const tail = bytes.subarray(1);\n            // if (head !== 0x04) throw new Error('Only non-compressed encoding is supported');\n            const x = Fp.fromBytes(tail.subarray(0, Fp.BYTES));\n            const y = Fp.fromBytes(tail.subarray(Fp.BYTES, 2 * Fp.BYTES));\n            return { x, y };\n        });\n    /**\n     * y² = x³ + ax + b: Short weierstrass curve formula. Takes x, returns y².\n     * @returns y²\n     */\n    function weierstrassEquation(x) {\n        const { a, b } = CURVE;\n        const x2 = Fp.sqr(x); // x * x\n        const x3 = Fp.mul(x2, x); // x² * x\n        return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x³ + a * x + b\n    }\n    function isValidXY(x, y) {\n        const left = Fp.sqr(y); // y²\n        const right = weierstrassEquation(x); // x³ + ax + b\n        return Fp.eql(left, right);\n    }\n    // Validate whether the passed curve params are valid.\n    // Test 1: equation y² = x³ + ax + b should work for generator point.\n    if (!isValidXY(CURVE.Gx, CURVE.Gy))\n        throw new Error('bad curve params: generator point');\n    // Test 2: discriminant Δ part should be non-zero: 4a³ + 27b² != 0.\n    // Guarantees curve is genus-1, smooth (non-singular).\n    const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);\n    const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));\n    if (Fp.is0(Fp.add(_4a3, _27b2)))\n        throw new Error('bad curve params: a or b');\n    // Valid group elements reside in range 1..n-1\n    function isWithinCurveOrder(num) {\n        return inRange(num, _1n, CURVE.n);\n    }\n    // Validates if priv key is valid and converts it to bigint.\n    // Supports options allowedPrivateKeyLengths and wrapPrivateKey.\n    function normPrivateKeyToScalar(key) {\n        const { allowedPrivateKeyLengths: lengths, nByteLength, wrapPrivateKey, n: N } = CURVE;\n        if (lengths && typeof key !== 'bigint') {\n            if (isBytes(key))\n                key = bytesToHex(key);\n            // Normalize to hex string, pad. E.g. P521 would norm 130-132 char hex to 132-char bytes\n            if (typeof key !== 'string' || !lengths.includes(key.length))\n                throw new Error('invalid private key');\n            key = key.padStart(nByteLength * 2, '0');\n        }\n        let num;\n        try {\n            num =\n                typeof key === 'bigint'\n                    ? key\n                    : bytesToNumberBE(ensureBytes('private key', key, nByteLength));\n        }\n        catch (error) {\n            throw new Error('invalid private key, expected hex or ' + nByteLength + ' bytes, got ' + typeof key);\n        }\n        if (wrapPrivateKey)\n            num = mod(num, N); // disabled by default, enabled for BLS\n        aInRange('private key', num, _1n, N); // num in range [1..N-1]\n        return num;\n    }\n    function aprjpoint(other) {\n        if (!(other instanceof Point))\n            throw new Error('ProjectivePoint expected');\n    }\n    // Memoized toAffine / validity check. They are heavy. Points are immutable.\n    // Converts Projective point to affine (x, y) coordinates.\n    // Can accept precomputed Z^-1 - for example, from invertBatch.\n    // (X, Y, Z) ∋ (x=X/Z, y=Y/Z)\n    const toAffineMemo = memoized((p, iz) => {\n        const { px: x, py: y, pz: z } = p;\n        // Fast-path for normalized points\n        if (Fp.eql(z, Fp.ONE))\n            return { x, y };\n        const is0 = p.is0();\n        // If invZ was 0, we return zero point. However we still want to execute\n        // all operations, so we replace invZ with a random number, 1.\n        if (iz == null)\n            iz = is0 ? Fp.ONE : Fp.inv(z);\n        const ax = Fp.mul(x, iz);\n        const ay = Fp.mul(y, iz);\n        const zz = Fp.mul(z, iz);\n        if (is0)\n            return { x: Fp.ZERO, y: Fp.ZERO };\n        if (!Fp.eql(zz, Fp.ONE))\n            throw new Error('invZ was invalid');\n        return { x: ax, y: ay };\n    });\n    // NOTE: on exception this will crash 'cached' and no value will be set.\n    // Otherwise true will be return\n    const assertValidMemo = memoized((p) => {\n        if (p.is0()) {\n            // (0, 1, 0) aka ZERO is invalid in most contexts.\n            // In BLS, ZERO can be serialized, so we allow it.\n            // (0, 0, 0) is invalid representation of ZERO.\n            if (CURVE.allowInfinityPoint && !Fp.is0(p.py))\n                return;\n            throw new Error('bad point: ZERO');\n        }\n        // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`\n        const { x, y } = p.toAffine();\n        // Check if x, y are valid field elements\n        if (!Fp.isValid(x) || !Fp.isValid(y))\n            throw new Error('bad point: x or y not FE');\n        if (!isValidXY(x, y))\n            throw new Error('bad point: equation left != right');\n        if (!p.isTorsionFree())\n            throw new Error('bad point: not in prime-order subgroup');\n        return true;\n    });\n    /**\n     * Projective Point works in 3d / projective (homogeneous) coordinates: (X, Y, Z) ∋ (x=X/Z, y=Y/Z)\n     * Default Point works in 2d / affine coordinates: (x, y)\n     * We're doing calculations in projective, because its operations don't require costly inversion.\n     */\n    class Point {\n        constructor(px, py, pz) {\n            if (px == null || !Fp.isValid(px))\n                throw new Error('x required');\n            if (py == null || !Fp.isValid(py) || Fp.is0(py))\n                throw new Error('y required');\n            if (pz == null || !Fp.isValid(pz))\n                throw new Error('z required');\n            this.px = px;\n            this.py = py;\n            this.pz = pz;\n            Object.freeze(this);\n        }\n        // Does not validate if the point is on-curve.\n        // Use fromHex instead, or call assertValidity() later.\n        static fromAffine(p) {\n            const { x, y } = p || {};\n            if (!p || !Fp.isValid(x) || !Fp.isValid(y))\n                throw new Error('invalid affine point');\n            if (p instanceof Point)\n                throw new Error('projective point not allowed');\n            const is0 = (i) => Fp.eql(i, Fp.ZERO);\n            // fromAffine(x:0, y:0) would produce (x:0, y:0, z:1), but we need (x:0, y:1, z:0)\n            if (is0(x) && is0(y))\n                return Point.ZERO;\n            return new Point(x, y, Fp.ONE);\n        }\n        get x() {\n            return this.toAffine().x;\n        }\n        get y() {\n            return this.toAffine().y;\n        }\n        /**\n         * Takes a bunch of Projective Points but executes only one\n         * inversion on all of them. Inversion is very slow operation,\n         * so this improves performance massively.\n         * Optimization: converts a list of projective points to a list of identical points with Z=1.\n         */\n        static normalizeZ(points) {\n            const toInv = FpInvertBatch(Fp, points.map((p) => p.pz));\n            return points.map((p, i) => p.toAffine(toInv[i])).map(Point.fromAffine);\n        }\n        /**\n         * Converts hash string or Uint8Array to Point.\n         * @param hex short/long ECDSA hex\n         */\n        static fromHex(hex) {\n            const P = Point.fromAffine(fromBytes(ensureBytes('pointHex', hex)));\n            P.assertValidity();\n            return P;\n        }\n        // Multiplies generator point by privateKey.\n        static fromPrivateKey(privateKey) {\n            return Point.BASE.multiply(normPrivateKeyToScalar(privateKey));\n        }\n        // Multiscalar Multiplication\n        static msm(points, scalars) {\n            return pippenger(Point, Fn, points, scalars);\n        }\n        // \"Private method\", don't use it directly\n        _setWindowSize(windowSize) {\n            wnaf.setWindowSize(this, windowSize);\n        }\n        // A point on curve is valid if it conforms to equation.\n        assertValidity() {\n            assertValidMemo(this);\n        }\n        hasEvenY() {\n            const { y } = this.toAffine();\n            if (Fp.isOdd)\n                return !Fp.isOdd(y);\n            throw new Error(\"Field doesn't support isOdd\");\n        }\n        /**\n         * Compare one point to another.\n         */\n        equals(other) {\n            aprjpoint(other);\n            const { px: X1, py: Y1, pz: Z1 } = this;\n            const { px: X2, py: Y2, pz: Z2 } = other;\n            const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));\n            const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));\n            return U1 && U2;\n        }\n        /**\n         * Flips point to one corresponding to (x, -y) in Affine coordinates.\n         */\n        negate() {\n            return new Point(this.px, Fp.neg(this.py), this.pz);\n        }\n        // Renes-Costello-Batina exception-free doubling formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 3\n        // Cost: 8M + 3S + 3*a + 2*b3 + 15add.\n        double() {\n            const { a, b } = CURVE;\n            const b3 = Fp.mul(b, _3n);\n            const { px: X1, py: Y1, pz: Z1 } = this;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            let t0 = Fp.mul(X1, X1); // step 1\n            let t1 = Fp.mul(Y1, Y1);\n            let t2 = Fp.mul(Z1, Z1);\n            let t3 = Fp.mul(X1, Y1);\n            t3 = Fp.add(t3, t3); // step 5\n            Z3 = Fp.mul(X1, Z1);\n            Z3 = Fp.add(Z3, Z3);\n            X3 = Fp.mul(a, Z3);\n            Y3 = Fp.mul(b3, t2);\n            Y3 = Fp.add(X3, Y3); // step 10\n            X3 = Fp.sub(t1, Y3);\n            Y3 = Fp.add(t1, Y3);\n            Y3 = Fp.mul(X3, Y3);\n            X3 = Fp.mul(t3, X3);\n            Z3 = Fp.mul(b3, Z3); // step 15\n            t2 = Fp.mul(a, t2);\n            t3 = Fp.sub(t0, t2);\n            t3 = Fp.mul(a, t3);\n            t3 = Fp.add(t3, Z3);\n            Z3 = Fp.add(t0, t0); // step 20\n            t0 = Fp.add(Z3, t0);\n            t0 = Fp.add(t0, t2);\n            t0 = Fp.mul(t0, t3);\n            Y3 = Fp.add(Y3, t0);\n            t2 = Fp.mul(Y1, Z1); // step 25\n            t2 = Fp.add(t2, t2);\n            t0 = Fp.mul(t2, t3);\n            X3 = Fp.sub(X3, t0);\n            Z3 = Fp.mul(t2, t1);\n            Z3 = Fp.add(Z3, Z3); // step 30\n            Z3 = Fp.add(Z3, Z3);\n            return new Point(X3, Y3, Z3);\n        }\n        // Renes-Costello-Batina exception-free addition formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 1\n        // Cost: 12M + 0S + 3*a + 3*b3 + 23add.\n        add(other) {\n            aprjpoint(other);\n            const { px: X1, py: Y1, pz: Z1 } = this;\n            const { px: X2, py: Y2, pz: Z2 } = other;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            const a = CURVE.a;\n            const b3 = Fp.mul(CURVE.b, _3n);\n            let t0 = Fp.mul(X1, X2); // step 1\n            let t1 = Fp.mul(Y1, Y2);\n            let t2 = Fp.mul(Z1, Z2);\n            let t3 = Fp.add(X1, Y1);\n            let t4 = Fp.add(X2, Y2); // step 5\n            t3 = Fp.mul(t3, t4);\n            t4 = Fp.add(t0, t1);\n            t3 = Fp.sub(t3, t4);\n            t4 = Fp.add(X1, Z1);\n            let t5 = Fp.add(X2, Z2); // step 10\n            t4 = Fp.mul(t4, t5);\n            t5 = Fp.add(t0, t2);\n            t4 = Fp.sub(t4, t5);\n            t5 = Fp.add(Y1, Z1);\n            X3 = Fp.add(Y2, Z2); // step 15\n            t5 = Fp.mul(t5, X3);\n            X3 = Fp.add(t1, t2);\n            t5 = Fp.sub(t5, X3);\n            Z3 = Fp.mul(a, t4);\n            X3 = Fp.mul(b3, t2); // step 20\n            Z3 = Fp.add(X3, Z3);\n            X3 = Fp.sub(t1, Z3);\n            Z3 = Fp.add(t1, Z3);\n            Y3 = Fp.mul(X3, Z3);\n            t1 = Fp.add(t0, t0); // step 25\n            t1 = Fp.add(t1, t0);\n            t2 = Fp.mul(a, t2);\n            t4 = Fp.mul(b3, t4);\n            t1 = Fp.add(t1, t2);\n            t2 = Fp.sub(t0, t2); // step 30\n            t2 = Fp.mul(a, t2);\n            t4 = Fp.add(t4, t2);\n            t0 = Fp.mul(t1, t4);\n            Y3 = Fp.add(Y3, t0);\n            t0 = Fp.mul(t5, t4); // step 35\n            X3 = Fp.mul(t3, X3);\n            X3 = Fp.sub(X3, t0);\n            t0 = Fp.mul(t3, t1);\n            Z3 = Fp.mul(t5, Z3);\n            Z3 = Fp.add(Z3, t0); // step 40\n            return new Point(X3, Y3, Z3);\n        }\n        subtract(other) {\n            return this.add(other.negate());\n        }\n        is0() {\n            return this.equals(Point.ZERO);\n        }\n        wNAF(n) {\n            return wnaf.wNAFCached(this, n, Point.normalizeZ);\n        }\n        /**\n         * Non-constant-time multiplication. Uses double-and-add algorithm.\n         * It's faster, but should only be used when you don't care about\n         * an exposed private key e.g. sig verification, which works over *public* keys.