{"version":3,"sources":["../../src/crypto-runtime.ts","../../src/next/proxy.ts","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/errors.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/_dnt.shims.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/algorithm.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/identifiers.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/consts.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/interfaces/kemInterface.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/kdfs/hkdf.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/utils/misc.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/kems/dhkem.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/interfaces/dhkemPrimitives.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/kems/dhkemPrimitives/ec.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/xCryptoKey.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/kems/dhkemPrimitives/xCurve.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/utils/noble.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/hash/hash.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/hash/hmac.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/hash/md.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/hash/u64.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/hash/sha2.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/hash/sha3.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/curve/modular.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/curve/curve.js","../../../node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/curve/montgomery.js","../../../node_modules/.pnpm/@hpke+chacha20poly1305@1.8.0/node_modules/@hpke/chacha20poly1305/esm/src/chacha/utils.js","../../../node_modules/.pnpm/@hpke+chacha20poly1305@1.8.0/node_modules/@hpke/chacha20poly1305/esm/src/chacha/_arx.js","../../../node_modules/.pnpm/@hpke+chacha20poly1305@1.8.0/node_modules/@hpke/chacha20poly1305/esm/src/chacha/_poly1305.js","../../../node_modules/.pnpm/@hpke+chacha20poly1305@1.8.0/node_modules/@hpke/chacha20poly1305/esm/src/chacha/chacha.js","../../../node_modules/.pnpm/@hpke+chacha20poly1305@1.8.0/node_modules/@hpke/chacha20poly1305/esm/src/chacha20Poly1305.js","../../../node_modules/.pnpm/@hpke+core@1.9.0/node_modules/@hpke/core/esm/src/utils/emitNotSupported.js","../../../node_modules/.pnpm/@hpke+core@1.9.0/node_modules/@hpke/core/esm/src/exporterContext.js","../../../node_modules/.pnpm/@hpke+core@1.9.0/node_modules/@hpke/core/esm/src/encryptionContext.js","../../../node_modules/.pnpm/@hpke+core@1.9.0/node_modules/@hpke/core/esm/src/mutex.js","../../../node_modules/.pnpm/@hpke+core@1.9.0/node_modules/@hpke/core/esm/src/recipientContext.js","../../../node_modules/.pnpm/@hpke+core@1.9.0/node_modules/@hpke/core/esm/src/senderContext.js","../../../node_modules/.pnpm/@hpke+core@1.9.0/node_modules/@hpke/core/esm/src/cipherSuiteNative.js","../../../node_modules/.pnpm/@hpke+core@1.9.0/node_modules/@hpke/core/esm/src/native.js","../../../node_modules/.pnpm/@hpke+core@1.9.0/node_modules/@hpke/core/esm/src/kems/dhkemPrimitives/x25519.js","../../../node_modules/.pnpm/@hpke+core@1.9.0/node_modules/@hpke/core/esm/src/kems/dhkemPrimitives/x448.js","../../../node_modules/.pnpm/@hpke+dhkem-x25519@1.8.0/node_modules/@hpke/dhkem-x25519/esm/src/primitives/x25519.js","../../../node_modules/.pnpm/@hpke+dhkem-x25519@1.8.0/node_modules/@hpke/dhkem-x25519/esm/src/hkdfSha256.js","../../../node_modules/.pnpm/@hpke+dhkem-x25519@1.8.0/node_modules/@hpke/dhkem-x25519/esm/src/dhkemX25519.js","../../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/src/utils.ts","../../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/src/_md.ts","../../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/src/_u64.ts","../../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/src/sha2.ts","../../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/src/utils.ts","../../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/src/abstract/modular.ts","../../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/src/abstract/curve.ts","../../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/src/abstract/edwards.ts","../../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/src/ed25519.ts","../../../core/src/config.ts","../../../core/src/errors.ts","../../../core/src/platform.ts","../../../core/src/pow.ts","../../../core/src/sealed.ts","../../../core/src/sealed-json.ts","../../../core/src/sealed-keys.ts","../../../core/src/url.ts","../../../core/src/http.ts","../../../core/src/token.ts","../../src/api-key.ts","../../src/errors.ts","../../src/next/cookie-codec.ts","../../src/next/shared.ts"],"sourcesContent":["// The web package supports browsers and modern Node/Next runtimes with WebCrypto.\n// HPKE/noble's legacy Node fallbacks must not leave a `crypto` import in browser\n// bundles. Only those dependencies are redirected here by the build plugin.\nexport const webcrypto = globalThis.crypto;\nexport const crypto = globalThis.crypto;\n","/**\n * '@palbase/web/next/proxy' — proactive cookie-session refresh in the Next.js\n * proxy (the file convention that replaced `middleware` in Next 16; this\n * package's peer range is `next >= 16`).\n *\n * REQUIRED — not optional — for session-bearing RSC apps. Server Components\n * cannot write cookies, so pbServer's reactive refresh cannot PERSIST a\n * rotated session there: every RSC render would re-refresh from the SAME\n * cookie refresh token, and once two of those land more than 30s apart\n * (outside palauth's rotation grace) the reuse detector REVOKES THE WHOLE\n * TOKEN FAMILY — the user is force-logged-out everywhere. The proxy refreshes\n * the cookie BEFORE the RSC tree renders, so pbServer hydrates a still-valid\n * session and never burns the token itself.\n *\n * BUNDLE RULE — why this is a SEPARATE entry taking an EXPLICIT config\n * instead of reading the process-global one like pbServer does:\n *\n * Next compiles the proxy into its OWN bundle, so the generated palbe.gen.ts\n * imported by app/layout.tsx does not reach it. Importing palbe.gen.ts from\n * proxy.ts to fix that would drag `__configure` → buildRuntime →\n * messaging/wasm/loader.ts into that graph: measured on a real app, 2.4 MB\n * where this entry ships 168 KB. (Under the pre-16 `middleware` convention it\n * was worse than size — that bundle was Edge, and webpack failed the build\n * outright with \"Dynamic Code Evaluation ... not allowed in Edge Runtime\".\n * `proxy` runs on nodejs, which is not configurable, so the hard error is\n * gone and the weight is not.)\n *\n * So the proxy never touches the runtime: it takes the two published identity\n * values it actually needs and speaks the one auth wire directly. Nothing on\n * this module's import graph may reach ../runtime.js —\n * __tests__/next-proxy-bundle.test.ts locks that against the real build\n * output.\n *\n * WHERE THE CONFIG COMES FROM — and why an explicit argument is not a chore the\n * application has to do. `palbe-gen` writes `palbase/config.ts`, a one-line\n * barrel over an IMPORT-FREE leaf beside the generated client, and rewrites\n * both on every run from PALBASE_ENV. So the proxy follows the same switch the\n * data client follows, while importing a module that has no graph to drag. That\n * is what keeps the rule above intact WITHOUT relying on tree-shaking: the leaf\n * reaches nothing, so there is nothing to shake.\n *\n * Import `palbase/config`, never `palbase/client`. The client barrel re-exports\n * palbe.gen.ts, which calls __configure at import time — that is the 2.4 MB\n * path. The bundle lock measures this chain (app proxy -> generated leaf -> this\n * entry), so pointing the import at the client barrel turns it red.\n *\n * 'next/server' is imported only lazily (the type-only NextRequest/\n * NextResponse imports erase at build time).\n *\n * ```ts\n * // proxy.ts — written by `palbase link`, carries no address and no key\n * import { palbeProxy } from '@palbase/web/next/proxy';\n * import { environmentConfig } from './palbase/config';\n * import type { NextRequest } from 'next/server';\n *\n * export function proxy(request: NextRequest) {\n * return palbeProxy(request, environmentConfig);\n * }\n *\n * // `config` MUST be declared here, in this file: Next reads it off THIS\n * // file's AST (export const + literal initializer). A re-exported or\n * // imported config is invisible and silently degrades to a catch-all.\n * export const config = { matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'] };\n * ```\n */\n\nimport { HttpClient, type HttpClientOptions } from '@palbase/core';\nimport type { NextRequest, NextResponse } from 'next/server';\nimport { environmentRefFromPublishableApiKey } from '../api-key.js';\nimport { BackendError } from '../errors.js';\nimport {\n clearedSessionCookieNames,\n decodeSessionCookies,\n encodeSessionCookiesDecoded,\n SESSION_COOKIE_ATTRS,\n type StoredSession,\n} from './cookie-codec.js';\nimport { importNextServer } from './shared.js';\n\nconst DEFAULT_REFRESH_MARGIN_MS = 60_000;\n\n/**\n * The published identity palbeProxy needs — the same two values\n * `palbase web link` bakes into palbe.gen.ts. Both are publishable (the\n * anon key already ships in every browser bundle); a service_role key is\n * REJECTED, it has no business in a request-path bundle.\n *\n * A `PalbeConfig` is structurally assignable, so apps that already hold one\n * can pass it straight through.\n */\nexport interface PalbeProxyConfig {\n /** Environment URL, e.g. `https://abc12345m.palbase.studio`. */\n url: string;\n /** Publishable (anon) API key: `pb__c`. */\n apiKey: string;\n /** Same auth encryption settings as the generated web configuration. */\n sealed?: HttpClientOptions['sealed'];\n}\n\nexport interface PalbeProxyOptions {\n /** Refresh when the access token expires within this window. Default 60s. */\n refreshMarginMs?: number;\n /**\n * Pre-built response to decorate (e.g. from your own chained proxy logic) instead of\n * building `NextResponse.next({ request })`. Pass-through cases return it\n * UNMODIFIED. Caveat: a pre-built response snapshotted the request headers\n * at ITS creation, so a rotated cookie reaches the browser (Set-Cookie)\n * but not the downstream RSC render of THIS request — prefer omitting this\n * and building your response after palbeProxy when possible.\n */\n response?: NextResponse;\n}\n\ntype RefreshOutcome =\n | { kind: 'rotated'; session: StoredSession }\n | { kind: 'terminal' } // 400/401/403 — refresh token dead, sign out\n | { kind: 'transient' }; // network / 5xx / malformed — keep the session\n\n/**\n * Per-process single-flight: concurrent proxy invocations holding the\n * SAME refresh token (parallel tabs / prefetches) share one refresh call —\n * a per-token thundering herd would race palauth rotation. Multi-pod\n * concurrency is covered by palauth's 30s rotation grace (concurrent\n * refreshes of one token all succeed); per-process dedup is all that's\n * needed here (Studio precedent — don't over-engineer).\n */\nconst inflightRefreshes = new Map>();\n\nfunction refreshSingleFlight(\n config: PalbeProxyConfig,\n refreshToken: string,\n): Promise {\n const existing = inflightRefreshes.get(refreshToken);\n if (existing) return existing;\n const pending = refresh(config, refreshToken).finally(() => {\n inflightRefreshes.delete(refreshToken);\n });\n inflightRefreshes.set(refreshToken, pending);\n return pending;\n}\n\n/** Shared sealed transport, without importing the browser runtime. */\nasync function refresh(config: PalbeProxyConfig, refreshToken: string): Promise {\n try {\n const http = new HttpClient(config.apiKey, { url: config.url, sealed: config.sealed });\n const res = await http.request('POST', '/auth/token/refresh', {\n body: { refresh_token: refreshToken },\n retry: false,\n });\n if (res.status === 400 || res.status === 401 || res.status === 403) {\n return { kind: 'terminal' };\n }\n if (res.error) return { kind: 'transient' };\n const raw: unknown = res.data;\n if (typeof raw === 'object' && raw !== null) {\n const obj = raw as Record;\n if (\n typeof obj.access_token === 'string' &&\n typeof obj.refresh_token === 'string' &&\n typeof obj.expires_in === 'number'\n ) {\n return {\n kind: 'rotated',\n session: {\n accessToken: obj.access_token,\n refreshToken: obj.refresh_token,\n expiresAt: Date.now() + obj.expires_in * 1000,\n },\n };\n }\n }\n return { kind: 'transient' }; // malformed 200 — never destroy a session over it\n } catch {\n return { kind: 'transient' }; // network failure\n }\n}\n\n/**\n * Keep the session cookie fresh for the request. No session / still-fresh\n * session → untouched pass-through (no cache-control changes). Stale or\n * expired → single-flight refresh, then the rotated (or cleared, on a dead\n * token) cookies are written onto BOTH the request (for the downstream RSC\n * render via `NextResponse.next({ request })`) and the response (for the\n * browser), with `Cache-Control: private, no-store` on touched responses.\n *\n * Cookie writes go through Next's cookie APIs with the DECODED codec values:\n * Next percent-encodes on serialization, so the wire bytes come out exactly\n * as the shared codec's (see encodeSessionCookiesDecoded). NextRequest's\n * cookie store is NOT a CookieStoreLike (its set is the 2-arg/RequestCookie\n * form), hence the direct codec calls here instead of the pbServer adapter.\n */\nexport async function palbeProxy(\n request: NextRequest,\n config: PalbeProxyConfig,\n opts?: PalbeProxyOptions,\n): Promise {\n // Fail LOUDLY on a bad key. A silently empty ref would name the cookie\n // `palbe-session-` — a name the browser SDK never writes — so every\n // request would look session-less and the proxy would degrade to a\n // no-op, which is exactly the token-family revocation this exists to stop.\n const ref = environmentRefFromPublishableApiKey(config.apiKey);\n if (ref === '') {\n throw new BackendError('validation', {\n code: 'validation_error',\n message:\n 'palbeProxy() needs the publishable API key from palbe.gen.ts (pb__c…). Re-run `palbase web link` and copy the generated values.',\n });\n }\n const { NextResponse } = await importNextServer('palbeProxy');\n const passThrough = (): NextResponse => opts?.response ?? NextResponse.next({ request });\n\n const session = decodeSessionCookies((name) => request.cookies.get(name)?.value, ref);\n if (!session) return passThrough();\n if (session.expiresAt - Date.now() > (opts?.refreshMarginMs ?? DEFAULT_REFRESH_MARGIN_MS)) {\n return passThrough();\n }\n\n const outcome = await refreshSingleFlight(config, session.refreshToken);\n if (outcome.kind === 'transient') return passThrough(); // keep the session over blips\n\n // Session-cookie names in the incoming jar — the browser's state mirror.\n const staleNames = clearedSessionCookieNames(ref, (name) => request.cookies.has(name));\n\n if (outcome.kind === 'terminal') {\n for (const name of staleNames) request.cookies.delete(name);\n const response = opts?.response ?? NextResponse.next({ request });\n for (const name of staleNames) {\n response.cookies.set(name, '', { ...SESSION_COOKIE_ATTRS, maxAge: 0 });\n }\n response.headers.set('cache-control', 'private, no-store');\n return response;\n }\n\n const write = encodeSessionCookiesDecoded(ref, outcome.session);\n for (const name of staleNames) request.cookies.delete(name);\n for (const { name, value } of write.set) request.cookies.set(name, value);\n for (const name of write.clear) request.cookies.delete(name);\n // Build AFTER the request-cookie mutation: NextResponse.next({ request })\n // snapshots the request headers for the downstream RSC render.\n const response = opts?.response ?? NextResponse.next({ request });\n const written = new Set(write.set.map((c) => c.name));\n for (const { name, value } of write.set) {\n response.cookies.set(name, value, SESSION_COOKIE_ATTRS);\n }\n // Browser-side cleanup: stale names not part of the new run (a shrunken /\n // grown chunk layout) + the codec's one-past-the-end overflow guard.\n for (const name of new Set([...write.clear, ...staleNames])) {\n if (!written.has(name)) {\n response.cookies.set(name, '', { ...SESSION_COOKIE_ATTRS, maxAge: 0 });\n }\n }\n response.headers.set('cache-control', 'private, no-store');\n return response;\n}\n","/**\n * The base error class of hpke-js.\n * @group Errors\n */\nexport class HpkeError extends Error {\n constructor(e) {\n let message;\n if (e instanceof Error) {\n message = e.message;\n }\n else if (typeof e === \"string\") {\n message = e;\n }\n else {\n message = \"\";\n }\n super(message);\n this.name = this.constructor.name;\n }\n}\n/**\n * Invalid parameter.\n * @group Errors\n */\nexport class InvalidParamError extends HpkeError {\n}\n/**\n * KEM input or output validation failure.\n * @group Errors\n */\nexport class ValidationError extends HpkeError {\n}\n/**\n * Public or private key serialization failure.\n * @group Errors\n */\nexport class SerializeError extends HpkeError {\n}\n/**\n * Public or private key deserialization failure.\n * @group Errors\n */\nexport class DeserializeError extends HpkeError {\n}\n/**\n * encap() failure.\n * @group Errors\n */\nexport class EncapError extends HpkeError {\n}\n/**\n * decap() failure.\n * @group Errors\n */\nexport class DecapError extends HpkeError {\n}\n/**\n * Secret export failure.\n * @group Errors\n */\nexport class ExportError extends HpkeError {\n}\n/**\n * seal() failure.\n * @group Errors\n */\nexport class SealError extends HpkeError {\n}\n/**\n * open() failure.\n * @group Errors\n */\nexport class OpenError extends HpkeError {\n}\n/**\n * Sequence number overflow on the encryption context.\n * @group Errors\n */\nexport class MessageLimitReachedError extends HpkeError {\n}\n/**\n * Key pair derivation failure.\n * @group Errors\n */\nexport class DeriveKeyPairError extends HpkeError {\n}\n/**\n * Not supported failure.\n * @group Errors\n */\nexport class NotSupportedError extends HpkeError {\n}\n","const dntGlobals = {};\nexport const dntGlobalThis = createMergeProxy(globalThis, dntGlobals);\nfunction createMergeProxy(baseObj, extObj) {\n return new Proxy(baseObj, {\n get(_target, prop, _receiver) {\n if (prop in extObj) {\n return extObj[prop];\n }\n else {\n return baseObj[prop];\n }\n },\n set(_target, prop, value) {\n if (prop in extObj) {\n delete extObj[prop];\n }\n baseObj[prop] = value;\n return true;\n },\n deleteProperty(_target, prop) {\n let success = false;\n if (prop in extObj) {\n delete extObj[prop];\n success = true;\n }\n if (prop in baseObj) {\n delete baseObj[prop];\n success = true;\n }\n return success;\n },\n ownKeys(_target) {\n const baseKeys = Reflect.ownKeys(baseObj);\n const extKeys = Reflect.ownKeys(extObj);\n const extKeysSet = new Set(extKeys);\n return [...baseKeys.filter((k) => !extKeysSet.has(k)), ...extKeys];\n },\n defineProperty(_target, prop, desc) {\n if (prop in extObj) {\n delete extObj[prop];\n }\n Reflect.defineProperty(baseObj, prop, desc);\n return true;\n },\n getOwnPropertyDescriptor(_target, prop) {\n if (prop in extObj) {\n return Reflect.getOwnPropertyDescriptor(extObj, prop);\n }\n else {\n return Reflect.getOwnPropertyDescriptor(baseObj, prop);\n }\n },\n has(_target, prop) {\n return prop in extObj || prop in baseObj;\n },\n });\n}\n","import * as dntShim from \"../_dnt.shims.js\";\nimport { NotSupportedError } from \"./errors.js\";\nasync function loadSubtleCrypto() {\n if (dntShim.dntGlobalThis !== undefined && globalThis.crypto !== undefined) {\n // Browsers, Node.js >= v19, Cloudflare Workers, Bun, etc.\n return globalThis.crypto.subtle;\n }\n // Node.js <= v18\n try {\n // @ts-ignore: to ignore \"crypto\"\n const { webcrypto } = await import(\"crypto\"); // node:crypto\n return webcrypto.subtle;\n }\n catch (e) {\n throw new NotSupportedError(e);\n }\n}\nexport class NativeAlgorithm {\n constructor() {\n Object.defineProperty(this, \"_api\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: undefined\n });\n }\n async _setup() {\n if (this._api !== undefined) {\n return;\n }\n this._api = await loadSubtleCrypto();\n }\n}\n","/**\n * The supported HPKE modes.\n */\nexport const Mode = {\n Base: 0x00,\n Psk: 0x01,\n Auth: 0x02,\n AuthPsk: 0x03,\n};\n/**\n * The supported Key Encapsulation Mechanism (KEM) identifiers.\n */\nexport const KemId = {\n NotAssigned: 0x0000,\n DhkemP256HkdfSha256: 0x0010,\n DhkemP384HkdfSha384: 0x0011,\n DhkemP521HkdfSha512: 0x0012,\n DhkemSecp256k1HkdfSha256: 0x0013,\n DhkemX25519HkdfSha256: 0x0020,\n DhkemX448HkdfSha512: 0x0021,\n HybridkemX25519Kyber768: 0x0030,\n MlKem512: 0x0040,\n MlKem768: 0x0041,\n MlKem1024: 0x0042,\n XWing: 0x647a,\n};\n/**\n * The supported Key Derivation Function (KDF) identifiers.\n */\nexport const KdfId = {\n HkdfSha256: 0x0001,\n HkdfSha384: 0x0002,\n HkdfSha512: 0x0003,\n Sha3256: 0x0004,\n Sha3384: 0x0005,\n Sha3512: 0x0006,\n Shake128: 0x0010,\n Shake256: 0x0011,\n TurboShake128: 0x0012,\n TurboShake256: 0x0013,\n};\n/**\n * The supported Authenticated Encryption with Associated Data (AEAD) identifiers.\n */\nexport const AeadId = {\n Aes128Gcm: 0x0001,\n Aes256Gcm: 0x0002,\n Chacha20Poly1305: 0x0003,\n ExportOnly: 0xFFFF,\n};\n","// The input length limit (psk, psk_id, info, exporter_context, ikm).\nexport const INPUT_LENGTH_LIMIT = 8192;\nexport const INFO_LENGTH_LIMIT = 268435456;\n// The minimum length of a PSK.\nexport const MINIMUM_PSK_LENGTH = 32;\n// b\"\"\nexport const EMPTY = /* @__PURE__ */ new Uint8Array(0);\n// Common BigInt constants\nexport const N_0 = 0n;\nexport const N_1 = 1n;\nexport const N_2 = 2n;\nexport const N_7 = 7n;\nexport const N_32 = 32n;\nexport const N_256 = 256n;\nexport const N_0x71 = 0x71n;\nexport const BYTE_TO_BIGINT_256 = /* @__PURE__ */ (() => {\n const out = new Array(256);\n let i = 0;\n let value = 0n;\n while (i < 256) {\n out[i] = value;\n i++;\n value += 1n;\n }\n return out;\n})();\n","// b\"KEM\"\nexport const SUITE_ID_HEADER_KEM = /* @__PURE__ */ new Uint8Array([\n 75,\n 69,\n 77,\n 0,\n 0,\n]);\n","import { EMPTY } from \"../consts.js\";\nimport { InvalidParamError } from \"../errors.js\";\nimport { KdfId } from \"../identifiers.js\";\nimport { NativeAlgorithm } from \"../algorithm.js\";\n// b\"HPKE-v1\"\nconst HPKE_VERSION = /* @__PURE__ */ new Uint8Array([\n 72,\n 80,\n 75,\n 69,\n 45,\n 118,\n 49,\n]);\nexport function toUint8Array(input) {\n return new Uint8Array(toArrayBuffer(input));\n}\nexport function toArrayBuffer(input) {\n if (input instanceof ArrayBuffer) {\n return input;\n }\n if (ArrayBuffer.isView(input)) {\n return new Uint8Array(input.buffer, input.byteOffset, input.byteLength)\n .slice().buffer;\n }\n return new Uint8Array(input).slice().buffer;\n}\nexport class HkdfNative extends NativeAlgorithm {\n constructor() {\n super();\n Object.defineProperty(this, \"id\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: KdfId.HkdfSha256\n });\n Object.defineProperty(this, \"hashSize\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 0\n });\n Object.defineProperty(this, \"_suiteId\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: EMPTY\n });\n Object.defineProperty(this, \"algHash\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: {\n name: \"HMAC\",\n hash: \"SHA-256\",\n length: 256,\n }\n });\n }\n init(suiteId) {\n this._suiteId = suiteId;\n }\n buildLabeledIkm(label, ikm) {\n this._checkInit();\n const ret = new Uint8Array(7 + this._suiteId.byteLength + label.byteLength + ikm.byteLength);\n ret.set(HPKE_VERSION, 0);\n ret.set(this._suiteId, 7);\n ret.set(label, 7 + this._suiteId.byteLength);\n ret.set(ikm, 7 + this._suiteId.byteLength + label.byteLength);\n return ret;\n }\n buildLabeledInfo(label, info, len) {\n this._checkInit();\n const ret = new Uint8Array(9 + this._suiteId.byteLength + label.byteLength + info.byteLength);\n ret.set(new Uint8Array([0, len]), 0);\n ret.set(HPKE_VERSION, 2);\n ret.set(this._suiteId, 9);\n ret.set(label, 9 + this._suiteId.byteLength);\n ret.set(info, 9 + this._suiteId.byteLength + label.byteLength);\n return ret;\n }\n async extract(salt, ikm) {\n await this._setup();\n const saltBuf = salt.byteLength === 0\n ? new ArrayBuffer(this.hashSize)\n : toArrayBuffer(salt);\n if (saltBuf.byteLength !== this.hashSize) {\n throw new InvalidParamError(\"The salt length must be the same as the hashSize\");\n }\n const ikmBuf = toArrayBuffer(ikm);\n const key = await this._api.importKey(\"raw\", saltBuf, this.algHash, false, [\n \"sign\",\n ]);\n return await this._api.sign(\"HMAC\", key, ikmBuf);\n }\n async expand(prk, info, len) {\n await this._setup();\n const prkBuf = toArrayBuffer(prk);\n const key = await this._api.importKey(\"raw\", prkBuf, this.algHash, false, [\n \"sign\",\n ]);\n const okm = new ArrayBuffer(len);\n const okmBytes = new Uint8Array(okm);\n let prev = EMPTY;\n const mid = toUint8Array(info);\n const tail = new Uint8Array(1);\n if (len > 255 * this.hashSize) {\n throw new Error(\"Entropy limit reached\");\n }\n const tmp = new Uint8Array(this.hashSize + mid.length + 1);\n for (let i = 1, cur = 0; cur < okmBytes.length; i++) {\n tail[0] = i;\n tmp.set(prev, 0);\n tmp.set(mid, prev.length);\n tmp.set(tail, prev.length + mid.length);\n prev = new Uint8Array(await this._api.sign(\"HMAC\", key, tmp.slice(0, prev.length + mid.length + 1)));\n if (okmBytes.length - cur >= prev.length) {\n okmBytes.set(prev, cur);\n cur += prev.length;\n }\n else {\n okmBytes.set(prev.slice(0, okmBytes.length - cur), cur);\n cur += okmBytes.length - cur;\n }\n }\n return okm;\n }\n async extractAndExpand(salt, ikm, info, len) {\n await this._setup();\n const ikmBuf = toArrayBuffer(ikm);\n const baseKey = await this._api.importKey(\"raw\", ikmBuf, \"HKDF\", false, [\"deriveBits\"]);\n return await this._api.deriveBits({\n name: \"HKDF\",\n hash: this.algHash.hash,\n salt: toArrayBuffer(salt),\n info: toArrayBuffer(info),\n }, baseKey, len * 8);\n }\n async labeledExtract(salt, label, ikm) {\n return await this.extract(salt, this.buildLabeledIkm(label, ikm));\n }\n async labeledExpand(prk, label, info, len) {\n return await this.expand(prk, this.buildLabeledInfo(label, info, len), len);\n }\n _checkInit() {\n if (this._suiteId === EMPTY) {\n throw new Error(\"Not initialized. Call init()\");\n }\n }\n}\nexport class HkdfSha256Native extends HkdfNative {\n constructor() {\n super(...arguments);\n /** KdfId.HkdfSha256 (0x0001) */\n Object.defineProperty(this, \"id\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: KdfId.HkdfSha256\n });\n /** 32 */\n Object.defineProperty(this, \"hashSize\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 32\n });\n /** The parameters for Web Cryptography API */\n Object.defineProperty(this, \"algHash\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: {\n name: \"HMAC\",\n hash: \"SHA-256\",\n length: 256,\n }\n });\n }\n}\nexport class HkdfSha384Native extends HkdfNative {\n constructor() {\n super(...arguments);\n /** KdfId.HkdfSha384 (0x0002) */\n Object.defineProperty(this, \"id\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: KdfId.HkdfSha384\n });\n /** 48 */\n Object.defineProperty(this, \"hashSize\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 48\n });\n /** The parameters for Web Cryptography API */\n Object.defineProperty(this, \"algHash\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: {\n name: \"HMAC\",\n hash: \"SHA-384\",\n length: 384,\n }\n });\n }\n}\nexport class HkdfSha512Native extends HkdfNative {\n constructor() {\n super(...arguments);\n /** KdfId.HkdfSha512 (0x0003) */\n Object.defineProperty(this, \"id\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: KdfId.HkdfSha512\n });\n /** 64 */\n Object.defineProperty(this, \"hashSize\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 64\n });\n /** The parameters for Web Cryptography API */\n Object.defineProperty(this, \"algHash\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: {\n name: \"HMAC\",\n hash: \"SHA-512\",\n length: 512,\n }\n });\n }\n}\n","import * as dntShim from \"../../_dnt.shims.js\";\nimport { KemId } from \"../identifiers.js\";\nexport const isDenoV1 = () => \n// deno-lint-ignore no-explicit-any\ndntShim.dntGlobalThis.process === undefined;\n/**\n * Checks whether the runtime is Deno or not (Node.js).\n * @returns boolean - true if the runtime is Deno, false Node.js.\n */\nexport function isDeno() {\n // deno-lint-ignore no-explicit-any\n if (dntShim.dntGlobalThis.process === undefined) {\n return true;\n }\n // deno-lint-ignore no-explicit-any\n return dntShim.dntGlobalThis.process?.versions?.deno !== undefined;\n}\n/**\n * Checks whetehr the type of input is CryptoKeyPair or not.\n */\nexport const isCryptoKeyPair = (x) => typeof x === \"object\" &&\n x !== null &&\n typeof x.privateKey === \"object\" &&\n typeof x.publicKey === \"object\";\n/**\n * Converts integer to octet string. I2OSP implementation.\n */\nexport function i2Osp(n, w) {\n if (w <= 0) {\n throw new Error(\"i2Osp: too small size\");\n }\n if (n >= 256 ** w) {\n throw new Error(\"i2Osp: too large integer\");\n }\n const ret = new Uint8Array(w);\n for (let i = 0; i < w && n; i++) {\n ret[w - (i + 1)] = n % 256;\n n = Math.floor(n / 256);\n }\n return ret;\n}\n/**\n * Concatenates two Uint8Arrays.\n * @param a Uint8Array\n * @param b Uint8Array\n * @returns Concatenated Uint8Array\n */\nexport function concat(a, b) {\n const ret = new Uint8Array(a.length + b.length);\n ret.set(a, 0);\n ret.set(b, a.length);\n return ret;\n}\n/**\n * Decodes Base64Url-encoded data.\n * @param v Base64Url-encoded string\n * @returns Uint8Array\n */\nexport function base64UrlToBytes(v) {\n const base64 = v.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const byteString = atob(base64);\n const ret = new Uint8Array(byteString.length);\n for (let i = 0; i < byteString.length; i++) {\n ret[i] = byteString.charCodeAt(i);\n }\n return ret;\n}\n/**\n * Encodes Uint8Array to Base64Url.\n * @param v Uint8Array\n * @returns Base64Url-encoded string\n */\nexport function bytesToBase64Url(v) {\n return btoa(String.fromCharCode(...v))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=*$/g, \"\");\n}\n/**\n * Decodes hex string to Uint8Array.\n * @param v Hex string\n * @returns Uint8Array\n * @throws Error if the input is not a hex string.\n */\nexport function hexToBytes(v) {\n if (v.length === 0) {\n return new Uint8Array([]);\n }\n const res = v.match(/[\\da-f]{2}/gi);\n if (res == null) {\n throw new Error(\"Not hex string.\");\n }\n return new Uint8Array(res.map(function (h) {\n return parseInt(h, 16);\n }));\n}\n/**\n * Encodes Uint8Array to hex string.\n * @param v Uint8Array\n * @returns Hex string\n */\nexport function bytesToHex(v) {\n return [...v].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n/**\n * Converts KemId to KeyAlgorithm.\n * @param kem KemId\n * @returns KeyAlgorithm\n */\nexport function kemToKeyGenAlgorithm(kem) {\n switch (kem) {\n case KemId.DhkemP256HkdfSha256:\n return {\n name: \"ECDH\",\n namedCurve: \"P-256\",\n };\n case KemId.DhkemP384HkdfSha384:\n return {\n name: \"ECDH\",\n namedCurve: \"P-384\",\n };\n case KemId.DhkemP521HkdfSha512:\n return {\n name: \"ECDH\",\n namedCurve: \"P-521\",\n };\n default:\n // case KemId.DhkemX25519HkdfSha256\n return {\n name: \"X25519\",\n };\n }\n}\nexport async function loadSubtleCrypto() {\n if (dntShim.dntGlobalThis !== undefined && globalThis.crypto !== undefined) {\n // Browsers, Node.js >= v19, Cloudflare Workers, Bun, etc.\n return globalThis.crypto.subtle;\n }\n // Node.js <= v18\n try {\n // @ts-ignore: to ignore \"crypto\"\n const { webcrypto } = await import(\"crypto\"); // node:crypto\n return webcrypto.subtle;\n }\n catch (_e) {\n throw new Error(\"Failed to load SubtleCrypto\");\n }\n}\nexport async function loadCrypto() {\n if (typeof dntShim.dntGlobalThis !== \"undefined\" && globalThis.crypto !== undefined) {\n // Browsers, Node.js >= v19, Cloudflare Workers, Bun, etc.\n return globalThis.crypto;\n }\n // Node.js <= v18\n try {\n // @ts-ignore: to ignore \"crypto\"\n const { webcrypto } = await import(\"crypto\"); // node:crypto\n return webcrypto;\n }\n catch (_e) {\n throw new Error(\"failed to load Crypto\");\n }\n}\n/**\n * XOR for Uint8Array.\n */\nexport function xor(a, b) {\n if (a.byteLength !== b.byteLength) {\n throw new Error(\"xor: different length inputs\");\n }\n const buf = new Uint8Array(a.byteLength);\n for (let i = 0; i < a.byteLength; i++) {\n buf[i] = a[i] ^ b[i];\n }\n return buf;\n}\n","import { EMPTY, INPUT_LENGTH_LIMIT } from \"../consts.js\";\nimport { DecapError, EncapError, InvalidParamError } from \"../errors.js\";\nimport { SUITE_ID_HEADER_KEM } from \"../interfaces/kemInterface.js\";\nimport { toArrayBuffer } from \"../kdfs/hkdf.js\";\nimport { concat, i2Osp, isCryptoKeyPair } from \"../utils/misc.js\";\n// b\"eae_prk\"\nconst LABEL_EAE_PRK = /* @__PURE__ */ new Uint8Array([\n 101,\n 97,\n 101,\n 95,\n 112,\n 114,\n 107,\n]);\n// b\"shared_secret\"\n// deno-fmt-ignore\nconst LABEL_SHARED_SECRET = /* @__PURE__ */ new Uint8Array([\n 115, 104, 97, 114, 101, 100, 95, 115, 101, 99,\n 114, 101, 116,\n]);\nfunction concat3(a, b, c) {\n const ret = new Uint8Array(a.length + b.length + c.length);\n ret.set(a, 0);\n ret.set(b, a.length);\n ret.set(c, a.length + b.length);\n return ret;\n}\nexport class Dhkem {\n constructor(id, prim, kdf) {\n Object.defineProperty(this, \"id\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"secretSize\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 0\n });\n Object.defineProperty(this, \"encSize\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 0\n });\n Object.defineProperty(this, \"publicKeySize\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 0\n });\n Object.defineProperty(this, \"privateKeySize\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 0\n });\n Object.defineProperty(this, \"_prim\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_kdf\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n this.id = id;\n this._prim = prim;\n this._kdf = kdf;\n const suiteId = new Uint8Array(SUITE_ID_HEADER_KEM);\n suiteId.set(i2Osp(this.id, 2), 3);\n this._kdf.init(suiteId);\n }\n async serializePublicKey(key) {\n return await this._prim.serializePublicKey(key);\n }\n async deserializePublicKey(key) {\n return await this._prim.deserializePublicKey(toArrayBuffer(key));\n }\n async serializePrivateKey(key) {\n return await this._prim.serializePrivateKey(key);\n }\n async deserializePrivateKey(key) {\n return await this._prim.deserializePrivateKey(toArrayBuffer(key));\n }\n async importKey(format, key, isPublic = true) {\n return await this._prim.importKey(format, key, isPublic);\n }\n async generateKeyPair() {\n return await this._prim.generateKeyPair();\n }\n async deriveKeyPair(ikm) {\n const rawIkm = toArrayBuffer(ikm);\n if (rawIkm.byteLength > INPUT_LENGTH_LIMIT) {\n throw new InvalidParamError(\"Too long ikm\");\n }\n return await this._prim.deriveKeyPair(rawIkm);\n }\n async encap(params) {\n let ke;\n if (params.ekm === undefined) {\n ke = await this.generateKeyPair();\n }\n else if (isCryptoKeyPair(params.ekm)) {\n // params.ekm is only used for testing.\n ke = params.ekm;\n }\n else {\n // params.ekm is only used for testing.\n ke = await this.deriveKeyPair(params.ekm);\n }\n const enc = await this._prim.serializePublicKey(ke.publicKey);\n const pkrm = await this._prim.serializePublicKey(params.recipientPublicKey);\n try {\n let dh;\n if (params.senderKey === undefined) {\n dh = new Uint8Array(await this._prim.dh(ke.privateKey, params.recipientPublicKey));\n }\n else {\n const sks = isCryptoKeyPair(params.senderKey)\n ? params.senderKey.privateKey\n : params.senderKey;\n const dh1 = new Uint8Array(await this._prim.dh(ke.privateKey, params.recipientPublicKey));\n const dh2 = new Uint8Array(await this._prim.dh(sks, params.recipientPublicKey));\n dh = concat(dh1, dh2);\n }\n let kemContext;\n if (params.senderKey === undefined) {\n kemContext = concat(new Uint8Array(enc), new Uint8Array(pkrm));\n }\n else {\n const pks = isCryptoKeyPair(params.senderKey)\n ? params.senderKey.publicKey\n : await this._prim.derivePublicKey(params.senderKey);\n const pksm = await this._prim.serializePublicKey(pks);\n kemContext = concat3(new Uint8Array(enc), new Uint8Array(pkrm), new Uint8Array(pksm));\n }\n const sharedSecret = await this._generateSharedSecret(dh, kemContext);\n return {\n enc: enc,\n sharedSecret: sharedSecret,\n };\n }\n catch (e) {\n throw new EncapError(e);\n }\n }\n async decap(params) {\n const enc = toArrayBuffer(params.enc);\n const pke = await this._prim.deserializePublicKey(enc);\n const skr = isCryptoKeyPair(params.recipientKey)\n ? params.recipientKey.privateKey\n : params.recipientKey;\n const pkr = isCryptoKeyPair(params.recipientKey)\n ? params.recipientKey.publicKey\n : await this._prim.derivePublicKey(params.recipientKey);\n const pkrm = await this._prim.serializePublicKey(pkr);\n try {\n let dh;\n if (params.senderPublicKey === undefined) {\n dh = new Uint8Array(await this._prim.dh(skr, pke));\n }\n else {\n const dh1 = new Uint8Array(await this._prim.dh(skr, pke));\n const dh2 = new Uint8Array(await this._prim.dh(skr, params.senderPublicKey));\n dh = concat(dh1, dh2);\n }\n let kemContext;\n if (params.senderPublicKey === undefined) {\n kemContext = concat(new Uint8Array(enc), new Uint8Array(pkrm));\n }\n else {\n const pksm = await this._prim.serializePublicKey(params.senderPublicKey);\n kemContext = new Uint8Array(enc.byteLength + pkrm.byteLength + pksm.byteLength);\n kemContext.set(new Uint8Array(enc), 0);\n kemContext.set(new Uint8Array(pkrm), enc.byteLength);\n kemContext.set(new Uint8Array(pksm), enc.byteLength + pkrm.byteLength);\n }\n return await this._generateSharedSecret(dh, kemContext);\n }\n catch (e) {\n throw new DecapError(e);\n }\n }\n async _generateSharedSecret(dh, kemContext) {\n const labeledIkm = this._kdf.buildLabeledIkm(LABEL_EAE_PRK, dh);\n const labeledInfo = this._kdf.buildLabeledInfo(LABEL_SHARED_SECRET, kemContext, this.secretSize);\n return await this._kdf.extractAndExpand(EMPTY, labeledIkm, labeledInfo, this.secretSize);\n }\n}\n","// The key usages for KEM.\nexport const KEM_USAGES = [\"deriveBits\"];\n// b\"dkp_prk\"\nexport const LABEL_DKP_PRK = /* @__PURE__ */ new Uint8Array([\n 100,\n 107,\n 112,\n 95,\n 112,\n 114,\n 107,\n]);\n// b\"sk\"\nexport const LABEL_SK = /* @__PURE__ */ new Uint8Array([115, 107]);\n","import { NativeAlgorithm } from \"../../algorithm.js\";\nimport { BYTE_TO_BIGINT_256, EMPTY } from \"../../consts.js\";\nimport { toArrayBuffer } from \"../../kdfs/hkdf.js\";\nimport { DeriveKeyPairError, DeserializeError, NotSupportedError, SerializeError, } from \"../../errors.js\";\nimport { KemId } from \"../../identifiers.js\";\nimport { KEM_USAGES, LABEL_DKP_PRK } from \"../../interfaces/dhkemPrimitives.js\";\nimport { Bignum } from \"../../utils/bignum.js\";\nimport { base64UrlToBytes, i2Osp } from \"../../utils/misc.js\";\n// b\"candidate\"\n// deno-fmt-ignore\nconst LABEL_CANDIDATE = /* @__PURE__ */ new Uint8Array([\n 99, 97, 110, 100, 105, 100, 97, 116, 101,\n]);\n// the order of the curve being used.\n// deno-fmt-ignore\nconst ORDER_P_256 = /* @__PURE__ */ new Uint8Array([\n 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,\n 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,\n 0xbc, 0xe6, 0xfa, 0xad, 0xa7, 0x17, 0x9e, 0x84,\n 0xf3, 0xb9, 0xca, 0xc2, 0xfc, 0x63, 0x25, 0x51,\n]);\n// deno-fmt-ignore\nconst ORDER_P_384 = /* @__PURE__ */ new Uint8Array([\n 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,\n 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,\n 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,\n 0xc7, 0x63, 0x4d, 0x81, 0xf4, 0x37, 0x2d, 0xdf,\n 0x58, 0x1a, 0x0d, 0xb2, 0x48, 0xb0, 0xa7, 0x7a,\n 0xec, 0xec, 0x19, 0x6a, 0xcc, 0xc5, 0x29, 0x73,\n]);\n// deno-fmt-ignore\nconst ORDER_P_521 = /* @__PURE__ */ new Uint8Array([\n 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,\n 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,\n 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,\n 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,\n 0xff, 0xfa, 0x51, 0x86, 0x87, 0x83, 0xbf, 0x2f,\n 0x96, 0x6b, 0x7f, 0xcc, 0x01, 0x48, 0xf7, 0x09,\n 0xa5, 0xd0, 0x3b, 0xb5, 0xc9, 0xb8, 0x89, 0x9c,\n 0x47, 0xae, 0xbb, 0x6f, 0xb7, 0x1e, 0x91, 0x38,\n 0x64, 0x09,\n]);\n// deno-fmt-ignore\nconst PKCS8_ALG_ID_P_256 = /* @__PURE__ */ new Uint8Array([\n 48, 65, 2, 1, 0, 48, 19, 6, 7, 42,\n 134, 72, 206, 61, 2, 1, 6, 8, 42, 134,\n 72, 206, 61, 3, 1, 7, 4, 39, 48, 37,\n 2, 1, 1, 4, 32,\n]);\n// deno-fmt-ignore\nconst PKCS8_ALG_ID_P_384 = /* @__PURE__ */ new Uint8Array([\n 48, 78, 2, 1, 0, 48, 16, 6, 7, 42,\n 134, 72, 206, 61, 2, 1, 6, 5, 43, 129,\n 4, 0, 34, 4, 55, 48, 53, 2, 1, 1,\n 4, 48,\n]);\n// deno-fmt-ignore\nconst PKCS8_ALG_ID_P_521 = /* @__PURE__ */ new Uint8Array([\n 48, 96, 2, 1, 0, 48, 16, 6, 7, 42,\n 134, 72, 206, 61, 2, 1, 6, 5, 43, 129,\n 4, 0, 35, 4, 73, 48, 71, 2, 1, 1,\n 4, 66,\n]);\nconst EC_P_256_PARAMS = {\n p: 0xffffffff00000001000000000000000000000000ffffffffffffffffffffffffn,\n b: 0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604bn,\n gx: 0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296n,\n gy: 0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5n,\n coordinateSize: 32,\n};\nconst EC_P_384_PARAMS = {\n p: 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffffn,\n b: 0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aefn,\n gx: 0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7n,\n gy: 0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5fn,\n coordinateSize: 48,\n};\nconst EC_P_521_PARAMS = {\n p: (1n << 521n) - 1n,\n b: 0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00n,\n gx: 0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66n,\n gy: 0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650n,\n coordinateSize: 66,\n};\nfunction mod(a, p) {\n const r = a % p;\n return r >= 0n ? r : r + p;\n}\nfunction modPow(base, exponent, p) {\n let result = 1n;\n let b = mod(base, p);\n let e = exponent;\n while (e > 0n) {\n if ((e & 1n) === 1n) {\n result = mod(result * b, p);\n }\n b = mod(b * b, p);\n e >>= 1n;\n }\n return result;\n}\nfunction modSqrt(rhs, p) {\n // P-256/P-384/P-521 primes satisfy p % 4 == 3.\n const y = modPow(rhs, (p + 1n) >> 2n, p);\n if (mod(y * y, p) !== mod(rhs, p)) {\n throw new Error(\"Invalid ECDH point\");\n }\n return y;\n}\nfunction bytesToBigInt(bytes) {\n let v = 0n;\n for (const b of bytes) {\n v = (v << 8n) | BYTE_TO_BIGINT_256[b];\n }\n return v;\n}\nfunction bigIntToBytes(v, len) {\n const out = new Uint8Array(len);\n let n = v;\n for (let i = len - 1; i >= 0; i--) {\n out[i] = Number(n & 0xffn);\n n >>= 8n;\n }\n if (n !== 0n) {\n throw new Error(\"Invalid coordinate length\");\n }\n return out;\n}\nfunction buildRawUncompressedPublicKey(x, y, coordinateSize) {\n const out = new Uint8Array(1 + coordinateSize * 2);\n out[0] = 0x04;\n out.set(bigIntToBytes(x, coordinateSize), 1);\n out.set(bigIntToBytes(y, coordinateSize), 1 + coordinateSize);\n return out;\n}\nexport class Ec extends NativeAlgorithm {\n constructor(kem, hkdf) {\n super();\n Object.defineProperty(this, \"_hkdf\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_alg\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_nPk\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_nSk\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_nDh\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n // EC specific arguments for deriving key pair.\n Object.defineProperty(this, \"_order\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_bitmask\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_pkcs8AlgId\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_curveParams\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n this._hkdf = hkdf;\n switch (kem) {\n case KemId.DhkemP256HkdfSha256:\n this._alg = { name: \"ECDH\", namedCurve: \"P-256\" };\n this._nPk = 65;\n this._nSk = 32;\n this._nDh = 32;\n this._order = ORDER_P_256;\n this._bitmask = 0xFF;\n this._pkcs8AlgId = PKCS8_ALG_ID_P_256;\n this._curveParams = EC_P_256_PARAMS;\n break;\n case KemId.DhkemP384HkdfSha384:\n this._alg = { name: \"ECDH\", namedCurve: \"P-384\" };\n this._nPk = 97;\n this._nSk = 48;\n this._nDh = 48;\n this._order = ORDER_P_384;\n this._bitmask = 0xFF;\n this._pkcs8AlgId = PKCS8_ALG_ID_P_384;\n this._curveParams = EC_P_384_PARAMS;\n break;\n default:\n // case KemId.DhkemP521HkdfSha512:\n this._alg = { name: \"ECDH\", namedCurve: \"P-521\" };\n this._nPk = 133;\n this._nSk = 66;\n this._nDh = 66;\n this._order = ORDER_P_521;\n this._bitmask = 0x01;\n this._pkcs8AlgId = PKCS8_ALG_ID_P_521;\n this._curveParams = EC_P_521_PARAMS;\n break;\n }\n }\n async serializePublicKey(key) {\n await this._setup();\n try {\n return await this._api.exportKey(\"raw\", key);\n }\n catch (e) {\n throw new SerializeError(e);\n }\n }\n async deserializePublicKey(key) {\n await this._setup();\n try {\n return await this._importRawKey(toArrayBuffer(key), true);\n }\n catch (e) {\n throw new DeserializeError(e);\n }\n }\n async serializePrivateKey(key) {\n await this._setup();\n try {\n const jwk = await this._api.exportKey(\"jwk\", key);\n if (!