{"version":3,"file":"aes.cjs","sources":["../../../node_modules/@noble/ciphers/utils.js","../../../node_modules/@noble/ciphers/aes.js","../src/aes-ccm.ts","../src/aes-gcm.ts","../src/aes.ts"],"sourcesContent":["/**\n * Utilities for hex, bytes, CSPRNG.\n * @module\n */\n/*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) */\n/**\n * Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.\n * @param a - Value to inspect.\n * @returns `true` when the value is a Uint8Array view, including Node's `Buffer`.\n * @example\n * Guards a value before treating it as raw key material.\n *\n * ```ts\n * isBytes(new Uint8Array());\n * ```\n */\nexport function isBytes(a) {\n    // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy /\n    // cross-realm cases. The fallback still requires a real ArrayBuffer view\n    // so plain JSON-deserialized `{ constructor: ... }`\n    // spoofing is rejected, and `BYTES_PER_ELEMENT === 1` keeps the fallback on byte-oriented views.\n    return (a instanceof Uint8Array ||\n        (ArrayBuffer.isView(a) &&\n            a.constructor.name === 'Uint8Array' &&\n            'BYTES_PER_ELEMENT' in a &&\n            a.BYTES_PER_ELEMENT === 1));\n}\n/**\n * Asserts something is boolean.\n * @param b - Value to validate.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Validates a boolean option before branching on it.\n *\n * ```ts\n * abool(true);\n * ```\n */\nexport function abool(b) {\n    if (typeof b !== 'boolean')\n        throw new TypeError(`boolean expected, not ${b}`);\n}\n/**\n * Asserts something is a non-negative safe integer.\n * @param n - Value to validate.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validates a non-negative length or counter.\n *\n * ```ts\n * anumber(1);\n * ```\n */\nexport function anumber(n) {\n    if (typeof n !== 'number')\n        throw new TypeError('number expected, got ' + typeof n);\n    if (!Number.isSafeInteger(n) || n < 0)\n        throw new RangeError('positive integer expected, got ' + n);\n}\n/**\n * Asserts something is Uint8Array.\n * @param value - Value to validate.\n * @param length - Expected byte length.\n * @param title - Optional label used in error messages.\n * @returns The validated byte array.\n * On Node, `Buffer` is accepted too because it is a Uint8Array view.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument lengths. {@link RangeError}\n * @example\n * Validates a fixed-length nonce or key buffer.\n *\n * ```ts\n * abytes(new Uint8Array([1, 2]), 2);\n * ```\n */\nexport function abytes(value, length, title = '') {\n    const bytes = isBytes(value);\n    const len = value?.length;\n    const needsLen = length !== undefined;\n    if (!bytes || (needsLen && len !== length)) {\n        const prefix = title && `\"${title}\" `;\n        const ofLen = needsLen ? ` of length ${length}` : '';\n        const got = bytes ? `length=${len}` : `type=${typeof value}`;\n        const message = prefix + 'expected Uint8Array' + ofLen + ', got ' + got;\n        if (!bytes)\n            throw new TypeError(message);\n        throw new RangeError(message);\n    }\n    return value;\n}\n/**\n * Asserts a hash- or MAC-like instance has not been destroyed or finished.\n * @param instance - Stateful instance to validate.\n * @param checkFinished - Whether to reject finished instances.\n * When `false`, only `destroyed` is checked.\n * @throws If the hash instance has already been destroyed or finalized. {@link Error}\n * @example\n * Guards against calling `update()` or `digest()` on a finished hash.\n *\n * ```ts\n * aexists({ destroyed: false, finished: false });\n * ```\n */\nexport function aexists(instance, checkFinished = true) {\n    if (instance.destroyed)\n        throw new Error('Hash instance has been destroyed');\n    if (checkFinished && instance.finished)\n        throw new Error('Hash#digest() has already been called');\n}\n/**\n * Asserts output is a properly-sized byte array.\n * @param out - Output buffer to validate.\n * @param instance - Hash-like instance providing `outputLen`.\n * This is the relaxed `digestInto()`-style contract: output must be at least `outputLen`,\n * unlike one-shot cipher helpers elsewhere in the repo that often require exact lengths.\n * @throws On wrong argument types. {@link TypeError}\n * @param onlyAligned - Whether `out` must be 4-byte aligned for zero-allocation word views.\n * @throws On wrong output buffer lengths. {@link RangeError}\n * @throws On wrong output buffer alignment. {@link Error}\n * @example\n * Verifies that a caller-provided output buffer is large enough.\n *\n * ```ts\n * aoutput(new Uint8Array(16), { outputLen: 16 });\n * ```\n */\nexport function aoutput(out, instance, onlyAligned = false) {\n    abytes(out, undefined, 'output');\n    const min = instance.outputLen;\n    if (out.length < min) {\n        throw new RangeError('digestInto() expects output buffer of length at least ' + min);\n    }\n    if (onlyAligned && !isAligned32(out))\n        throw new Error('invalid output, must be aligned');\n}\n/**\n * Casts a typed-array view to Uint8Array.\n * @param arr - Typed-array view to reinterpret.\n * @returns Uint8Array view over the same bytes.\n * @example\n * Views 32-bit words as raw bytes without copying.\n *\n * ```ts\n * u8(new Uint32Array([1]));\n * ```\n */\nexport function u8(arr) {\n    return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/**\n * Casts a typed-array view to Uint32Array.\n * @param arr - Typed-array view to reinterpret.\n * @returns Uint32Array view over the same bytes. Callers are expected to provide a\n * 4-byte-aligned offset; trailing `1..3` bytes are silently dropped.\n * @example\n * Views a byte buffer as 32-bit words for block processing.\n *\n * ```ts\n * u32(new Uint8Array(4));\n * ```\n */\nexport function u32(arr) {\n    return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));\n}\n/**\n * Zeroizes typed arrays in place.\n * Warning: JS provides no guarantees.\n * @param arrays - Arrays to wipe.\n * @example\n * Wipes a temporary key buffer after use.\n *\n * ```ts\n * const bytes = new Uint8Array([1]);\n * clean(bytes);\n * ```\n */\nexport function clean(...arrays) {\n    for (let i = 0; i < arrays.length; i++) {\n        arrays[i].fill(0);\n    }\n}\n/**\n * Creates a DataView for byte-level manipulation.\n * @param arr - Typed-array view to wrap.\n * @returns DataView over the same bytes.\n * @example\n * Creates an endian-aware view for length encoding.\n *\n * ```ts\n * createView(new Uint8Array(4));\n * ```\n */\nexport function createView(arr) {\n    return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/**\n * Whether the current platform is little-endian.\n * Most are; some IBM systems are not.\n */\nexport const isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44)();\n/**\n * Reverses byte order of one 32-bit word.\n * @param word - Unsigned 32-bit word to swap.\n * @returns The same word with bytes reversed.\n * @example\n * Swaps a big-endian word into little-endian byte order.\n *\n * ```ts\n * byteSwap(0x11223344);\n * ```\n */\nexport const byteSwap = (word) => ((word << 24) & 0xff000000) |\n    ((word << 8) & 0xff0000) |\n    ((word >>> 8) & 0xff00) |\n    ((word >>> 24) & 0xff);\n/**\n * Normalizes one 32-bit word to the little-endian representation expected by cipher cores.\n * @param n - Unsigned 32-bit word to normalize.\n * @returns Little-endian normalized word on big-endian hosts, else the input word unchanged.\n * @example\n * Normalizes a host-endian word before passing it into an ARX/AES core.\n *\n * ```ts\n * swap8IfBE(0x11223344);\n * ```\n */\nexport const swap8IfBE = isLE\n    ? (n) => n\n    : (n) => byteSwap(n) >>> 0;\n/**\n * Byte-swaps every word of a Uint32Array in place.\n * @param arr - Uint32Array whose words should be swapped.\n * @returns The same array after in-place byte swapping.\n * @example\n * Swaps every 32-bit word in a word-view buffer.\n *\n * ```ts\n * byteSwap32(new Uint32Array([0x11223344]));\n * ```\n */\nexport const byteSwap32 = (arr) => {\n    for (let i = 0; i < arr.length; i++)\n        arr[i] = byteSwap(arr[i]);\n    return arr;\n};\n/**\n * Normalizes a Uint32Array view to the little-endian representation expected by cipher cores.\n * @param u - Word view to normalize in place.\n * @returns Little-endian normalized word view.\n * @example\n * Normalizes a word-view buffer before block processing.\n *\n * ```ts\n * swap32IfBE(new Uint32Array([0x11223344]));\n * ```\n */\nexport const swap32IfBE = isLE\n    ? (u) => u\n    : byteSwap32;\n// Built-in hex conversion:\n// {@link https://caniuse.com/mdn-javascript_builtins_uint8array_fromhex | caniuse entry}\nconst hasHexBuiltin = /* @__PURE__ */ (() => \n// @ts-ignore\ntypeof Uint8Array.from([]).toHex === 'function' && typeof Uint8Array.fromHex === 'function')();\n// Array where index 0xf0 (240) is mapped to string 'f0'\nconst hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));\n/**\n * Convert byte array to hex string. Uses built-in function, when available.\n * @param bytes - Bytes to encode.\n * @returns Lowercase hexadecimal string.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Formats ciphertext bytes for logs or test vectors.\n *\n * ```ts\n * bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])); // 'cafe0123'\n * ```\n */\nexport function bytesToHex(bytes) {\n    abytes(bytes);\n    // @ts-ignore\n    if (hasHexBuiltin)\n        return bytes.toHex();\n    // pre-caching improves the speed 6x\n    let hex = '';\n    for (let i = 0; i < bytes.length; i++) {\n        hex += hexes[bytes[i]];\n    }\n    return hex;\n}\n// We use optimized technique to convert hex string to byte array\nconst asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };\nfunction asciiToBase16(ch) {\n    if (ch >= asciis._0 && ch <= asciis._9)\n        return ch - asciis._0; // '2' => 50-48\n    if (ch >= asciis.A && ch <= asciis.F)\n        return ch - (asciis.A - 10); // 'B' => 66-(65-10)\n    if (ch >= asciis.a && ch <= asciis.f)\n        return ch - (asciis.a - 10); // 'b' => 98-(97-10)\n    return;\n}\n/**\n * Convert hex string to byte array. Uses built-in function, when available.\n * @param hex - Hexadecimal string to decode.\n * @returns Decoded bytes.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On malformed hexadecimal input. {@link RangeError}\n * @example\n * Parses a hex test vector into bytes.\n *\n * ```ts\n * hexToBytes('cafe0123'); // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])\n * ```\n */\nexport function hexToBytes(hex) {\n    if (typeof hex !== 'string')\n        throw new TypeError('hex string expected, got ' + typeof hex);\n    if (hasHexBuiltin) {\n        try {\n            return Uint8Array.fromHex(hex);\n        }\n        catch (error) {\n            if (error instanceof SyntaxError)\n                throw new RangeError(error.message);\n            throw error;\n        }\n    }\n    const hl = hex.length;\n    const al = hl / 2;\n    if (hl % 2)\n        throw new RangeError('hex string expected, got unpadded hex of length ' + hl);\n    const array = new Uint8Array(al);\n    for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {\n        const n1 = asciiToBase16(hex.charCodeAt(hi));\n        const n2 = asciiToBase16(hex.charCodeAt(hi + 1));\n        if (n1 === undefined || n2 === undefined) {\n            const char = hex[hi] + hex[hi + 1];\n            throw new RangeError('hex string expected, got non-hex character \"' + char + '\" at index ' + hi);\n        }\n        array[ai] = n1 * 16 + n2; // multiply first octet, e.g. 'a3' => 10*16+3 => 160 + 3 => 163\n    }\n    return array;\n}\n// Used in micro\n/**\n * Converts a big-endian hex string into bigint.\n * @param hex - Hexadecimal string without `0x`.\n * @returns Parsed bigint value. The empty string is treated as `0n`.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Parses a big-endian field element or counter from hex.\n *\n * ```ts\n * hexToNumber('ff');\n * ```\n */\nexport function hexToNumber(hex) {\n    if (typeof hex !== 'string')\n        throw new TypeError('hex string expected, got ' + typeof hex);\n    return BigInt(hex === '' ? '0' : '0x' + hex); // Big Endian\n}\n// Used in ff1\n// BE: Big Endian, LE: Little Endian\n/**\n * Converts big-endian bytes into bigint.\n * @param bytes - Big-endian bytes.\n * @returns Parsed bigint value. Empty input is treated as `0n`.\n * @throws On invalid byte input passed to the internal hex conversion. {@link TypeError}\n * @example\n * Reads a big-endian integer from serialized bytes.\n *\n * ```ts\n * bytesToNumberBE(new Uint8Array([1, 0]));\n * ```\n */\nexport function bytesToNumberBE(bytes) {\n    return hexToNumber(bytesToHex(bytes));\n}\n// Used in micro, ff1\n/**\n * Converts a number into big-endian bytes of fixed length.\n * @param n - Number to encode.\n * @param len - Output length in bytes.\n * @returns Big-endian bytes padded to `len`.\n * Validation is indirect through `hexToBytes(...)`, so negative values, `len = 0`,\n * and values that do not fit surface through the downstream hex parser instead of a\n * dedicated range guard here.\n * @throws On wrong argument types. {@link TypeError}\n * @throws If the requested output length cannot represent the encoded value. {@link RangeError}\n * @example\n * Encodes a counter as fixed-width big-endian bytes.\n *\n * ```ts\n * numberToBytesBE(1, 2);\n * ```\n */\nexport function numberToBytesBE(n, len) {\n    // Reject coercible non-numeric inputs before string/hex conversion changes behavior.\n    if (typeof n === 'number')\n        anumber(n);\n    else if (typeof n !== 'bigint')\n        throw new TypeError(`number or bigint expected, got ${typeof n}`);\n    anumber(len);\n    return hexToBytes(n.toString(16).padStart(len * 2, '0'));\n}\n/**\n * Converts string to bytes using UTF8 encoding.\n * @param str - String to encode.\n * @returns UTF-8 bytes in a detached fresh Uint8Array copy.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Encodes application text before encryption or MACing.\n *\n * ```ts\n * utf8ToBytes('abc'); // new Uint8Array([97, 98, 99])\n * ```\n */\nexport function utf8ToBytes(str) {\n    if (typeof str !== 'string')\n        throw new TypeError('string expected');\n    return new Uint8Array(new TextEncoder().encode(str)); // {@link https://bugzil.la/1681809 | Firefox bug 1681809}\n}\n/**\n * Converts bytes to string using UTF8 encoding.\n * @param bytes - UTF-8 bytes.\n * @returns Decoded string. Input validation is delegated to `TextDecoder`, and malformed\n * UTF-8 is replacement-decoded instead of rejected.\n * @example\n * Decodes UTF-8 plaintext back into a string.\n *\n * ```ts\n * bytesToUtf8(new Uint8Array([97, 98, 99])); // 'abc'\n * ```\n */\nexport function bytesToUtf8(bytes) {\n    return new TextDecoder().decode(bytes);\n}\n/**\n * Checks if two U8A use same underlying buffer and overlaps.\n * This is invalid and can corrupt data.\n * @param a - First byte view.\n * @param b - Second byte view.\n * @returns `true` when the views overlap in memory.\n * @example\n * Detects whether two slices alias the same backing buffer.\n *\n * ```ts\n * overlapBytes(new Uint8Array(4), new Uint8Array(4));\n * ```\n */\nexport function overlapBytes(a, b) {\n    // Zero-length views cannot overwrite anything, even if their offset sits inside another range.\n    if (!a.byteLength || !b.byteLength)\n        return false;\n    return (a.buffer === b.buffer && // best we can do, may fail with an obscure Proxy\n        a.byteOffset < b.byteOffset + b.byteLength && // a starts before b end\n        b.byteOffset < a.byteOffset + a.byteLength // b starts before a end\n    );\n}\n/**\n * If input and output overlap and input starts before output, we will overwrite end of input before\n * we start processing it, so this is not supported for most ciphers\n * (except chacha/salsa, which were designed for this)\n * @param input - Input bytes.\n * @param output - Output bytes.\n * @throws If the output view would overwrite unread input bytes. {@link Error}\n * @example\n * Rejects an in-place layout that would overwrite unread input bytes.\n *\n * ```ts\n * complexOverlapBytes(new Uint8Array(4), new Uint8Array(4));\n * ```\n */\nexport function complexOverlapBytes(input, output) {\n    // This is very cursed. It works somehow, but I'm completely unsure,\n    // reasoning about overlapping aligned windows is very hard.\n    if (overlapBytes(input, output) && input.byteOffset < output.byteOffset)\n        throw new Error('complex overlap of input and output is not supported');\n}\n/**\n * Copies several Uint8Arrays into one.\n * @param arrays - Byte arrays to concatenate.\n * @returns Combined byte array.\n * @throws On wrong argument types inside the byte-array list. {@link TypeError}\n * @example\n * Builds a `nonce || ciphertext` style buffer.\n *\n * ```ts\n * concatBytes(new Uint8Array([1]), new Uint8Array([2]));\n * ```\n */\nexport function concatBytes(...arrays) {\n    let sum = 0;\n    for (let i = 0; i < arrays.length; i++) {\n        const a = arrays[i];\n        abytes(a);\n        sum += a.length;\n    }\n    const res = new Uint8Array(sum);\n    for (let i = 0, pad = 0; i < arrays.length; i++) {\n        const a = arrays[i];\n        res.set(a, pad);\n        pad += a.length;\n    }\n    return res;\n}\n/**\n * Merges user options into defaults.\n * @param defaults - Default option values.\n * @param opts - User-provided overrides.\n * @returns Combined options object.\n * The merge mutates `defaults` in place and returns the same object.\n * @throws If options are missing or not an object. {@link Error}\n * @example\n * Applies user overrides to the default cipher options.\n *\n * ```ts\n * checkOpts({ rounds: 20 }, { rounds: 8 });\n * ```\n */\nexport function checkOpts(defaults, opts) {\n    if (opts == null || typeof opts !== 'object')\n        throw new Error('options must be defined');\n    const merged = Object.assign(defaults, opts);\n    return merged;\n}\n/**\n * Compares two byte arrays in kinda constant time once lengths already match.\n * @param a - First byte array.\n * @param b - Second byte array.\n * @returns `true` when the arrays contain the same bytes. Different lengths still return early.\n * @example\n * Compares an expected authentication tag with the received one.\n *\n * ```ts\n * equalBytes(new Uint8Array([1]), new Uint8Array([1]));\n * ```\n */\nexport function equalBytes(a, b) {\n    if (a.length !== b.length)\n        return false;\n    let diff = 0;\n    for (let i = 0; i < a.length; i++)\n        diff |= a[i] ^ b[i];\n    return diff === 0;\n}\n/**\n * Wraps a keyed MAC constructor into a one-shot helper with `.create()`.\n * @param keyLen - Valid probe-key length used to read static metadata once.\n * The probe key is only used for `outputLen` / `blockLen`, so callers with several valid key sizes\n * can pass any representative size as long as those values stay fixed.\n * @param macCons - Keyed MAC constructor or factory.\n * @param fromMsg - Optional adapter that derives extra constructor args from the one-shot message.\n * @returns Callable MAC helper with `.create()`.\n */\nexport function wrapMacConstructor(keyLen, macCons, fromMsg) {\n    const mac = macCons;\n    const getArgs = (fromMsg || (() => []));\n    const macC = (msg, key) => mac(key, ...getArgs(msg))\n        .update(msg)\n        .digest();\n    const tmp = mac(new Uint8Array(keyLen), ...getArgs(new Uint8Array(0)));\n    macC.outputLen = tmp.outputLen;\n    macC.blockLen = tmp.blockLen;\n    macC.create = (key, ...args) => mac(key, ...args);\n    return macC;\n}\n/**\n * Wraps a cipher: validates args, ensures encrypt() can only be called once.\n * Used internally by the exported cipher constructors.\n * Output-buffer support is inferred from the wrapped `encrypt` / `decrypt`\n * arity (`fn.length === 2`), and tag-bearing constructors are expected to use\n * `args[1]` for optional AAD.\n * @__NO_SIDE_EFFECTS__\n * @param params - Static cipher metadata. See {@link CipherParams}.\n * @param constructor - Cipher constructor.\n * @returns Wrapped constructor with validation.\n */\nexport const wrapCipher = (params, constructor) => {\n    function wrappedCipher(key, ...args) {\n        // Validate key\n        abytes(key, undefined, 'key');\n        // Validate nonce if nonceLength is present\n        if (params.nonceLength !== undefined) {\n            const nonce = args[0];\n            abytes(nonce, params.varSizeNonce ? undefined : params.nonceLength, 'nonce');\n        }\n        // Validate AAD if tagLength present\n        const tagl = params.tagLength;\n        if (tagl && args[1] !== undefined)\n            abytes(args[1], undefined, 'AAD');\n        const cipher = constructor(key, ...args);\n        const checkOutput = (fnLength, output) => {\n            if (output !== undefined) {\n                if (fnLength !