\n         */\n        multiplyUnsafe(sc) {\n            const { endo, n: N } = CURVE;\n            aInRange('scalar', sc, _0n, N);\n            const I = Point.ZERO;\n            if (sc === _0n)\n                return I;\n            if (this.is0() || sc === _1n)\n                return this;\n            // Case a: no endomorphism. Case b: has precomputes.\n            if (!endo || wnaf.hasPrecomputes(this))\n                return wnaf.wNAFCachedUnsafe(this, sc, Point.normalizeZ);\n            // Case c: endomorphism\n            /** See docs for {@link EndomorphismOpts} */\n            let { k1neg, k1, k2neg, k2 } = endo.splitScalar(sc);\n            let k1p = I;\n            let k2p = I;\n            let d = this;\n            while (k1 > _0n || k2 > _0n) {\n                if (k1 & _1n)\n                    k1p = k1p.add(d);\n                if (k2 & _1n)\n                    k2p = k2p.add(d);\n                d = d.double();\n                k1 >>= _1n;\n                k2 >>= _1n;\n            }\n            if (k1neg)\n                k1p = k1p.negate();\n            if (k2neg)\n                k2p = k2p.negate();\n            k2p = new Point(Fp.mul(k2p.px, endo.beta), k2p.py, k2p.pz);\n            return k1p.add(k2p);\n        }\n        /**\n         * Constant time multiplication.\n         * Uses wNAF method. Windowed method may be 10% faster,\n         * but takes 2x longer to generate and consumes 2x memory.\n         * Uses precomputes when available.\n         * Uses endomorphism for Koblitz curves.\n         * @param scalar by which the point would be multiplied\n         * @returns New point\n         */\n        multiply(scalar) {\n            const { endo, n: N } = CURVE;\n            aInRange('scalar', scalar, _1n, N);\n            let point, fake; // Fake point is used to const-time mult\n            /** See docs for {@link EndomorphismOpts} */\n            if (endo) {\n                const { k1neg, k1, k2neg, k2 } = endo.splitScalar(scalar);\n                let { p: k1p, f: f1p } = this.wNAF(k1);\n                let { p: k2p, f: f2p } = this.wNAF(k2);\n                k1p = wnaf.constTimeNegate(k1neg, k1p);\n                k2p = wnaf.constTimeNegate(k2neg, k2p);\n                k2p = new Point(Fp.mul(k2p.px, endo.beta), k2p.py, k2p.pz);\n                point = k1p.add(k2p);\n                fake = f1p.add(f2p);\n            }\n            else {\n                const { p, f } = this.wNAF(scalar);\n                point = p;\n                fake = f;\n            }\n            // Normalize `z` for both points, but return only real one\n            return Point.normalizeZ([point, fake])[0];\n        }\n        /**\n         * Efficiently calculate `aP + bQ`. Unsafe, can expose private key, if used incorrectly.\n         * Not using Strauss-Shamir trick: precomputation tables are faster.\n         * The trick could be useful if both P and Q are not G (not in our case).\n         * @returns non-zero affine point\n         */\n        multiplyAndAddUnsafe(Q, a, b) {\n            const G = Point.BASE; // No Strauss-Shamir trick: we have 10% faster G precomputes\n            const mul = (P, a // Select faster multiply() method\n            ) => (a === _0n || a === _1n || !P.equals(G) ? P.multiplyUnsafe(a) : P.multiply(a));\n            const sum = mul(this, a).add(mul(Q, b));\n            return sum.is0() ? undefined : sum;\n        }\n        // Converts Projective point to affine (x, y) coordinates.\n        // Can accept precomputed Z^-1 - for example, from invertBatch.\n        // (x, y, z) ∋ (x=x/z, y=y/z)\n        toAffine(iz) {\n            return toAffineMemo(this, iz);\n        }\n        isTorsionFree() {\n            const { h: cofactor, isTorsionFree } = CURVE;\n            if (cofactor === _1n)\n                return true; // No subgroups, always torsion-free\n            if (isTorsionFree)\n                return isTorsionFree(Point, this);\n            throw new Error('isTorsionFree() has not been declared for the elliptic curve');\n        }\n        clearCofactor() {\n            const { h: cofactor, clearCofactor } = CURVE;\n            if (cofactor === _1n)\n                return this; // Fast-path\n            if (clearCofactor)\n                return clearCofactor(Point, this);\n            return this.multiplyUnsafe(CURVE.h);\n        }\n        toRawBytes(isCompressed = true) {\n            abool('isCompressed', isCompressed);\n            this.assertValidity();\n            return toBytes(Point, this, isCompressed);\n        }\n        toHex(isCompressed = true) {\n            abool('isCompressed', isCompressed);\n            return bytesToHex(this.toRawBytes(isCompressed));\n        }\n    }\n    // base / generator point\n    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);\n    // zero / infinity / identity point\n    Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO); // 0, 1, 0\n    const { endo, nBitLength } = CURVE;\n    const wnaf = wNAF(Point, endo ? Math.ceil(nBitLength / 2) : nBitLength);\n    return {\n        CURVE,\n        ProjectivePoint: Point,\n        normPrivateKeyToScalar,\n        weierstrassEquation,\n        isWithinCurveOrder,\n    };\n}\nfunction validateOpts(curve) {\n    const opts = validateBasic(curve);\n    validateObject(opts, {\n        hash: 'hash',\n        hmac: 'function',\n        randomBytes: 'function',\n    }, {\n        bits2int: 'function',\n        bits2int_modN: 'function',\n        lowS: 'boolean',\n    });\n    return Object.freeze({ lowS: true, ...opts });\n}\n/**\n * Creates short weierstrass curve and ECDSA signature methods for it.\n * @example\n * import { Field } from '@noble/curves/abstract/modular';\n * // Before that, define BigInt-s: a, b, p, n, Gx, Gy\n * const curve = weierstrass({ a, b, Fp: Field(p), n, Gx, Gy, h: 1n })\n */\nexport function weierstrass(curveDef) {\n    const CURVE = validateOpts(curveDef);\n    const { Fp, n: CURVE_ORDER, nByteLength, nBitLength } = CURVE;\n    const compressedLen = Fp.BYTES + 1; // e.g. 33 for 32\n    const uncompressedLen = 2 * Fp.BYTES + 1; // e.g. 65 for 32\n    function modN(a) {\n        return mod(a, CURVE_ORDER);\n    }\n    function invN(a) {\n        return invert(a, CURVE_ORDER);\n    }\n    const { ProjectivePoint: Point, normPrivateKeyToScalar, weierstrassEquation, isWithinCurveOrder, } = weierstrassPoints({\n        ...CURVE,\n        toBytes(_c, point, isCompressed) {\n            const a = point.toAffine();\n            const x = Fp.toBytes(a.x);\n            const cat = concatBytes;\n            abool('isCompressed', isCompressed);\n            if (isCompressed) {\n                return cat(Uint8Array.from([point.hasEvenY() ? 0x02 : 0x03]), x);\n            }\n            else {\n                return cat(Uint8Array.from([0x04]), x, Fp.toBytes(a.y));\n            }\n        },\n        fromBytes(bytes) {\n            const len = bytes.length;\n            const head = bytes[0];\n            const tail = bytes.subarray(1);\n            // this.assertValidity() is done inside of fromHex\n            if (len === compressedLen && (head === 0x02 || head === 0x03)) {\n                const x = bytesToNumberBE(tail);\n                if (!inRange(x, _1n, Fp.ORDER))\n                    throw new Error('Point is not on curve');\n                const y2 = weierstrassEquation(x); // y² = x³ + ax + b\n                let y;\n                try {\n                    y = Fp.sqrt(y2); // y = y² ^ (p+1)/4\n                }\n                catch (sqrtError) {\n                    const suffix = sqrtError instanceof Error ? ': ' + sqrtError.message : '';\n                    throw new Error('Point is not on curve' + suffix);\n                }\n                const isYOdd = (y & _1n) === _1n;\n                // ECDSA\n                const isHeadOdd = (head & 1) === 1;\n                if (isHeadOdd !== isYOdd)\n                    y = Fp.neg(y);\n                return { x, y };\n            }\n            else if (len === uncompressedLen && head === 0x04) {\n                const x = Fp.fromBytes(tail.subarray(0, Fp.BYTES));\n                const y = Fp.fromBytes(tail.subarray(Fp.BYTES, 2 * Fp.BYTES));\n                return { x, y };\n            }\n            else {\n                const cl = compressedLen;\n                const ul = uncompressedLen;\n                throw new Error('invalid Point, expected length of ' + cl + ', or uncompressed ' + ul + ', got ' + len);\n            }\n        },\n    });\n    function isBiggerThanHalfOrder(number) {\n        const HALF = CURVE_ORDER >> _1n;\n        return number > HALF;\n    }\n    function normalizeS(s) {\n        return isBiggerThanHalfOrder(s) ? modN(-s) : s;\n    }\n    // slice bytes num\n    const slcNum = (b, from, to) => bytesToNumberBE(b.slice(from, to));\n    /**\n     * ECDSA signature with its (r, s) properties. Supports DER & compact representations.\n     */\n    class Signature {\n        constructor(r, s, recovery) {\n            aInRange('r', r, _1n, CURVE_ORDER); // r in [1..N]\n            aInRange('s', s, _1n, CURVE_ORDER); // s in [1..N]\n            this.r = r;\n            this.s = s;\n            if (recovery != null)\n                this.recovery = recovery;\n            Object.freeze(this);\n        }\n        // pair (bytes of r, bytes of s)\n        static fromCompact(hex) {\n            const l = nByteLength;\n            hex = ensureBytes('compactSignature', hex, l * 2);\n            return new Signature(slcNum(hex, 0, l), slcNum(hex, l, 2 * l));\n        }\n        // DER encoded ECDSA signature\n        // https://bitcoin.stackexchange.com/questions/57644/what-are-the-parts-of-a-bitcoin-transaction-input-script\n        static fromDER(hex) {\n            const { r, s } = DER.toSig(ensureBytes('DER', hex));\n            return new Signature(r, s);\n        }\n        /**\n         * @todo remove\n         * @deprecated\n         */\n        assertValidity() { }\n        addRecoveryBit(recovery) {\n            return new Signature(this.r, this.s, recovery);\n        }\n        recoverPublicKey(msgHash) {\n            const { r, s, recovery: rec } = this;\n            const h = bits2int_modN(ensureBytes('msgHash', msgHash)); // Truncate hash\n            if (rec == null || ![0, 1, 2, 3].includes(rec))\n                throw new Error('recovery id invalid');\n            const radj = rec === 2 || rec === 3 ? r + CURVE.n : r;\n            if (radj >= Fp.ORDER)\n                throw new Error('recovery id 2 or 3 invalid');\n            const prefix = (rec & 1) === 0 ? '02' : '03';\n            const R = Point.fromHex(prefix + numToSizedHex(radj, Fp.BYTES));\n            const ir = invN(radj); // r^-1\n            const u1 = modN(-h * ir); // -hr^-1\n            const u2 = modN(s * ir); // sr^-1\n            const Q = Point.BASE.multiplyAndAddUnsafe(R, u1, u2); // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1)\n            if (!Q)\n                throw new Error('point at infinify'); // unsafe is fine: no priv data leaked\n            Q.assertValidity();\n            return Q;\n        }\n        // Signatures should be low-s, to prevent malleability.\n        hasHighS() {\n            return isBiggerThanHalfOrder(this.s);\n        }\n        normalizeS() {\n            return this.hasHighS() ? new Signature(this.r, modN(-this.s), this.recovery) : this;\n        }\n        // DER-encoded\n        toDERRawBytes() {\n            return hexToBytes(this.toDERHex());\n        }\n        toDERHex() {\n            return DER.hexFromSig(this);\n        }\n        // padded bytes of r, then padded bytes of s\n        toCompactRawBytes() {\n            return hexToBytes(this.toCompactHex());\n        }\n        toCompactHex() {\n            const l = nByteLength;\n            return numToSizedHex(this.r, l) + numToSizedHex(this.s, l);\n        }\n    }\n    const utils = {\n        isValidPrivateKey(privateKey) {\n            try {\n                normPrivateKeyToScalar(privateKey);\n                return true;\n            }\n            catch (error) {\n                return false;\n            }\n        },\n        normPrivateKeyToScalar: normPrivateKeyToScalar,\n        /**\n         * Produces cryptographically secure private key from random of size\n         * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.\n         */\n        randomPrivateKey: () => {\n            const length = getMinHashLength(CURVE.n);\n            return mapHashToField(CURVE.randomBytes(length), CURVE.n);\n        },\n        /**\n         * Creates precompute table for an arbitrary EC point. Makes point \"cached\".\n         * Allows to massively speed-up `point.multiply(scalar)`.\n         * @returns cached point\n         * @example\n         * const fast = utils.precompute(8, ProjectivePoint.fromHex(someonesPubKey));\n         * fast.multiply(privKey); // much faster ECDH now\n         */\n        precompute(windowSize = 8, point = Point.BASE) {\n            point._setWindowSize(windowSize);\n            point.multiply(BigInt(3)); // 3 is arbitrary, just need any number here\n            return point;\n        },\n    };\n    /**\n     * Computes public key for a private key. Checks for validity of the private key.