(\"d\" in jwk)) {\n throw new Error(\"Not private key\");\n }\n return base64UrlToBytes(jwk[\"d\"]).buffer;\n }\n catch (e) {\n throw new SerializeError(e);\n }\n }\n async deserializePrivateKey(key) {\n await this._setup();\n try {\n return await this._importRawKey(toArrayBuffer(key), false);\n }\n catch (e) {\n throw new DeserializeError(e);\n }\n }\n async importKey(format, key, isPublic) {\n await this._setup();\n try {\n if (format === \"raw\") {\n return await this._importRawKey(key, isPublic);\n }\n // jwk\n if (key instanceof ArrayBuffer) {\n throw new Error(\"Invalid jwk key format\");\n }\n return await this._importJWK(key, isPublic);\n }\n catch (e) {\n throw new DeserializeError(e);\n }\n }\n async generateKeyPair() {\n await this._setup();\n try {\n return await this._api.generateKey(this._alg, true, KEM_USAGES);\n }\n catch (e) {\n throw new NotSupportedError(e);\n }\n }\n async deriveKeyPair(ikm) {\n await this._setup();\n try {\n const rawIkm = toArrayBuffer(ikm);\n const dkpPrk = await this._hkdf.labeledExtract(EMPTY, LABEL_DKP_PRK, new Uint8Array(rawIkm));\n const bn = new Bignum(this._nSk);\n for (let counter = 0; bn.isZero() || !bn.lessThan(this._order); counter++) {\n if (counter > 255) {\n throw new Error(\"Faild to derive a key pair\");\n }\n const bytes = new Uint8Array(await this._hkdf.labeledExpand(dkpPrk, LABEL_CANDIDATE, i2Osp(counter, 1), this._nSk));\n bytes[0] = bytes[0] & this._bitmask;\n bn.set(bytes);\n }\n const sk = await this._deserializePkcs8Key(bn.val());\n bn.reset();\n return {\n privateKey: sk,\n publicKey: await this.derivePublicKey(sk),\n };\n }\n catch (e) {\n throw new DeriveKeyPairError(e);\n }\n }\n async derivePublicKey(key) {\n await this._setup();\n try {\n const jwk = await this._api.exportKey(\"jwk\", key);\n delete jwk[\"d\"];\n delete jwk[\"key_ops\"];\n return await this._api.importKey(\"jwk\", jwk, this._alg, true, []);\n }\n catch {\n try {\n // Firefox fails to export JWK from some imported ECDH private keys.\n return await this._derivePublicKeyWithoutJwkExport(key);\n }\n catch (e) {\n throw new DeserializeError(e);\n }\n }\n }\n async dh(sk, pk) {\n try {\n await this._setup();\n const bits = await this._api.deriveBits({\n name: \"ECDH\",\n public: pk,\n }, sk, this._nDh * 8);\n return bits;\n }\n catch (e) {\n throw new SerializeError(e);\n }\n }\n async _importRawKey(key, isPublic) {\n if (isPublic && key.byteLength !== this._nPk) {\n throw new Error(\"Invalid public key for the ciphersuite\");\n }\n if (!isPublic && key.byteLength !== this._nSk) {\n throw new Error(\"Invalid private key for the ciphersuite\");\n }\n if (isPublic) {\n return await this._api.importKey(\"raw\", key, this._alg, true, []);\n }\n return await this._deserializePkcs8Key(new Uint8Array(key));\n }\n async _importJWK(key, isPublic) {\n if (typeof key.crv === \"undefined\" || key.crv !== this._alg.namedCurve) {\n throw new Error(`Invalid crv: ${key.crv}`);\n }\n if (isPublic) {\n if (typeof key.d !== \"undefined\") {\n throw new Error(\"Invalid key: `d` should not be set\");\n }\n return await this._api.importKey(\"jwk\", key, this._alg, true, []);\n }\n if (typeof key.d === \"undefined\") {\n throw new Error(\"Invalid key: `d` not found\");\n }\n return await this._api.importKey(\"jwk\", key, this._alg, true, KEM_USAGES);\n }\n async _deserializePkcs8Key(k) {\n const pkcs8Key = new Uint8Array(this._pkcs8AlgId.length + k.length);\n pkcs8Key.set(this._pkcs8AlgId, 0);\n pkcs8Key.set(k, this._pkcs8AlgId.length);\n return await this._api.importKey(\"pkcs8\", pkcs8Key, this._alg, true, KEM_USAGES);\n }\n async _derivePublicKeyWithoutJwkExport(key) {\n const basePointRaw = buildRawUncompressedPublicKey(this._curveParams.gx, this._curveParams.gy, this._curveParams.coordinateSize);\n const basePoint = await this._api.importKey(\"raw\", basePointRaw.buffer, this._alg, true, []);\n const xBytes = new Uint8Array(await this._api.deriveBits({\n name: \"ECDH\",\n public: basePoint,\n }, key, this._nDh * 8));\n const p = this._curveParams.p;\n const x = bytesToBigInt(xBytes);\n const rhs = mod(modPow(x, 3n, p) - 3n * x + this._curveParams.b, p);\n let y = modSqrt(rhs, p);\n // Canonicalize sign so the encoded point is deterministic.\n if ((y & 1n) === 1n) {\n y = p - y;\n }\n const pubRaw = buildRawUncompressedPublicKey(x, y, this._curveParams.coordinateSize);\n return await this._api.importKey(\"raw\", pubRaw.buffer, this._alg, true, []);\n }\n}\n","export class XCryptoKey {\n constructor(name, key, type, usages = []) {\n Object.defineProperty(this, \"key\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"type\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"extractable\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: true\n });\n Object.defineProperty(this, \"algorithm\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"usages\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n this.key = key;\n this.type = type;\n this.algorithm = { name: name };\n this.usages = usages;\n if (type === \"public\") {\n this.usages = [];\n }\n }\n}\n","import { EMPTY } from \"../../consts.js\";\nimport { DeriveKeyPairError, DeserializeError, NotSupportedError, SerializeError, } from \"../../errors.js\";\nimport { toArrayBuffer } from \"../../kdfs/hkdf.js\";\nimport { KEM_USAGES, LABEL_DKP_PRK, LABEL_SK, } from \"../../interfaces/dhkemPrimitives.js\";\nimport { base64UrlToBytes } from \"../../utils/misc.js\";\nimport { XCryptoKey } from \"../../xCryptoKey.js\";\n/**\n * Base DhkemPrimitives implementation for Montgomery curves (X25519/X448).\n *\n * Subclasses pass curve-specific parameters (algorithm name, key size, curve)\n * and optionally add extra methods (e.g., raw derive for X25519).\n */\nexport class XCurveDhkemPrimitives {\n constructor(algName, keySize, curve, hkdf) {\n Object.defineProperty(this, \"_algName\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_curve\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_hkdf\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_nPk\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_nSk\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n this._algName = algName;\n this._nPk = keySize;\n this._nSk = keySize;\n this._curve = curve;\n this._hkdf = hkdf;\n }\n serializePublicKey(key) {\n try {\n return Promise.resolve(key.key.buffer);\n }\n catch (e) {\n return Promise.reject(new SerializeError(e));\n }\n }\n async deserializePublicKey(key) {\n try {\n return await this._importRawKey(toArrayBuffer(key), true);\n }\n catch (e) {\n throw new DeserializeError(e);\n }\n }\n serializePrivateKey(key) {\n try {\n return Promise.resolve(key.key.buffer);\n }\n catch (e) {\n return Promise.reject(new SerializeError(e));\n }\n }\n async deserializePrivateKey(key) {\n try {\n return await this._importRawKey(toArrayBuffer(key), false);\n }\n catch (e) {\n throw new DeserializeError(e);\n }\n }\n async importKey(format, key, isPublic) {\n try {\n if (format === \"raw\") {\n return await this._importRawKey(key, isPublic);\n }\n // jwk\n if (key instanceof ArrayBuffer) {\n throw new Error(\"Invalid jwk key format\");\n }\n return await this._importJWK(key, isPublic);\n }\n catch (e) {\n throw new DeserializeError(e);\n }\n }\n async generateKeyPair() {\n try {\n const rawSk = await this._curve.utils.randomSecretKey();\n const sk = new XCryptoKey(this._algName, rawSk, \"private\", KEM_USAGES);\n const pk = await this.derivePublicKey(sk);\n return { publicKey: pk, privateKey: sk };\n }\n catch (e) {\n throw new NotSupportedError(e);\n }\n }\n async deriveKeyPair(ikm) {\n try {\n const rawIkm = toArrayBuffer(ikm);\n const dkpPrk = await this._hkdf.labeledExtract(EMPTY.buffer, LABEL_DKP_PRK, new Uint8Array(rawIkm));\n const rawSk = await this._hkdf.labeledExpand(dkpPrk, LABEL_SK, EMPTY, this._nSk);\n const sk = new XCryptoKey(this._algName, new Uint8Array(rawSk), \"private\", KEM_USAGES);\n return {\n privateKey: sk,\n publicKey: await this.derivePublicKey(sk),\n };\n }\n catch (e) {\n throw new DeriveKeyPairError(e);\n }\n }\n derivePublicKey(key) {\n try {\n const pk = this._curve.getPublicKey(key.key);\n return Promise.resolve(new XCryptoKey(this._algName, pk, \"public\"));\n }\n catch (e) {\n return Promise.reject(new DeserializeError(e));\n }\n }\n dh(sk, pk) {\n try {\n return Promise.resolve(this._curve.getSharedSecret(sk.key, pk.key).buffer);\n }\n catch (e) {\n return Promise.reject(new SerializeError(e));\n }\n }\n _importRawKey(key, isPublic) {\n return new Promise((resolve, reject) => {\n if (isPublic && key.byteLength !== this._nPk) {\n reject(new Error(\"Invalid length of the key\"));\n }\n if (!isPublic && key.byteLength !== this._nSk) {\n reject(new Error(\"Invalid length of the key\"));\n }\n resolve(new XCryptoKey(this._algName, new Uint8Array(key), isPublic ? \"public\" : \"private\", isPublic ? [] : KEM_USAGES));\n });\n }\n _importJWK(key, isPublic) {\n return new Promise((resolve, reject) => {\n if (key.kty !== \"OKP\") {\n reject(new Error(`Invalid kty: ${key.kty}`));\n }\n if (key.crv !== this._algName) {\n reject(new Error(`Invalid crv: ${key.crv}`));\n }\n if (isPublic) {\n if (typeof key.d !== \"undefined\") {\n reject(new Error(\"Invalid key: `d` should not be set\"));\n }\n if (typeof key.x !== \"string\") {\n reject(new Error(\"Invalid key: `x` not found\"));\n }\n resolve(new XCryptoKey(this._algName, base64UrlToBytes(key.x), \"public\"));\n }\n else {\n if (typeof key.d !== \"string\") {\n reject(new Error(\"Invalid key: `d` not found\"));\n }\n resolve(new XCryptoKey(this._algName, base64UrlToBytes(key.d), \"private\", KEM_USAGES));\n }\n });\n }\n}\n","// deno-lint-ignore-file no-explicit-any\n/**\n * This file is based on noble-curves (https://github.com/paulmillr/noble-curves).\n *\n * noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com)\n *\n * The original file is located at:\n * https://github.com/paulmillr/noble-curves/blob/b9d49d2b41d550571a0c5be443ecb62109fa3373/src/utils.ts\n */\n/**\n * Hex, bytes and number utilities.\n * @module\n */\nimport { loadCrypto } from \"./misc.js\";\nimport { N_0 } from \"../consts.js\";\n/** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */\nexport function isBytes(a) {\n return a instanceof Uint8Array ||\n (ArrayBuffer.isView(a) && a.constructor.name === \"Uint8Array\");\n}\n/** Asserts something is positive integer. */\nexport function anumber(n, title = \"\") {\n if (!Number.isSafeInteger(n) || n < 0) {\n const prefix = title && `\"${title}\" `;\n throw new Error(`${prefix}expected integer >0, got ${n}`);\n }\n}\n/** Asserts something is Uint8Array. */\nexport function abytes(value, length, title = \"\") {\n const bytes = isBytes(value);\n const len = value?.length;\n const needsLen = length !== undefined;\n if (!bytes || (needsLen && len !== length)) {\n const prefix = title && `\"${title}\" `;\n const ofLen = needsLen ? ` of length ${length}` : \"\";\n const got = bytes ? `length=${len}` : `type=${typeof value}`;\n throw new Error(prefix + \"expected Uint8Array\" + ofLen + \", got \" + got);\n }\n return value;\n}\n// ahash function is now imported from ../hash/hash.ts\n/** Asserts a hash instance has not been destroyed / finished */\nexport function aexists(instance, checkFinished = true) {\n if (instance.destroyed)\n throw new Error(\"Hash instance has been destroyed\");\n if (checkFinished && instance.finished) {\n throw new Error(\"Hash#digest() has already been called\");\n }\n}\n/** Asserts output is properly-sized byte array */\nexport function aoutput(out, instance) {\n abytes(out, undefined, \"digestInto() output\");\n const min = instance.outputLen;\n if (out.length < min) {\n throw new Error('\"digestInto() output\" expected to be of length >=' + min);\n }\n}\n// Used in weierstrass, der\nfunction abignumer(n) {\n if (typeof n === \"bigint\") {\n if (!isPosBig(n))\n throw new Error(\"positive bigint expected, got \" + n);\n }\n else\n anumber(n);\n return n;\n}\n/** Cast u8 / u16 / u32 to u32. */\nexport function u32(arr) {\n return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));\n}\n/** Zeroize a byte array. Warning: JS provides no guarantees. */\nexport function clean(...arrays) {\n for (let i = 0; i < arrays.length; i++) {\n arrays[i].fill(0);\n }\n}\n/** Pre-computed buffer for endianness detection */\nconst _endianTestBuffer = /* @__PURE__ */ new Uint32Array([0x11223344]);\nconst _endianTestBytes = /* @__PURE__ */ new Uint8Array(_endianTestBuffer.buffer);\n/** Is current platform little-endian? Most are. Big-Endian platform: IBM */\nexport const isLE = /* @__PURE__ */ _endianTestBytes[0] === 0x44;\n/** The byte swap operation for uint32 */\nexport function byteSwap(word) {\n return (((word << 24) & 0xff000000) |\n ((word << 8) & 0xff0000) |\n ((word >>> 8) & 0xff00) |\n ((word >>> 24) & 0xff));\n}\n/** Conditionally byte swap if on a big-endian platform */\nexport function swap8IfBE(n) {\n return isLE ? n : byteSwap(n);\n}\n/** @deprecated */\nexport const byteSwapIfBE = swap8IfBE;\n/** In place byte swap for Uint32Array */\nexport function byteSwap32(arr) {\n for (let i = 0; i < arr.length; i++) {\n arr[i] = byteSwap(arr[i]);\n }\n return arr;\n}\nexport function swap32IfBE(u) {\n return isLE ? u : byteSwap32(u);\n}\n/** Create DataView of an array for easy byte-level manipulation. */\nexport function createView(arr) {\n return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/** The rotate right (circular right shift) operation for uint32 */\nexport function rotr(word, shift) {\n return (word << (32 - shift)) | (word >>> shift);\n}\n// Built-in hex conversion https://caniuse.com/mdn-javascript_builtins_uint8array_fromhex\nconst hasHexBuiltin = /* @__PURE__ */ (() => \n// @ts-ignore: to use toHex\ntypeof Uint8Array.from([]).toHex === \"function\" &&\n // @ts-ignore: to use fromHex\n typeof Uint8Array.fromHex === \"function\")();\n// Array where index 0xf0 (240) is mapped to string 'f0'\nconst hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, \"0\"));\nconst HEX_TO_BIGINT = /* @__PURE__ */ [\n 0n,\n 1n,\n 2n,\n 3n,\n 4n,\n 5n,\n 6n,\n 7n,\n 8n,\n 9n,\n 10n,\n 11n,\n 12n,\n 13n,\n 14n,\n 15n,\n];\n/**\n * Convert byte array to hex string. Uses built-in function, when available.\n * @example bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])) // 'cafe0123'\n */\nexport function bytesToHex(bytes) {\n abytes(bytes);\n // @ts-ignore: to use toHex\n if (hasHexBuiltin)\n return bytes.toHex();\n // pre-caching improves the speed 6x\n let hex = \"\";\n for (let i = 0; i < bytes.length; i++) {\n hex += hexes[bytes[i]];\n }\n return hex;\n}\n// We use optimized technique to convert hex string to byte array\nconst asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };\nfunction asciiToBase16(ch) {\n if (ch >= asciis._0 && ch <= asciis._9)\n return ch - asciis._0; // '2' => 50-48\n if (ch >= asciis.A && ch <= asciis.F)\n return ch - (asciis.A - 10); // 'B' => 66-(65-10)\n if (ch >= asciis.a && ch <= asciis.f)\n return ch - (asciis.a - 10); // 'b' => 98-(97-10)\n return;\n}\n/**\n * Convert hex string to byte array. Uses built-in function, when available.\n * @example hexToBytes('cafe0123') // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])\n */\nexport function hexToBytes(hex) {\n if (typeof hex !== \"string\") {\n throw new Error(\"hex string expected, got \" + typeof hex);\n }\n // @ts-ignore: to use fromHex\n if (hasHexBuiltin)\n return Uint8Array.fromHex(hex);\n const hl = hex.length;\n const al = hl / 2;\n if (hl % 2) {\n throw new Error(\"hex string expected, got unpadded hex of length \" + hl);\n }\n const array = new Uint8Array(al);\n for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {\n const n1 = asciiToBase16(hex.charCodeAt(hi));\n const n2 = asciiToBase16(hex.charCodeAt(hi + 1));\n if (n1 === undefined || n2 === undefined) {\n const char = hex[hi] + hex[hi + 1];\n throw new Error('hex string expected, got non-hex character \"' + char + '\" at index ' +\n hi);\n }\n array[ai] = n1 * 16 + n2; // multiply first octet, e.g. 'a3' => 10*16+3 => 160 + 3 => 163\n }\n return array;\n}\n/**\n * Converts string to bytes using UTF8 encoding.\n * @example utf8ToBytes('abc') // Uint8Array.from([97, 98, 99])\n */\nexport function utf8ToBytes(str) {\n if (typeof str !== \"string\")\n throw new Error(\"string expected\");\n return new Uint8Array(new TextEncoder().encode(str)); // https://bugzil.la/1681809\n}\n/**\n * Converts bytes to string using UTF8 encoding.\n * @example bytesToUtf8(Uint8Array.from([97, 98, 99])) // 'abc'\n */\nexport function bytesToUtf8(bytes) {\n return new TextDecoder().decode(bytes);\n}\nexport function numberToHexUnpadded(num) {\n const hex = abignumer(num).toString(16);\n return hex.length & 1 ? \"0\" + hex : hex;\n}\nexport function hexToNumber(hex) {\n if (typeof hex !== \"string\") {\n throw new Error(\"hex string expected, got \" + typeof hex);\n }\n let out = N_0;\n for (let i = 0; i < hex.length; i++) {\n const n = asciiToBase16(hex.charCodeAt(i));\n if (n === undefined) {\n throw new Error('hex string expected, got non-hex character \"' + hex[i] +\n '\" at index ' + i);\n }\n out = (out << 4n) | HEX_TO_BIGINT[n];\n }\n return out; // Big Endian\n}\nexport function numberToBigint(num) {\n anumber(num, \"numberToBigint\");\n let n = num;\n let out = N_0;\n let bit = 1n;\n while (n > 0) {\n if (n % 2 === 1)\n out += bit;\n n = Math.floor(n / 2);\n bit <<= 1n;\n }\n return out;\n}\n// BE: Big Endian, LE: Little Endian\nexport function bytesToNumberBE(bytes) {\n return hexToNumber(bytesToHex(bytes));\n}\nexport function bytesToNumberLE(bytes) {\n return hexToNumber(bytesToHex(copyBytes(abytes(bytes)).reverse()));\n}\nexport function numberToBytesBE(n, len) {\n anumber(len);\n n = abignumer(n);\n const res = hexToBytes(n.toString(16).padStart(len * 2, \"0\"));\n if (res.length !== len)\n throw new Error(\"number too large\");\n return res;\n}\nexport function numberToBytesLE(n, len) {\n return numberToBytesBE(n, len).reverse();\n}\n/**\n * Copies Uint8Array. We can't use u8a.slice(), because u8a can be Buffer,\n * and Buffer#slice creates mutable copy. Never use Buffers!\n */\nexport function copyBytes(bytes) {\n return Uint8Array.from(bytes);\n}\n/** Copies several Uint8Arrays into one. */\nexport function concatBytes(...arrays) {\n let sum = 0;\n for (let i = 0; i < arrays.length; i++) {\n const a = arrays[i];\n abytes(a);\n sum += a.length;\n }\n const res = new Uint8Array(sum);\n for (let i = 0, pad = 0; i < arrays.length; i++) {\n const a = arrays[i];\n res.set(a, pad);\n pad += a.length;\n }\n return res;\n}\n/**\n * Decodes 7-bit ASCII string to Uint8Array, throws on non-ascii symbols\n * Should be safe to use for things expected to be ASCII.\n * Returns exact same result as utf8ToBytes for ASCII or throws.\n */\nexport function asciiToBytes(ascii) {\n return Uint8Array.from(ascii, (c, i) => {\n const charCode = c.charCodeAt(0);\n if (c.length !== 1 || charCode > 127) {\n throw new Error(`string contains non-ASCII character \"${ascii[i]}\" with code ${charCode} at position ${i}`);\n }\n return charCode;\n });\n}\n// Is positive bigint\nfunction isPosBig(n) {\n return typeof n === \"bigint\" && N_0 <= n;\n}\nexport function inRange(n, min, max) {\n return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;\n}\n/**\n * Asserts min <= n < max. NOTE: It's < max and not <= max.\n * @example\n * aInRange('x', x, 1n, 256n); // would assume x is in (1n..255n)\n */\nexport function aInRange(title, n, min, max) {\n // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)?\n // consider P=256n, min=0n, max=P\n // - a for min=0 would require -1: `inRange('x', x, -1n, P)`\n // - b would commonly require subtraction: `inRange('x', x, 0n, P - 1n)`\n // - our way is the cleanest: `inRange('x', x, 0n, P)\n if (!inRange(n, min, max)) {\n throw new Error(\"expected valid \" + title + \": \" + min + \" <= n < \" + max + \", got \" + n);\n }\n}\nexport function validateObject(object, fields = {}, optFields = {}) {\n if (!object || typeof object !== \"object\") {\n throw new Error(\"expected valid options object\");\n }\n function checkField(fieldName, expectedType, isOpt) {\n const val = object[fieldName];\n if (isOpt && val === undefined)\n return;\n const current = typeof val;\n if (current !== expectedType || val === null) {\n throw new Error(`param \"${fieldName}\" is invalid: expected ${expectedType}, got ${current}`);\n }\n }\n const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));\n iter(fields, false);\n iter(optFields, true);\n}\n// createHasher function is now exported above with ahash\n// /** Cryptographically secure PRNG. Uses internal OS-level `crypto.getRandomValues`. */\n// export function randomBytes(bytesLength = 32): Uint8Array {\n// const cr = typeof globalThis != null && (globalThis as any).crypto;\n// if (!cr || typeof cr.getRandomValues !== \"function\") {\n// throw new Error(\"crypto.getRandomValues must be defined\");\n// }\n// return cr.getRandomValues(new Uint8Array(bytesLength));\n// }\n/** Cryptographically secure PRNG. Uses internal OS-level `crypto.getRandomValues`. */\nexport async function randomBytesAsync(bytesLength = 32) {\n const api = await loadCrypto();\n const rnd = new Uint8Array(bytesLength);\n api.getRandomValues(rnd);\n return rnd;\n}\n// 06 09 60 86 48 01 65 03 04 02\nexport function oidNist(suffix) {\n return {\n oid: Uint8Array.from([\n 0x06,\n 0x09,\n 0x60,\n 0x86,\n 0x48,\n 0x01,\n 0x65,\n 0x03,\n 0x04,\n 0x02,\n suffix,\n ]),\n };\n}\n","/**\n * This file is based on noble-curves (https://github.com/paulmillr/noble-curves).\n *\n * noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com)\n *\n * The original file is located at:\n * https://github.com/paulmillr/noble-curves/blob/b9d49d2b41d550571a0c5be443ecb62109fa3373/src/utils.ts\n */\n/**\n * Hash utilities and type definitions extracted from noble.ts\n * @module\n */\nimport { anumber } from \"../utils/noble.js\";\n/** Asserts something is hash */\nexport function ahash(h) {\n if (typeof h !== \"function\" || typeof h.create !== \"function\") {\n throw new Error(\"Hash must wrapped by utils.createHasher\");\n }\n anumber(h.outputLen);\n anumber(h.blockLen);\n}\nexport function createHasher(hashCons, info = {}) {\n const hashFn = (msg, opts) => hashCons(opts).update(msg).digest();\n const tmp = hashCons(undefined);\n const hashC = Object.assign(hashFn, {\n outputLen: tmp.outputLen,\n blockLen: tmp.blockLen,\n create: (opts) => hashCons(opts),\n ...info,\n });\n return Object.freeze(hashC);\n}\n","// deno-lint-ignore-file no-explicit-any\n/**\n * This file is based on noble-hashes (https://github.com/paulmillr/noble-hashes).\n *\n * noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com)\n *\n * The original file is located at:\n * https://github.com/paulmillr/noble-hashes/blob/2e0c00e1aa134082ba1380bf3afb8b1641f60fed/src/hmac.ts\n */\n/**\n * HMAC: RFC2104 message authentication code.\n * @module\n */\nimport { abytes, aexists, clean } from \"../utils/noble.js\";\nimport { ahash } from \"./hash.js\";\nexport class _HMAC {\n constructor(hash, key) {\n Object.defineProperty(this, \"oHash\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"iHash\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"blockLen\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"outputLen\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"finished\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: false\n });\n Object.defineProperty(this, \"destroyed\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: false\n });\n ahash(hash);\n abytes(key, undefined, \"key\");\n this.iHash = hash.create();\n if (typeof this.iHash.update !== \"function\") {\n throw new Error(\"Expected instance of class which extends utils.Hash\");\n }\n this.blockLen = this.iHash.blockLen;\n this.outputLen = this.iHash.outputLen;\n const blockLen = this.blockLen;\n const pad = new Uint8Array(blockLen);\n // blockLen can be bigger than outputLen\n pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);\n for (let i = 0; i < pad.length; i++)\n pad[i] ^= 0x36;\n this.iHash.update(pad);\n // By doing update (processing of first block) of outer hash here we can re-use it between multiple calls via clone\n this.oHash = hash.create();\n // Undo internal XOR && apply outer XOR\n for (let i = 0; i < pad.length; i++)\n pad[i] ^= 0x36 ^ 0x5c;\n this.oHash.update(pad);\n clean(pad);\n }\n update(buf) {\n aexists(this);\n this.iHash.update(buf);\n return this;\n }\n digestInto(out) {\n aexists(this);\n abytes(out, this.outputLen, \"output\");\n this.finished = true;\n this.iHash.digestInto(out);\n this.oHash.update(out);\n this.oHash.digestInto(out);\n this.destroy();\n }\n digest() {\n const out = new Uint8Array(this.oHash.outputLen);\n this.digestInto(out);\n return out;\n }\n _cloneInto(to) {\n // Create new instance without calling constructor since key already in state and we don't know it.\n to ||= Object.create(Object.getPrototypeOf(this), {});\n const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;\n to = to;\n to.finished = finished;\n to.destroyed = destroyed;\n to.blockLen = blockLen;\n to.outputLen = outputLen;\n to.oHash = oHash._cloneInto(to.oHash);\n to.iHash = iHash._cloneInto(to.iHash);\n return to;\n }\n clone() {\n return this._cloneInto();\n }\n destroy() {\n this.destroyed = true;\n this.oHash.destroy();\n this.iHash.destroy();\n }\n}\n/**\n * HMAC: RFC2104 message authentication code.\n * @param hash - function that would be used e.g. sha256\n * @param key - message key\n * @param message - message data\n * @example\n * import { hmac } from '@noble/hashes/hmac';\n * import { sha256 } from '@noble/hashes/sha2';\n * const mac1 = hmac(sha256, 'key', 'message');\n */\nexport const hmac = (hash, key, message) => new _HMAC(hash, key).update(message).digest();\nhmac.create = (hash, key) => new _HMAC(hash, key);\n","// deno-lint-ignore-file no-explicit-any\n/**\n * This file is based on noble-hashes (https://github.com/paulmillr/noble-hashes).\n *\n * noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com)\n *\n * The original file is located at:\n * https://github.com/paulmillr/noble-hashes/blob/2e0c00e1aa134082ba1380bf3afb8b1641f60fed/src/_md.ts\n */\n/**\n * Internal Merkle-Damgard hash utils.\n * @module\n */\nimport { abytes, aexists, aoutput, clean, createView, numberToBigint, } from \"../utils/noble.js\";\n/** Choice: a ? b : c */\nexport function Chi(a, b, c) {\n return (a & b) ^ (~a & c);\n}\n/** Majority function, true if any two inputs is true. */\nexport function Maj(a, b, c) {\n return (a & b) ^ (a & c) ^ (b & c);\n}\n/**\n * Merkle-Damgard hash construction base class.\n * Could be used to create MD5, RIPEMD, SHA1, SHA2.\n */\nexport class HashMD {\n constructor(blockLen, outputLen, padOffset, isLE) {\n Object.defineProperty(this, \"blockLen\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"outputLen\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"padOffset\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"isLE\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n // For partial updates less than block size\n Object.defineProperty(this, \"buffer\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"view\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"finished\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: false\n });\n Object.defineProperty(this, \"length\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 0\n });\n Object.defineProperty(this, \"pos\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 0\n });\n Object.defineProperty(this, \"destroyed\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: false\n });\n this.blockLen = blockLen;\n this.outputLen = outputLen;\n this.padOffset = padOffset;\n this.isLE = isLE;\n this.buffer = new Uint8Array(blockLen);\n this.view = createView(this.buffer);\n }\n update(data) {\n aexists(this);\n abytes(data);\n const { view, buffer, blockLen } = this;\n const len = data.length;\n for (let pos = 0; pos < len;) {\n const take = Math.min(blockLen - this.pos, len - pos);\n // Fast path: we have at least one block in input, cast it to view and process\n if (take === blockLen) {\n const dataView = createView(data);\n for (; blockLen <= len - pos; pos += blockLen) {\n this.process(dataView, pos);\n }\n continue;\n }\n buffer.set(data.subarray(pos, pos + take), this.pos);\n this.pos += take;\n pos += take;\n if (this.pos === blockLen) {\n this.process(view, 0);\n this.pos = 0;\n }\n }\n this.length += data.length;\n this.roundClean();\n return this;\n }\n digestInto(out) {\n aexists(this);\n aoutput(out, this);\n this.finished = true;\n // Padding\n // We can avoid allocation of buffer for padding completely if it\n // was previously not allocated here. But it won't change performance.\n const { buffer, view, blockLen, isLE } = this;\n let { pos } = this;\n // append the bit '1' to the message\n buffer[pos++] = 0b10000000;\n clean(this.buffer.subarray(pos));\n // we have less than padOffset left in buffer, so we cannot put length in\n // current block, need process it and pad again\n if (this.padOffset > blockLen - pos) {\n this.process(view, 0);\n pos = 0;\n }\n // Pad until full block byte with zeros\n for (let i = pos; i < blockLen; i++)\n buffer[i] = 0;\n // Note: sha512 requires length to be 128bit integer, but length in JS will overflow before that\n // You need to write around 2 exabytes (u64_max / 8 / (1024**6)) for this to happen.\n // So we just write lowest 64 bits of that value.\n view.setBigUint64(blockLen - 8, numberToBigint(this.length * 8), isLE);\n this.process(view, 0);\n const oview = createView(out);\n const len = this.outputLen;\n // NOTE: we do division by 4 later, which must be fused in single op with modulo by JIT\n if (len % 4)\n throw new Error(\"_sha2: outputLen must be aligned to 32bit\");\n const outLen = len / 4;\n const state = this.get();\n if (outLen > state.length) {\n throw new Error(\"_sha2: outputLen bigger than state\");\n }\n for (let i = 0; i < outLen; i++)\n oview.setUint32(4 * i, state[i], isLE);\n }\n digest() {\n const { buffer, outputLen } = this;\n this.digestInto(buffer);\n const res = buffer.slice(0, outputLen);\n this.destroy();\n return res;\n }\n _cloneInto(to) {\n to ||= new this.constructor();\n to.set(...this.get());\n const { blockLen, buffer, length, finished, destroyed, pos } = this;\n to.destroyed = destroyed;\n to.finished = finished;\n to.length = length;\n to.pos = pos;\n if (length % blockLen)\n to.buffer.set(buffer);\n return to;\n }\n clone() {\n return this._cloneInto();\n }\n}\n/**\n * Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.\n * Check out `test/misc/sha2-gen-iv.js` for recomputation guide.\n */\n/** Initial SHA256 state. Bits 0..32 of frac part of sqrt of primes 2..19 */\nexport const SHA256_IV = /* @__PURE__ */ Uint32Array.from([\n 0x6a09e667,\n 0xbb67ae85,\n 0x3c6ef372,\n 0xa54ff53a,\n 0x510e527f,\n 0x9b05688c,\n 0x1f83d9ab,\n 0x5be0cd19,\n]);\n/** Initial SHA384 state. Bits 0..64 of frac part of sqrt of primes 23..53 */\nexport const SHA384_IV = /* @__PURE__ */ Uint32Array.from([\n 0xcbbb9d5d,\n 0xc1059ed8,\n 0x629a292a,\n 0x367cd507,\n 0x9159015a,\n 0x3070dd17,\n 0x152fecd8,\n 0xf70e5939,\n 0x67332667,\n 0xffc00b31,\n 0x8eb44a87,\n 0x68581511,\n 0xdb0c2e0d,\n 0x64f98fa7,\n 0x47b5481d,\n 0xbefa4fa4,\n]);\n/** Initial SHA512 state. Bits 0..64 of frac part of sqrt of primes 2..19 */\nexport const SHA512_IV = /* @__PURE__ */ Uint32Array.from([\n 0x6a09e667,\n 0xf3bcc908,\n 0xbb67ae85,\n 0x84caa73b,\n 0x3c6ef372,\n 0xfe94f82b,\n 0xa54ff53a,\n 0x5f1d36f1,\n 0x510e527f,\n 0xade682d1,\n 0x9b05688c,\n 0x2b3e6c1f,\n 0x1f83d9ab,\n 0xfb41bd6b,\n 0x5be0cd19,\n 0x137e2179,\n]);\n","/**\n * This file is based on noble-hashes (https://github.com/paulmillr/noble-hashes).\n *\n * noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com)\n *\n * The original file is located at:\n * https://github.com/paulmillr/noble-hashes/blob/4e358a46d682adfb005ae6314ec999f2513086b9/src/_u64.ts\n */\n/**\n * Internal helpers for u64. BigUint64Array is too slow as per 2025, so we implement it using Uint32Array.\n * @todo re-check https://issues.chromium.org/issues/42212588\n * @module\n */\nconst U32_MASK64 = 0xffffffffn;\nconst _32n = 32n;\nfunction fromBig(n, le = false) {\n if (le) {\n return { h: Number(n & U32_MASK64), l: Number((n >> _32n) & U32_MASK64) };\n }\n return {\n h: Number((n >> _32n) & U32_MASK64) | 0,\n l: Number(n & U32_MASK64) | 0,\n };\n}\nfunction split(lst, le = false) {\n const len = lst.length;\n const Ah = new Uint32Array(len);\n const Al = new Uint32Array(len);\n for (let i = 0; i < len; i++) {\n const { h, l } = fromBig(lst[i], le);\n [Ah[i], Al[i]] = [h, l];\n }\n return [Ah, Al];\n}\nconst toBig = (h, l) => (BigInt(h >>> 0) << _32n) | BigInt(l >>> 0);\n// for Shift in [0, 32)\nconst shrSH = (h, _l, s) => h >>> s;\nconst shrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);\n// Right rotate for Shift in [1, 32)\nconst rotrSH = (h, l, s) => (h >>> s) | (l << (32 - s));\nconst rotrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);\n// Right rotate for Shift in (32, 64), NOTE: 32 is special case.\nconst rotrBH = (h, l, s) => (h << (64 - s)) | (l >>> (s - 32));\nconst rotrBL = (h, l, s) => (h >>> (s - 32)) | (l << (64 - s));\n// Right rotate for shift===32 (just swaps l&h)\nconst rotr32H = (_h, l) => l;\nconst rotr32L = (h, _l) => h;\n// Left rotate for Shift in [1, 32)\nconst rotlSH = (h, l, s) => (h << s) | (l >>> (32 - s));\nconst rotlSL = (h, l, s) => (l << s) | (h >>> (32 - s));\n// Left rotate for Shift in (32, 64), NOTE: 32 is special case.\nconst rotlBH = (h, l, s) => (l << (s - 32)) | (h >>> (64 - s));\nconst rotlBL = (h, l, s) => (h << (s - 32)) | (l >>> (64 - s));\n// JS uses 32-bit signed integers for bitwise operations which means we cannot\n// simple take carry out of low bit sum by shift, we need to use division.\nfunction add(Ah, Al, Bh, Bl) {\n const l = (Al >>> 0) + (Bl >>> 0);\n return { h: (Ah + Bh + ((l / 2 ** 32) | 0)) | 0, l: l | 0 };\n}\n// Addition with more than 2 elements\nconst add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);\nconst add3H = (low, Ah, Bh, Ch) => (Ah + Bh + Ch + ((low / 2 ** 32) | 0)) | 0;\nconst add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);\nconst add4H = (low, Ah, Bh, Ch, Dh) => (Ah + Bh + Ch + Dh + ((low / 2 ** 32) | 0)) | 0;\nconst add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);\nconst add5H = (low, Ah, Bh, Ch, Dh, Eh) => (Ah + Bh + Ch + Dh + Eh + ((low / 2 ** 32) | 0)) | 0;\n// prettier-ignore\nexport { add, add3H, add3L, add4H, add4L, add5H, add5L, fromBig, rotlBH, rotlBL, rotlSH, rotlSL, rotr32H, rotr32L, rotrBH, rotrBL, rotrSH, rotrSL, shrSH, shrSL, split, toBig, };\n// prettier-ignore\nconst u64 = {\n fromBig,\n split,\n toBig,\n shrSH,\n shrSL,\n rotrSH,\n rotrSL,\n rotrBH,\n rotrBL,\n rotr32H,\n rotr32L,\n rotlSH,\n rotlSL,\n rotlBH,\n rotlBL,\n add,\n add3L,\n add3H,\n add4L,\n add4H,\n add5H,\n add5L,\n};\nexport default u64;\n","/**\n * This file is based on noble-hashes (https://github.com/paulmillr/noble-hashes).\n *\n * noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com)\n *\n * The original file is located at:\n * https://github.com/paulmillr/noble-hashes/blob/2e0c00e1aa134082ba1380bf3afb8b1641f60fed/src/sha2.ts\n */\n/**\n * SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.\n * SHA256 is the fastest hash implementable in JS, even faster than Blake3.\n * Check out [RFC 4634](https://www.rfc-editor.org/rfc/rfc4634) and\n * [FIPS 180-4](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf).\n * @module\n */\nimport { Chi, HashMD, Maj, SHA256_IV, SHA384_IV, SHA512_IV } from \"./md.js\";\nimport * as u64 from \"./u64.js\";\nimport { clean, oidNist, rotr } from \"../utils/noble.js\";\nimport { createHasher } from \"./hash.js\";\n/**\n * Round constants:\n * First 32 bits of fractional parts of the cube roots of the first 64 primes 2..311)\n */\nconst SHA256_K = /* @__PURE__ */ Uint32Array.from([\n 0x428a2f98,\n 0x71374491,\n 0xb5c0fbcf,\n 0xe9b5dba5,\n 0x3956c25b,\n 0x59f111f1,\n 0x923f82a4,\n 0xab1c5ed5,\n 0xd807aa98,\n 0x12835b01,\n 0x243185be,\n 0x550c7dc3,\n 0x72be5d74,\n 0x80deb1fe,\n 0x9bdc06a7,\n 0xc19bf174,\n 0xe49b69c1,\n 0xefbe4786,\n 0x0fc19dc6,\n 0x240ca1cc,\n 0x2de92c6f,\n 0x4a7484aa,\n 0x5cb0a9dc,\n 0x76f988da,\n 0x983e5152,\n 0xa831c66d,\n 0xb00327c8,\n 0xbf597fc7,\n 0xc6e00bf3,\n 0xd5a79147,\n 0x06ca6351,\n 0x14292967,\n 0x27b70a85,\n 0x2e1b2138,\n 0x4d2c6dfc,\n 0x53380d13,\n 0x650a7354,\n 0x766a0abb,\n 0x81c2c92e,\n 0x92722c85,\n 0xa2bfe8a1,\n 0xa81a664b,\n 0xc24b8b70,\n 0xc76c51a3,\n 0xd192e819,\n 0xd6990624,\n 0xf40e3585,\n 0x106aa070,\n 0x19a4c116,\n 0x1e376c08,\n 0x2748774c,\n 0x34b0bcb5,\n 0x391c0cb3,\n 0x4ed8aa4a,\n 0x5b9cca4f,\n 0x682e6ff3,\n 0x748f82ee,\n 0x78a5636f,\n 0x84c87814,\n 0x8cc70208,\n 0x90befffa,\n 0xa4506ceb,\n 0xbef9a3f7,\n 0xc67178f2,\n]);\n/** Reusable temporary buffer. \"W\" comes straight from spec. */\nconst SHA256_W = /* @__PURE__ */ new Uint32Array(64);\n/** Internal 32-byte base SHA2 hash class. */\nclass SHA2_32B extends HashMD {\n constructor(outputLen) {\n super(64, outputLen, 8, false);\n }\n get() {\n const { A, B, C, D, E, F, G, H } = this;\n return [A, B, C, D, E, F, G, H];\n }\n set(A, B, C, D, E, F, G, H) {\n this.A = A | 0;\n this.B = B | 0;\n this.C = C | 0;\n this.D = D | 0;\n this.E = E | 0;\n this.F = F | 0;\n this.G = G | 0;\n this.H = H | 0;\n }\n process(view, offset) {\n // Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array\n for (let i = 0; i < 16; i++, offset += 4) {\n SHA256_W[i] = view.getUint32(offset, false);\n }\n for (let i = 16; i < 64; i++) {\n const W15 = SHA256_W[i - 15];\n const W2 = SHA256_W[i - 2];\n const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ (W15 >>> 3);\n const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ (W2 >>> 10);\n SHA256_W[i] = (s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16]) | 0;\n }\n // Compression function main loop, 64 rounds\n let { A, B, C, D, E, F, G, H } = this;\n for (let i = 0; i < 64; i++) {\n const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);\n const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);\n const T2 = (sigma0 + Maj(A, B, C)) | 0;\n H = G;\n G = F;\n F = E;\n E = (D + T1) | 0;\n D = C;\n C = B;\n B = A;\n A = (T1 + T2) | 0;\n }\n // Add the compressed chunk to the current hash value\n A = (A + this.A) | 0;\n B = (B + this.B) | 0;\n C = (C + this.C) | 0;\n D = (D + this.D) | 0;\n E = (E + this.E) | 0;\n F = (F + this.F) | 0;\n G = (G + this.G) | 0;\n H = (H + this.H) | 0;\n this.set(A, B, C, D, E, F, G, H);\n }\n roundClean() {\n clean(SHA256_W);\n }\n destroy() {\n this.set(0, 0, 0, 0, 0, 0, 0, 0);\n clean(this.buffer);\n }\n}\n/** Internal SHA2-256 hash class. */\nexport class _SHA256 extends SHA2_32B {\n constructor() {\n super(32);\n // We cannot use array here since array allows indexing by variable\n // which means optimizer/compiler cannot use registers.\n Object.defineProperty(this, \"A\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA256_IV[0] | 0\n });\n Object.defineProperty(this, \"B\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA256_IV[1] | 0\n });\n Object.defineProperty(this, \"C\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA256_IV[2] | 0\n });\n Object.defineProperty(this, \"D\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA256_IV[3] | 0\n });\n Object.defineProperty(this, \"E\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA256_IV[4] | 0\n });\n Object.defineProperty(this, \"F\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA256_IV[5] | 0\n });\n Object.defineProperty(this, \"G\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA256_IV[6] | 0\n });\n Object.defineProperty(this, \"H\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA256_IV[7] | 0\n });\n }\n}\n// SHA2-512 is slower than sha256 in js because u64 operations are slow.