== 2)\n                    throw new Error('cipher output not supported');\n                abytes(output, undefined, 'output');\n            }\n        };\n        // Create wrapped cipher with validation and single-use encryption\n        let called = false;\n        const wrCipher = {\n            encrypt(data, output) {\n                if (called)\n                    throw new Error('cannot encrypt() twice with same key + nonce');\n                called = true;\n                abytes(data);\n                checkOutput(cipher.encrypt.length, output);\n                return cipher.encrypt(data, output);\n            },\n            decrypt(data, output) {\n                abytes(data);\n                if (tagl && data.length < tagl)\n                    throw new Error('\"ciphertext\" expected length bigger than tagLength=' + tagl);\n                checkOutput(cipher.decrypt.length, output);\n                return cipher.decrypt(data, output);\n            },\n        };\n        return wrCipher;\n    }\n    Object.assign(wrappedCipher, params);\n    return wrappedCipher;\n};\n/**\n * By default, returns u8a of length.\n * When out is available, it checks it for validity and uses it.\n * @param expectedLength - Required output length.\n * @param out - Optional destination buffer.\n * @param onlyAligned - Whether `out` must be 4-byte aligned.\n * @returns Output buffer ready for writing.\n * @throws On wrong argument types. {@link TypeError}\n * @throws If the provided output buffer has the wrong size or alignment. {@link Error}\n * @example\n * Reuses a caller-provided output buffer when lengths match.\n *\n * ```ts\n * getOutput(16, new Uint8Array(16));\n * ```\n */\nexport function getOutput(expectedLength, out, onlyAligned = true) {\n    if (out === undefined)\n        return new Uint8Array(expectedLength);\n    // Keep Buffer/cross-realm Uint8Array support here instead of trusting a shape-compatible object.\n    abytes(out, undefined, 'output');\n    if (out.length !== expectedLength)\n        throw new Error('\"output\" expected Uint8Array of length ' + expectedLength + ', got: ' + out.length);\n    if (onlyAligned && !isAligned32(out))\n        throw new Error('invalid output, must be aligned');\n    return out;\n}\n/**\n * Encodes data and AAD bit lengths into a 16-byte buffer.\n * @param dataLength - Data length in bits.\n * @param aadLength - AAD length in bits.\n * The serialized block is still `aadLength || dataLength`, matching GCM/Poly1305\n * conventions even though the helper parameter order is `(dataLength, aadLength)`.\n * @param isLE - Whether to encode lengths as little-endian.\n * @returns 16-byte length block.\n * @throws On wrong argument types passed to the endian validator. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Builds the length block appended by GCM and Poly1305.\n *\n * ```ts\n * u64Lengths(16, 8, true);\n * ```\n */\nexport function u64Lengths(dataLength, aadLength, isLE) {\n    // Reject coercible non-number lengths like '10' and true before BigInt(...) accepts them.\n    anumber(dataLength);\n    anumber(aadLength);\n    abool(isLE);\n    const num = new Uint8Array(16);\n    const view = createView(num);\n    view.setBigUint64(0, BigInt(aadLength), isLE);\n    view.setBigUint64(8, BigInt(dataLength), isLE);\n    return num;\n}\n/**\n * Checks whether a byte array is aligned to a 4-byte offset.\n * @param bytes - Byte array to inspect.\n * @returns `true` when the view is 4-byte aligned.\n * @example\n * Checks whether a buffer can be safely viewed as Uint32Array.\n *\n * ```ts\n * isAligned32(new Uint8Array(4));\n * ```\n */\nexport function isAligned32(bytes) {\n    return bytes.byteOffset % 4 === 0;\n}\n/**\n * Copies bytes into a new Uint8Array.\n * @param bytes - Bytes to copy.\n * @returns Copied byte array.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Copies input into an aligned Uint8Array before block processing.\n *\n * ```ts\n * copyBytes(new Uint8Array([1, 2]));\n * ```\n */\nexport function copyBytes(bytes) {\n    // `Uint8Array.from(...)` would also accept arrays / other typed arrays. Keep this helper strict\n    // because callers use it at byte-validation boundaries before mutating the detached copy.\n    return Uint8Array.from(abytes(bytes));\n}\n/**\n * Cryptographically secure PRNG.\n * Uses internal OS-level `crypto.getRandomValues`.\n * @param bytesLength - Number of bytes to produce.\n * Validation is delegated to `Uint8Array(bytesLength)` and `getRandomValues`, so\n * non-integers, negative lengths, and oversize requests surface backend/runtime errors.\n * @returns Random byte array.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @throws If the runtime does not expose `crypto.getRandomValues`. {@link Error}\n * @example\n * Generates a fresh nonce or key.\n *\n * ```ts\n * randomBytes(16);\n * ```\n */\nexport function randomBytes(bytesLength = 32) {\n    // Validate upfront so fractional / coercible lengths do not silently\n    // truncate through Uint8Array().\n    anumber(bytesLength);\n    const cr = typeof globalThis === 'object' ? globalThis.crypto : null;\n    if (typeof cr?.getRandomValues !== 'function')\n        throw new Error('crypto.getRandomValues must be defined');\n    return cr.getRandomValues(new Uint8Array(bytesLength));\n}\n/**\n * Uses CSPRNG for nonce, nonce injected in ciphertext.\n * For `encrypt`, a `nonceBytes`-length buffer is fetched from CSPRNG and\n * prepended to encrypted ciphertext. For `decrypt`, first `nonceBytes` of ciphertext\n * are treated as nonce. The wrapper always allocates a fresh `nonce || ciphertext`\n * buffer on encrypt and intentionally does not support caller-provided destination buffers.\n * Too-short decrypt inputs are split into short/empty nonce views and then delegated\n * to the wrapped cipher instead of being rejected here first.\n *\n * NOTE: Under the same key, using random nonces (e.g. `managedNonce`) with AES-GCM and ChaCha\n * should be limited to `2**23` (8M) messages to get a collision chance of\n * `2**-50`. Stretching to `2**32` (4B) messages would raise that chance to\n * `2**-33`, still negligible but creeping up.\n * @param fn - Cipher constructor that expects a nonce.\n * @param randomBytes_ - Random-byte source used for nonce generation.\n * @returns Cipher constructor that prepends the nonce to ciphertext.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On invalid nonce lengths observed at wrapper construction or use. {@link RangeError}\n * @example\n * Prepends a fresh random nonce to every ciphertext.\n *\n * ```ts\n * import { gcm } from '@noble/ciphers/aes.js';\n * import { managedNonce, randomBytes } from '@noble/ciphers/utils.js';\n * const wrapped = managedNonce(gcm);\n * const key = randomBytes(16);\n * const ciphertext = wrapped(key).encrypt(new Uint8Array([1, 2, 3]));\n * wrapped(key).decrypt(ciphertext);\n * ```\n */\nexport function managedNonce(fn, randomBytes_ = randomBytes) {\n    const { nonceLength } = fn;\n    anumber(nonceLength);\n    const addNonce = (nonce, ciphertext, plaintext) => {\n        const out = concatBytes(nonce, ciphertext);\n        // Wrapped ciphers may alias caller plaintext on encrypt(); never zero\n        // caller-owned buffers here.\n        if (!overlapBytes(plaintext, ciphertext))\n            ciphertext.fill(0);\n        return out;\n    };\n    // NOTE: we cannot support DST here, it would be mistake:\n    // - we don't know how much dst length cipher requires\n    // - nonce may unalign dst and break everything\n    // - we create new u8a anyway (concatBytes)\n    // - previously we passed all args to cipher, but that was mistake!\n    const res = ((key, ...args) => ({\n        encrypt(plaintext) {\n            abytes(plaintext);\n            const nonce = randomBytes_(nonceLength);\n            const encrypted = fn(key, nonce, ...args).encrypt(plaintext);\n            // @ts-ignore\n            if (encrypted instanceof Promise)\n                return encrypted.then((ct) => addNonce(nonce, ct, plaintext));\n            return addNonce(nonce, encrypted, plaintext);\n        },\n        decrypt(ciphertext) {\n            abytes(ciphertext);\n            const nonce = ciphertext.subarray(0, nonceLength);\n            const decrypted = ciphertext.subarray(nonceLength);\n            return fn(key, nonce, ...args).decrypt(decrypted);\n        },\n    }));\n    // Auto-nonce wrappers still preserve the wrapped payload geometry.\n    if ('blockSize' in fn)\n        res.blockSize = fn.blockSize;\n    if ('tagLength' in fn)\n        res.tagLength = fn.tagLength;\n    return res;\n}\n//# sourceMappingURL=utils.js.map","/**\n * {@link https://en.wikipedia.org/wiki/Advanced_Encryption_Standard | AES}\n * a.k.a. Advanced Encryption Standard\n * is a variant of Rijndael block cipher, standardized by NIST in 2001.\n * We provide the fastest available pure JS implementation.\n *\n * `cipher = encrypt(block, key)`\n *\n * Data is split into 128-bit blocks.\n * Encrypted in 10/12/14 rounds (128/192/256 bits). In every round:\n * 1. **S-box**, table substitution\n * 2. **Shift rows**, cyclic shift left of all rows of data array\n * 3. **Mix columns**, multiplying every column by fixed polynomial\n * 4. **Add round key**, round_key xor i-th column of array\n *\n * Check out\n * {@link https://csrc.nist.gov/files/pubs/fips/197/final/docs/fips-197.pdf | FIPS-197},\n * {@link https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38G.pdf | NIST 800-38G},\n * and {@link https://csrc.nist.gov/csrc/media/projects/cryptographic-standards-and-guidelines/documents/aes-development/rijndael-ammended.pdf | original proposal}.\n * @module\n */\nimport { ghash, polyval } from \"./_polyval.js\";\n// prettier-ignore\nimport { abytes, anumber, aoutput, byteSwap, clean, complexOverlapBytes, concatBytes, copyBytes, createView, equalBytes, getOutput, isAligned32, isLE, overlapBytes, swap32IfBE, swap8IfBE, u32, u64Lengths, u8, wrapCipher, wrapMacConstructor } from \"./utils.js\";\nconst BLOCK_SIZE = 16;\n// AES operates on 16-byte blocks, i.e. 4 32-bit words.\nconst BLOCK_SIZE32 = 4;\n// Shared zero block (`0^128`) used by GCM's `H = CIPH_K(0^128)` / J0 scratch\n// and by CMAC / SIV helpers; callers take `.slice()` before mutating it.\nconst EMPTY_BLOCK = /* @__PURE__ */ new Uint8Array(BLOCK_SIZE);\n// RFC 5297 §2.1 / §2.4: S2V uses `<one> = 0^127 || 1` for the `n = 0` special case.\nconst ONE_BLOCK = /* @__PURE__ */ Uint8Array.from([\n    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,\n]);\nconst POLY = 0x11b; // 1 + x + x**3 + x**4 + x**8\n// Validates plain AES key sizes only; AES-SIV's doubled-key contract is checked elsewhere.\nfunction validateKeyLength(key) {\n    if (![16, 24, 32].includes(key.length))\n        throw new Error('\"aes key\" expected Uint8Array of length 16/24/32, got length=' + key.length);\n}\n// TODO: remove multiplication, binary ops only\n// Doubles one GF(2^8) field element; callers are expected to stay in byte range.\n// FIPS 197 upd1 §4.3 equation (4.5): XTIMES(b) left-shifts by one and, when\n// b7=1, reduces by m(x); using POLY=0x11b here yields the same byte result\n// as XORing with {1b} after the shift.\nfunction mul2(n) {\n    return (n << 1) ^ (POLY & -(n >> 7));\n}\n// Shift-and-add multiplication in GF(2^8); callers are expected to pass byte values.\n// FIPS 197 upd1 §4.3 equation (4.7): general products are XORs of repeated\n// XTIMES() multiples, e.g. {57}•{13} = {57}⊕{ae}⊕{07}.\nfunction mul(a, b) {\n    let res = 0;\n    for (; b > 0; b >>= 1) {\n        // Usual shift-and-add step in GF(2^8), not a scalar-multiplication ladder.\n        res ^= a & -(b & 1); // if (b&1) res ^=a (but const-time).\n        a = mul2(a); // a = 2*a\n    }\n    return res;\n}\n/**\n * Increments a counter block with wrap around.\n * AES call sites here currently use the big-endian branch, but the helper supports both layouts.\n * NIST SP 800-38A Appendix B.1 and SP 800-38D §6.2 increment the\n * least-significant/rightmost bits.\n * `isLE=false` matches that standard counter-block layout, while `isLE=true`\n * is a generic extension for non-AES callers.\n * The implementation keeps a 32-bit bitwise carry path, so `carry` is capped at `0xffffff00`;\n * larger values throw instead of silently overflowing before the next-byte propagation step.\n */\n// Keep the helper explicitly typed so `--isolatedDeclarations` can expose it\n// through the test-only `__TESTS` export without inference errors.\nconst incBytes = (data, isLE, carry = 1) => {\n    // Keep `carry + byte <= 0xffffffff` so the `| 0` / `>>> 8` path below\n    // never truncates a real carry bit.\n    if (!Number.isSafeInteger(carry) || carry > 0xffffff00)\n        throw new Error('incBytes: wrong carry ' + carry);\n    abytes(data);\n    for (let i = 0; i < data.length; i++) {\n        const pos = !isLE ? data.length - 1 - i : i;\n        carry = (carry + (data[pos] & 0xff)) | 0;\n        data[pos] = carry & 0xff;\n        carry >>>= 8;\n    }\n};\n// AES S-box is generated using finite field inversion,\n// an affine transform, and xor of a constant 0x63.\nconst sbox = /* @__PURE__ */ (() => {\n    const t = new Uint8Array(256);\n    // Repeated multiplication by {03} walks all 255 nonzero field elements\n    // once, so t[255 - i] is the multiplicative inverse of t[i] for the\n    // affine step.\n    for (let i = 0, x = 1; i < 256; i++, x ^= mul2(x))\n        t[i] = x;\n    const box = new Uint8Array(256);\n    // FIPS 197 upd1 §5.1.1: SBOX({00}) = {63} because the inverse step leaves\n    // {00} at {00}, then the affine transform xors in c = {63}.\n    box[0] = 0x63;\n    for (let i = 0; i < 255; i++) {\n        let x = t[255 - i];\n        x |= x << 8;\n        box[t[i]] = (x ^ (x >> 4) ^ (x >> 5) ^ (x >> 6) ^ (x >> 7) ^ 0x63) & 0xff;\n    }\n    clean(t);\n    return box;\n})();\n// FIPS 197 upd1 §5.3.2: INVSBOX() is derived from SBOX() by swapping input\n// and output roles (Table 6).\n// `indexOf` is only used once at module init, so the quadratic setup cost stays off hot paths.\nconst invSbox = /* @__PURE__ */ sbox.map((_, j) => sbox.indexOf(j));\n// FIPS 197 upd1 §5.2: ROTWORD([a0,a1,a2,a3]) = [a1,a2,a3,a0]; with this LE\n// word packing that is a right rotate by 8 bits.\nconst rotr32_8 = (n) => (n << 24) | (n >>> 8);\n// LE T-table helper: rotates one precomputed word by one byte so T1/T2/T3\n// reuse T0's substitution/mix result in the other byte lanes.\nconst rotl32_8 = (n) => (n << 8) | (n >>> 24);\n// T-table is optimization suggested in 5.2 of original proposal (missed from FIPS-197). Changes:\n// - LE instead of BE\n// - bigger tables: T0 and T1 are merged into T01 table and T2 & T3 into T23;\n//   so index is u16, instead of u8. This speeds up things, unexpectedly\nfunction genTtable(sbox, fn) {\n    if (sbox.length !== 256)\n        throw new Error('Wrong sbox length');\n    const T0 = new Uint32Array(256).map((_, j) => fn(sbox[j]));\n    const T1 = T0.map(rotl32_8);\n    const T2 = T1.map(rotl32_8);\n    const T3 = T2.map(rotl32_8);\n    // Pre-xor adjacent lanes so apply0123/applySbox can fetch two substituted\n    // byte lanes per lookup in the LE round layout.\n    const T01 = new Uint32Array(256 * 256);\n    const T23 = new Uint32Array(256 * 256);\n    const sbox2 = new Uint16Array(256 * 256);\n    for (let i = 0; i < 256; i++) {\n        for (let j = 0; j < 256; j++) {\n            const idx = i * 256 + j;\n            T01[idx] = T0[i] ^ T1[j];\n            T23[idx] = T2[i] ^ T3[j];\n            sbox2[idx] = (sbox[i] << 8) | sbox[j];\n        }\n    }\n    return { sbox, sbox2, T0, T1, T2, T3, T01, T23 };\n}\n// Forward round precompute: the packed word stores the MIXCOLUMNS row\n// [{02},{01},{01},{03}] in LE byte-lane order, and the returned `sbox2`\n// is also reused by key expansion and the final round.\nconst tableEncoding = /* @__PURE__ */ genTtable(sbox, (s) => (mul(s, 3) << 24) | (s << 16) | (s << 8) | mul(s, 2));\n// Inverse round precompute: the packed word stores the INVMIXCOLUMNS row\n// [{0e},{09},{0d},{0b}] in LE byte-lane order, and the tables are reused\n// by decrypt() and expandKeyDecLE().\nconst tableDecoding = /* @__PURE__ */ genTtable(invSbox, (s) => (mul(s, 11) << 24) | (mul(s, 13) << 16) | (mul(s, 9) << 8) | mul(s, 14));\n// FIPS 197 upd1 §5.2 Table 5: left-most bytes of Rcon[j] = x^(j-1), generated by repeated XTIMES().\nconst xPowers = /* @__PURE__ */ (() => {\n    const p = new Uint8Array(16);\n    for (let i = 0, x = 1; i < 16; i++, x = mul2(x))\n        p[i] = x;\n    return p;\n})();\n/** Forward AES key expansion used across ECB/CBC/CTR/GCM/CMAC/KW-style paths. */\nfunction expandKeyLE(key) {\n    abytes(key);\n    const len = key.length;\n    validateKeyLength(key);\n    const { sbox2 } = tableEncoding;\n    const toClean = [];\n    // Copy on BE or misaligned inputs so the LE word normalization below never\n    // mutates caller key bytes in place.\n    if (!isLE || !isAligned32(key))\n        toClean.push((key = copyBytes(key)));\n    const k32 = swap32IfBE(u32(key));\n    const Nk = k32.length;\n    // `applySbox` normally reads one byte lane from each argument; repeating\n    // `n` across all four lanes turns it into SUBWORD(n).\n    const subByte = (n) => applySbox(sbox2, n, n, n, n);\n    // AES key sizes are 16/24/32 bytes, so len + 28 yields the 44/52/60\n    // schedule words from FIPS 197 §5.2 / Table 3.\n    const xk = new Uint32Array(len + 28); // expanded key\n    xk.set(k32);\n    // 4.3.1 Key expansion\n    for (let i = Nk; i < xk.length; i++) {\n        let t = xk[i - 1];\n        if (i % Nk === 0)\n            t = subByte(rotr32_8(t)) ^ xPowers[i / Nk - 1];\n        else if (Nk > 6 && i % Nk === 4)\n            t = subByte(t);\n        xk[i] = xk[i - Nk] ^ t;\n    }\n    clean(...toClean);\n    return xk;\n}\nfunction expandKeyDecLE(key) {\n    const encKey = expandKeyLE(key);\n    const xk = encKey.slice();\n    const Nk = encKey.length;\n    const { sbox2 } = tableEncoding;\n    const { T0, T1, T2, T3 } = tableDecoding;\n    // Local decrypt() walks round keys forward from xk[0], so reverse the\n    // encryption round-key blocks first before applying the equivalent-inverse\n    // middle-round transform.\n    for (let i = 0; i < Nk; i += 4) {\n        for (let j = 0; j < 4; j++)\n            xk[i + j] = encKey[Nk - i - 4 + j];\n    }\n    clean(encKey);\n    // Apply InvMixColumn to the reversed round keys using the same LE sbox2\n    // packing as the forward path.\n    // apply InvMixColumn except first & last round\n    for (let i = 4; i < Nk - 4; i++) {\n        const x = xk[i];\n        const w = applySbox(sbox2, x, x, x, x);\n        xk[i] = T0[w & 0xff] ^ T1[(w >>> 8) & 0xff] ^ T2[(w >>> 16) & 0xff] ^ T3[w >>> 24];\n    }\n    return xk;\n}\n// Apply tables\nfunction apply0123(T01, T23, s0, s1, s2, s3) {\n    // `T01` takes the low byte lane from `s0` plus the next lane from `s1`;\n    // `T23` does the same for `s2`/`s3`.\n    // Equivalent to `T0[s0&0xff] ^ T1[(s1>>>8)&0xff] ^ T2[(s2>>>16)&0xff] ^\n    // T3[s3>>>24]`, but with two merged-table fetches.\n    return (T01[((s0 << 8) & 0xff00) | ((s1 >>> 8) & 0xff)] ^\n        T23[((s2 >>> 8) & 0xff00) | ((s3 >>> 24) & 0xff)]);\n}\nfunction applySbox(sbox2, s0, s1, s2, s3) {\n    // `sbox2` packs two substituted byte lanes at a time in the same LE\n    // layout used by the round code.\n    // Equivalent to `SBOX(byte0(s0)) | SBOX(byte1(s1))<<8 |\n    // SBOX(byte2(s2))<<16 | SBOX(byte3(s3))<<24`.\n    return (sbox2[(s0 & 0xff) | (s1 & 0xff00)] |\n        (sbox2[((s2 >>> 16) & 0xff) | ((s3 >>> 16) & 0xff00)] << 16));\n}\nfunction encrypt(xk, s0, s1, s2, s3) {\n    const { sbox2, T01, T23 } = tableEncoding;\n    let k = 0;\n    ((s0 ^= xk[k++]), (s1 ^= xk[k++]), (s2 ^= xk[k++]), (s3 ^= xk[k++]));\n    // `xk` has Nr+1 round-key blocks, so after the initial AddRoundKey and the\n    // final S-box-only round there are Nr-1 full table/MixColumns rounds left.\n    const rounds = xk.length / 4 - 2;\n    for (let i = 0; i < rounds; i++) {\n        const t0 = xk[k++] ^ apply0123(T01, T23, s0, s1, s2, s3);\n        const t1 = xk[k++] ^ apply0123(T01, T23, s1, s2, s3, s0);\n        const t2 = xk[k++] ^ apply0123(T01, T23, s2, s3, s0, s1);\n        const t3 = xk[k++] ^ apply0123(T01, T23, s3, s0, s1, s2);\n        ((s0 = t0), (s1 = t1), (s2 = t2), (s3 = t3));\n    }\n    // last round (without mixcolumns, so using SBOX2 table)\n    const t0 = xk[k++] ^ applySbox(sbox2, s0, s1, s2, s3);\n    const t1 = xk[k++] ^ applySbox(sbox2, s1, s2, s3, s0);\n    const t2 = xk[k++] ^ applySbox(sbox2, s2, s3, s0, s1);\n    const t3 = xk[k++] ^ applySbox(sbox2, s3, s0, s1, s2);\n    return { s0: t0, s1: t1, s2: t2, s3: t3 };\n}\n// Can't be merged with encrypt: arg positions for apply0123 / applySbox are different\nfunction decrypt(xk, s0, s1, s2, s3) {\n    const { sbox2, T01, T23 } = tableDecoding;\n    let k = 0;\n    ((s0 ^= xk[k++]), (s1 ^= xk[k++]), (s2 ^= xk[k++]), (s3 ^= xk[k++]));\n    // With `expandKeyDecLE()` the round keys are already reversed and middle\n    // rounds are InvMixColumns-adjusted, so this loop follows the equivalent\n    // inverse cipher order directly.\n    const rounds = xk.length / 4 - 2;\n    for (let i = 0; i < rounds; i++) {\n        const t0 = xk[k++] ^ apply0123(T01, T23, s0, s3, s2, s1);\n        const t1 = xk[k++] ^ apply0123(T01, T23, s1, s0, s3, s2);\n        const t2 = xk[k++] ^ apply0123(T01, T23, s2, s1, s0, s3);\n        const t3 = xk[k++] ^ apply0123(T01, T23, s3, s2, s1, s0);\n        ((s0 = t0), (s1 = t1), (s2 = t2), (s3 = t3));\n    }\n    // Final equivalent-inverse round omits InvMixColumns, so use inverse\n    // S-box lanes in InvShiftRows order.