\n     * @param privateKey private key\n     * @param isCompressed whether to return compact (default), or full key\n     * @returns Public key, full when isCompressed=false; short when isCompressed=true\n     */\n    function getPublicKey(privateKey, isCompressed = true) {\n        return Point.fromPrivateKey(privateKey).toRawBytes(isCompressed);\n    }\n    /**\n     * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.\n     */\n    function isProbPub(item) {\n        if (typeof item === 'bigint')\n            return false;\n        if (item instanceof Point)\n            return true;\n        const arr = ensureBytes('key', item);\n        const len = arr.length;\n        const fpl = Fp.BYTES;\n        const compLen = fpl + 1; // e.g. 33 for 32\n        const uncompLen = 2 * fpl + 1; // e.g. 65 for 32\n        if (CURVE.allowedPrivateKeyLengths || nByteLength === compLen) {\n            return undefined;\n        }\n        else {\n            return len === compLen || len === uncompLen;\n        }\n    }\n    /**\n     * ECDH (Elliptic Curve Diffie Hellman).\n     * Computes shared public key from private key and public key.\n     * Checks: 1) private key validity 2) shared key is on-curve.\n     * Does NOT hash the result.\n     * @param privateA private key\n     * @param publicB different public key\n     * @param isCompressed whether to return compact (default), or full key\n     * @returns shared public key\n     */\n    function getSharedSecret(privateA, publicB, isCompressed = true) {\n        if (isProbPub(privateA) === true)\n            throw new Error('first arg must be private key');\n        if (isProbPub(publicB) === false)\n            throw new Error('second arg must be public key');\n        const b = Point.fromHex(publicB); // check for being on-curve\n        return b.multiply(normPrivateKeyToScalar(privateA)).toRawBytes(isCompressed);\n    }\n    // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.\n    // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.\n    // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.\n    // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors\n    const bits2int = CURVE.bits2int ||\n        function (bytes) {\n            // Our custom check \"just in case\", for protection against DoS\n            if (bytes.length > 8192)\n                throw new Error('input is too large');\n            // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)\n            // for some cases, since bytes.length * 8 is not actual bitLength.\n            const num = bytesToNumberBE(bytes); // check for == u8 done here\n            const delta = bytes.length * 8 - nBitLength; // truncate to nBitLength leftmost bits\n            return delta > 0 ? num >> BigInt(delta) : num;\n        };\n    const bits2int_modN = CURVE.bits2int_modN ||\n        function (bytes) {\n            return modN(bits2int(bytes)); // can't use bytesToNumberBE here\n        };\n    // NOTE: pads output with zero as per spec\n    const ORDER_MASK = bitMask(nBitLength);\n    /**\n     * Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`.\n     */\n    function int2octets(num) {\n        aInRange('num < 2^' + nBitLength, num, _0n, ORDER_MASK);\n        // works with order, can have different size than numToField!\n        return numberToBytesBE(num, nByteLength);\n    }\n    // Steps A, D of RFC6979 3.2\n    // Creates RFC6979 seed; converts msg/privKey to numbers.\n    // Used only in sign, not in verify.\n    // NOTE: we cannot assume here that msgHash has same amount of bytes as curve order,\n    // this will be invalid at least for P521. Also it can be bigger for P224 + SHA256\n    function prepSig(msgHash, privateKey, opts = defaultSigOpts) {\n        if (['recovered', 'canonical'].some((k) => k in opts))\n            throw new Error('sign() legacy options not supported');\n        const { hash, randomBytes } = CURVE;\n        let { lowS, prehash, extraEntropy: ent } = opts; // generates low-s sigs by default\n        if (lowS == null)\n            lowS = true; // RFC6979 3.2: we skip step A, because we already provide hash\n        msgHash = ensureBytes('msgHash', msgHash);\n        validateSigVerOpts(opts);\n        if (prehash)\n            msgHash = ensureBytes('prehashed msgHash', hash(msgHash));\n        // We can't later call bits2octets, since nested bits2int is broken for curves\n        // with nBitLength % 8 !== 0. Because of that, we unwrap it here as int2octets call.\n        // const bits2octets = (bits) => int2octets(bits2int_modN(bits))\n        const h1int = bits2int_modN(msgHash);\n        const d = normPrivateKeyToScalar(privateKey); // validate private key, convert to bigint\n        const seedArgs = [int2octets(d), int2octets(h1int)];\n        // extraEntropy. RFC6979 3.6: additional k' (optional).\n        if (ent != null && ent !== false) {\n            // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')\n            const e = ent === true ? randomBytes(Fp.BYTES) : ent; // generate random bytes OR pass as-is\n            seedArgs.push(ensureBytes('extraEntropy', e)); // check for being bytes\n        }\n        const seed = concatBytes(...seedArgs); // Step D of RFC6979 3.2\n        const m = h1int; // NOTE: no need to call bits2int second time here, it is inside truncateHash!\n        // Converts signature params into point w r/s, checks result for validity.\n        function k2sig(kBytes) {\n            // RFC 6979 Section 3.2, step 3: k = bits2int(T)\n            const k = bits2int(kBytes); // Cannot use fields methods, since it is group element\n            if (!isWithinCurveOrder(k))\n                return; // Important: all mod() calls here must be done over N\n            const ik = invN(k); // k^-1 mod n\n            const q = Point.BASE.multiply(k).toAffine(); // q = Gk\n            const r = modN(q.x); // r = q.x mod n\n            if (r === _0n)\n                return;\n            // Can use scalar blinding b^-1(bm + bdr) where b ∈ [1,q−1] according to\n            // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. We've decided against it:\n            // a) dependency on CSPRNG b) 15% slowdown c) doesn't really help since bigints are not CT\n            const s = modN(ik * modN(m + r * d)); // Not using blinding here\n            if (s === _0n)\n                return;\n            let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3, when q.x > n)\n            let normS = s;\n            if (lowS && isBiggerThanHalfOrder(s)) {\n                normS = normalizeS(s); // if lowS was passed, ensure s is always\n                recovery ^= 1; // // in the bottom half of N\n            }\n            return new Signature(r, normS, recovery); // use normS, not s\n        }\n        return { seed, k2sig };\n    }\n    const defaultSigOpts = { lowS: CURVE.lowS, prehash: false };\n    const defaultVerOpts = { lowS: CURVE.lowS, prehash: false };\n    /**\n     * Signs message hash with a private key.\n     * ```\n     * sign(m, d, k) where\n     *   (x, y) = G × k\n     *   r = x mod n\n     *   s = (m + dr)/k mod n\n     * ```\n     * @param msgHash NOT message. msg needs to be hashed to `msgHash`, or use `prehash`.\n     * @param privKey private key\n     * @param opts lowS for non-malleable sigs. extraEntropy for mixing randomness into k. prehash will hash first arg.\n     * @returns signature with recovery param\n     */\n    function sign(msgHash, privKey, opts = defaultSigOpts) {\n        const { seed, k2sig } = prepSig(msgHash, privKey, opts); // Steps A, D of RFC6979 3.2.\n        const C = CURVE;\n        const drbg = createHmacDrbg(C.hash.outputLen, C.nByteLength, C.hmac);\n        return drbg(seed, k2sig); // Steps B, C, D, E, F, G\n    }\n    // Enable precomputes. Slows down first publicKey computation by 20ms.\n    Point.BASE._setWindowSize(8);\n    // utils.precompute(8, ProjectivePoint.BASE)\n    /**\n     * Verifies a signature against message hash and public key.\n     * Rejects lowS signatures by default: to override,\n     * specify option `{lowS: false}`. Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:\n     *\n     * ```\n     * verify(r, s, h, P) where\n     *   U1 = hs^-1 mod n\n     *   U2 = rs^-1 mod n\n     *   R = U1⋅G - U2⋅P\n     *   mod(R.x, n) == r\n     * ```\n     */\n    function verify(signature, msgHash, publicKey, opts = defaultVerOpts) {\n        const sg = signature;\n        msgHash = ensureBytes('msgHash', msgHash);\n        publicKey = ensureBytes('publicKey', publicKey);\n        const { lowS, prehash, format } = opts;\n        // Verify opts, deduce signature format\n        validateSigVerOpts(opts);\n        if ('strict' in opts)\n            throw new Error('options.strict was renamed to lowS');\n        if (format !== undefined && format !== 'compact' && format !== 'der')\n            throw new Error('format must be compact or der');\n        const isHex = typeof sg === 'string' || isBytes(sg);\n        const isObj = !isHex &&\n            !format &&\n            typeof sg === 'object' &&\n            sg !== null &&\n            typeof sg.r === 'bigint' &&\n            typeof sg.s === 'bigint';\n        if (!isHex && !isObj)\n            throw new Error('invalid signature, expected Uint8Array, hex string or Signature instance');\n        let _sig = undefined;\n        let P;\n        try {\n            if (isObj)\n                _sig = new Signature(sg.r, sg.s);\n            if (isHex) {\n                // Signature can be represented in 2 ways: compact (2*nByteLength) & DER (variable-length).\n                // Since DER can also be 2*nByteLength bytes, we check for it first.\n                try {\n                    if (format !== 'compact')\n                        _sig = Signature.fromDER(sg);\n                }\n                catch (derError) {\n                    if (!(derError instanceof DER.Err))\n                        throw derError;\n                }\n                if (!_sig && format !== 'der')\n                    _sig = Signature.fromCompact(sg);\n            }\n            P = Point.fromHex(publicKey);\n        }\n        catch (error) {\n            return false;\n        }\n        if (!_sig)\n            return false;\n        if (lowS && _sig.hasHighS())\n            return false;\n        if (prehash)\n            msgHash = CURVE.hash(msgHash);\n        const { r, s } = _sig;\n        const h = bits2int_modN(msgHash); // Cannot use fields methods, since it is group element\n        const is = invN(s); // s^-1\n        const u1 = modN(h * is); // u1 = hs^-1 mod n\n        const u2 = modN(r * is); // u2 = rs^-1 mod n\n        const R = Point.BASE.multiplyAndAddUnsafe(P, u1, u2)?.toAffine(); // R = u1⋅G + u2⋅P\n        if (!R)\n            return false;\n        const v = modN(R.x);\n        return v === r;\n    }\n    return {\n        CURVE,\n        getPublicKey,\n        getSharedSecret,\n        sign,\n        verify,\n        ProjectivePoint: Point,\n        Signature,\n        utils,\n    };\n}\n/**\n * Implementation of the Shallue and van de Woestijne method for any weierstrass curve.\n * TODO: check if there is a way to merge this with uvRatio in Edwards; move to modular.\n * b = True and y = sqrt(u / v) if (u / v) is square in F, and\n * b = False and y = sqrt(Z * (u / v)) otherwise.\n * @param Fp\n * @param Z\n * @returns\n */\nexport function SWUFpSqrtRatio(Fp, Z) {\n    // Generic implementation\n    const q = Fp.ORDER;\n    let l = _0n;\n    for (let o = q - _1n; o % _2n === _0n; o /= _2n)\n        l += _1n;\n    const c1 = l; // 1. c1, the largest integer such that 2^c1 divides q - 1.\n    // We need 2n ** c1 and 2n ** (c1-1). We can't use **; but we can use <<.\n    // 2n ** c1 == 2n << (c1-1)\n    const _2n_pow_c1_1 = _2n << (c1 - _1n - _1n);\n    const _2n_pow_c1 = _2n_pow_c1_1 * _2n;\n    const c2 = (q - _1n) / _2n_pow_c1; // 2. c2 = (q - 1) / (2^c1)  # Integer arithmetic\n    const c3 = (c2 - _1n) / _2n; // 3. c3 = (c2 - 1) / 2            # Integer arithmetic\n    const c4 = _2n_pow_c1 - _1n; // 4. c4 = 2^c1 - 1                # Integer arithmetic\n    const c5 = _2n_pow_c1_1; // 5. c5 = 2^(c1 - 1)                  # Integer arithmetic\n    const c6 = Fp.pow(Z, c2); // 6. c6 = Z^c2\n    const c7 = Fp.pow(Z, (c2 + _1n) / _2n); // 7. c7 = Z^((c2 + 1) / 2)\n    let sqrtRatio = (u, v) => {\n        let tv1 = c6; // 1. tv1 = c6\n        let tv2 = Fp.pow(v, c4); // 2. tv2 = v^c4\n        let tv3 = Fp.sqr(tv2); // 3. tv3 = tv2^2\n        tv3 = Fp.mul(tv3, v); // 4. tv3 = tv3 * v\n        let tv5 = Fp.mul(u, tv3); // 5. tv5 = u * tv3\n        tv5 = Fp.pow(tv5, c3); // 6. tv5 = tv5^c3\n        tv5 = Fp.mul(tv5, tv2); // 7. tv5 = tv5 * tv2\n        tv2 = Fp.mul(tv5, v); // 8. tv2 = tv5 * v\n        tv3 = Fp.mul(tv5, u); // 9. tv3 = tv5 * u\n        let tv4 = Fp.mul(tv3, tv2); // 10. tv4 = tv3 * tv2\n        tv5 = Fp.pow(tv4, c5); // 11. tv5 = tv4^c5\n        let isQR = Fp.eql(tv5, Fp.ONE); // 12. isQR = tv5 == 1\n        tv2 = Fp.mul(tv3, c7); // 13. tv2 = tv3 * c7\n        tv5 = Fp.mul(tv4, tv1); // 14. tv5 = tv4 * tv1\n        tv3 = Fp.cmov(tv2, tv3, isQR); // 15. tv3 = CMOV(tv2, tv3, isQR)\n        tv4 = Fp.cmov(tv5, tv4, isQR); // 16. tv4 = CMOV(tv5, tv4, isQR)\n        // 17. for i in (c1, c1 - 1, ..., 2):\n        for (let i = c1; i > _1n; i--) {\n            let tv5 = i - _2n; // 18.    