\n// Round contants\n// First 32 bits of the fractional parts of the cube roots of the first 80 primes 2..409\nconst K512 = /* @__PURE__ */ (() => u64.split([\n 0x428a2f98d728ae22n,\n 0x7137449123ef65cdn,\n 0xb5c0fbcfec4d3b2fn,\n 0xe9b5dba58189dbbcn,\n 0x3956c25bf348b538n,\n 0x59f111f1b605d019n,\n 0x923f82a4af194f9bn,\n 0xab1c5ed5da6d8118n,\n 0xd807aa98a3030242n,\n 0x12835b0145706fben,\n 0x243185be4ee4b28cn,\n 0x550c7dc3d5ffb4e2n,\n 0x72be5d74f27b896fn,\n 0x80deb1fe3b1696b1n,\n 0x9bdc06a725c71235n,\n 0xc19bf174cf692694n,\n 0xe49b69c19ef14ad2n,\n 0xefbe4786384f25e3n,\n 0x0fc19dc68b8cd5b5n,\n 0x240ca1cc77ac9c65n,\n 0x2de92c6f592b0275n,\n 0x4a7484aa6ea6e483n,\n 0x5cb0a9dcbd41fbd4n,\n 0x76f988da831153b5n,\n 0x983e5152ee66dfabn,\n 0xa831c66d2db43210n,\n 0xb00327c898fb213fn,\n 0xbf597fc7beef0ee4n,\n 0xc6e00bf33da88fc2n,\n 0xd5a79147930aa725n,\n 0x06ca6351e003826fn,\n 0x142929670a0e6e70n,\n 0x27b70a8546d22ffcn,\n 0x2e1b21385c26c926n,\n 0x4d2c6dfc5ac42aedn,\n 0x53380d139d95b3dfn,\n 0x650a73548baf63den,\n 0x766a0abb3c77b2a8n,\n 0x81c2c92e47edaee6n,\n 0x92722c851482353bn,\n 0xa2bfe8a14cf10364n,\n 0xa81a664bbc423001n,\n 0xc24b8b70d0f89791n,\n 0xc76c51a30654be30n,\n 0xd192e819d6ef5218n,\n 0xd69906245565a910n,\n 0xf40e35855771202an,\n 0x106aa07032bbd1b8n,\n 0x19a4c116b8d2d0c8n,\n 0x1e376c085141ab53n,\n 0x2748774cdf8eeb99n,\n 0x34b0bcb5e19b48a8n,\n 0x391c0cb3c5c95a63n,\n 0x4ed8aa4ae3418acbn,\n 0x5b9cca4f7763e373n,\n 0x682e6ff3d6b2b8a3n,\n 0x748f82ee5defb2fcn,\n 0x78a5636f43172f60n,\n 0x84c87814a1f0ab72n,\n 0x8cc702081a6439ecn,\n 0x90befffa23631e28n,\n 0xa4506cebde82bde9n,\n 0xbef9a3f7b2c67915n,\n 0xc67178f2e372532bn,\n 0xca273eceea26619cn,\n 0xd186b8c721c0c207n,\n 0xeada7dd6cde0eb1en,\n 0xf57d4f7fee6ed178n,\n 0x06f067aa72176fban,\n 0x0a637dc5a2c898a6n,\n 0x113f9804bef90daen,\n 0x1b710b35131c471bn,\n 0x28db77f523047d84n,\n 0x32caab7b40c72493n,\n 0x3c9ebe0a15c9bebcn,\n 0x431d67c49c100d4cn,\n 0x4cc5d4becb3e42b6n,\n 0x597f299cfc657e2an,\n 0x5fcb6fab3ad6faecn,\n 0x6c44198c4a475817n,\n]))();\nconst SHA512_Kh = /* @__PURE__ */ (() => K512[0])();\nconst SHA512_Kl = /* @__PURE__ */ (() => K512[1])();\n// Reusable temporary buffers\nconst SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);\nconst SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);\n/** Internal 64-byte base SHA2 hash class. */\nclass SHA2_64B extends HashMD {\n constructor(outputLen) {\n super(128, outputLen, 16, false);\n }\n get() {\n const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];\n }\n set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {\n this.Ah = Ah | 0;\n this.Al = Al | 0;\n this.Bh = Bh | 0;\n this.Bl = Bl | 0;\n this.Ch = Ch | 0;\n this.Cl = Cl | 0;\n this.Dh = Dh | 0;\n this.Dl = Dl | 0;\n this.Eh = Eh | 0;\n this.El = El | 0;\n this.Fh = Fh | 0;\n this.Fl = Fl | 0;\n this.Gh = Gh | 0;\n this.Gl = Gl | 0;\n this.Hh = Hh | 0;\n this.Hl = Hl | 0;\n }\n process(view, offset) {\n // Extend the first 16 words into the remaining 64 words w[16..79] of the message schedule array\n for (let i = 0; i < 16; i++, offset += 4) {\n SHA512_W_H[i] = view.getUint32(offset);\n SHA512_W_L[i] = view.getUint32(offset += 4);\n }\n for (let i = 16; i < 80; i++) {\n // s0 := (w[i-15] rightrotate 1) xor (w[i-15] rightrotate 8) xor (w[i-15] rightshift 7)\n const W15h = SHA512_W_H[i - 15] | 0;\n const W15l = SHA512_W_L[i - 15] | 0;\n const s0h = u64.rotrSH(W15h, W15l, 1) ^ u64.rotrSH(W15h, W15l, 8) ^\n u64.shrSH(W15h, W15l, 7);\n const s0l = u64.rotrSL(W15h, W15l, 1) ^ u64.rotrSL(W15h, W15l, 8) ^\n u64.shrSL(W15h, W15l, 7);\n // s1 := (w[i-2] rightrotate 19) xor (w[i-2] rightrotate 61) xor (w[i-2] rightshift 6)\n const W2h = SHA512_W_H[i - 2] | 0;\n const W2l = SHA512_W_L[i - 2] | 0;\n const s1h = u64.rotrSH(W2h, W2l, 19) ^ u64.rotrBH(W2h, W2l, 61) ^\n u64.shrSH(W2h, W2l, 6);\n const s1l = u64.rotrSL(W2h, W2l, 19) ^ u64.rotrBL(W2h, W2l, 61) ^\n u64.shrSL(W2h, W2l, 6);\n // SHA256_W[i] = s0 + s1 + SHA256_W[i - 7] + SHA256_W[i - 16];\n const SUMl = u64.add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);\n const SUMh = u64.add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);\n SHA512_W_H[i] = SUMh | 0;\n SHA512_W_L[i] = SUMl | 0;\n }\n let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n // Compression function main loop, 80 rounds\n for (let i = 0; i < 80; i++) {\n // S1 := (e rightrotate 14) xor (e rightrotate 18) xor (e rightrotate 41)\n const sigma1h = u64.rotrSH(Eh, El, 14) ^ u64.rotrSH(Eh, El, 18) ^\n u64.rotrBH(Eh, El, 41);\n const sigma1l = u64.rotrSL(Eh, El, 14) ^ u64.rotrSL(Eh, El, 18) ^\n u64.rotrBL(Eh, El, 41);\n //const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n const CHIh = (Eh & Fh) ^ (~Eh & Gh);\n const CHIl = (El & Fl) ^ (~El & Gl);\n // T1 = H + sigma1 + Chi(E, F, G) + SHA512_K[i] + SHA512_W[i]\n const T1ll = u64.add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);\n const T1h = u64.add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);\n const T1l = T1ll | 0;\n // S0 := (a rightrotate 28) xor (a rightrotate 34) xor (a rightrotate 39)\n const sigma0h = u64.rotrSH(Ah, Al, 28) ^ u64.rotrBH(Ah, Al, 34) ^\n u64.rotrBH(Ah, Al, 39);\n const sigma0l = u64.rotrSL(Ah, Al, 28) ^ u64.rotrBL(Ah, Al, 34) ^\n u64.rotrBL(Ah, Al, 39);\n const MAJh = (Ah & Bh) ^ (Ah & Ch) ^ (Bh & Ch);\n const MAJl = (Al & Bl) ^ (Al & Cl) ^ (Bl & Cl);\n Hh = Gh | 0;\n Hl = Gl | 0;\n Gh = Fh | 0;\n Gl = Fl | 0;\n Fh = Eh | 0;\n Fl = El | 0;\n ({ h: Eh, l: El } = u64.add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));\n Dh = Ch | 0;\n Dl = Cl | 0;\n Ch = Bh | 0;\n Cl = Bl | 0;\n Bh = Ah | 0;\n Bl = Al | 0;\n const All = u64.add3L(T1l, sigma0l, MAJl);\n Ah = u64.add3H(All, T1h, sigma0h, MAJh);\n Al = All | 0;\n }\n // Add the compressed chunk to the current hash value\n ({ h: Ah, l: Al } = u64.add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));\n ({ h: Bh, l: Bl } = u64.add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));\n ({ h: Ch, l: Cl } = u64.add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));\n ({ h: Dh, l: Dl } = u64.add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));\n ({ h: Eh, l: El } = u64.add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));\n ({ h: Fh, l: Fl } = u64.add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));\n ({ h: Gh, l: Gl } = u64.add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));\n ({ h: Hh, l: Hl } = u64.add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));\n this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);\n }\n roundClean() {\n clean(SHA512_W_H, SHA512_W_L);\n }\n destroy() {\n clean(this.buffer);\n this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);\n }\n}\n/** Internal SHA2-512 hash class. */\nexport class _SHA512 extends SHA2_64B {\n constructor() {\n super(64);\n Object.defineProperty(this, \"Ah\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[0] | 0\n });\n Object.defineProperty(this, \"Al\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[1] | 0\n });\n Object.defineProperty(this, \"Bh\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[2] | 0\n });\n Object.defineProperty(this, \"Bl\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[3] | 0\n });\n Object.defineProperty(this, \"Ch\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[4] | 0\n });\n Object.defineProperty(this, \"Cl\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[5] | 0\n });\n Object.defineProperty(this, \"Dh\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[6] | 0\n });\n Object.defineProperty(this, \"Dl\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[7] | 0\n });\n Object.defineProperty(this, \"Eh\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[8] | 0\n });\n Object.defineProperty(this, \"El\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[9] | 0\n });\n Object.defineProperty(this, \"Fh\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[10] | 0\n });\n Object.defineProperty(this, \"Fl\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[11] | 0\n });\n Object.defineProperty(this, \"Gh\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[12] | 0\n });\n Object.defineProperty(this, \"Gl\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[13] | 0\n });\n Object.defineProperty(this, \"Hh\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[14] | 0\n });\n Object.defineProperty(this, \"Hl\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA512_IV[15] | 0\n });\n }\n}\nexport class _SHA384 extends SHA2_64B {\n constructor() {\n super(48);\n Object.defineProperty(this, \"Ah\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[0] | 0\n });\n Object.defineProperty(this, \"Al\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[1] | 0\n });\n Object.defineProperty(this, \"Bh\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[2] | 0\n });\n Object.defineProperty(this, \"Bl\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[3] | 0\n });\n Object.defineProperty(this, \"Ch\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[4] | 0\n });\n Object.defineProperty(this, \"Cl\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[5] | 0\n });\n Object.defineProperty(this, \"Dh\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[6] | 0\n });\n Object.defineProperty(this, \"Dl\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[7] | 0\n });\n Object.defineProperty(this, \"Eh\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[8] | 0\n });\n Object.defineProperty(this, \"El\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[9] | 0\n });\n Object.defineProperty(this, \"Fh\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[10] | 0\n });\n Object.defineProperty(this, \"Fl\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[11] | 0\n });\n Object.defineProperty(this, \"Gh\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[12] | 0\n });\n Object.defineProperty(this, \"Gl\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[13] | 0\n });\n Object.defineProperty(this, \"Hh\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[14] | 0\n });\n Object.defineProperty(this, \"Hl\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: SHA384_IV[15] | 0\n });\n }\n}\n/**\n * SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info:\n *\n * - Trying 2^128 hashes would get 50% chance of collision, using birthday attack.\n * - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.\n * - Each sha256 hash is executing 2^18 bit operations.\n * - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.\n */\nexport const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), \n/* @__PURE__ */ oidNist(0x01));\n/** SHA2-512 hash function from RFC 4634. */\nexport const sha512 = /* @__PURE__ */ createHasher(() => new _SHA512(), \n/* @__PURE__ */ oidNist(0x03));\n/** SHA2-384 hash function from RFC 4634. */\nexport const sha384 = /* @__PURE__ */ createHasher(() => new _SHA384(), \n/* @__PURE__ */ oidNist(0x02));\n","/**\n * This file is based on noble-hashes (https://github.com/paulmillr/noble-hashes).\n *\n * noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com)\n *\n * The original file is located at:\n * https://github.com/paulmillr/noble-hashes/blob/4e358a46d682adfb005ae6314ec999f2513086b9/src/sha3.ts\n */\n/**\n * SHA3 (keccak) hash function, based on a new \"Sponge function\" design.\n * Different from older hashes, the internal state is bigger than output size.\n *\n * Check out [FIPS-202](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf),\n * [Website](https://keccak.team/keccak.html),\n * [the differences between SHA-3 and Keccak](https://crypto.stackexchange.com/questions/15727/what-are-the-key-differences-between-the-draft-sha-3-standard-and-the-keccak-sub).\n *\n * Check out `sha3-addons` module for cSHAKE, k12, and others.\n * @module\n */\nimport { rotlBH, rotlBL, rotlSH, rotlSL, split } from \"./u64.js\";\nimport { abytes, aexists, anumber, aoutput, clean, oidNist, swap32IfBE, u32, } from \"../utils/noble.js\";\nimport { createHasher, } from \"./hash.js\";\n// No __PURE__ annotations in sha3 header:\n// EVERYTHING is in fact used on every export.\n// Various per round constants calculations\nconst _0n = 0n;\nconst _1n = 1n;\nconst _2n = 2n;\nconst _7n = 7n;\nconst _256n = 256n;\nconst _0x71n = 0x71n;\nconst SHA3_PI = [];\nconst SHA3_ROTL = [];\nconst _SHA3_IOTA = []; // no pure annotation: var is always used\nfor (let round = 0, R = _1n, x = 1, y = 0; round < 24; round++) {\n // Pi\n [x, y] = [y, (2 * x + 3 * y) % 5];\n SHA3_PI.push(2 * (5 * y + x));\n // Rotational\n SHA3_ROTL.push((((round + 1) * (round + 2)) / 2) % 64);\n // Iota\n let t = _0n;\n for (let j = 0; j < 7; j++) {\n R = ((R << _1n) ^ ((R >> _7n) * _0x71n)) % _256n;\n if (R & _2n)\n t ^= _1n << ((_1n << BigInt(j)) - _1n);\n }\n _SHA3_IOTA.push(t);\n}\nconst IOTAS = split(_SHA3_IOTA, true);\nconst SHA3_IOTA_H = IOTAS[0];\nconst SHA3_IOTA_L = IOTAS[1];\n// Left rotation (without 0, 32, 64)\nconst rotlH = (h, l, s) => (s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s));\nconst rotlL = (h, l, s) => (s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s));\n/** `keccakf1600` internal function, additionally allows to adjust round count. */\nexport function keccakP(s, rounds = 24, B) {\n if (!B)\n B = new Uint32Array(10);\n // NOTE: all indices are x2 since we store state as u32 instead of u64 (bigints to slow in js)\n for (let round = 24 - rounds; round < 24; round++) {\n // Theta θ\n for (let x = 0; x < 10; x++) {\n B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];\n }\n // for (let x = 0; x < 10; x += 2) {\n // const idx1 = (x + 8) % 10;\n // const idx0 = (x + 2) % 10;\n // const B0 = B[idx0];\n // const B1 = B[idx0 + 1];\n // const Th = rotlH(B0, B1, 1) ^ B[idx1];\n // const Tl = rotlL(B0, B1, 1) ^ B[idx1 + 1];\n // for (let y = 0; y < 50; y += 10) {\n // s[x + y] ^= Th;\n // s[x + y + 1] ^= Tl;\n // }\n // }\n { // x=0: idx0=2, idx1=8\n const Th = rotlH(B[2], B[3], 1) ^ B[8];\n const Tl = rotlL(B[2], B[3], 1) ^ B[9];\n s[0] ^= Th;\n s[1] ^= Tl;\n s[10] ^= Th;\n s[11] ^= Tl;\n s[20] ^= Th;\n s[21] ^= Tl;\n s[30] ^= Th;\n s[31] ^= Tl;\n s[40] ^= Th;\n s[41] ^= Tl;\n }\n { // x=2: idx0=4, idx1=0\n const Th = rotlH(B[4], B[5], 1) ^ B[0];\n const Tl = rotlL(B[4], B[5], 1) ^ B[1];\n s[2] ^= Th;\n s[3] ^= Tl;\n s[12] ^= Th;\n s[13] ^= Tl;\n s[22] ^= Th;\n s[23] ^= Tl;\n s[32] ^= Th;\n s[33] ^= Tl;\n s[42] ^= Th;\n s[43] ^= Tl;\n }\n { // x=4: idx0=6, idx1=2\n const Th = rotlH(B[6], B[7], 1) ^ B[2];\n const Tl = rotlL(B[6], B[7], 1) ^ B[3];\n s[4] ^= Th;\n s[5] ^= Tl;\n s[14] ^= Th;\n s[15] ^= Tl;\n s[24] ^= Th;\n s[25] ^= Tl;\n s[34] ^= Th;\n s[35] ^= Tl;\n s[44] ^= Th;\n s[45] ^= Tl;\n }\n { // x=6: idx0=8, idx1=4\n const Th = rotlH(B[8], B[9], 1) ^ B[4];\n const Tl = rotlL(B[8], B[9], 1) ^ B[5];\n s[6] ^= Th;\n s[7] ^= Tl;\n s[16] ^= Th;\n s[17] ^= Tl;\n s[26] ^= Th;\n s[27] ^= Tl;\n s[36] ^= Th;\n s[37] ^= Tl;\n s[46] ^= Th;\n s[47] ^= Tl;\n }\n { // x=8: idx0=0, idx1=6\n const Th = rotlH(B[0], B[1], 1) ^ B[6];\n const Tl = rotlL(B[0], B[1], 1) ^ B[7];\n s[8] ^= Th;\n s[9] ^= Tl;\n s[18] ^= Th;\n s[19] ^= Tl;\n s[28] ^= Th;\n s[29] ^= Tl;\n s[38] ^= Th;\n s[39] ^= Tl;\n s[48] ^= Th;\n s[49] ^= Tl;\n }\n // Rho (ρ) and Pi (π) — fully unrolled\n let curH = s[2];\n let curL = s[3];\n // for (let t = 0; t < 24; t++) {\n // const shift = SHA3_ROTL[t];\n // const Th = rotlH(curH, curL, shift);\n // const Tl = rotlL(curH, curL, shift);\n // const PI = SHA3_PI[t];\n // curH = s[PI];\n // curL = s[PI + 1];\n // s[PI] = Th;\n // s[PI + 1] = Tl;\n // }\n let Th, Tl;\n // t=0: shift=1(S), PI=20\n Th = rotlSH(curH, curL, 1);\n Tl = rotlSL(curH, curL, 1);\n curH = s[20];\n curL = s[21];\n s[20] = Th;\n s[21] = Tl;\n // t=1: shift=3(S), PI=14\n Th = rotlSH(curH, curL, 3);\n Tl = rotlSL(curH, curL, 3);\n curH = s[14];\n curL = s[15];\n s[14] = Th;\n s[15] = Tl;\n // t=2: shift=6(S), PI=22\n Th = rotlSH(curH, curL, 6);\n Tl = rotlSL(curH, curL, 6);\n curH = s[22];\n curL = s[23];\n s[22] = Th;\n s[23] = Tl;\n // t=3: shift=10(S), PI=34\n Th = rotlSH(curH, curL, 10);\n Tl = rotlSL(curH, curL, 10);\n curH = s[34];\n curL = s[35];\n s[34] = Th;\n s[35] = Tl;\n // t=4: shift=15(S), PI=36\n Th = rotlSH(curH, curL, 15);\n Tl = rotlSL(curH, curL, 15);\n curH = s[36];\n curL = s[37];\n s[36] = Th;\n s[37] = Tl;\n // t=5: shift=21(S), PI=6\n Th = rotlSH(curH, curL, 21);\n Tl = rotlSL(curH, curL, 21);\n curH = s[6];\n curL = s[7];\n s[6] = Th;\n s[7] = Tl;\n // t=6: shift=28(S), PI=10\n Th = rotlSH(curH, curL, 28);\n Tl = rotlSL(curH, curL, 28);\n curH = s[10];\n curL = s[11];\n s[10] = Th;\n s[11] = Tl;\n // t=7: shift=36(B), PI=32\n Th = rotlBH(curH, curL, 36);\n Tl = rotlBL(curH, curL, 36);\n curH = s[32];\n curL = s[33];\n s[32] = Th;\n s[33] = Tl;\n // t=8: shift=45(B), PI=16\n Th = rotlBH(curH, curL, 45);\n Tl = rotlBL(curH, curL, 45);\n curH = s[16];\n curL = s[17];\n s[16] = Th;\n s[17] = Tl;\n // t=9: shift=55(B), PI=42\n Th = rotlBH(curH, curL, 55);\n Tl = rotlBL(curH, curL, 55);\n curH = s[42];\n curL = s[43];\n s[42] = Th;\n s[43] = Tl;\n // t=10: shift=2(S), PI=48\n Th = rotlSH(curH, curL, 2);\n Tl = rotlSL(curH, curL, 2);\n curH = s[48];\n curL = s[49];\n s[48] = Th;\n s[49] = Tl;\n // t=11: shift=14(S), PI=8\n Th = rotlSH(curH, curL, 14);\n Tl = rotlSL(curH, curL, 14);\n curH = s[8];\n curL = s[9];\n s[8] = Th;\n s[9] = Tl;\n // t=12: shift=27(S), PI=30\n Th = rotlSH(curH, curL, 27);\n Tl = rotlSL(curH, curL, 27);\n curH = s[30];\n curL = s[31];\n s[30] = Th;\n s[31] = Tl;\n // t=13: shift=41(B), PI=46\n Th = rotlBH(curH, curL, 41);\n Tl = rotlBL(curH, curL, 41);\n curH = s[46];\n curL = s[47];\n s[46] = Th;\n s[47] = Tl;\n // t=14: shift=56(B), PI=38\n Th = rotlBH(curH, curL, 56);\n Tl = rotlBL(curH, curL, 56);\n curH = s[38];\n curL = s[39];\n s[38] = Th;\n s[39] = Tl;\n // t=15: shift=8(S), PI=26\n Th = rotlSH(curH, curL, 8);\n Tl = rotlSL(curH, curL, 8);\n curH = s[26];\n curL = s[27];\n s[26] = Th;\n s[27] = Tl;\n // t=16: shift=25(S), PI=24\n Th = rotlSH(curH, curL, 25);\n Tl = rotlSL(curH, curL, 25);\n curH = s[24];\n curL = s[25];\n s[24] = Th;\n s[25] = Tl;\n // t=17: shift=43(B), PI=4\n Th = rotlBH(curH, curL, 43);\n Tl = rotlBL(curH, curL, 43);\n curH = s[4];\n curL = s[5];\n s[4] = Th;\n s[5] = Tl;\n // t=18: shift=62(B), PI=40\n Th = rotlBH(curH, curL, 62);\n Tl = rotlBL(curH, curL, 62);\n curH = s[40];\n curL = s[41];\n s[40] = Th;\n s[41] = Tl;\n // t=19: shift=18(S), PI=28\n Th = rotlSH(curH, curL, 18);\n Tl = rotlSL(curH, curL, 18);\n curH = s[28];\n curL = s[29];\n s[28] = Th;\n s[29] = Tl;\n // t=20: shift=39(B), PI=44\n Th = rotlBH(curH, curL, 39);\n Tl = rotlBL(curH, curL, 39);\n curH = s[44];\n curL = s[45];\n s[44] = Th;\n s[45] = Tl;\n // t=21: shift=61(B), PI=18\n Th = rotlBH(curH, curL, 61);\n Tl = rotlBL(curH, curL, 61);\n curH = s[18];\n curL = s[19];\n s[18] = Th;\n s[19] = Tl;\n // t=22: shift=20(S), PI=12\n Th = rotlSH(curH, curL, 20);\n Tl = rotlSL(curH, curL, 20);\n curH = s[12];\n curL = s[13];\n s[12] = Th;\n s[13] = Tl;\n // t=23: shift=44(B), PI=2\n Th = rotlBH(curH, curL, 44);\n Tl = rotlBL(curH, curL, 44);\n s[2] = Th;\n s[3] = Tl;\n // Chi (χ)\n for (let y = 0; y < 50; y += 10) {\n B[0] = s[y];\n B[1] = s[y + 1];\n B[2] = s[y + 2];\n B[3] = s[y + 3];\n B[4] = s[y + 4];\n B[5] = s[y + 5];\n B[6] = s[y + 6];\n B[7] = s[y + 7];\n B[8] = s[y + 8];\n B[9] = s[y + 9];\n s[y + 0] ^= ~B[2] & B[4];\n s[y + 1] ^= ~B[3] & B[5];\n s[y + 2] ^= ~B[4] & B[6];\n s[y + 3] ^= ~B[5] & B[7];\n s[y + 4] ^= ~B[6] & B[8];\n s[y + 5] ^= ~B[7] & B[9];\n s[y + 6] ^= ~B[8] & B[0];\n s[y + 7] ^= ~B[9] & B[1];\n s[y + 8] ^= ~B[0] & B[2];\n s[y + 9] ^= ~B[1] & B[3];\n }\n // Iota (ι)\n s[0] ^= SHA3_IOTA_H[round];\n s[1] ^= SHA3_IOTA_L[round];\n }\n}\n/** Keccak sponge function. */\nexport class Keccak {\n // NOTE: we accept arguments in bytes instead of bits here.\n constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {\n Object.defineProperty(this, \"state\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"pos\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 0\n });\n Object.defineProperty(this, \"posOut\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 0\n });\n Object.defineProperty(this, \"finished\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: false\n });\n Object.defineProperty(this, \"state32\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"destroyed\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: false\n });\n Object.defineProperty(this, \"_B\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: new Uint32Array(10)\n });\n Object.defineProperty(this, \"blockLen\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"suffix\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"outputLen\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"enableXOF\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: false\n });\n Object.defineProperty(this, \"rounds\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n this.blockLen = blockLen;\n this.suffix = suffix;\n this.outputLen = outputLen;\n this.enableXOF = enableXOF;\n this.rounds = rounds;\n // Can be passed from user as dkLen\n anumber(outputLen, \"outputLen\");\n // 1600 = 5x5 matrix of 64bit. 1600 bits === 200 bytes\n // 0 < blockLen < 200\n if (!(0 < blockLen && blockLen < 200)) {\n throw new Error(\"only keccak-f1600 function is supported\");\n }\n this.state = new Uint8Array(200);\n this.state32 = u32(this.state);\n }\n clone() {\n return this._cloneInto();\n }\n /** Resets instance to initial (empty) state for reuse. */\n reset() {\n this.state.fill(0);\n this.pos = 0;\n this.posOut = 0;\n this.finished = false;\n this.destroyed = false;\n }\n keccak() {\n swap32IfBE(this.state32);\n keccakP(this.state32, this.rounds, this._B);\n swap32IfBE(this.state32);\n this.posOut = 0;\n this.pos = 0;\n }\n update(data) {\n aexists(this);\n abytes(data);\n return this.updateUnsafe(data);\n }\n /** Like update(), but skips validation. Caller must ensure valid state and input. */\n updateUnsafe(data) {\n const { blockLen, state } = this;\n const len = data.length;\n for (let pos = 0; pos < len;) {\n const take = Math.min(blockLen - this.pos, len - pos);\n for (let i = 0; i < take; i++)\n state[this.pos++] ^= data[pos++];\n if (this.pos === blockLen)\n this.keccak();\n }\n return this;\n }\n finish() {\n if (this.finished)\n return;\n this.finished = true;\n const { state, suffix, pos, blockLen } = this;\n // Do the padding\n state[pos] ^= suffix;\n if ((suffix & 0x80) !== 0 && pos === blockLen - 1)\n this.keccak();\n state[blockLen - 1] ^= 0x80;\n this.keccak();\n }\n writeInto(out) {\n aexists(this, false);\n abytes(out);\n return this.writeIntoUnsafe(out);\n }\n /** Like writeInto(), but skips validation. Caller must ensure valid state and output. */\n writeIntoUnsafe(out) {\n this.finish();\n const bufferOut = this.state;\n const { blockLen } = this;\n for (let pos = 0, len = out.length; pos < len;) {\n if (this.posOut >= blockLen)\n this.keccak();\n const take = Math.min(blockLen - this.posOut, len - pos);\n out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);\n this.posOut += take;\n pos += take;\n }\n return out;\n }\n xofInto(out) {\n // Sha3/Keccak usage with XOF is probably mistake, only SHAKE instances can do XOF\n if (!this.enableXOF) {\n throw new Error(\"XOF is not possible for this instance\");\n }\n return this.writeInto(out);\n }\n xof(bytes) {\n anumber(bytes);\n return this.xofInto(new Uint8Array(bytes));\n }\n digestInto(out) {\n aoutput(out, this);\n if (this.finished)\n throw new Error(\"digest() was already called\");\n this.writeInto(out);\n this.destroy();\n return out;\n }\n digest() {\n return this.digestInto(new Uint8Array(this.outputLen));\n }\n destroy() {\n this.destroyed = true;\n clean(this.state);\n }\n _cloneInto(to) {\n const { blockLen, suffix, outputLen, rounds, enableXOF } = this;\n to ||= new Keccak(blockLen, suffix, outputLen, enableXOF, rounds);\n to.state32.set(this.state32);\n to.pos = this.pos;\n to.posOut = this.posOut;\n to.finished = this.finished;\n to.rounds = rounds;\n // Suffix can change in cSHAKE\n to.suffix = suffix;\n to.outputLen = outputLen;\n to.enableXOF = enableXOF;\n to.destroyed = this.destroyed;\n return to;\n }\n}\nconst genKeccak = (suffix, blockLen, outputLen, info = {}) => createHasher(() => new Keccak(blockLen, suffix, outputLen), info);\n// /** SHA3-224 hash function. */\n// export const sha3_224: CHash = /* @__PURE__ */ genKeccak(\n// 0x06,\n// 144,\n// 28,\n// /* @__PURE__ */ oidNist(0x07),\n// );\n/** SHA3-256 hash function. Different from keccak-256. */\nexport const sha3_256 = /* @__PURE__ */ genKeccak(0x06, 136, 32, \n/* @__PURE__ */ oidNist(0x08));\n/** SHA3-384 hash function. */\nexport const sha3_384 = /* @__PURE__ */ genKeccak(0x06, 104, 48, \n/* @__PURE__ */ oidNist(0x09));\n/** SHA3-512 hash function. */\nexport const sha3_512 = /* @__PURE__ */ genKeccak(0x06, 72, 64, \n/* @__PURE__ */ oidNist(0x0a));\n/** keccak-224 hash function. */\nexport const keccak_224 = /* @__PURE__ */ genKeccak(0x01, 144, 28);\n/** keccak-256 hash function. Different from SHA3-256. */\nexport const keccak_256 = /* @__PURE__ */ genKeccak(0x01, 136, 32);\n/** keccak-384 hash function. */\nexport const keccak_384 = /* @__PURE__ */ genKeccak(0x01, 104, 48);\n/** keccak-512 hash function. */\nexport const keccak_512 = /* @__PURE__ */ genKeccak(0x01, 72, 64);\nconst genShake = (suffix, blockLen, outputLen, info = {}) => createHasher((opts = {}) => new Keccak(blockLen, suffix, opts.dkLen === undefined ? outputLen : opts.dkLen, true), info);\n/** SHAKE128 XOF with 128-bit security. */\nexport const shake128 = \n/* @__PURE__ */\ngenShake(0x1f, 168, 16, /* @__PURE__ */ oidNist(0x0b));\n/** SHAKE256 XOF with 256-bit security. */\nexport const shake256 = \n/* @__PURE__ */\ngenShake(0x1f, 136, 32, /* @__PURE__ */ oidNist(0x0c));\n// /** SHAKE128 XOF with 256-bit output (NIST version). */\n// export const shake128_32: CHashXOF =\n// /* @__PURE__ */\n// genShake(0x1f, 168, 32, /* @__PURE__ */ oidNist(0x0b));\n// /** SHAKE256 XOF with 512-bit output (NIST version). */\n// export const shake256_64: CHashXOF =\n// /* @__PURE__ */\n// genShake(0x1f, 136, 64, /* @__PURE__ */ oidNist(0x0c));\n","/**\n * This file is based on noble-curves (https://github.com/paulmillr/noble-curves).\n *\n * noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com)\n *\n * The original file is located at:\n * https://github.com/paulmillr/noble-curves/blob/b9d49d2b41d550571a0c5be443ecb62109fa3373/src/abstract/modular.ts\n */\n/**\n * Utils for modular division and fields.\n * Field over 11 is a finite (Galois) field is integer number operations `mod 11`.\n * There is no division: it is replaced by modular multiplicative inverse.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { N_0 } from \"../consts.js\";\n// Numbers aren't used in x25519 / x448 builds\n// Calculates a modulo b\nexport function mod(a, b) {\n const result = a % b;\n return result >= N_0 ? result : b + result;\n}\n/** Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)` */\nexport function pow2(x, power, modulo) {\n let res = x;\n while (power-- > N_0) {\n res *= res;\n res %= modulo;\n }\n return res;\n}\n","/**\n * This file is based on noble-curves (https://github.com/paulmillr/noble-curves).\n *\n * noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com)\n *\n * The original file is located at:\n * https://github.com/paulmillr/noble-curves/blob/b9d49d2b41d550571a0c5be443ecb62109fa3373/src/abstract/curve.ts\n */\nexport function createKeygen(\n// deno-lint-ignore ban-types\nrandomSecretKey, getPublicKey) {\n return function keygen(seed) {\n const secretKey = randomSecretKey(seed);\n return { secretKey, publicKey: getPublicKey(secretKey) };\n };\n}\n","/**\n * This file is based on noble-curves (https://github.com/paulmillr/noble-curves).\n *\n * noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com)\n *\n * The original file is located at:\n * https://github.com/paulmillr/noble-curves/blob/b9d49d2b41d550571a0c5be443ecb62109fa3373/src/abstract/montgomery.ts\n */\n/**\n * Montgomery curve methods. It's not really whole montgomery curve,\n * just bunch of very specific methods for X25519 / X448 from\n * [RFC 7748](https://www.rfc-editor.org/rfc/rfc7748)\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { abytes, aInRange, bytesToNumberLE, copyBytes, numberToBytesLE, randomBytesAsync, validateObject, } from \"../utils/noble.js\";\nimport { createKeygen } from \"./curve.js\";\nimport { mod } from \"./modular.js\";\nimport { N_0, N_1, N_2 } from \"../consts.js\";\nfunction validateOpts(curve) {\n validateObject(curve, {\n adjustScalarBytes: \"function\",\n powPminus2: \"function\",\n });\n return Object.freeze({ ...curve });\n}\nexport function montgomery(curveDef) {\n const CURVE = validateOpts(curveDef);\n const { P, type, adjustScalarBytes, powPminus2, randomBytes: rand } = CURVE;\n const is25519 = type === \"x25519\";\n if (!is25519 && type !== \"x448\")\n throw new Error(\"invalid type\");\n const randomBytes_ = rand || randomBytesAsync;\n const montgomeryBits = is25519 ? 255n : 448n;\n const fieldLen = is25519 ? 32 : 56;\n const Gu = is25519 ? 9n : 5n;\n // RFC 7748 #5:\n // The constant a24 is (486662 - 2) / 4 = 121665 for curve25519/X25519 and\n // (156326 - 2) / 4 = 39081 for curve448/X448\n // const a = is25519 ? 156326n : 486662n;\n const a24 = is25519 ? 121665n : 39081n;\n // RFC: x25519 \"the resulting integer is of the form 2^254 plus\n // eight times a value between 0 and 2^251 - 1 (inclusive)\"\n // x448: \"2^447 plus four times a value between 0 and 2^445 - 1 (inclusive)\"\n const minScalar = is25519 ? N_2 ** 254n : N_2 ** 447n;\n const maxAdded = is25519 ? 8n * N_2 ** 251n - N_1 : 4n * N_2 ** 445n - N_1;\n const maxScalar = minScalar + maxAdded + N_1; // (inclusive)\n const modP = (n) => mod(n, P);\n const GuBytes = encodeU(Gu);\n function encodeU(u) {\n return numberToBytesLE(modP(u), fieldLen);\n }\n function decodeU(u) {\n const _u = copyBytes(abytes(u, fieldLen, \"uCoordinate\"));\n // RFC: When receiving such an array, implementations of X25519\n // (but not X448) MUST mask the most significant bit in the final byte.\n if (is25519)\n _u[31] &= 127; // 0b0111_1111\n // RFC: Implementations MUST accept non-canonical values and process them as\n // if they had been reduced modulo the field prime. The non-canonical\n // values are 2^255 - 19 through 2^255 - 1 for X25519 and 2^448 - 2^224\n // - 1 through 2^448 - 1 for X448.\n return modP(bytesToNumberLE(_u));\n }\n function decodeScalar(scalar) {\n return bytesToNumberLE(adjustScalarBytes(copyBytes(abytes(scalar, fieldLen, \"scalar\"))));\n }\n function scalarMult(scalar, u) {\n const pu = montgomeryLadder(decodeU(u), decodeScalar(scalar));\n // Some public keys are useless, of low-order. Curve author doesn't think\n // it needs to be validated, but we do it nonetheless.\n // https://cr.yp.to/ecdh.html#validate\n if (pu === N_0)\n throw new Error(\"invalid private or public key received\");\n return encodeU(pu);\n }\n // Computes public key from private. By doing scalar multiplication of base point.\n function scalarMultBase(scalar) {\n return scalarMult(scalar, GuBytes);\n }\n const getPublicKey = scalarMultBase;\n const getSharedSecret = scalarMult;\n // cswap from RFC7748 \"example code\"\n function cswap(swap, x_2, x_3) {\n // dummy = mask(swap) AND (x_2 XOR x_3)\n // Where mask(swap) is the all-1 or all-0 word of the same length as x_2\n // and x_3, computed, e.g., as mask(swap) = 0 - swap.\n const dummy = modP(swap * (x_2 - x_3));\n x_2 = modP(x_2 - dummy); // x_2 = x_2 XOR dummy\n x_3 = modP(x_3 + dummy); // x_3 = x_3 XOR dummy\n return { x_2, x_3 };\n }\n /**\n * Montgomery x-only multiplication ladder.\n * @param pointU u coordinate (x) on Montgomery Curve 25519\n * @param scalar by which the point would be multiplied\n * @returns new Point on Montgomery curve\n */\n function montgomeryLadder(u, scalar) {\n aInRange(\"u\", u, N_0, P);\n aInRange(\"scalar\", scalar, minScalar, maxScalar);\n const k = scalar;\n const x_1 = u;\n let x_2 = N_1;\n let z_2 = N_0;\n let x_3 = u;\n let z_3 = N_1;\n let swap = N_0;\n for (let t = montgomeryBits - 1n; t >= N_0; t--) {\n const k_t = (k >> t) & N_1;\n swap ^= k_t;\n ({ x_2, x_3 } = cswap(swap, x_2, x_3));\n ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));\n swap = k_t;\n const A = x_2 + z_2;\n const AA = modP(A * A);\n const B = x_2 - z_2;\n const BB = modP(B * B);\n const E = AA - BB;\n const C = x_3 + z_3;\n const D = x_3 - z_3;\n const DA = modP(D * A);\n const CB = modP(C * B);\n const dacb = DA + CB;\n const da_cb = DA - CB;\n x_3 = modP(dacb * dacb);\n z_3 = modP(x_1 * modP(da_cb * da_cb));\n x_2 = modP(AA * BB);\n z_2 = modP(E * (AA + modP(a24 * E)));\n }\n ({ x_2, x_3 } = cswap(swap, x_2, x_3));\n ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));\n const z2 = powPminus2(z_2); // `Fp.pow(x, P - N_2)` is much slower equivalent\n return modP(x_2 * z2); // Return x_2 * (z_2^(p - 2))\n }\n const lengths = {\n secretKey: fieldLen,\n publicKey: fieldLen,\n seed: fieldLen,\n };\n const randomSecretKey = async (seed) => {\n if (seed === undefined) {\n seed = await randomBytes_(fieldLen);\n }\n abytes(seed, lengths.seed, \"seed\");\n return seed;\n };\n const utils = { randomSecretKey };\n return Object.freeze({\n keygen: createKeygen(randomSecretKey, getPublicKey),\n getSharedSecret,\n getPublicKey,\n scalarMult,\n scalarMultBase,\n utils,\n GuBytes: GuBytes.slice(),\n lengths,\n });\n}\n","/**\n * This file is based on noble-ciphers (https://github.com/paulmillr/noble-ciphers).\n *\n * noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com)\n *\n * The original file is located at:\n * https://github.com/paulmillr/noble-ciphers/blob/749cdf9cd07ebdd19e9b957d0f172f1045179695/src/utils.ts\n */\n/**\n * Utilities for hex, bytes, CSPRNG.\n * @module\n */\nimport { abytes, aexists, anumber, aoutput, clean, copyBytes, createView, isLE, numberToBigint, u32, } from \"@hpke/common\";\nexport { abytes, aexists, anumber, aoutput, clean, copyBytes, createView, isLE, u32, };\n/** Asserts something is boolean. */\nexport function abool(b) {\n if (typeof b !== \"boolean\")\n throw new Error(`boolean expected, not ${b}`);\n}\n/** Cast u8 / u16 / u32 to u8. */\nexport function u8(arr) {\n return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/**\n * Wraps a cipher: validates args, ensures encrypt() can only be called once.\n * @__NO_SIDE_EFFECTS__\n */\n// deno-lint-ignore no-explicit-any\nexport const wrapCipher = (params, constructor) => {\n // deno-lint-ignore no-explicit-any\n function wrappedCipher(key, ...args) {\n // Validate key\n abytes(key, undefined, \"key\");\n // Big-Endian hardware is rare. Just in case someone still decides to run ciphers:\n if (!isLE) {\n throw new Error(\"Non little-endian hardware is not yet supported\");\n }\n // Validate nonce if nonceLength is present\n if (params.nonceLength !== undefined) {\n const nonce = args[0];\n abytes(nonce, params.varSizeNonce ? undefined : params.nonceLength, \"nonce\");\n }\n // Validate AAD if tagLength present\n const tagl = params.tagLength;\n if (tagl && args[1] !== undefined)\n abytes(args[1], undefined, \"AAD\");\n const cipher = constructor(key, ...args);\n const checkOutput = (fnLength, output) => {\n if (output !== undefined) {\n if (fnLength !== 2)\n throw new Error(\"cipher output not supported\");\n abytes(output, undefined, \"output\");\n }\n };\n // Create wrapped cipher with validation and single-use encryption\n let called = false;\n const wrCipher = {\n encrypt(data, output) {\n if (called) {\n throw new Error(\"cannot encrypt() twice with same key + nonce\");\n }\n called = true;\n abytes(data);\n checkOutput(cipher.encrypt.length, output);\n return cipher.encrypt(data, output);\n },\n decrypt(data, output) {\n abytes(data);\n if (tagl && data.length < tagl) {\n throw new Error('\"ciphertext\" expected length bigger than tagLength=' + tagl);\n }\n checkOutput(cipher.decrypt.length, output);\n return cipher.decrypt(data, output);\n },\n };\n return wrCipher;\n }\n Object.assign(wrappedCipher, params);\n return wrappedCipher;\n};\nexport function checkOpts(defaults, opts) {\n if (opts == null || typeof opts !== \"object\") {\n throw new Error(\"options must be defined\");\n }\n const merged = Object.assign(defaults, opts);\n return merged;\n}\n/** Compares 2 uint8array-s in kinda constant time. */\nexport function equalBytes(a, b) {\n if (a.length !== b.length)\n return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++)\n diff |= a[i] ^ b[i];\n return diff === 0;\n}\n/**\n * By default, returns u8a of length.\n * When out is available, it checks it for validity and uses it.\n */\nexport function getOutput(expectedLength, out, onlyAligned = true) {\n if (out === undefined)\n return new Uint8Array(expectedLength);\n if (out.length !== expectedLength) {\n throw new Error('\"output\" expected Uint8Array of length ' + expectedLength + \", got: \" +\n out.length);\n }\n if (onlyAligned && !isAligned32(out)) {\n throw new Error(\"invalid output, must be aligned\");\n }\n return out;\n}\nexport function u64Lengths(dataLength, aadLength, isLE) {\n abool(isLE);\n const num = new Uint8Array(16);\n const view = createView(num);\n view.setBigUint64(0, numberToBigint(aadLength), isLE);\n view.setBigUint64(8, numberToBigint(dataLength), isLE);\n return num;\n}\n// Is byte array aligned to 4 byte offset (u32)?\nexport function isAligned32(bytes) {\n return bytes.byteOffset % 4 === 0;\n}\n// copy bytes to new u8a (aligned). Because Buffer.slice is broken.\n// Re-exported from @hpke/common.\n","/**\n * This file is based on noble-ciphers (https://github.com/paulmillr/noble-ciphers).\n *\n * noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com)\n *\n * The original file is located at:\n * https://github.com/paulmillr/noble-ciphers/blob/749cdf9cd07ebdd19e9b957d0f172f1045179695/src/_arx.ts\n */\n/**\n * Basic utils for ARX (add-rotate-xor) salsa and chacha ciphers.\n\nRFC8439 requires multi-step cipher stream, where\nauthKey starts with counter: 0, actual msg with counter: 1.\n\nFor this, we need a way to re-use nonce / counter:\n\n const counter = new Uint8Array(4);\n chacha(..., counter, ...); // counter is now 1\n chacha(..., counter, ...); // counter is now 2\n\nThis is complicated:\n\n- 32-bit counters are enough, no need for 64-bit: max ArrayBuffer size in JS is 4GB\n- Original papers don't allow mutating counters\n- Counter overflow is undefined [^1]\n- Idea A: allow providing (nonce | counter) instead of just nonce, re-use it\n- Caveat: Cannot be re-used through all cases:\n- * chacha has (counter | nonce)\n- * xchacha has (nonce16 | counter | nonce16)\n- Idea B: separate nonce / counter and provide separate API for counter re-use\n- Caveat: there are different counter sizes depending on an algorithm.\n- salsa & chacha also differ in structures of key & sigma:\n salsa20: s[0] | k(4) | s[1] | nonce(2) | cnt(2) | s[2] | k(4) | s[3]\n chacha: s(4) | k(8) | cnt(1) | nonce(3)\n chacha20orig: s(4) | k(8) | cnt(2) | nonce(2)\n- Idea C: helper method such as `setSalsaState(key, nonce, sigma, data)`\n- Caveat: we can't re-use counter array\n\nxchacha [^2] uses the subkey and remaining 8 byte nonce with ChaCha20 as normal\n(prefixed by 4 NUL bytes, since [RFC8439] specifies a 12-byte nonce).\n\n[^1]: https://mailarchive.ietf.org/arch/msg/cfrg/gsOnTJzcbgG6OqD8Sc0GO5aR_tU/\n[^2]: https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha#appendix-A.2\n\n * @module\n */\nimport { abool, abytes, anumber, checkOpts, clean, copyBytes, u32, } from \"./utils.js\";\n// Can't use similar utils.utf8ToBytes, because it uses `TextEncoder` - not available in all envs\nconst _utf8ToBytes = (str) => Uint8Array.from(str.split(\"\").map((c) => c.charCodeAt(0)));\nconst sigma16 = _utf8ToBytes(\"expand 16-byte k\");\nconst sigma32 = _utf8ToBytes(\"expand 32-byte k\");\nconst sigma16_32 = u32(sigma16);\nconst sigma32_32 = u32(sigma32);\n/** Rotate left. */\nexport function rotl(a, b) {\n return (a << b) | (a >>> (32 - b));\n}\n// Is byte array aligned to 4 byte offset (u32)?\nfunction isAligned32(b) {\n return b.byteOffset % 4 === 0;\n}\n// Salsa and Chacha block length is always 512-bit\nconst BLOCK_LEN = 64;\nconst BLOCK_LEN32 = 16;\n// new Uint32Array([2**32]) // => Uint32Array(1) [ 0 ]\n// new Uint32Array([2**32-1]) // => Uint32Array(1) [ 4294967295 ]\nconst MAX_COUNTER = 2 ** 32 - 1;\nconst U32_EMPTY = Uint32Array.of();\nfunction runCipher(core, sigma, key, nonce, data, output, counter, rounds) {\n const len = data.length;\n const block = new Uint8Array(BLOCK_LEN);\n const b32 = u32(block);\n // Make sure that buffers aligned to 4 bytes\n const isAligned = isAligned32(data) && isAligned32(output);\n const d32 = isAligned ? u32(data) : U32_EMPTY;\n const o32 = isAligned ? u32(output) : U32_EMPTY;\n for (let pos = 0; pos < len; counter++) {\n core(sigma, key, nonce, b32, counter, rounds);\n if (counter >= MAX_COUNTER)\n throw new Error(\"arx: counter overflow\");\n const take = Math.min(BLOCK_LEN, len - pos);\n // aligned to 4 bytes\n if (isAligned && take === BLOCK_LEN) {\n const pos32 = pos / 4;\n if (pos % 4 !== 0)\n throw new Error(\"arx: invalid block position\");\n for (let j = 0, posj; j < BLOCK_LEN32; j++) {\n posj = pos32 + j;\n o32[posj] = d32[posj] ^ b32[j];\n }\n pos += BLOCK_LEN;\n continue;\n }\n for (let j = 0, posj; j < take; j++) {\n posj = pos + j;\n output[posj] = data[posj] ^ block[j];\n }\n pos += take;\n }\n}\n/** Creates ARX-like (ChaCha, Salsa) cipher stream from core function. */\nexport function createCipher(core, opts) {\n const { allowShortKeys, extendNonceFn, counterLength, counterRight, rounds } = checkOpts({\n allowShortKeys: false,\n counterLength: 8,\n counterRight: false,\n rounds: 20,\n }, opts);\n if (typeof core !== \"function\")\n throw new Error(\"core must be a function\");\n anumber(counterLength);\n anumber(rounds);\n abool(counterRight);\n abool(allowShortKeys);\n return (key, nonce, data, output, counter = 0) => {\n abytes(key, undefined, \"key\");\n abytes(nonce, undefined, \"nonce\");\n abytes(data, undefined, \"data\");\n const len = data.length;\n if (output === undefined)\n output = new Uint8Array(len);\n abytes(output, undefined, \"output\");\n anumber(counter);\n if (counter < 0 || counter >= MAX_COUNTER) {\n throw new Error(\"arx: counter overflow\");\n }\n if (output.length < len) {\n throw new Error(`arx: output (${output.length}) is shorter than data (${len})`);\n }\n const toClean = [];\n // Key & sigma\n // key=16 -> sigma16, k=key|key\n // key=32 -> sigma32, k=key\n const l = key.length;\n let k;\n let sigma;\n if (l === 32) {\n toClean.push(k = copyBytes(key));\n sigma = sigma32_32;\n }\n else if (l === 16 && allowShortKeys) {\n k = new Uint8Array(32);\n k.set(key);\n k.set(key, 16);\n sigma = sigma16_32;\n toClean.push(k);\n }\n else {\n abytes(key, 32, \"arx key\");\n throw new Error(\"invalid key size\");\n // throw new Error(`\"arx key\" expected Uint8Array of length 32, got length=${l}`);\n }\n // Nonce\n // salsa20: 8 (8-byte counter)\n // chacha20orig: 8 (8-byte counter)\n // chacha20: 12 (4-byte counter)\n // xsalsa20: 24 (16 -> hsalsa, 8 -> old nonce)\n // xchacha20: 24 (16 -> hchacha, 8 -> old nonce)\n // Align nonce to 4 bytes\n if (!isAligned32(nonce))\n toClean.push(nonce = copyBytes(nonce));\n const k32 = u32(k);\n // hsalsa & hchacha: handle extended nonce\n if (extendNonceFn) {\n if (nonce.length !== 24) {\n throw new Error(`arx: extended nonce must be 24 bytes`);\n }\n extendNonceFn(sigma, k32, u32(nonce.subarray(0, 16)), k32);\n nonce = nonce.subarray(16);\n }\n // Handle nonce counter\n const nonceNcLen = 16 - counterLength;\n if (nonceNcLen !== nonce.length) {\n throw new Error(`arx: nonce must be ${nonceNcLen} or 16 bytes`);\n }\n // Pad counter when nonce is 64 bit\n if (nonceNcLen !== 12) {\n const nc = new Uint8Array(12);\n nc.set(nonce, counterRight ? 0 : 12 - nonce.length);\n nonce = nc;\n toClean.push(nonce);\n }\n const n32 = u32(nonce);\n runCipher(core, sigma, k32, n32, data, output, counter, rounds);\n clean(...toClean);\n return output;\n };\n}\n","/**\n * This file is based on noble-ciphers (https://github.com/paulmillr/noble-ciphers).\n *\n * noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com)\n *\n * The original file is located at:\n * https://github.com/paulmillr/noble-ciphers/blob/749cdf9cd07ebdd19e9b957d0f172f1045179695/src/_poly1305.ts\n */\n/**\n * Poly1305 ([PDF](https://cr.yp.to/mac/poly1305-20050329.pdf),\n * [wiki](https://en.wikipedia.org/wiki/Poly1305))\n * is a fast and parallel secret-key message-authentication code suitable for\n * a wide variety of applications. It was standardized in\n * [RFC 8439](https://www.rfc-editor.org/rfc/rfc8439) and is now used in TLS 1.3.\n *\n * Polynomial MACs are not perfect for every situation:\n * they lack Random Key Robustness: the MAC can be forged, and can't be used in PAKE schemes.\n * See [invisible salamanders attack](https://keymaterial.net/2020/09/07/invisible-salamanders-in-aes-gcm-siv/).\n * To combat invisible salamanders, `hash(key)` can be included in ciphertext,\n * however, this would violate ciphertext indistinguishability:\n * an attacker would know which key was used - so `HKDF(key, i)`\n * could be used instead.\n *\n * Check out [original website](https://cr.yp.to/mac.html).\n * Based on Public Domain [poly1305-donna](https://github.com/floodyberry/poly1305-donna).\n * @module\n */\nimport { abytes, aexists, aoutput, clean, copyBytes, } from \"./utils.js\";\nfunction u8to16(a, i) {\n return (a[i++] & 0xff) | ((a[i++] & 0xff) << 8);\n}\n// function bytesToNumberLE(bytes: Uint8Array): bigint {\n// return hexToNumber(bytesToHex(Uint8Array.from(bytes).reverse()));\n// }\n// /** Small version of `poly1305` without loop unrolling. Unused, provided for auditability. */\n// function poly1305_small(msg: Uint8Array, key: Uint8Array): Uint8Array {\n// abytes(msg);\n// abytes(key, 32, \"key\");\n// const POW_2_130_5 = 2n ** 130n - 5n; // 2^130-5\n// const POW_2_128_1 = 2n ** 128n - 1n; // 2^128-1\n// const CLAMP_R = 0x0ffffffc0ffffffc0ffffffc0fffffffn;\n// const r = bytesToNumberLE(key.subarray(0, 16)) & CLAMP_R;\n// const s = bytesToNumberLE(key.subarray(16));\n// // Process by 16 byte chunks\n// let acc = 0n;\n// for (let i = 0; i < msg.length; i += 16) {\n// const m = msg.subarray(i, i + 16);\n// const n = bytesToNumberLE(m) | (1n << (8n * mLen)); // mLen: bigint\n// acc = ((acc + n) * r) % POW_2_130_5;\n// }\n// const res = (acc + s) & POW_2_128_1;\n// return numberToBytesBE(res, 16).reverse(); // LE\n// }\n// Can be used to replace `computeTag` in chacha.ts. Unused, provided for auditability.\n// function poly1305_computeTag_small(\n// authKey: Uint8Array,\n// lengths: Uint8Array,\n// ciphertext: Uint8Array,\n// AAD?: Uint8Array,\n// ): Uint8Array {\n// const res = [];\n// const updatePadded2 = (msg: Uint8Array) => {\n// res.push(msg);\n// const leftover = msg.length % 16;\n// if (leftover) res.push(new Uint8Array(16).slice(leftover));\n// };\n// if (AAD) updatePadded2(AAD);\n// updatePadded2(ciphertext);\n// res.push(lengths);\n// return poly1305_small(concatBytes(...res), authKey);\n// }\n/** Poly1305 class. Prefer poly1305() function instead. */\nexport class Poly1305 {\n // Can be speed-up using BigUint64Array, at the cost of complexity\n constructor(key) {\n Object.defineProperty(this, \"blockLen\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 16\n });\n Object.defineProperty(this, \"outputLen\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 16\n });\n Object.defineProperty(this, \"buffer\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: new Uint8Array(16)\n });\n Object.defineProperty(this, \"r\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: new Uint16Array(10)\n }); // Allocating 1 array with .subarray() here is slower than 3\n Object.defineProperty(this, \"h\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: new Uint16Array(10)\n });\n Object.defineProperty(this, \"pad\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: new Uint16Array(8)\n });\n Object.defineProperty(this, \"pos\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 0\n });\n Object.defineProperty(this, \"finished\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: false\n });\n key = copyBytes(abytes(key, 32, \"key\"));\n const t0 = u8to16(key, 0);\n const t1 = u8to16(key, 2);\n const t2 = u8to16(key, 4);\n const t3 = u8to16(key, 6);\n const t4 = u8to16(key, 8);\n const t5 = u8to16(key, 10);\n const t6 = u8to16(key, 12);\n const t7 = u8to16(key, 14);\n // https://github.com/floodyberry/poly1305-donna/blob/e6ad6e091d30d7f4ec2d4f978be1fcfcbce72781/poly1305-donna-16.h#L47\n this.r[0] = t0 & 0x1fff;\n this.r[1] = ((t0 >>> 13) | (t1 << 3)) & 0x1fff;\n this.r[2] = ((t1 >>> 10) | (t2 << 6)) & 0x1f03;\n this.r[3] = ((t2 >>> 7) | (t3 << 9)) & 0x1fff;\n this.r[4] = ((t3 >>> 4) | (t4 << 12)) & 0x00ff;\n this.r[5] = (t4 >>> 1) & 0x1ffe;\n this.r[6] = ((t4 >>> 14) | (t5 << 2)) & 0x1fff;\n this.r[7] = ((t5 >>> 11) | (t6 << 5)) & 0x1f81;\n this.r[8] = ((t6 >>> 8) | (t7 << 8)) & 0x1fff;\n this.r[9] = (t7 >>> 5) & 0x007f;\n for (let i = 0; i < 8; i++)\n this.pad[i] = u8to16(key, 16 + 2 * i);\n }\n process(data, offset, isLast = false) {\n const hibit = isLast ? 