\n    const t0 = xk[k++] ^ applySbox(sbox2, s0, s3, s2, s1);\n    const t1 = xk[k++] ^ applySbox(sbox2, s1, s0, s3, s2);\n    const t2 = xk[k++] ^ applySbox(sbox2, s2, s1, s0, s3);\n    const t3 = xk[k++] ^ applySbox(sbox2, s3, s2, s1, s0);\n    return { s0: t0, s1: t1, s2: t2, s3: t3 };\n}\nfunction ctrCounter(xk, nonce, src, dst) {\n    abytes(nonce, BLOCK_SIZE, 'nonce');\n    abytes(src);\n    const srcLen = src.length;\n    dst = getOutput(srcLen, dst);\n    complexOverlapBytes(src, dst);\n    // Internal helper: mutate `nonce` in place as the live counter block so\n    // each encrypted block uses the next CTR value.\n    const ctr = nonce;\n    const c32 = u32(ctr);\n    const src32 = u32(src);\n    const dst32 = u32(dst);\n    // Fill block (empty, ctr=0)\n    let { s0, s1, s2, s3 } = encrypt(xk, swap8IfBE(c32[0]), swap8IfBE(c32[1]), swap8IfBE(c32[2]), swap8IfBE(c32[3]));\n    // process blocks\n    for (let i = 0; i + 4 <= src32.length; i += 4) {\n        dst32[i + 0] = src32[i + 0] ^ swap8IfBE(s0);\n        dst32[i + 1] = src32[i + 1] ^ swap8IfBE(s1);\n        dst32[i + 2] = src32[i + 2] ^ swap8IfBE(s2);\n        dst32[i + 3] = src32[i + 3] ^ swap8IfBE(s3);\n        incBytes(ctr, false, 1); // Full 128 bit counter with wrap around\n        ({ s0, s1, s2, s3 } = encrypt(xk, swap8IfBE(c32[0]), swap8IfBE(c32[1]), swap8IfBE(c32[2]), swap8IfBE(c32[3])));\n    }\n    // NIST SP 800-38A CTR mode uses the leading `u` bits of the next output\n    // block for the final short block.\n    // It's possible to handle > u32 fast, but is it worth it?\n    const start = BLOCK_SIZE * Math.floor(src32.length / BLOCK_SIZE32);\n    if (start < srcLen) {\n        const b32 = new Uint32Array([s0, s1, s2, s3]);\n        swap32IfBE(b32);\n        const buf = u8(b32);\n        for (let i = start, pos = 0; i < srcLen; i++, pos++)\n            dst[i] = src[i] ^ buf[pos];\n        clean(b32);\n    }\n    // Unsafe mutable-counter API only advances whole blocks. Callers that want to\n    // resume after consuming part of this block must re-run from the same counter\n    // with left-padding and strip the already-consumed prefix themselves.\n    return dst;\n}\n// AES CTR with overflowing 32 bit counter\n// It's possible to do 32le significantly simpler (and probably faster) by using u32.\n// But, we need both, and perf bottleneck is in ghash anyway.\n// Unsafe 32-bit CTR helper: mutates `nonce` in place, expects aligned `src`/`dst`,\n// and uses `isLE` to choose which 32-bit counter word is incremented.\nfunction ctr32(xk, isLE, nonce, src, dst) {\n    abytes(nonce, BLOCK_SIZE, 'nonce');\n    abytes(src);\n    dst = getOutput(src.length, dst);\n    const ctr = nonce; // write new value to nonce, so it can be re-used\n    const c32 = u32(ctr);\n    const view = createView(ctr);\n    const src32 = u32(src);\n    const dst32 = u32(dst);\n    // NIST SP 800-38D GCTR increments the rightmost 32 bits of J0, while\n    // RFC 8452 AES-GCM-SIV increments the first 32 bits as a little-endian u32.\n    const ctrPos = isLE ? 0 : 12;\n    const srcLen = src.length;\n    // Fill block (empty, ctr=0)\n    let ctrNum = view.getUint32(ctrPos, isLE); // read current counter value\n    let { s0, s1, s2, s3 } = encrypt(xk, swap8IfBE(c32[0]), swap8IfBE(c32[1]), swap8IfBE(c32[2]), swap8IfBE(c32[3]));\n    // process blocks\n    for (let i = 0; i + 4 <= src32.length; i += 4) {\n        dst32[i + 0] = src32[i + 0] ^ swap8IfBE(s0);\n        dst32[i + 1] = src32[i + 1] ^ swap8IfBE(s1);\n        dst32[i + 2] = src32[i + 2] ^ swap8IfBE(s2);\n        dst32[i + 3] = src32[i + 3] ^ swap8IfBE(s3);\n        ctrNum = (ctrNum + 1) >>> 0; // u32 wrap\n        view.setUint32(ctrPos, ctrNum, isLE);\n        ({ s0, s1, s2, s3 } = encrypt(xk, swap8IfBE(c32[0]), swap8IfBE(c32[1]), swap8IfBE(c32[2]), swap8IfBE(c32[3])));\n    }\n    // leftovers (less than a block)\n    const start = BLOCK_SIZE * Math.floor(src32.length / BLOCK_SIZE32);\n    if (start < srcLen) {\n        const b32 = new Uint32Array([s0, s1, s2, s3]);\n        swap32IfBE(b32);\n        const buf = u8(b32);\n        for (let i = start, pos = 0; i < srcLen; i++, pos++)\n            dst[i] = src[i] ^ buf[pos];\n        clean(b32);\n    }\n    // Same unsafe contract as ctrCounter(): only full blocks advance the stored\n    // mutable counter state; partial-block continuation is caller-managed.\n    return dst;\n}\n/**\n * **CTR** (Counter Mode): turns a block cipher into a stream cipher using a\n * full 16-byte counter block.\n * Efficient and parallelizable. Requires a unique nonce per encryption. Unauthenticated: needs MAC.\n * @param key - AES key bytes.\n * @param nonce - 16-byte counter block, incremented as a full AES block.\n * @returns Cipher instance with `encrypt()` and `decrypt()`.\n * @example\n * Encrypts a short payload with a fresh AES key and counter block.\n *\n * ```ts\n * import { ctr } from '@noble/ciphers/aes.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(16);\n * const nonce = randomBytes(16);\n * const cipher = ctr(key, nonce);\n * cipher.encrypt(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport const ctr = /* @__PURE__ */ wrapCipher({ blockSize: 16, nonceLength: 16 }, function aesctr(key, nonce) {\n    function processCtr(buf, dst) {\n        abytes(buf);\n        if (dst !== undefined) {\n            abytes(dst);\n            // Optional output buffers must stay 4-byte aligned because\n            // ctrCounter() reinterprets them as Uint32Array words.\n            if (!isAligned32(dst))\n                throw new Error('unaligned destination');\n        }\n        const xk = expandKeyLE(key);\n        // Public CTR keeps caller nonce bytes immutable even though ctrCounter()\n        // advances the live 16-byte counter block in place.\n        const n = copyBytes(nonce); // align + avoid changing\n        const toClean = [xk, n];\n        if (!isAligned32(buf))\n            toClean.push((buf = copyBytes(buf)));\n        const out = ctrCounter(xk, n, buf, dst);\n        clean(...toClean);\n        return out;\n    }\n    return {\n        encrypt: (plaintext, dst) => processCtr(plaintext, dst),\n        decrypt: (ciphertext, dst) => processCtr(ciphertext, dst),\n    };\n});\nfunction validateBlockDecrypt(data) {\n    abytes(data);\n    // ECB/CBC decryption always consumes whole ciphertext blocks; PKCS#7/CMS\n    // padding, when enabled, is removed only after decrypting the final block.\n    if (data.length % BLOCK_SIZE !== 0) {\n        throw new Error('aes-(cbc/ecb).decrypt ciphertext should consist of blocks with size ' + BLOCK_SIZE);\n    }\n}\n// ECB/CBC core modes operate on whole blocks; `pkcs5` enables the library's\n// PKCS#7/CMS-compatible final-block padding convenience before encryption.\nfunction validateBlockEncrypt(plaintext, pkcs5, dst) {\n    abytes(plaintext);\n    let outLen = plaintext.length;\n    const remaining = outLen % BLOCK_SIZE;\n    if (!pkcs5 && remaining !== 0)\n        throw new Error('aec/(cbc-ecb): unpadded plaintext with disabled padding');\n    if (pkcs5) {\n        let left = BLOCK_SIZE - remaining;\n        // RFC 5652 pads even already-aligned inputs, so a full extra block is\n        // appended when the plaintext length is already a multiple of 16 bytes.\n        if (!left)\n            left = BLOCK_SIZE; // if no bytes left, create empty padding block\n        outLen = outLen + left;\n    }\n    dst = getOutput(outLen, dst);\n    complexOverlapBytes(plaintext, dst);\n    // Copy on BE or misaligned inputs so u32()/swap32IfBE() normalization never\n    // mutates caller plaintext bytes in place before ECB/CBC processing.\n    if (!isLE || !isAligned32(plaintext))\n        plaintext = copyBytes(plaintext);\n    const b = u32(plaintext);\n    swap32IfBE(b);\n    const o = u32(dst);\n    return { b, o, out: dst };\n}\n// `pkcs5` is the historical option name; for AES's 16-byte block this is the\n// generic PKCS#7/CMS-style block-padding rule on decrypt.\nfunction validatePKCS(data, pkcs5) {\n    if (!pkcs5)\n        return data;\n    const len = data.length;\n    // RFC 5652 pads even empty / already-aligned inputs, so a valid padded\n    // ECB/CBC ciphertext is never empty when PKCS#7/CMS unpadding is enabled.\n    // AES-CBC/ECB ciphertext should be full blocks before unpadding\n    if (len === 0)\n        throw new Error('aes/pkcs7: empty ciphertext not allowed');\n    const lastByte = data[len - 1];\n    let valid = 1;\n    valid &= ((lastByte - 1) >>> 31) ^ 1; // pad >= 1\n    valid &= ((16 - lastByte) >>> 31) ^ 1; // pad <= 16\n    // Check exactly 16 tail bytes in constant-shape loop\n    // For i < pad: byte must equal pad\n    // For i >= pad: ignore byte\n    for (let i = 0; i < 16; i++) {\n        // const b = data[len - 1 - i];\n        const shouldCheck = (i - lastByte) >>> 31; // 1 if i < pad else 0\n        const eq = (data[len - 1 - i] ^ lastByte) === 0 ? 1 : 0; // 1 if equal\n        valid &= eq | (shouldCheck ^ 1); // pass if equal OR not checked\n    }\n    // if (invalidLen) throw new Error('aes/pkcs7: ciphertext length must be multiple of 16');\n    if (!valid)\n        throw new Error('aes/pkcs7: wrong padding');\n    return data.subarray(0, len - lastByte);\n}\n// ECB/CBC callers only pass the final short block here, so `left.length` is\n// 0..15 and the helper always emits exactly one padded 16-byte block.\nfunction padPCKS(left) {\n    const tmp = new Uint8Array(16);\n    const tmp32 = u32(tmp);\n    tmp.set(left);\n    const paddingByte = BLOCK_SIZE - left.length;\n    // RFC 5652 §6.3 fills the whole suffix with the padding length byte:\n    // e.g. `aa 0f..0f` for a 1-byte tail, or `10..10` for a full extra block.\n    for (let i = BLOCK_SIZE - paddingByte; i < BLOCK_SIZE; i++)\n        tmp[i] = paddingByte;\n    return tmp32;\n}\n/**\n * **ECB** (Electronic Codebook): Deterministic encryption; identical plaintext blocks yield\n * identical ciphertexts. Not secure due to pattern leakage.\n * See {@link https://words.filippo.io/the-ecb-penguin/ | the AES Penguin}.\n * @param key - AES key bytes.\n * @param opts - Padding options. See {@link BlockOpts}.\n * @returns Cipher instance with `encrypt()` and `decrypt()`.\n * @example\n * Shows the basic ECB encrypt call shape with a fresh key; avoid ECB in new designs.\n *\n * ```ts\n * import { ecb } from '@noble/ciphers/aes.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(16);\n * const cipher = ecb(key);\n * cipher.encrypt(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport const ecb = /* @__PURE__ */ wrapCipher({ blockSize: 16 }, function aesecb(key, opts = {}) {\n    const pkcs5 = !opts.disablePadding;\n    return {\n        encrypt(plaintext, dst) {\n            const { b, o, out: _out } = validateBlockEncrypt(plaintext, pkcs5, dst);\n            const xk = expandKeyLE(key);\n            let i = 0;\n            for (; i + 4 <= b.length;) {\n                const { s0, s1, s2, s3 } = encrypt(xk, b[i + 0], b[i + 1], b[i + 2], b[i + 3]);\n                ((o[i++] = s0), (o[i++] = s1), (o[i++] = s2), (o[i++] = s3));\n            }\n            if (pkcs5) {\n                const tmp32 = padPCKS(plaintext.subarray(i * 4));\n                swap32IfBE(tmp32);\n                const { s0, s1, s2, s3 } = encrypt(xk, tmp32[0], tmp32[1], tmp32[2], tmp32[3]);\n                ((o[i++] = s0), (o[i++] = s1), (o[i++] = s2), (o[i++] = s3));\n            }\n            swap32IfBE(o);\n            clean(xk);\n            return _out;\n        },\n        decrypt(ciphertext, dst) {\n            validateBlockDecrypt(ciphertext);\n            const xk = expandKeyDecLE(key);\n            dst = getOutput(ciphertext.length, dst);\n            const toClean = [xk];\n            complexOverlapBytes(ciphertext, dst);\n            // Copy on BE or misaligned ciphertext so u32()/swap32IfBE()\n            // normalization never mutates caller bytes in place before decrypt().\n            if (!isLE || !isAligned32(ciphertext))\n                toClean.push((ciphertext = copyBytes(ciphertext)));\n            const b = u32(ciphertext);\n            const o = u32(dst);\n            swap32IfBE(b);\n            for (let i = 0; i + 4 <= b.length;) {\n                const { s0, s1, s2, s3 } = decrypt(xk, b[i + 0], b[i + 1], b[i + 2], b[i + 3]);\n                ((o[i++] = s0), (o[i++] = s1), (o[i++] = s2), (o[i++] = s3));\n            }\n            swap32IfBE(o);\n            clean(...toClean);\n            return validatePKCS(dst, pkcs5);\n        },\n    };\n});\n/**\n * **CBC** (Cipher Block Chaining): Each plaintext block is XORed with the\n * previous block of ciphertext before encryption.\n * Hard to use: requires proper padding and an unpredictable IV. Unauthenticated: needs MAC.\n * @param key - AES key bytes.\n * @param iv - 16-byte unpredictable initialization vector.\n * @param opts - Padding options. See {@link BlockOpts}.\n * @returns Cipher instance with `encrypt()` and `decrypt()`.\n * @example\n * Encrypts a padded message with a fresh key and 16-byte IV.\n *\n * ```ts\n * import { cbc } from '@noble/ciphers/aes.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(16);\n * const iv = randomBytes(16);\n * const cipher = cbc(key, iv);\n * cipher.encrypt(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport const cbc = /* @__PURE__ */ wrapCipher({ blockSize: 16, nonceLength: 16 }, function aescbc(key, iv, opts = {}) {\n    const pkcs5 = !opts.disablePadding;\n    return {\n        encrypt(plaintext, dst) {\n            const xk = expandKeyLE(key);\n            const { b, o, out: _out } = validateBlockEncrypt(plaintext, pkcs5, dst);\n            let _iv = iv;\n            const toClean = [xk];\n            // Copy on BE or misaligned inputs so IV normalization and the mutable\n            // local chaining state never write back into caller IV bytes.\n            if (!isLE || !isAligned32(_iv))\n                toClean.push((_iv = copyBytes(_iv)));\n            const n32 = u32(_iv);\n            swap32IfBE(n32);\n            // prettier-ignore\n            let s0 = n32[0], s1 = n32[1], s2 = n32[2], s3 = n32[3];\n            let i = 0;\n            for (; i + 4 <= b.length;) {\n                ((s0 ^= b[i + 0]), (s1 ^= b[i + 1]), (s2 ^= b[i + 2]), (s3 ^= b[i + 3]));\n                ({ s0, s1, s2, s3 } = encrypt(xk, s0, s1, s2, s3));\n                ((o[i++] = s0), (o[i++] = s1), (o[i++] = s2), (o[i++] = s3));\n            }\n            if (pkcs5) {\n                const tmp32 = padPCKS(plaintext.subarray(i * 4));\n                swap32IfBE(tmp32);\n                ((s0 ^= tmp32[0]), (s1 ^= tmp32[1]), (s2 ^= tmp32[2]), (s3 ^= tmp32[3]));\n                ({ s0, s1, s2, s3 } = encrypt(xk, s0, s1, s2, s3));\n                ((o[i++] = s0), (o[i++] = s1), (o[i++] = s2), (o[i++] = s3));\n            }\n            swap32IfBE(o);\n            clean(...toClean);\n            return _out;\n        },\n        decrypt(ciphertext, dst) {\n            validateBlockDecrypt(ciphertext);\n            const xk = expandKeyDecLE(key);\n            let _iv = iv;\n            const toClean = [xk];\n            // Copy on BE or misaligned inputs so IV normalization and the mutable\n            // local chaining state never write back into caller IV bytes.\n            if (!isLE || !isAligned32(_iv))\n                toClean.push((_iv = copyBytes(_iv)));\n            const n32 = u32(_iv);\n            swap32IfBE(n32);\n            dst = getOutput(ciphertext.length, dst);\n            complexOverlapBytes(ciphertext, dst);\n            // Copy on BE or misaligned ciphertext so u32()/swap32IfBE()\n            // normalization never mutates caller bytes in place before decrypt().\n            if (!isLE || !isAligned32(ciphertext))\n                toClean.push((ciphertext = copyBytes(ciphertext)));\n            const b = u32(ciphertext);\n            const o = u32(dst);\n            swap32IfBE(b);\n            // prettier-ignore\n            let s0 = n32[0], s1 = n32[1], s2 = n32[2], s3 = n32[3];\n            for (let i = 0; i + 4 <= b.length;) {\n                // prettier-ignore\n                const ps0 = s0, ps1 = s1, ps2 = s2, ps3 = s3;\n                ((s0 = b[i + 0]), (s1 = b[i + 1]), (s2 = b[i + 2]), (s3 = b[i + 3]));\n                const { s0: o0, s1: o1, s2: o2, s3: o3 } = decrypt(xk, s0, s1, s2, s3);\n                ((o[i++] = o0 ^ ps0), (o[i++] = o1 ^ ps1), (o[i++] = o2 ^ ps2), (o[i++] = o3 ^ ps3));\n            }\n            swap32IfBE(o);\n            clean(...toClean);\n            return validatePKCS(dst, pkcs5);\n        },\n    };\n});\n/**\n * CFB (CFB-128): Cipher Feedback Mode with 128-bit segments. The input for the\n * block cipher is the previous cipher output.\n * Unauthenticated: needs MAC.\n * @param key - AES key bytes.\n * @param iv - 16-byte unpredictable initialization vector.\n * @returns Cipher instance with `encrypt()` and `decrypt()`.\n * @example\n * Encrypts a short message with feedback mode and a fresh key/IV pair.\n *\n * ```ts\n * import { cfb } from '@noble/ciphers/aes.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(16);\n * const iv = randomBytes(16);\n * const cipher = cfb(key, iv);\n * cipher.encrypt(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport const cfb = /* @__PURE__ */ wrapCipher({ blockSize: 16, nonceLength: 16 }, function aescfb(key, iv) {\n    function processCfb(src, isEncrypt, dst) {\n        abytes(src);\n        const srcLen = src.length;\n        dst = getOutput(srcLen, dst);\n        // CFB feeds back previous ciphertext, so overlapping src/dst could\n        // overwrite bytes that are still needed as the next feedback block.\n        if (overlapBytes(src, dst))\n            throw new Error('overlapping src and dst not supported.');\n        const xk = expandKeyLE(key);\n        let _iv = iv;\n        const toClean = [xk];\n        // Copy on BE or misaligned inputs so u32()/swap32IfBE() normalization\n        // never mutates caller IV/src bytes in place before CFB processing.\n        if (!isLE || !isAligned32(_iv))\n            toClean.push((_iv = copyBytes(_iv)));\n        if (!isLE || !isAligned32(src))\n            toClean.push((src = copyBytes(src)));\n        const src32 = u32(src);\n        const dst32 = u32(dst);\n        // NIST SP 800-38A §6.3 feeds back the previous ciphertext segment in\n        // both directions: encrypt reuses freshly written dst words, decrypt\n        // reuses the source ciphertext words.\n        const next32 = isEncrypt ? dst32 : src32;\n        const n32 = u32(_iv);\n        swap32IfBE(src32);\n        swap32IfBE(n32);\n        // prettier-ignore\n        let s0 = n32[0], s1 = n32[1], s2 = n32[2], s3 = n32[3];\n        for (let i = 0; i + 4 <= src32.length;) {\n            const { s0: e0, s1: e1, s2: e2, s3: e3 } = encrypt(xk, s0, s1, s2, s3);\n            dst32[i + 0] = src32[i + 0] ^ e0;\n            dst32[i + 1] = src32[i + 1] ^ e1;\n            dst32[i + 2] = src32[i + 2] ^ e2;\n            dst32[i + 3] = src32[i + 3] ^ e3;\n            ((s0 = next32[i++]), (s1 = next32[i++]), (s2 = next32[i++]), (s3 = next32[i++]));\n        }\n        // leftovers (less than block)\n        const start = BLOCK_SIZE * Math.floor(src32.length / BLOCK_SIZE32);\n        if (start < srcLen) {\n            // Byte-oriented API: for a final short tail, reuse the next CFB-128\n            // output block and XOR only the needed prefix. RFC 3826 §3.1.3 /\n            // §3.1.4 describes the same no-padding rule at bit granularity for a\n            // final r<=128 segment.\n            ({ s0, s1, s2, s3 } = encrypt(xk, s0, s1, s2, s3));\n            const tmp = new Uint32Array([s0, s1, s2, s3]);\n            swap32IfBE(tmp);\n            const buf = u8(tmp);\n            for (let i = start, pos = 0; i < srcLen; i++, pos++)\n                dst[i] = src[i] ^ buf[pos];\n            clean(buf);\n        }\n        swap32IfBE(dst32);\n        clean(...toClean);\n        return dst;\n    }\n    return {\n        encrypt: (plaintext, dst) => processCfb(plaintext, true, dst),\n        decrypt: (ciphertext, dst) => processCfb(ciphertext, false, dst),\n    };\n});\n// TODO: merge with chacha, however gcm has bitLen while chacha has byteLen\n// `data` is the payload covered by the polynomial MAC: ciphertext for GCM,\n// plaintext for GCM-SIV. Keep AAD/data/length as separate updates because\n// GHASH/POLYVAL pad each call to block boundaries, so the chunks must match the\n// spec-defined segments instead of arbitrary concatenation boundaries.\nfunction computeTag(fn, isLE, key, data, AAD) {\n    const aadLength = AAD ? AAD.length : 0;\n    const h = fn.create(key, data.length + aadLength);\n    if (AAD)\n        h.update(AAD);\n    // u64Lengths() takes (dataBits, aadBits) but still serializes the final\n    // block as len(AAD) || len(data), matching both GCM and GCM-SIV.\n    const num = u64Lengths(8 * data.length, 8 * aadLength, isLE);\n    h.update(data);\n    h.update(num);\n    const res = h.digest();\n    clean(num);\n    return res;\n}\n/**\n * **GCM** (Galois/Counter Mode): Combines CTR mode with polynomial MAC. Efficient and widely used.\n * Not perfect:\n * a) conservative key wear-out is `2**32` (4B) msgs.\n * b) key wear-out under random nonces is even smaller: `2**23` (8M) messages for `2**-50` chance.