tv5 = i - 2\n            tv5 = _2n << (tv5 - _1n); // 19.    tv5 = 2^tv5\n            let tvv5 = Fp.pow(tv4, tv5); // 20.    tv5 = tv4^tv5\n            const e1 = Fp.eql(tvv5, Fp.ONE); // 21.    e1 = tv5 == 1\n            tv2 = Fp.mul(tv3, tv1); // 22.    tv2 = tv3 * tv1\n            tv1 = Fp.mul(tv1, tv1); // 23.    tv1 = tv1 * tv1\n            tvv5 = Fp.mul(tv4, tv1); // 24.    tv5 = tv4 * tv1\n            tv3 = Fp.cmov(tv2, tv3, e1); // 25.    tv3 = CMOV(tv2, tv3, e1)\n            tv4 = Fp.cmov(tvv5, tv4, e1); // 26.    tv4 = CMOV(tv5, tv4, e1)\n        }\n        return { isValid: isQR, value: tv3 };\n    };\n    if (Fp.ORDER % _4n === _3n) {\n        // sqrt_ratio_3mod4(u, v)\n        const c1 = (Fp.ORDER - _3n) / _4n; // 1. c1 = (q - 3) / 4     # Integer arithmetic\n        const c2 = Fp.sqrt(Fp.neg(Z)); // 2. c2 = sqrt(-Z)\n        sqrtRatio = (u, v) => {\n            let tv1 = Fp.sqr(v); // 1. tv1 = v^2\n            const tv2 = Fp.mul(u, v); // 2. tv2 = u * v\n            tv1 = Fp.mul(tv1, tv2); // 3. tv1 = tv1 * tv2\n            let y1 = Fp.pow(tv1, c1); // 4. y1 = tv1^c1\n            y1 = Fp.mul(y1, tv2); // 5. y1 = y1 * tv2\n            const y2 = Fp.mul(y1, c2); // 6. y2 = y1 * c2\n            const tv3 = Fp.mul(Fp.sqr(y1), v); // 7. tv3 = y1^2; 8. tv3 = tv3 * v\n            const isQR = Fp.eql(tv3, u); // 9. isQR = tv3 == u\n            let y = Fp.cmov(y2, y1, isQR); // 10. y = CMOV(y2, y1, isQR)\n            return { isValid: isQR, value: y }; // 11. return (isQR, y) isQR ? y : y*c2\n        };\n    }\n    // No curves uses that\n    // if (Fp.ORDER % _8n === _5n) // sqrt_ratio_5mod8\n    return sqrtRatio;\n}\n/**\n * Simplified Shallue-van de Woestijne-Ulas Method\n * https://www.rfc-editor.org/rfc/rfc9380#section-6.6.2\n */\nexport function mapToCurveSimpleSWU(Fp, opts) {\n    validateField(Fp);\n    if (!Fp.isValid(opts.A) || !Fp.isValid(opts.B) || !Fp.isValid(opts.Z))\n        throw new Error('mapToCurveSimpleSWU: invalid opts');\n    const sqrtRatio = SWUFpSqrtRatio(Fp, opts.Z);\n    if (!Fp.isOdd)\n        throw new Error('Fp.isOdd is not implemented!');\n    // Input: u, an element of F.\n    // Output: (x, y), a point on E.\n    return (u) => {\n        // prettier-ignore\n        let tv1, tv2, tv3, tv4, tv5, tv6, x, y;\n        tv1 = Fp.sqr(u); // 1.  tv1 = u^2\n        tv1 = Fp.mul(tv1, opts.Z); // 2.  tv1 = Z * tv1\n        tv2 = Fp.sqr(tv1); // 3.  tv2 = tv1^2\n        tv2 = Fp.add(tv2, tv1); // 4.  tv2 = tv2 + tv1\n        tv3 = Fp.add(tv2, Fp.ONE); // 5.  tv3 = tv2 + 1\n        tv3 = Fp.mul(tv3, opts.B); // 6.  tv3 = B * tv3\n        tv4 = Fp.cmov(opts.Z, Fp.neg(tv2), !Fp.eql(tv2, Fp.ZERO)); // 7.  tv4 = CMOV(Z, -tv2, tv2 != 0)\n        tv4 = Fp.mul(tv4, opts.A); // 8.  tv4 = A * tv4\n        tv2 = Fp.sqr(tv3); // 9.  tv2 = tv3^2\n        tv6 = Fp.sqr(tv4); // 10. tv6 = tv4^2\n        tv5 = Fp.mul(tv6, opts.A); // 11. tv5 = A * tv6\n        tv2 = Fp.add(tv2, tv5); // 12. tv2 = tv2 + tv5\n        tv2 = Fp.mul(tv2, tv3); // 13. tv2 = tv2 * tv3\n        tv6 = Fp.mul(tv6, tv4); // 14. tv6 = tv6 * tv4\n        tv5 = Fp.mul(tv6, opts.B); // 15. tv5 = B * tv6\n        tv2 = Fp.add(tv2, tv5); // 16. tv2 = tv2 + tv5\n        x = Fp.mul(tv1, tv3); // 17.   x = tv1 * tv3\n        const { isValid, value } = sqrtRatio(tv2, tv6); // 18. (is_gx1_square, y1) = sqrt_ratio(tv2, tv6)\n        y = Fp.mul(tv1, u); // 19.   y = tv1 * u  -> Z * u^3 * y1\n        y = Fp.mul(y, value); // 20.   y = y * y1\n        x = Fp.cmov(x, tv3, isValid); // 21.   x = CMOV(x, tv3, is_gx1_square)\n        y = Fp.cmov(y, value, isValid); // 22.   y = CMOV(y, y1, is_gx1_square)\n        const e1 = Fp.isOdd(u) === Fp.isOdd(y); // 23.  e1 = sgn0(u) == sgn0(y)\n        y = Fp.cmov(Fp.neg(y), y, e1); // 24.   y = CMOV(-y, y, e1)\n        const tv4_inv = FpInvertBatch(Fp, [tv4], true)[0];\n        x = Fp.mul(x, tv4_inv); // 25.   x = x / tv4\n        return { x, y };\n    };\n}\n//# sourceMappingURL=weierstrass.js.map","/**\n * Utilities for short weierstrass curves, combined with noble-hashes.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { hmac } from '@noble/hashes/hmac';\nimport { concatBytes, randomBytes } from '@noble/hashes/utils';\nimport { weierstrass } from \"./abstract/weierstrass.js\";\n/** connects noble-curves to noble-hashes */\nexport function getHash(hash) {\n    return {\n        hash,\n        hmac: (key, ...msgs) => hmac(hash, key, concatBytes(...msgs)),\n        randomBytes,\n    };\n}\nexport function createCurve(curveDef, defHash) {\n    const create = (hash) => weierstrass({ ...curveDef, ...getHash(hash) });\n    return { ...create(defHash), create };\n}\n//# sourceMappingURL=_shortw_utils.js.map","import { FpInvertBatch, mod } from \"./modular.js\";\nimport { abytes, bytesToNumberBE, concatBytes, utf8ToBytes, validateObject } from \"./utils.js\";\n// Octet Stream to Integer. \"spec\" implementation of os2ip is 2.5x slower vs bytesToNumberBE.\nconst os2ip = bytesToNumberBE;\n// Integer to Octet Stream (numberToBytesBE)\nfunction i2osp(value, length) {\n    anum(value);\n    anum(length);\n    if (value < 0 || value >= 1 << (8 * length))\n        throw new Error('invalid I2OSP input: ' + value);\n    const res = Array.from({ length }).fill(0);\n    for (let i = length - 1; i >= 0; i--) {\n        res[i] = value & 0xff;\n        value >>>= 8;\n    }\n    return new Uint8Array(res);\n}\nfunction strxor(a, b) {\n    const arr = new Uint8Array(a.length);\n    for (let i = 0; i < a.length; i++) {\n        arr[i] = a[i] ^ b[i];\n    }\n    return arr;\n}\nfunction anum(item) {\n    if (!Number.isSafeInteger(item))\n        throw new Error('number expected');\n}\n/**\n * Produces a uniformly random byte string using a cryptographic hash function H that outputs b bits.\n * [RFC 9380 5.3.1](https://www.rfc-editor.org/rfc/rfc9380#section-5.3.1).\n */\nexport function expand_message_xmd(msg, DST, lenInBytes, H) {\n    abytes(msg);\n    abytes(DST);\n    anum(lenInBytes);\n    // https://www.rfc-editor.org/rfc/rfc9380#section-5.3.3\n    if (DST.length > 255)\n        DST = H(concatBytes(utf8ToBytes('H2C-OVERSIZE-DST-'), DST));\n    const { outputLen: b_in_bytes, blockLen: r_in_bytes } = H;\n    const ell = Math.ceil(lenInBytes / b_in_bytes);\n    if (lenInBytes > 65535 || ell > 255)\n        throw new Error('expand_message_xmd: invalid lenInBytes');\n    const DST_prime = concatBytes(DST, i2osp(DST.length, 1));\n    const Z_pad = i2osp(0, r_in_bytes);\n    const l_i_b_str = i2osp(lenInBytes, 2); // len_in_bytes_str\n    const b = new Array(ell);\n    const b_0 = H(concatBytes(Z_pad, msg, l_i_b_str, i2osp(0, 1), DST_prime));\n    b[0] = H(concatBytes(b_0, i2osp(1, 1), DST_prime));\n    for (let i = 1; i <= ell; i++) {\n        const args = [strxor(b_0, b[i - 1]), i2osp(i + 1, 1), DST_prime];\n        b[i] = H(concatBytes(...args));\n    }\n    const pseudo_random_bytes = concatBytes(...b);\n    return pseudo_random_bytes.slice(0, lenInBytes);\n}\n/**\n * Produces a uniformly random byte string using an extendable-output function (XOF) H.\n * 1. The collision resistance of H MUST be at least k bits.\n * 2. H MUST be an XOF that has been proved indifferentiable from\n *    a random oracle under a reasonable cryptographic assumption.\n * [RFC 9380 5.3.2](https://www.rfc-editor.org/rfc/rfc9380#section-5.3.2).\n */\nexport function expand_message_xof(msg, DST, lenInBytes, k, H) {\n    abytes(msg);\n    abytes(DST);\n    anum(lenInBytes);\n    // https://www.rfc-editor.org/rfc/rfc9380#section-5.3.3\n    // DST = H('H2C-OVERSIZE-DST-' || a_very_long_DST, Math.ceil((lenInBytes * k) / 8));\n    if (DST.length > 255) {\n        const dkLen = Math.ceil((2 * k) / 8);\n        DST = H.create({ dkLen }).update(utf8ToBytes('H2C-OVERSIZE-DST-')).update(DST).digest();\n    }\n    if (lenInBytes > 65535 || DST.length > 255)\n        throw new Error('expand_message_xof: invalid lenInBytes');\n    return (H.create({ dkLen: lenInBytes })\n        .update(msg)\n        .update(i2osp(lenInBytes, 2))\n        // 2. DST_prime = DST || I2OSP(len(DST), 1)\n        .update(DST)\n        .update(i2osp(DST.length, 1))\n        .digest());\n}\n/**\n * Hashes arbitrary-length byte strings to a list of one or more elements of a finite field F.\n * [RFC 9380 5.2](https://www.rfc-editor.org/rfc/rfc9380#section-5.2).\n * @param msg a byte string containing the message to hash\n * @param count the number of elements of F to output\n * @param options `{DST: string, p: bigint, m: number, k: number, expand: 'xmd' | 'xof', hash: H}`, see above\n * @returns [u_0, ..., u_(count - 1)], a list of field elements.\n */\nexport function hash_to_field(msg, count, options) {\n    validateObject(options, {\n        DST: 'stringOrUint8Array',\n        p: 'bigint',\n        m: 'isSafeInteger',\n        k: 'isSafeInteger',\n        hash: 'hash',\n    });\n    const { p, k, m, hash, expand, DST: _DST } = options;\n    abytes(msg);\n    anum(count);\n    const DST = typeof _DST === 'string' ? utf8ToBytes(_DST) : _DST;\n    const log2p = p.toString(2).length;\n    const L = Math.ceil((log2p + k) / 8); // section 5.1 of ietf draft link above\n    const len_in_bytes = count * m * L;\n    let prb; // pseudo_random_bytes\n    if (expand === 'xmd') {\n        prb = expand_message_xmd(msg, DST, len_in_bytes, hash);\n    }\n    else if (expand === 'xof') {\n        prb = expand_message_xof(msg, DST, len_in_bytes, k, hash);\n    }\n    else if (expand === '_internal_pass') {\n        // for internal tests only\n        prb = msg;\n    }\n    else {\n        throw new Error('expand must be \"xmd\" or \"xof\"');\n    }\n    const u = new Array(count);\n    for (let i = 0; i < count; i++) {\n        const e = new Array(m);\n        for (let j = 0; j < m; j++) {\n            const elm_offset = L * (j + i * m);\n            const tv = prb.subarray(elm_offset, elm_offset + L);\n            e[j] = mod(os2ip(tv), p);\n        }\n        u[i] = e;\n    }\n    return u;\n}\nexport function isogenyMap(field, map) {\n    // Make same order as in spec\n    const coeff = map.map((i) => Array.from(i).reverse());\n    return (x, y) => {\n        const [xn, xd, yn, yd] = coeff.map((val) => val.reduce((acc, i) => field.add(field.mul(acc, x), i)));\n        // 6.6.3\n        // Exceptional cases of iso_map are inputs that cause the denominator of\n        // either rational function to evaluate to zero; such cases MUST return\n        // the identity point on E.\n        const [xd_inv, yd_inv] = FpInvertBatch(field, [xd, yd], true);\n        x = field.mul(xn, xd_inv); // xNum / xDen\n        y = field.mul(y, field.mul(yn, yd_inv)); // y * (yNum / yDev)\n        return { x, y };\n    };\n}\n/** Creates hash-to-curve methods from EC Point and mapToCurve function. */\nexport function createHasher(Point, mapToCurve, defaults) {\n    if (typeof mapToCurve !== 'function')\n        throw new Error('mapToCurve() must be defined');\n    function map(num) {\n        return Point.fromAffine(mapToCurve(num));\n    }\n    function clear(initial) {\n        const P = initial.clearCofactor();\n        if (P.equals(Point.ZERO))\n            return Point.ZERO; // zero will throw in assert\n        P.assertValidity();\n        return P;\n    }\n    return {\n        defaults,\n        // Encodes byte string to elliptic curve.\n        // hash_to_curve from https://www.rfc-editor.org/rfc/rfc9380#section-3\n        hashToCurve(msg, options) {\n            const u = hash_to_field(msg, 2, { ...defaults, DST: defaults.DST, ...options });\n            const u0 = map(u[0]);\n            const u1 = map(u[1]);\n            return clear(u0.add(u1));\n        },\n        // Encodes byte string to elliptic curve.\n        // encode_to_curve from https://www.rfc-editor.org/rfc/rfc9380#section-3\n        encodeToCurve(msg, options) {\n            const u = hash_to_field(msg, 1, { ...defaults, DST: defaults.encodeDST, ...options });\n            return clear(map(u[0]));\n        },\n        // Same as encodeToCurve, but without hash\n        mapToCurve(scalars) {\n            if (!Array.isArray(scalars))\n                throw new Error('expected array of bigints');\n            for (const i of scalars)\n                if (typeof i !== 'bigint')\n                    throw new Error('expected array of bigints');\n            return clear(map(scalars));\n        },\n    };\n}\n//# sourceMappingURL=hash-to-curve.js.map","/**\n * NIST secp256k1. See [pdf](https://www.secg.org/sec2-v2.pdf).\n *\n * Seems to be rigid (not backdoored)\n * [as per discussion](https://bitcointalk.org/index.php?topic=289795.msg3183975#msg3183975).\n *\n * secp256k1 belongs to Koblitz curves: it has efficiently computable endomorphism.\n * Endomorphism uses 2x less RAM, speeds up precomputation by 2x and ECDH / key recovery by 20%.