0 : 1 << 11;\n const { h, r } = this;\n const r0 = r[0];\n const r1 = r[1];\n const r2 = r[2];\n const r3 = r[3];\n const r4 = r[4];\n const r5 = r[5];\n const r6 = r[6];\n const r7 = r[7];\n const r8 = r[8];\n const r9 = r[9];\n const t0 = u8to16(data, offset + 0);\n const t1 = u8to16(data, offset + 2);\n const t2 = u8to16(data, offset + 4);\n const t3 = u8to16(data, offset + 6);\n const t4 = u8to16(data, offset + 8);\n const t5 = u8to16(data, offset + 10);\n const t6 = u8to16(data, offset + 12);\n const t7 = u8to16(data, offset + 14);\n const h0 = h[0] + (t0 & 0x1fff);\n const h1 = h[1] + (((t0 >>> 13) | (t1 << 3)) & 0x1fff);\n const h2 = h[2] + (((t1 >>> 10) | (t2 << 6)) & 0x1fff);\n const h3 = h[3] + (((t2 >>> 7) | (t3 << 9)) & 0x1fff);\n const h4 = h[4] + (((t3 >>> 4) | (t4 << 12)) & 0x1fff);\n const h5 = h[5] + ((t4 >>> 1) & 0x1fff);\n const h6 = h[6] + (((t4 >>> 14) | (t5 << 2)) & 0x1fff);\n const h7 = h[7] + (((t5 >>> 11) | (t6 << 5)) & 0x1fff);\n const h8 = h[8] + (((t6 >>> 8) | (t7 << 8)) & 0x1fff);\n const h9 = h[9] + ((t7 >>> 5) | hibit);\n let c = 0;\n let d0 = c + h0 * r0 + h1 * (5 * r9) + h2 * (5 * r8) + h3 * (5 * r7) +\n h4 * (5 * r6);\n c = d0 >>> 13;\n d0 &= 0x1fff;\n d0 += h5 * (5 * r5) + h6 * (5 * r4) + h7 * (5 * r3) + h8 * (5 * r2) +\n h9 * (5 * r1);\n c += d0 >>> 13;\n d0 &= 0x1fff;\n let d1 = c + h0 * r1 + h1 * r0 + h2 * (5 * r9) + h3 * (5 * r8) +\n h4 * (5 * r7);\n c = d1 >>> 13;\n d1 &= 0x1fff;\n d1 += h5 * (5 * r6) + h6 * (5 * r5) + h7 * (5 * r4) + h8 * (5 * r3) +\n h9 * (5 * r2);\n c += d1 >>> 13;\n d1 &= 0x1fff;\n let d2 = c + h0 * r2 + h1 * r1 + h2 * r0 + h3 * (5 * r9) + h4 * (5 * r8);\n c = d2 >>> 13;\n d2 &= 0x1fff;\n d2 += h5 * (5 * r7) + h6 * (5 * r6) + h7 * (5 * r5) + h8 * (5 * r4) +\n h9 * (5 * r3);\n c += d2 >>> 13;\n d2 &= 0x1fff;\n let d3 = c + h0 * r3 + h1 * r2 + h2 * r1 + h3 * r0 + h4 * (5 * r9);\n c = d3 >>> 13;\n d3 &= 0x1fff;\n d3 += h5 * (5 * r8) + h6 * (5 * r7) + h7 * (5 * r6) + h8 * (5 * r5) +\n h9 * (5 * r4);\n c += d3 >>> 13;\n d3 &= 0x1fff;\n let d4 = c + h0 * r4 + h1 * r3 + h2 * r2 + h3 * r1 + h4 * r0;\n c = d4 >>> 13;\n d4 &= 0x1fff;\n d4 += h5 * (5 * r9) + h6 * (5 * r8) + h7 * (5 * r7) + h8 * (5 * r6) +\n h9 * (5 * r5);\n c += d4 >>> 13;\n d4 &= 0x1fff;\n let d5 = c + h0 * r5 + h1 * r4 + h2 * r3 + h3 * r2 + h4 * r1;\n c = d5 >>> 13;\n d5 &= 0x1fff;\n d5 += h5 * r0 + h6 * (5 * r9) + h7 * (5 * r8) + h8 * (5 * r7) +\n h9 * (5 * r6);\n c += d5 >>> 13;\n d5 &= 0x1fff;\n let d6 = c + h0 * r6 + h1 * r5 + h2 * r4 + h3 * r3 + h4 * r2;\n c = d6 >>> 13;\n d6 &= 0x1fff;\n d6 += h5 * r1 + h6 * r0 + h7 * (5 * r9) + h8 * (5 * r8) + h9 * (5 * r7);\n c += d6 >>> 13;\n d6 &= 0x1fff;\n let d7 = c + h0 * r7 + h1 * r6 + h2 * r5 + h3 * r4 + h4 * r3;\n c = d7 >>> 13;\n d7 &= 0x1fff;\n d7 += h5 * r2 + h6 * r1 + h7 * r0 + h8 * (5 * r9) + h9 * (5 * r8);\n c += d7 >>> 13;\n d7 &= 0x1fff;\n let d8 = c + h0 * r8 + h1 * r7 + h2 * r6 + h3 * r5 + h4 * r4;\n c = d8 >>> 13;\n d8 &= 0x1fff;\n d8 += h5 * r3 + h6 * r2 + h7 * r1 + h8 * r0 + h9 * (5 * r9);\n c += d8 >>> 13;\n d8 &= 0x1fff;\n let d9 = c + h0 * r9 + h1 * r8 + h2 * r7 + h3 * r6 + h4 * r5;\n c = d9 >>> 13;\n d9 &= 0x1fff;\n d9 += h5 * r4 + h6 * r3 + h7 * r2 + h8 * r1 + h9 * r0;\n c += d9 >>> 13;\n d9 &= 0x1fff;\n c = ((c << 2) + c) | 0;\n c = (c + d0) | 0;\n d0 = c & 0x1fff;\n c = c >>> 13;\n d1 += c;\n h[0] = d0;\n h[1] = d1;\n h[2] = d2;\n h[3] = d3;\n h[4] = d4;\n h[5] = d5;\n h[6] = d6;\n h[7] = d7;\n h[8] = d8;\n h[9] = d9;\n }\n finalize() {\n const { h, pad } = this;\n const g = new Uint16Array(10);\n let c = h[1] >>> 13;\n h[1] &= 0x1fff;\n for (let i = 2; i < 10; i++) {\n h[i] += c;\n c = h[i] >>> 13;\n h[i] &= 0x1fff;\n }\n h[0] += c * 5;\n c = h[0] >>> 13;\n h[0] &= 0x1fff;\n h[1] += c;\n c = h[1] >>> 13;\n h[1] &= 0x1fff;\n h[2] += c;\n g[0] = h[0] + 5;\n c = g[0] >>> 13;\n g[0] &= 0x1fff;\n for (let i = 1; i < 10; i++) {\n g[i] = h[i] + c;\n c = g[i] >>> 13;\n g[i] &= 0x1fff;\n }\n g[9] -= 1 << 13;\n let mask = (c ^ 1) - 1;\n for (let i = 0; i < 10; i++)\n g[i] &= mask;\n mask = ~mask;\n for (let i = 0; i < 10; i++)\n h[i] = (h[i] & mask) | g[i];\n h[0] = (h[0] | (h[1] << 13)) & 0xffff;\n h[1] = ((h[1] >>> 3) | (h[2] << 10)) & 0xffff;\n h[2] = ((h[2] >>> 6) | (h[3] << 7)) & 0xffff;\n h[3] = ((h[3] >>> 9) | (h[4] << 4)) & 0xffff;\n h[4] = ((h[4] >>> 12) | (h[5] << 1) | (h[6] << 14)) & 0xffff;\n h[5] = ((h[6] >>> 2) | (h[7] << 11)) & 0xffff;\n h[6] = ((h[7] >>> 5) | (h[8] << 8)) & 0xffff;\n h[7] = ((h[8] >>> 8) | (h[9] << 5)) & 0xffff;\n let f = h[0] + pad[0];\n h[0] = f & 0xffff;\n for (let i = 1; i < 8; i++) {\n f = (((h[i] + pad[i]) | 0) + (f >>> 16)) | 0;\n h[i] = f & 0xffff;\n }\n clean(g);\n }\n update(data) {\n aexists(this);\n abytes(data);\n data = copyBytes(data);\n const { buffer, blockLen } = this;\n const len = data.length;\n for (let pos = 0; pos < len;) {\n const take = Math.min(blockLen - this.pos, len - pos);\n // Fast path: we have at least one block in input\n if (take === blockLen) {\n for (; blockLen <= len - pos; pos += blockLen)\n this.process(data, pos);\n continue;\n }\n buffer.set(data.subarray(pos, pos + take), this.pos);\n this.pos += take;\n pos += take;\n if (this.pos === blockLen) {\n this.process(buffer, 0, false);\n this.pos = 0;\n }\n }\n return this;\n }\n destroy() {\n clean(this.h, this.r, this.buffer, this.pad);\n }\n digestInto(out) {\n aexists(this);\n aoutput(out, this);\n this.finished = true;\n const { buffer, h } = this;\n let { pos } = this;\n if (pos) {\n buffer[pos++] = 1;\n for (; pos < 16; pos++)\n buffer[pos] = 0;\n this.process(buffer, 0, true);\n }\n this.finalize();\n let opos = 0;\n for (let i = 0; i < 8; i++) {\n out[opos++] = h[i] >>> 0;\n out[opos++] = h[i] >>> 8;\n }\n return out;\n }\n digest() {\n const { buffer, outputLen } = this;\n this.digestInto(buffer);\n const res = buffer.slice(0, outputLen);\n this.destroy();\n return res;\n }\n}\nexport function wrapConstructorWithKey(hashCons) {\n const hashC = (msg, key) => hashCons(key).update(msg).digest();\n const tmp = hashCons(new Uint8Array(32)); // tmp array, used just once below\n hashC.outputLen = tmp.outputLen;\n hashC.blockLen = tmp.blockLen;\n hashC.create = (key) => hashCons(key);\n return hashC;\n}\n/** Poly1305 MAC from RFC 8439. */\nexport const poly1305 = \n/** @__PURE__ */ (() => wrapConstructorWithKey((key) => new Poly1305(key)))();\n","/**\n * This file is based on noble-ciphers (https://github.com/paulmillr/noble-ciphers).\n *\n * noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com)\n *\n * The original file is located at:\n * https://github.com/paulmillr/noble-ciphers/blob/749cdf9cd07ebdd19e9b957d0f172f1045179695/src/chacha.ts\n */\n/**\n * ChaCha stream cipher, released\n * in 2008. Developed after Salsa20, ChaCha aims to increase diffusion per round.\n * It was standardized in [RFC 8439](https://www.rfc-editor.org/rfc/rfc8439) and\n * is now used in TLS 1.3.\n *\n * [XChaCha20](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha)\n * extended-nonce variant is also provided. Similar to XSalsa, it's safe to use with\n * randomly-generated nonces.\n *\n * Check out [PDF](http://cr.yp.to/chacha/chacha-20080128.pdf) and\n * [wiki](https://en.wikipedia.org/wiki/Salsa20) and\n * [website](https://cr.yp.to/chacha.html).\n *\n * @module\n */\nimport { createCipher, rotl } from \"./_arx.js\";\nimport { poly1305 } from \"./_poly1305.js\";\nimport { abytes, clean, equalBytes, getOutput, u64Lengths, wrapCipher, } from \"./utils.js\";\n/**\n * ChaCha core function. It is implemented twice:\n * 1. Simple loop (chachaCore_small, hchacha_small)\n * 2. Unrolled loop (chachaCore, hchacha) - 4x faster, but larger & harder to read\n * The specific implementation is selected in `createCipher` below.\n */\nfunction chachaCore(s, k, n, out, cnt, rounds = 20) {\n const y00 = s[0], y01 = s[1], y02 = s[2], y03 = s[3], // \"expa\" \"nd 3\" \"2-by\" \"te k\"\n y04 = k[0], y05 = k[1], y06 = k[2], y07 = k[3], // Key Key Key Key\n y08 = k[4], y09 = k[5], y10 = k[6], y11 = k[7], // Key Key Key Key\n y12 = cnt, y13 = n[0], y14 = n[1], y15 = n[2]; // Counter Counter\tNonce Nonce\n // Save state to temporary variables\n let x00 = y00, x01 = y01, x02 = y02, x03 = y03, x04 = y04, x05 = y05, x06 = y06, x07 = y07, x08 = y08, x09 = y09, x10 = y10, x11 = y11, x12 = y12, x13 = y13, x14 = y14, x15 = y15;\n for (let r = 0; r < rounds; r += 2) {\n x00 = (x00 + x04) | 0;\n x12 = rotl(x12 ^ x00, 16);\n x08 = (x08 + x12) | 0;\n x04 = rotl(x04 ^ x08, 12);\n x00 = (x00 + x04) | 0;\n x12 = rotl(x12 ^ x00, 8);\n x08 = (x08 + x12) | 0;\n x04 = rotl(x04 ^ x08, 7);\n x01 = (x01 + x05) | 0;\n x13 = rotl(x13 ^ x01, 16);\n x09 = (x09 + x13) | 0;\n x05 = rotl(x05 ^ x09, 12);\n x01 = (x01 + x05) | 0;\n x13 = rotl(x13 ^ x01, 8);\n x09 = (x09 + x13) | 0;\n x05 = rotl(x05 ^ x09, 7);\n x02 = (x02 + x06) | 0;\n x14 = rotl(x14 ^ x02, 16);\n x10 = (x10 + x14) | 0;\n x06 = rotl(x06 ^ x10, 12);\n x02 = (x02 + x06) | 0;\n x14 = rotl(x14 ^ x02, 8);\n x10 = (x10 + x14) | 0;\n x06 = rotl(x06 ^ x10, 7);\n x03 = (x03 + x07) | 0;\n x15 = rotl(x15 ^ x03, 16);\n x11 = (x11 + x15) | 0;\n x07 = rotl(x07 ^ x11, 12);\n x03 = (x03 + x07) | 0;\n x15 = rotl(x15 ^ x03, 8);\n x11 = (x11 + x15) | 0;\n x07 = rotl(x07 ^ x11, 7);\n x00 = (x00 + x05) | 0;\n x15 = rotl(x15 ^ x00, 16);\n x10 = (x10 + x15) | 0;\n x05 = rotl(x05 ^ x10, 12);\n x00 = (x00 + x05) | 0;\n x15 = rotl(x15 ^ x00, 8);\n x10 = (x10 + x15) | 0;\n x05 = rotl(x05 ^ x10, 7);\n x01 = (x01 + x06) | 0;\n x12 = rotl(x12 ^ x01, 16);\n x11 = (x11 + x12) | 0;\n x06 = rotl(x06 ^ x11, 12);\n x01 = (x01 + x06) | 0;\n x12 = rotl(x12 ^ x01, 8);\n x11 = (x11 + x12) | 0;\n x06 = rotl(x06 ^ x11, 7);\n x02 = (x02 + x07) | 0;\n x13 = rotl(x13 ^ x02, 16);\n x08 = (x08 + x13) | 0;\n x07 = rotl(x07 ^ x08, 12);\n x02 = (x02 + x07) | 0;\n x13 = rotl(x13 ^ x02, 8);\n x08 = (x08 + x13) | 0;\n x07 = rotl(x07 ^ x08, 7);\n x03 = (x03 + x04) | 0;\n x14 = rotl(x14 ^ x03, 16);\n x09 = (x09 + x14) | 0;\n x04 = rotl(x04 ^ x09, 12);\n x03 = (x03 + x04) | 0;\n x14 = rotl(x14 ^ x03, 8);\n x09 = (x09 + x14) | 0;\n x04 = rotl(x04 ^ x09, 7);\n }\n // Write output\n let oi = 0;\n out[oi++] = (y00 + x00) | 0;\n out[oi++] = (y01 + x01) | 0;\n out[oi++] = (y02 + x02) | 0;\n out[oi++] = (y03 + x03) | 0;\n out[oi++] = (y04 + x04) | 0;\n out[oi++] = (y05 + x05) | 0;\n out[oi++] = (y06 + x06) | 0;\n out[oi++] = (y07 + x07) | 0;\n out[oi++] = (y08 + x08) | 0;\n out[oi++] = (y09 + x09) | 0;\n out[oi++] = (y10 + x10) | 0;\n out[oi++] = (y11 + x11) | 0;\n out[oi++] = (y12 + x12) | 0;\n out[oi++] = (y13 + x13) | 0;\n out[oi++] = (y14 + x14) | 0;\n out[oi++] = (y15 + x15) | 0;\n}\n/**\n * ChaCha stream cipher. Conforms to RFC 8439 (IETF, TLS). 12-byte nonce, 4-byte counter.\n * With smaller nonce, it's not safe to make it random (CSPRNG), due to collision chance.\n */\nexport const chacha20 = /* @__PURE__ */ createCipher(chachaCore, {\n counterRight: false,\n counterLength: 4,\n allowShortKeys: false,\n});\nconst ZEROS16 = /* @__PURE__ */ new Uint8Array(16);\n// Pad to digest size with zeros\nconst updatePadded = (h, msg) => {\n h.update(msg);\n const leftover = msg.length % 16;\n if (leftover)\n h.update(ZEROS16.subarray(leftover));\n};\nconst ZEROS32 = /* @__PURE__ */ new Uint8Array(32);\nfunction computeTag(fn, key, nonce, ciphertext, AAD) {\n if (AAD !== undefined)\n abytes(AAD, undefined, \"AAD\");\n const authKey = fn(key, nonce, ZEROS32);\n const lengths = u64Lengths(ciphertext.length, AAD ? AAD.length : 0, true);\n // Methods below can be replaced with\n // return poly1305_computeTag_small(authKey, lengths, ciphertext, AAD)\n const h = poly1305.create(authKey);\n if (AAD)\n updatePadded(h, AAD);\n updatePadded(h, ciphertext);\n h.update(lengths);\n const res = h.digest();\n clean(authKey, lengths);\n return res;\n}\n/**\n * AEAD algorithm from RFC 8439.\n * Salsa20 and chacha (RFC 8439) use poly1305 differently.\n * We could have composed them, but it's hard because of authKey:\n * In salsa20, authKey changes position in salsa stream.\n * In chacha, authKey can't be computed inside computeTag, it modifies the counter.\n */\nexport const _poly1305_aead = (xorStream) => (key, nonce, AAD) => {\n const tagLength = 16;\n return {\n encrypt(plaintext, output) {\n const plength = plaintext.length;\n output = getOutput(plength + tagLength, output, false);\n output.set(plaintext);\n const oPlain = output.subarray(0, -tagLength);\n // Actual encryption\n xorStream(key, nonce, oPlain, oPlain, 1);\n const tag = computeTag(xorStream, key, nonce, oPlain, AAD);\n output.set(tag, plength); // append tag\n clean(tag);\n return output;\n },\n decrypt(ciphertext, output) {\n output = getOutput(ciphertext.length - tagLength, output, false);\n const data = ciphertext.subarray(0, -tagLength);\n const passedTag = ciphertext.subarray(-tagLength);\n const tag = computeTag(xorStream, key, nonce, data, AAD);\n if (!equalBytes(passedTag, tag))\n throw new Error(\"invalid tag\");\n output.set(ciphertext.subarray(0, -tagLength));\n // Actual decryption\n xorStream(key, nonce, output, output, 1); // start stream with i=1\n clean(tag);\n return output;\n },\n };\n};\n/**\n * ChaCha20-Poly1305 from RFC 8439.\n *\n * Unsafe to use random nonces under the same key, due to collision chance.\n * Prefer XChaCha instead.\n */\nexport const chacha20poly1305 = /* @__PURE__ */ wrapCipher({ blockSize: 64, nonceLength: 12, tagLength: 16 }, _poly1305_aead(chacha20));\n","import { chacha20poly1305 } from \"./chacha/chacha.js\";\nimport { AeadId, toArrayBuffer } from \"@hpke/common\";\nexport class Chacha20Poly1305Context {\n constructor(key) {\n Object.defineProperty(this, \"_key\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n this._key = new Uint8Array(toArrayBuffer(key));\n }\n async seal(iv, data, aad) {\n return await this._seal(toArrayBuffer(iv), toArrayBuffer(data), toArrayBuffer(aad));\n }\n async open(iv, data, aad) {\n return await this._open(toArrayBuffer(iv), toArrayBuffer(data), toArrayBuffer(aad));\n }\n _seal(iv, data, aad) {\n return new Promise((resolve) => {\n const ret = chacha20poly1305(this._key, new Uint8Array(iv), new Uint8Array(aad)).encrypt(new Uint8Array(data));\n resolve(ret.buffer);\n });\n }\n _open(iv, data, aad) {\n return new Promise((resolve) => {\n const ret = chacha20poly1305(this._key, new Uint8Array(iv), new Uint8Array(aad)).decrypt(new Uint8Array(data));\n resolve(ret.buffer);\n });\n }\n}\n/**\n * The ChaCha20Poly1305 for HPKE AEAD implementing {@link AeadInterface}.\n *\n * When using `@hpke/core`, the instance of this class can be specified\n * to the `aead` parameter of {@link CipherSuiteParams} instead of `AeadId.Chacha20Poly1305`\n * as follows:\n *\n * @example\n *\n * ```ts\n * import {\n * CipherSuite,\n * DhkemP256HkdfSha256,\n * HkdfSha256,\n * } from \"@hpke/core\";\n * import {\n * Chacha20Poly1305,\n * } from \"@hpke/chacha20poly1305\";\n *\n * const suite = new CipherSuite({\n * kem: new DhkemP256HkdfSha256(),\n * kdf: new HkdfSha256(),\n * aead: new Chacha20Poly1305(),\n * });\n * ```\n *\n * This class is implemented using\n * {@link https://github.com/paulmillr/noble-ciphers | @noble/ciphers}.\n */\nexport class Chacha20Poly1305 {\n constructor() {\n /** AeadId.Chacha20Poly1305 (0x0003) */\n Object.defineProperty(this, \"id\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: AeadId.Chacha20Poly1305\n });\n /** 32 */\n Object.defineProperty(this, \"keySize\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 32\n });\n /** 12 */\n Object.defineProperty(this, \"nonceSize\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 12\n });\n /** 16 */\n Object.defineProperty(this, \"tagSize\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 16\n });\n }\n createEncryptionContext(key) {\n return new Chacha20Poly1305Context(key);\n }\n}\n","import { NotSupportedError } from \"@hpke/common\";\nexport function emitNotSupported() {\n return new Promise((_resolve, reject) => {\n reject(new NotSupportedError(\"Not supported\"));\n });\n}\n","import { ExportError, INPUT_LENGTH_LIMIT, InvalidParamError, toArrayBuffer, } from \"@hpke/common\";\nimport { emitNotSupported } from \"./utils/emitNotSupported.js\";\n// b\"sec\"\nconst LABEL_SEC = new Uint8Array([115, 101, 99]);\nexport class ExporterContextImpl {\n constructor(api, kdf, exporterSecret) {\n Object.defineProperty(this, \"_api\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"exporterSecret\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_kdf\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n this._api = api;\n this._kdf = kdf;\n this.exporterSecret = exporterSecret;\n }\n async seal(_data, _aad) {\n return await emitNotSupported();\n }\n async open(_data, _aad) {\n return await emitNotSupported();\n }\n async export(exporterContext, len) {\n const rawExporterContext = toArrayBuffer(exporterContext);\n if (rawExporterContext.byteLength > INPUT_LENGTH_LIMIT) {\n throw new InvalidParamError(\"Too long exporter context\");\n }\n try {\n return await this._kdf.labeledExpand(this.exporterSecret, LABEL_SEC, new Uint8Array(rawExporterContext), len);\n }\n catch (e) {\n throw new ExportError(e);\n }\n }\n}\nexport class RecipientExporterContextImpl extends ExporterContextImpl {\n}\nexport class SenderExporterContextImpl extends ExporterContextImpl {\n constructor(api, kdf, exporterSecret, enc) {\n super(api, kdf, exporterSecret);\n Object.defineProperty(this, \"enc\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n this.enc = enc;\n return;\n }\n}\n","import { i2Osp, MessageLimitReachedError, xor } from \"@hpke/common\";\nimport { ExporterContextImpl } from \"./exporterContext.js\";\nexport class EncryptionContextImpl extends ExporterContextImpl {\n constructor(api, kdf, params) {\n super(api, kdf, params.exporterSecret);\n // AEAD id.\n Object.defineProperty(this, \"_aead\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n // The length in bytes of a key for the algorithm.\n Object.defineProperty(this, \"_nK\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n // The length in bytes of a nonce for the algorithm.\n Object.defineProperty(this, \"_nN\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n // The length in bytes of an authentication tag for the algorithm.\n Object.defineProperty(this, \"_nT\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n // The end-to-end encryption key information.\n Object.defineProperty(this, \"_ctx\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n if (params.key === undefined || params.baseNonce === undefined ||\n params.seq === undefined) {\n throw new Error(\"Required parameters are missing\");\n }\n this._aead = params.aead;\n this._nK = this._aead.keySize;\n this._nN = this._aead.nonceSize;\n this._nT = this._aead.tagSize;\n const key = this._aead.createEncryptionContext(params.key);\n this._ctx = {\n key: key,\n baseNonce: params.baseNonce,\n seq: params.seq,\n };\n }\n computeNonce(k) {\n const seqBytes = i2Osp(k.seq, k.baseNonce.byteLength);\n return xor(k.baseNonce, seqBytes).buffer;\n }\n incrementSeq(k) {\n // if (this.seq >= (1 << (8 * this.baseNonce.byteLength)) - 1) {\n if (k.seq > Number.MAX_SAFE_INTEGER) {\n throw new MessageLimitReachedError(\"Message limit reached\");\n }\n k.seq += 1;\n return;\n }\n}\n","var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {\n if (kind === \"a\" && !f) throw new TypeError(\"Private accessor was defined without a getter\");\n if (typeof state === \"function\" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError(\"Cannot read private member from an object whose class did not declare it\");\n return kind === \"m\" ? f : kind === \"a\" ? f.call(receiver) : f ? f.value : state.get(receiver);\n};\nvar __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {\n if (kind === \"m\") throw new TypeError(\"Private method is not writable\");\n if (kind === \"a\" && !f) throw new TypeError(\"Private accessor was defined without a setter\");\n if (typeof state === \"function\" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError(\"Cannot write private member to an object whose class did not declare it\");\n return (kind === \"a\" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;\n};\nvar _Mutex_locked;\nexport class Mutex {\n constructor() {\n _Mutex_locked.set(this, Promise.resolve());\n }\n async lock() {\n let releaseLock;\n const nextLock = new Promise((resolve) => {\n releaseLock = resolve;\n });\n const previousLock = __classPrivateFieldGet(this, _Mutex_locked, \"f\");\n __classPrivateFieldSet(this, _Mutex_locked, nextLock, \"f\");\n await previousLock;\n return releaseLock;\n }\n}\n_Mutex_locked = new WeakMap();\n","var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {\n if (kind === \"a\" && !f) throw new TypeError(\"Private accessor was defined without a getter\");\n if (typeof state === \"function\" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError(\"Cannot read private member from an object whose class did not declare it\");\n return kind === \"m\" ? f : kind === \"a\" ? f.call(receiver) : f ? f.value : state.get(receiver);\n};\nvar __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {\n if (kind === \"m\") throw new TypeError(\"Private method is not writable\");\n if (kind === \"a\" && !f) throw new TypeError(\"Private accessor was defined without a setter\");\n if (typeof state === \"function\" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError(\"Cannot write private member to an object whose class did not declare it\");\n return (kind === \"a\" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;\n};\nvar _RecipientContextImpl_mutex;\nimport { EMPTY, OpenError, toArrayBuffer } from \"@hpke/common\";\nimport { EncryptionContextImpl } from \"./encryptionContext.js\";\nimport { Mutex } from \"./mutex.js\";\nexport class RecipientContextImpl extends EncryptionContextImpl {\n constructor() {\n super(...arguments);\n _RecipientContextImpl_mutex.set(this, void 0);\n }\n async open(data, aad = EMPTY.buffer) {\n __classPrivateFieldSet(this, _RecipientContextImpl_mutex, __classPrivateFieldGet(this, _RecipientContextImpl_mutex, \"f\") ?? new Mutex(), \"f\");\n const release = await __classPrivateFieldGet(this, _RecipientContextImpl_mutex, \"f\").lock();\n let pt;\n try {\n pt = await this._ctx.key.open(this.computeNonce(this._ctx), toArrayBuffer(data), toArrayBuffer(aad));\n }\n catch (e) {\n throw new OpenError(e);\n }\n finally {\n release();\n }\n this.incrementSeq(this._ctx);\n return pt;\n }\n}\n_RecipientContextImpl_mutex = new WeakMap();\n","var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {\n if (kind === \"a\" && !f) throw new TypeError(\"Private accessor was defined without a getter\");\n if (typeof state === \"function\" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError(\"Cannot read private member from an object whose class did not declare it\");\n return kind === \"m\" ? f : kind === \"a\" ? f.call(receiver) : f ? f.value : state.get(receiver);\n};\nvar __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {\n if (kind === \"m\") throw new TypeError(\"Private method is not writable\");\n if (kind === \"a\" && !f) throw new TypeError(\"Private accessor was defined without a setter\");\n if (typeof state === \"function\" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError(\"Cannot write private member to an object whose class did not declare it\");\n return (kind === \"a\" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;\n};\nvar _SenderContextImpl_mutex;\nimport { EMPTY, SealError, toArrayBuffer } from \"@hpke/common\";\nimport { EncryptionContextImpl } from \"./encryptionContext.js\";\nimport { Mutex } from \"./mutex.js\";\nexport class SenderContextImpl extends EncryptionContextImpl {\n constructor(api, kdf, params, enc) {\n super(api, kdf, params);\n Object.defineProperty(this, \"enc\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n _SenderContextImpl_mutex.set(this, void 0);\n this.enc = enc;\n }\n async seal(data, aad = EMPTY.buffer) {\n __classPrivateFieldSet(this, _SenderContextImpl_mutex, __classPrivateFieldGet(this, _SenderContextImpl_mutex, \"f\") ?? new Mutex(), \"f\");\n const release = await __classPrivateFieldGet(this, _SenderContextImpl_mutex, \"f\").lock();\n let ct;\n try {\n ct = await this._ctx.key.seal(this.computeNonce(this._ctx), toArrayBuffer(data), toArrayBuffer(aad));\n }\n catch (e) {\n throw new SealError(e);\n }\n finally {\n release();\n }\n this.incrementSeq(this._ctx);\n return ct;\n }\n}\n_SenderContextImpl_mutex = new WeakMap();\n","import { AeadId, EMPTY, i2Osp, INFO_LENGTH_LIMIT, INPUT_LENGTH_LIMIT, InvalidParamError, MINIMUM_PSK_LENGTH, Mode, NativeAlgorithm, toUint8Array, } from \"@hpke/common\";\nimport { RecipientExporterContextImpl, SenderExporterContextImpl, } from \"./exporterContext.js\";\nimport { RecipientContextImpl } from \"./recipientContext.js\";\nimport { SenderContextImpl } from \"./senderContext.js\";\n// b\"base_nonce\"\n// deno-fmt-ignore\nconst LABEL_BASE_NONCE = new Uint8Array([\n 98, 97, 115, 101, 95, 110, 111, 110, 99, 101,\n]);\n// b\"exp\"\nconst LABEL_EXP = new Uint8Array([101, 120, 112]);\n// b\"info_hash\"\n// deno-fmt-ignore\nconst LABEL_INFO_HASH = new Uint8Array([\n 105, 110, 102, 111, 95, 104, 97, 115, 104,\n]);\n// b\"key\"\nconst LABEL_KEY = new Uint8Array([107, 101, 121]);\n// b\"psk_id_hash\"\n// deno-fmt-ignore\nconst LABEL_PSK_ID_HASH = new Uint8Array([\n 112, 115, 107, 95, 105, 100, 95, 104, 97, 115, 104,\n]);\n// b\"secret\"\nconst LABEL_SECRET = new Uint8Array([115, 101, 99, 114, 101, 116]);\n// b\"HPKE\"\n// deno-fmt-ignore\nconst SUITE_ID_HEADER_HPKE = new Uint8Array([\n 72, 80, 75, 69, 0, 0, 0, 0, 0, 0,\n]);\n/**\n * The Hybrid Public Key Encryption (HPKE) ciphersuite,\n * which is implemented using only\n * {@link https://www.w3.org/TR/WebCryptoAPI/ | Web Cryptography API}.\n *\n * This is the super class of {@link CipherSuite} and the same as\n * {@link https://jsr.io/@hpke/core/doc/~/CipherSuite | @hpke/core#CipherSuite} as follows:\n * which supports only the ciphersuites that can be implemented on the native\n * {@link https://www.w3.org/TR/WebCryptoAPI/ | Web Cryptography API}.\n * Therefore, the following cryptographic algorithms are not supported for now:\n * - DHKEM(X25519, HKDF-SHA256)\n * - DHKEM(X448, HKDF-SHA512)\n * - ChaCha20Poly1305\n *\n * In addtion, the HKDF functions contained in this class can only derive\n * keys of the same length as the `hashSize`.\n *\n * If you want to use the unsupported cryptographic algorithms\n * above or derive keys longer than the `hashSize`,\n * please use {@link CipherSuite}.\n *\n * This class provides following functions:\n *\n * - Creates encryption contexts both for senders and recipients.\n * - {@link createSenderContext}\n * - {@link createRecipientContext}\n * - Provides single-shot encryption API.\n * - {@link seal}\n * - {@link open}\n *\n * The calling of the constructor of this class is the starting\n * point for HPKE operations for both senders and recipients.\n *\n * @example Use only ciphersuites supported by Web Cryptography API.\n *\n * ```ts\n * import {\n * Aes128Gcm,\n * DhkemP256HkdfSha256,\n * HkdfSha256,\n * CipherSuite,\n * } from \"@hpke/core\";\n *\n * const suite = new CipherSuite({\n * kem: new DhkemP256HkdfSha256(),\n * kdf: new HkdfSha256(),\n * aead: new Aes128Gcm(),\n * });\n * ```\n *\n * @example Use a ciphersuite which is currently not supported by Web Cryptography API.\n *\n * ```ts\n * import { Aes128Gcm, HkdfSha256, CipherSuite } from \"@hpke/core\";\n * // Use an extension module.\n * import { DhkemX25519HkdfSha256 } from \"@hpke/dhkem-x25519\";\n *\n * const suite = new CipherSuite({\n * kem: new DhkemX25519HkdfSha256(),\n * kdf: new HkdfSha256(),\n * aead: new Aes128Gcm(),\n * });\n * ```\n */\nexport class CipherSuiteNative extends NativeAlgorithm {\n /**\n * @param params A set of parameters for building a cipher suite.\n *\n * If the error occurred, throws {@link InvalidParamError}.\n *\n * @throws {@link InvalidParamError}\n */\n constructor(params) {\n super();\n Object.defineProperty(this, \"_kem\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_kdf\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_aead\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_suiteId\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n // KEM\n if (typeof params.kem === \"number\") {\n throw new InvalidParamError(\"KemId cannot be used\");\n }\n this._kem = params.kem;\n // KDF\n if (typeof params.kdf === \"number\") {\n throw new InvalidParamError(\"KdfId cannot be used\");\n }\n this._kdf = params.kdf;\n // AEAD\n if (typeof params.aead === \"number\") {\n throw new InvalidParamError(\"AeadId cannot be used\");\n }\n this._aead = params.aead;\n this._suiteId = new Uint8Array(SUITE_ID_HEADER_HPKE);\n this._suiteId.set(i2Osp(this._kem.id, 2), 4);\n this._suiteId.set(i2Osp(this._kdf.id, 2), 6);\n this._suiteId.set(i2Osp(this._aead.id, 2), 8);\n this._kdf.init(this._suiteId);\n }\n /**\n * Gets the KEM context of the ciphersuite.\n */\n get kem() {\n return this._kem;\n }\n /**\n * Gets the KDF context of the ciphersuite.\n */\n get kdf() {\n return this._kdf;\n }\n /**\n * Gets the AEAD context of the ciphersuite.\n */\n get aead() {\n return this._aead;\n }\n /**\n * Creates an encryption context for a sender.\n *\n * If the error occurred, throws {@link DecapError} | {@link ValidationError}.\n *\n * @param params A set of parameters for the sender encryption context.\n * @returns A sender encryption context.\n * @throws {@link EncapError}, {@link ValidationError}\n */\n async createSenderContext(params) {\n this._validateInputLength(params);\n await this._setup();\n const dh = await this._kem.encap(params);\n let mode;\n if (params.psk !== undefined) {\n mode = params.senderKey !== undefined ? Mode.AuthPsk : Mode.Psk;\n }\n else {\n mode = params.senderKey !== undefined ? Mode.Auth : Mode.Base;\n }\n return await this._keyScheduleS(mode, dh.sharedSecret, dh.enc, params);\n }\n /**\n * Creates an encryption context for a recipient.\n *\n * If the error occurred, throws {@link DecapError}\n * | {@link DeserializeError} | {@link ValidationError}.\n *\n * @param params A set of parameters for the recipient encryption context.\n * @returns A recipient encryption context.\n * @throws {@link DecapError}, {@link DeserializeError}, {@link ValidationError}\n */\n async createRecipientContext(params) {\n this._validateInputLength(params);\n await this._setup();\n const sharedSecret = await this._kem.decap(params);\n let mode;\n if (params.psk !== undefined) {\n mode = params.senderPublicKey !== undefined ? Mode.AuthPsk : Mode.Psk;\n }\n else {\n mode = params.senderPublicKey !== undefined ? Mode.Auth : Mode.Base;\n }\n return await this._keyScheduleR(mode, sharedSecret, params);\n }\n /**\n * Encrypts a message to a recipient.\n *\n * If the error occurred, throws `EncapError` | `MessageLimitReachedError` | `SealError` | `ValidationError`.\n *\n * @param params A set of parameters for building a sender encryption context.\n * @param pt A plain text as bytes to be encrypted.\n * @param aad Additional authenticated data as bytes fed by an application.\n * @returns A cipher text and an encapsulated key as bytes.\n * @throws {@link EncapError}, {@link MessageLimitReachedError}, {@link SealError}, {@link ValidationError}\n */\n async seal(params, pt, aad = EMPTY.buffer) {\n const ctx = await this.createSenderContext(params);\n return {\n ct: await ctx.seal(pt, aad),\n enc: ctx.enc,\n };\n }\n /**\n * Decrypts a message from a sender.\n *\n * If the error occurred, throws `DecapError` | `DeserializeError` | `OpenError` | `ValidationError`.\n *\n * @param params A set of parameters for building a recipient encryption context.\n * @param ct An encrypted text as bytes to be decrypted.\n * @param aad Additional authenticated data as bytes fed by an application.\n * @returns A decrypted plain text as bytes.\n * @throws {@link DecapError}, {@link DeserializeError}, {@link OpenError}, {@link ValidationError}\n */\n async open(params, ct, aad = EMPTY.buffer) {\n const ctx = await this.createRecipientContext(params);\n return await ctx.open(ct, aad);\n }\n // private verifyPskInputs(mode: Mode, params: KeyScheduleParams) {\n // const gotPsk = (params.psk !== undefined);\n // const gotPskId = (params.psk !== undefined && params.psk.id.byteLength > 0);\n // if (gotPsk !== gotPskId) {\n // throw new Error('Inconsistent PSK inputs');\n // }\n // if (gotPsk && (mode === Mode.Base || mode === Mode.Auth)) {\n // throw new Error('PSK input provided when not needed');\n // }\n // if (!gotPsk && (mode === Mode.Psk || mode === Mode.AuthPsk)) {\n // throw new Error('Missing required PSK input');\n // }\n // return;\n // }\n async _keySchedule(mode, sharedSecret, params) {\n // Currently, there is no point in executing this function\n // because this hpke library does not allow users to explicitly specify the mode.\n //\n // this.verifyPskInputs(mode, params);\n const pskId = params.psk === undefined\n ? EMPTY\n : toUint8Array(params.psk.id);\n const pskIdHash = await this._kdf.labeledExtract(EMPTY, LABEL_PSK_ID_HASH, pskId);\n const info = params.info === undefined ? EMPTY : toUint8Array(params.info);\n const infoHash = await this._kdf.labeledExtract(EMPTY, LABEL_INFO_HASH, info);\n const keyScheduleContext = new Uint8Array(1 + pskIdHash.byteLength + infoHash.byteLength);\n keyScheduleContext.set(new Uint8Array([mode]), 0);\n keyScheduleContext.set(new Uint8Array(pskIdHash), 1);\n keyScheduleContext.set(new Uint8Array(infoHash), 1 + pskIdHash.byteLength);\n const psk = params.psk === undefined ? EMPTY : toUint8Array(params.psk.key);\n const ikm = this._kdf.buildLabeledIkm(LABEL_SECRET, psk);\n const exporterSecretInfo = this._kdf.buildLabeledInfo(LABEL_EXP, keyScheduleContext, this._kdf.hashSize);\n const exporterSecret = await this._kdf.extractAndExpand(sharedSecret, ikm, exporterSecretInfo, this._kdf.hashSize);\n if (this._aead.id === AeadId.ExportOnly) {\n return { aead: this._aead, exporterSecret: exporterSecret };\n }\n const keyInfo = this._kdf.buildLabeledInfo(LABEL_KEY, keyScheduleContext, this._aead.keySize);\n const key = await this._kdf.extractAndExpand(sharedSecret, ikm, keyInfo, this._aead.keySize);\n const baseNonceInfo = this._kdf.buildLabeledInfo(LABEL_BASE_NONCE, keyScheduleContext, this._aead.nonceSize);\n const baseNonce = await this._kdf.extractAndExpand(sharedSecret, ikm, baseNonceInfo, this._aead.nonceSize);\n return {\n aead: this._aead,\n exporterSecret: exporterSecret,\n key: key,\n baseNonce: new Uint8Array(baseNonce),\n seq: 0,\n };\n }\n async _keyScheduleS(mode, sharedSecret, enc, params) {\n const res = await this._keySchedule(mode, sharedSecret, params);\n if (res.key === undefined) {\n return new SenderExporterContextImpl(this._api, this._kdf, res.exporterSecret, enc);\n }\n return new SenderContextImpl(this._api, this._kdf, res, enc);\n }\n async _keyScheduleR(mode, sharedSecret, params) {\n const res = await this._keySchedule(mode, sharedSecret, params);\n if (res.key === undefined) {\n return new RecipientExporterContextImpl(this._api, this._kdf, res.exporterSecret);\n }\n return new RecipientContextImpl(this._api, this._kdf, res);\n }\n _validateInputLength(params) {\n if (params.info !== undefined &&\n params.info.byteLength > INFO_LENGTH_LIMIT) {\n throw new InvalidParamError(\"Too long info\");\n }\n if (params.psk !== undefined) {\n if (params.psk.key.byteLength < MINIMUM_PSK_LENGTH) {\n throw new InvalidParamError(`PSK must have at least ${MINIMUM_PSK_LENGTH} bytes`);\n }\n if (params.psk.key.byteLength > INPUT_LENGTH_LIMIT) {\n throw new InvalidParamError(\"Too long psk.key\");\n }\n if (params.psk.id.byteLength > INPUT_LENGTH_LIMIT) {\n throw new InvalidParamError(\"Too long psk.id\");\n }\n }\n return;\n }\n}\n","import { HkdfSha256Native, HkdfSha384Native, HkdfSha512Native, } from \"@hpke/common\";\nimport { CipherSuiteNative } from \"./cipherSuiteNative.js\";\nimport { DhkemP256HkdfSha256Native, DhkemP384HkdfSha384Native, DhkemP521HkdfSha512Native, } from \"./kems/dhkemNative.js\";\n/**\n * The Hybrid Public Key Encryption (HPKE) ciphersuite,\n * which is implemented using only\n * {@link https://www.w3.org/TR/WebCryptoAPI/ | Web Cryptography API}.\n *\n * This class is the same as\n * {@link https://jsr.io/@hpke/core/doc/~/CipherSuiteNative | @hpke/core#CipherSuiteNative} as follows:\n * which supports only the ciphersuites that can be implemented on the native\n * {@link https://www.w3.org/TR/WebCryptoAPI/ | Web Cryptography API}.\n * Therefore, the following cryptographic algorithms are not supported for now:\n * - `DHKEM(X448, HKDF-SHA512)`\n * - `ChaCha20Poly1305`\n *\n * In addtion, the HKDF functions contained in this `CipherSuiteNative`\n * class can only derive keys of the same length as the `hashSize`.\n *\n * If you want to use the unsupported cryptographic algorithms\n * above or derive keys longer than the `hashSize`,\n * please use {@link https://jsr.io/@hpke/hpke-js/doc/~/CipherSuite | hpke-js#CipherSuite}.\n *\n * This class provides following functions:\n *\n * - Creates encryption contexts both for senders and recipients.\n * - {@link createSenderContext}\n * - {@link createRecipientContext}\n * - Provides single-shot encryption API.\n * - {@link seal}\n * - {@link open}\n *\n * The calling of the constructor of this class is the starting\n * point for HPKE operations for both senders and recipients.\n *\n * @example Use only ciphersuites supported by Web Cryptography API.\n *\n * ```ts\n * import {\n * Aes128Gcm,\n * DhkemP256HkdfSha256,\n * HkdfSha256,\n * CipherSuite,\n * } from \"@hpke/core\";\n *\n * const suite = new CipherSuite({\n * kem: new DhkemP256HkdfSha256(),\n * kdf: new HkdfSha256(),\n * aead: new Aes128Gcm(),\n * });\n * ```\n *\n * @example Use DHKEM(X25519, HKDF-SHA256).\n *\n * ```ts\n * import {\n * Aes128Gcm,\n * CipherSuite,\n * DhkemX25519HkdfSha256,\n * HkdfSha256,\n * } from \"@hpke/core\";\n * const suite = new CipherSuite({\n * kem: new DhkemX25519HkdfSha256(),\n * kdf: new HkdfSha256(),\n * aead: new Aes128Gcm(),\n * });\n * ```\n */\nexport class CipherSuite extends CipherSuiteNative {\n}\n/**\n * The DHKEM(P-256, HKDF-SHA256) for HPKE KEM implementing {@link KemInterface}.\n *\n * When using `@hpke/core`, the instance of this class must be specified\n * to the `kem` parameter of {@link CipherSuiteParams} instead of `KemId.DhkemP256HkdfSha256`\n * as follows:\n *\n * @example\n *\n * ```ts\n * import {\n * Aes128Gcm,\n * CipherSuite,\n * DhkemP256HkdfSha256,\n * HkdfSha256,\n * } from \"@hpke/core\";\n *\n * const suite = new CipherSuite({\n * kem: new DhkemP256HkdfSha256(),\n * kdf: new HkdfSha256(),\n * aead: new Aes128Gcm(),\n * });\n * ```\n */\nexport class DhkemP256HkdfSha256 extends DhkemP256HkdfSha256Native {\n}\n/**\n * The DHKEM(P-384, HKDF-SHA384) for HPKE KEM implementing {@link KemInterface}.\n *\n * When using `@hpke/core`, the instance of this class must be specified\n * to the `kem` parameter of {@link CipherSuiteParams} instead of `KemId.DhkemP384HkdfSha384`\n * as follows:\n *\n * @example\n *\n * ```ts\n * import {\n * Aes128Gcm,\n * CipherSuite,\n * DhkemP384HkdfSha384,\n * HkdfSha384,\n * } from \"@hpke/core\";\n *\n * const suite = new CipherSuite({\n * kem: new DhkemP384HkdfSha384(),\n * kdf: new HkdfSha384(),\n * aead: new Aes128Gcm(),\n * });\n * ```\n */\nexport class DhkemP384HkdfSha384 extends DhkemP384HkdfSha384Native {\n}\n/**\n * The DHKEM(P-521, HKDF-SHA512) for HPKE KEM implementing {@link KemInterface}.\n *\n * When using `@hpke/core`, the instance of this class must be specified\n * to the `kem` parameter of {@link CipherSuiteParams} instead of `KemId.DhkemP521HkdfSha512`\n * as follows:\n *\n * @example\n *\n * ```ts\n * import {\n * Aes256Gcm,\n * CipherSuite,\n * DhkemP521HkdfSha512,\n * HkdfSha512,\n * } from \"@hpke/core\";\n *\n * const suite = new CipherSuite({\n * kem: new DhkemP521HkdfSha512(),\n * kdf: new HkdfSha512(),\n * aead: new Aes256Gcm(),\n * });\n * ```\n */\nexport class DhkemP521HkdfSha512 extends DhkemP521HkdfSha512Native {\n}\n/**\n * The HKDF-SHA256 for HPKE KDF implementing {@link KdfInterface}.\n *\n * When using `@hpke/core`, the instance of this class must be specified\n * to the `kem` parameter of {@link CipherSuiteParams} instead of `KdfId.HkdfSha256`.\n *\n * The KDF class can only derive keys of the same length as the `hashSize`.\n * If you want to derive keys longer than the `hashSize`,\n * please use {@link https://jsr.io/@hpke/hpke-js/doc/~/CipherSuite | hpke-js#CipherSuite}.\n *\n * @example\n *\n * ```ts\n * import {\n * Aes128Gcm,\n * CipherSuite,\n * DhkemP256HkdfSha256,\n * HkdfSha256,\n * } from \"@hpke/core\";\n *\n * const suite = new CipherSuite({\n * kem: new DhkemP256HkdfSha256(),\n * kdf: new HkdfSha256(),\n * aead: new Aes128Gcm(),\n * });\n * ```\n */\nexport class HkdfSha256 extends HkdfSha256Native {\n}\n/**\n * The HKDF-SHA384 for HPKE KDF implementing {@link KdfInterface}.\n *\n * When using `@hpke/core`, the instance of this class must be specified\n * to the `kem` parameter of {@link CipherSuiteParams} instead of `KdfId.HkdfSha384`.\n *\n * The KDF class can only derive keys of the same length as the `hashSize`.\n * If you want to derive keys longer than the `hashSize`,\n * please use {@link https://jsr.io/@hpke/hpke-js/doc/~/CipherSuite | hpke-js#CipherSuite}.\n *\n * @example\n *\n * ```ts\n * import {\n * Aes128Gcm,\n * CipherSuite,\n * DhkemP384HkdfSha384,\n * HkdfSha384,\n * } from \"@hpke/core\";\n *\n * const suite = new CipherSuite({\n * kem: new DhkemP384HkdfSha384(),\n * kdf: new HkdfSha384(),\n * aead: new Aes128Gcm(),\n * });\n * ```\n */\nexport class HkdfSha384 extends HkdfSha384Native {\n}\n/**\n * The HKDF-SHA512 for HPKE KDF implementing {@link KdfInterface}.\n *\n * When using `@hpke/core`, the instance of this class must be specified\n * to the `kem` parameter of {@link CipherSuiteParams} instead of `KdfId.HkdfSha512`.\n *\n * The KDF class can only derive keys of the same length as the `hashSize`.\n * If you want to derive keys longer than the `hashSize`,\n * please use {@link https://jsr.io/@hpke/hpke-js/doc/~/CipherSuite | hpke-js#CipherSuite}.\n *\n * @example\n *\n * ```ts\n * import {\n * Aes256Gcm,\n * CipherSuite,\n * DhkemP521HkdfSha512,\n * HkdfSha512,\n * } from \"@hpke/core\";\n *\n * const suite = new CipherSuite({\n * kem: new DhkemP521HkdfSha512(),\n * kdf: new HkdfSha512(),\n * aead: new Aes256Gcm(),\n * });\n * ```\n */\nexport class HkdfSha512 extends HkdfSha512Native {\n}\n","import { base64UrlToBytes, DeriveKeyPairError, DeserializeError, EMPTY, KEM_USAGES, LABEL_DKP_PRK, LABEL_SK, NativeAlgorithm, NotSupportedError, SerializeError, toArrayBuffer, } from \"@hpke/common\";\nconst ALG_NAME = \"X25519\";\n// deno-fmt-ignore\nconst PKCS8_ALG_ID_X25519 = new Uint8Array([\n 0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06,\n 0x03, 0x2b, 0x65, 0x6e, 0x04, 0x22, 0x04, 0x20,\n]);\nconst BASE_POINT_X25519 = /* @__PURE__ */ (() => {\n const p = new Uint8Array(32);\n p[0] = 9;\n return p;\n})();\nexport class X25519 extends NativeAlgorithm {\n constructor(hkdf) {\n super();\n Object.defineProperty(this, \"_hkdf\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_alg\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_nPk\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_nSk\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_nDh\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_pkcs8AlgId\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n this._alg = { name: ALG_NAME };\n this._hkdf = hkdf;\n this._nPk = 32;\n this._nSk = 32;\n this._nDh = 32;\n this._pkcs8AlgId = PKCS8_ALG_ID_X25519;\n }\n async serializePublicKey(key) {\n await this._setup();\n try {\n return await this._api.exportKey(\"raw\", key);\n }\n catch (e) {\n throw new SerializeError(e);\n }\n }\n async deserializePublicKey(key) {\n await this._setup();\n try {\n return await this._importRawKey(toArrayBuffer(key), true);\n }\n catch (e) {\n throw new DeserializeError(e);\n }\n }\n async serializePrivateKey(key) {\n await this._setup();\n try {\n const jwk = await this._api.exportKey(\"jwk\", key);\n if (!(\"d\" in jwk)) {\n throw new Error(\"Not private key\");\n }\n return base64UrlToBytes(jwk[\"d\"]).buffer;\n }\n catch (e) {\n throw new SerializeError(e);\n }\n }\n async deserializePrivateKey(key) {\n await this._setup();\n try {\n return await this._importRawKey(toArrayBuffer(key), false);\n }\n catch (e) {\n throw new DeserializeError(e);\n }\n }\n async importKey(format, key, isPublic) {\n await this._setup();\n try {\n if (format === \"raw\") {\n return await this._importRawKey(key, isPublic);\n }\n // jwk\n if (key instanceof ArrayBuffer) {\n throw new Error(\"Invalid jwk key format\");\n }\n return await this._importJWK(key, isPublic);\n }\n catch (e) {\n throw new DeserializeError(e);\n }\n }\n async generateKeyPair() {\n await this._setup();\n try {\n return await this._api.generateKey(ALG_NAME, true, KEM_USAGES);\n }\n catch (e) {\n throw new NotSupportedError(e);\n }\n }\n async deriveKeyPair(ikm) {\n await this._setup();\n try {\n const rawIkm = toArrayBuffer(ikm);\n const dkpPrk = await this._hkdf.labeledExtract(EMPTY, LABEL_DKP_PRK, new Uint8Array(rawIkm));\n const rawSk = await this._hkdf.labeledExpand(dkpPrk, LABEL_SK, EMPTY, this._nSk);\n const rawSkBytes = new Uint8Array(rawSk);\n const sk = await this._deserializePkcs8Key(rawSkBytes);\n rawSkBytes.fill(0);\n return {\n privateKey: sk,\n publicKey: await this.derivePublicKey(sk),\n };\n }\n catch (e) {\n throw new DeriveKeyPairError(e);\n }\n }\n async derivePublicKey(key) {\n await this._setup();\n try {\n const jwk = await this._api.exportKey(\"jwk\", key);\n delete jwk[\"d\"];\n delete jwk[\"key_ops\"];\n return await this._api.importKey(\"jwk\", jwk, this._alg, true, []);\n }\n catch {\n try {\n // Firefox fails to export JWK from some imported X25519 private keys.