\n * c) MAC can be forged: see Poly1305 documentation.\n * @param key - AES key bytes.\n * @param nonce - Nonce bytes (12 recommended, minimum 8; other lengths use GHASH J0 derivation).\n * @param AAD - Additional authenticated data.\n * @returns AEAD cipher instance with a fixed 16-byte tag.\n * @example\n * Encrypts and authenticates plaintext with a fresh key and 12-byte nonce.\n *\n * ```ts\n * import { gcm } from '@noble/ciphers/aes.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(16);\n * const nonce = randomBytes(12);\n * const cipher = gcm(key, nonce);\n * cipher.encrypt(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport const gcm = /* @__PURE__ */ wrapCipher({ blockSize: 16, nonceLength: 12, tagLength: 16, varSizeNonce: true }, function aesgcm(key, nonce, AAD) {\n    // SP 800-38D lets implementations narrow supported IV lengths.\n    // This wrapper intentionally requires at least 8 bytes; OpenSSL accepts shorter IVs too.\n    // 12-byte nonces take the fast path; other allowed lengths use GHASH to derive J0.\n    if (nonce.length < 8)\n        throw new Error('aes/gcm: invalid nonce length');\n    const tagLength = 16;\n    function _computeTag(authKey, tagMask, data) {\n        const tag = computeTag(ghash, false, authKey, data, AAD);\n        for (let i = 0; i < tagMask.length; i++)\n            tag[i] ^= tagMask[i];\n        return tag;\n    }\n    function deriveKeys() {\n        const xk = expandKeyLE(key);\n        const authKey = EMPTY_BLOCK.slice();\n        const counter = EMPTY_BLOCK.slice();\n        ctr32(xk, false, counter, counter, authKey);\n        // NIST 800-38d, page 15: different behavior for 96-bit and non-96-bit nonces\n        if (nonce.length === 12) {\n            counter.set(nonce);\n        }\n        else {\n            const nonceLen = EMPTY_BLOCK.slice();\n            const view = createView(nonceLen);\n            view.setBigUint64(8, BigInt(nonce.length * 8), false);\n            // GHASH.update() pads each call to 16 bytes, so\n            // update(nonce).update(nonceLen) realizes\n            // IV || 0^s || 0^64 || [len(IV)]_64 for non-96-bit nonces.\n            // ghash(nonce || u64be(0) || u64be(nonceLen*8))\n            const g = ghash.create(authKey).update(nonce).update(nonceLen);\n            g.digestInto(counter); // digestInto doesn't trigger '.destroy'\n            g.destroy();\n        }\n        // GCTR_K(J0, 0^128) = E_K(J0); reusing ctr32() here extracts that tag\n        // mask and leaves `counter` advanced to inc32(J0) for payload GCTR.\n        const tagMask = ctr32(xk, false, counter, EMPTY_BLOCK);\n        return { xk, authKey, counter, tagMask };\n    }\n    return {\n        encrypt(plaintext) {\n            const { xk, authKey, counter, tagMask } = deriveKeys();\n            const out = new Uint8Array(plaintext.length + tagLength);\n            const toClean = [xk, authKey, counter, tagMask];\n            if (!isAligned32(plaintext))\n                toClean.push((plaintext = copyBytes(plaintext)));\n            ctr32(xk, false, counter, plaintext, out.subarray(0, plaintext.length));\n            const tag = _computeTag(authKey, tagMask, out.subarray(0, out.length - tagLength));\n            toClean.push(tag);\n            out.set(tag, plaintext.length);\n            clean(...toClean);\n            return out;\n        },\n        decrypt(ciphertext) {\n            const { xk, authKey, counter, tagMask } = deriveKeys();\n            const toClean = [xk, authKey, tagMask, counter];\n            if (!isAligned32(ciphertext))\n                toClean.push((ciphertext = copyBytes(ciphertext)));\n            const data = ciphertext.subarray(0, -tagLength);\n            const passedTag = ciphertext.subarray(-tagLength);\n            const tag = _computeTag(authKey, tagMask, data);\n            toClean.push(tag);\n            // NIST SP 800-38D §7.2 permits equivalent step orderings; verify the\n            // tag before CTR so unauthenticated plaintext is never materialized.\n            if (!equalBytes(tag, passedTag)) {\n                clean(...toClean);\n                throw new Error('aes/gcm: invalid ghash tag');\n            }\n            const out = ctr32(xk, false, counter, data);\n            clean(...toClean);\n            return out;\n        },\n    };\n});\nconst limit = (name, min, max) => (value) => {\n    // Current AES-SIV/GCM-SIV callers pass protocol limits from RFC 8452 / RFC 5297,\n    // not arbitrary library-preference bounds.\n    // Callers feed Uint8Array.length values here, so safe-integer rejection\n    // does not exclude any representable input even when an RFC bound is larger.\n    if (!Number.isSafeInteger(value) || min > value || value > max) {\n        const minmax = '[' + min + '..' + max + ']';\n        throw new Error('' + name + ': expected value in range ' + minmax + ', got ' + value);\n    }\n};\n/**\n * **SIV** (Synthetic IV): GCM with nonce-misuse resistance.\n * Repeating nonces reveal only the fact plaintexts are identical.\n * Also suffers from GCM issues: key wear-out limits & MAC forging.\n * See {@link https://www.rfc-editor.org/rfc/rfc8452 | RFC 8452}.\n * RFC 8452 defines 16-byte and 32-byte AES keys for this mode.\n * This implementation also accepts 24-byte AES-192 keys as a local\n * extension; see the inline comment next to `validateKeyLength(key)` below\n * for the exact scope note.\n * @param key - AES key bytes.\n * @param nonce - 12-byte nonce.\n * @param AAD - Additional authenticated data.\n * @returns AEAD cipher instance.\n * @example\n * Encrypts and authenticates plaintext with a fresh key and nonce, while tolerating reuse.\n *\n * ```ts\n * import { gcmsiv } from '@noble/ciphers/aes.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(16);\n * const nonce = randomBytes(12);\n * const cipher = gcmsiv(key, nonce);\n * cipher.encrypt(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport const gcmsiv = /* @__PURE__ */ wrapCipher({ blockSize: 16, nonceLength: 12, tagLength: 16, varSizeNonce: true }, function aessiv(key, nonce, AAD) {\n    const tagLength = 16;\n    // From RFC 8452: Section 6\n    const AAD_LIMIT = limit('AAD', 0, 2 ** 36);\n    const PLAIN_LIMIT = limit('plaintext', 0, 2 ** 36);\n    const NONCE_LIMIT = limit('nonce', 12, 12);\n    const CIPHER_LIMIT = limit('ciphertext', 16, 2 ** 36 + 16);\n    abytes(key);\n    // RFC 8452 only standardizes 16-byte and 32-byte key-generating keys.\n    // The accepted 24-byte path is a local AES-192 extension outside the RFC-defined AEADs.\n    validateKeyLength(key);\n    NONCE_LIMIT(nonce.length);\n    if (AAD !== undefined)\n        AAD_LIMIT(AAD.length);\n    function deriveKeys() {\n        const xk = expandKeyLE(key);\n        const encKey = new Uint8Array(key.length);\n        const authKey = new Uint8Array(16);\n        const toClean = [xk, encKey];\n        let _nonce = nonce;\n        // Copy on BE or misaligned nonce so u32()/swap32IfBE() normalization\n        // never mutates caller nonce bytes before RFC 8452 key derivation.\n        if (!isLE || !isAligned32(_nonce))\n            toClean.push((_nonce = copyBytes(_nonce)));\n        const n32 = u32(_nonce);\n        swap32IfBE(n32);\n        // prettier-ignore\n        let s0 = 0, s1 = n32[0], s2 = n32[1], s3 = n32[2];\n        let counter = 0;\n        for (const derivedKey of [authKey, encKey].map(u32)) {\n            const d32 = u32(derivedKey);\n            for (let i = 0; i < d32.length; i += 2) {\n                // aes(u32le(0) || nonce)[:8] || aes(u32le(1) || nonce)[:8] ...\n                const { s0: o0, s1: o1 } = encrypt(xk, s0, s1, s2, s3);\n                d32[i + 0] = o0;\n                d32[i + 1] = o1;\n                s0 = ++counter; // increment counter inside state\n            }\n            swap32IfBE(d32);\n        }\n        const res = { authKey, encKey: expandKeyLE(encKey) };\n        // Cleanup\n        clean(...toClean);\n        return res;\n    }\n    function _computeTag(encKey, authKey, data) {\n        const tag = computeTag(polyval, true, authKey, data, AAD);\n        // Compute the expected tag by XORing S_s and the nonce, clearing the\n        // most significant bit of the last byte and encrypting with the\n        // message-encryption key.\n        for (let i = 0; i < 12; i++)\n            tag[i] ^= nonce[i];\n        tag[15] &= 0x7f; // Clear the highest bit\n        // encrypt tag as block\n        const t32 = u32(tag);\n        swap32IfBE(t32);\n        // prettier-ignore\n        let s0 = t32[0], s1 = t32[1], s2 = t32[2], s3 = t32[3];\n        ({ s0, s1, s2, s3 } = encrypt(encKey, s0, s1, s2, s3));\n        ((t32[0] = s0), (t32[1] = s1), (t32[2] = s2), (t32[3] = s3));\n        swap32IfBE(t32);\n        return tag;\n    }\n    // actual decrypt/encrypt of message.\n    function processSiv(encKey, tag, input) {\n        let block = copyBytes(tag);\n        // RFC 8452 §4 / §5 use the tag with the highest bit of the last byte\n        // forced to one as the initial AES-CTR counter block.\n        block[15] |= 0x80; // Force highest bit\n        const res = ctr32(encKey, true, block, input);\n        // Cleanup\n        clean(block);\n        return res;\n    }\n    return {\n        encrypt(plaintext) {\n            PLAIN_LIMIT(plaintext.length);\n            const { encKey, authKey } = deriveKeys();\n            const tag = _computeTag(encKey, authKey, plaintext);\n            const toClean = [encKey, authKey, tag];\n            if (!isAligned32(plaintext))\n                toClean.push((plaintext = copyBytes(plaintext)));\n            const out = new Uint8Array(plaintext.length + tagLength);\n            out.set(tag, plaintext.length);\n            out.set(processSiv(encKey, tag, plaintext));\n            // Cleanup\n            clean(...toClean);\n            return out;\n        },\n        decrypt(ciphertext) {\n            CIPHER_LIMIT(ciphertext.length);\n            const tag = ciphertext.subarray(-tagLength);\n            const { encKey, authKey } = deriveKeys();\n            const toClean = [encKey, authKey];\n            if (!isAligned32(ciphertext))\n                toClean.push((ciphertext = copyBytes(ciphertext)));\n            const plaintext = processSiv(encKey, tag, ciphertext.subarray(0, -tagLength));\n            const expectedTag = _computeTag(encKey, authKey, plaintext);\n            toClean.push(expectedTag);\n            // RFC 8452 §5: plaintext is unauthenticated here and MUST NOT be\n            // returned until the expected-tag check completes successfully.\n            if (!equalBytes(tag, expectedTag)) {\n                clean(...toClean);\n                throw new Error('invalid polyval tag');\n            }\n            // Cleanup\n            clean(...toClean);\n            return plaintext;\n        },\n    };\n});\nfunction isBytes32(a) {\n    // Plain `instanceof Uint32Array` is too strict for cross-realm expanded-key views.\n    // This is only a best-effort unsafe-export guard, not a provenance proof for `expandKeyLE`.\n    return (a instanceof Uint32Array || (ArrayBuffer.isView(a) && a.constructor.name === 'Uint32Array'));\n}\n// Unsafe single-block helpers: mutate `block` in place and require its 16-byte\n// Uint8Array view to be 4-byte aligned because `u32(block)` reinterprets it.\nfunction encryptBlock(xk, block) {\n    abytes(block, 16, 'block');\n    if (!isBytes32(xk))\n        throw new Error('_encryptBlock accepts result of expandKeyLE');\n    const b32 = u32(block);\n    swap32IfBE(b32);\n    let { s0, s1, s2, s3 } = encrypt(xk, b32[0], b32[1], b32[2], b32[3]);\n    ((b32[0] = s0), (b32[1] = s1), (b32[2] = s2), (b32[3] = s3));\n    swap32IfBE(b32);\n    return block;\n}\nfunction decryptBlock(xk, block) {\n    abytes(block, 16, 'block');\n    if (!isBytes32(xk))\n        throw new Error('_decryptBlock accepts result of expandKeyLE');\n    const b32 = u32(block);\n    swap32IfBE(b32);\n    let { s0, s1, s2, s3 } = decrypt(xk, b32[0], b32[1], b32[2], b32[3]);\n    ((b32[0] = s0), (b32[1] = s1), (b32[2] = s2), (b32[3] = s3));\n    swap32IfBE(b32);\n    return block;\n}\n/**\n * AES-W (base for AESKW/AESKWP).\n * Specs:\n * {@link https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf | SP800-38F},\n * {@link https://www.rfc-editor.org/rfc/rfc3394 | RFC 3394},\n * {@link https://www.rfc-editor.org/rfc/rfc5649 | RFC 5649}.\n * Shared core mutates `out` in place; callers are responsible for prepending\n * the right IV/AIV and checking the recovered value after decrypt.\n */\nconst AESW = {\n    /*\n    High-level pseudocode:\n    ```\n    A: u64 = IV\n    out = []\n    for (let i=0, ctr = 0; i<6; i++) {\n      for (const chunk of chunks(plaintext, 8)) {\n        A ^= swapEndianess(ctr++)\n        [A, res] = chunks(encrypt(A || chunk), 8);\n        out ||= res\n      }\n    }\n    out = A || out\n    ```\n    Decrypt is the same, but reversed.\n    */\n    encrypt(kek, out) {\n        // Current implementation keeps RFC 3394/5649 `t` in a u32-shaped counter,\n        // so the shared core caps plaintext below 4 GiB even though the specs allow more.\n        if (out.length >= 2 ** 32)\n            throw new Error('plaintext should be less than 4gb');\n        const xk = expandKeyLE(kek);\n        // 16-byte `S = A || P[1]` is the RFC 5649 KWP special case for n=1;\n        // KW callers never reach it because KW requires at least two plaintext semiblocks.\n        if (out.length === 16)\n            encryptBlock(xk, out);\n        else {\n            const o32 = u32(out);\n            swap32IfBE(o32);\n            // prettier-ignore\n            let a0 = o32[0], a1 = o32[1]; // A\n            for (let j = 0, ctr = 1; j < 6; j++) {\n                for (let pos = 2; pos < o32.length; pos += 2, ctr++) {\n                    const { s0, s1, s2, s3 } = encrypt(xk, a0, a1, o32[pos], o32[pos + 1]);\n                    // A = MSB(64, B) ^ t where t = (n*j)+i. Under the 32-bit length cap\n                    // above, `t` fits in the low half of `[t]_64`, so xor only the low\n                    // 32 bits of A after converting `ctr` to network order.\n                    ((a0 = s0), (a1 = s1 ^ byteSwap(ctr)), (o32[pos] = s2), (o32[pos + 1] = s3));\n                }\n            }\n            ((o32[0] = a0), (o32[1] = a1)); // out = A || out\n            swap32IfBE(o32);\n        }\n        xk.fill(0);\n    },\n    decrypt(kek, out) {\n        // Same implementation cap on the recovered plaintext length after\n        // removing the 8-byte A/IV prefix.\n        if (out.length - 8 >= 2 ** 32)\n            throw new Error('ciphertext should be less than 4gb');\n        const xk = expandKeyDecLE(kek);\n        const chunks = out.length / 8 - 1; // first chunk is IV\n        // `n = 2` semiblocks is the RFC 5649 KWP special case; KW ciphertexts\n        // always have at least three semiblocks and therefore use the W^-1 loop.\n        if (chunks === 1)\n            decryptBlock(xk, out);\n        else {\n            const o32 = u32(out);\n            swap32IfBE(o32);\n            // prettier-ignore\n            let a0 = o32[0], a1 = o32[1]; // A\n            for (let j = 0, ctr = chunks * 6; j < 6; j++) {\n                for (let pos = chunks * 2; pos >= 1; pos -= 2, ctr--) {\n                    a1 ^= byteSwap(ctr);\n                    const { s0, s1, s2, s3 } = decrypt(xk, a0, a1, o32[pos], o32[pos + 1]);\n                    ((a0 = s0), (a1 = s1), (o32[pos] = s2), (o32[pos + 1] = s3));\n                }\n            }\n            ((o32[0] = a0), (o32[1] = a1));\n            swap32IfBE(o32);\n        }\n        xk.fill(0);\n    },\n};\n// RFC 3394 §2.2.3.1 / NIST SP 800-38F Algorithm 3 / Algorithm 4: KW prepends\n// the default 64-bit ICV1 and unwrap must verify the same value.\nconst AESKW_IV = /* @__PURE__ */ new Uint8Array(8).fill(0xa6); // A6A6A6A6A6A6A6A6\n/**\n * AES-KW (key-wrap). Injects static IV into plaintext, adds counter, encrypts 6 times.\n * Reduces block size from 16 to 8 bytes.\n * Plaintext must be a non-empty multiple of 8 bytes with minimum 16 bytes.\n * 8-byte inputs use aeskwp.\n * Wrapped ciphertext must be a multiple of 8 bytes with minimum 24 bytes.\n * For padded version, use aeskwp.\n * See {@link https://www.rfc-editor.org/rfc/rfc3394/ | RFC 3394} and\n * {@link https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf | NIST SP 800-38F}.\n * @param kek - AES key-encryption key.\n * @returns Key-wrap cipher instance.\n * As with other `wrapCipher(...)` wrappers, `encrypt()` is single-use per\n * instance.\n * @example\n * Wraps a 128-bit content-encryption key with a fresh key-encryption key.\n *\n * ```ts\n * import { aeskw } from '@noble/ciphers/aes.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const kek = randomBytes(16);\n * const cek = randomBytes(16);\n * const wrap = aeskw(kek);\n * wrap.encrypt(cek);\n * ```\n */\nexport const aeskw = /* @__PURE__ */ wrapCipher({ blockSize: 8 }, (kek) => ({\n    encrypt(plaintext) {\n        if (!plaintext.length || plaintext.length % 8 !== 0)\n            throw new Error('invalid plaintext length');\n        // RFC 3394 / NIST SP 800-38F define KW only for >=2 plaintext\n        // semiblocks; the 1-semiblock case belongs to RFC 5649 KWP.\n        if (plaintext.length === 8)\n            throw new Error('8-byte keys not allowed in AESKW, use AESKWP instead');\n        const out = concatBytes(AESKW_IV, plaintext);\n        AESW.encrypt(kek, out);\n        return out;\n    },\n    decrypt(ciphertext) {\n        // ciphertext must be at least 24 bytes and a multiple of 8 bytes\n        // 24 because should have at least two block (1 iv + 2).\n        // Replace with 16 to enable '8-byte keys'\n        if (ciphertext.length % 8 !== 0 || ciphertext.length < 3 * 8)\n            throw new Error('invalid ciphertext length');\n        // AESW.decrypt() mutates its buffer in place, so keep caller ciphertext\n        // immutable across the unwrap, ICV1 check, and IV scrubbing below.\n        const out = copyBytes(ciphertext);\n        AESW.decrypt(kek, out);\n        if (!equalBytes(out.subarray(0, 8), AESKW_IV))\n            throw new Error('integrity check failed');\n        out.subarray(0, 8).fill(0); // ciphertext.subarray(0, 8) === IV, but we clean it anyway\n        return out.subarray(8);\n    },\n}));\n/*\nWe don't support 8-byte keys. The rabbit hole:\n\n- Wycheproof says: \"NIST SP 800-38F does not define the wrapping of 8 byte keys.\n  RFC 3394 Section 2  on the other hand specifies that 8 byte keys are wrapped\n  by directly encrypting one block with AES.\"\n    - {@link https://github.com/C2SP/wycheproof/blob/master/doc/key_wrap.md | Wycheproof key-wrap note}\n    - \"RFC 3394 specifies in Section 2, that the input for the key wrap\n      algorithm must be at least two blocks and otherwise the constant\n      field and key are simply encrypted with ECB as a single block\"\n- What RFC 3394 actually says (in Section 2):\n    - \"Before being wrapped, the key data is parsed into n blocks of 64 bits.\n      The only restriction the key wrap algorithm places on n is that n be\n      at least two\"\n    - \"For key data with length less than or equal to 64 bits, the constant\n      field used in this specification and the key data form a single\n      128-bit codebook input making this key wrap unnecessary.\"\n- Which means \"assert(n >= 2)\" and \"use something else for 8 byte keys\"\n- NIST SP800-38F actually prohibits 8-byte in \"5.3.1 Mandatory Limits\".\n  It states that plaintext for KW should be \"2 to 2^54 -1 semiblocks\".\n- So, where does \"directly encrypt single block with AES\" come from?\n    - Not RFC 3394. Pseudocode of key wrap in 2.2 explicitly uses\n      loop of 6 for any code path\n    - There is a weird W3C spec:\n      {@link https://www.w3.org/TR/2002/REC-xmlenc-core-20021210/Overview.html#kw-aes128 | XML Encryption AES key-wrap section}\n    - This spec is outdated, as admitted by Wycheproof authors\n    - There is RFC 5649 for padded key wrap, which is padding construction on\n      top of AESKW. In '4.1.2' it says: \"If the padded plaintext contains exactly\n      eight octets, then prepend the AIV as defined in Section 3 above to P[1] and\n      encrypt the resulting 128-bit block using AES in ECB mode [Modes] with key\n      K (the KEK).  In this case, the output is two 64-bit blocks C[0] and C[1]:\"\n    - Browser subtle crypto is actually crashes on wrapping keys less than 16 bytes:\n      `Error: error:1C8000E6:Provider routines::invalid input length]\n       { opensslErrorStack: [ 'error:030000BD:digital envelope routines::update error' ]`\n\nIn the end, seems like a bug in Wycheproof.\nThe 8-byte check can be easily disabled inside of AES_W.\n*/\n// RFC 5649 §3 / NIST SP 800-38F Algorithm 5 / Algorithm 6: KWP uses ICV2 as\n// the high 32 bits of the AIV; the low 32 bits carry the MLI in network order.\nconst AESKWP_IV = 0xa65959a6; // single u32le value\n/**\n * AES-KW, but with padding and allows random keys.\n * Uses the RFC 5649 alternative initial value; the second u32 stores the\n * 32-bit MLI in network order.\n * Wrapped ciphertext must be at least 16 bytes; malformed lengths are\n * rejected during AIV/padding checks.\n * See {@link https://www.rfc-editor.org/rfc/rfc5649 | RFC 5649}.\n * @param kek - AES key-encryption key.