\n * For precomputed wNAF it trades off 1/2 init time & 1/3 ram for 20% perf hit.\n * [See explanation](https://gist.github.com/paulmillr/eb670806793e84df628a7c434a873066).\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha256 } from '@noble/hashes/sha2';\nimport { randomBytes } from '@noble/hashes/utils';\nimport { createCurve } from \"./_shortw_utils.js\";\nimport { createHasher, isogenyMap } from \"./abstract/hash-to-curve.js\";\nimport { Field, mod, pow2 } from \"./abstract/modular.js\";\nimport { aInRange, bytesToNumberBE, concatBytes, ensureBytes, inRange, numberToBytesBE, } from \"./abstract/utils.js\";\nimport { mapToCurveSimpleSWU } from \"./abstract/weierstrass.js\";\nconst secp256k1P = BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f');\nconst secp256k1N = BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141');\nconst _0n = BigInt(0);\nconst _1n = BigInt(1);\nconst _2n = BigInt(2);\nconst divNearest = (a, b) => (a + b / _2n) / b;\n/**\n * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.\n * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]\n */\nfunction sqrtMod(y) {\n    const P = secp256k1P;\n    // prettier-ignore\n    const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);\n    // prettier-ignore\n    const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);\n    const b2 = (y * y * y) % P; // x^3, 11\n    const b3 = (b2 * b2 * y) % P; // x^7\n    const b6 = (pow2(b3, _3n, P) * b3) % P;\n    const b9 = (pow2(b6, _3n, P) * b3) % P;\n    const b11 = (pow2(b9, _2n, P) * b2) % P;\n    const b22 = (pow2(b11, _11n, P) * b11) % P;\n    const b44 = (pow2(b22, _22n, P) * b22) % P;\n    const b88 = (pow2(b44, _44n, P) * b44) % P;\n    const b176 = (pow2(b88, _88n, P) * b88) % P;\n    const b220 = (pow2(b176, _44n, P) * b44) % P;\n    const b223 = (pow2(b220, _3n, P) * b3) % P;\n    const t1 = (pow2(b223, _23n, P) * b22) % P;\n    const t2 = (pow2(t1, _6n, P) * b2) % P;\n    const root = pow2(t2, _2n, P);\n    if (!Fpk1.eql(Fpk1.sqr(root), y))\n        throw new Error('Cannot find square root');\n    return root;\n}\nconst Fpk1 = Field(secp256k1P, undefined, undefined, { sqrt: sqrtMod });\n/**\n * secp256k1 curve, ECDSA and ECDH methods.\n *\n * Field: `2n**256n - 2n**32n - 2n**9n - 2n**8n - 2n**7n - 2n**6n - 2n**4n - 1n`\n *\n * @example\n * ```js\n * import { secp256k1 } from '@noble/curves/secp256k1';\n * const priv = secp256k1.utils.randomPrivateKey();\n * const pub = secp256k1.getPublicKey(priv);\n * const msg = new Uint8Array(32).fill(1); // message hash (not message) in ecdsa\n * const sig = secp256k1.sign(msg, priv); // `{prehash: true}` option is available\n * const isValid = secp256k1.verify(sig, msg, pub) === true;\n * ```\n */\nexport const secp256k1 = createCurve({\n    a: _0n,\n    b: BigInt(7),\n    Fp: Fpk1,\n    n: secp256k1N,\n    Gx: BigInt('55066263022277343669578718895168534326250603453777594175500187360389116729240'),\n    Gy: BigInt('32670510020758816978083085130507043184471273380659243275938904335757337482424'),\n    h: BigInt(1),\n    lowS: true, // Allow only low-S signatures by default in sign() and verify()\n    endo: {\n        // Endomorphism, see above\n        beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),\n        splitScalar: (k) => {\n            const n = secp256k1N;\n            const a1 = BigInt('0x3086d221a7d46bcde86c90e49284eb15');\n            const b1 = -_1n * BigInt('0xe4437ed6010e88286f547fa90abfe4c3');\n            const a2 = BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8');\n            const b2 = a1;\n            const POW_2_128 = BigInt('0x100000000000000000000000000000000'); // (2n**128n).toString(16)\n            const c1 = divNearest(b2 * k, n);\n            const c2 = divNearest(-b1 * k, n);\n            let k1 = mod(k - c1 * a1 - c2 * a2, n);\n            let k2 = mod(-c1 * b1 - c2 * b2, n);\n            const k1neg = k1 > POW_2_128;\n            const k2neg = k2 > POW_2_128;\n            if (k1neg)\n                k1 = n - k1;\n            if (k2neg)\n                k2 = n - k2;\n            if (k1 > POW_2_128 || k2 > POW_2_128) {\n                throw new Error('splitScalar: Endomorphism failed, k=' + k);\n            }\n            return { k1neg, k1, k2neg, k2 };\n        },\n    },\n}, sha256);\n// Schnorr signatures are superior to ECDSA from above. Below is Schnorr-specific BIP0340 code.\n// https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\n/** An object mapping tags to their tagged hash prefix of [SHA256(tag) | SHA256(tag)] */\nconst TAGGED_HASH_PREFIXES = {};\nfunction taggedHash(tag, ...messages) {\n    let tagP = TAGGED_HASH_PREFIXES[tag];\n    if (tagP === undefined) {\n        const tagH = sha256(Uint8Array.from(tag, (c) => c.charCodeAt(0)));\n        tagP = concatBytes(tagH, tagH);\n        TAGGED_HASH_PREFIXES[tag] = tagP;\n    }\n    return sha256(concatBytes(tagP, ...messages));\n}\n// ECDSA compact points are 33-byte. Schnorr is 32: we strip first byte 0x02 or 0x03\nconst pointToBytes = (point) => point.toRawBytes(true).slice(1);\nconst numTo32b = (n) => numberToBytesBE(n, 32);\nconst modP = (x) => mod(x, secp256k1P);\nconst modN = (x) => mod(x, secp256k1N);\nconst Point = /* @__PURE__ */ (() => secp256k1.ProjectivePoint)();\nconst GmulAdd = (Q, a, b) => Point.BASE.multiplyAndAddUnsafe(Q, a, b);\n// Calculate point, scalar and bytes\nfunction schnorrGetExtPubKey(priv) {\n    let d_ = secp256k1.utils.normPrivateKeyToScalar(priv); // same method executed in fromPrivateKey\n    let p = Point.fromPrivateKey(d_); // P = d'⋅G; 0 < d' < n check is done inside\n    const scalar = p.hasEvenY() ? d_ : modN(-d_);\n    return { scalar: scalar, bytes: pointToBytes(p) };\n}\n/**\n * lift_x from BIP340. Convert 32-byte x coordinate to elliptic curve point.\n * @returns valid point checked for being on-curve\n */\nfunction lift_x(x) {\n    aInRange('x', x, _1n, secp256k1P); // Fail if x ≥ p.\n    const xx = modP(x * x);\n    const c = modP(xx * x + BigInt(7)); // Let c = x³ + 7 mod p.\n    let y = sqrtMod(c); // Let y = c^(p+1)/4 mod p.\n    if (y % _2n !== _0n)\n        y = modP(-y); // Return the unique point P such that x(P) = x and\n    const p = new Point(x, y, _1n); // y(P) = y if y mod 2 = 0 or y(P) = p-y otherwise.\n    p.assertValidity();\n    return p;\n}\nconst num = bytesToNumberBE;\n/**\n * Create tagged hash, convert it to bigint, reduce modulo-n.\n */\nfunction challenge(...args) {\n    return modN(num(taggedHash('BIP0340/challenge', ...args)));\n}\n/**\n * Schnorr public key is just `x` coordinate of Point as per BIP340.\n */\nfunction schnorrGetPublicKey(privateKey) {\n    return schnorrGetExtPubKey(privateKey).bytes; // d'=int(sk). Fail if d'=0 or d'≥n. Ret bytes(d'⋅G)\n}\n/**\n * Creates Schnorr signature as per BIP340. Verifies itself before returning anything.\n * auxRand is optional and is not the sole source of k generation: bad CSPRNG won't be dangerous.\n */\nfunction schnorrSign(message, privateKey, auxRand = randomBytes(32)) {\n    const m = ensureBytes('message', message);\n    const { bytes: px, scalar: d } = schnorrGetExtPubKey(privateKey); // checks for isWithinCurveOrder\n    const a = ensureBytes('auxRand', auxRand, 32); // Auxiliary random data a: a 32-byte array\n    const t = numTo32b(d ^ num(taggedHash('BIP0340/aux', a))); // Let t be the byte-wise xor of bytes(d) and hash/aux(a)\n    const rand = taggedHash('BIP0340/nonce', t, px, m); // Let rand = hash/nonce(t || bytes(P) || m)\n    const k_ = modN(num(rand)); // Let k' = int(rand) mod n\n    if (k_ === _0n)\n        throw new Error('sign failed: k is zero'); // Fail if k' = 0.\n    const { bytes: rx, scalar: k } = schnorrGetExtPubKey(k_); // Let R = k'⋅G.\n    const e = challenge(rx, px, m); // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.\n    const sig = new Uint8Array(64); // Let sig = bytes(R) || bytes((k + ed) mod n).\n    sig.set(rx, 0);\n    sig.set(numTo32b(modN(k + e * d)), 32);\n    // If Verify(bytes(P), m, sig) (see below) returns failure, abort\n    if (!schnorrVerify(sig, m, px))\n        throw new Error('sign: Invalid signature produced');\n    return sig;\n}\n/**\n * Verifies Schnorr signature.\n * Will swallow errors & return false except for initial type validation of arguments.\n */\nfunction schnorrVerify(signature, message, publicKey) {\n    const sig = ensureBytes('signature', signature, 64);\n    const m = ensureBytes('message', message);\n    const pub = ensureBytes('publicKey', publicKey, 32);\n    try {\n        const P = lift_x(num(pub)); // P = lift_x(int(pk)); fail if that fails\n        const r = num(sig.subarray(0, 32)); // Let r = int(sig[0:32]); fail if r ≥ p.\n        if (!inRange(r, _1n, secp256k1P))\n            return false;\n        const s = num(sig.subarray(32, 64)); // Let s = int(sig[32:64]); fail if s ≥ n.\n        if (!inRange(s, _1n, secp256k1N))\n            return false;\n        const e = challenge(numTo32b(r), pointToBytes(P), m); // int(challenge(bytes(r)||bytes(P)||m))%n\n        const R = GmulAdd(P, s, modN(-e)); // R = s⋅G - e⋅P\n        if (!R || !R.hasEvenY() || R.toAffine().x !== r)\n            return false; // -eP == (n-e)P\n        return true; // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.\n    }\n    catch (error) {\n        return false;\n    }\n}\n/**\n * Schnorr signatures over secp256k1.\n * https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\n * @example\n * ```js\n * import { schnorr } from '@noble/curves/secp256k1';\n * const priv = schnorr.utils.randomPrivateKey();\n * const pub = schnorr.getPublicKey(priv);\n * const msg = new TextEncoder().encode('hello');\n * const sig = schnorr.sign(msg, priv);\n * const isValid = schnorr.verify(sig, msg, pub);\n * ```\n */\nexport const schnorr = /* @__PURE__ */ (() => ({\n    getPublicKey: schnorrGetPublicKey,\n    sign: schnorrSign,\n    verify: schnorrVerify,\n    utils: {\n        randomPrivateKey: secp256k1.utils.randomPrivateKey,\n        lift_x,\n        pointToBytes,\n        numberToBytesBE,\n        bytesToNumberBE,\n        taggedHash,\n        mod,\n    },\n}))();\nconst isoMap = /* @__PURE__ */ (() => isogenyMap(Fpk1, [\n    // xNum\n    [\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7',\n        '0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581',\n        '0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262',\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c',\n    ],\n    // xDen\n    [\n        '0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b',\n        '0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n    // yNum\n    [\n        '0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c',\n        '0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3',\n        '0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931',\n        '0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84',\n    ],\n    // yDen\n    [\n        '0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b',\n        '0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573',\n        '0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n].map((i) => i.map((j) => BigInt(j)))))();\nconst mapSWU = /* @__PURE__ */ (() => mapToCurveSimpleSWU(Fpk1, {\n    A: BigInt('0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533'),\n    B: BigInt('1771'),\n    Z: Fpk1.create(BigInt('-11')),\n}))();\n/** Hashing / encoding to secp256k1 points / field. RFC 9380 methods. */\nexport const secp256k1_hasher = /* @__PURE__ */ (() => createHasher(secp256k1.ProjectivePoint, (scalars) => {\n    const { x, y } = mapSWU(Fpk1.create(scalars[0]));\n    return isoMap(x, y);\n}, {\n    DST: 'secp256k1_XMD:SHA-256_SSWU_RO_',\n    encodeDST: 'secp256k1_XMD:SHA-256_SSWU_NU_',\n    p: Fpk1.ORDER,\n    m: 1,\n    k: 128,\n    expand: 'xmd',\n    hash: sha256,\n}))();\nexport const hashToCurve = /* @__PURE__ */ (() => secp256k1_hasher.hashToCurve)();\nexport const encodeToCurve = /* @__PURE__ */ (() => secp256k1_hasher.encodeToCurve)();\n//# sourceMappingURL=secp256k1.js.map"],"x_google_ignoreList":[0,1,2,3,4,5,6],"mappings":";;;;;;;;;AAKA,IAAa,OAAb,cAA0B,KAAK;CAC3B,YAAY,MAAM,MAAM;AACpB,SAAO;AACP,OAAK,WAAW;AAChB,OAAK,YAAY;AACjB,QAAM,KAAK;EACX,MAAM,MAAM,QAAQ,KAAK;AACzB,OAAK,QAAQ,KAAK,QAAQ;AAC1B,MAAI,OAAO,KAAK,MAAM,WAAW,WAC7B,OAAM,IAAI,MAAM,sDAAsD;AAC1E,OAAK,WAAW,KAAK,MAAM;AAC3B,OAAK,YAAY,KAAK,MAAM;EAC5B,MAAM,WAAW,KAAK;EACtB,MAAM,MAAM,IAAI,WAAW,SAAS;AAEpC,MAAI,IAAI,IAAI,SAAS,WAAW,KAAK,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,GAAG,IAAI;AACzE,OAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,IAC5B,KAAI,MAAM;AACd,OAAK,MAAM,OAAO,IAAI;AAEtB,OAAK,QAAQ,KAAK,QAAQ;AAE1B,OAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,IAC5B,KAAI,MAAM;AACd,OAAK,MAAM,OAAO,IAAI;AACtB,QAAM,IAAI;;CAEd,OAAO,KAAK;AACR,UAAQ,KAAK;AACb,OAAK,MAAM,OAAO,IAAI;AACtB,SAAO;;CAEX,WAAW,KAAK;AACZ,UAAQ,KAAK;AACb,SAAO,KAAK,KAAK,UAAU;AAC3B,OAAK,WAAW;AAChB,OAAK,MAAM,WAAW,IAAI;AAC1B,OAAK,MAAM,OAAO,IAAI;AACtB,OAAK,MAAM,WAAW,IAAI;AAC1B,OAAK,SAAS;;CAElB,SAAS;EACL,MAAM,MAAM,IAAI,WAAW,KAAK,MAAM,UAAU;AAChD,OAAK,WAAW,IAAI;AACpB,SAAO;;CAEX,WAAW,IAAI;AAEX,SAAO,KAAK,OAAO,OAAO,OAAO,eAAe,KAAK,EAAE,EAAE,CAAC;EAC1D,MAAM,EAAE,OAAO,OAAO,UAAU,WAAW,UAAU,cAAc;AACnE,OAAK;AACL,KAAG,WAAW;AACd,KAAG,YAAY;AACf,KAAG,WAAW;AACd,KAAG,YAAY;AACf,KAAG,QAAQ,MAAM,WAAW,GAAG,MAAM;AACrC,KAAG,QAAQ,MAAM,WAAW,GAAG,MAAM;AACrC,SAAO;;CAEX,QAAQ;AACJ,SAAO,KAAK,YAAY;;CAE5B,UAAU;AACN,OAAK,YAAY;AACjB,OAAK,MAAM,SAAS;AACpB,OAAK,MAAM,SAAS;;;;;;;;;;;;;AAa5B,MAAa,QAAQ,MAAM,KAAK,YAAY,IAAI,KAAK,MAAM,IAAI,CAAC,OAAO,QAAQ,CAAC,QAAQ;AACxF,KAAK,UAAU,MAAM,QAAQ,IAAI,KAAK,MAAM,IAAI;;;;;;;;;;AC1EhD,MAAMA,QAAM,OAAO,EAAE,EAAEC,QAAM,OAAO,EAAE,EAAEC,QAAsB,uBAAO,EAAE,EAAEC,QAAsB,uBAAO,EAAE;AAExG,MAAMC,QAAsB,uBAAO,EAAE,EAAE,MAAsB,uBAAO,EAAE,EAAE,MAAsB,uBAAO,EAAE;AAEvG,SAAgB,IAAI,GAAG,GAAG;CACtB,MAAM,SAAS,IAAI;AACnB,QAAO,UAAUJ,QAAM,SAAS,IAAI;;;AAaxC,SAAgB,KAAK,GAAG,OAAO,QAAQ;CACnC,IAAI,MAAM;AACV,QAAO,UAAUA,OAAK;AAClB,SAAO;AACP,SAAO;;AAEX,QAAO;;;;;;AAMX,SAAgB,OAAO,QAAQ,QAAQ;AACnC,KAAI,WAAWA,MACX,OAAM,IAAI,MAAM,mCAAmC;AACvD,KAAI,UAAUA,MACV,OAAM,IAAI,MAAM,4CAA4C,OAAO;CAEvE,IAAI,IAAI,IAAI,QAAQ,OAAO;CAC3B,IAAI,IAAI;CAER,IAAI,IAAIA,OAAK,IAAIC,OAAK,IAAIA,OAAK,IAAID;AACnC,QAAO,MAAMA,OAAK;EAEd,MAAM,IAAI,IAAI;EACd,MAAM,IAAI,IAAI;EACd,MAAM,IAAI,IAAI,IAAI;EAClB,MAAM,IAAI,IAAI,IAAI;AAElB,MAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI;;AAG3C,KADY,MACAC,MACR,OAAM,IAAI,MAAM,yBAAyB;AAC7C,QAAO,IAAI,GAAG,OAAO;;AAMzB,SAAS,UAAU,IAAI,GAAG;CACtB,MAAM,UAAU,GAAG,QAAQA,SAAOG;CAClC,MAAM,OAAO,GAAG,IAAI,GAAG,OAAO;AAE9B,KAAI,CAAC,GAAG,IAAI,GAAG,IAAI,KAAK,EAAE,EAAE,CACxB,OAAM,IAAI,MAAM,0BAA0B;AAC9C,QAAO;;AAEX,SAAS,UAAU,IAAI,GAAG;CACtB,MAAM,UAAU,GAAG,QAAQ,OAAO;CAClC,MAAM,KAAK,GAAG,IAAI,GAAGF,MAAI;CACzB,MAAM,IAAI,GAAG,IAAI,IAAI,OAAO;CAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE;CACvB,MAAM,IAAI,GAAG,IAAI,GAAG,IAAI,IAAIA,MAAI,EAAE,EAAE;CACpC,MAAM,OAAO,GAAG,IAAI,IAAI,GAAG,IAAI,GAAG,GAAG,IAAI,CAAC;AAC1C,KAAI,CAAC,GAAG,IAAI,GAAG,IAAI,KAAK,EAAE,EAAE,CACxB,OAAM,IAAI,MAAM,0BAA0B;AAC9C,QAAO;;;;;;;;;AA+BX,SAAgB,cAAc,GAAG;AAE7B,KAAI,IAAI,OAAO,EAAE,CACb,OAAM,IAAI,MAAM,sCAAsC;CAE1D,IAAI,IAAI,IAAID;CACZ,IAAI,IAAI;AACR,QAAO,IAAIC,UAAQF,OAAK;AACpB,OAAKE;AACL;;CAGJ,IAAI,IAAIA;CACR,MAAM,MAAM,MAAM,EAAE;AACpB,QAAO,WAAW,KAAK,EAAE,KAAK,EAG1B,KAAI,MAAM,IACN,OAAM,IAAI,MAAM,gDAAgD;AAGxE,KAAI,MAAM,EACN,QAAO;CAGX,IAAI,KAAK,IAAI,IAAI,GAAG,EAAE;CACtB,MAAM,UAAU,IAAID,SAAOC;AAC3B,QAAO,SAAS,YAAY,IAAI,GAAG;AAC/B,MAAI,GAAG,IAAI,EAAE,CACT,QAAO;AAEX,MAAI,WAAW,IAAI,EAAE,KAAK,EACtB,OAAM,IAAI,MAAM,0BAA0B;EAE9C,IAAI,IAAI;EACR,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG;EAC1B,IAAI,IAAI,GAAG,IAAI,GAAG,EAAE;EACpB,IAAI,IAAI,GAAG,IAAI,GAAG,OAAO;AAGzB,SAAO,CAAC,GAAG,IAAI,GAAG,GAAG,IAAI,EAAE;AACvB,OAAI,GAAG,IAAI,EAAE,CACT,QAAO,GAAG;GACd,IAAI,IAAI;GAER,IAAI,QAAQ,GAAG,IAAI,EAAE;AACrB,UAAO,CAAC,GAAG,IAAI,OAAO,GAAG,IAAI,EAAE;AAC3B;AACA,YAAQ,GAAG,IAAI,MAAM;AACrB,QAAI,MAAM,EACN,OAAM,IAAI,MAAM,0BAA0B;;GAGlD,MAAM,WAAWD,SAAO,OAAO,IAAI,IAAI,EAAE;GACzC,MAAM,IAAI,GAAG,IAAI,GAAG,SAAS;AAE7B,OAAI;AACJ,OAAI,GAAG,IAAI,EAAE;AACb,OAAI,GAAG,IAAI,GAAG,EAAE;AAChB,OAAI,GAAG,IAAI,GAAG,EAAE;;AAEpB,SAAO;;;;;;;;;;;;;AAaf,SAAgB,OAAO,GAAG;AAEtB,KAAI,IAAIG,UAAQD,MACZ,QAAO;AAEX,KAAI,IAAI,QAAQ,IACZ,QAAO;AAGX,QAAO,cAAc,EAAE;;AAK3B,MAAM,eAAe;CACjB;CAAU;CAAW;CAAO;CAAO;CAAO;CAAQ;CAClD;CAAO;CAAO;CAAO;CAAO;CAAO;CACnC;CAAQ;CAAQ;CAAQ;CAC3B;AACD,SAAgB,cAAc,OAAO;AAWjC,QAAO,eAAe,OAJT,aAAa,QAAQ,KAAK,QAAQ;AAC3C,MAAI,OAAO;AACX,SAAO;IARK;EACZ,OAAO;EACP,MAAM;EACN,OAAO;EACP,MAAM;EACT,CAIU,CACuB;;;;;;AAOtC,SAAgB,MAAM,IAAI,KAAK,OAAO;AAClC,KAAI,QAAQH,MACR,OAAM,IAAI,MAAM,0CAA0C;AAC9D,KAAI,UAAUA,MACV,QAAO,GAAG;AACd,KAAI,UAAUC,MACV,QAAO;CACX,IAAI,IAAI,GAAG;CACX,IAAI,IAAI;AACR,QAAO,QAAQD,OAAK;AAChB,MAAI,QAAQC,MACR,KAAI,GAAG,IAAI,GAAG,EAAE;AACpB,MAAI,GAAG,IAAI,EAAE;AACb,YAAUA;;AAEd,QAAO;;;;;;;AAOX,SAAgB,cAAc,IAAI,MAAM,WAAW,OAAO;CACtD,MAAM,WAAW,IAAI,MAAM,KAAK,OAAO,CAAC,KAAK,WAAW,GAAG,OAAO,KAAA,EAAU;CAE5E,MAAM,gBAAgB,KAAK,QAAQ,KAAK,KAAK,MAAM;AAC/C,MAAI,GAAG,IAAI,IAAI,CACX,QAAO;AACX,WAAS,KAAK;AACd,SAAO,GAAG,IAAI,KAAK,IAAI;IACxB,GAAG,IAAI;CAEV,MAAM,cAAc,GAAG,IAAI,cAAc;AAEzC,MAAK,aAAa,KAAK,KAAK,MAAM;AAC9B,MAAI,GAAG,IAAI,IAAI,CACX,QAAO;AACX,WAAS,KAAK,GAAG,IAAI,KAAK,SAAS,GAAG;AACtC,SAAO,GAAG,IAAI,KAAK,IAAI;IACxB,YAAY;AACf,QAAO;;;;;;;;;;;AAeX,SAAgB,WAAW,IAAI,GAAG;CAG9B,MAAM,UAAU,GAAG,QAAQA,SAAOC;CAClC,MAAM,UAAU,GAAG,IAAI,GAAG,OAAO;CACjC,MAAM,MAAM,GAAG,IAAI,SAAS,GAAG,IAAI;CACnC,MAAM,OAAO,GAAG,IAAI,SAAS,GAAG,KAAK;CACrC,MAAM,KAAK,GAAG,IAAI,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,KAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAClB,OAAM,IAAI,MAAM,iCAAiC;AACrD,QAAO,MAAM,IAAI,OAAO,IAAI;;AAQhC,SAAgB,QAAQ,GAAG,YAAY;AAEnC,KAAI,eAAe,KAAA,EACf,SAAQ,WAAW;CACvB,MAAM,cAAc,eAAe,KAAA,IAAY,aAAa,EAAE,SAAS,EAAE,CAAC;AAE1E,QAAO;EAAE,YAAY;EAAa,aADd,KAAK,KAAK,cAAc,EAAE;EACC;;;;;;;;;;;;;;;;;AAiBnD,SAAgB,MAAM,OAAO,QAAQ,OAAO,OAAO,QAAQ,EAAE,EAAE;AAC3D,KAAI,SAASF,MACT,OAAM,IAAI,MAAM,4CAA4C,MAAM;CACtE,MAAM,EAAE,YAAY,MAAM,aAAa,UAAU,QAAQ,OAAO,OAAO;AACvE,KAAI,QAAQ,KACR,OAAM,IAAI,MAAM,iDAAiD;CACrE,IAAI;CACJ,MAAM,IAAI,OAAO,OAAO;EACpB;EACA;EACA;EACA;EACA,MAAM,QAAQ,KAAK;EACnB,MAAMA;EACN,KAAKC;EACL,SAAS,QAAQ,IAAI,KAAK,MAAM;EAChC,UAAU,QAAQ;AACd,OAAI,OAAO,QAAQ,SACf,OAAM,IAAI,MAAM,iDAAiD,OAAO,IAAI;AAChF,UAAOD,SAAO,OAAO,MAAM;;EAE/B,MAAM,QAAQ,QAAQA;EACtB,QAAQ,SAAS,MAAMC,WAASA;EAChC,MAAM,QAAQ,IAAI,CAAC,KAAK,MAAM;EAC9B,MAAM,KAAK,QAAQ,QAAQ;EAC3B,MAAM,QAAQ,IAAI,MAAM,KAAK,MAAM;EACnC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM;EACxC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM;EACxC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM;EACxC,MAAM,KAAK,UAAU,MAAM,GAAG,KAAK,MAAM;EACzC,MAAM,KAAK,QAAQ,IAAI,MAAM,OAAO,KAAK,MAAM,EAAE,MAAM;EAEvD,OAAO,QAAQ,MAAM;EACrB,OAAO,KAAK,QAAQ,MAAM;EAC1B,OAAO,KAAK,QAAQ,MAAM;EAC1B,OAAO,KAAK,QAAQ,MAAM;EAC1B,MAAM,QAAQ,OAAO,KAAK,MAAM;EAChC,MAAM,MAAM,UACN,MAAM;AACJ,OAAI,CAAC,MACD,SAAQ,OAAO,MAAM;AACzB,UAAO,MAAM,GAAG,EAAE;;EAE1B,UAAU,QAAS,OAAO,gBAAgB,KAAK,MAAM,GAAG,gBAAgB,KAAK,MAAM;EACnF,YAAY,UAAU;AAClB,OAAI,MAAM,WAAW,MACjB,OAAM,IAAI,MAAM,+BAA+B,QAAQ,iBAAiB,MAAM,OAAO;AACzF,UAAO,OAAO,gBAAgB,MAAM,GAAG,gBAAgB,MAAM;;EAGjE,cAAc,QAAQ,cAAc,GAAG,IAAI;EAG3C,OAAO,GAAG,GAAG,MAAO,IAAI,IAAI;EAC/B,CAAC;AACF,QAAO,OAAO,OAAO,EAAE;;;;;;;;AAmC3B,SAAgB,oBAAoB,YAAY;AAC5C,KAAI,OAAO,eAAe,SACtB,OAAM,IAAI,MAAM,6BAA6B;CACjD,MAAM,YAAY,WAAW,SAAS,EAAE,CAAC;AACzC,QAAO,KAAK,KAAK,YAAY,EAAE;;;;;;;;;AASnC,SAAgB,iBAAiB,YAAY;CACzC,MAAM,SAAS,oBAAoB,WAAW;AAC9C,QAAO,SAAS,KAAK,KAAK,SAAS,EAAE;;;;;;;;;;;;;;;AAezC,SAAgB,eAAe,KAAK,YAAY,OAAO,OAAO;CAC1D,MAAM,MAAM,IAAI;CAChB,MAAM,WAAW,oBAAoB,WAAW;CAChD,MAAM,SAAS,iBAAiB,WAAW;AAE3C,KAAI,MAAM,MAAM,MAAM,UAAU,MAAM,KAClC,OAAM,IAAI,MAAM,cAAc,SAAS,+BAA+B,IAAI;CAG9E,MAAM,UAAU,IAFJ,OAAO,gBAAgB,IAAI,GAAG,gBAAgB,IAAI,EAErC,aAAaA,MAAI,GAAGA;AAC7C,QAAO,OAAO,gBAAgB,SAAS,SAAS,GAAG,gBAAgB,SAAS,SAAS;;;;;;;;;;AC9bzF,MAAMI,QAAM,OAAO,EAAE;AACrB,MAAMC,QAAM,OAAO,EAAE;AACrB,SAAS,gBAAgB,WAAW,MAAM;CACtC,MAAM,MAAM,KAAK,QAAQ;AACzB,QAAO,YAAY,MAAM;;AAE7B,SAAS,UAAU,GAAG,MAAM;AACxB,KAAI,CAAC,OAAO,cAAc,EAAE,IAAI,KAAK,KAAK,IAAI,KAC1C,OAAM,IAAI,MAAM,uCAAuC,OAAO,cAAc,EAAE;;AAEtF,SAAS,UAAU,GAAG,YAAY;AAC9B,WAAU,GAAG,WAAW;CACxB,MAAM,UAAU,KAAK,KAAK,aAAa,EAAE,GAAG;CAC5C,MAAM,aAAa,MAAM,IAAI;CAC7B,MAAM,YAAY,KAAK;AAGvB,QAAO;EAAE;EAAS;EAAY,MAFjB,QAAQ,EAAE;EAEa;EAAW,SAD/B,OAAO,EAAE;EAC+B;;AAE5D,SAAS,YAAY,GAAG,QAAQ,OAAO;CACnC,MAAM,EAAE,YAAY,MAAM,WAAW,YAAY;CACjD,IAAI,QAAQ,OAAO,IAAI,KAAK;CAC5B,IAAI,QAAQ,KAAK;AAMjB,KAAI,QAAQ,YAAY;AAEpB,WAAS;AACT,WAASA;;CAEb,MAAM,cAAc,SAAS;CAC7B,MAAM,SAAS,cAAc,KAAK,IAAI,MAAM,GAAG;CAC/C,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,QAAQ;CACtB,MAAM,SAAS,SAAS,MAAM;AAE9B,QAAO;EAAE;EAAO;EAAQ;EAAQ;EAAO;EAAQ,SAD/B;EACwC;;AAE5D,SAAS,kBAAkB,QAAQ,GAAG;AAClC,KAAI,CAAC,MAAM,QAAQ,OAAO,CACtB,OAAM,IAAI,MAAM,iBAAiB;AACrC,QAAO,SAAS,GAAG,MAAM;AACrB,MAAI,EAAE,aAAa,GACf,OAAM,IAAI,MAAM,4BAA4B,EAAE;GACpD;;AAEN,SAAS,mBAAmB,SAAS,OAAO;AACxC,KAAI,CAAC,MAAM,QAAQ,QAAQ,CACvB,OAAM,IAAI,MAAM,4BAA4B;AAChD,SAAQ,SAAS,GAAG,MAAM;AACtB,MAAI,CAAC,MAAM,QAAQ,EAAE,CACjB,OAAM,IAAI,MAAM,6BAA6B,EAAE;GACrD;;AAKN,MAAM,mCAAmB,IAAI,SAAS;AACtC,MAAM,mCAAmB,IAAI,SAAS;AACtC,SAAS,KAAK,GAAG;AACb,QAAO,iBAAiB,IAAI,EAAE,IAAI;;;;;;;;;;;;;;;;AAgBtC,SAAgB,KAAK,GAAG,MAAM;AAC1B,QAAO;EACH;EACA,eAAe,KAAK;AAChB,UAAO,KAAK,IAAI,KAAK;;EAGzB,aAAa,KAAK,GAAG,IAAI,EAAE,MAAM;GAC7B,IAAI,IAAI;AACR,UAAO,IAAID,OAAK;AACZ,QAAI,IAAIC,MACJ,KAAI,EAAE,IAAI,EAAE;AAChB,QAAI,EAAE,QAAQ;AACd,UAAMA;;AAEV,UAAO;;EAcX,iBAAiB,KAAK,GAAG;GACrB,MAAM,EAAE,SAAS,eAAe,UAAU,GAAG,KAAK;GAClD,MAAM,SAAS,EAAE;GACjB,IAAI,IAAI;GACR,IAAI,OAAO;AACX,QAAK,IAAI,SAAS,GAAG,SAAS,SAAS,UAAU;AAC7C,WAAO;AACP,WAAO,KAAK,KAAK;AAEjB,SAAK,IAAI,IAAI,GAAG,IAAI,YAAY,KAAK;AACjC,YAAO,KAAK,IAAI,EAAE;AAClB,YAAO,KAAK,KAAK;;AAErB,QAAI,KAAK,QAAQ;;AAErB,UAAO;;EASX,KAAK,GAAG,aAAa,GAAG;GAOpB,IAAI,IAAI,EAAE;GACV,IAAI,IAAI,EAAE;GAMV,MAAM,KAAK,UAAU,GAAG,KAAK;AAC7B,QAAK,IAAI,SAAS,GAAG,SAAS,GAAG,SAAS,UAAU;IAEhD,MAAM,EAAE,OAAO,QAAQ,QAAQ,OAAO,QAAQ,YAAY,YAAY,GAAG,QAAQ,GAAG;AACpF,QAAI;AACJ,QAAI,OAGA,KAAI,EAAE,IAAI,gBAAgB,QAAQ,YAAY,SAAS,CAAC;QAIxD,KAAI,EAAE,IAAI,gBAAgB,OAAO,YAAY,QAAQ,CAAC;;AAM9D,UAAO;IAAE;IAAG;IAAG;;EAUnB,WAAW,GAAG,aAAa,GAAG,MAAM,EAAE,MAAM;GACxC,MAAM,KAAK,UAAU,GAAG,KAAK;AAC7B,QAAK,IAAI,SAAS,GAAG,SAAS,GAAG,SAAS,UAAU;AAChD,QAAI,MAAMD,MACN;IACJ,MAAM,EAAE,OAAO,QAAQ,QAAQ,UAAU,YAAY,GAAG,QAAQ,GAAG;AACnE,QAAI;AACJ,QAAI,OAGA;SAEC;KACD,MAAM,OAAO,YAAY;AACzB,WAAM,IAAI,IAAI,QAAQ,KAAK,QAAQ,GAAG,KAAK;;;AAGnD,UAAO;;EAEX,eAAe,GAAG,GAAG,WAAW;GAE5B,IAAI,OAAO,iBAAiB,IAAI,EAAE;AAClC,OAAI,CAAC,MAAM;AACP,WAAO,KAAK,iBAAiB,GAAG,EAAE;AAClC,QAAI,MAAM,EACN,kBAAiB,IAAI,GAAG,UAAU,KAAK,CAAC;;AAEhD,UAAO;;EAEX,WAAW,GAAG,GAAG,WAAW;GACxB,MAAM,IAAI,KAAK,EAAE;AACjB,UAAO,KAAK,KAAK,GAAG,KAAK,eAAe,GAAG,GAAG,UAAU,EAAE,EAAE;;EAEhE,iBAAiB,GAAG,GAAG,WAAW,MAAM;GACpC,MAAM,IAAI,KAAK,EAAE;AACjB,OAAI,MAAM,EACN,QAAO,KAAK,aAAa,GAAG,GAAG,KAAK;AACxC,UAAO,KAAK,WAAW,GAAG,KAAK,eAAe,GAAG,GAAG,UAAU,EAAE,GAAG,KAAK;;EAK5E,cAAc,GAAG,GAAG;AAChB,aAAU,GAAG,KAAK;AAClB,oBAAiB,IAAI,GAAG,EAAE;AAC1B,oBAAiB,OAAO,EAAE;;EAEjC;;;;;;;;;;;;AAYL,SAAgB,UAAU,GAAG,QAAQ,QAAQ,SAAS;AAOlD,mBAAkB,QAAQ,EAAE;AAC5B,oBAAmB,SAAS,OAAO;CACnC,MAAM,UAAU,OAAO;CACvB,MAAM,UAAU,QAAQ;AACxB,KAAI,YAAY,QACZ,OAAM,IAAI,MAAM,sDAAsD;CAE1E,MAAM,OAAO,EAAE;CACf,MAAM,QAAQ,OAAO,OAAO,QAAQ,CAAC;CACrC,IAAI,aAAa;AACjB,KAAI,QAAQ,GACR,cAAa,QAAQ;UAChB,QAAQ,EACb,cAAa,QAAQ;UAChB,QAAQ,EACb,cAAa;CACjB,MAAM,OAAO,QAAQ,WAAW;CAChC,MAAM,UAAU,IAAI,MAAM,OAAO,KAAK,GAAG,EAAE,CAAC,KAAK,KAAK;CACtD,MAAM,WAAW,KAAK,OAAO,OAAO,OAAO,KAAK,WAAW,GAAG;CAC9D,IAAI,MAAM;AACV,MAAK,IAAI,IAAI,UAAU,KAAK,GAAG,KAAK,YAAY;AAC5C,UAAQ,KAAK,KAAK;AAClB,OAAK,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK;GAC9B,MAAM,SAAS,QAAQ;GACvB,MAAM,QAAQ,OAAQ,UAAU,OAAO,EAAE,GAAI,KAAK;AAClD,WAAQ,SAAS,QAAQ,OAAO,IAAI,OAAO,GAAG;;EAElD,IAAI,OAAO;AAEX,OAAK,IAAI,IAAI,QAAQ,SAAS,GAAG,OAAO,MAAM,IAAI,GAAG,KAAK;AACtD,UAAO,KAAK,IAAI,QAAQ,GAAG;AAC3B,UAAO,KAAK,IAAI,KAAK;;AAEzB,QAAM,IAAI,IAAI,KAAK;AACnB,MAAI,MAAM,EACN,MAAK,IAAI,IAAI,GAAG,IAAI,YAAY,IAC5B,OAAM,IAAI,QAAQ;;AAE9B,QAAO;;AAiFX,SAAgB,cAAc,OAAO;AACjC,eAAc,MAAM,GAAG;AACvB,gBAAe,OAAO;EAClB,GAAG;EACH,GAAG;EACH,IAAI;EACJ,IAAI;EACP,EAAE;EACC,YAAY;EACZ,aAAa;EAChB,CAAC;AAEF,QAAO,OAAO,OAAO;EACjB,GAAG,QAAQ,MAAM,GAAG,MAAM,WAAW;EACrC,GAAG;EACE,GAAG,MAAM,GAAG;EACpB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACjVN,SAAS,mBAAmB,MAAM;AAC9B,KAAI,KAAK,SAAS,KAAA,EACd,OAAM,QAAQ,KAAK,KAAK;AAC5B,KAAI,KAAK,YAAY,KAAA,EACjB,OAAM,WAAW,KAAK,QAAQ;;AAEtC,SAAS,kBAAkB,OAAO;CAC9B,MAAM,OAAO,cAAc,MAAM;AACjC,gBAAe,MAAM;EACjB,GAAG;EACH,GAAG;EACN,EAAE;EACC,oBAAoB;EACpB,0BAA0B;EAC1B,eAAe;EACf,WAAW;EACX,eAAe;EACf,SAAS;EACT,gBAAgB;EACnB,CAAC;CACF,MAAM,EAAE,MAAM,IAAI,MAAM;AACxB,KAAI,MAAM;AACN,MAAI,CAAC,GAAG,IAAI,GAAG,GAAG,KAAK,CACnB,OAAM,IAAI,MAAM,kCAAkC;AAEtD,MAAI,OAAO,SAAS,YAChB,OAAO,KAAK,SAAS,YACrB,OAAO,KAAK,gBAAgB,WAC5B,OAAM,IAAI,MAAM,wEAAoE;;AAG5F,QAAO,OAAO,OAAO,EAAE,GAAG,MAAM,CAAC;;AAErC,IAAa,SAAb,cAA4B,MAAM;CAC9B,YAAY,IAAI,IAAI;AAChB,QAAM,EAAE;;;;;;;;;;AAUhB,MAAa,MAAM;CAEf,KAAK;CAEL,MAAM;EACF,SAAS,KAAK,SAAS;GACnB,MAAM,EAAE,KAAK,MAAM;AACnB,OAAI,MAAM,KAAK,MAAM,IACjB,OAAM,IAAI,EAAE,wBAAwB;AACxC,OAAI,KAAK,SAAS,EACd,OAAM,IAAI,EAAE,4BAA4B;GAC5C,MAAM,UAAU,KAAK,SAAS;GAC9B,MAAM,MAAM,oBAAoB,QAAQ;AACxC,OAAK,IAAI,SAAS,IAAK,IACnB,OAAM,IAAI,EAAE,uCAAuC;GAEvD,MAAM,SAAS,UAAU,MAAM,oBAAqB,IAAI,SAAS,IAAK,IAAI,GAAG;AAE7E,UADU,oBAAoB,IAAI,GACvB,SAAS,MAAM;;EAG9B,OAAO,KAAK,MAAM;GACd,MAAM,EAAE,KAAK,MAAM;GACnB,IAAI,MAAM;AACV,OAAI,MAAM,KAAK,MAAM,IACjB,OAAM,IAAI,EAAE,wBAAwB;AACxC,OAAI,KAAK,SAAS,KAAK,KAAK,WAAW,IACnC,OAAM,IAAI,EAAE,wBAAwB;GACxC,MAAM,QAAQ,KAAK;GACnB,MAAM,SAAS,CAAC,EAAE,QAAQ;GAC1B,IAAI,SAAS;AACb,OAAI,CAAC,OACD,UAAS;QACR;IAED,MAAM,SAAS,QAAQ;AACvB,QAAI,CAAC,OACD,OAAM,IAAI,EAAE,oDAAoD;AACpE,QAAI,SAAS,EACT,OAAM,IAAI,EAAE,2CAA2C;IAC3D,MAAM,cAAc,KAAK,SAAS,KAAK,MAAM,OAAO;AACpD,QAAI,YAAY,WAAW,OACvB,OAAM,IAAI,EAAE,wCAAwC;AACxD,QAAI,YAAY,OAAO,EACnB,OAAM,IAAI,EAAE,uCAAuC;AACvD,SAAK,MAAM,KAAK,YACZ,UAAU,UAAU,IAAK;AAC7B,WAAO;AACP,QAAI,SAAS,IACT,OAAM,IAAI,EAAE,yCAAyC;;GAE7D,MAAM,IAAI,KAAK,SAAS,KAAK,MAAM,OAAO;AAC1C,OAAI,EAAE,WAAW,OACb,OAAM,IAAI,EAAE,iCAAiC;AACjD,UAAO;IAAE;IAAG,GAAG,KAAK,SAAS,MAAM,OAAO;IAAE;;EAEnD;CAKD,MAAM;EACF,OAAO,KAAK;GACR,MAAM,EAAE,KAAK,MAAM;AACnB,OAAI,MAAME,MACN,OAAM,IAAI,EAAE,6CAA6C;GAC7D,IAAI,MAAM,oBAAoB,IAAI;AAElC,OAAI,OAAO,SAAS,IAAI,IAAI,GAAG,GAAG,EAC9B,OAAM,OAAO;AACjB,OAAI,IAAI,SAAS,EACb,OAAM,IAAI,EAAE,iDAAiD;AACjE,UAAO;;EAEX,OAAO,MAAM;GACT,MAAM,EAAE,KAAK,MAAM;AACnB,OAAI,KAAK,KAAK,IACV,OAAM,IAAI,EAAE,sCAAsC;AACtD,OAAI,