\n const bp = await this._api.importKey(\"raw\", BASE_POINT_X25519.buffer, this._alg, true, []);\n const bits = await this._api.deriveBits({\n name: ALG_NAME,\n public: bp,\n }, key, this._nPk * 8);\n return await this._api.importKey(\"raw\", bits, this._alg, true, []);\n }\n catch (e) {\n throw new DeserializeError(e);\n }\n }\n }\n async dh(sk, pk) {\n await this._setup();\n try {\n const bits = await this._api.deriveBits({\n name: ALG_NAME,\n public: pk,\n }, sk, this._nDh * 8);\n return bits;\n }\n catch (e) {\n throw new SerializeError(e);\n }\n }\n async _importRawKey(key, isPublic) {\n if (isPublic && key.byteLength !== this._nPk) {\n throw new Error(\"Invalid public key for the ciphersuite\");\n }\n if (!isPublic && key.byteLength !== this._nSk) {\n throw new Error(\"Invalid private key for the ciphersuite\");\n }\n if (isPublic) {\n return await this._api.importKey(\"raw\", key, this._alg, true, []);\n }\n return await this._deserializePkcs8Key(new Uint8Array(key));\n }\n async _importJWK(key, isPublic) {\n if (typeof key.kty === \"undefined\" || key.kty !== \"OKP\") {\n throw new Error(`Invalid kty: ${key.crv}`);\n }\n if (typeof key.crv === \"undefined\" || key.crv !== ALG_NAME) {\n throw new Error(`Invalid crv: ${key.crv}`);\n }\n if (isPublic) {\n if (typeof key.d !== \"undefined\") {\n throw new Error(\"Invalid key: `d` should not be set\");\n }\n return await this._api.importKey(\"jwk\", key, this._alg, true, []);\n }\n if (typeof key.d === \"undefined\") {\n throw new Error(\"Invalid key: `d` not found\");\n }\n return await this._api.importKey(\"jwk\", key, this._alg, true, KEM_USAGES);\n }\n async _deserializePkcs8Key(k) {\n const pkcs8Key = new Uint8Array(this._pkcs8AlgId.length + k.length);\n pkcs8Key.set(this._pkcs8AlgId, 0);\n pkcs8Key.set(k, this._pkcs8AlgId.length);\n return await this._api.importKey(\"pkcs8\", pkcs8Key, this._alg, true, KEM_USAGES);\n }\n}\n","import { base64UrlToBytes, DeriveKeyPairError, DeserializeError, EMPTY, KEM_USAGES, LABEL_DKP_PRK, LABEL_SK, NativeAlgorithm, NotSupportedError, SerializeError, toArrayBuffer, } from \"@hpke/common\";\nconst ALG_NAME = \"X448\";\n// deno-fmt-ignore\nconst PKCS8_ALG_ID_X448 = new Uint8Array([\n 0x30, 0x46, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06,\n 0x03, 0x2b, 0x65, 0x6f, 0x04, 0x3a, 0x04, 0x38,\n]);\nconst BASE_POINT_X448 = /* @__PURE__ */ (() => {\n const p = new Uint8Array(56);\n p[0] = 5;\n return p;\n})();\nexport class X448 extends NativeAlgorithm {\n constructor(hkdf) {\n super();\n Object.defineProperty(this, \"_hkdf\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_alg\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_nPk\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_nSk\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_nDh\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n Object.defineProperty(this, \"_pkcs8AlgId\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: void 0\n });\n this._alg = { name: ALG_NAME };\n this._hkdf = hkdf;\n this._nPk = 56;\n this._nSk = 56;\n this._nDh = 56;\n this._pkcs8AlgId = PKCS8_ALG_ID_X448;\n }\n async serializePublicKey(key) {\n await this._setup();\n try {\n return await this._api.exportKey(\"raw\", key);\n }\n catch (e) {\n throw new SerializeError(e);\n }\n }\n async deserializePublicKey(key) {\n await this._setup();\n try {\n return await this._importRawKey(toArrayBuffer(key), true);\n }\n catch (e) {\n throw new DeserializeError(e);\n }\n }\n async serializePrivateKey(key) {\n await this._setup();\n try {\n const jwk = await this._api.exportKey(\"jwk\", key);\n if (!(\"d\" in jwk)) {\n throw new Error(\"Not private key\");\n }\n return base64UrlToBytes(jwk[\"d\"]).buffer;\n }\n catch (e) {\n throw new SerializeError(e);\n }\n }\n async deserializePrivateKey(key) {\n await this._setup();\n try {\n return await this._importRawKey(toArrayBuffer(key), false);\n }\n catch (e) {\n throw new DeserializeError(e);\n }\n }\n async importKey(format, key, isPublic) {\n await this._setup();\n try {\n if (format === \"raw\") {\n return await this._importRawKey(key, isPublic);\n }\n // jwk\n if (key instanceof ArrayBuffer) {\n throw new Error(\"Invalid jwk key format\");\n }\n return await this._importJWK(key, isPublic);\n }\n catch (e) {\n throw new DeserializeError(e);\n }\n }\n async generateKeyPair() {\n await this._setup();\n try {\n return await this._api.generateKey(ALG_NAME, true, KEM_USAGES);\n }\n catch (e) {\n throw new NotSupportedError(e);\n }\n }\n async deriveKeyPair(ikm) {\n await this._setup();\n try {\n const rawIkm = toArrayBuffer(ikm);\n const dkpPrk = await this._hkdf.labeledExtract(EMPTY, LABEL_DKP_PRK, new Uint8Array(rawIkm));\n const rawSk = await this._hkdf.labeledExpand(dkpPrk, LABEL_SK, EMPTY, this._nSk);\n const rawSkBytes = new Uint8Array(rawSk);\n const sk = await this._deserializePkcs8Key(rawSkBytes);\n rawSkBytes.fill(0);\n return {\n privateKey: sk,\n publicKey: await this.derivePublicKey(sk),\n };\n }\n catch (e) {\n throw new DeriveKeyPairError(e);\n }\n }\n async derivePublicKey(key) {\n await this._setup();\n try {\n const jwk = await this._api.exportKey(\"jwk\", key);\n delete jwk[\"d\"];\n delete jwk[\"key_ops\"];\n return await this._api.importKey(\"jwk\", jwk, this._alg, true, []);\n }\n catch {\n try {\n // Some runtimes cannot export JWK from imported X448 private keys.\n const bp = await this._api.importKey(\"raw\", BASE_POINT_X448.buffer, this._alg, true, []);\n const bits = await this._api.deriveBits({\n name: ALG_NAME,\n public: bp,\n }, key, this._nPk * 8);\n return await this._api.importKey(\"raw\", bits, this._alg, true, []);\n }\n catch (e) {\n throw new DeserializeError(e);\n }\n }\n }\n async dh(sk, pk) {\n await this._setup();\n try {\n const bits = await this._api.deriveBits({\n name: ALG_NAME,\n public: pk,\n }, sk, this._nDh * 8);\n return bits;\n }\n catch (e) {\n throw new SerializeError(e);\n }\n }\n async _importRawKey(key, isPublic) {\n if (isPublic && key.byteLength !== this._nPk) {\n throw new Error(\"Invalid public key for the ciphersuite\");\n }\n if (!isPublic && key.byteLength !== this._nSk) {\n throw new Error(\"Invalid private key for the ciphersuite\");\n }\n if (isPublic) {\n return await this._api.importKey(\"raw\", key, this._alg, true, []);\n }\n return await this._deserializePkcs8Key(new Uint8Array(key));\n }\n async _importJWK(key, isPublic) {\n if (typeof key.kty === \"undefined\" || key.kty !== \"OKP\") {\n throw new Error(`Invalid kty: ${key.crv}`);\n }\n if (typeof key.crv === \"undefined\" || key.crv !== ALG_NAME) {\n throw new Error(`Invalid crv: ${key.crv}`);\n }\n if (isPublic) {\n if (typeof key.d !== \"undefined\") {\n throw new Error(\"Invalid key: `d` should not be set\");\n }\n return await this._api.importKey(\"jwk\", key, this._alg, true, []);\n }\n if (typeof key.d === \"undefined\") {\n throw new Error(\"Invalid key: `d` not found\");\n }\n return await this._api.importKey(\"jwk\", key, this._alg, true, KEM_USAGES);\n }\n async _deserializePkcs8Key(k) {\n const pkcs8Key = new Uint8Array(this._pkcs8AlgId.length + k.length);\n pkcs8Key.set(this._pkcs8AlgId, 0);\n pkcs8Key.set(k, this._pkcs8AlgId.length);\n return await this._api.importKey(\"pkcs8\", pkcs8Key, this._alg, true, KEM_USAGES);\n }\n}\n","/**\n * This file is based on noble-curves (https://github.com/paulmillr/noble-curves).\n *\n * noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com)\n *\n * The original file is located at:\n * https://github.com/paulmillr/noble-curves/blob/b9d49d2b41d550571a0c5be443ecb62109fa3373/src/ed25519.ts\n */\n/**\n * ed25519 Twisted Edwards curve with following addons:\n * - X25519 ECDH\n * - Ristretto cofactor elimination\n * - Elligator hash-to-group / point indistinguishability\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { mod, montgomery, pow2 } from \"@hpke/common\";\nconst _1n = 1n;\nconst _2n = 2n;\nconst _3n = 3n;\nconst _5n = 5n;\n// P = 2n**255n - 19n\nconst ed25519_CURVE_p = 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffedn;\nfunction ed25519_pow_2_252_3(x) {\n const _10n = 10n;\n const _20n = 20n;\n const _40n = 40n;\n const _80n = 80n;\n const P = ed25519_CURVE_p;\n const x2 = (x * x) % P;\n const b2 = (x2 * x) % P; // x^3, 11\n const b4 = (pow2(b2, _2n, P) * b2) % P; // x^15, 1111\n const b5 = (pow2(b4, _1n, P) * x) % P; // x^31\n const b10 = (pow2(b5, _5n, P) * b5) % P;\n const b20 = (pow2(b10, _10n, P) * b10) % P;\n const b40 = (pow2(b20, _20n, P) * b20) % P;\n const b80 = (pow2(b40, _40n, P) * b40) % P;\n const b160 = (pow2(b80, _80n, P) * b80) % P;\n const b240 = (pow2(b160, _80n, P) * b80) % P;\n const b250 = (pow2(b240, _10n, P) * b10) % P;\n const pow_p_5_8 = (pow2(b250, _2n, P) * x) % P;\n // ^ To pow to (p+3)/8, multiply it by x.\n return { pow_p_5_8, b2 };\n}\nfunction adjustScalarBytes(bytes) {\n // Section 5: For X25519, in order to decode 32 random bytes as an integer scalar,\n // set the three least significant bits of the first byte\n bytes[0] &= 248; // 0b1111_1000\n // and the most significant bit of the last to zero,\n bytes[31] &= 127; // 0b0111_1111\n // set the second most significant bit of the last byte to 1\n bytes[31] |= 64; // 0b0100_0000\n return bytes;\n}\nexport const x25519 = /* @__PURE__ */ (() => {\n const P = ed25519_CURVE_p;\n return montgomery({\n P,\n type: \"x25519\",\n powPminus2: (x) => {\n // x^(p-2) aka x^(2^255-21)\n const { pow_p_5_8, b2 } = ed25519_pow_2_252_3(x);\n return mod(pow2(pow_p_5_8, _3n, P) * b2, P);\n },\n adjustScalarBytes,\n });\n})();\n","import { HkdfSha256Native, hmac, sha256, toArrayBuffer } from \"@hpke/common\";\nexport class HkdfSha256 extends HkdfSha256Native {\n async extract(salt, ikm) {\n await this._setup();\n const saltBuf = salt.byteLength === 0\n ? new ArrayBuffer(this.hashSize)\n : toArrayBuffer(salt);\n const ikmBuf = toArrayBuffer(ikm);\n if (saltBuf.byteLength !== this.hashSize) {\n return hmac(sha256, new Uint8Array(saltBuf), new Uint8Array(ikmBuf))\n .buffer;\n }\n const key = await this._api.importKey(\"raw\", saltBuf, this.algHash, false, [\n \"sign\",\n ]);\n return await this._api.sign(\"HMAC\", key, ikmBuf);\n }\n}\n","import { Dhkem, KemId, SerializeError, XCurveDhkemPrimitives, } from \"@hpke/common\";\nimport { x25519 } from \"./primitives/x25519.js\";\nimport { HkdfSha256 } from \"./hkdfSha256.js\";\nexport class X25519 extends XCurveDhkemPrimitives {\n constructor(hkdf) {\n super(\"X25519\", 32, x25519, hkdf);\n }\n derive(sk, pk) {\n try {\n return Promise.resolve(this._curve.getSharedSecret(sk, pk));\n }\n catch (e) {\n return Promise.reject(new SerializeError(e));\n }\n }\n}\n/**\n * The DHKEM(X25519, HKDF-SHA256) for HPKE KEM implementing {@link KemInterface}.\n *\n * This class is implemented using\n * {@link https://github.com/paulmillr/noble-curves | @noble/curves}.\n *\n * The instance of this class can be specified to the\n * {@link https://jsr.io/@hpke/core/doc/~/CipherSuiteParams | CipherSuiteParams} as follows:\n *\n * @example Use with `@hpke/core`:\n *\n * ```ts\n * import {\n * Aes128Gcm,\n * CipherSuite,\n * HkdfSha256,\n * } from \"@hpke/core\";\n * import { DhkemX25519HkdfSha256 } from \"@hpke/dhkem-x25519\";\n *\n * const suite = new CipherSuite({\n * kem: new DhkemX25519HkdfSha256(),\n * kdf: new HkdfSha256(),\n * aead: new Aes128Gcm(),\n * });\n * ```\n */\nexport class DhkemX25519HkdfSha256 extends Dhkem {\n constructor() {\n const kdf = new HkdfSha256();\n super(KemId.DhkemX25519HkdfSha256, new X25519(kdf), kdf);\n /** KemId.DhkemX25519HkdfSha256 (0x0020) */\n Object.defineProperty(this, \"id\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: KemId.DhkemX25519HkdfSha256\n });\n /** 32 */\n Object.defineProperty(this, \"secretSize\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 32\n });\n /** 32 */\n Object.defineProperty(this, \"encSize\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 32\n });\n /** 32 */\n Object.defineProperty(this, \"publicKeySize\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 32\n });\n /** 32 */\n Object.defineProperty(this, \"privateKeySize\", {\n enumerable: true,\n configurable: true,\n writable: true,\n value: 32\n });\n }\n}\n","/**\n * Utilities for hex, bytes, CSPRNG.\n * @module\n */\n/*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */\n\n// We use WebCrypto aka globalThis.crypto, which exists in browsers and node.js 16+.\n// node.js versions earlier than v19 don't declare it in global scope.\n// For node.js, package.json#exports field mapping rewrites import\n// from `crypto` to `cryptoNode`, which imports native module.\n// Makes the utils un-importable in browsers without a bundler.\n// Once node.js 18 is deprecated (2025-04-30), we can just drop the import.\nimport { crypto } from '@noble/hashes/crypto';\n\n/** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */\nexport function isBytes(a: unknown): a is Uint8Array {\n return a instanceof Uint8Array || (ArrayBuffer.isView(a) && a.constructor.name === 'Uint8Array');\n}\n\n/** Asserts something is positive integer. */\nexport function anumber(n: number): void {\n if (!Number.isSafeInteger(n) || n < 0) throw new Error('positive integer expected, got ' + n);\n}\n\n/** Asserts something is Uint8Array. */\nexport function abytes(b: Uint8Array | undefined, ...lengths: number[]): void {\n if (!isBytes(b)) throw new Error('Uint8Array expected');\n if (lengths.length > 0 && !lengths.includes(b.length))\n throw new Error('Uint8Array expected of length ' + lengths + ', got length=' + b.length);\n}\n\n/** Asserts something is hash */\nexport function ahash(h: IHash): void {\n if (typeof h !== 'function' || typeof h.create !== 'function')\n throw new Error('Hash should be wrapped by utils.createHasher');\n anumber(h.outputLen);\n anumber(h.blockLen);\n}\n\n/** Asserts a hash instance has not been destroyed / finished */\nexport function aexists(instance: any, checkFinished = true): void {\n if (instance.destroyed) throw new Error('Hash instance has been destroyed');\n if (checkFinished && instance.finished) throw new Error('Hash#digest() has already been called');\n}\n\n/** Asserts output is properly-sized byte array */\nexport function aoutput(out: any, instance: any): void {\n abytes(out);\n const min = instance.outputLen;\n if (out.length < min) {\n throw new Error('digestInto() expects output buffer of length at least ' + min);\n }\n}\n\n/** Generic type encompassing 8/16/32-byte arrays - but not 64-byte. */\n// prettier-ignore\nexport type TypedArray = Int8Array | Uint8ClampedArray | Uint8Array |\n Uint16Array | Int16Array | Uint32Array | Int32Array;\n\n/** Cast u8 / u16 / u32 to u8. */\nexport function u8(arr: TypedArray): Uint8Array {\n return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n\n/** Cast u8 / u16 / u32 to u32. */\nexport function u32(arr: TypedArray): Uint32Array {\n return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));\n}\n\n/** Zeroize a byte array. Warning: JS provides no guarantees. */\nexport function clean(...arrays: TypedArray[]): void {\n for (let i = 0; i < arrays.length; i++) {\n arrays[i].fill(0);\n }\n}\n\n/** Create DataView of an array for easy byte-level manipulation. */\nexport function createView(arr: TypedArray): DataView {\n return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n\n/** The rotate right (circular right shift) operation for uint32 */\nexport function rotr(word: number, shift: number): number {\n return (word << (32 - shift)) | (word >>> shift);\n}\n\n/** The rotate left (circular left shift) operation for uint32 */\nexport function rotl(word: number, shift: number): number {\n return (word << shift) | ((word >>> (32 - shift)) >>> 0);\n}\n\n/** Is current platform little-endian? Most are. Big-Endian platform: IBM */\nexport const isLE: boolean = /* @__PURE__ */ (() =>\n new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44)();\n\n/** The byte swap operation for uint32 */\nexport function byteSwap(word: number): number {\n return (\n ((word << 24) & 0xff000000) |\n ((word << 8) & 0xff0000) |\n ((word >>> 8) & 0xff00) |\n ((word >>> 24) & 0xff)\n );\n}\n/** Conditionally byte swap if on a big-endian platform */\nexport const swap8IfBE: (n: number) => number = isLE\n ? (n: number) => n\n : (n: number) => byteSwap(n);\n\n/** @deprecated */\nexport const byteSwapIfBE: typeof swap8IfBE = swap8IfBE;\n/** In place byte swap for Uint32Array */\nexport function byteSwap32(arr: Uint32Array): Uint32Array {\n for (let i = 0; i < arr.length; i++) {\n arr[i] = byteSwap(arr[i]);\n }\n return arr;\n}\n\nexport const swap32IfBE: (u: Uint32Array) => Uint32Array = isLE\n ? (u: Uint32Array) => u\n : byteSwap32;\n\n// Built-in hex conversion https://caniuse.com/mdn-javascript_builtins_uint8array_fromhex\nconst hasHexBuiltin: boolean = /* @__PURE__ */ (() =>\n // @ts-ignore\n typeof Uint8Array.from([]).toHex === 'function' && typeof Uint8Array.fromHex === 'function')();\n\n// Array where index 0xf0 (240) is mapped to string 'f0'\nconst hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) =>\n i.toString(16).padStart(2, '0')\n);\n\n/**\n * Convert byte array to hex string. Uses built-in function, when available.\n * @example bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])) // 'cafe0123'\n */\nexport function bytesToHex(bytes: Uint8Array): string {\n abytes(bytes);\n // @ts-ignore\n if (hasHexBuiltin) return bytes.toHex();\n // pre-caching improves the speed 6x\n let hex = '';\n for (let i = 0; i < bytes.length; i++) {\n hex += hexes[bytes[i]];\n }\n return hex;\n}\n\n// We use optimized technique to convert hex string to byte array\nconst asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 } as const;\nfunction asciiToBase16(ch: number): number | undefined {\n if (ch >= asciis._0 && ch <= asciis._9) return ch - asciis._0; // '2' => 50-48\n if (ch >= asciis.A && ch <= asciis.F) return ch - (asciis.A - 10); // 'B' => 66-(65-10)\n if (ch >= asciis.a && ch <= asciis.f) return ch - (asciis.a - 10); // 'b' => 98-(97-10)\n return;\n}\n\n/**\n * Convert hex string to byte array. Uses built-in function, when available.\n * @example hexToBytes('cafe0123') // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])\n */\nexport function hexToBytes(hex: string): Uint8Array {\n if (typeof hex !== 'string') throw new Error('hex string expected, got ' + typeof hex);\n // @ts-ignore\n if (hasHexBuiltin) return Uint8Array.fromHex(hex);\n const hl = hex.length;\n const al = hl / 2;\n if (hl % 2) throw new Error('hex string expected, got unpadded hex of length ' + hl);\n const array = new Uint8Array(al);\n for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {\n const n1 = asciiToBase16(hex.charCodeAt(hi));\n const n2 = asciiToBase16(hex.charCodeAt(hi + 1));\n if (n1 === undefined || n2 === undefined) {\n const char = hex[hi] + hex[hi + 1];\n throw new Error('hex string expected, got non-hex character \"' + char + '\" at index ' + hi);\n }\n array[ai] = n1 * 16 + n2; // multiply first octet, e.g. 'a3' => 10*16+3 => 160 + 3 => 163\n }\n return array;\n}\n\n/**\n * There is no setImmediate in browser and setTimeout is slow.\n * Call of async fn will return Promise, which will be fullfiled only on\n * next scheduler queue processing step and this is exactly what we need.\n */\nexport const nextTick = async (): Promise => {};\n\n/** Returns control to thread each 'tick' ms to avoid blocking. */\nexport async function asyncLoop(\n iters: number,\n tick: number,\n cb: (i: number) => void\n): Promise {\n let ts = Date.now();\n for (let i = 0; i < iters; i++) {\n cb(i);\n // Date.now() is not monotonic, so in case if clock goes backwards we return return control too\n const diff = Date.now() - ts;\n if (diff >= 0 && diff < tick) continue;\n await nextTick();\n ts += diff;\n }\n}\n\n// Global symbols, but ts doesn't see them: https://github.com/microsoft/TypeScript/issues/31535\ndeclare const TextEncoder: any;\ndeclare const TextDecoder: any;\n\n/**\n * Converts string to bytes using UTF8 encoding.\n * @example utf8ToBytes('abc') // Uint8Array.from([97, 98, 99])\n */\nexport function utf8ToBytes(str: string): Uint8Array {\n if (typeof str !== 'string') throw new Error('string expected');\n return new Uint8Array(new TextEncoder().encode(str)); // https://bugzil.la/1681809\n}\n\n/**\n * Converts bytes to string using UTF8 encoding.\n * @example bytesToUtf8(Uint8Array.from([97, 98, 99])) // 'abc'\n */\nexport function bytesToUtf8(bytes: Uint8Array): string {\n return new TextDecoder().decode(bytes);\n}\n\n/** Accepted input of hash functions. Strings are converted to byte arrays. */\nexport type Input = string | Uint8Array;\n/**\n * Normalizes (non-hex) string or Uint8Array to Uint8Array.\n * Warning: when Uint8Array is passed, it would NOT get copied.\n * Keep in mind for future mutable operations.\n */\nexport function toBytes(data: Input): Uint8Array {\n if (typeof data === 'string') data = utf8ToBytes(data);\n abytes(data);\n return data;\n}\n\n/** KDFs can accept string or Uint8Array for user convenience. */\nexport type KDFInput = string | Uint8Array;\n/**\n * Helper for KDFs: consumes uint8array or string.\n * When string is passed, does utf8 decoding, using TextDecoder.\n */\nexport function kdfInputToBytes(data: KDFInput): Uint8Array {\n if (typeof data === 'string') data = utf8ToBytes(data);\n abytes(data);\n return data;\n}\n\n/** Copies several Uint8Arrays into one. */\nexport function concatBytes(...arrays: Uint8Array[]): Uint8Array {\n let sum = 0;\n for (let i = 0; i < arrays.length; i++) {\n const a = arrays[i];\n abytes(a);\n sum += a.length;\n }\n const res = new Uint8Array(sum);\n for (let i = 0, pad = 0; i < arrays.length; i++) {\n const a = arrays[i];\n res.set(a, pad);\n pad += a.length;\n }\n return res;\n}\n\ntype EmptyObj = {};\nexport function checkOpts(\n defaults: T1,\n opts?: T2\n): T1 & T2 {\n if (opts !== undefined && {}.toString.call(opts) !== '[object Object]')\n throw new Error('options should be object or undefined');\n const merged = Object.assign(defaults, opts);\n return merged as T1 & T2;\n}\n\n/** Hash interface. */\nexport type IHash = {\n (data: Uint8Array): Uint8Array;\n blockLen: number;\n outputLen: number;\n create: any;\n};\n\n/** For runtime check if class implements interface */\nexport abstract class Hash> {\n abstract blockLen: number; // Bytes per block\n abstract outputLen: number; // Bytes in output\n abstract update(buf: Input): this;\n // Writes digest into buf\n abstract digestInto(buf: Uint8Array): void;\n abstract digest(): Uint8Array;\n /**\n * Resets internal state. Makes Hash instance unusable.\n * Reset is impossible for keyed hashes if key is consumed into state. If digest is not consumed\n * by user, they will need to manually call `destroy()` when zeroing is necessary.\n */\n abstract destroy(): void;\n /**\n * Clones hash instance. Unsafe: doesn't check whether `to` is valid. Can be used as `clone()`\n * when no options are passed.\n * Reasons to use `_cloneInto` instead of clone: 1) performance 2) reuse instance => all internal\n * buffers are overwritten => causes buffer overwrite which is used for digest in some cases.\n * There are no guarantees for clean-up because it's impossible in JS.\n */\n abstract _cloneInto(to?: T): T;\n // Safe version that clones internal state\n abstract clone(): T;\n}\n\n/**\n * XOF: streaming API to read digest in chunks.\n * Same as 'squeeze' in keccak/k12 and 'seek' in blake3, but more generic name.\n * When hash used in XOF mode it is up to user to call '.destroy' afterwards, since we cannot\n * destroy state, next call can require more bytes.\n */\nexport type HashXOF> = Hash & {\n xof(bytes: number): Uint8Array; // Read 'bytes' bytes from digest stream\n xofInto(buf: Uint8Array): Uint8Array; // read buf.length bytes from digest stream into buf\n};\n\n/** Hash function */\nexport type CHash = ReturnType;\n/** Hash function with output */\nexport type CHashO = ReturnType;\n/** XOF with output */\nexport type CHashXO = ReturnType;\n\n/** Wraps hash function, creating an interface on top of it */\nexport function createHasher>(\n hashCons: () => Hash\n): {\n (msg: Input): Uint8Array;\n outputLen: number;\n blockLen: number;\n create(): Hash;\n} {\n const hashC = (msg: Input): Uint8Array => hashCons().update(toBytes(msg)).digest();\n const tmp = hashCons();\n hashC.outputLen = tmp.outputLen;\n hashC.blockLen = tmp.blockLen;\n hashC.create = () => hashCons();\n return hashC;\n}\n\nexport function createOptHasher, T extends Object>(\n hashCons: (opts?: T) => Hash\n): {\n (msg: Input, opts?: T): Uint8Array;\n outputLen: number;\n blockLen: number;\n create(opts?: T): Hash;\n} {\n const hashC = (msg: Input, opts?: T): Uint8Array => hashCons(opts).update(toBytes(msg)).digest();\n const tmp = hashCons({} as T);\n hashC.outputLen = tmp.outputLen;\n hashC.blockLen = tmp.blockLen;\n hashC.create = (opts?: T) => hashCons(opts);\n return hashC;\n}\n\nexport function createXOFer, T extends Object>(\n hashCons: (opts?: T) => HashXOF\n): {\n (msg: Input, opts?: T): Uint8Array;\n outputLen: number;\n blockLen: number;\n create(opts?: T): HashXOF;\n} {\n const hashC = (msg: Input, opts?: T): Uint8Array => hashCons(opts).update(toBytes(msg)).digest();\n const tmp = hashCons({} as T);\n hashC.outputLen = tmp.outputLen;\n hashC.blockLen = tmp.blockLen;\n hashC.create = (opts?: T) => hashCons(opts);\n return hashC;\n}\nexport const wrapConstructor: typeof createHasher = createHasher;\nexport const wrapConstructorWithOpts: typeof createOptHasher = createOptHasher;\nexport const wrapXOFConstructorWithOpts: typeof createXOFer = createXOFer;\n\n/** Cryptographically secure PRNG. Uses internal OS-level `crypto.getRandomValues`. */\nexport function randomBytes(bytesLength = 32): Uint8Array {\n if (crypto && typeof crypto.getRandomValues === 'function') {\n return crypto.getRandomValues(new Uint8Array(bytesLength));\n }\n // Legacy Node.js compatibility\n if (crypto && typeof crypto.randomBytes === 'function') {\n return Uint8Array.from(crypto.randomBytes(bytesLength));\n }\n throw new Error('crypto.getRandomValues must be defined');\n}\n","/**\n * Internal Merkle-Damgard hash utils.\n * @module\n */\nimport { type Input, Hash, abytes, aexists, aoutput, clean, createView, toBytes } from './utils.ts';\n\n/** Polyfill for Safari 14. https://caniuse.com/mdn-javascript_builtins_dataview_setbiguint64 */\nexport function setBigUint64(\n view: DataView,\n byteOffset: number,\n value: bigint,\n isLE: boolean\n): void {\n if (typeof view.setBigUint64 === 'function') return view.setBigUint64(byteOffset, value, isLE);\n const _32n = BigInt(32);\n const _u32_max = BigInt(0xffffffff);\n const wh = Number((value >> _32n) & _u32_max);\n const wl = Number(value & _u32_max);\n const h = isLE ? 4 : 0;\n const l = isLE ? 0 : 4;\n view.setUint32(byteOffset + h, wh, isLE);\n view.setUint32(byteOffset + l, wl, isLE);\n}\n\n/** Choice: a ? b : c */\nexport function Chi(a: number, b: number, c: number): number {\n return (a & b) ^ (~a & c);\n}\n\n/** Majority function, true if any two inputs is true. */\nexport function Maj(a: number, b: number, c: number): number {\n return (a & b) ^ (a & c) ^ (b & c);\n}\n\n/**\n * Merkle-Damgard hash construction base class.\n * Could be used to create MD5, RIPEMD, SHA1, SHA2.\n */\nexport abstract class HashMD> extends Hash {\n protected abstract process(buf: DataView, offset: number): void;\n protected abstract get(): number[];\n protected abstract set(...args: number[]): void;\n abstract destroy(): void;\n protected abstract roundClean(): void;\n\n readonly blockLen: number;\n readonly outputLen: number;\n readonly padOffset: number;\n readonly isLE: boolean;\n\n // For partial updates less than block size\n protected buffer: Uint8Array;\n protected view: DataView;\n protected finished = false;\n protected length = 0;\n protected pos = 0;\n protected destroyed = false;\n\n constructor(blockLen: number, outputLen: number, padOffset: number, isLE: boolean) {\n super();\n this.blockLen = blockLen;\n this.outputLen = outputLen;\n this.padOffset = padOffset;\n this.isLE = isLE;\n this.buffer = new Uint8Array(blockLen);\n this.view = createView(this.buffer);\n }\n update(data: Input): this {\n aexists(this);\n data = toBytes(data);\n abytes(data);\n const { view, buffer, blockLen } = this;\n const len = data.length;\n for (let pos = 0; pos < len; ) {\n const take = Math.min(blockLen - this.pos, len - pos);\n // Fast path: we have at least one block in input, cast it to view and process\n if (take === blockLen) {\n const dataView = createView(data);\n for (; blockLen <= len - pos; pos += blockLen) this.process(dataView, pos);\n continue;\n }\n buffer.set(data.subarray(pos, pos + take), this.pos);\n this.pos += take;\n pos += take;\n if (this.pos === blockLen) {\n this.process(view, 0);\n this.pos = 0;\n }\n }\n this.length += data.length;\n this.roundClean();\n return this;\n }\n digestInto(out: Uint8Array): void {\n aexists(this);\n aoutput(out, this);\n this.finished = true;\n // Padding\n // We can avoid allocation of buffer for padding completely if it\n // was previously not allocated here. But it won't change performance.\n const { buffer, view, blockLen, isLE } = this;\n let { pos } = this;\n // append the bit '1' to the message\n buffer[pos++] = 0b10000000;\n clean(this.buffer.subarray(pos));\n // we have less than padOffset left in buffer, so we cannot put length in\n // current block, need process it and pad again\n if (this.padOffset > blockLen - pos) {\n this.process(view, 0);\n pos = 0;\n }\n // Pad until full block byte with zeros\n for (let i = pos; i < blockLen; i++) buffer[i] = 0;\n // Note: sha512 requires length to be 128bit integer, but length in JS will overflow before that\n // You need to write around 2 exabytes (u64_max / 8 / (1024**6)) for this to happen.\n // So we just write lowest 64 bits of that value.\n setBigUint64(view, blockLen - 8, BigInt(this.length * 8), isLE);\n this.process(view, 0);\n const oview = createView(out);\n const len = this.outputLen;\n // NOTE: we do division by 4 later, which should be fused in single op with modulo by JIT\n if (len % 4) throw new Error('_sha2: outputLen should be aligned to 32bit');\n const outLen = len / 4;\n const state = this.get();\n if (outLen > state.length) throw new Error('_sha2: outputLen bigger than state');\n for (let i = 0; i < outLen; i++) oview.setUint32(4 * i, state[i], isLE);\n }\n digest(): Uint8Array {\n const { buffer, outputLen } = this;\n this.digestInto(buffer);\n const res = buffer.slice(0, outputLen);\n this.destroy();\n return res;\n }\n _cloneInto(to?: T): T {\n to ||= new (this.constructor as any)() as T;\n to.set(...this.get());\n const { blockLen, buffer, length, finished, destroyed, pos } = this;\n to.destroyed = destroyed;\n to.finished = finished;\n to.length = length;\n to.pos = pos;\n if (length % blockLen) to.buffer.set(buffer);\n return to;\n }\n clone(): T {\n return this._cloneInto();\n }\n}\n\n/**\n * Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.\n * Check out `test/misc/sha2-gen-iv.js` for recomputation guide.\n */\n\n/** Initial SHA256 state. Bits 0..32 of frac part of sqrt of primes 2..19 */\nexport const SHA256_IV: Uint32Array = /* @__PURE__ */ Uint32Array.from([\n 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,\n]);\n\n/** Initial SHA224 state. Bits 32..64 of frac part of sqrt of primes 23..53 */\nexport const SHA224_IV: Uint32Array = /* @__PURE__ */ Uint32Array.from([\n 0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939, 0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4,\n]);\n\n/** Initial SHA384 state. Bits 0..64 of frac part of sqrt of primes 23..53 */\nexport const SHA384_IV: Uint32Array = /* @__PURE__ */ Uint32Array.from([\n 0xcbbb9d5d, 0xc1059ed8, 0x629a292a, 0x367cd507, 0x9159015a, 0x3070dd17, 0x152fecd8, 0xf70e5939,\n 0x67332667, 0xffc00b31, 0x8eb44a87, 0x68581511, 0xdb0c2e0d, 0x64f98fa7, 0x47b5481d, 0xbefa4fa4,\n]);\n\n/** Initial SHA512 state. Bits 0..64 of frac part of sqrt of primes 2..19 */\nexport const SHA512_IV: Uint32Array = /* @__PURE__ */ Uint32Array.from([\n 0x6a09e667, 0xf3bcc908, 0xbb67ae85, 0x84caa73b, 0x3c6ef372, 0xfe94f82b, 0xa54ff53a, 0x5f1d36f1,\n 0x510e527f, 0xade682d1, 0x9b05688c, 0x2b3e6c1f, 0x1f83d9ab, 0xfb41bd6b, 0x5be0cd19, 0x137e2179,\n]);\n","/**\n * Internal helpers for u64. BigUint64Array is too slow as per 2025, so we implement it using Uint32Array.\n * @todo re-check https://issues.chromium.org/issues/42212588\n * @module\n */\nconst U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);\nconst _32n = /* @__PURE__ */ BigInt(32);\n\nfunction fromBig(\n n: bigint,\n le = false\n): {\n h: number;\n l: number;\n} {\n if (le) return { h: Number(n & U32_MASK64), l: Number((n >> _32n) & U32_MASK64) };\n return { h: Number((n >> _32n) & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };\n}\n\nfunction split(lst: bigint[], le = false): Uint32Array[] {\n const len = lst.length;\n let Ah = new Uint32Array(len);\n let Al = new Uint32Array(len);\n for (let i = 0; i < len; i++) {\n const { h, l } = fromBig(lst[i], le);\n [Ah[i], Al[i]] = [h, l];\n }\n return [Ah, Al];\n}\n\nconst toBig = (h: number, l: number): bigint => (BigInt(h >>> 0) << _32n) | BigInt(l >>> 0);\n// for Shift in [0, 32)\nconst shrSH = (h: number, _l: number, s: number): number => h >>> s;\nconst shrSL = (h: number, l: number, s: number): number => (h << (32 - s)) | (l >>> s);\n// Right rotate for Shift in [1, 32)\nconst rotrSH = (h: number, l: number, s: number): number => (h >>> s) | (l << (32 - s));\nconst rotrSL = (h: number, l: number, s: number): number => (h << (32 - s)) | (l >>> s);\n// Right rotate for Shift in (32, 64), NOTE: 32 is special case.\nconst rotrBH = (h: number, l: number, s: number): number => (h << (64 - s)) | (l >>> (s - 32));\nconst rotrBL = (h: number, l: number, s: number): number => (h >>> (s - 32)) | (l << (64 - s));\n// Right rotate for shift===32 (just swaps l&h)\nconst rotr32H = (_h: number, l: number): number => l;\nconst rotr32L = (h: number, _l: number): number => h;\n// Left rotate for Shift in [1, 32)\nconst rotlSH = (h: number, l: number, s: number): number => (h << s) | (l >>> (32 - s));\nconst rotlSL = (h: number, l: number, s: number): number => (l << s) | (h >>> (32 - s));\n// Left rotate for Shift in (32, 64), NOTE: 32 is special case.\nconst rotlBH = (h: number, l: number, s: number): number => (l << (s - 32)) | (h >>> (64 - s));\nconst rotlBL = (h: number, l: number, s: number): number => (h << (s - 32)) | (l >>> (64 - s));\n\n// JS uses 32-bit signed integers for bitwise operations which means we cannot\n// simple take carry out of low bit sum by shift, we need to use division.\nfunction add(\n Ah: number,\n Al: number,\n Bh: number,\n Bl: number\n): {\n h: number;\n l: number;\n} {\n const l = (Al >>> 0) + (Bl >>> 0);\n return { h: (Ah + Bh + ((l / 2 ** 32) | 0)) | 0, l: l | 0 };\n}\n// Addition with more than 2 elements\nconst add3L = (Al: number, Bl: number, Cl: number): number => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);\nconst add3H = (low: number, Ah: number, Bh: number, Ch: number): number =>\n (Ah + Bh + Ch + ((low / 2 ** 32) | 0)) | 0;\nconst add4L = (Al: number, Bl: number, Cl: number, Dl: number): number =>\n (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);\nconst add4H = (low: number, Ah: number, Bh: number, Ch: number, Dh: number): number =>\n (Ah + Bh + Ch + Dh + ((low / 2 ** 32) | 0)) | 0;\nconst add5L = (Al: number, Bl: number, Cl: number, Dl: number, El: number): number =>\n (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);\nconst add5H = (low: number, Ah: number, Bh: number, Ch: number, Dh: number, Eh: number): number =>\n (Ah + Bh + Ch + Dh + Eh + ((low / 2 ** 32) | 0)) | 0;\n\n// prettier-ignore\nexport {\n add, add3H, add3L, add4H, add4L, add5H, add5L, fromBig, rotlBH, rotlBL, rotlSH, rotlSL, rotr32H, rotr32L, rotrBH, rotrBL, rotrSH, rotrSL, shrSH, shrSL, split, toBig\n};\n// prettier-ignore\nconst u64: { fromBig: typeof fromBig; split: typeof split; toBig: (h: number, l: number) => bigint; shrSH: (h: number, _l: number, s: number) => number; shrSL: (h: number, l: number, s: number) => number; rotrSH: (h: number, l: number, s: number) => number; rotrSL: (h: number, l: number, s: number) => number; rotrBH: (h: number, l: number, s: number) => number; rotrBL: (h: number, l: number, s: number) => number; rotr32H: (_h: number, l: number) => number; rotr32L: (h: number, _l: number) => number; rotlSH: (h: number, l: number, s: number) => number; rotlSL: (h: number, l: number, s: number) => number; rotlBH: (h: number, l: number, s: number) => number; rotlBL: (h: number, l: number, s: number) => number; add: typeof add; add3L: (Al: number, Bl: number, Cl: number) => number; add3H: (low: number, Ah: number, Bh: number, Ch: number) => number; add4L: (Al: number, Bl: number, Cl: number, Dl: number) => number; add4H: (low: number, Ah: number, Bh: number, Ch: number, Dh: number) => number; add5H: (low: number, Ah: number, Bh: number, Ch: number, Dh: number, Eh: number) => number; add5L: (Al: number, Bl: number, Cl: number, Dl: number, El: number) => number; } = {\n fromBig, split, toBig,\n shrSH, shrSL,\n rotrSH, rotrSL, rotrBH, rotrBL,\n rotr32H, rotr32L,\n rotlSH, rotlSL, rotlBH, rotlBL,\n add, add3L, add3H, add4L, add4H, add5H, add5L,\n};\nexport default u64;\n","/**\n * SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.\n * SHA256 is the fastest hash implementable in JS, even faster than Blake3.\n * Check out [RFC 4634](https://datatracker.ietf.org/doc/html/rfc4634) and\n * [FIPS 180-4](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf).\n * @module\n */\nimport { Chi, HashMD, Maj, SHA224_IV, SHA256_IV, SHA384_IV, SHA512_IV } from './_md.ts';\nimport * as u64 from './_u64.ts';\nimport { type CHash, clean, createHasher, rotr } from './utils.ts';\n\n/**\n * Round constants:\n * First 32 bits of fractional parts of the cube roots of the first 64 primes 2..311)\n */\n// prettier-ignore\nconst SHA256_K = /* @__PURE__ */ Uint32Array.from([\n 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,\n 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,\n 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,\n 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,\n 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,\n 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,\n 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,\n 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2\n]);\n\n/** Reusable temporary buffer. \"W\" comes straight from spec. */\nconst SHA256_W = /* @__PURE__ */ new Uint32Array(64);\nexport class SHA256 extends HashMD {\n // We cannot use array here since array allows indexing by variable\n // which means optimizer/compiler cannot use registers.\n protected A: number = SHA256_IV[0] | 0;\n protected B: number = SHA256_IV[1] | 0;\n protected C: number = SHA256_IV[2] | 0;\n protected D: number = SHA256_IV[3] | 0;\n protected E: number = SHA256_IV[4] | 0;\n protected F: number = SHA256_IV[5] | 0;\n protected G: number = SHA256_IV[6] | 0;\n protected H: number = SHA256_IV[7] | 0;\n\n constructor(outputLen: number = 32) {\n super(64, outputLen, 8, false);\n }\n protected get(): [number, number, number, number, number, number, number, number] {\n const { A, B, C, D, E, F, G, H } = this;\n return [A, B, C, D, E, F, G, H];\n }\n // prettier-ignore\n protected set(\n A: number, B: number, C: number, D: number, E: number, F: number, G: number, H: number\n ): void {\n this.A = A | 0;\n this.B = B | 0;\n this.C = C | 0;\n this.D = D | 0;\n this.E = E | 0;\n this.F = F | 0;\n this.G = G | 0;\n this.H = H | 0;\n }\n protected process(view: DataView, offset: number): void {\n // Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array\n for (let i = 0; i < 16; i++, offset += 4) SHA256_W[i] = view.getUint32(offset, false);\n for (let i = 16; i < 64; i++) {\n const W15 = SHA256_W[i - 15];\n const W2 = SHA256_W[i - 2];\n const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ (W15 >>> 3);\n const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ (W2 >>> 10);\n SHA256_W[i] = (s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16]) | 0;\n }\n // Compression function main loop, 64 rounds\n let { A, B, C, D, E, F, G, H } = this;\n for (let i = 0; i < 64; i++) {\n const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);\n const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);\n const T2 = (sigma0 + Maj(A, B, C)) | 0;\n H = G;\n G = F;\n F = E;\n E = (D + T1) | 0;\n D = C;\n C = B;\n B = A;\n A = (T1 + T2) | 0;\n }\n // Add the compressed chunk to the current hash value\n A = (A + this.A) | 0;\n B = (B + this.B) | 0;\n C = (C + this.C) | 0;\n D = (D + this.D) | 0;\n E = (E + this.E) | 0;\n F = (F + this.F) | 0;\n G = (G + this.G) | 0;\n H = (H + this.H) | 0;\n this.set(A, B, C, D, E, F, G, H);\n }\n protected roundClean(): void {\n clean(SHA256_W);\n }\n destroy(): void {\n this.set(0, 0, 0, 0, 0, 0, 0, 0);\n clean(this.buffer);\n }\n}\n\nexport class SHA224 extends SHA256 {\n protected A: number = SHA224_IV[0] | 0;\n protected B: number = SHA224_IV[1] | 0;\n protected C: number = SHA224_IV[2] | 0;\n protected D: number = SHA224_IV[3] | 0;\n protected E: number = SHA224_IV[4] | 0;\n protected F: number = SHA224_IV[5] | 0;\n protected G: number = SHA224_IV[6] | 0;\n protected H: number = SHA224_IV[7] | 0;\n constructor() {\n super(28);\n }\n}\n\n// SHA2-512 is slower than sha256 in js because u64 operations are slow.\n\n// Round contants\n// First 32 bits of the fractional parts of the cube roots of the first 80 primes 2..409\n// prettier-ignore\nconst K512 = /* @__PURE__ */ (() => u64.split([\n '0x428a2f98d728ae22', '0x7137449123ef65cd', '0xb5c0fbcfec4d3b2f', '0xe9b5dba58189dbbc',\n '0x3956c25bf348b538', '0x59f111f1b605d019', '0x923f82a4af194f9b', '0xab1c5ed5da6d8118',\n '0xd807aa98a3030242', '0x12835b0145706fbe', '0x243185be4ee4b28c', '0x550c7dc3d5ffb4e2',\n '0x72be5d74f27b896f', '0x80deb1fe3b1696b1', '0x9bdc06a725c71235', '0xc19bf174cf692694',\n '0xe49b69c19ef14ad2', '0xefbe4786384f25e3', '0x0fc19dc68b8cd5b5', '0x240ca1cc77ac9c65',\n '0x2de92c6f592b0275', '0x4a7484aa6ea6e483', '0x5cb0a9dcbd41fbd4', '0x76f988da831153b5',\n '0x983e5152ee66dfab', '0xa831c66d2db43210', '0xb00327c898fb213f', '0xbf597fc7beef0ee4',\n '0xc6e00bf33da88fc2', '0xd5a79147930aa725', '0x06ca6351e003826f', '0x142929670a0e6e70',\n '0x27b70a8546d22ffc', '0x2e1b21385c26c926', '0x4d2c6dfc5ac42aed', '0x53380d139d95b3df',\n '0x650a73548baf63de', '0x766a0abb3c77b2a8', '0x81c2c92e47edaee6', '0x92722c851482353b',\n '0xa2bfe8a14cf10364', '0xa81a664bbc423001', '0xc24b8b70d0f89791', '0xc76c51a30654be30',\n '0xd192e819d6ef5218', '0xd69906245565a910', '0xf40e35855771202a', '0x106aa07032bbd1b8',\n '0x19a4c116b8d2d0c8', '0x1e376c085141ab53', '0x2748774cdf8eeb99', '0x34b0bcb5e19b48a8',\n '0x391c0cb3c5c95a63', '0x4ed8aa4ae3418acb', '0x5b9cca4f7763e373', '0x682e6ff3d6b2b8a3',\n '0x748f82ee5defb2fc', '0x78a5636f43172f60', '0x84c87814a1f0ab72', '0x8cc702081a6439ec',\n '0x90befffa23631e28', '0xa4506cebde82bde9', '0xbef9a3f7b2c67915', '0xc67178f2e372532b',\n '0xca273eceea26619c', '0xd186b8c721c0c207', '0xeada7dd6cde0eb1e', '0xf57d4f7fee6ed178',\n '0x06f067aa72176fba', '0x0a637dc5a2c898a6', '0x113f9804bef90dae', '0x1b710b35131c471b',\n '0x28db77f523047d84', '0x32caab7b40c72493', '0x3c9ebe0a15c9bebc', '0x431d67c49c100d4c',\n '0x4cc5d4becb3e42b6', '0x597f299cfc657e2a', '0x5fcb6fab3ad6faec', '0x6c44198c4a475817'\n].map(n => BigInt(n))))();\nconst SHA512_Kh = /* @__PURE__ */ (() => K512[0])();\nconst SHA512_Kl = /* @__PURE__ */ (() => K512[1])();\n\n// Reusable temporary buffers\nconst SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);\nconst SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);\n\nexport class SHA512 extends HashMD {\n // We cannot use array here since array allows indexing by variable\n // which means optimizer/compiler cannot use registers.