\n * @returns Padded key-wrap cipher instance.\n * @example\n * Wraps a short key blob using the padded variant and a fresh key-encryption key.\n *\n * ```ts\n * import { aeskwp } from '@noble/ciphers/aes.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const kek = randomBytes(16);\n * const wrap = aeskwp(kek);\n * wrap.encrypt(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport const aeskwp = /* @__PURE__ */ wrapCipher({ blockSize: 8 }, (kek) => ({\n    encrypt(plaintext) {\n        if (!plaintext.length)\n            throw new Error('invalid plaintext length');\n        const padded = Math.ceil(plaintext.length / 8) * 8;\n        const out = new Uint8Array(8 + padded);\n        out.set(plaintext, 8);\n        const out32 = u32(out);\n        out32[0] = swap8IfBE(AESKWP_IV);\n        // RFC 5649 §3: the low 32 bits of the AIV carry the octet-length MLI in\n        // network order, even though this buffer is addressed through LE u32s.\n        out32[1] = swap8IfBE(byteSwap(plaintext.length));\n        AESW.encrypt(kek, out);\n        return out;\n    },\n    decrypt(ciphertext) {\n        // 16 because should have at least one block\n        if (ciphertext.length < 16)\n            throw new Error('invalid ciphertext length');\n        // AESW.decrypt() mutates its buffer in place, so keep caller ciphertext\n        // immutable across the unwrap, AIV checks, and IV scrubbing below.\n        const out = copyBytes(ciphertext);\n        const o32 = u32(out);\n        AESW.decrypt(kek, out);\n        const len = byteSwap(swap8IfBE(o32[1])) >>> 0;\n        const padded = Math.ceil(len / 8) * 8;\n        if (swap8IfBE(o32[0]) !== AESKWP_IV || out.length - 8 !== padded)\n            throw new Error('integrity check failed');\n        // RFC 5649 §3 / NIST SP 800-38F Algorithm 6: recovered padding length\n        // must be in [0,7], and every recovered pad octet must be zero.\n        for (let i = len; i < padded; i++)\n            if (out[8 + i] !== 0)\n                throw new Error('integrity check failed');\n        out.subarray(0, 8).fill(0); // ciphertext.subarray(0, 8) === IV, but we clean it anyway\n        return out.subarray(8, 8 + len);\n    },\n}));\nclass _AesCtrDRBG {\n    blockLen;\n    key;\n    nonce;\n    state;\n    reseedCnt;\n    constructor(keyLen, seed, personalization) {\n        this.blockLen = ctr.blockSize;\n        const keyLenBytes = keyLen / 8;\n        const nonceLen = 16;\n        // Store the full seedlen state as key || V so CTR_DRBG_Update-style steps\n        // can rewrite the entire internal state in place.\n        this.state = new Uint8Array(keyLenBytes + nonceLen);\n        this.key = this.state.subarray(0, keyLenBytes);\n        this.nonce = this.state.subarray(keyLenBytes, keyLenBytes + nonceLen);\n        this.reseedCnt = 1;\n        // Keep the stored counter one step ahead of SP 800-90A's formal V so\n        // ctr(key, nonce) uses the next counter block directly.\n        incBytes(this.nonce, false, 1);\n        this.addEntropy(seed, personalization);\n    }\n    update(data) {\n        // cannot re-use state here, because we will wipe current key\n        ctr(this.key, this.nonce).encrypt(new Uint8Array(this.state.length), this.state);\n        if (data) {\n            abytes(data);\n            // CTR_DRBG without a derivation function pads shorter additional_input\n            // with zeros to seedlen, so XOR only the provided prefix here.\n            for (let i = 0; i < data.length; i++)\n                this.state[i] ^= data[i];\n        }\n        // Keep storing V+1 so the next ctr(key, nonce) call starts from the\n        // spec's post-update counter state.\n        incBytes(this.nonce, false, 1);\n    }\n    // Optional `info` is additional input XORed into the reseed block and is\n    // limited to the internal state width.\n    addEntropy(seed, info) {\n        abytes(seed, this.state.length, 'seed');\n        // Copy caller entropy before XORing in personalization/additional input,\n        // then wipe the mixed seed material after CTR_DRBG_Update consumes it.\n        const _seed = seed.slice();\n        if (info) {\n            abytes(info);\n            if (info.length > _seed.length)\n                throw new Error('info length is too big');\n            for (let i = 0; i < info.length; i++)\n                _seed[i] ^= info[i];\n        }\n        this.update(_seed);\n        _seed.fill(0);\n        this.reseedCnt = 1;\n    }\n    // Optional `info` is additional input for the pre/post-update steps; bytes\n    // SP 800-90A Rev. 1 CTR_DRBG without a derivation function limits\n    // additional_input to seedlen, which is exactly this internal state width.\n    randomBytes(len, info) {\n        anumber(len);\n        // SP 800-90A Table 3 caps AES CTR_DRBG requests at 2^16 bits = 65536 bytes.\n        if (len > 2 ** 16)\n            throw new Error('requested output is too big');\n        // The spec allows generate while reseed_counter == reseed_interval and increments afterwards.\n        if (this.reseedCnt > 2 ** 48)\n            throw new Error('entropy exhausted');\n        if (info) {\n            abytes(info);\n            if (info.length > this.state.length)\n                throw new Error('info length is too big');\n            this.update(info);\n        }\n        const res = new Uint8Array(len);\n        ctr(this.key, this.nonce).encrypt(res, res);\n        incBytes(this.nonce, false, Math.ceil(len / this.blockLen));\n        this.update(info);\n        this.reseedCnt++;\n        return res;\n    }\n    // Zeroes the current state and resets the counter, but does not make the\n    // instance unusable: later calls continue from the zeroed state.\n    clean() {\n        // `key` and `nonce` alias this backing buffer, so one fill wipes the full\n        // secret state in place.\n        this.state.fill(0);\n        this.reseedCnt = 0;\n    }\n}\n// Internal helper for the exported 128-bit and 256-bit aliases; other key\n// lengths are not validated here.\nconst createAesDrbg = (keyLen) => {\n    return (seed, personalization = undefined) => new _AesCtrDRBG(keyLen, seed, personalization);\n};\n/**\n * AES-CTR DRBG 128-bit - CSPRNG (cryptographically secure pseudorandom number generator).\n * It's best to limit usage to non-production, non-critical cases: for example, test-only.\n * @param seed - Initial 32-byte entropy input.\n * @param personalization - Optional personalization string.\n * @returns Seeded DRBG instance. The concrete methods also accept optional additional-input bytes.\n * @example\n * Seeds the test-only AES-CTR DRBG from fresh entropy and reads bytes from it.\n *\n * ```ts\n * import { rngAesCtrDrbg128 } from '@noble/ciphers/aes.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const seed = randomBytes(32);\n * const prg = rngAesCtrDrbg128(seed);\n * prg.randomBytes(8);\n * ```\n */\nexport const rngAesCtrDrbg128 = /* @__PURE__ */ createAesDrbg(128);\n/**\n * AES-CTR DRBG 256-bit - CSPRNG (cryptographically secure pseudorandom number generator).\n * It's best to limit usage to non-production, non-critical cases: for example, test-only.\n * @param seed - Initial 48-byte entropy input.\n * @param personalization - Optional personalization string.\n * @returns Seeded DRBG instance. The concrete methods also accept optional additional-input bytes.\n * @example\n * Seeds the test-only AES-CTR DRBG from fresh entropy and reads bytes from it.\n *\n * ```ts\n * import { rngAesCtrDrbg256 } from '@noble/ciphers/aes.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const seed = randomBytes(48);\n * const prg = rngAesCtrDrbg256(seed);\n * prg.randomBytes(8);\n * ```\n */\nexport const rngAesCtrDrbg256 = /* @__PURE__ */ createAesDrbg(256);\n//#region CMAC\n/**\n * Left-shift by one bit and conditionally XOR with 0x87:\n * ```\n * if MSB(L) is equal to 0\n * then    K1 := L << 1;\n * else    K1 := (L << 1) XOR const_Rb;\n * ```\n *\n * Specs:\n * {@link https://www.rfc-editor.org/rfc/rfc4493.html#section-2.3 | RFC 4493 Section 2.3},\n * {@link https://datatracker.ietf.org/doc/html/rfc5297.html#section-2.3 | RFC 5297 Section 2.3}\n *\n * @returns modified `block` (for chaining)\n */\nfunction dbl(block) {\n    let carry = 0;\n    // Left shift by 1 bit\n    for (let i = BLOCK_SIZE - 1; i >= 0; i--) {\n        const newCarry = (block[i] & 0x80) >>> 7;\n        block[i] = (block[i] << 1) | carry;\n        carry = newCarry;\n    }\n    // XOR with 0x87 if there was a carry from the most significant bit\n    if (carry) {\n        // RFC 4493 §2.3 / RFC 5297 §2.1: 0x87 is const_Rb for doubling in the\n        // CMAC/S2V finite field with primitive polynomial x^128 + x^7 + x^2 + x + 1.\n        block[BLOCK_SIZE - 1] ^= 0x87;\n    }\n    return block;\n}\n/**\n * `a XOR b`, running in-place on `a`.\n * @param a left operand and output\n * @param b right operand\n * @returns `a` (for chaining)\n */\nfunction xorBlock(a, b) {\n    if (a.length !== b.length)\n        throw new Error('xorBlock: blocks must have same length');\n    for (let i = 0; i < a.length; i++) {\n        a[i] = a[i] ^ b[i];\n    }\n    return a;\n}\n/**\n * xorend as defined in\n * {@link https://datatracker.ietf.org/doc/html/rfc5297.html#section-2.1 | RFC 5297 Section 2.1}.\n *\n * ```\n * leftmost(A, len(A)-len(B)) || (rightmost(A, len(B)) xor B)\n * ```\n *\n * Mutates `a` in place so the left prefix stays untouched and only the\n * rightmost `len(B)` bytes are xored with `b`.\n */\nfunction xorend(a, b) {\n    if (b.length > a.length) {\n        throw new Error('xorend: len(B) must be less than or equal to len(A)');\n    }\n    // keep leftmost part of `a` unchanged\n    // and xor only the rightmost part:\n    const offset = a.length - b.length;\n    for (let i = 0; i < b.length; i++) {\n        a[offset + i] = a[offset + i] ^ b[i];\n    }\n    return a;\n}\n/**\n * Internal CMAC class.\n */\nclass _CMAC {\n    blockLen = BLOCK_SIZE;\n    outputLen = BLOCK_SIZE;\n    // CMAC can only decide between `K1` and `K2` once the true final block is known,\n    // so updates process older blocks eagerly but keep one pending block buffered.\n    buffer;\n    pos;\n    finished;\n    destroyed;\n    k1;\n    k2;\n    x;\n    xk;\n    constructor(key) {\n        abytes(key);\n        validateKeyLength(key);\n        this.xk = expandKeyLE(key);\n        this.buffer = new Uint8Array(BLOCK_SIZE);\n        this.pos = 0;\n        this.finished = false;\n        this.destroyed = false;\n        this.x = new Uint8Array(BLOCK_SIZE);\n        // L = AES_encrypt(K, const_Zero)\n        const L = new Uint8Array(BLOCK_SIZE);\n        encryptBlock(this.xk, L);\n        // Generate subkeys K1 and K2 from the main key according to\n        // {@link https://www.rfc-editor.org/rfc/rfc4493.html#section-2.3 | RFC 4493 Section 2.3}\n        // K1\n        this.k1 = dbl(L);\n        this.k2 = dbl(new Uint8Array(this.k1));\n    }\n    process(data) {\n        // RFC 4493 §2.4 step 6 loop body: Y := X XOR M_i; X := AES-128(K, Y).\n        xorBlock(this.x, data);\n        encryptBlock(this.xk, this.x);\n    }\n    update(data) {\n        if (this.destroyed)\n            throw new Error('Hash instance has been destroyed');\n        if (this.finished)\n            throw new Error('Hash#digest() has already been called');\n        abytes(data);\n        let pos = 0;\n        if (this.pos) {\n            const take = Math.min(BLOCK_SIZE - this.pos, data.length);\n            this.buffer.set(data.subarray(0, take), this.pos);\n            this.pos += take;\n            pos = take;\n            if (this.pos === BLOCK_SIZE && pos < data.length) {\n                this.process(this.buffer);\n                this.pos = 0;\n            }\n        }\n        // Keep one complete block buffered: an exact 16-byte tail may still be\n        // M_n, and digestInto() must decide there whether RFC 4493 uses K1 or K2.\n        while (pos + BLOCK_SIZE < data.length) {\n            this.process(data.subarray(pos, pos + BLOCK_SIZE));\n            pos += BLOCK_SIZE;\n        }\n        if (pos < data.length) {\n            this.buffer.set(data.subarray(pos), 0);\n            this.pos = data.length - pos;\n        }\n        return this;\n    }\n    // See {@link https://www.rfc-editor.org/rfc/rfc4493.html#section-2.4 | RFC 4493 Section 2.4}.\n    digestInto(out) {\n        if (this.destroyed)\n            throw new Error('Hash instance has been destroyed');\n        if (this.finished)\n            throw new Error('Hash#digest() has already been called');\n        // `digestInto(out)` is the no-allocation fast path, so AES block re-use below\n        // requires a 32-bit-aligned caller buffer instead of hidden temp copies.\n        aoutput(out, this, true);\n        this.finished = true;\n        // `digestInto()` accepts out.length >= outputLen, so only the first block stores the tag.\n        const view = out.subarray(0, this.outputLen);\n        let last = new Uint8Array(BLOCK_SIZE);\n        if (this.pos === BLOCK_SIZE) {\n            // M_last := M_n XOR K1;\n            last.set(this.buffer);\n            xorBlock(last, this.k1);\n        }\n        else {\n            // M_last := padding(M_n) XOR K2;\n            //\n            // [...] padding(x) is the concatenation of x and a single '1',\n            // followed by the minimum number of '0's, so that the total length is\n            // equal to 128 bits.\n            last.set(this.buffer.subarray(0, this.pos));\n            last[this.pos] = 0x80; // single '1' bit\n            xorBlock(last, this.k2);\n        }\n        view.set(this.x); // X := AES_CBC(K, M_1..M_{n-1})\n        xorBlock(view, last); // Y := X XOR M_last\n        encryptBlock(this.xk, view); // T := AES-128(K, Y)\n        clean(last);\n    }\n    digest() {\n        const { buffer, outputLen } = this;\n        this.digestInto(buffer);\n        // Copy out before destroy() wipes the internal digest buffer in place.\n        const res = buffer.slice(0, outputLen);\n        this.destroy();\n        return res;\n    }\n    destroy() {\n        const { buffer, destroyed, x, xk, k1, k2 } = this;\n        if (destroyed)\n            return;\n        this.destroyed = true;\n        // Wipe the buffered tail, chaining value, expanded AES key, and both CMAC subkeys.\n        clean(buffer, x, xk, k1, k2);\n    }\n}\n/**\n * AES-CMAC (Cipher-based Message Authentication Code).\n * Specs: {@link https://www.rfc-editor.org/rfc/rfc4493.html | RFC 4493}.\n * @param msg - Message bytes to authenticate.\n * @param key - AES key bytes.\n * @returns 16-byte authentication tag. `cmac.create(...)` follows the same incremental MAC shape as\n * the other keyed helpers in this repo, including `blockLen`,\n * `outputLen`, `digestInto()` and `destroy()`.\n * @example\n * Authenticates a message with AES-CMAC and a fresh key.\n *\n * ```ts\n * import { cmac } from '@noble/ciphers/aes.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(16);\n * cmac(new Uint8Array(), key);\n * ```\n */\n// The 16-byte probe key is only used to read static metadata; runtime CMAC\n// still accepts AES-128/192/256 keys.\nexport const cmac = /* @__PURE__ */ wrapMacConstructor(16, (key) => new _CMAC(key));\n/**\n * S2V (Synthetic Initialization Vector) function as described in\n * {@link https://datatracker.ietf.org/doc/html/rfc5297.html#section-2.4 | RFC 5297 Section 2.4}.\n *\n * ```\n * S2V(K, S1, ..., Sn) {\n *   if n = 0 then\n *     return V = AES-CMAC(K, <one>)\n *   fi\n *   D = AES-CMAC(K, <zero>)\n *   for i = 1 to n-1 do\n *     D = dbl(D) xor AES-CMAC(K, Si)\n *   done\n *   if len(Sn) >= 128 then\n *     T = Sn xorend D\n *   else\n *     T = dbl(D) xor pad(Sn)\n *   fi\n *   return V = AES-CMAC(K, T)\n * }\n * ```\n *\n * S2V takes a key and a vector of strings S1, S2, ..., Sn and returns a 128-bit string.\n * The S2V function is used to generate a synthetic IV for AES-SIV.\n *\n * @param key - AES key (128, 192, or 256 bits)\n * @param strings - Array of byte arrays to process\n * @returns 128-bit synthetic IV\n */\nfunction s2v(key, strings) {\n    validateKeyLength(key);\n    const len = strings.length;\n    if (len > 127) {\n        // RFC 5297 §7 only proves S2V secure for at most 127 components; SIV\n        // spends one of those on the plaintext, leaving at most 126 AAD inputs.\n        throw new Error('s2v: number of input strings must be less than or equal to 127');\n    }\n    if (len === 0)\n        return cmac(ONE_BLOCK, key);\n    // D = AES-CMAC(K, <zero>)\n    let d = cmac(EMPTY_BLOCK, key);\n    // for i = 1 to n-1 do\n    //   D = dbl(D) xor AES-CMAC(K, Si)\n    for (let i = 0; i < len - 1; i++) {\n        dbl(d);\n        const cmacResult = cmac(strings[i], key);\n        xorBlock(d, cmacResult);\n        clean(cmacResult);\n    }\n    const s_n = strings[len - 1];\n    // Earlier components are validated through cmac(...); validate the final one explicitly because\n    // the Uint8Array.from()/set() paths below would otherwise coerce array-like inputs silently.\n    abytes(s_n);\n    let t;\n    // if len(Sn) >= 128 then\n    if (s_n.byteLength >= BLOCK_SIZE) {\n        // T = Sn xorend D\n        t = xorend(Uint8Array.from(s_n), d);\n    }\n    else {\n        // pad(Sn):\n        const paddedSn = new Uint8Array(BLOCK_SIZE);\n        paddedSn.set(s_n);\n        paddedSn[s_n.length] = 0x80; // padding: 0x80 followed by zeros\n        // T = dbl(D) xor pad(Sn)\n        t = xorBlock(dbl(d), paddedSn);\n        clean(paddedSn);\n    }\n    // V = AES-CMAC(K, T)\n    const result = cmac(t, key);\n    clean(d, t);\n    return result;\n}\n/**\n * Use `gcmsiv` or `aessiv`.\n * @returns Never; always throws with the migration hint.\n * @throws If called; `siv()` is a removed v1 alias. {@link Error}\n * @example\n * `siv()` was removed in v2; use `gcmsiv()` for nonce-based SIV instead.\n *\n * ```ts\n * import { gcmsiv } from '@noble/ciphers/aes.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(16);\n * const nonce = randomBytes(12);\n * const cipher = gcmsiv(key, nonce);\n * cipher.encrypt(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport const siv = () => {\n    throw new Error('\"siv\" from v1 is now \"gcmsiv\"');\n};\n/**\n * **SIV**: Synthetic Initialization Vector (SIV) Authenticated Encryption\n * Nonce is derived from the plaintext and AAD using the S2V function.\n * Supports at most 126 AAD components. RFC 5297 nonce-based use is expressed by\n * passing the nonce as the final AAD component before the plaintext.\n * See {@link https://datatracker.ietf.org/doc/html/rfc5297.html | RFC 5297}.\n * @param key - 32-byte, 48-byte, or 64-byte key.\n * @param AAD - Additional authenticated data chunks (up to 126).\n * @returns AEAD cipher instance.\n * @example\n * Authenticates and encrypts plaintext with a fresh key without requiring unique nonces.\n *\n * ```ts\n * import { aessiv } from '@noble/ciphers/aes.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(32);\n * const cipher = aessiv(key);\n * cipher.encrypt(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport const aessiv = /* @__PURE__ */ wrapCipher({ blockSize: 16, tagLength: 16 }, function aessiv(key, ...AAD) {\n    // From RFC 5297: Section 6.1, 6.2, 6.3:\n    const PLAIN_LIMIT = limit('plaintext', 0, 2 ** 132);\n    const CIPHER_LIMIT = limit('ciphertext', 16, 2 ** 132 + 16);\n    if (AAD.length > 126) {\n        // RFC 5297 §2.6 / §2.7 / §7: SIV passes the plaintext as the last S2V\n        // component, so callers only get 126 associated-data components.\n        throw new Error('\"AAD\" number of elements must be less than or equal to 126');\n    }\n    AAD.forEach((aad) => abytes(aad));\n    abytes(key);\n    if (![32, 48, 64].includes(key.length))\n        throw new Error('\"aes key\" expected Uint8Array of length 32/48/64, got length=' + key.length);\n    // The key is split into equal halves, K1 = leftmost(K, len(K)/2) and\n    // K2 = rightmost(K, len(K)/2).  K1 is used for S2V and K2 is used for CTR.\n    // This borrows caller key/AAD buffers by reference; mutating them after\n    // construction changes future encrypt/decrypt results.\n    const k1 = key.subarray(0, key.length / 2);\n    const k2 = key.subarray(key.length / 2);\n    return {\n        // {@link https://datatracker.ietf.org/doc/html/rfc5297.html#section-2.6 | RFC 5297 Section 2.6}\n        encrypt(plaintext) {\n            PLAIN_LIMIT(plaintext.length);\n            const v = s2v(k1, [...AAD, plaintext]);\n            // clear out the 31st and 63rd (rightmost) bit:\n            const q = Uint8Array.from(v);\n            q[8] &= 0x7f;\n            q[12] &= 0x7f;\n            // encrypt:\n            const c = ctr(k2, q).encrypt(plaintext);\n            return concatBytes(v, c);\n        },\n        // {@link https://datatracker.ietf.org/doc/html/rfc5297.html#section-2.7 | RFC 5297 Section 2.7}\n        decrypt(ciphertext) {\n            CIPHER_LIMIT(ciphertext.length);\n            const v = ciphertext.subarray(0, BLOCK_SIZE);\n            const c = ciphertext.subarray(BLOCK_SIZE);\n            // clear out the 31st and 63rd (rightmost) bit:\n            const q = Uint8Array.from(v);\n            q[8] &= 0x7f;\n            q[12] &= 0x7f;\n            // decrypt:\n            const p = ctr(k2, q).decrypt(c);\n            // verify tag:\n            const t = s2v(k1, [...AAD, p]);\n            if (equalBytes(t, v)) {\n                return p;\n            }\n            else {\n                throw new Error('invalid siv tag');\n            }\n        },\n    };\n});\n//#endregion\n/**\n * Unsafe low-level internal methods. May change at any time.