KAAK,OAAO,KAAQ,EAAE,KAAK,KAAK,KAChC,OAAM,IAAI,EAAE,sDAAsD;AACtE,UAAO,gBAAgB,KAAK;;EAEnC;CACD,MAAM,KAAK;EAEP,MAAM,EAAE,KAAK,GAAG,MAAM,KAAK,MAAM,QAAQ;EACzC,MAAM,OAAO,YAAY,aAAa,IAAI;EAC1C,MAAM,EAAE,GAAG,UAAU,GAAG,iBAAiB,IAAI,OAAO,IAAM,KAAK;AAC/D,MAAI,aAAa,OACb,OAAM,IAAI,EAAE,8CAA8C;EAC9D,MAAM,EAAE,GAAG,QAAQ,GAAG,eAAe,IAAI,OAAO,GAAM,SAAS;EAC/D,MAAM,EAAE,GAAG,QAAQ,GAAG,eAAe,IAAI,OAAO,GAAM,WAAW;AACjE,MAAI,WAAW,OACX,OAAM,IAAI,EAAE,8CAA8C;AAC9D,SAAO;GAAE,GAAG,IAAI,OAAO,OAAO;GAAE,GAAG,IAAI,OAAO,OAAO;GAAE;;CAE3D,WAAW,KAAK;EACZ,MAAM,EAAE,MAAM,KAAK,MAAM,QAAQ;EAGjC,MAAM,MAFK,IAAI,OAAO,GAAM,IAAI,OAAO,IAAI,EAAE,CAAC,GACnC,IAAI,OAAO,GAAM,IAAI,OAAO,IAAI,EAAE,CAAC;AAE9C,SAAO,IAAI,OAAO,IAAM,IAAI;;CAEnC;AACD,SAAS,cAAc,KAAK,MAAM;AAC9B,QAAO,WAAW,gBAAgB,KAAK,KAAK,CAAC;;AAIjD,MAAMA,QAAM,OAAO,EAAE,EAAEC,QAAM,OAAO,EAAE,EAAEC,QAAM,OAAO,EAAE,EAAE,MAAM,OAAO,EAAE,EAAE,MAAM,OAAO,EAAE;AACzF,SAAgB,kBAAkB,MAAM;CACpC,MAAM,QAAQ,kBAAkB,KAAK;CACrC,MAAM,EAAE,OAAO;CACf,MAAM,KAAK,MAAM,MAAM,GAAG,MAAM,WAAW;CAC3C,MAAM,UAAU,MAAM,aAChB,IAAI,OAAO,kBAAkB;EAC3B,MAAM,IAAI,MAAM,UAAU;AAC1B,SAAOC,cAAY,WAAW,KAAK,CAAC,EAAK,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,CAAC;;CAErF,MAAM,YAAY,MAAM,eAClB,UAAU;EAER,MAAM,OAAO,MAAM,SAAS,EAAE;AAI9B,SAAO;GAAE,GAFC,GAAG,UAAU,KAAK,SAAS,GAAG,GAAG,MAAM,CAAC;GAEtC,GADF,GAAG,UAAU,KAAK,SAAS,GAAG,OAAO,IAAI,GAAG,MAAM,CAAC;GAC9C;;;;;;CAMvB,SAAS,oBAAoB,GAAG;EAC5B,MAAM,EAAE,GAAG,MAAM;EACjB,MAAM,KAAK,GAAG,IAAI,EAAE;EACpB,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE;AACxB,SAAO,GAAG,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE;;CAE9C,SAAS,UAAU,GAAG,GAAG;EACrB,MAAM,OAAO,GAAG,IAAI,EAAE;EACtB,MAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,GAAG,IAAI,MAAM,MAAM;;AAI9B,KAAI,CAAC,UAAU,MAAM,IAAI,MAAM,GAAG,CAC9B,OAAM,IAAI,MAAM,oCAAoC;CAGxD,MAAM,OAAO,GAAG,IAAI,GAAG,IAAI,MAAM,GAAG,IAAI,EAAE,IAAI;CAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,MAAM,EAAE,EAAE,OAAO,GAAG,CAAC;AACjD,KAAI,GAAG,IAAI,GAAG,IAAI,MAAM,MAAM,CAAC,CAC3B,OAAM,IAAI,MAAM,2BAA2B;CAE/C,SAAS,mBAAmB,KAAK;AAC7B,SAAO,QAAQ,KAAKF,OAAK,MAAM,EAAE;;CAIrC,SAAS,uBAAuB,KAAK;EACjC,MAAM,EAAE,0BAA0B,SAAS,aAAa,gBAAgB,GAAG,MAAM;AACjF,MAAI,WAAW,OAAO,QAAQ,UAAU;AACpC,OAAI,QAAQ,IAAI,CACZ,OAAM,WAAW,IAAI;AAEzB,OAAI,OAAO,QAAQ,YAAY,CAAC,QAAQ,SAAS,IAAI,OAAO,CACxD,OAAM,IAAI,MAAM,sBAAsB;AAC1C,SAAM,IAAI,SAAS,cAAc,GAAG,IAAI;;EAE5C,IAAI;AACJ,MAAI;AACA,SACI,OAAO,QAAQ,WACT,MACA,gBAAgB,YAAY,eAAe,KAAK,YAAY,CAAC;WAEpE,OAAO;AACV,SAAM,IAAI,MAAM,0CAA0C,cAAc,iBAAiB,OAAO,IAAI;;AAExG,MAAI,eACA,OAAM,IAAI,KAAK,EAAE;AACrB,WAAS,eAAe,KAAKA,OAAK,EAAE;AACpC,SAAO;;CAEX,SAAS,UAAU,OAAO;AACtB,MAAI,EAAE,iBAAiB,OACnB,OAAM,IAAI,MAAM,2BAA2B;;CAMnD,MAAM,eAAe,UAAU,GAAG,OAAO;EACrC,MAAM,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,MAAM;AAEhC,MAAI,GAAG,IAAI,GAAG,GAAG,IAAI,CACjB,QAAO;GAAE;GAAG;GAAG;EACnB,MAAM,MAAM,EAAE,KAAK;AAGnB,MAAI,MAAM,KACN,MAAK,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE;EACjC,MAAM,KAAK,GAAG,IAAI,GAAG,GAAG;EACxB,MAAM,KAAK,GAAG,IAAI,GAAG,GAAG;EACxB,MAAM,KAAK,GAAG,IAAI,GAAG,GAAG;AACxB,MAAI,IACA,QAAO;GAAE,GAAG,GAAG;GAAM,GAAG,GAAG;GAAM;AACrC,MAAI,CAAC,GAAG,IAAI,IAAI,GAAG,IAAI,CACnB,OAAM,IAAI,MAAM,mBAAmB;AACvC,SAAO;GAAE,GAAG;GAAI,GAAG;GAAI;GACzB;CAGF,MAAM,kBAAkB,UAAU,MAAM;AACpC,MAAI,EAAE,KAAK,EAAE;AAIT,OAAI,MAAM,sBAAsB,CAAC,GAAG,IAAI,EAAE,GAAG,CACzC;AACJ,SAAM,IAAI,MAAM,kBAAkB;;EAGtC,MAAM,EAAE,GAAG,MAAM,EAAE,UAAU;AAE7B,MAAI,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,GAAG,QAAQ,EAAE,CAChC,OAAM,IAAI,MAAM,2BAA2B;AAC/C,MAAI,CAAC,UAAU,GAAG,EAAE,CAChB,OAAM,IAAI,MAAM,oCAAoC;AACxD,MAAI,CAAC,EAAE,eAAe,CAClB,OAAM,IAAI,MAAM,yCAAyC;AAC7D,SAAO;GACT;;;;;;CAMF,MAAM,MAAM;EACR,YAAY,IAAI,IAAI,IAAI;AACpB,OAAI,MAAM,QAAQ,CAAC,GAAG,QAAQ,GAAG,CAC7B,OAAM,IAAI,MAAM,aAAa;AACjC,OAAI,MAAM,QAAQ,CAAC,GAAG,QAAQ,GAAG,IAAI,GAAG,IAAI,GAAG,CAC3C,OAAM,IAAI,MAAM,aAAa;AACjC,OAAI,MAAM,QAAQ,CAAC,GAAG,QAAQ,GAAG,CAC7B,OAAM,IAAI,MAAM,aAAa;AACjC,QAAK,KAAK;AACV,QAAK,KAAK;AACV,QAAK,KAAK;AACV,UAAO,OAAO,KAAK;;EAIvB,OAAO,WAAW,GAAG;GACjB,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE;AACxB,OAAI,CAAC,KAAK,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,GAAG,QAAQ,EAAE,CACtC,OAAM,IAAI,MAAM,uBAAuB;AAC3C,OAAI,aAAa,MACb,OAAM,IAAI,MAAM,+BAA+B;GACnD,MAAM,OAAO,MAAM,GAAG,IAAI,GAAG,GAAG,KAAK;AAErC,OAAI,IAAI,EAAE,IAAI,IAAI,EAAE,CAChB,QAAO,MAAM;AACjB,UAAO,IAAI,MAAM,GAAG,GAAG,GAAG,IAAI;;EAElC,IAAI,IAAI;AACJ,UAAO,KAAK,UAAU,CAAC;;EAE3B,IAAI,IAAI;AACJ,UAAO,KAAK,UAAU,CAAC;;;;;;;;EAQ3B,OAAO,WAAW,QAAQ;GACtB,MAAM,QAAQ,cAAc,IAAI,OAAO,KAAK,MAAM,EAAE,GAAG,CAAC;AACxD,UAAO,OAAO,KAAK,GAAG,MAAM,EAAE,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,WAAW;;;;;;EAM3E,OAAO,QAAQ,KAAK;GAChB,MAAM,IAAI,MAAM,WAAW,UAAU,YAAY,YAAY,IAAI,CAAC,CAAC;AACnE,KAAE,gBAAgB;AAClB,UAAO;;EAGX,OAAO,eAAe,YAAY;AAC9B,UAAO,MAAM,KAAK,SAAS,uBAAuB,WAAW,CAAC;;EAGlE,OAAO,IAAI,QAAQ,SAAS;AACxB,UAAO,UAAU,OAAO,IAAI,QAAQ,QAAQ;;EAGhD,eAAe,YAAY;AACvB,QAAK,cAAc,MAAM,WAAW;;EAGxC,iBAAiB;AACb,mBAAgB,KAAK;;EAEzB,WAAW;GACP,MAAM,EAAE,MAAM,KAAK,UAAU;AAC7B,OAAI,GAAG,MACH,QAAO,CAAC,GAAG,MAAM,EAAE;AACvB,SAAM,IAAI,MAAM,8BAA8B;;;;;EAKlD,OAAO,OAAO;AACV,aAAU,MAAM;GAChB,MAAM,EAAE,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO;GACnC,MAAM,EAAE,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO;GACnC,MAAM,KAAK,GAAG,IAAI,GAAG,IAAI,IAAI,GAAG,EAAE,GAAG,IAAI,IAAI,GAAG,CAAC;GACjD,MAAM,KAAK,GAAG,IAAI,GAAG,IAAI,IAAI,GAAG,EAAE,GAAG,IAAI,IAAI,GAAG,CAAC;AACjD,UAAO,MAAM;;;;;EAKjB,SAAS;AACL,UAAO,IAAI,MAAM,KAAK,IAAI,GAAG,IAAI,KAAK,GAAG,EAAE,KAAK,GAAG;;EAMvD,SAAS;GACL,MAAM,EAAE,GAAG,MAAM;GACjB,MAAM,KAAK,GAAG,IAAI,GAAG,IAAI;GACzB,MAAM,EAAE,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO;GACnC,IAAI,KAAK,GAAG,MAAM,KAAK,GAAG,MAAM,KAAK,GAAG;GACxC,IAAI,KAAK,GAAG,IAAI,IAAI,GAAG;GACvB,IAAI,KAAK,GAAG,IAAI,IAAI,GAAG;GACvB,IAAI,KAAK,GAAG,IAAI,IAAI,GAAG;GACvB,IAAI,KAAK,GAAG,IAAI,IAAI,GAAG;AACvB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,GAAG,GAAG;AAClB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,GAAG,GAAG;AAClB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,GAAG,GAAG;AAClB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,UAAO,IAAI,MAAM,IAAI,IAAI,GAAG;;EAMhC,IAAI,OAAO;AACP,aAAU,MAAM;GAChB,MAAM,EAAE,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO;GACnC,MAAM,EAAE,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO;GACnC,IAAI,KAAK,GAAG,MAAM,KAAK,GAAG,MAAM,KAAK,GAAG;GACxC,MAAM,IAAI,MAAM;GAChB,MAAM,KAAK,GAAG,IAAI,MAAM,GAAG,IAAI;GAC/B,IAAI,KAAK,GAAG,IAAI,IAAI,GAAG;GACvB,IAAI,KAAK,GAAG,IAAI,IAAI,GAAG;GACvB,IAAI,KAAK,GAAG,IAAI,IAAI,GAAG;GACvB,IAAI,KAAK,GAAG,IAAI,IAAI,GAAG;GACvB,IAAI,KAAK,GAAG,IAAI,IAAI,GAAG;AACvB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;GACnB,IAAI,KAAK,GAAG,IAAI,IAAI,GAAG;AACvB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,GAAG,GAAG;AAClB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,GAAG,GAAG;AAClB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,GAAG,GAAG;AAClB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,QAAK,GAAG,IAAI,IAAI,GAAG;AACnB,UAAO,IAAI,MAAM,IAAI,IAAI,GAAG;;EAEhC,SAAS,OAAO;AACZ,UAAO,KAAK,IAAI,MAAM,QAAQ,CAAC;;EAEnC,MAAM;AACF,UAAO,KAAK,OAAO,MAAM,KAAK;;EAElC,KAAK,GAAG;AACJ,UAAO,KAAK,WAAW,MAAM,GAAG,MAAM,WAAW;;;;;;;EAOrD,eAAe,IAAI;GACf,MAAM,EAAE,MAAM,GAAG,MAAM;AACvB,YAAS,UAAU,IAAID,OAAK,EAAE;GAC9B,MAAM,IAAI,MAAM;AAChB,OAAI,OAAOA,MACP,QAAO;AACX,OAAI,KAAK,KAAK,IAAI,OAAOC,MACrB,QAAO;AAEX,OAAI,CAAC,QAAQ,KAAK,eAAe,KAAK,CAClC,QAAO,KAAK,iBAAiB,MAAM,IAAI,MAAM,WAAW;;GAG5D,IAAI,EAAE,OAAO,IAAI,OAAO,OAAO,KAAK,YAAY,GAAG;GACnD,IAAI,MAAM;GACV,IAAI,MAAM;GACV,IAAI,IAAI;AACR,UAAO,KAAKD,SAAO,KAAKA,OAAK;AACzB,QAAI,KAAKC,MACL,OAAM,IAAI,IAAI,EAAE;AACpB,QAAI,KAAKA,MACL,OAAM,IAAI,IAAI,EAAE;AACpB,QAAI,EAAE,QAAQ;AACd,WAAOA;AACP,WAAOA;;AAEX,OAAI,MACA,OAAM,IAAI,QAAQ;AACtB,OAAI,MACA,OAAM,IAAI,QAAQ;AACtB,SAAM,IAAI,MAAM,GAAG,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,IAAI,IAAI,IAAI,GAAG;AAC1D,UAAO,IAAI,IAAI,IAAI;;;;;;;;;;;EAWvB,SAAS,QAAQ;GACb,MAAM,EAAE,MAAM,GAAG,MAAM;AACvB,YAAS,UAAU,QAAQA,OAAK,EAAE;GAClC,IAAI,OAAO;;AAEX,OAAI,MAAM;IACN,MAAM,EAAE,OAAO,IAAI,OAAO,OAAO,KAAK,YAAY,OAAO;IACzD,IAAI,EAAE,GAAG,KAAK,GAAG,QAAQ,KAAK,KAAK,GAAG;IACtC,IAAI,EAAE,GAAG,KAAK,GAAG,QAAQ,KAAK,KAAK,GAAG;AACtC,UAAM,KAAK,gBAAgB,OAAO,IAAI;AACtC,UAAM,KAAK,gBAAgB,OAAO,IAAI;AACtC,UAAM,IAAI,MAAM,GAAG,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,IAAI,IAAI,IAAI,GAAG;AAC1D,YAAQ,IAAI,IAAI,IAAI;AACpB,WAAO,IAAI,IAAI,IAAI;UAElB;IACD,MAAM,EAAE,GAAG,MAAM,KAAK,KAAK,OAAO;AAClC,YAAQ;AACR,WAAO;;AAGX,UAAO,MAAM,WAAW,CAAC,OAAO,KAAK,CAAC,CAAC;;;;;;;;EAQ3C,qBAAqB,GAAG,GAAG,GAAG;GAC1B,MAAM,IAAI,MAAM;GAChB,MAAM,OAAO,GAAG,MACV,MAAMD,SAAO,MAAMC,SAAO,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE;GAClF,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;AACvC,UAAO,IAAI,KAAK,GAAG,KAAA,IAAY;;EAKnC,SAAS,IAAI;AACT,UAAO,aAAa,MAAM,GAAG;;EAEjC,gBAAgB;GACZ,MAAM,EAAE,GAAG,UAAU,kBAAkB;AACvC,OAAI,aAAaA,MACb,QAAO;AACX,OAAI,cACA,QAAO,cAAc,OAAO,KAAK;AACrC,SAAM,IAAI,MAAM,+DAA+D;;EAEnF,gBAAgB;GACZ,MAAM,EAAE,GAAG,UAAU,kBAAkB;AACvC,OAAI,aAAaA,MACb,QAAO;AACX,OAAI,cACA,QAAO,cAAc,OAAO,KAAK;AACrC,UAAO,KAAK,eAAe,MAAM,EAAE;;EAEvC,WAAW,eAAe,MAAM;AAC5B,SAAM,gBAAgB,aAAa;AACnC,QAAK,gBAAgB;AACrB,UAAO,QAAQ,OAAO,MAAM,aAAa;;EAE7C,MAAM,eAAe,MAAM;AACvB,SAAM,gBAAgB,aAAa;AACnC,UAAO,WAAW,KAAK,WAAW,aAAa,CAAC;;;AAIxD,OAAM,OAAO,IAAI,MAAM,MAAM,IAAI,MAAM,IAAI,GAAG,IAAI;AAElD,OAAM,OAAO,IAAI,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK;CAChD,MAAM,EAAE,MAAM,eAAe;CAC7B,MAAM,OAAO,KAAK,OAAO,OAAO,KAAK,KAAK,aAAa,EAAE,GAAG,WAAW;AACvE,QAAO;EACH;EACA,iBAAiB;EACjB;EACA;EACA;EACH;;AAEL,SAAS,aAAa,OAAO;CACzB,MAAM,OAAO,cAAc,MAAM;AACjC,gBAAe,MAAM;EACjB,MAAM;EACN,MAAM;EACN,aAAa;EAChB,EAAE;EACC,UAAU;EACV,eAAe;EACf,MAAM;EACT,CAAC;AACF,QAAO,OAAO,OAAO;EAAE,MAAM;EAAM,GAAG;EAAM,CAAC;;;;;;;;;AASjD,SAAgB,YAAY,UAAU;CAClC,MAAM,QAAQ,aAAa,SAAS;CACpC,MAAM,EAAE,IAAI,GAAG,aAAa,aAAa,eAAe;CACxD,MAAM,gBAAgB,GAAG,QAAQ;CACjC,MAAM,kBAAkB,IAAI,GAAG,QAAQ;CACvC,SAAS,KAAK,GAAG;AACb,SAAO,IAAI,GAAG,YAAY;;CAE9B,SAAS,KAAK,GAAG;AACb,SAAO,OAAO,GAAG,YAAY;;CAEjC,MAAM,EAAE,iBAAiB,OAAO,wBAAwB,qBAAqB,uBAAwB,kBAAkB;EACnH,GAAG;EACH,QAAQ,IAAI,OAAO,cAAc;GAC7B,MAAM,IAAI,MAAM,UAAU;GAC1B,MAAM,IAAI,GAAG,QAAQ,EAAE,EAAE;GACzB,MAAM,MAAME;AACZ,SAAM,gBAAgB,aAAa;AACnC,OAAI,aACA,QAAO,IAAI,WAAW,KAAK,CAAC,MAAM,UAAU,GAAG,IAAO,EAAK,CAAC,EAAE,EAAE;OAGhE,QAAO,IAAI,WAAW,KAAK,CAAC,EAAK,CAAC,EAAE,GAAG,GAAG,QAAQ,EAAE,EAAE,CAAC;;EAG/D,UAAU,OAAO;GACb,MAAM,MAAM,MAAM;GAClB,MAAM,OAAO,MAAM;GACnB,MAAM,OAAO,MAAM,SAAS,EAAE;AAE9B,OAAI,QAAQ,kBAAkB,SAAS,KAAQ,SAAS,IAAO;IAC3D,MAAM,IAAI,gBAAgB,KAAK;AAC/B,QAAI,CAAC,QAAQ,GAAGF,OAAK,GAAG,MAAM,CAC1B,OAAM,IAAI,MAAM,wBAAwB;IAC5C,MAAM,KAAK,oBAAoB,EAAE;IACjC,IAAI;AACJ,QAAI;AACA,SAAI,GAAG,KAAK,GAAG;aAEZ,WAAW;KACd,MAAM,SAAS,qBAAqB,QAAQ,OAAO,UAAU,UAAU;AACvE,WAAM,IAAI,MAAM,0BAA0B,OAAO;;IAErD,MAAM,UAAU,IAAIA,WAASA;AAG7B,SADmB,OAAO,OAAO,MACf,OACd,KAAI,GAAG,IAAI,EAAE;AACjB,WAAO;KAAE;KAAG;KAAG;cAEV,QAAQ,mBAAmB,SAAS,EAGzC,QAAO;IAAE,GAFC,GAAG,UAAU,KAAK,SAAS,GAAG,GAAG,MAAM,CAAC;IAEtC,GADF,GAAG,UAAU,KAAK,SAAS,GAAG,OAAO,IAAI,GAAG,MAAM,CAAC;IAC9C;QAEd;IACD,MAAM,KAAK;IACX,MAAM,KAAK;AACX,UAAM,IAAI,MAAM,uCAAuC,KAAK,uBAAuB,KAAK,WAAW,IAAI;;;EAGlH,CAAC;CACF,SAAS,sBAAsB,QAAQ;AAEnC,SAAO,SADM,eAAeA;;CAGhC,SAAS,WAAW,GAAG;AACnB,SAAO,sBAAsB,EAAE,GAAG,KAAK,CAAC,EAAE,GAAG;;CAGjD,MAAM,UAAU,GAAG,MAAM,OAAO,gBAAgB,EAAE,MAAM,MAAM,GAAG,CAAC;;;;CAIlE,MAAM,UAAU;EACZ,YAAY,GAAG,GAAG,UAAU;AACxB,YAAS,KAAK,GAAGA,OAAK,YAAY;AAClC,YAAS,KAAK,GAAGA,OAAK,YAAY;AAClC,QAAK,IAAI;AACT,QAAK,IAAI;AACT,OAAI,YAAY,KACZ,MAAK,WAAW;AACpB,UAAO,OAAO,KAAK;;EAGvB,OAAO,YAAY,KAAK;GACpB,MAAM,IAAI;AACV,SAAM,YAAY,oBAAoB,KAAK,IAAI,EAAE;AACjD,UAAO,IAAI,UAAU,OAAO,KAAK,GAAG,EAAE,EAAE,OAAO,KAAK,GAAG,IAAI,EAAE,CAAC;;EAIlE,OAAO,QAAQ,KAAK;GAChB,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,YAAY,OAAO,IAAI,CAAC;AACnD,UAAO,IAAI,UAAU,GAAG,EAAE;;;;;;EAM9B,iBAAiB;EACjB,eAAe,UAAU;AACrB,UAAO,IAAI,UAAU,KAAK,GAAG,KAAK,GAAG,SAAS;;EAElD,iBAAiB,SAAS;GACtB,MAAM,EAAE,GAAG,GAAG,UAAU,QAAQ;GAChC,MAAM,IAAI,cAAc,YAAY,WAAW,QAAQ,CAAC;AACxD,OAAI,OAAO,QAAQ,CAAC;IAAC;IAAG;IAAG;IAAG;IAAE,CAAC,SAAS,IAAI,CAC1C,OAAM,IAAI,MAAM,sBAAsB;GAC1C,MAAM,OAAO,QAAQ,KAAK,QAAQ,IAAI,IAAI,MAAM,IAAI;AACpD,OAAI,QAAQ,GAAG,MACX,OAAM,IAAI,MAAM,6BAA6B;GACjD,MAAM,UAAU,MAAM,OAAO,IAAI,OAAO;GACxC,MAAM,IAAI,MAAM,QAAQ,SAAS,cAAc,MAAM,GAAG,MAAM,CAAC;GAC/D,MAAM,KAAK,KAAK,KAAK;GACrB,MAAM,KAAK,KAAK,CAAC,IAAI,GAAG;GACxB,MAAM,KAAK,KAAK,IAAI,GAAG;GACvB,MAAM,IAAI,MAAM,KAAK,qBAAqB,GAAG,IAAI,GAAG;AACpD,OAAI,CAAC,EACD,OAAM,IAAI,MAAM,oBAAoB;AACxC,KAAE,gBAAgB;AAClB,UAAO;;EAGX,WAAW;AACP,UAAO,sBAAsB,KAAK,EAAE;;EAExC,aAAa;AACT,UAAO,KAAK,UAAU,GAAG,IAAI,UAAU,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,SAAS,GAAG;;EAGnF,gBAAgB;AACZ,UAAO,WAAW,KAAK,UAAU,CAAC;;EAEtC,WAAW;AACP,UAAO,IAAI,WAAW,KAAK;;EAG/B,oBAAoB;AAChB,UAAO,WAAW,KAAK,cAAc,CAAC;;EAE1C,eAAe;GACX,MAAM,IAAI;AACV,UAAO,cAAc,KAAK,GAAG,EAAE,GAAG,cAAc,KAAK,GAAG,EAAE;;;CAGlE,MAAM,QAAQ;EACV,kBAAkB,YAAY;AAC1B,OAAI;AACA,2BAAuB,WAAW;AAClC,WAAO;YAEJ,OAAO;AACV,WAAO;;;EAGS;EAKxB,wBAAwB;GACpB,MAAM,SAAS,iBAAiB,MAAM,EAAE;AACxC,UAAO,eAAe,MAAM,YAAY,OAAO,EAAE,MAAM,EAAE;;EAU7D,WAAW,aAAa,GAAG,QAAQ,MAAM,MAAM;AAC3C,SAAM,eAAe,WAAW;AAChC,SAAM,SAAS,OAAO,EAAE,CAAC;AACzB,UAAO;;EAEd;;;;;;;CAOD,SAAS,aAAa,YAAY,eAAe,MAAM;AACnD,SAAO,MAAM,eAAe,WAAW,CAAC,WAAW,aAAa;;;;;CAKpE,SAAS,UAAU,MAAM;AACrB,MAAI,OAAO,SAAS,SAChB,QAAO;AACX,MAAI,gBAAgB,MAChB,QAAO;EAEX,MAAM,MADM,YAAY,OAAO,KAAK,CACpB;EAChB,MAAM,MAAM,GAAG;