\n // h -- high 32 bits, l -- low 32 bits\n protected Ah: number = SHA512_IV[0] | 0;\n protected Al: number = SHA512_IV[1] | 0;\n protected Bh: number = SHA512_IV[2] | 0;\n protected Bl: number = SHA512_IV[3] | 0;\n protected Ch: number = SHA512_IV[4] | 0;\n protected Cl: number = SHA512_IV[5] | 0;\n protected Dh: number = SHA512_IV[6] | 0;\n protected Dl: number = SHA512_IV[7] | 0;\n protected Eh: number = SHA512_IV[8] | 0;\n protected El: number = SHA512_IV[9] | 0;\n protected Fh: number = SHA512_IV[10] | 0;\n protected Fl: number = SHA512_IV[11] | 0;\n protected Gh: number = SHA512_IV[12] | 0;\n protected Gl: number = SHA512_IV[13] | 0;\n protected Hh: number = SHA512_IV[14] | 0;\n protected Hl: number = SHA512_IV[15] | 0;\n\n constructor(outputLen: number = 64) {\n super(128, outputLen, 16, false);\n }\n // prettier-ignore\n protected get(): [\n number, number, number, number, number, number, number, number,\n number, number, number, number, number, number, number, number\n ] {\n const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];\n }\n // prettier-ignore\n protected set(\n Ah: number, Al: number, Bh: number, Bl: number, Ch: number, Cl: number, Dh: number, Dl: number,\n Eh: number, El: number, Fh: number, Fl: number, Gh: number, Gl: number, Hh: number, Hl: number\n ): void {\n this.Ah = Ah | 0;\n this.Al = Al | 0;\n this.Bh = Bh | 0;\n this.Bl = Bl | 0;\n this.Ch = Ch | 0;\n this.Cl = Cl | 0;\n this.Dh = Dh | 0;\n this.Dl = Dl | 0;\n this.Eh = Eh | 0;\n this.El = El | 0;\n this.Fh = Fh | 0;\n this.Fl = Fl | 0;\n this.Gh = Gh | 0;\n this.Gl = Gl | 0;\n this.Hh = Hh | 0;\n this.Hl = Hl | 0;\n }\n protected process(view: DataView, offset: number): void {\n // Extend the first 16 words into the remaining 64 words w[16..79] of the message schedule array\n for (let i = 0; i < 16; i++, offset += 4) {\n SHA512_W_H[i] = view.getUint32(offset);\n SHA512_W_L[i] = view.getUint32((offset += 4));\n }\n for (let i = 16; i < 80; i++) {\n // s0 := (w[i-15] rightrotate 1) xor (w[i-15] rightrotate 8) xor (w[i-15] rightshift 7)\n const W15h = SHA512_W_H[i - 15] | 0;\n const W15l = SHA512_W_L[i - 15] | 0;\n const s0h = u64.rotrSH(W15h, W15l, 1) ^ u64.rotrSH(W15h, W15l, 8) ^ u64.shrSH(W15h, W15l, 7);\n const s0l = u64.rotrSL(W15h, W15l, 1) ^ u64.rotrSL(W15h, W15l, 8) ^ u64.shrSL(W15h, W15l, 7);\n // s1 := (w[i-2] rightrotate 19) xor (w[i-2] rightrotate 61) xor (w[i-2] rightshift 6)\n const W2h = SHA512_W_H[i - 2] | 0;\n const W2l = SHA512_W_L[i - 2] | 0;\n const s1h = u64.rotrSH(W2h, W2l, 19) ^ u64.rotrBH(W2h, W2l, 61) ^ u64.shrSH(W2h, W2l, 6);\n const s1l = u64.rotrSL(W2h, W2l, 19) ^ u64.rotrBL(W2h, W2l, 61) ^ u64.shrSL(W2h, W2l, 6);\n // SHA256_W[i] = s0 + s1 + SHA256_W[i - 7] + SHA256_W[i - 16];\n const SUMl = u64.add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);\n const SUMh = u64.add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);\n SHA512_W_H[i] = SUMh | 0;\n SHA512_W_L[i] = SUMl | 0;\n }\n let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n // Compression function main loop, 80 rounds\n for (let i = 0; i < 80; i++) {\n // S1 := (e rightrotate 14) xor (e rightrotate 18) xor (e rightrotate 41)\n const sigma1h = u64.rotrSH(Eh, El, 14) ^ u64.rotrSH(Eh, El, 18) ^ u64.rotrBH(Eh, El, 41);\n const sigma1l = u64.rotrSL(Eh, El, 14) ^ u64.rotrSL(Eh, El, 18) ^ u64.rotrBL(Eh, El, 41);\n //const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n const CHIh = (Eh & Fh) ^ (~Eh & Gh);\n const CHIl = (El & Fl) ^ (~El & Gl);\n // T1 = H + sigma1 + Chi(E, F, G) + SHA512_K[i] + SHA512_W[i]\n // prettier-ignore\n const T1ll = u64.add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);\n const T1h = u64.add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);\n const T1l = T1ll | 0;\n // S0 := (a rightrotate 28) xor (a rightrotate 34) xor (a rightrotate 39)\n const sigma0h = u64.rotrSH(Ah, Al, 28) ^ u64.rotrBH(Ah, Al, 34) ^ u64.rotrBH(Ah, Al, 39);\n const sigma0l = u64.rotrSL(Ah, Al, 28) ^ u64.rotrBL(Ah, Al, 34) ^ u64.rotrBL(Ah, Al, 39);\n const MAJh = (Ah & Bh) ^ (Ah & Ch) ^ (Bh & Ch);\n const MAJl = (Al & Bl) ^ (Al & Cl) ^ (Bl & Cl);\n Hh = Gh | 0;\n Hl = Gl | 0;\n Gh = Fh | 0;\n Gl = Fl | 0;\n Fh = Eh | 0;\n Fl = El | 0;\n ({ h: Eh, l: El } = u64.add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));\n Dh = Ch | 0;\n Dl = Cl | 0;\n Ch = Bh | 0;\n Cl = Bl | 0;\n Bh = Ah | 0;\n Bl = Al | 0;\n const All = u64.add3L(T1l, sigma0l, MAJl);\n Ah = u64.add3H(All, T1h, sigma0h, MAJh);\n Al = All | 0;\n }\n // Add the compressed chunk to the current hash value\n ({ h: Ah, l: Al } = u64.add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));\n ({ h: Bh, l: Bl } = u64.add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));\n ({ h: Ch, l: Cl } = u64.add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));\n ({ h: Dh, l: Dl } = u64.add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));\n ({ h: Eh, l: El } = u64.add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));\n ({ h: Fh, l: Fl } = u64.add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));\n ({ h: Gh, l: Gl } = u64.add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));\n ({ h: Hh, l: Hl } = u64.add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));\n this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);\n }\n protected roundClean(): void {\n clean(SHA512_W_H, SHA512_W_L);\n }\n destroy(): void {\n clean(this.buffer);\n this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);\n }\n}\n\nexport class SHA384 extends SHA512 {\n protected Ah: number = SHA384_IV[0] | 0;\n protected Al: number = SHA384_IV[1] | 0;\n protected Bh: number = SHA384_IV[2] | 0;\n protected Bl: number = SHA384_IV[3] | 0;\n protected Ch: number = SHA384_IV[4] | 0;\n protected Cl: number = SHA384_IV[5] | 0;\n protected Dh: number = SHA384_IV[6] | 0;\n protected Dl: number = SHA384_IV[7] | 0;\n protected Eh: number = SHA384_IV[8] | 0;\n protected El: number = SHA384_IV[9] | 0;\n protected Fh: number = SHA384_IV[10] | 0;\n protected Fl: number = SHA384_IV[11] | 0;\n protected Gh: number = SHA384_IV[12] | 0;\n protected Gl: number = SHA384_IV[13] | 0;\n protected Hh: number = SHA384_IV[14] | 0;\n protected Hl: number = SHA384_IV[15] | 0;\n\n constructor() {\n super(48);\n }\n}\n\n/**\n * Truncated SHA512/256 and SHA512/224.\n * SHA512_IV is XORed with 0xa5a5a5a5a5a5a5a5, then used as \"intermediary\" IV of SHA512/t.\n * Then t hashes string to produce result IV.\n * See `test/misc/sha2-gen-iv.js`.\n */\n\n/** SHA512/224 IV */\nconst T224_IV = /* @__PURE__ */ Uint32Array.from([\n 0x8c3d37c8, 0x19544da2, 0x73e19966, 0x89dcd4d6, 0x1dfab7ae, 0x32ff9c82, 0x679dd514, 0x582f9fcf,\n 0x0f6d2b69, 0x7bd44da8, 0x77e36f73, 0x04c48942, 0x3f9d85a8, 0x6a1d36c8, 0x1112e6ad, 0x91d692a1,\n]);\n\n/** SHA512/256 IV */\nconst T256_IV = /* @__PURE__ */ Uint32Array.from([\n 0x22312194, 0xfc2bf72c, 0x9f555fa3, 0xc84c64c2, 0x2393b86b, 0x6f53b151, 0x96387719, 0x5940eabd,\n 0x96283ee2, 0xa88effe3, 0xbe5e1e25, 0x53863992, 0x2b0199fc, 0x2c85b8aa, 0x0eb72ddc, 0x81c52ca2,\n]);\n\nexport class SHA512_224 extends SHA512 {\n protected Ah: number = T224_IV[0] | 0;\n protected Al: number = T224_IV[1] | 0;\n protected Bh: number = T224_IV[2] | 0;\n protected Bl: number = T224_IV[3] | 0;\n protected Ch: number = T224_IV[4] | 0;\n protected Cl: number = T224_IV[5] | 0;\n protected Dh: number = T224_IV[6] | 0;\n protected Dl: number = T224_IV[7] | 0;\n protected Eh: number = T224_IV[8] | 0;\n protected El: number = T224_IV[9] | 0;\n protected Fh: number = T224_IV[10] | 0;\n protected Fl: number = T224_IV[11] | 0;\n protected Gh: number = T224_IV[12] | 0;\n protected Gl: number = T224_IV[13] | 0;\n protected Hh: number = T224_IV[14] | 0;\n protected Hl: number = T224_IV[15] | 0;\n\n constructor() {\n super(28);\n }\n}\n\nexport class SHA512_256 extends SHA512 {\n protected Ah: number = T256_IV[0] | 0;\n protected Al: number = T256_IV[1] | 0;\n protected Bh: number = T256_IV[2] | 0;\n protected Bl: number = T256_IV[3] | 0;\n protected Ch: number = T256_IV[4] | 0;\n protected Cl: number = T256_IV[5] | 0;\n protected Dh: number = T256_IV[6] | 0;\n protected Dl: number = T256_IV[7] | 0;\n protected Eh: number = T256_IV[8] | 0;\n protected El: number = T256_IV[9] | 0;\n protected Fh: number = T256_IV[10] | 0;\n protected Fl: number = T256_IV[11] | 0;\n protected Gh: number = T256_IV[12] | 0;\n protected Gl: number = T256_IV[13] | 0;\n protected Hh: number = T256_IV[14] | 0;\n protected Hl: number = T256_IV[15] | 0;\n\n constructor() {\n super(32);\n }\n}\n\n/**\n * SHA2-256 hash function from RFC 4634.\n *\n * It is the fastest JS hash, even faster than Blake3.\n * To break sha256 using birthday attack, attackers need to try 2^128 hashes.\n * BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.\n */\nexport const sha256: CHash = /* @__PURE__ */ createHasher(() => new SHA256());\n/** SHA2-224 hash function from RFC 4634 */\nexport const sha224: CHash = /* @__PURE__ */ createHasher(() => new SHA224());\n\n/** SHA2-512 hash function from RFC 4634. */\nexport const sha512: CHash = /* @__PURE__ */ createHasher(() => new SHA512());\n/** SHA2-384 hash function from RFC 4634. */\nexport const sha384: CHash = /* @__PURE__ */ createHasher(() => new SHA384());\n\n/**\n * SHA2-512/256 \"truncated\" hash function, with improved resistance to length extension attacks.\n * See the paper on [truncated SHA512](https://eprint.iacr.org/2010/548.pdf).\n */\nexport const sha512_256: CHash = /* @__PURE__ */ createHasher(() => new SHA512_256());\n/**\n * SHA2-512/224 \"truncated\" hash function, with improved resistance to length extension attacks.\n * See the paper on [truncated SHA512](https://eprint.iacr.org/2010/548.pdf).\n */\nexport const sha512_224: CHash = /* @__PURE__ */ createHasher(() => new SHA512_224());\n","/**\n * Hex, bytes and number utilities.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport {\n abytes as abytes_,\n bytesToHex as bytesToHex_,\n concatBytes as concatBytes_,\n hexToBytes as hexToBytes_,\n isBytes as isBytes_,\n} from '@noble/hashes/utils.js';\nexport {\n abytes,\n anumber,\n bytesToHex,\n bytesToUtf8,\n concatBytes,\n hexToBytes,\n isBytes,\n randomBytes,\n utf8ToBytes,\n} from '@noble/hashes/utils.js';\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\nexport type Hex = Uint8Array | string; // hex strings are accepted for simplicity\nexport type PrivKey = Hex | bigint; // bigints are accepted to ease learning curve\nexport type CHash = {\n (message: Uint8Array | string): Uint8Array;\n blockLen: number;\n outputLen: number;\n create(opts?: { dkLen?: number }): any; // For shake\n};\nexport type FHash = (message: Uint8Array | string) => Uint8Array;\n\nexport function abool(title: string, value: boolean): void {\n if (typeof value !== 'boolean') throw new Error(title + ' boolean expected, got ' + value);\n}\n\n// tmp name until v2\nexport function _abool2(value: boolean, title: string = ''): boolean {\n if (typeof value !== 'boolean') {\n const prefix = title && `\"${title}\"`;\n throw new Error(prefix + 'expected boolean, got type=' + typeof value);\n }\n return value;\n}\n\n// tmp name until v2\n/** Asserts something is Uint8Array. */\nexport function _abytes2(value: Uint8Array, length?: number, title: string = ''): Uint8Array {\n const bytes = isBytes_(value);\n const len = value?.length;\n const needsLen = length !== undefined;\n if (!bytes || (needsLen && len !== length)) {\n const prefix = title && `\"${title}\" `;\n const ofLen = needsLen ? ` of length ${length}` : '';\n const got = bytes ? `length=${len}` : `type=${typeof value}`;\n throw new Error(prefix + 'expected Uint8Array' + ofLen + ', got ' + got);\n }\n return value;\n}\n\n// Used in weierstrass, der\nexport function numberToHexUnpadded(num: number | bigint): string {\n const hex = num.toString(16);\n return hex.length & 1 ? '0' + hex : hex;\n}\n\nexport function hexToNumber(hex: string): bigint {\n if (typeof hex !== 'string') throw new Error('hex string expected, got ' + typeof hex);\n return hex === '' ? _0n : BigInt('0x' + hex); // Big Endian\n}\n\n// BE: Big Endian, LE: Little Endian\nexport function bytesToNumberBE(bytes: Uint8Array): bigint {\n return hexToNumber(bytesToHex_(bytes));\n}\nexport function bytesToNumberLE(bytes: Uint8Array): bigint {\n abytes_(bytes);\n return hexToNumber(bytesToHex_(Uint8Array.from(bytes).reverse()));\n}\n\nexport function numberToBytesBE(n: number | bigint, len: number): Uint8Array {\n return hexToBytes_(n.toString(16).padStart(len * 2, '0'));\n}\nexport function numberToBytesLE(n: number | bigint, len: number): Uint8Array {\n return numberToBytesBE(n, len).reverse();\n}\n// Unpadded, rarely used\nexport function numberToVarBytesBE(n: number | bigint): Uint8Array {\n return hexToBytes_(numberToHexUnpadded(n));\n}\n\n/**\n * Takes hex string or Uint8Array, converts to Uint8Array.\n * Validates output length.\n * Will throw error for other types.\n * @param title descriptive title for an error e.g. 'secret key'\n * @param hex hex string or Uint8Array\n * @param expectedLength optional, will compare to result array's length\n * @returns\n */\nexport function ensureBytes(title: string, hex: Hex, expectedLength?: number): Uint8Array {\n let res: Uint8Array;\n if (typeof hex === 'string') {\n try {\n res = hexToBytes_(hex);\n } catch (e) {\n throw new Error(title + ' must be hex string or Uint8Array, cause: ' + e);\n }\n } else if (isBytes_(hex)) {\n // Uint8Array.from() instead of hash.slice() because node.js Buffer\n // is instance of Uint8Array, and its slice() creates **mutable** copy\n res = Uint8Array.from(hex);\n } else {\n throw new Error(title + ' must be hex string or Uint8Array');\n }\n const len = res.length;\n if (typeof expectedLength === 'number' && len !== expectedLength)\n throw new Error(title + ' of length ' + expectedLength + ' expected, got ' + len);\n return res;\n}\n\n// Compares 2 u8a-s in kinda constant time\nexport function equalBytes(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n/**\n * Copies Uint8Array. We can't use u8a.slice(), because u8a can be Buffer,\n * and Buffer#slice creates mutable copy. Never use Buffers!\n */\nexport function copyBytes(bytes: Uint8Array): Uint8Array {\n return Uint8Array.from(bytes);\n}\n\n/**\n * Decodes 7-bit ASCII string to Uint8Array, throws on non-ascii symbols\n * Should be safe to use for things expected to be ASCII.\n * Returns exact same result as utf8ToBytes for ASCII or throws.\n */\nexport function asciiToBytes(ascii: string): Uint8Array {\n return Uint8Array.from(ascii, (c, i) => {\n const charCode = c.charCodeAt(0);\n if (c.length !== 1 || charCode > 127) {\n throw new Error(\n `string contains non-ASCII character \"${ascii[i]}\" with code ${charCode} at position ${i}`\n );\n }\n return charCode;\n });\n}\n\n/**\n * @example utf8ToBytes('abc') // new Uint8Array([97, 98, 99])\n */\n// export const utf8ToBytes: typeof utf8ToBytes_ = utf8ToBytes_;\n/**\n * Converts bytes to string using UTF8 encoding.\n * @example bytesToUtf8(Uint8Array.from([97, 98, 99])) // 'abc'\n */\n// export const bytesToUtf8: typeof bytesToUtf8_ = bytesToUtf8_;\n\n// Is positive bigint\nconst isPosBig = (n: bigint) => typeof n === 'bigint' && _0n <= n;\n\nexport function inRange(n: bigint, min: bigint, max: bigint): boolean {\n return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;\n}\n\n/**\n * Asserts min <= n < max. NOTE: It's < max and not <= max.\n * @example\n * aInRange('x', x, 1n, 256n); // would assume x is in (1n..255n)\n */\nexport function aInRange(title: string, n: bigint, min: bigint, max: bigint): void {\n // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)?\n // consider P=256n, min=0n, max=P\n // - a for min=0 would require -1: `inRange('x', x, -1n, P)`\n // - b would commonly require subtraction: `inRange('x', x, 0n, P - 1n)`\n // - our way is the cleanest: `inRange('x', x, 0n, P)\n if (!inRange(n, min, max))\n throw new Error('expected valid ' + title + ': ' + min + ' <= n < ' + max + ', got ' + n);\n}\n\n// Bit operations\n\n/**\n * Calculates amount of bits in a bigint.\n * Same as `n.toString(2).length`\n * TODO: merge with nLength in modular\n */\nexport function bitLen(n: bigint): number {\n let len;\n for (len = 0; n > _0n; n >>= _1n, len += 1);\n return len;\n}\n\n/**\n * Gets single bit at position.\n * NOTE: first bit position is 0 (same as arrays)\n * Same as `!!+Array.from(n.toString(2)).reverse()[pos]`\n */\nexport function bitGet(n: bigint, pos: number): bigint {\n return (n >> BigInt(pos)) & _1n;\n}\n\n/**\n * Sets single bit at position.\n */\nexport function bitSet(n: bigint, pos: number, value: boolean): bigint {\n return n | ((value ? _1n : _0n) << BigInt(pos));\n}\n\n/**\n * Calculate mask for N bits. Not using ** operator with bigints because of old engines.\n * Same as BigInt(`0b${Array(i).fill('1').join('')}`)\n */\nexport const bitMask = (n: number): bigint => (_1n << BigInt(n)) - _1n;\n\n// DRBG\n\ntype Pred = (v: Uint8Array) => T | undefined;\n/**\n * Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n * @returns function that will call DRBG until 2nd arg returns something meaningful\n * @example\n * const drbg = createHmacDRBG(32, 32, hmac);\n * drbg(seed, bytesToKey); // bytesToKey must return Key or undefined\n */\nexport function createHmacDrbg(\n hashLen: number,\n qByteLen: number,\n hmacFn: (key: Uint8Array, ...messages: Uint8Array[]) => Uint8Array\n): (seed: Uint8Array, predicate: Pred) => T {\n if (typeof hashLen !== 'number' || hashLen < 2) throw new Error('hashLen must be a number');\n if (typeof qByteLen !== 'number' || qByteLen < 2) throw new Error('qByteLen must be a number');\n if (typeof hmacFn !== 'function') throw new Error('hmacFn must be a function');\n // Step B, Step C: set hashLen to 8*ceil(hlen/8)\n const u8n = (len: number) => new Uint8Array(len); // creates Uint8Array\n const u8of = (byte: number) => Uint8Array.of(byte); // another shortcut\n let v = u8n(hashLen); // Minimal non-full-spec HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n let k = u8n(hashLen); // Steps B and C of RFC6979 3.2: set hashLen, in our case always same\n let i = 0; // Iterations counter, will throw when over 1000\n const reset = () => {\n v.fill(1);\n k.fill(0);\n i = 0;\n };\n const h = (...b: Uint8Array[]) => hmacFn(k, v, ...b); // hmac(k)(v, ...values)\n const reseed = (seed = u8n(0)) => {\n // HMAC-DRBG reseed() function. Steps D-G\n k = h(u8of(0x00), seed); // k = hmac(k || v || 0x00 || seed)\n v = h(); // v = hmac(k || v)\n if (seed.length === 0) return;\n k = h(u8of(0x01), seed); // k = hmac(k || v || 0x01 || seed)\n v = h(); // v = hmac(k || v)\n };\n const gen = () => {\n // HMAC-DRBG generate() function\n if (i++ >= 1000) throw new Error('drbg: tried 1000 values');\n let len = 0;\n const out: Uint8Array[] = [];\n while (len < qByteLen) {\n v = h();\n const sl = v.slice();\n out.push(sl);\n len += v.length;\n }\n return concatBytes_(...out);\n };\n const genUntil = (seed: Uint8Array, pred: Pred): T => {\n reset();\n reseed(seed); // Steps D-G\n let res: T | undefined = undefined; // Step H: grind until k is in [1..n-1]\n while (!(res = pred(gen()))) reseed();\n reset();\n return res;\n };\n return genUntil;\n}\n\n// Validating curves and fields\n\nconst validatorFns = {\n bigint: (val: any): boolean => typeof val === 'bigint',\n function: (val: any): boolean => typeof val === 'function',\n boolean: (val: any): boolean => typeof val === 'boolean',\n string: (val: any): boolean => typeof val === 'string',\n stringOrUint8Array: (val: any): boolean => typeof val === 'string' || isBytes_(val),\n isSafeInteger: (val: any): boolean => Number.isSafeInteger(val),\n array: (val: any): boolean => Array.isArray(val),\n field: (val: any, object: any): any => (object as any).Fp.isValid(val),\n hash: (val: any): boolean => typeof val === 'function' && Number.isSafeInteger(val.outputLen),\n} as const;\ntype Validator = keyof typeof validatorFns;\ntype ValMap> = { [K in keyof T]?: Validator };\n// type Record = { [P in K]: T; }\n\nexport function validateObject>(\n object: T,\n validators: ValMap,\n optValidators: ValMap = {}\n): T {\n const checkField = (fieldName: keyof T, type: Validator, isOptional: boolean) => {\n const checkVal = validatorFns[type];\n if (typeof checkVal !== 'function') throw new Error('invalid validator function');\n\n const val = object[fieldName as keyof typeof object];\n if (isOptional && val === undefined) return;\n if (!checkVal(val, object)) {\n throw new Error(\n 'param ' + String(fieldName) + ' is invalid. Expected ' + type + ', got ' + val\n );\n }\n };\n for (const [fieldName, type] of Object.entries(validators)) checkField(fieldName, type!, false);\n for (const [fieldName, type] of Object.entries(optValidators)) checkField(fieldName, type!, true);\n return object;\n}\n// validate type tests\n// const o: { a: number; b: number; c: number } = { a: 1, b: 5, c: 6 };\n// const z0 = validateObject(o, { a: 'isSafeInteger' }, { c: 'bigint' }); // Ok!\n// // Should fail type-check\n// const z1 = validateObject(o, { a: 'tmp' }, { c: 'zz' });\n// const z2 = validateObject(o, { a: 'isSafeInteger' }, { c: 'zz' });\n// const z3 = validateObject(o, { test: 'boolean', z: 'bug' });\n// const z4 = validateObject(o, { a: 'boolean', z: 'bug' });\n\nexport function isHash(val: CHash): boolean {\n return typeof val === 'function' && Number.isSafeInteger(val.outputLen);\n}\nexport function _validateObject(\n object: Record,\n fields: Record,\n optFields: Record = {}\n): void {\n if (!object || typeof object !== 'object') throw new Error('expected valid options object');\n type Item = keyof typeof object;\n function checkField(fieldName: Item, expectedType: string, isOpt: boolean) {\n const val = object[fieldName];\n if (isOpt && val === undefined) return;\n const current = typeof val;\n if (current !== expectedType || val === null)\n throw new Error(`param \"${fieldName}\" is invalid: expected ${expectedType}, got ${current}`);\n }\n Object.entries(fields).forEach(([k, v]) => checkField(k, v, false));\n Object.entries(optFields).forEach(([k, v]) => checkField(k, v, true));\n}\n\n/**\n * throws not implemented error\n */\nexport const notImplemented = (): never => {\n throw new Error('not implemented');\n};\n\n/**\n * Memoizes (caches) computation result.\n * Uses WeakMap: the value is going auto-cleaned by GC after last reference is removed.\n */\nexport function memoized(\n fn: (arg: T, ...args: O) => R\n): (arg: T, ...args: O) => R {\n const map = new WeakMap();\n return (arg: T, ...args: O): R => {\n const val = map.get(arg);\n if (val !== undefined) return val;\n const computed = fn(arg, ...args);\n map.set(arg, computed);\n return computed;\n };\n}\n","/**\n * Utils for modular division and fields.\n * Field over 11 is a finite (Galois) field is integer number operations `mod 11`.\n * There is no division: it is replaced by modular multiplicative inverse.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport {\n _validateObject,\n anumber,\n bitMask,\n bytesToNumberBE,\n bytesToNumberLE,\n ensureBytes,\n numberToBytesBE,\n numberToBytesLE,\n} from '../utils.ts';\n\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _3n = /* @__PURE__ */ BigInt(3);\n// prettier-ignore\nconst _4n = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5), _7n = /* @__PURE__ */ BigInt(7);\n// prettier-ignore\nconst _8n = /* @__PURE__ */ BigInt(8), _9n = /* @__PURE__ */ BigInt(9), _16n = /* @__PURE__ */ BigInt(16);\n\n// Calculates a modulo b\nexport function mod(a: bigint, b: bigint): bigint {\n const result = a % b;\n return result >= _0n ? result : b + result;\n}\n/**\n * Efficiently raise num to power and do modular division.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * @example\n * pow(2n, 6n, 11n) // 64n % 11n == 9n\n */\nexport function pow(num: bigint, power: bigint, modulo: bigint): bigint {\n return FpPow(Field(modulo), num, power);\n}\n\n/** Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)` */\nexport function pow2(x: bigint, power: bigint, modulo: bigint): bigint {\n let res = x;\n while (power-- > _0n) {\n res *= res;\n res %= modulo;\n }\n return res;\n}\n\n/**\n * Inverses number over modulo.\n * Implemented using [Euclidean GCD](https://brilliant.org/wiki/extended-euclidean-algorithm/).\n */\nexport function invert(number: bigint, modulo: bigint): bigint {\n if (number === _0n) throw new Error('invert: expected non-zero number');\n if (modulo <= _0n) throw new Error('invert: expected positive modulus, got ' + modulo);\n // Fermat's little theorem \"CT-like\" version inv(n) = n^(m-2) mod m is 30x slower.\n let a = mod(number, modulo);\n let b = modulo;\n // prettier-ignore\n let x = _0n, y = _1n, u = _1n, v = _0n;\n while (a !== _0n) {\n // JIT applies optimization if those two lines follow each other\n const q = b / a;\n const r = b % a;\n const m = x - u * q;\n const n = y - v * q;\n // prettier-ignore\n b = a, a = r, x = u, y = v, u = m, v = n;\n }\n const gcd = b;\n if (gcd !== _1n) throw new Error('invert: does not exist');\n return mod(x, modulo);\n}\n\nfunction assertIsSquare(Fp: IField, root: T, n: T): void {\n if (!Fp.eql(Fp.sqr(root), n)) throw new Error('Cannot find square root');\n}\n\n// Not all roots are possible! Example which will throw:\n// const NUM =\n// n = 72057594037927816n;\n// Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'));\nfunction sqrt3mod4(Fp: IField, n: T) {\n const p1div4 = (Fp.ORDER + _1n) / _4n;\n const root = Fp.pow(n, p1div4);\n assertIsSquare(Fp, root, n);\n return root;\n}\n\nfunction sqrt5mod8(Fp: IField, n: T) {\n const p5div8 = (Fp.ORDER - _5n) / _8n;\n const n2 = Fp.mul(n, _2n);\n const v = Fp.pow(n2, p5div8);\n const nv = Fp.mul(n, v);\n const i = Fp.mul(Fp.mul(nv, _2n), v);\n const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));\n assertIsSquare(Fp, root, n);\n return root;\n}\n\n// Based on RFC9380, Kong algorithm\n// prettier-ignore\nfunction sqrt9mod16(P: bigint): (Fp: IField, n: T) => T {\n const Fp_ = Field(P);\n const tn = tonelliShanks(P);\n const c1 = tn(Fp_, Fp_.neg(Fp_.ONE));// 1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F\n const c2 = tn(Fp_, c1); // 2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F\n const c3 = tn(Fp_, Fp_.neg(c1)); // 3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F\n const c4 = (P + _7n) / _16n; // 4. c4 = (q + 7) / 16 # Integer arithmetic\n return (Fp: IField, n: T) => {\n let tv1 = Fp.pow(n, c4); // 1. tv1 = x^c4\n let tv2 = Fp.mul(tv1, c1); // 2. tv2 = c1 * tv1\n const tv3 = Fp.mul(tv1, c2); // 3. tv3 = c2 * tv1\n const tv4 = Fp.mul(tv1, c3); // 4. tv4 = c3 * tv1\n const e1 = Fp.eql(Fp.sqr(tv2), n); // 5. e1 = (tv2^2) == x\n const e2 = Fp.eql(Fp.sqr(tv3), n); // 6. e2 = (tv3^2) == x\n tv1 = Fp.cmov(tv1, tv2, e1); // 7. tv1 = CMOV(tv1, tv2, e1) # Select tv2 if (tv2^2) == x\n tv2 = Fp.cmov(tv4, tv3, e2); // 8. tv2 = CMOV(tv4, tv3, e2) # Select tv3 if (tv3^2) == x\n const e3 = Fp.eql(Fp.sqr(tv2), n); // 9. e3 = (tv2^2) == x\n const root = Fp.cmov(tv1, tv2, e3);// 10. z = CMOV(tv1, tv2, e3) # Select sqrt from tv1 & tv2\n assertIsSquare(Fp, root, n);\n return root;\n };\n}\n\n/**\n * Tonelli-Shanks square root search algorithm.\n * 1. https://eprint.iacr.org/2012/685.pdf (page 12)\n * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks\n * @param P field order\n * @returns function that takes field Fp (created from P) and number n\n */\nexport function tonelliShanks(P: bigint): (Fp: IField, n: T) => T {\n // Initialization (precomputation).\n // Caching initialization could boost perf by 7%.\n if (P < _3n) throw new Error('sqrt is not defined for small field');\n // Factor P - 1 = Q * 2^S, where Q is odd\n let Q = P - _1n;\n let S = 0;\n while (Q % _2n === _0n) {\n Q /= _2n;\n S++;\n }\n\n // Find the first quadratic non-residue Z >= 2\n let Z = _2n;\n const _Fp = Field(P);\n while (FpLegendre(_Fp, Z) === 1) {\n // Basic primality test for P. After x iterations, chance of\n // not finding quadratic non-residue is 2^x, so 2^1000.\n if (Z++ > 1000) throw new Error('Cannot find square root: probably non-prime P');\n }\n // Fast-path; usually done before Z, but we do \"primality test\".\n if (S === 1) return sqrt3mod4;\n\n // Slow-path\n // TODO: test on Fp2 and others\n let cc = _Fp.pow(Z, Q); // c = z^Q\n const Q1div2 = (Q + _1n) / _2n;\n return function tonelliSlow(Fp: IField, n: T): T {\n if (Fp.is0(n)) return n;\n // Check if n is a quadratic residue using Legendre symbol\n if (FpLegendre(Fp, n) !== 1) throw new Error('Cannot find square root');\n\n // Initialize variables for the main loop\n let M = S;\n let c = Fp.mul(Fp.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp\n let t = Fp.pow(n, Q); // t = n^Q, first guess at the fudge factor\n let R = Fp.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root\n\n // Main loop\n // while t != 1\n while (!Fp.eql(t, Fp.ONE)) {\n if (Fp.is0(t)) return Fp.ZERO; // if t=0 return R=0\n let i = 1;\n\n // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P)\n let t_tmp = Fp.sqr(t); // t^(2^1)\n while (!Fp.eql(t_tmp, Fp.ONE)) {\n i++;\n t_tmp = Fp.sqr(t_tmp); // t^(2^2)...\n if (i === M) throw new Error('Cannot find square root');\n }\n\n // Calculate the exponent for b: 2^(M - i - 1)\n const exponent = _1n << BigInt(M - i - 1); // bigint is important\n const b = Fp.pow(c, exponent); // b = 2^(M - i - 1)\n\n // Update variables\n M = i;\n c = Fp.sqr(b); // c = b^2\n t = Fp.mul(t, c); // t = (t * b^2)\n R = Fp.mul(R, b); // R = R*b\n }\n return R;\n };\n}\n\n/**\n * Square root for a finite field. Will try optimized versions first:\n *\n * 1. P ≡ 3 (mod 4)\n * 2. P ≡ 5 (mod 8)\n * 3. P ≡ 9 (mod 16)\n * 4. Tonelli-Shanks algorithm\n *\n * Different algorithms can give different roots, it is up to user to decide which one they want.\n * For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).\n */\nexport function FpSqrt(P: bigint): (Fp: IField, n: T) => T {\n // P ≡ 3 (mod 4) => √n = n^((P+1)/4)\n if (P % _4n === _3n) return sqrt3mod4;\n // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf\n if (P % _8n === _5n) return sqrt5mod8;\n // P ≡ 9 (mod 16) => Kong algorithm, page 11 of https://eprint.iacr.org/2012/685.pdf (algorithm 4)\n if (P % _16n === _9n) return sqrt9mod16(P);\n // Tonelli-Shanks algorithm\n return tonelliShanks(P);\n}\n\n// Little-endian check for first LE bit (last BE bit);\nexport const isNegativeLE = (num: bigint, modulo: bigint): boolean =>\n (mod(num, modulo) & _1n) === _1n;\n\n/** Field is not always over prime: for example, Fp2 has ORDER(q)=p^m. */\nexport interface IField {\n ORDER: bigint;\n isLE: boolean;\n BYTES: number;\n BITS: number;\n MASK: bigint;\n ZERO: T;\n ONE: T;\n // 1-arg\n create: (num: T) => T;\n isValid: (num: T) => boolean;\n is0: (num: T) => boolean;\n isValidNot0: (num: T) => boolean;\n neg(num: T): T;\n inv(num: T): T;\n sqrt(num: T): T;\n sqr(num: T): T;\n // 2-args\n eql(lhs: T, rhs: T): boolean;\n add(lhs: T, rhs: T): T;\n sub(lhs: T, rhs: T): T;\n mul(lhs: T, rhs: T | bigint): T;\n pow(lhs: T, power: bigint): T;\n div(lhs: T, rhs: T | bigint): T;\n // N for NonNormalized (for now)\n addN(lhs: T, rhs: T): T;\n subN(lhs: T, rhs: T): T;\n mulN(lhs: T, rhs: T | bigint): T;\n sqrN(num: T): T;\n\n // Optional\n // Should be same as sgn0 function in\n // [RFC9380](https://www.rfc-editor.org/rfc/rfc9380#section-4.1).\n // NOTE: sgn0 is 'negative in LE', which is same as odd. And negative in LE is kinda strange definition anyway.\n isOdd?(num: T): boolean; // Odd instead of even since we have it for Fp2\n allowedLengths?: number[];\n // legendre?(num: T): T;\n invertBatch: (lst: T[]) => T[];\n toBytes(num: T): Uint8Array;\n fromBytes(bytes: Uint8Array, skipValidation?: boolean): T;\n // If c is False, CMOV returns a, otherwise it returns b.\n cmov(a: T, b: T, c: boolean): T;\n}\n// prettier-ignore\nconst FIELD_FIELDS = [\n 'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',\n 'eql', 'add', 'sub', 'mul', 'pow', 'div',\n 'addN', 'subN', 'mulN', 'sqrN'\n] as const;\nexport function validateField(field: IField): IField {\n const initial = {\n ORDER: 'bigint',\n MASK: 'bigint',\n BYTES: 'number',\n BITS: 'number',\n } as Record;\n const opts = FIELD_FIELDS.reduce((map, val: string) => {\n map[val] = 'function';\n return map;\n }, initial);\n _validateObject(field, opts);\n // const max = 16384;\n // if (field.BYTES < 1 || field.BYTES > max) throw new Error('invalid field');\n // if (field.BITS < 1 || field.BITS > 8 * max) throw new Error('invalid field');\n return field;\n}\n\n// Generic field functions\n\n/**\n * Same as `pow` but for Fp: non-constant-time.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n */\nexport function FpPow(Fp: IField, num: T, power: bigint): T {\n if (power < _0n) throw new Error('invalid exponent, negatives unsupported');\n if (power === _0n) return Fp.ONE;\n if (power === _1n) return num;\n let p = Fp.ONE;\n let d = num;\n while (power > _0n) {\n if (power & _1n) p = Fp.mul(p, d);\n d = Fp.sqr(d);\n power >>= _1n;\n }\n return p;\n}\n\n/**\n * Efficiently invert an array of Field elements.\n * Exception-free. Will return `undefined` for 0 elements.\n * @param passZero map 0 to 0 (instead of undefined)\n */\nexport function FpInvertBatch(Fp: IField, nums: T[], passZero = false): T[] {\n const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : undefined);\n // Walk from first to last, multiply them by each other MOD p\n const multipliedAcc = nums.reduce((acc, num, i) => {\n if (Fp.is0(num)) return acc;\n inverted[i] = acc;\n return Fp.mul(acc, num);\n }, Fp.ONE);\n // Invert last element\n const invertedAcc = Fp.inv(multipliedAcc);\n // Walk from last to first, multiply them by inverted each other MOD p\n nums.reduceRight((acc, num, i) => {\n if (Fp.is0(num)) return acc;\n inverted[i] = Fp.mul(acc, inverted[i]);\n return Fp.mul(acc, num);\n }, invertedAcc);\n return inverted;\n}\n\n// TODO: remove\nexport function FpDiv(Fp: IField, lhs: T, rhs: T | bigint): T {\n return Fp.mul(lhs, typeof rhs === 'bigint' ? invert(rhs, Fp.ORDER) : Fp.inv(rhs));\n}\n\n/**\n * Legendre symbol.\n * Legendre constant is used to calculate Legendre symbol (a | p)\n * which denotes the value of a^((p-1)/2) (mod p).\n *\n * * (a | p) ≡ 1 if a is a square (mod p), quadratic residue\n * * (a | p) ≡ -1 if a is not a square (mod p), quadratic non residue\n * * (a | p) ≡ 0 if a ≡ 0 (mod p)\n */\nexport function FpLegendre(Fp: IField, n: T): -1 | 0 | 1 {\n // We can use 3rd argument as optional cache of this value\n // but seems unneeded for now. The operation is very fast.\n const p1mod2 = (Fp.ORDER - _1n) / _2n;\n const powered = Fp.pow(n, p1mod2);\n const yes = Fp.eql(powered, Fp.ONE);\n const zero = Fp.eql(powered, Fp.ZERO);\n const no = Fp.eql(powered, Fp.neg(Fp.ONE));\n if (!yes && !zero && !no) throw new Error('invalid Legendre symbol result');\n return yes ? 1 : zero ? 0 : -1;\n}\n\n// This function returns True whenever the value x is a square in the field F.\nexport function FpIsSquare(Fp: IField, n: T): boolean {\n const l = FpLegendre(Fp, n);\n return l === 1;\n}\n\nexport type NLength = { nByteLength: number; nBitLength: number };\n// CURVE.n lengths\nexport function nLength(n: bigint, nBitLength?: number): NLength {\n // Bit size, byte size of CURVE.n\n if (nBitLength !== undefined) anumber(nBitLength);\n const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length;\n const nByteLength = Math.ceil(_nBitLength / 8);\n return { nBitLength: _nBitLength, nByteLength };\n}\n\ntype FpField = IField & Required, 'isOdd'>>;\ntype SqrtFn = (n: bigint) => bigint;\ntype FieldOpts = Partial<{\n sqrt: SqrtFn;\n isLE: boolean;\n BITS: number;\n modFromBytes: boolean; // bls12-381 requires mod(n) instead of rejecting keys >= n\n allowedLengths?: readonly number[]; // for P521 (adds padding for smaller sizes)\n}>;\n/**\n * Creates a finite field. Major performance optimizations:\n * * 1. Denormalized operations like mulN instead of mul.\n * * 2. Identical object shape: never add or remove keys.\n * * 3. `Object.freeze`.\n * Fragile: always run a benchmark on a change.\n * Security note: operations don't check 'isValid' for all elements for performance reasons,\n * it is caller responsibility to check this.\n * This is low-level code, please make sure you know what you're doing.\n *\n * Note about field properties:\n * * CHARACTERISTIC p = prime number, number of elements in main subgroup.\n * * ORDER q = similar to cofactor in curves, may be composite `q = p^m`.\n *\n * @param ORDER field order, probably prime, or could be composite\n * @param bitLen how many bits the field consumes\n * @param isLE (default: false) if encoding / decoding should be in little-endian\n * @param redef optional faster redefinitions of sqrt and other methods\n */\nexport function Field(\n ORDER: bigint,\n bitLenOrOpts?: number | FieldOpts, // TODO: use opts only in v2?\n isLE = false,\n opts: { sqrt?: SqrtFn } = {}\n): Readonly {\n if (ORDER <= _0n) throw new Error('invalid field: expected ORDER > 0, got ' + ORDER);\n let _nbitLength: number | undefined = undefined;\n let _sqrt: SqrtFn | undefined = undefined;\n let modFromBytes: boolean = false;\n let allowedLengths: undefined | readonly number[] = undefined;\n if (typeof bitLenOrOpts === 'object' && bitLenOrOpts != null) {\n if (opts.sqrt || isLE) throw new Error('cannot specify opts in two arguments');\n const _opts = bitLenOrOpts;\n if (_opts.BITS) _nbitLength = _opts.BITS;\n if (_opts.sqrt) _sqrt = _opts.sqrt;\n if (typeof _opts.isLE === 'boolean') isLE = _opts.isLE;\n if (typeof _opts.modFromBytes === 'boolean') modFromBytes = _opts.modFromBytes;\n allowedLengths = _opts.allowedLengths;\n } else {\n if (typeof bitLenOrOpts === 'number') _nbitLength = bitLenOrOpts;\n if (opts.sqrt) _sqrt = opts.sqrt;\n }\n const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, _nbitLength);\n if (BYTES > 2048) throw new Error('invalid field: expected ORDER of <= 2048 bytes');\n let sqrtP: ReturnType; // cached sqrtP\n const f: Readonly = Object.freeze({\n ORDER,\n isLE,\n BITS,\n BYTES,\n MASK: bitMask(BITS),\n ZERO: _0n,\n ONE: _1n,\n allowedLengths: allowedLengths,\n create: (num) => mod(num, ORDER),\n isValid: (num) => {\n if (typeof num !== 'bigint')\n throw new Error('invalid field element: expected bigint, got ' + typeof num);\n return _0n <= num && num < ORDER; // 0 is valid element, but it's not invertible\n },\n is0: (num) => num === _0n,\n // is valid and invertible\n isValidNot0: (num: bigint) => !f.is0(num) && f.isValid(num),\n isOdd: (num) => (num & _1n) === _1n,\n neg: (num) => mod(-num, ORDER),\n eql: (lhs, rhs) => lhs === rhs,\n\n sqr: (num) => mod(num * num, ORDER),\n add: (lhs, rhs) => mod(lhs + rhs, ORDER),\n sub: (lhs, rhs) => mod(lhs - rhs, ORDER),\n mul: (lhs, rhs) => mod(lhs * rhs, ORDER),\n pow: (num, power) => FpPow(f, num, power),\n div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),\n\n // Same as above, but doesn't normalize\n sqrN: (num) => num * num,\n addN: (lhs, rhs) => lhs + rhs,\n subN: (lhs, rhs) => lhs - rhs,\n mulN: (lhs, rhs) => lhs * rhs,\n\n inv: (num) => invert(num, ORDER),\n sqrt:\n _sqrt ||\n ((n) => {\n if (!sqrtP) sqrtP = FpSqrt(ORDER);\n return sqrtP(f, n);\n }),\n toBytes: (num) => (isLE ? numberToBytesLE(num, BYTES) : numberToBytesBE(num, BYTES)),\n fromBytes: (bytes, skipValidation = true) => {\n if (allowedLengths) {\n if (!allowedLengths.includes(bytes.length) || bytes.length > BYTES) {\n throw new Error(\n 'Field.fromBytes: expected ' + allowedLengths + ' bytes, got ' + bytes.length\n );\n }\n const padded = new Uint8Array(BYTES);\n // isLE add 0 to right, !isLE to the left.\n padded.set(bytes, isLE ? 0 : padded.length - bytes.length);\n bytes = padded;\n }\n if (bytes.length !== BYTES)\n throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);\n let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n if (modFromBytes) scalar = mod(scalar, ORDER);\n if (!skipValidation)\n if (!f.isValid(scalar)) throw new Error('invalid field element: outside of range 0..ORDER');\n // NOTE: we don't validate scalar here, please use isValid. This done such way because some\n // protocol may allow non-reduced scalar that reduced later or changed some other way.\n return scalar;\n },\n // TODO: we don't need it here, move out to separate fn\n invertBatch: (lst) => FpInvertBatch(f, lst),\n // We can't move this out because Fp6, Fp12 implement it\n // and it's unclear what to return in there.\n cmov: (a, b, c) => (c ? b : a),\n } as FpField);\n return Object.freeze(f);\n}\n\n// Generic random scalar, we can do same for other fields if via Fp2.mul(Fp2.ONE, Fp2.random)?\n// This allows unsafe methods like ignore bias or zero. These unsafe, but often used in different protocols (if deterministic RNG).\n// which mean we cannot force this via opts.\n// Not sure what to do with randomBytes, we can accept it inside opts if wanted.\n// Probably need to export getMinHashLength somewhere?\n// random(bytes?: Uint8Array, unsafeAllowZero = false, unsafeAllowBias = false) {\n// const LEN = !unsafeAllowBias ? getMinHashLength(ORDER) : BYTES;\n// if (bytes === undefined) bytes = randomBytes(LEN); // _opts.randomBytes?\n// const num = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n// // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n// const reduced = unsafeAllowZero ? mod(num, ORDER) : mod(num, ORDER - _1n) + _1n;\n// return reduced;\n// },\n\nexport function FpSqrtOdd(Fp: IField, elm: T): T {\n if (!Fp.isOdd) throw new Error(\"Field doesn't have isOdd\");\n const root = Fp.sqrt(elm);\n return Fp.isOdd(root) ? root : Fp.neg(root);\n}\n\nexport function FpSqrtEven(Fp: IField, elm: T): T {\n if (!Fp.isOdd) throw new Error(\"Field doesn't have isOdd\");\n const root = Fp.sqrt(elm);\n return Fp.isOdd(root) ? Fp.neg(root) : root;\n}\n\n/**\n * \"Constant-time\" private key generation utility.\n * Same as mapKeyToField, but accepts less bytes (40 instead of 48 for 32-byte field).\n * Which makes it slightly more biased, less secure.\n * @deprecated use `mapKeyToField` instead\n */\nexport function hashToPrivateScalar(\n hash: string | Uint8Array,\n groupOrder: bigint,\n isLE = false\n): bigint {\n hash = ensureBytes('privateHash', hash);\n const hashLen = hash.length;\n const minLen = nLength(groupOrder).nByteLength + 8;\n if (minLen < 24 || hashLen < minLen || hashLen > 1024)\n throw new Error(\n 'hashToPrivateScalar: expected ' + minLen + '-1024 bytes of input, got ' + hashLen\n );\n const num = isLE ? bytesToNumberLE(hash) : bytesToNumberBE(hash);\n return mod(num, groupOrder - _1n) + _1n;\n}\n\n/**\n * Returns total number of bytes consumed by the field element.\n * For example, 32 bytes for usual 256-bit weierstrass curve.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of field\n */\nexport function getFieldBytesLength(fieldOrder: bigint): number {\n if (typeof fieldOrder !== 'bigint') throw new Error('field order must be bigint');\n const bitLength = fieldOrder.toString(2).length;\n return Math.ceil(bitLength / 8);\n}\n\n/**\n * Returns minimal amount of bytes that can be safely reduced\n * by field order.\n * Should be 2^-128 for 128-bit curve such as P256.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of target hash\n */\nexport function getMinHashLength(fieldOrder: bigint): number {\n const length = getFieldBytesLength(fieldOrder);\n return length + Math.ceil(length / 2);\n}\n\n/**\n * \"Constant-time\" private key generation utility.\n * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF\n * and convert them into private scalar, with the modulo bias being negligible.\n * Needs at least 48 bytes of input for 32-byte private key.\n * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/\n * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final\n * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5\n * @param hash hash output from SHA3 or a similar function\n * @param groupOrder size of subgroup - (e.g. secp256k1.CURVE.n)\n * @param isLE interpret hash bytes as LE num\n * @returns valid private scalar\n */\nexport function mapHashToField(key: Uint8Array, fieldOrder: bigint, isLE = false): Uint8Array {\n const len = key.length;\n const fieldLen = getFieldBytesLength(fieldOrder);\n const minLen = getMinHashLength(fieldOrder);\n // No small numbers: need to understand bias story. No huge numbers: easier to detect JS timings.\n if (len < 16 || len < minLen || len > 1024)\n throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);\n const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);\n // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n const reduced = mod(num, fieldOrder - _1n) + _1n;\n return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);\n}\n","/**\n * Methods for elliptic curve multiplication by scalars.\n * Contains wNAF, pippenger.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { bitLen, bitMask, validateObject } from '../utils.ts';\nimport { Field, FpInvertBatch, nLength, validateField, type IField } from './modular.ts';\n\nconst _0n = BigInt(0);\nconst _1n = BigInt(1);\n\nexport type AffinePoint = {\n x: T;\n y: T;\n} & { Z?: never };\n\n// This was initialy do this way to re-use montgomery ladder in field (add->mul,double->sqr), but\n// that didn't happen and there is probably not much reason to have separate Group like this?\nexport interface Group> {\n double(): T;\n negate(): T;\n add(other: T): T;\n subtract(other: T): T;\n equals(other: T): boolean;\n multiply(scalar: bigint): T;\n toAffine?(invertedZ?: any): AffinePoint;\n}\n\n// We can't \"abstract out\" coordinates (X, Y, Z; and T in Edwards): argument names of constructor\n// are not accessible. See Typescript gh-56093, gh-41594.\n//\n// We have to use recursive types, so it will return actual point, not constained `CurvePoint`.\n// If, at any point, P is `any`, it will erase all types and replace it\n// with `any`, because of recursion, `any implements CurvePoint`,\n// but we lose all constrains on methods.\n\n/** Base interface for all elliptic curve Points. */\nexport interface CurvePoint> extends Group