\n * Callers are expected to use reviewed expanded-key outputs, pass mutable and\n * aligned 16-byte blocks where required, and treat several helpers as in-place\n * mutations of their input buffers or counters.\n */\nexport const unsafe = /* @__PURE__ */ Object.freeze({\n    expandKeyLE,\n    expandKeyDecLE,\n    encrypt,\n    decrypt,\n    encryptBlock,\n    decryptBlock,\n    ctrCounter,\n    ctr32,\n    dbl,\n    xorBlock,\n    xorend,\n    s2v,\n});\nexport const __TESTS = /* @__PURE__ */ Object.freeze({\n    incBytes: incBytes,\n});\n//# sourceMappingURL=aes.js.map","import {\n  assertBytes,\n  concatBytes,\n  equalBytes,\n  type AeadComponent,\n  type AeadCreateContext,\n  type AeadCreateOpenerParams,\n  type AeadCreateParams,\n  type AeadCreateSealerParams,\n  type AeadTransform,\n  type BlockCipher,\n  type Transform,\n} from '@jscrypto/core';\n\nconst BLOCK_SIZE = 16;\nconst KEY_SIZES = [16, 24, 32] as const;\nconst NONCE_SIZES = [7, 8, 9, 10, 11, 12, 13] as const;\nconst TAG_SIZES = [4, 6, 8, 10, 12, 14, 16] as const;\nconst DEFAULT_TAG_LENGTH = 16;\nconst MIN_NONCE_LENGTH = 7;\nconst MAX_NONCE_LENGTH = 13;\nconst AAD_SHORT_LIMIT = 0xff00;\n\nexport function createAesCcmComponent(): AeadComponent<'AES-CCM'> {\n  return {\n    kind: 'aead',\n    name: 'AES-CCM',\n    keySizes: KEY_SIZES,\n    nonceSizes: NONCE_SIZES,\n    recommendedNonceSize: 12,\n    tagSizes: TAG_SIZES,\n    create(params, context) {\n      return createAesCcmTransform(params, context);\n    },\n  };\n}\n\n/** Exported for focused unit tests; not part of the public package surface. */\nexport function encodeCcmAad(aad: Uint8Array): Uint8Array {\n  return concatBytes(encodeCcmAadLength(aad.length), aad);\n}\n\n/**\n * Encode only the CCM AAD length prefix for a given length.\n * Accepts synthetic lengths so the `0xffff` form (>= 2^32) can be unit-tested\n * without allocating multi-gigabyte AAD buffers.\n */\nexport function encodeCcmAadLength(aadLength: number): Uint8Array {\n  if (aadLength === 0) {\n    return new Uint8Array(0);\n  }\n\n  if (aadLength < AAD_SHORT_LIMIT) {\n    const encoded = new Uint8Array(2);\n    encoded[0] = (aadLength >>> 8) & 0xff;\n    encoded[1] = aadLength & 0xff;\n    return encoded;\n  }\n\n  if (aadLength < 0x100000000) {\n    const encoded = new Uint8Array(6);\n    encoded[0] = 0xff;\n    encoded[1] = 0xfe;\n    encoded[2] = (aadLength >>> 24) & 0xff;\n    encoded[3] = (aadLength >>> 16) & 0xff;\n    encoded[4] = (aadLength >>> 8) & 0xff;\n    encoded[5] = aadLength & 0xff;\n    return encoded;\n  }\n\n  const encoded = new Uint8Array(10);\n  encoded[0] = 0xff;\n  encoded[1] = 0xff;\n  let remaining = aadLength;\n  for (let i = 9; i >= 2; i--) {\n    encoded[i] = remaining % 256;\n    remaining = Math.floor(remaining / 256);\n  }\n  return encoded;\n}\n\n/**\n * Encode an unsigned integer into `byteLength` bytes at `out[offset]`.\n * Used for CCM length and counter fields.\n */\nexport function encodeCcmBinaryLength(\n  value: number,\n  byteLength: number,\n  out: Uint8Array,\n  offset: number,\n): void {\n  let remaining = value;\n  for (let i = byteLength - 1; i >= 0; i--) {\n    out[offset + i] = remaining % 256;\n    remaining = Math.floor(remaining / 256);\n  }\n  if (remaining !== 0) {\n    throw new RangeError('AES-CCM plaintext is too large for the nonce length.');\n  }\n}\n\nfunction createAesCcmTransform(\n  { key }: AeadCreateParams,\n  context: AeadCreateContext,\n): AeadTransform {\n  assertBytes(key, 'AES-CCM key');\n  if (key.length !== 16 && key.length !== 24 && key.length !== 32) {\n    throw new Error('AES key must be 128, 192, or 256 bits.');\n  }\n  const cipher = context.createBlockCipher({ cipher: 'AES', key });\n\n  return {\n    createSealer({ nonce, aad, tagLength }: AeadCreateSealerParams): Transform {\n      const resolvedNonce = requireNonce(nonce);\n      const resolvedAad = resolveAad(aad);\n      const resolvedTagLength = resolveTagLength(tagLength);\n      let pendings: Uint8Array[] = [];\n      let finalized = false;\n\n      return {\n        process(input) {\n          assertNotFinalized(finalized);\n          assertBytes(input, 'AES-CCM input');\n          pendings.push(input);\n          return new Uint8Array(0);\n        },\n\n        finalize(input = new Uint8Array(0)) {\n          assertNotFinalized(finalized);\n          if (input.length !== 0) {\n            this.process(input);\n          }\n          finalized = true;\n          const plaintext = collectPending(pendings);\n          pendings = [];\n          return seal(cipher, plaintext, resolvedNonce, resolvedAad, resolvedTagLength);\n        },\n      };\n    },\n\n    createOpener({ nonce, aad, tag, tagLength }: AeadCreateOpenerParams): Transform {\n      const resolvedNonce = requireNonce(nonce);\n      const resolvedAad = resolveAad(aad);\n      const detachedTag = resolveOptionalTag(tag);\n      const resolvedTagLength = detachedTag\n        ? resolveTagLength(detachedTag.length)\n        : resolveTagLength(tagLength);\n      let pendings: Uint8Array[] = [];\n      let finalized = false;\n\n      return {\n        process(input) {\n          assertNotFinalized(finalized);\n          assertBytes(input, 'AES-CCM input');\n          pendings.push(input);\n          return new Uint8Array(0);\n        },\n\n        finalize(input = new Uint8Array(0)) {\n          assertNotFinalized(finalized);\n          if (input.length !== 0) {\n            this.process(input);\n          }\n          finalized = true;\n          const buffered = collectPending(pendings);\n          pendings = [];\n          return open(\n            cipher,\n            buffered,\n            resolvedNonce,\n            resolvedAad,\n            resolvedTagLength,\n            detachedTag,\n          );\n        },\n      };\n    },\n  };\n}\n\nfunction seal(\n  cipher: BlockCipher,\n  plaintext: Uint8Array,\n  nonce: Uint8Array,\n  aad: Uint8Array,\n  tagLength: number,\n): Uint8Array {\n  const L = 15 - nonce.length;\n  assertPlaintextLength(plaintext.length, L);\n\n  const tag = computeTag(cipher, plaintext, nonce, aad, tagLength, L);\n  const ciphertext = ctrCrypt(cipher, plaintext, nonce, L);\n  const sealed = new Uint8Array(ciphertext.length + tagLength);\n  sealed.set(ciphertext, 0);\n  sealed.set(tag, ciphertext.length);\n  return sealed;\n}\n\nfunction open(\n  cipher: BlockCipher,\n  input: Uint8Array,\n  nonce: Uint8Array,\n  aad: Uint8Array,\n  tagLength: number,\n  detachedTag: Uint8Array | undefined,\n): Uint8Array {\n  const L = 15 - nonce.length;\n  let ciphertext: Uint8Array;\n  let tag: Uint8Array;\n\n  if (detachedTag) {\n    ciphertext = input;\n    tag = detachedTag;\n  } else {\n    if (input.length < tagLength) {\n      throw new Error('AES-CCM ciphertext is shorter than the authentication tag.');\n    }\n    ciphertext = input.subarray(0, input.length - tagLength);\n    tag = input.subarray(input.length - tagLength);\n  }\n\n  assertPlaintextLength(ciphertext.length, L);\n  const plaintext = ctrCrypt(cipher, ciphertext, nonce, L);\n  const expectedTag = computeTag(cipher, plaintext, nonce, aad, tagLength, L);\n  if (!equalBytes(tag, expectedTag)) {\n    plaintext.fill(0);\n    throw new Error('AES-CCM authentication failed.');\n  }\n  return plaintext;\n}\n\nfunction computeTag(\n  cipher: BlockCipher,\n  plaintext: Uint8Array,\n  nonce: Uint8Array,\n  aad: Uint8Array,\n  tagLength: number,\n  L: number,\n): Uint8Array {\n  const mac = new Uint8Array(BLOCK_SIZE);\n  const block = new Uint8Array(BLOCK_SIZE);\n\n  buildB0(block, nonce, plaintext.length, aad.length > 0, tagLength, L);\n  encryptBlock(cipher, block, 0, mac, 0);\n\n  if (aad.length > 0) {\n    const encodedAad = encodeCcmAad(aad);\n    cbcMacBlocks(cipher, mac, encodedAad);\n  }\n\n  if (plaintext.length > 0) {\n    cbcMacBlocks(cipher, mac, plaintext);\n  }\n\n  const s0 = new Uint8Array(BLOCK_SIZE);\n  buildCounterBlock(block, nonce, 0, L);\n  encryptBlock(cipher, block, 0, s0, 0);\n\n  const tag = new Uint8Array(tagLength);\n  for (let i = 0; i < tagLength; i++) {\n    tag[i] = mac[i]! ^ s0[i]!;\n  }\n  return tag;\n}\n\nfunction ctrCrypt(\n  cipher: BlockCipher,\n  input: Uint8Array,\n  nonce: Uint8Array,\n  L: number,\n): Uint8Array {\n  if (input.length === 0) {\n    return new Uint8Array(0);\n  }\n\n  const output = new Uint8Array(input.length);\n  const counterBlock = new Uint8Array(BLOCK_SIZE);\n  const keystream = new Uint8Array(BLOCK_SIZE);\n  let counter = 1;\n  let offset = 0;\n\n  while (offset < input.length) {\n    buildCounterBlock(counterBlock, nonce, counter, L);\n    encryptBlock(cipher, counterBlock, 0, keystream, 0);\n    const n = Math.min(BLOCK_SIZE, input.length - offset);\n    for (let i = 0; i < n; i++) {\n      output[offset + i] = input[offset + i]! ^ keystream[i]!;\n    }\n    offset += n;\n    counter += 1;\n  }\n\n  return output;\n}\n\nfunction cbcMacBlocks(cipher: BlockCipher, mac: Uint8Array, data: Uint8Array): void {\n  const block = new Uint8Array(BLOCK_SIZE);\n  let offset = 0;\n\n  while (offset < data.length) {\n    const n = Math.min(BLOCK_SIZE, data.length - offset);\n    block.fill(0);\n    block.set(data.subarray(offset, offset + n));\n    for (let i = 0; i < BLOCK_SIZE; i++) {\n      block[i]! ^= mac[i]!;\n    }\n    encryptBlock(cipher, block, 0, mac, 0);\n    offset += n;\n  }\n}\n\nfunction buildB0(\n  out: Uint8Array,\n  nonce: Uint8Array,\n  messageLength: number,\n  hasAad: boolean,\n  tagLength: number,\n  L: number,\n): void {\n  out[0] = ((hasAad ? 1 : 0) << 6) | (((tagLength - 2) / 2) << 3) | (L - 1);\n  out.set(nonce, 1);\n  encodeCcmBinaryLength(messageLength, L, out, 1 + nonce.length);\n}\n\nfunction buildCounterBlock(\n  out: Uint8Array,\n  nonce: Uint8Array,\n  counter: number,\n  L: number,\n): void {\n  out.fill(0);\n  out[0] = L - 1;\n  out.set(nonce, 1);\n  encodeCcmBinaryLength(counter, L, out, 1 + nonce.length);\n}\n\nfunction encryptBlock(\n  cipher: BlockCipher,\n  input: Uint8Array,\n  inputOffset: number,\n  output: Uint8Array,\n  outputOffset: number,\n): void {\n  if (cipher.encryptBlock) {\n    cipher.encryptBlock(input, inputOffset, output, outputOffset);\n    return;\n  }\n\n  cipher.encrypt(\n    input.subarray(inputOffset, inputOffset + cipher.blockSize),\n    output.subarray(outputOffset, outputOffset + cipher.blockSize),\n  );\n}\n\nfunction assertPlaintextLength(length: number, L: number): void {\n  let remaining = length;\n  for (let i = 0; i < L; i++) {\n    remaining = Math.floor(remaining / 256);\n  }\n  if (remaining !== 0) {\n    throw new RangeError('AES-CCM plaintext is too large for the nonce length.');\n  }\n}\n\nfunction requireNonce(nonce: Uint8Array | undefined): Uint8Array {\n  if (nonce === undefined) {\n    throw new Error('AES-CCM requires a nonce.');\n  }\n  assertBytes(nonce, 'AES-CCM nonce');\n  if (nonce.length < MIN_NONCE_LENGTH || nonce.length > MAX_NONCE_LENGTH) {\n    throw new RangeError('AES-CCM nonce length must be between 7 and 13 bytes.');\n  }\n  return nonce;\n}\n\nfunction resolveAad(aad: Uint8Array | undefined): Uint8Array {\n  if (aad === undefined) {\n    return new Uint8Array(0);\n  }\n  assertBytes(aad, 'AES-CCM aad');\n  return aad;\n}\n\nfunction resolveOptionalTag(tag: Uint8Array | undefined): Uint8Array | undefined {\n  if (tag === undefined) {\n    return undefined;\n  }\n  assertBytes(tag, 'AES-CCM tag');\n  resolveTagLength(tag.length);\n  return tag;\n}\n\nfunction resolveTagLength(tagLength: number | undefined): number {\n  if (tagLength === undefined) {\n    return DEFAULT_TAG_LENGTH;\n  }\n  if (\n    typeof tagLength !== 'number'\n    || !Number.isInteger(tagLength)\n    || (TAG_SIZES as readonly number[]).indexOf(tagLength) === -1\n  ) {\n    throw new RangeError(\n      'AES-CCM tagLength must be one of 4, 6, 8, 10, 12, 14, or 16 bytes.',\n    );\n  }\n  return tagLength;\n}\n\nfunction collectPending(pendings: readonly Uint8Array[]): Uint8Array {\n  if (pendings.length === 0) {\n    return new Uint8Array(0);\n  }\n  if (pendings.length === 1) {\n    return pendings[0]!;\n  }\n  return concatBytes(...pendings);\n}\n\nfunction assertNotFinalized(finalized: boolean): void {\n  if (finalized) {\n    throw new Error('AES-CCM transform already finalized.');\n  }\n}\n","import {\n  assertBytes,\n  type AeadComponent,\n  type AeadCreateContext,\n  type AeadCreateOpenerParams,\n  type AeadCreateParams,\n  type AeadCreateSealerParams,\n  type AeadTransform,\n  type Transform,\n} from '@jscrypto/core';\n\nconst KEY_SIZES = [16, 24, 32] as const;\nconst TAG_SIZES = [4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16] as const;\nconst DEFAULT_TAG_LENGTH = 16;\nconst MIN_TAG_LENGTH = 4;\nconst MAX_TAG_LENGTH = 16;\n\nexport function createAesGcmComponent(): AeadComponent<'AES-GCM'> {\n  return {\n    kind: 'aead',\n    name: 'AES-GCM',\n    keySizes: KEY_SIZES,\n    recommendedNonceSize: 12,\n    tagSizes: TAG_SIZES,\n    create(params, context) {\n      return createAesGcmTransform(params, context);\n    },\n  };\n}\n\nfunction createAesGcmTransform(\n  { key }: AeadCreateParams,\n  context: AeadCreateContext,\n): AeadTransform {\n  assertBytes(key, 'AES-GCM key');\n\n  return {\n    createSealer({ nonce, aad, tagLength, options }: AeadCreateSealerParams): Transform {\n      return context.createEncryptor(toGcmOptions(key, {\n        nonce: requireNonce(nonce),\n        aad: resolveAad(aad),\n        tagLength: resolveTagLength(tagLength),\n        options,\n      }));\n    },\n\n    createOpener({ nonce, aad, tag, tagLength, options }: AeadCreateOpenerParams): Transform {\n      const detachedTag = resolveOptionalTag(tag);\n      return wrapGcmOpener(context.createDecryptor(toGcmOptions(key, {\n        nonce: requireNonce(nonce),\n        aad: resolveAad(aad),\n        tag: detachedTag,\n        tagLength: detachedTag ? resolveTagLength(detachedTag.length) : resolveTagLength(tagLength),\n        options,\n      })));\n    },\n  };\n}\n\nfunction toGcmOptions(\n  key: Uint8Array,\n  {\n    nonce,\n    aad,\n    tag,\n    tagLength,\n    options,\n  }: {\n    nonce: Uint8Array;\n    aad: Uint8Array;\n    tag?: Uint8Array;\n    tagLength: number;\n    options?: unknown;\n  },\n) {\n  return {\n    ...toRecord(options),\n    cipher: 'AES',\n    mode: 'GCM',\n    key,\n    nonce,\n    aad,\n    tag,\n    tagLength,\n  };\n}\n\nfunction wrapGcmOpener(opener: Transform): Transform {\n  return {\n    process(input) {\n      return opener.process(input);\n    },\n\n    finalize(input) {\n      try {\n        return opener.finalize(input);\n      } catch (error) {\n        if (error instanceof Error && error.message === 'GCM authentication failed.') {\n          throw new Error('AES-GCM authentication failed.');\n        }\n        throw error;\n      }\n    },\n  };\n}\n\nfunction requireNonce(nonce: Uint8Array | undefined): Uint8Array {\n  if (nonce === undefined) {\n    throw new Error('AES-GCM requires a nonce.');\n  }\n  assertBytes(nonce, 'AES-GCM nonce');\n  if (nonce.length === 0) {\n    throw new Error('AES-GCM requires a nonce.');\n  }\n  return nonce;\n}\n\nfunction resolveAad(aad: Uint8Array | undefined): Uint8Array {\n  if (aad === undefined) {\n    return new Uint8Array(0);\n  }\n  assertBytes(aad, 'AES-GCM aad');\n  return aad;\n}\n\nfunction resolveOptionalTag(tag: Uint8Array | undefined): Uint8Array | undefined {\n  if (tag === undefined) {\n    return undefined;\n  }\n  assertBytes(tag, 'AES-GCM tag');\n  return tag;\n}\n\nfunction resolveTagLength(tagLength: number | undefined): number {\n  if (tagLength === undefined) {\n    return DEFAULT_TAG_LENGTH;\n  }\n  if (\n    typeof tagLength !== 'number' ||\n    !Number.isInteger(tagLength) ||\n    tagLength < MIN_TAG_LENGTH ||\n    tagLength > MAX_TAG_LENGTH\n  ) {\n    throw new RangeError('AES-GCM tagLength must be an integer between 4 and 16 bytes.');\n  }\n  return tagLength;\n}\n\nfunction toRecord(options: unknown): Record<string, unknown> {\n  return typeof options === 'object' && options !== null ? options as Record<string, unknown> : {};\n}\n","import type { BlockCipher, CipherComponent, PresetComponent } from '@jscrypto/core';\nimport { unsafe as nobleAesUnsafe } from '@noble/ciphers/aes.js';\nimport { createAesCcmComponent } from './aes-ccm.js';\nimport { createAesGcmComponent } from './aes-gcm.js';\n\nconst BLOCK_SIZE = 16;\n\nexport const aes: CipherComponent<'AES'> = {\n  kind: 'cipher',\n  name: 'AES',\n  type: 'block',\n  blockSize: BLOCK_SIZE,\n  keySizes: [16, 24, 32],\n  create(key) {\n    return createAesCipher(key);\n  },\n};\n\nexport const aesGcm = createAesGcmComponent();\nexport const aesCcm = createAesCcmComponent();\n\nexport { createAesCcmComponent } from './aes-ccm.js';\n\nexport const aesPreset: PresetComponent<'aes'> = {\n  kind: 'preset',\n  name: 'aes',\n  components() {\n    return [aes, aesGcm, aesCcm];\n  },\n};\n\nexport function createAesCipher(key: Uint8Array): BlockCipher {\n  if (key.length !== 16 && key.length !== 24 && key.length !== 32) {\n    throw new Error('AES key must be 128, 192, or 256 bits.');\n  }\n\n  const encryptionKey = nobleAesUnsafe.expandKeyLE(key);\n  const decryptionKey = nobleAesUnsafe.expandKeyDecLE(key);\n\n  return {\n    blockSize: BLOCK_SIZE,\n\n    encryptBlock(input, inputOffset, output, outputOffset) {\n      transformBlock(encryptionKey, input, inputOffset, output, outputOffset, nobleAesUnsafe.encrypt);\n    },\n\n    decryptBlock(input, inputOffset, output, outputOffset) {\n      transformBlock(decryptionKey, input, inputOffset, output, outputOffset, nobleAesUnsafe.decrypt);\n    },\n\n    encrypt(input, output) {\n      assertBlocks(input, output);\n      return transformBlocks(encryptionKey, input, output, nobleAesUnsafe.encrypt);\n    },\n\n    decrypt(input, output) {\n      assertBlocks(input, output);\n      return transformBlocks(decryptionKey, input, output, nobleAesUnsafe.decrypt);\n    },\n  };\n}\n\ntype NobleAesTransform = typeof nobleAesUnsafe.encrypt;\n\nfunction transformBlocks(\n  expandedKey: Uint32Array,\n  input: Uint8Array,\n  output: Uint8Array,\n  transform: NobleAesTransform,\n): Uint8Array {\n  for (let offset = 0; offset < input.length; offset += BLOCK_SIZE) {\n    transformBlock(expandedKey, input, offset, output, offset, transform);\n  }\n\n  return output;\n}\n\nfunction transformBlock(\n  expandedKey: Uint32Array,\n  input: Uint8Array,\n  inputOffset: number,\n  output: Uint8Array,\n  outputOffset: number,\n  transform: NobleAesTransform,\n): void {\n  const { s0, s1, s2, s3 } = transform(\n    expandedKey,\n    readUint32LE(input, inputOffset),\n    readUint32LE(input, inputOffset + 4),\n    readUint32LE(input, inputOffset + 8),\n    readUint32LE(input, inputOffset + 12),\n  );\n  writeUint32LE(output, outputOffset, s0);\n  writeUint32LE(output, outputOffset + 4, s1);\n  writeUint32LE(output, outputOffset + 8, s2);\n  writeUint32LE(output, outputOffset + 12, s3);\n}\n\nfunction readUint32LE(input: Uint8Array, offset: number): number {\n  return (\n    input[offset]\n    | (input[offset + 1] << 8)\n    | (input[offset + 2] << 16)\n    | (input[offset + 3] << 24)\n  ) >>> 0;\n}\n\nfunction writeUint32LE(output: Uint8Array, offset: number, value: number): void {\n  output[offset] = value;\n  output[offset + 1] = value >>> 8;\n  output[offset + 2] = value >>> 16;\n  output[offset + 3] = value >>> 24;\n}\n\nfunction assertBlocks(input: Uint8Array, output: Uint8Array): void {\n  if (input.length % BLOCK_SIZE !== 0) {\n    throw new Error('AES input length must be a multiple of 128 bits.');\n  }\n  if (output.length !