EACf,MAAM,UAAU,MAAM;EACtB,MAAM,YAAY,IAAI,MAAM;AAC5B,MAAI,MAAM,4BAA4B,gBAAgB,QAClD;MAGA,QAAO,QAAQ,WAAW,QAAQ;;;;;;;;;;;;CAa1C,SAAS,gBAAgB,UAAU,SAAS,eAAe,MAAM;AAC7D,MAAI,UAAU,SAAS,KAAK,KACxB,OAAM,IAAI,MAAM,gCAAgC;AACpD,MAAI,UAAU,QAAQ,KAAK,MACvB,OAAM,IAAI,MAAM,gCAAgC;AAEpD,SADU,MAAM,QAAQ,QAAQ,CACvB,SAAS,uBAAuB,SAAS,CAAC,CAAC,WAAW,aAAa;;CAMhF,MAAM,WAAW,MAAM,YACnB,SAAU,OAAO;AAEb,MAAI,MAAM,SAAS,KACf,OAAM,IAAI,MAAM,qBAAqB;EAGzC,MAAM,MAAM,gBAAgB,MAAM;EAClC,MAAM,QAAQ,MAAM,SAAS,IAAI;AACjC,SAAO,QAAQ,IAAI,OAAO,OAAO,MAAM,GAAG;;CAElD,MAAM,gBAAgB,MAAM,iBACxB,SAAU,OAAO;AACb,SAAO,KAAK,SAAS,MAAM,CAAC;;CAGpC,MAAM,aAAa,QAAQ,WAAW;;;;CAItC,SAAS,WAAW,KAAK;AACrB,WAAS,aAAa,YAAY,KAAKD,OAAK,WAAW;AAEvD,SAAO,gBAAgB,KAAK,YAAY;;CAO5C,SAAS,QAAQ,SAAS,YAAY,OAAO,gBAAgB;AACzD,MAAI,CAAC,aAAa,YAAY,CAAC,MAAM,MAAM,KAAK,KAAK,CACjD,OAAM,IAAI,MAAM,sCAAsC;EAC1D,MAAM,EAAE,MAAM,gBAAgB;EAC9B,IAAI,EAAE,MAAM,SAAS,cAAc,QAAQ;AAC3C,MAAI,QAAQ,KACR,QAAO;AACX,YAAU,YAAY,WAAW,QAAQ;AACzC,qBAAmB,KAAK;AACxB,MAAI,QACA,WAAU,YAAY,qBAAqB,KAAK,QAAQ,CAAC;EAI7D,MAAM,QAAQ,cAAc,QAAQ;EACpC,MAAM,IAAI,uBAAuB,WAAW;EAC5C,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,WAAW,MAAM,CAAC;AAEnD,MAAI,OAAO,QAAQ,QAAQ,OAAO;GAE9B,MAAM,IAAI,QAAQ,OAAO,YAAY,GAAG,MAAM,GAAG;AACjD,YAAS,KAAK,YAAY,gBAAgB,EAAE,CAAC;;EAEjD,MAAM,OAAOG,cAAY,GAAG,SAAS;EACrC,MAAM,IAAI;EAEV,SAAS,MAAM,QAAQ;GAEnB,MAAM,IAAI,SAAS,OAAO;AAC1B,OAAI,CAAC,mBAAmB,EAAE,CACtB;GACJ,MAAM,KAAK,KAAK,EAAE;GAClB,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC,UAAU;GAC3C,MAAM,IAAI,KAAK,EAAE,EAAE;AACnB,OAAI,MAAMH,MACN;GAIJ,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,IAAI,EAAE,CAAC;AACpC,OAAI,MAAMA,MACN;GACJ,IAAI,YAAY,EAAE,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,IAAIC,MAAI;GACtD,IAAI,QAAQ;AACZ,OAAI,QAAQ,sBAAsB,EAAE,EAAE;AAClC,YAAQ,WAAW,EAAE;AACrB,gBAAY;;AAEhB,UAAO,IAAI,UAAU,GAAG,OAAO,SAAS;;AAE5C,SAAO;GAAE;GAAM;GAAO;;CAE1B,MAAM,iBAAiB;EAAE,MAAM,MAAM;EAAM,SAAS;EAAO;CAC3D,MAAM,iBAAiB;EAAE,MAAM,MAAM;EAAM,SAAS;EAAO;;;;;;;;;;;;;;CAc3D,SAAS,KAAK,SAAS,SAAS,OAAO,gBAAgB;EACnD,MAAM,EAAE,MAAM,UAAU,QAAQ,SAAS,SAAS,KAAK;EACvD,MAAM,IAAI;AAEV,SADa,eAAe,EAAE,KAAK,WAAW,EAAE,aAAa,EAAE,KAAK,CACxD,MAAM,MAAM;;AAG5B,OAAM,KAAK,eAAe,EAAE;;;;;;;;;;;;;;CAe5B,SAAS,OAAO,WAAW,SAAS,WAAW,OAAO,gBAAgB;EAClE,MAAM,KAAK;AACX,YAAU,YAAY,WAAW,QAAQ;AACzC,cAAY,YAAY,aAAa,UAAU;EAC/C,MAAM,EAAE,MAAM,SAAS,WAAW;AAElC,qBAAmB,KAAK;AACxB,MAAI,YAAY,KACZ,OAAM,IAAI,MAAM,qCAAqC;AACzD,MAAI,WAAW,KAAA,KAAa,WAAW,aAAa,WAAW,MAC3D,OAAM,IAAI,MAAM,gCAAgC;EACpD,MAAM,QAAQ,OAAO,OAAO,YAAY,QAAQ,GAAG;EACnD,MAAM,QAAQ,CAAC,SACX,CAAC,UACD,OAAO,OAAO,YACd,OAAO,QACP,OAAO,GAAG,MAAM,YAChB,OAAO,GAAG,MAAM;AACpB,MAAI,CAAC,SAAS,CAAC,MACX,OAAM,IAAI,MAAM,2EAA2E;EAC/F,IAAI,OAAO,KAAA;EACX,IAAI;AACJ,MAAI;AACA,OAAI,MACA,QAAO,IAAI,UAAU,GAAG,GAAG,GAAG,EAAE;AACpC,OAAI,OAAO;AAGP,QAAI;AACA,SAAI,WAAW,UACX,QAAO,UAAU,QAAQ,GAAG;aAE7B,UAAU;AACb,SAAI,EAAE,oBAAoB,IAAI,KAC1B,OAAM;;AAEd,QAAI,CAAC,QAAQ,WAAW,MACpB,QAAO,UAAU,YAAY,GAAG;;AAExC,OAAI,MAAM,QAAQ,UAAU;WAEzB,OAAO;AACV,UAAO;;AAEX,MAAI,CAAC,KACD,QAAO;AACX,MAAI,QAAQ,KAAK,UAAU,CACvB,QAAO;AACX,MAAI,QACA,WAAU,MAAM,KAAK,QAAQ;EACjC,MAAM,EAAE,GAAG,MAAM;EACjB,MAAM,IAAI,cAAc,QAAQ;EAChC,MAAM,KAAK,KAAK,EAAE;EAClB,MAAM,KAAK,KAAK,IAAI,GAAG;EACvB,MAAM,KAAK,KAAK,IAAI,GAAG;EACvB,MAAM,IAAI,MAAM,KAAK,qBAAqB,GAAG,IAAI,GAAG,EAAE,UAAU;AAChE,MAAI,CAAC,EACD,QAAO;AAEX,SADU,KAAK,EAAE,EAAE,KACN;;AAEjB,QAAO;EACH;EACA;EACA;EACA;EACA;EACA,iBAAiB;EACjB;EACA;EACH;;;;;;;;;;;AAWL,SAAgB,eAAe,IAAI,GAAG;CAElC,MAAM,IAAI,GAAG;CACb,IAAI,IAAID;AACR,MAAK,IAAI,IAAI,IAAIC,OAAK,IAAIC,UAAQF,OAAK,KAAKE,MACxC,MAAKD;CACT,MAAM,KAAK;CAGX,MAAM,eAAeC,SAAQ,KAAKD,QAAMA;CACxC,MAAM,aAAa,eAAeC;CAClC,MAAM,MAAM,IAAID,SAAO;CACvB,MAAM,MAAM,KAAKA,SAAOC;CACxB,MAAM,KAAK,aAAaD;CACxB,MAAM,KAAK;CACX,MAAM,KAAK,GAAG,IAAI,GAAG,GAAG;CACxB,MAAM,KAAK,GAAG,IAAI,IAAI,KAAKA,SAAOC,MAAI;CACtC,IAAI,aAAa,GAAG,MAAM;EACtB,IAAI,MAAM;EACV,IAAI,MAAM,GAAG,IAAI,GAAG,GAAG;EACvB,IAAI,MAAM,GAAG,IAAI,IAAI;AACrB,QAAM,GAAG,IAAI,KAAK,EAAE;EACpB,IAAI,MAAM,GAAG,IAAI,GAAG,IAAI;AACxB,QAAM,GAAG,IAAI,KAAK,GAAG;AACrB,QAAM,GAAG,IAAI,KAAK,IAAI;AACtB,QAAM,GAAG,IAAI,KAAK,EAAE;AACpB,QAAM,GAAG,IAAI,KAAK,EAAE;EACpB,IAAI,MAAM,GAAG,IAAI,KAAK,IAAI;AAC1B,QAAM,GAAG,IAAI,KAAK,GAAG;EACrB,IAAI,OAAO,GAAG,IAAI,KAAK,GAAG,IAAI;AAC9B,QAAM,GAAG,IAAI,KAAK,GAAG;AACrB,QAAM,GAAG,IAAI,KAAK,IAAI;AACtB,QAAM,GAAG,KAAK,KAAK,KAAK,KAAK;AAC7B,QAAM,GAAG,KAAK,KAAK,KAAK,KAAK;AAE7B,OAAK,IAAI,IAAI,IAAI,IAAID,OAAK,KAAK;GAC3B,IAAI,MAAM,IAAIC;AACd,SAAMA,SAAQ,MAAMD;GACpB,IAAI,OAAO,GAAG,IAAI,KAAK,IAAI;GAC3B,MAAM,KAAK,GAAG,IAAI,MAAM,GAAG,IAAI;AAC/B,SAAM,GAAG,IAAI,KAAK,IAAI;AACtB,SAAM,GAAG,IAAI,KAAK,IAAI;AACtB,UAAO,GAAG,IAAI,KAAK,IAAI;AACvB,SAAM,GAAG,KAAK,KAAK,KAAK,GAAG;AAC3B,SAAM,GAAG,KAAK,MAAM,KAAK,GAAG;;AAEhC,SAAO;GAAE,SAAS;GAAM,OAAO;GAAK;;AAExC,KAAI,GAAG,QAAQ,QAAQ,KAAK;EAExB,MAAM,MAAM,GAAG,QAAQ,OAAO;EAC9B,MAAM,KAAK,GAAG,KAAK,GAAG,IAAI,EAAE,CAAC;AAC7B,eAAa,GAAG,MAAM;GAClB,IAAI,MAAM,GAAG,IAAI,EAAE;GACnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAE;AACxB,SAAM,GAAG,IAAI,KAAK,IAAI;GACtB,IAAI,KAAK,GAAG,IAAI,KAAK,GAAG;AACxB,QAAK,GAAG,IAAI,IAAI,IAAI;GACpB,MAAM,KAAK,GAAG,IAAI,IAAI,GAAG;GACzB,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,EAAE,EAAE;GACjC,MAAM,OAAO,GAAG,IAAI,KAAK,EAAE;AAE3B,UAAO;IAAE,SAAS;IAAM,OADhB,GAAG,KAAK,IAAI,IAAI,KAAK;IACK;;;AAK1C,QAAO;;;;;;AAMX,SAAgB,oBAAoB,IAAI,MAAM;AAC1C,eAAc,GAAG;AACjB,KAAI,CAAC,GAAG,QAAQ,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,KAAK,EAAE,CACjE,OAAM,IAAI,MAAM,oCAAoC;CACxD,MAAM,YAAY,eAAe,IAAI,KAAK,EAAE;AAC5C,KAAI,CAAC,GAAG,MACJ,OAAM,IAAI,MAAM,+BAA+B;AAGnD,SAAQ,MAAM;EAEV,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,GAAG;AACrC,QAAM,GAAG,IAAI,EAAE;AACf,QAAM,GAAG,IAAI,KAAK,KAAK,EAAE;AACzB,QAAM,GAAG,IAAI,IAAI;AACjB,QAAM,GAAG,IAAI,KAAK,IAAI;AACtB,QAAM,GAAG,IAAI,KAAK,GAAG,IAAI;AACzB,QAAM,GAAG,IAAI,KAAK,KAAK,EAAE;AACzB,QAAM,GAAG,KAAK,KAAK,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,GAAG,IAAI,KAAK,GAAG,KAAK,CAAC;AACzD,QAAM,GAAG,IAAI,KAAK,KAAK,EAAE;AACzB,QAAM,GAAG,IAAI,IAAI;AACjB,QAAM,GAAG,IAAI,IAAI;AACjB,QAAM,GAAG,IAAI,KAAK,KAAK,EAAE;AACzB,QAAM,GAAG,IAAI,KAAK,IAAI;AACtB,QAAM,GAAG,IAAI,KAAK,IAAI;AACtB,QAAM,GAAG,IAAI,KAAK,IAAI;AACtB,QAAM,GAAG,IAAI,KAAK,KAAK,EAAE;AACzB,QAAM,GAAG,IAAI,KAAK,IAAI;AACtB,MAAI,GAAG,IAAI,KAAK,IAAI;EACpB,MAAM,EAAE,SAAS,UAAU,UAAU,KAAK,IAAI;AAC9C,MAAI,GAAG,IAAI,KAAK,EAAE;AAClB,MAAI,GAAG,IAAI,GAAG,MAAM;AACpB,MAAI,GAAG,KAAK,GAAG,KAAK,QAAQ;AAC5B,MAAI,GAAG,KAAK,GAAG,OAAO,QAAQ;EAC9B,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,GAAG,MAAM,EAAE;AACtC,MAAI,GAAG,KAAK,GAAG,IAAI,EAAE,EAAE,GAAG,GAAG;EAC7B,MAAM,UAAU,cAAc,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;AAC/C,MAAI,GAAG,IAAI,GAAG,QAAQ;AACtB,SAAO;GAAE;GAAG;GAAG;;;;;;;;;;;ACrrCvB,SAAgB,QAAQ,MAAM;AAC1B,QAAO;EACH;EACA,OAAO,KAAK,GAAG,SAAS,KAAK,MAAM,KAAK,YAAY,GAAG,KAAK,CAAC;EAC7D;EACH;;AAEL,SAAgB,YAAY,UAAU,SAAS;CAC3C,MAAM,UAAU,SAAS,YAAY;EAAE,GAAG;EAAU,GAAG,QAAQ,KAAK;EAAE,CAAC;AACvE,QAAO;EAAE,GAAG,OAAO,QAAQ;EAAE;EAAQ;;;;ACfzC,MAAM,QAAQ;AAEd,SAAS,MAAM,OAAO,QAAQ;AAC1B,MAAK,MAAM;AACX,MAAK,OAAO;AACZ,KAAI,QAAQ,KAAK,SAAS,KAAM,IAAI,OAChC,OAAM,IAAI,MAAM,0BAA0B,MAAM;CACpD,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,CAAC,CAAC,KAAK,EAAE;AAC1C,MAAK,IAAI,IAAI,SAAS,GAAG,KAAK,GAAG,KAAK;AAClC,MAAI,KAAK,QAAQ;AACjB,aAAW;;AAEf,QAAO,IAAI,WAAW,IAAI;;AAE9B,SAAS,OAAO,GAAG,GAAG;CAClB,MAAM,MAAM,IAAI,WAAW,EAAE,OAAO;AACpC,MAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,IAC1B,KAAI,KAAK,EAAE,KAAK,EAAE;AAEtB,QAAO;;AAEX,SAAS,KAAK,MAAM;AAChB,KAAI,CAAC,OAAO,cAAc,KAAK,CAC3B,OAAM,IAAI,MAAM,kBAAkB;;;;;;AAM1C,SAAgB,mBAAmB,KAAK,KAAK,YAAY,GAAG;AACxD,UAAO,IAAI;AACX,UAAO,IAAI;AACX,MAAK,WAAW;AAEhB,KAAI,IAAI,SAAS,IACb,OAAM,EAAEG,cAAY,YAAY,oBAAoB,EAAE,IAAI,CAAC;CAC/D,MAAM,EAAE,WAAW,YAAY,UAAU,eAAe;CACxD,MAAM,MAAM,KAAK,KAAK,aAAa,WAAW;AAC9C,KAAI,aAAa,SAAS,MAAM,IAC5B,OAAM,IAAI,MAAM,yCAAyC;CAC7D,MAAM,YAAYA,cAAY,KAAK,MAAM,IAAI,QAAQ,EAAE,CAAC;CACxD,MAAM,QAAQ,MAAM,GAAG,WAAW;CAClC,MAAM,YAAY,MAAM,YAAY,EAAE;CACtC,MAAM,IAAI,IAAI,MAAM,IAAI;CACxB,MAAM,MAAM,EAAEA,cAAY,OAAO,KAAK,WAAW,MAAM,GAAG,EAAE,EAAE,UAAU,CAAC;AACzE,GAAE,KAAK,EAAEA,cAAY,KAAK,MAAM,GAAG,EAAE,EAAE,UAAU,CAAC;AAClD,MAAK,IAAI,IAAI,GAAG,KAAK,KAAK,IAEtB,GAAE,KAAK,EAAEA,cAAY,GADR;EAAC,OAAO,KAAK,EAAE,IAAI,GAAG;EAAE,MAAM,IAAI,GAAG,EAAE;EAAE;EAAU,CACnC,CAAC;AAGlC,QAD4BA,cAAY,GAAG,EAAE,CAClB,MAAM,GAAG,WAAW;;;;;;;;;AASnD,SAAgB,mBAAmB,KAAK,KAAK,YAAY,GAAG,GAAG;AAC3D,UAAO,IAAI;AACX,UAAO,IAAI;AACX,MAAK,WAAW;AAGhB,KAAI,IAAI,SAAS,KAAK;EAClB,MAAM,QAAQ,KAAK,KAAM,IAAI,IAAK,EAAE;AACpC,QAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,YAAY,oBAAoB,CAAC,CAAC,OAAO,IAAI,CAAC,QAAQ;;AAE3F,KAAI,aAAa,SAAS,IAAI,SAAS,IACnC,OAAM,IAAI,MAAM,yCAAyC;AAC7D,QAAQ,EAAE,OAAO,EAAE,OAAO,YAAY,CAAC,CAClC,OAAO,IAAI,CACX,OAAO,MAAM,YAAY,EAAE,CAAC,CAE5B,OAAO,IAAI,CACX,OAAO,MAAM,IAAI,QAAQ,EAAE,CAAC,CAC5B,QAAQ;;;;;;;;;;AAUjB,SAAgB,cAAc,KAAK,OAAO,SAAS;AAC/C,gBAAe,SAAS;EACpB,KAAK;EACL,GAAG;EACH,GAAG;EACH,GAAG;EACH,MAAM;EACT,CAAC;CACF,MAAM,EAAE,GAAG,GAAG,GAAG,MAAM,QAAQ,KAAK,SAAS;AAC7C,UAAO,IAAI;AACX,MAAK,MAAM;CACX,MAAM,MAAM,OAAO,SAAS,WAAW,YAAY,KAAK,GAAG;CAC3D,MAAM,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC5B,MAAM,IAAI,KAAK,MAAM,QAAQ,KAAK,EAAE;CACpC,MAAM,eAAe,QAAQ,IAAI;CACjC,IAAI;AACJ,KAAI,WAAW,MACX,OAAM,mBAAmB,KAAK,KAAK,cAAc,KAAK;UAEjD,WAAW,MAChB,OAAM,mBAAmB,KAAK,KAAK,cAAc,GAAG,KAAK;UAEpD,WAAW,iBAEhB,OAAM;KAGN,OAAM,IAAI,MAAM,oCAAgC;CAEpD,MAAM,IAAI,IAAI,MAAM,MAAM;AAC1B,MAAK,IAAI,IAAI,GAAG,IAAI,OAAO,KAAK;EAC5B,MAAM,IAAI,IAAI,MAAM,EAAE;AACtB,OAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;GACxB,MAAM,aAAa,KAAK,IAAI,IAAI;AAEhC,KAAE,KAAK,IAAI,MADA,IAAI,SAAS,YAAY,aAAa,EAAE,CAC/B,EAAE,EAAE;;AAE5B,IAAE,KAAK;;AAEX,QAAO;;AAEX,SAAgB,WAAW,OAAO,KAAK;CAEnC,MAAM,QAAQ,IAAI,KAAK,MAAM,MAAM,KAAK,EAAE,CAAC,SAAS,CAAC;AACrD,SAAQ,GAAG,MAAM;EACb,MAAM,CAAC,IAAI,IAAI,IAAI,MAAM,MAAM,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM,MAAM,IAAI,MAAM,IAAI,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;EAKpG,MAAM,CAAC,QAAQ,UAAU,cAAc,OAAO,CAAC,IAAI,GAAG,EAAE,KAAK;AAC7D,MAAI,MAAM,IAAI,IAAI,OAAO;AACzB,MAAI,MAAM,IAAI,GAAG,MAAM,IAAI,IAAI,OAAO,CAAC;AACvC,SAAO;GAAE;GAAG;GAAG;;;;AAIvB,SAAgB,aAAa,OAAO,YAAY,UAAU;AACtD,KAAI,OAAO,eAAe,WACtB,OAAM,IAAI,MAAM,+BAA+B;CACnD,SAAS,IAAI,KAAK;AACd,SAAO,MAAM,WAAW,WAAW,IAAI,CAAC;;CAE5C,SAAS,MAAM,SAAS;EACpB,MAAM,IAAI,QAAQ,eAAe;AACjC,MAAI,EAAE,OAAO,MAAM,KAAK,CACpB,QAAO,MAAM;AACjB,IAAE,gBAAgB;AAClB,SAAO;;AAEX,QAAO;EACH;EAGA,YAAY,KAAK,SAAS;GACtB,MAAM,IAAI,cAAc,KAAK,GAAG;IAAE,GAAG;IAAU,KAAK,SAAS;IAAK,GAAG;IAAS,CAAC;GAC/E,MAAM,KAAK,IAAI,EAAE,GAAG;GACpB,MAAM,KAAK,IAAI,EAAE,GAAG;AACpB,UAAO,MAAM,GAAG,IAAI,GAAG,CAAC;;EAI5B,cAAc,KAAK,SAAS;AAExB,UAAO,MAAM,IADH,cAAc,KAAK,GAAG;IAAE,GAAG;IAAU,KAAK,SAAS;IAAW,GAAG;IAAS,CAAC,CAClE,GAAG,CAAC;;EAG3B,WAAW,SAAS;AAChB,OAAI,CAAC,MAAM,QAAQ,QAAQ,CACvB,OAAM,IAAI,MAAM,4BAA4B;AAChD,QAAK,MAAM,KAAK,QACZ,KAAI,OAAO,MAAM,SACb,OAAM,IAAI,MAAM,4BAA4B;AACpD,UAAO,MAAM,IAAI,QAAQ,CAAC;;EAEjC;;;;;;;;;;;;;;;;;;;;;ACtKL,MAAM,aAAa,OAAO,qEAAqE;AAC/F,MAAM,aAAa,OAAO,qEAAqE;AAC/F,MAAM,MAAM,OAAO,EAAE;AACrB,MAAM,MAAM,OAAO,EAAE;AACrB,MAAM,MAAM,OAAO,EAAE;AACrB,MAAM,cAAc,GAAG,OAAO,IAAI,IAAI,OAAO;;;;;AAK7C,SAAS,QAAQ,GAAG;CAChB,MAAM,IAAI;CAEV,MAAM,MAAM,OAAO,EAAE,EAAE,MAAM,OAAO,EAAE,EAAE,OAAO,OAAO,GAAG,EAAE,OAAO,OAAO,GAAG;CAE5E,MAAM,OAAO,OAAO,GAAG,EAAE,OAAO,OAAO,GAAG,EAAE,OAAO,OAAO,GAAG;CAC7D,MAAM,KAAM,IAAI,IAAI,IAAK;CACzB,MAAM,KAAM,KAAK,KAAK,IAAK;CAG3B,MAAM,MAAO,KADD,KADA,KAAK,IAAI,KAAK,EAAE,GAAG,KAAM,GAChB,KAAK,EAAE,GAAG,KAAM,GACf,KAAK,EAAE,GAAG,KAAM;CACtC,MAAM,MAAO,KAAK,KAAK,MAAM,EAAE,GAAG,MAAO;CACzC,MAAM,MAAO,KAAK,KAAK,MAAM,EAAE,GAAG,MAAO;CACzC,MAAM,MAAO,KAAK,KAAK,MAAM,EAAE,GAAG,MAAO;CAMzC,MAAM,OAAO,KADD,KADA,KADE,KADA,KADA,KAAK,KAAK,MAAM,EAAE,GAAG,MAAO,GACjB,MAAM,EAAE,GAAG,MAAO,GAClB,KAAK,EAAE,GAAG,KAAM,GAClB,MAAM,EAAE,GAAG,MAAO,GACpB,KAAK,EAAE,GAAG,KAAM,GACf,KAAK,EAAE;AAC7B,KAAI,CAAC,KAAK,IAAI,KAAK,IAAI,KAAK,EAAE,EAAE,CAC5B,OAAM,IAAI,MAAM,0BAA0B;AAC9C,QAAO;;AAEX,MAAM,OAAO,MAAM,YAAY,KAAA,GAAW,KAAA,GAAW,EAAE,MAAM,SAAS,CAAC;;;;;;;;;;;;;;;;AAgBvE,MAAa,YAAY,YAAY;CACjC,GAAG;CACH,GAAG,OAAO,EAAE;CACZ,IAAI;CACJ,GAAG;CACH,IAAI,OAAO,gFAAgF;CAC3F,IAAI,OAAO,gFAAgF;CAC3F,GAAG,OAAO,EAAE;CACZ,MAAM;CACN,MAAM;EAEF,MAAM,OAAO,qEAAqE;EAClF,cAAc,MAAM;GAChB,MAAM,IAAI;GACV,MAAM,KAAK,OAAO,qCAAqC;GACvD,MAAM,KAAK,CAAC,MAAM,OAAO,qCAAqC;GAC9D,MAAM,KAAK,OAAO,sCAAsC;GACxD,MAAM,KAAK;GACX,MAAM,YAAY,OAAO,sCAAsC;GAC/D,MAAM,KAAK,WAAW,KAAK,GAAG,EAAE;GAChC,MAAM,KAAK,WAAW,CAAC,KAAK,GAAG,EAAE;GACjC,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK,IAAI,EAAE;GACtC,IAAI,KAAK,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,EAAE;GACnC,MAAM,QAAQ,KAAK;GACnB,MAAM,QAAQ,KAAK;AACnB,OAAI,MACA,MAAK,IAAI;AACb,OAAI,MACA,MAAK,IAAI;AACb,OAAI,KAAK,aAAa,KAAK,UACvB,OAAM,IAAI,MAAM,yCAAyC,EAAE;AAE/D,UAAO;IAAE;IAAO;IAAI;IAAO;IAAI;;EAEtC;CACJ,EAAE,OAAO;AAmB2B,UAAU;AAwGrB,UAAU,MAAM;AAS1C,MAAM,SAAgC,WAAW,MAAM;CAEnD;EACI;EACA;EACA;EACA;EACH;CAED;EACI;EACA;EACA;EACH;CAED;EACI;EACA;EACA;EACA;EACH;CAED;EACI;EACA;EACA;EACA;EACH;CACJ,CAAC,KAAK,MAAM,EAAE,KAAK,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC;AACtC,MAAM,SAAgC,oBAAoB,MAAM;CAC5D,GAAG,OAAO,qEAAqE;CAC/E,GAAG,OAAO,OAAO;CACjB,GAAG,KAAK,OAAO,OAAO,MAAM,CAAC;CAChC,CAAC;;AAEF,MAAa,mBAA0C,aAAa,UAAU,kBAAkB,YAAY;CACxG,MAAM,EAAE,GAAG,MAAM,OAAO,KAAK,OAAO,QAAQ,GAAG,CAAC;AAChD,QAAO,OAAO,GAAG,EAAE;GACpB;CACC,KAAK;CACL,WAAW;CACX,GAAG,KAAK;CACR,GAAG;CACH,GAAG;CACH,QAAQ;CACR,MAAM;CACT,CAAC;AACgD,iBAAiB;AACf,iBAAiB"}