{\n /** Affine x coordinate. Different from projective / extended X coordinate. */\n x: F;\n /** Affine y coordinate. Different from projective / extended Y coordinate. */\n y: F;\n Z?: F;\n double(): P;\n negate(): P;\n add(other: P): P;\n subtract(other: P): P;\n equals(other: P): boolean;\n multiply(scalar: bigint): P;\n assertValidity(): void;\n clearCofactor(): P;\n is0(): boolean;\n isTorsionFree(): boolean;\n isSmallOrder(): boolean;\n multiplyUnsafe(scalar: bigint): P;\n /**\n * Massively speeds up `p.multiply(n)` by using precompute tables (caching). See {@link wNAF}.\n * @param isLazy calculate cache now. Default (true) ensures it's deferred to first `multiply()`\n */\n precompute(windowSize?: number, isLazy?: boolean): P;\n /** Converts point to 2D xy affine coordinates */\n toAffine(invertedZ?: F): AffinePoint;\n toBytes(): Uint8Array;\n toHex(): string;\n}\n\n/** Base interface for all elliptic curve Point constructors. */\nexport interface CurvePointCons

> {\n [Symbol.hasInstance]: (item: unknown) => boolean;\n BASE: P;\n ZERO: P;\n /** Field for basic curve math */\n Fp: IField>;\n /** Scalar field, for scalars in multiply and others */\n Fn: IField;\n /** Creates point from x, y. Does NOT validate if the point is valid. Use `.assertValidity()`. */\n fromAffine(p: AffinePoint>): P;\n fromBytes(bytes: Uint8Array): P;\n fromHex(hex: Uint8Array | string): P;\n}\n\n// Type inference helpers: PC - PointConstructor, P - Point, Fp - Field element\n// Short names, because we use them a lot in result types:\n// * we can't do 'P = GetCurvePoint': this is default value and doesn't constrain anything\n// * we can't do 'type X = GetCurvePoint': it won't be accesible for arguments/return types\n// * `CurvePointCons