== input.length) {\n    throw new Error('AES output length must equal input length.');\n  }\n}\n"],"names":["BLOCK_SIZE","encryptBlock","KEY_SIZES","TAG_SIZES","DEFAULT_TAG_LENGTH","concatBytes","assertBytes","requireNonce","resolveAad","resolveTagLength","resolveOptionalTag","equalBytes","nobleAesUnsafe"],"mappings":";;;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,OAAO,CAAC,CAAC,EAAE;AAC3B;AACA;AACA;AACA;AACA,IAAI,QAAQ,CAAC,YAAY,UAAU;AACnC,SAAS,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,YAAY,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK,YAAY;AAC/C,YAAY,mBAAmB,IAAI,CAAC;AACpC,YAAY,CAAC,CAAC,iBAAiB,KAAK,CAAC,CAAC;AACtC;AAkCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE;AAClD,IAAI,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;AAChC,IAAI,MAAM,GAAG,GAAG,KAAK,EAAE,MAAM;AAC7B,IAAI,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS;AACzC,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM,CAAC,EAAE;AAChD,QAAQ,MAAM,MAAM,GAAG,KAAK,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;AAC7C,QAAQ,MAAM,KAAK,GAAG,QAAQ,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,GAAG,EAAE;AAC5D,QAAQ,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC;AACpE,QAAQ,MAAM,OAAO,GAAG,MAAM,GAAG,qBAAqB,GAAG,KAAK,GAAG,QAAQ,GAAG,GAAG;AAC/E,QAAQ,IAAI,CAAC,KAAK;AAClB,YAAY,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC;AACxC,QAAQ,MAAM,IAAI,UAAU,CAAC,OAAO,CAAC;AACrC,IAAI;AACJ,IAAI,OAAO,KAAK;AAChB;AAoBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,GAAG,KAAK,EAAE;AAC5D,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC;AACpC,IAAI,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS;AAClC,IAAI,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE;AAC1B,QAAQ,MAAM,IAAI,UAAU,CAAC,wDAAwD,GAAG,GAAG,CAAC;AAC5F,IAAI;AACJ,IAAI,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;AACxC,QAAQ,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC;AAC1D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,EAAE,CAAC,GAAG,EAAE;AACxB,IAAI,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;AACrE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,GAAG,CAAC,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;AACtF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,KAAK,CAAC,GAAG,MAAM,EAAE;AACjC,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;AAC5C,QAAQ,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACzB,IAAI;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,UAAU,CAAC,GAAG,EAAE;AAChC,IAAI,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;AACnE;AACA;AACA;AACA;AACA;AACO,MAAM,IAAI,mBAAmB,CAAC,MAAM,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG;AAC9G;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAM,QAAQ,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,UAAU;AAC5D,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,QAAQ,CAAC;AAC5B,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC;AAC3B,KAAK,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC;AAC1B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAM,SAAS,GAAG;AACzB,MAAM,CAAC,CAAC,KAAK;AACb,MAAM,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK;AACnC,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;AACvC,QAAQ,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjC,IAAI,OAAO,GAAG;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAM,UAAU,GAAG;AAC1B,MAAM,CAAC,CAAC,KAAK;AACb,MAAM,UAAU;AAmLhB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE;AACnC;AACA,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,UAAU;AACtC,QAAQ,OAAO,KAAK;AACpB,IAAI,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;AACjC,QAAQ,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU;AAClD,QAAQ,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU;AAClD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE;AACnD;AACA;AACA,IAAI,IAAI,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU;AAC3E,QAAQ,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC;AAC/E;AAoEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE;AAC7D,IAAI,MAAM,GAAG,GAAG,OAAO;AACvB,IAAI,MAAM,OAAO,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;AAC3C,IAAI,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;AACvD,SAAS,MAAM,CAAC,GAAG;AACnB,SAAS,MAAM,EAAE;AACjB,IAAI,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS;AAClC,IAAI,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ;AAChC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,KAAK,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACrD,IAAI,OAAO,IAAI;AACf;AAyDA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,WAAW,GAAG,IAAI,EAAE;AACnE,IAAI,IAAI,GAAG,KAAK,SAAS;AACzB,QAAQ,OAAO,IAAI,UAAU,CAAC,cAAc,CAAC;AAC7C;AACA,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC;AACpC,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,cAAc,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;AAC5G,IAAI,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;AACxC,QAAQ,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC;AAC1D,IAAI,OAAO,GAAG;AACd;AA6BA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,WAAW,CAAC,KAAK,EAAE;AACnC,IAAI,OAAO,KAAK,CAAC,UAAU,GAAG,CAAC,KAAK,CAAC;AACrC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,SAAS,CAAC,KAAK,EAAE;AACjC;AACA;AACA,IAAI,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC;;ACrsBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAIA,MAAMA,YAAU,GAAG,EAAE;AACrB;AACA,MAAM,YAAY,GAAG,CAAC;AACtB;AACA;AACA,MAAM,WAAW,mBAAmB,IAAI,UAAU,CAACA,YAAU,CAAC;AAC9D;AACA,MAAM,SAAS,mBAAmB,UAAU,CAAC,IAAI,CAAC;AAClD,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;AAClG,CAAC,CAAC;AACF,MAAM,IAAI,GAAG,KAAK,CAAC;AACnB;AACA,SAAS,iBAAiB,CAAC,GAAG,EAAE;AAChC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;AAC1C,QAAQ,MAAM,IAAI,KAAK,CAAC,+DAA+D,GAAG,GAAG,CAAC,MAAM,CAAC;AACrG;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,IAAI,CAAC,CAAC,EAAE;AACjB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AACxC;AACA;AACA;AACA;AACA,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE;AACnB,IAAI,IAAI,GAAG,GAAG,CAAC;AACf,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE;AAC3B;AACA,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5B,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,IAAI;AACJ,IAAI,OAAO,GAAG;AACd;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,KAAK;AAC5C;AACA;AACA,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,UAAU;AAC1D,QAAQ,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,KAAK,CAAC;AACzD,IAAI,MAAM,CAAC,IAAI,CAAC;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;AAC1C,QAAQ,MAAM,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;AACnD,QAAQ,KAAK,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;AAChD,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,IAAI;AAChC,QAAQ,KAAK,MAAM,CAAC;AACpB,IAAI;AACJ,CAAC;AACD;AACA;AACA,MAAM,IAAI,mBAAmB,CAAC,MAAM;AACpC,IAAI,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC;AACjC;AACA;AACA;AACA,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;AACrD,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAChB,IAAI,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC;AACnC;AACA;AACA,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI;AACjB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE;AAClC,QAAQ,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;AAC1B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;AACnB,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI;AACjF,IAAI;AACJ,IAAI,KAAK,CAAC,CAAC,CAAC;AACZ,IAAI,OAAO,GAAG;AACd,CAAC,GAAG;AACJ;AACA;AACA;AACA,MAAM,OAAO,mBAAmB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACnE;AACA;AACA,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;AAC7C;AACA;AACA,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;AAC7C;AACA;AACA;AACA;AACA,SAAS,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE;AAC7B,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;AAC3B,QAAQ,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC;AAC5C,IAAI,MAAM,EAAE,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC/B,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC/B,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC/B;AACA;AACA,IAAI,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,GAAG,GAAG,GAAG,CAAC;AAC1C,IAAI,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,GAAG,GAAG,GAAG,CAAC;AAC1C,IAAI,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,GAAG,GAAG,GAAG,CAAC;AAC5C,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE;AAClC,QAAQ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE;AACtC,YAAY,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC;AACnC,YAAY,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACpC,YAAY,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACpC,YAAY,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;AACjD,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;AACpD;AACA;AACA;AACA;AACA,MAAM,aAAa,mBAAmB,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAClH;AACA;AACA;AACA,MAAM,aAAa,mBAAmB,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxI;AACA,MAAM,OAAO,mBAAmB,CAAC,MAAM;AACvC,IAAI,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC;AAChC,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AACnD,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAChB,IAAI,OAAO,CAAC;AACZ,CAAC,GAAG;AACJ;AACA,SAAS,WAAW,CAAC,GAAG,EAAE;AAC1B,IAAI,MAAM,CAAC,GAAG,CAAC;AACf,IAAI,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM;AAC1B,IAAI,iBAAiB,CAAC,GAAG,CAAC;AAC1B,IAAI,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa;AACnC,IAAI,MAAM,OAAO,GAAG,EAAE;AACtB;AACA;AACA,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;AAClC,QAAQ,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE;AAC5C,IAAI,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpC,IAAI,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM;AACzB;AACA;AACA,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACvD;AACA;AACA,IAAI,MAAM,EAAE,GAAG,IAAI,WAAW,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;AACzC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;AACf;AACA,IAAI,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;AACzC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;AACzB,QAAQ,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC;AACxB,YAAY,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC1D,aAAa,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC;AACvC,YAAY,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;AAC1B,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC;AAC9B,IAAI;AACJ,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC;AACrB,IAAI,OAAO,EAAE;AACb;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,IAAI,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC;AACnC,IAAI,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE;AAC7B,IAAI,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM;AAC5B,IAAI,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa;AACnC,IAAI,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,aAAa;AAC5C;AACA;AACA;AACA,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE;AACpC,QAAQ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;AAClC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC9C,IAAI;AACJ,IAAI,KAAK,CAAC,MAAM,CAAC;AACjB;AACA;AACA;AACA,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;AACrC,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACvB,QAAQ,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC9C,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AAC1F,IAAI;AACJ,IAAI,OAAO,EAAE;AACb;AACA;AACA,SAAS,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;AAC7C;AACA;AACA;AACA;AACA,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;AAC3D,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,CAAC;AACzD;AACA,SAAS,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;AAC1C;AACA;AACA;AACA;AACA,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC;AAC9C,SAAS,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AACpE;AACA,SAAS,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;AACrC,IAAI,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,aAAa;AAC7C,IAAI,IAAI,CAAC,GAAG,CAAC;AACb,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AACvE;AACA;AACA,IAAI,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC;AACpC,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE;AACrC,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AAChE,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AAChE,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AAChE,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AAChE,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD,IAAI;AACJ;AACA,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACzD,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACzD,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACzD,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACzD,IAAI,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;AAC7C;AACA;AACA,SAAS,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;AACrC,IAAI,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,aAAa;AAC7C,IAAI,IAAI,CAAC,GAAG,CAAC;AACb,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AACvE;AACA;AACA;AACA,IAAI,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC;AACpC,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE;AACrC,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AAChE,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AAChE,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AAChE,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AAChE,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD,IAAI;AACJ;AACA;AACA,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACzD,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACzD,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACzD,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACzD,IAAI,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;AAC7C;AACA,SAAS,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE;AACzC,IAAI,MAAM,CAAC,KAAK,EAAEA,YAAU,EAAE,OAAO,CAAC;AACtC,IAAI,MAAM,CAAC,GAAG,CAAC;AACf,IAAI,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM;AAC7B,IAAI,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC;AAChC,IAAI,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC;AACjC;AACA;AACA,IAAI,MAAM,GAAG,GAAG,KAAK;AACrB,IAAI,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;AACxB,IAAI,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC;AAC1B,IAAI,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC;AAC1B;AACA,IAAI,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpH;AACA,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE;AACnD,QAAQ,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;AACnD,QAAQ,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;AACnD,QAAQ,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;AACnD,QAAQ,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;AACnD,QAAQ,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAChC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACrH,IAAI;AACJ;AACA;AACA;AACA,IAAI,MAAM,KAAK,GAAGA,YAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC;AACtE,IAAI,IAAI,KAAK,GAAG,MAAM,EAAE;AACxB,QAAQ,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AACrD,QAAQ,UAAU,CAAC,GAAG,CAAC;AACvB,QAAQ,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC;AAC3B,QAAQ,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE;AAC3D,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;AACtC,QAAQ,KAAK,CAAC,GAAG,CAAC;AAClB,IAAI;AACJ;AACA;AACA;AACA,IAAI,OAAO,GAAG;AACd;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE;AAC1C,IAAI,MAAM,CAAC,KAAK,EAAEA,YAAU,EAAE,OAAO,CAAC;AACtC,IAAI,MAAM,CAAC,GAAG,CAAC;AACf,IAAI,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC;AACpC,IAAI,MAAM,GAAG,GAAG,KAAK,CAAC;AACtB,IAAI,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;AACxB,IAAI,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC;AAChC,IAAI,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC;AAC1B,IAAI,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC;AAC1B;AACA;AACA,IAAI,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE;AAChC,IAAI,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM;AAC7B;AACA,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC9C,IAAI,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpH;AACA,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE;AACnD,QAAQ,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;AACnD,QAAQ,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;AACnD,QAAQ,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;AACnD,QAAQ,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;AACnD,QAAQ,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;AACpC,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC;AAC5C,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACrH,IAAI;AACJ;AACA,IAAI,MAAM,KAAK,GAAGA,YAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC;AACtE,IAAI,IAAI,KAAK,GAAG,MAAM,EAAE;AACxB,QAAQ,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AACrD,QAAQ,UAAU,CAAC,GAAG,CAAC;AACvB,QAAQ,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC;AAC3B,QAAQ,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE;AAC3D,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;AACtC,QAAQ,KAAK,CAAC,GAAG,CAAC;AAClB,IAAI;AACJ;AACA;AACA,IAAI,OAAO,GAAG;AACd;AAsmBA,SAAS,SAAS,CAAC,CAAC,EAAE;AACtB;AACA;AACA,IAAI,QAAQ,CAAC,YAAY,WAAW,KAAK,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,CAAC;AACvG;AACA;AACA;AACA,SAASC,cAAY,CAAC,EAAE,EAAE,KAAK,EAAE;AACjC,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC;AAC9B,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AACtB,QAAQ,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC;AACtE,IAAI,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC;AAC1B,IAAI,UAAU,CAAC,GAAG,CAAC;AACnB,IAAI,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACxE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AAC/D,IAAI,UAAU,CAAC,GAAG,CAAC;AACnB,IAAI,OAAO,KAAK;AAChB;AACA,SAAS,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE;AACjC,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC;AAC9B,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AACtB,QAAQ,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC;AACtE,IAAI,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC;AAC1B,IAAI,UAAU,CAAC,GAAG,CAAC;AACnB,IAAI,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACxE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AAC/D,IAAI,UAAU,CAAC,GAAG,CAAC;AACnB,IAAI,OAAO,KAAK;AAChB;AA8WA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,GAAG,CAAC,KAAK,EAAE;AACpB,IAAI,IAAI,KAAK,GAAG,CAAC;AACjB;AACA,IAAI,KAAK,IAAI,CAAC,GAAGD,YAAU,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE;AAC9C,QAAQ,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;AAChD,QAAQ,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK;AAC1C,QAAQ,KAAK,GAAG,QAAQ;AACxB,IAAI;AACJ;AACA,IAAI,IAAI,KAAK,EAAE;AACf;AACA;AACA,QAAQ,KAAK,CAACA,YAAU,GAAG,CAAC,CAAC,IAAI,IAAI;AACrC,IAAI;AACJ,IAAI,OAAO,KAAK;AAChB;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE;AACxB,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;AAC7B,QAAQ,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC;AACjE,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;AACvC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC1B,IAAI;AACJ,IAAI,OAAO,CAAC;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE;AAC7B,QAAQ,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC;AAC9E,IAAI;AACJ;AACA;AACA,IAAI,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;AACtC,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;AACvC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5C,IAAI;AACJ,IAAI,OAAO,CAAC;AACZ;AACA;AACA;AACA;AACA,MAAM,KAAK,CAAC;AACZ,IAAI,QAAQ,GAAGA,YAAU;AACzB,IAAI,SAAS,GAAGA,YAAU;AAC1B;AACA;AACA,IAAI,MAAM;AACV,IAAI,GAAG;AACP,IAAI,QAAQ;AACZ,IAAI,SAAS;AACb,IAAI,EAAE;AACN,IAAI,EAAE;AACN,IAAI,CAAC;AACL,IAAI,EAAE;AACN,IAAI,WAAW,CAAC,GAAG,EAAE;AACrB,QAAQ,MAAM,CAAC,GAAG,CAAC;AACnB,QAAQ,iBAAiB,CAAC,GAAG,CAAC;AAC9B,QAAQ,IAAI,CAAC,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC;AAClC,QAAQ,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAACA,YAAU,CAAC;AAChD,QAAQ,IAAI,CAAC,GAAG,GAAG,CAAC;AACpB,QAAQ,IAAI,CAAC,QAAQ,GAAG,KAAK;AAC7B,QAAQ,IAAI,CAAC,SAAS,GAAG,KAAK;AAC9B,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,UAAU,CAACA,YAAU,CAAC;AAC3C;AACA,QAAQ,MAAM,CAAC,GAAG,IAAI,UAAU,CAACA,YAAU,CAAC;AAC5C,QAAQC,cAAY,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AAChC;AACA;AACA;AACA,QAAQ,IAAI,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;AACxB,QAAQ,IAAI,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC9C,IAAI;AACJ,IAAI,OAAO,CAAC,IAAI,EAAE;AAClB;AACA,QAAQ,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;AAC9B,QAAQA,cAAY,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;AACrC,IAAI;AACJ,IAAI,MAAM,CAAC,IAAI,EAAE;AACjB,QAAQ,IAAI,IAAI,CAAC,SAAS;AAC1B,YAAY,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC;AAC/D,QAAQ,IAAI,IAAI,CAAC,QAAQ;AACzB,YAAY,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC;AACpE,QAAQ,MAAM,CAAC,IAAI,CAAC;AACpB,QAAQ,IAAI,GAAG,GAAG,CAAC;AACnB,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE;AACtB,YAAY,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAACD,YAAU,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;AACrE,YAAY,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC;AAC7D,YAAY,IAAI,CAAC,GAAG,IAAI,IAAI;AAC5B,YAAY,GAAG,GAAG,IAAI;AACtB,YAAY,IAAI,IAAI,CAAC,GAAG,KAAKA,YAAU,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE;AAC9D,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;AACzC,gBAAgB,IAAI,CAAC,GAAG,GAAG,CAAC;AAC5B,YAAY;AACZ,QAAQ;AACR;AACA;AACA,QAAQ,OAAO,GAAG,GAAGA,YAAU,GAAG,IAAI,CAAC,MAAM,EAAE;AAC/C,YAAY,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAGA,YAAU,CAAC,CAAC;AAC9D,YAAY,GAAG,IAAIA,YAAU;AAC7B,QAAQ;AACR,QAAQ,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE;AAC/B,YAAY,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClD,YAAY,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG;AACxC,QAAQ;AACR,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ;AACA,IAAI,UAAU,CAAC,GAAG,EAAE;AACpB,QAAQ,IAAI,IAAI,CAAC,SAAS;AAC1B,YAAY,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC;AAC/D,QAAQ,IAAI,IAAI,CAAC,QAAQ;AACzB,YAAY,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC;AACpE;AACA;AACA,QAAQ,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC;AAChC,QAAQ,IAAI,CAAC,QAAQ,GAAG,IAAI;AAC5B;AACA,QAAQ,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;AACpD,QAAQ,IAAI,IAAI,GAAG,IAAI,UAAU,CAACA,YAAU,CAAC;AAC7C,QAAQ,IAAI,IAAI,CAAC,GAAG,KAAKA,YAAU,EAAE;AACrC;AACA,YAAY,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;AACjC,YAAY,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;AACnC,QAAQ;AACR,aAAa;AACb;AACA;AACA;AACA;AACA;AACA,YAAY,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;AACvD,YAAY,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;AAClC,YAAY,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;AACnC,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzB,QAAQ,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC7B,QAAQC,cAAY,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AACpC,QAAQ,KAAK,CAAC,IAAI,CAAC;AACnB,IAAI;AACJ,IAAI,MAAM,GAAG;AACb,QAAQ,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI;AAC1C,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;AAC/B;AACA,QAAQ,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;AAC9C,QAAQ,IAAI,CAAC,OAAO,EAAE;AACtB,QAAQ,OAAO,GAAG;AAClB,IAAI;AACJ,IAAI,OAAO,GAAG;AACd,QAAQ,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI;AACzD,QAAQ,IAAI,SAAS;AACrB,YAAY;AACZ,QAAQ,IAAI,CAAC,SAAS,GAAG,IAAI;AAC7B;AACA,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACpC,IAAI;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAM,IAAI,mBAAmB,kBAAkB,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;AACnF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE;AAC3B,IAAI,iBAAiB,CAAC,GAAG,CAAC;AAC1B,IAAI,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM;AAC9B,IAAI,IAAI,GAAG,GAAG,GAAG,EAAE;AACnB;AACA;AACA,QAAQ,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC;AACzF,IAAI;AACJ,IAAI,IAAI,GAAG,KAAK,CAAC;AACjB,QAAQ,OAAO,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC;AACnC;AACA,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC;AAClC;AACA;AACA,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;AACtC,QAAQ,GAAG,CAAC,CAAC,CAAC;AACd,QAAQ,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;AAChD,QAAQ,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC;AAC/B,QAAQ,KAAK,CAAC,UAAU,CAAC;AACzB,IAAI;AACJ,IAAI,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAChC;AACA;AACA,IAAI,MAAM,CAAC,GAAG,CAAC;AACf,IAAI,IAAI,CAAC;AACT;AACA,IAAI,IAAI,GAAG,CAAC,UAAU,IAAID,YAAU,EAAE;AACtC;AACA,QAAQ,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC3C,IAAI;AACJ,SAAS;AACT;AACA,QAAQ,MAAM,QAAQ,GAAG,IAAI,UAAU,CAACA,YAAU,CAAC;AACnD,QAAQ,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;AACzB,QAAQ,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;AACpC;AACA,QAAQ,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;AACtC,QAAQ,KAAK,CAAC,QAAQ,CAAC;AACvB,IAAI;AACJ;AACA,IAAI,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;AAC/B,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AACf,IAAI,OAAO,MAAM;AACjB;AA8FA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAM,MAAM,mBAAmB,MAAM,CAAC,MAAM,CAAC;AACpD,IAAI,WAAW;AACf,IAAI,cAAc;AAClB,IAAI,OAAO;AACX,IAAI,OAAO;AACX,kBAAIC,cAAY;AAChB,IAAI,YAAY;AAChB,IAAI,UAAU;AACd,IAAI,KAAK;AACT,IAAI,GAAG;AACP,IAAI,QAAQ;AACZ,IAAI,MAAM;AACV,IAAI,GAAG;AACP,CAAC,CAAC;;ACltDF,MAAMD,YAAU,GAAG,EAAE;AACrB,MAAME,WAAS,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAU;AACvC,MAAM,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAU;AACtD,MAAMC,WAAS,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAU;AACpD,MAAMC,oBAAkB,GAAG,EAAE;AAC7B,MAAM,gBAAgB,GAAG,CAAC;AAC1B,MAAM,gBAAgB,GAAG,EAAE;AAC3B,MAAM,eAAe,GAAG,MAAM;SAEd,qBAAqB,GAAA;IACnC,OAAO;AACL,QAAA,IAAI,EAAE,MAAM;AACZ,QAAA,IAAI,EAAE,SAAS;AACf,QAAA,QAAQ,EAAEF,WAAS;AACnB,QAAA,UAAU,EAAE,WAAW;AACvB,QAAA,oBAAoB,EAAE,EAAE;AACxB,QAAA,QAAQ,EAAEC,WAAS;QACnB,MAAM,CAAC,MAAM,EAAE,OAAO,EAAA;AACpB,YAAA,OAAO,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC;QAC/C,CAAC;KACF;AACH;AAEA;AACM,SAAU,YAAY,CAAC,GAAe,EAAA;IAC1C,OAAOE,gBAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC;AACzD;AAEA;;;;AAIG;AACG,SAAU,kBAAkB,CAAC,SAAiB,EAAA;AAClD,IAAA,IAAI,SAAS,KAAK,CAAC,EAAE;AACnB,QAAA,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC;IAC1B;AAEA,IAAA,IAAI,SAAS,GAAG,eAAe,EAAE;AAC/B,QAAA,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,IAAI;AACrC,QAAA,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,IAAI;AAC7B,QAAA,OAAO,OAAO;IAChB;AAEA,IAAA,IAAI,SAAS,GAAG,WAAW,EAAE;AAC3B,QAAA,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC;AACjC,QAAA,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI;AACjB,QAAA,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI;QACjB,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,EAAE,IAAI,IAAI;QACtC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,EAAE,IAAI,IAAI;QACtC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,IAAI;AACrC,QAAA,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,IAAI;AAC7B,QAAA,OAAO,OAAO;IAChB;AAEA,IAAA,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC;AAClC,IAAA,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI;AACjB,IAAA,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI;IACjB,IAAI,SAAS,GAAG,SAAS;AACzB,IAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE;AAC3B,QAAA,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,GAAG;QAC5B,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;IACzC;AACA,IAAA,OAAO,OAAO;AAChB;AAEA;;;AAGG;AACG,SAAU,qBAAqB,CACnC,KAAa,EACb,UAAkB,EAClB,GAAe,EACf,MAAc,EAAA;IAEd,IAAI,SAAS,GAAG,KAAK;AACrB,IAAA,KAAK,IAAI,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,SAAS,GAAG,GAAG;QACjC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;IACzC;AACA,IAAA,IAAI,SAAS,KAAK,CAAC,EAAE;AACnB,QAAA,MAAM,IAAI,UAAU,CAAC,sDAAsD,CAAC;IAC9E;AACF;AAEA,SAAS,qBAAqB,CAC5B,EAAE,GAAG,EAAoB,EACzB,OAA0B,EAAA;AAE1B,IAAAC,gBAAW,CAAC,GAAG,EAAE,aAAa,CAAC;AAC/B,IAAA,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE;AAC/D,QAAA,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC;IAC3D;AACA,IAAA,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAEhE,OAAO;AACL,QAAA,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAA0B,EAAA;AAC5D,YAAA,MAAM,aAAa,GAAGC,cAAY,CAAC,KAAK,CAAC;AACzC,YAAA,MAAM,WAAW,GAAGC,YAAU,CAAC,GAAG,CAAC;AACnC,YAAA,MAAM,iBAAiB,GAAGC,kBAAgB,CAAC,SAAS,CAAC;YACrD,IAAI,QAAQ,GAAiB,EAAE;YAC/B,IAAI,SAAS,GAAG,KAAK;YAErB,OAAO;AACL,gBAAA,OAAO,CAAC,KAAK,EAAA;oBACX,kBAAkB,CAAC,SAAS,CAAC;AAC7B,oBAAAH,gBAAW,CAAC,KAAK,EAAE,eAAe,CAAC;AACnC,oBAAA,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;AACpB,oBAAA,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC;gBAC1B,CAAC;AAED,gBAAA,QAAQ,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,EAAA;oBAChC,kBAAkB,CAAC,SAAS,CAAC;AAC7B,oBAAA,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;AACtB,wBAAA,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;oBACrB;oBACA,SAAS,GAAG,IAAI;AAChB,oBAAA,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC;oBAC1C,QAAQ,GAAG,EAAE;AACb,oBAAA,OAAO,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,CAAC;gBAC/E,CAAC;aACF;QACH,CAAC;QAED,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAA0B,EAAA;AACjE,YAAA,MAAM,aAAa,GAAGC,cAAY,CAAC,KAAK,CAAC;AACzC,YAAA,MAAM,WAAW,GAAGC,YAAU,CAAC,GAAG,CAAC;AACnC,YAAA,MAAM,WAAW,GAAGE,oBAAkB,CAAC,GAAG,CAAC;YAC3C,MAAM,iBAAiB,GAAG;AACxB,kBAAED,kBAAgB,CAAC,WAAW,CAAC,MAAM;AACrC,kBAAEA,kBAAgB,CAAC,SAAS,CAAC;YAC/B,IAAI,QAAQ,GAAiB,EAAE;YAC/B,IAAI,SAAS,GAAG,KAAK;YAErB,OAAO;AACL,gBAAA,OAAO,CAAC,KAAK,EAAA;oBACX,kBAAkB,CAAC,SAAS,CAAC;AAC7B,oBAAAH,gBAAW,CAAC,KAAK,EAAE,eAAe,CAAC;AACnC,oBAAA,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;AACpB,oBAAA,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC;gBAC1B,CAAC;AAED,gBAAA,QAAQ,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,EAAA;oBAChC,kBAAkB,CAAC,SAAS,CAAC;AAC7B,oBAAA,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;AACtB,wBAAA,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;oBACrB;oBACA,SAAS,GAAG,IAAI;AAChB,oBAAA,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;oBACzC,QAAQ,GAAG,EAAE;AACb,oBAAA,OAAO,IAAI,CACT,MAAM,EACN,QAAQ,EACR,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,WAAW,CACZ;gBACH,CAAC;aACF;QACH,CAAC;KACF;AACH;AAEA,SAAS,IAAI,CACX,MAAmB,EACnB,SAAqB,EACrB,KAAiB,EACjB,GAAe,EACf,SAAiB,EAAA;AAEjB,IAAA,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM;AAC3B,IAAA,qBAAqB,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AAE1C,IAAA,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;AACnE,IAAA,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC;AAC5D,IAAA,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;AAClC,IAAA,OAAO,MAAM;AACf;AAEA,SAAS,IAAI,CACX,MAAmB,EACnB,KAAiB,EACjB,KAAiB,EACjB,GAAe,EACf,SAAiB,EACjB,WAAmC,EAAA;AAEnC,IAAA,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM;AAC3B,IAAA,IAAI,UAAsB;AAC1B,IAAA,IAAI,GAAe;IAEnB,IAAI,WAAW,EAAE;QACf,UAAU,GAAG,KAAK;QAClB,GAAG,GAAG,WAAW;IACnB;SAAO;AACL,QAAA,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE;AAC5B,YAAA,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC;QAC/E;AACA,QAAA,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;QACxD,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;IAChD;AAEA,IAAA,qBAAqB,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3C,IAAA,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AACxD,IAAA,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,IAAI,CAACK,eAAU,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE;AACjC,QAAA,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACjB,QAAA,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC;IACnD;AACA,IAAA,OAAO,SAAS;AAClB;AAEA,SAAS,UAAU,CACjB,MAAmB,EACnB,SAAqB,EACrB,KAAiB,EACjB,GAAe,EACf,SAAiB,EACjB,CAAS,EAAA;AAET,IAAA,MAAM,GAAG,GAAG,IAAI,UAAU,CAACX,YAAU,CAAC;AACtC,IAAA,MAAM,KAAK,GAAG,IAAI,UAAU,CAACA,YAAU,CAAC;AAExC,IAAA,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACrE,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;AAEtC,IAAA,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE;AAClB,QAAA,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC;AACpC,QAAA,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC;IACvC;AAEA,IAAA,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE;AACxB,QAAA,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC;IACtC;AAEA,IAAA,MAAM,EAAE,GAAG,IAAI,UAAU,CAACA,YAAU,CAAC;IACrC,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACrC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAErC,IAAA,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC;AACrC,IAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE;AAClC,QAAA,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,GAAG,EAAE,CAAC,CAAC,CAAE;IAC3B;AACA,IAAA,OAAO,GAAG;AACZ;AAEA,SAAS,QAAQ,CACf,MAAmB,EACnB,KAAiB,EACjB,KAAiB,EACjB,CAAS,EAAA;AAET,IAAA,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;AACtB,QAAA,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC;IAC1B;IAEA,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;AAC3C,IAAA,MAAM,YAAY,GAAG,IAAI,UAAU,CAACA,YAAU,CAAC;AAC/C,IAAA,MAAM,SAAS,GAAG,IAAI,UAAU,CAACA,YAAU,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC;IACf,IAAI,MAAM,GAAG,CAAC;AAEd,IAAA,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE;QAC5B,iBAAiB,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;AACnD,QAAA,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAACA,YAAU,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;AACrD,QAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;AAC1B,YAAA,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,SAAS,CAAC,CAAC,CAAE;QACzD;QACA,MAAM,IAAI,CAAC;QACX,OAAO,IAAI,CAAC;IACd;AAEA,IAAA,OAAO,MAAM;AACf;AAEA,SAAS,YAAY,CAAC,MAAmB,EAAE,GAAe,EAAE,IAAgB,EAAA;AAC1E,IAAA,MAAM,KAAK,GAAG,IAAI,UAAU,CAACA,YAAU,CAAC;IACxC,IAAI,MAAM,GAAG,CAAC;AAEd,IAAA,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE;AAC3B,QAAA,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAACA,YAAU,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;AACpD,QAAA,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AACb,QAAA,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;AAC5C,QAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAGA,YAAU,EAAE,CAAC,EAAE,EAAE;YACnC,KAAK,CAAC,CAAC,CAAE,IAAI,GAAG,CAAC,CAAC,CAAE;QACtB;QACA,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC;IACb;AACF;AAEA,SAAS,OAAO,CACd,GAAe,EACf,KAAiB,EACjB,aAAqB,EACrB,MAAe,EACf,SAAiB,EACjB,CAAS,EAAA;AAET,IAAA,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzE,IAAA,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;AACjB,IAAA,qBAAqB,CAAC,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;AAChE;AAEA,SAAS,iBAAiB,CACxB,GAAe,EACf,KAAiB,EACjB,OAAe,EACf,CAAS,EAAA;AAET,IAAA,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACX,IAAA,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACd,IAAA,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;AACjB,IAAA,qBAAqB,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;AAC1D;AAEA,SAAS,YAAY,CACnB,MAAmB,EACnB,KAAiB,EACjB,WAAmB,EACnB,MAAkB,EAClB,YAAoB,EAAA;AAEpB,IAAA,IAAI,MAAM,CAAC,YAAY,EAAE;QACvB,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC;QAC7D;IACF;AAEA,IAAA,MAAM,CAAC,OAAO,CACZ,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,EAC3D,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAC/D;AACH;AAEA,SAAS,qBAAqB,CAAC,MAAc,EAAE,CAAS,EAAA;IACtD,IAAI,SAAS,GAAG,MAAM;AACtB,IAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;QAC1B,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;IACzC;AACA,IAAA,IAAI,SAAS,KAAK,CAAC,EAAE;AACnB,QAAA,MAAM,IAAI,UAAU,CAAC,sDAAsD,CAAC;IAC9E;AACF;AAEA,SAASO,cAAY,CAAC,KAA6B,EAAA;AACjD,IAAA,IAAI,KAAK,KAAK,SAAS,EAAE;AACvB,QAAA,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC;IAC9C;AACA,IAAAD,gBAAW,CAAC,KAAK,EAAE,eAAe,CAAC;AACnC,IAAA,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE;AACtE,QAAA,MAAM,IAAI,UAAU,CAAC,sDAAsD,CAAC;IAC9E;AACA,IAAA,OAAO,KAAK;AACd;AAEA,SAASE,YAAU,CAAC,GAA2B,EAAA;AAC7C,IAAA,IAAI,GAAG,KAAK,SAAS,EAAE;AACrB,QAAA,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC;IAC1B;AACA,IAAAF,gBAAW,CAAC,GAAG,EAAE,aAAa,CAAC;AAC/B,IAAA,OAAO,GAAG;AACZ;AAEA,SAASI,oBAAkB,CAAC,GAA2B,EAAA;AACrD,IAAA,IAAI,GAAG,KAAK,SAAS,EAAE;AACrB,QAAA,OAAO,SAAS;IAClB;AACA,IAAAJ,gBAAW,CAAC,GAAG,EAAE,aAAa,CAAC;AAC/B,IAAAG,kBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;AAC5B,IAAA,OAAO,GAAG;AACZ;AAEA,SAASA,kBAAgB,CAAC,SAA6B,EAAA;AACrD,IAAA,IAAI,SAAS,KAAK,SAAS,EAAE;AAC3B,QAAA,OAAOL,oBAAkB;IAC3B;IACA,IACE,OAAO,SAAS,KAAK;AAClB,WAAA,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS;WAC1BD,WAA+B,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAC7D;AACA,QAAA,MAAM,IAAI,UAAU,CAClB,oEAAoE,CACrE;IACH;AACA,IAAA,OAAO,SAAS;AAClB;AAEA,SAAS,cAAc,CAAC,QAA+B,EAAA;AACrD,IAAA,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;AACzB,QAAA,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC;IAC1B;AACA,IAAA,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;AACzB,QAAA,OAAO,QAAQ,CAAC,CAAC,CAAE;IACrB;AACA,IAAA,OAAOE,gBAAW,CAAC,GAAG,QAAQ,CAAC;AACjC;AAEA,SAAS,kBAAkB,CAAC,SAAkB,EAAA;IAC5C,IAAI,SAAS,EAAE;AACb,QAAA,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;IACzD;AACF;;AC3ZA,MAAM,SAAS,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAU;AACvC,MAAM,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAU;AACzE,MAAM,kBAAkB,GAAG,EAAE;AAC7B,MAAM,cAAc,GAAG,CAAC;AACxB,MAAM,cAAc,GAAG,EAAE;SAET,qBAAqB,GAAA;IACnC,OAAO;AACL,QAAA,IAAI,EAAE,MAAM;AACZ,QAAA,IAAI,EAAE,SAAS;AACf,QAAA,QAAQ,EAAE,SAAS;AACnB,QAAA,oBAAoB,EAAE,EAAE;AACxB,QAAA,QAAQ,EAAE,SAAS;QACnB,MAAM,CAAC,MAAM,EAAE,OAAO,EAAA;AACpB,YAAA,OAAO,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC;QAC/C,CAAC;KACF;AACH;AAEA,SAAS,qBAAqB,CAC5B,EAAE,GAAG,EAAoB,EACzB,OAA0B,EAAA;AAE1B,IAAAC,gBAAW,CAAC,GAAG,EAAE,aAAa,CAAC;IAE/B,OAAO;QACL,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAA0B,EAAA;AACrE,YAAA,OAAO,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE;AAC/C,gBAAA,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;AAC1B,gBAAA,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC;AACpB,gBAAA,SAAS,EAAE,gBAAgB,CAAC,SAAS,CAAC;gBACtC,OAAO;AACR,aAAA,CAAC,CAAC;QACL,CAAC;QAED,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAA0B,EAAA;AAC1E,YAAA,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC;YAC3C,OAAO,aAAa,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE;AAC7D,gBAAA,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;AAC1B,gBAAA,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC;AACpB,gBAAA,GAAG,EAAE,WAAW;AAChB,gBAAA,SAAS,EAAE,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,gBAAgB,CAAC,SAAS,CAAC;gBAC3F,OAAO;aACR,CAAC,CAAC,CAAC;QACN,CAAC;KACF;AACH;AAEA,SAAS,YAAY,CACnB,GAAe,EACf,EACE,KAAK,EACL,GAAG,EACH,GAAG,EACH,SAAS,EACT,OAAO,GAOR,EAAA;IAED,OAAO;QACL,GAAG,QAAQ,CAAC,OAAO,CAAC;AACpB,QAAA,MAAM,EAAE,KAAK;AACb,QAAA,IAAI,EAAE,KAAK;QACX,GAAG;QACH,KAAK;QACL,GAAG;QACH,GAAG;QACH,SAAS;KACV;AACH;AAEA,SAAS,aAAa,CAAC,MAAiB,EAAA;IACtC,OAAO;AACL,QAAA,OAAO,CAAC,KAAK,EAAA;AACX,YAAA,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAC9B,CAAC;AAED,QAAA,QAAQ,CAAC,KAAK,EAAA;AACZ,YAAA,IAAI;AACF,gBAAA,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC/B;YAAE,OAAO,KAAK,EAAE;gBACd,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,4BAA4B,EAAE;AAC5E,oBAAA,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC;gBACnD;AACA,gBAAA,MAAM,KAAK;YACb;QACF,CAAC;KACF;AACH;AAEA,SAAS,YAAY,CAAC,KAA6B,EAAA;AACjD,IAAA,IAAI,KAAK,KAAK,SAAS,EAAE;AACvB,QAAA,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC;IAC9C;AACA,IAAAA,gBAAW,CAAC,KAAK,EAAE,eAAe,CAAC;AACnC,IAAA,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;AACtB,QAAA,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC;IAC9C;AACA,IAAA,OAAO,KAAK;AACd;AAEA,SAAS,UAAU,CAAC,GAA2B,EAAA;AAC7C,IAAA,IAAI,GAAG,KAAK,SAAS,EAAE;AACrB,QAAA,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC;IAC1B;AACA,IAAAA,gBAAW,CAAC,GAAG,EAAE,aAAa,CAAC;AAC/B,IAAA,OAAO,GAAG;AACZ;AAEA,SAAS,kBAAkB,CAAC,GAA2B,EAAA;AACrD,IAAA,IAAI,GAAG,KAAK,SAAS,EAAE;AACrB,QAAA,OAAO,SAAS;IAClB;AACA,IAAAA,gBAAW,CAAC,GAAG,EAAE,aAAa,CAAC;AAC/B,IAAA,OAAO,GAAG;AACZ;AAEA,SAAS,gBAAgB,CAAC,SAA6B,EAAA;AACrD,IAAA,IAAI,SAAS,KAAK,SAAS,EAAE;AAC3B,QAAA,OAAO,kBAAkB;IAC3B;IACA,IACE,OAAO,SAAS,KAAK,QAAQ;AAC7B,QAAA,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC;AAC5B,QAAA,SAAS,GAAG,cAAc;QAC1B,SAAS,GAAG,cAAc,EAC1B;AACA,QAAA,MAAM,IAAI,UAAU,CAAC,8DAA8D,CAAC;IACtF;AACA,IAAA,OAAO,SAAS;AAClB;AAEA,SAAS,QAAQ,CAAC,OAAgB,EAAA;AAChC,IAAA,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,GAAG,OAAkC,GAAG,EAAE;AAClG;;ACjJA,MAAM,UAAU,GAAG,EAAE;AAEd,MAAM,GAAG,GAA2B;AACzC,IAAA,IAAI,EAAE,QAAQ;AACd,IAAA,IAAI,EAAE,KAAK;AACX,IAAA,IAAI,EAAE,OAAO;AACb,IAAA,SAAS,EAAE,UAAU;AACrB,IAAA,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACtB,IAAA,MAAM,CAAC,GAAG,EAAA;AACR,QAAA,OAAO,eAAe,CAAC,GAAG,CAAC;IAC7B,CAAC;;AAGI,MAAM,MAAM,GAAG,qBAAqB;AACpC,MAAM,MAAM,GAAG,qBAAqB;AAIpC,MAAM,SAAS,GAA2B;AAC/C,IAAA,IAAI,EAAE,QAAQ;AACd,IAAA,IAAI,EAAE,KAAK;IACX,UAAU,GAAA;AACR,QAAA,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC;IAC9B,CAAC;;AAGG,SAAU,eAAe,CAAC,GAAe,EAAA;AAC7C,IAAA,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE;AAC/D,QAAA,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC;IAC3D;IAEA,MAAM,aAAa,GAAGM,MAAc,CAAC,WAAW,CAAC,GAAG,CAAC;IACrD,MAAM,aAAa,GAAGA,MAAc,CAAC,cAAc,CAAC,GAAG,CAAC;IAExD,OAAO;AACL,QAAA,SAAS,EAAE,UAAU;AAErB,QAAA,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAA;AACnD,YAAA,cAAc,CAAC,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAEA,MAAc,CAAC,OAAO,CAAC;QACjG,CAAC;AAED,QAAA,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAA;AACnD,YAAA,cAAc,CAAC,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAEA,MAAc,CAAC,OAAO,CAAC;QACjG,CAAC;QAED,OAAO,CAAC,KAAK,EAAE,MAAM,EAAA;AACnB,YAAA,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;AAC3B,YAAA,OAAO,eAAe,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,EAAEA,MAAc,CAAC,OAAO,CAAC;QAC9E,CAAC;QAED,OAAO,CAAC,KAAK,EAAE,MAAM,EAAA;AACnB,YAAA,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;AAC3B,YAAA,OAAO,eAAe,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,EAAEA,MAAc,CAAC,OAAO,CAAC;QAC9E,CAAC;KACF;AACH;AAIA,SAAS,eAAe,CACtB,WAAwB,EACxB,KAAiB,EACjB,MAAkB,EAClB,SAA4B,EAAA;AAE5B,IAAA,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,UAAU,EAAE;AAChE,QAAA,cAAc,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;IACvE;AAEA,IAAA,OAAO,MAAM;AACf;AAEA,SAAS,cAAc,CACrB,WAAwB,EACxB,KAAiB,EACjB,WAAmB,EACnB,MAAkB,EAClB,YAAoB,EACpB,SAA4B,EAAA;IAE5B,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,SAAS,CAClC,WAAW,EACX,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,EAChC,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,CAAC,CAAC,EACpC,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,CAAC,CAAC,EACpC,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,EAAE,CAAC,CACtC;AACD,IAAA,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC;IACvC,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,CAAC,EAAE,EAAE,CAAC;IAC3C,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,CAAC,EAAE,EAAE,CAAC;IAC3C,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,EAAE,EAAE,EAAE,CAAC;AAC9C;AAEA,SAAS,YAAY,CAAC,KAAiB,EAAE,MAAc,EAAA;AACrD,IAAA,OAAO,CACL,KAAK,CAAC,MAAM;WACT,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC;WACtB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;AACxB,WAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,MACvB,CAAC;AACT;AAEA,SAAS,aAAa,CAAC,MAAkB,EAAE,MAAc,EAAE,KAAa,EAAA;AACtE,IAAA,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK;IACtB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC;IAChC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,KAAK,EAAE;IACjC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,KAAK,EAAE;AACnC;AAEA,SAAS,YAAY,CAAC,KAAiB,EAAE,MAAkB,EAAA;IACzD,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU,KAAK,CAAC,EAAE;AACnC,QAAA,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC;IACrE;IACA,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE;AAClC,QAAA,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC;IAC/D;AACF;;;;;;;;;","x_google_ignoreList":[0,1]}