>` constraints from interface definition\n// won't propagate, if `PC extends CurvePointCons`: the P would be 'any', which is incorrect\n// * PC could be super specific with super specific P, which implements CurvePoint.\n// this means we need to do stuff like\n// `function test

, PC extends CurvePointCons

>(`\n// if we want type safety around P, otherwise PC_P will be any\n\n/** Returns Fp type from Point (P_F

== P.F) */\nexport type P_F

> = P extends CurvePoint ? F : never;\n/** Returns Fp type from PointCons (PC_F == PC.P.F) */\nexport type PC_F>> = PC['Fp']['ZERO'];\n/** Returns Point type from PointCons (PC_P == PC.P) */\nexport type PC_P>> = PC['ZERO'];\n\n// Ugly hack to get proper type inference, because in typescript fails to infer resursively.\n// The hack allows to do up to 10 chained operations without applying type erasure.\n//\n// Types which won't work:\n// * `CurvePointCons>`, will return `any` after 1 operation\n// * `CurvePointCons: WeierstrassPointCons extends CurvePointCons = false`\n// * `P extends CurvePoint, PC extends CurvePointCons

`\n// * It can't infer P from PC alone\n// * Too many relations between F, P & PC\n// * It will infer P/F if `arg: CurvePointCons`, but will fail if PC is generic\n// * It will work correctly if there is an additional argument of type P\n// * But generally, we don't want to parametrize `CurvePointCons` over `F`: it will complicate\n// types, making them un-inferable\n// prettier-ignore\nexport type PC_ANY = CurvePointCons<\n CurvePoint\n >>>>>>>>>\n>;\n\nexport interface CurveLengths {\n secretKey?: number;\n publicKey?: number;\n publicKeyUncompressed?: number;\n publicKeyHasPrefix?: boolean;\n signature?: number;\n seed?: number;\n}\nexport type GroupConstructor = {\n BASE: T;\n ZERO: T;\n};\n/** @deprecated */\nexport type ExtendedGroupConstructor = GroupConstructor & {\n Fp: IField;\n Fn: IField;\n fromAffine(ap: AffinePoint): T;\n};\nexport type Mapper = (i: T[]) => T[];\n\nexport function negateCt T }>(condition: boolean, item: T): T {\n const neg = item.negate();\n return condition ? neg : item;\n}\n\n/**\n * Takes a bunch of Projective Points but executes only one\n * inversion on all of them. Inversion is very slow operation,\n * so this improves performance massively.\n * Optimization: converts a list of projective points to a list of identical points with Z=1.\n */\nexport function normalizeZ

, PC extends CurvePointCons

>(\n c: PC,\n points: P[]\n): P[] {\n const invertedZs = FpInvertBatch(\n c.Fp,\n points.map((p) => p.Z!)\n );\n return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));\n}\n\nfunction validateW(W: number, bits: number) {\n if (!Number.isSafeInteger(W) || W <= 0 || W > bits)\n throw new Error('invalid window size, expected [1..' + bits + '], got W=' + W);\n}\n\n/** Internal wNAF opts for specific W and scalarBits */\nexport type WOpts = {\n windows: number;\n windowSize: number;\n mask: bigint;\n maxNumber: number;\n shiftBy: bigint;\n};\n\nfunction calcWOpts(W: number, scalarBits: number): WOpts {\n validateW(W, scalarBits);\n const windows = Math.ceil(scalarBits / W) + 1; // W=8 33. Not 32, because we skip zero\n const windowSize = 2 ** (W - 1); // W=8 128. Not 256, because we skip zero\n const maxNumber = 2 ** W; // W=8 256\n const mask = bitMask(W); // W=8 255 == mask 0b11111111\n const shiftBy = BigInt(W); // W=8 8\n return { windows, windowSize, mask, maxNumber, shiftBy };\n}\n\nfunction calcOffsets(n: bigint, window: number, wOpts: WOpts) {\n const { windowSize, mask, maxNumber, shiftBy } = wOpts;\n let wbits = Number(n & mask); // extract W bits.\n let nextN = n >> shiftBy; // shift number by W bits.\n\n // What actually happens here:\n // const highestBit = Number(mask ^ (mask >> 1n));\n // let wbits2 = wbits - 1; // skip zero\n // if (wbits2 & highestBit) { wbits2 ^= Number(mask); // (~);\n\n // split if bits > max: +224 => 256-32\n if (wbits > windowSize) {\n // we skip zero, which means instead of `>= size-1`, we do `> size`\n wbits -= maxNumber; // -32, can be maxNumber - wbits, but then we need to set isNeg here.\n nextN += _1n; // +256 (carry)\n }\n const offsetStart = window * windowSize;\n const offset = offsetStart + Math.abs(wbits) - 1; // -1 because we skip zero\n const isZero = wbits === 0; // is current window slice a 0?\n const isNeg = wbits < 0; // is current window slice negative?\n const isNegF = window % 2 !== 0; // fake random statement for noise\n const offsetF = offsetStart; // fake offset for noise\n return { nextN, offset, isZero, isNeg, isNegF, offsetF };\n}\n\nfunction validateMSMPoints(points: any[], c: any) {\n if (!Array.isArray(points)) throw new Error('array expected');\n points.forEach((p, i) => {\n if (!(p instanceof c)) throw new Error('invalid point at index ' + i);\n });\n}\nfunction validateMSMScalars(scalars: any[], field: any) {\n if (!Array.isArray(scalars)) throw new Error('array of scalars expected');\n scalars.forEach((s, i) => {\n if (!field.isValid(s)) throw new Error('invalid scalar at index ' + i);\n });\n}\n\n// Since points in different groups cannot be equal (different object constructor),\n// we can have single place to store precomputes.\n// Allows to make points frozen / immutable.\nconst pointPrecomputes = new WeakMap();\nconst pointWindowSizes = new WeakMap();\n\nfunction getW(P: any): number {\n // To disable precomputes:\n // return 1;\n return pointWindowSizes.get(P) || 1;\n}\n\nfunction assert0(n: bigint): void {\n if (n !== _0n) throw new Error('invalid wNAF');\n}\n\n/**\n * Elliptic curve multiplication of Point by scalar. Fragile.\n * Table generation takes **30MB of ram and 10ms on high-end CPU**,\n * but may take much longer on slow devices. Actual generation will happen on\n * first call of `multiply()`. By default, `BASE` point is precomputed.\n *\n * Scalars should always be less than curve order: this should be checked inside of a curve itself.\n * Creates precomputation tables for fast multiplication:\n * - private scalar is split by fixed size windows of W bits\n * - every window point is collected from window's table & added to accumulator\n * - since windows are different, same point inside tables won't be accessed more than once per calc\n * - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)\n * - +1 window is neccessary for wNAF\n * - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication\n *\n * @todo Research returning 2d JS array of windows, instead of a single window.\n * This would allow windows to be in different memory locations\n */\nexport class wNAF {\n private readonly BASE: PC_P;\n private readonly ZERO: PC_P;\n private readonly Fn: PC['Fn'];\n readonly bits: number;\n\n // Parametrized with a given Point class (not individual point)\n constructor(Point: PC, bits: number) {\n this.BASE = Point.BASE;\n this.ZERO = Point.ZERO;\n this.Fn = Point.Fn;\n this.bits = bits;\n }\n\n // non-const time multiplication ladder\n _unsafeLadder(elm: PC_P, n: bigint, p: PC_P = this.ZERO): PC_P {\n let d: PC_P = elm;\n while (n > _0n) {\n if (n & _1n) p = p.add(d);\n d = d.double();\n n >>= _1n;\n }\n return p;\n }\n\n /**\n * Creates a wNAF precomputation window. Used for caching.\n * Default window size is set by `utils.precompute()` and is equal to 8.\n * Number of precomputed points depends on the curve size:\n * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:\n * - 𝑊 is the window size\n * - 𝑛 is the bitlength of the curve order.\n * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.\n * @param point Point instance\n * @param W window size\n * @returns precomputed point tables flattened to a single array\n */\n private precomputeWindow(point: PC_P, W: number): PC_P[] {\n const { windows, windowSize } = calcWOpts(W, this.bits);\n const points: PC_P[] = [];\n let p: PC_P = point;\n let base = p;\n for (let window = 0; window < windows; window++) {\n base = p;\n points.push(base);\n // i=1, bc we skip 0\n for (let i = 1; i < windowSize; i++) {\n base = base.add(p);\n points.push(base);\n }\n p = base.double();\n }\n return points;\n }\n\n /**\n * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.\n * More compact implementation:\n * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541\n * @returns real and fake (for const-time) points\n */\n private wNAF(W: number, precomputes: PC_P[], n: bigint): { p: PC_P; f: PC_P } {\n // Scalar should be smaller than field order\n if (!this.Fn.isValid(n)) throw new Error('invalid scalar');\n // Accumulators\n let p = this.ZERO;\n let f = this.BASE;\n // This code was first written with assumption that 'f' and 'p' will never be infinity point:\n // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,\n // there is negate now: it is possible that negated element from low value\n // would be the same as high element, which will create carry into next window.\n // It's not obvious how this can fail, but still worth investigating later.\n const wo = calcWOpts(W, this.bits);\n for (let window = 0; window < wo.windows; window++) {\n // (n === _0n) is handled and not early-exited. isEven and offsetF are used for noise\n const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);\n n = nextN;\n if (isZero) {\n // bits are 0: add garbage to fake point\n // Important part for const-time getPublicKey: add random \"noise\" point to f.\n f = f.add(negateCt(isNegF, precomputes[offsetF]));\n } else {\n // bits are 1: add to result point\n p = p.add(negateCt(isNeg, precomputes[offset]));\n }\n }\n assert0(n);\n // Return both real and fake points: JIT won't eliminate f.\n // At this point there is a way to F be infinity-point even if p is not,\n // which makes it less const-time: around 1 bigint multiply.\n return { p, f };\n }\n\n /**\n * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.\n * @param acc accumulator point to add result of multiplication\n * @returns point\n */\n private wNAFUnsafe(\n W: number,\n precomputes: PC_P[],\n n: bigint,\n acc: PC_P = this.ZERO\n ): PC_P {\n const wo = calcWOpts(W, this.bits);\n for (let window = 0; window < wo.windows; window++) {\n if (n === _0n) break; // Early-exit, skip 0 value\n const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);\n n = nextN;\n if (isZero) {\n // Window bits are 0: skip processing.\n // Move to next window.\n continue;\n } else {\n const item = precomputes[offset];\n acc = acc.add(isNeg ? item.negate() : item); // Re-using acc allows to save adds in MSM\n }\n }\n assert0(n);\n return acc;\n }\n\n private getPrecomputes(W: number, point: PC_P, transform?: Mapper>): PC_P[] {\n // Calculate precomputes on a first run, reuse them after\n let comp = pointPrecomputes.get(point);\n if (!comp) {\n comp = this.precomputeWindow(point, W) as PC_P[];\n if (W !== 1) {\n // Doing transform outside of if brings 15% perf hit\n if (typeof transform === 'function') comp = transform(comp);\n pointPrecomputes.set(point, comp);\n }\n }\n return comp;\n }\n\n cached(\n point: PC_P,\n scalar: bigint,\n transform?: Mapper>\n ): { p: PC_P; f: PC_P } {\n const W = getW(point);\n return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);\n }\n\n unsafe(point: PC_P, scalar: bigint, transform?: Mapper>, prev?: PC_P): PC_P {\n const W = getW(point);\n if (W === 1) return this._unsafeLadder(point, scalar, prev); // For W=1 ladder is ~x2 faster\n return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);\n }\n\n // We calculate precomputes for elliptic curve point multiplication\n // using windowed method. This specifies window size and\n // stores precomputed values. Usually only base point would be precomputed.\n createCache(P: PC_P, W: number): void {\n validateW(W, this.bits);\n pointWindowSizes.set(P, W);\n pointPrecomputes.delete(P);\n }\n\n hasCache(elm: PC_P): boolean {\n return getW(elm) !== 1;\n }\n}\n\n/**\n * Endomorphism-specific multiplication for Koblitz curves.\n * Cost: 128 dbl, 0-256 adds.\n */\nexport function mulEndoUnsafe

, PC extends CurvePointCons

>(\n Point: PC,\n point: P,\n k1: bigint,\n k2: bigint\n): { p1: P; p2: P } {\n let acc = point;\n let p1 = Point.ZERO;\n let p2 = Point.ZERO;\n while (k1 > _0n || k2 > _0n) {\n if (k1 & _1n) p1 = p1.add(acc);\n if (k2 & _1n) p2 = p2.add(acc);\n acc = acc.double();\n k1 >>= _1n;\n k2 >>= _1n;\n }\n return { p1, p2 };\n}\n\n/**\n * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * 30x faster vs naive addition on L=4096, 10x faster than precomputes.\n * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.\n * Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.\n * @param c Curve Point constructor\n * @param fieldN field over CURVE.N - important that it's not over CURVE.P\n * @param points array of L curve points\n * @param scalars array of L scalars (aka secret keys / bigints)\n */\nexport function pippenger

, PC extends CurvePointCons

>(\n c: PC,\n fieldN: IField,\n points: P[],\n scalars: bigint[]\n): P {\n // If we split scalars by some window (let's say 8 bits), every chunk will only\n // take 256 buckets even if there are 4096 scalars, also re-uses double.\n // TODO:\n // - https://eprint.iacr.org/2024/750.pdf\n // - https://tches.iacr.org/index.php/TCHES/article/view/10287\n // 0 is accepted in scalars\n validateMSMPoints(points, c);\n validateMSMScalars(scalars, fieldN);\n const plength = points.length;\n const slength = scalars.length;\n if (plength !== slength) throw new Error('arrays of points and scalars must have equal length');\n // if (plength === 0) throw new Error('array must be of length >= 2');\n const zero = c.ZERO;\n const wbits = bitLen(BigInt(plength));\n let windowSize = 1; // bits\n if (wbits > 12) windowSize = wbits - 3;\n else if (wbits > 4) windowSize = wbits - 2;\n else if (wbits > 0) windowSize = 2;\n const MASK = bitMask(windowSize);\n const buckets = new Array(Number(MASK) + 1).fill(zero); // +1 for zero array\n const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;\n let sum = zero;\n for (let i = lastBits; i >= 0; i -= windowSize) {\n buckets.fill(zero);\n for (let j = 0; j < slength; j++) {\n const scalar = scalars[j];\n const wbits = Number((scalar >> BigInt(i)) & MASK);\n buckets[wbits] = buckets[wbits].add(points[j]);\n }\n let resI = zero; // not using this will do small speed-up, but will lose ct\n // Skip first bucket, because it is zero\n for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {\n sumI = sumI.add(buckets[j]);\n resI = resI.add(sumI);\n }\n sum = sum.add(resI);\n if (i !== 0) for (let j = 0; j < windowSize; j++) sum = sum.double();\n }\n return sum as P;\n}\n/**\n * Precomputed multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * @param c Curve Point constructor\n * @param fieldN field over CURVE.N - important that it's not over CURVE.P\n * @param points array of L curve points\n * @returns function which multiplies points with scaars\n */\nexport function precomputeMSMUnsafe

, PC extends CurvePointCons

>(\n c: PC,\n fieldN: IField,\n points: P[],\n windowSize: number\n): (scalars: bigint[]) => P {\n /**\n * Performance Analysis of Window-based Precomputation\n *\n * Base Case (256-bit scalar, 8-bit window):\n * - Standard precomputation requires:\n * - 31 additions per scalar × 256 scalars = 7,936 ops\n * - Plus 255 summary additions = 8,191 total ops\n * Note: Summary additions can be optimized via accumulator\n *\n * Chunked Precomputation Analysis:\n * - Using 32 chunks requires:\n * - 255 additions per chunk\n * - 256 doublings\n * - Total: (255 × 32) + 256 = 8,416 ops\n *\n * Memory Usage Comparison:\n * Window Size | Standard Points | Chunked Points\n * ------------|-----------------|---------------\n * 4-bit | 520 | 15\n * 8-bit | 4,224 | 255\n * 10-bit | 13,824 | 1,023\n * 16-bit | 557,056 | 65,535\n *\n * Key Advantages:\n * 1. Enables larger window sizes due to reduced memory overhead\n * 2. More efficient for smaller scalar counts:\n * - 16 chunks: (16 × 255) + 256 = 4,336 ops\n * - ~2x faster than standard 8,191 ops\n *\n * Limitations:\n * - Not suitable for plain precomputes (requires 256 constant doublings)\n * - Performance degrades with larger scalar counts:\n * - Optimal for ~256 scalars\n * - Less efficient for 4096+ scalars (Pippenger preferred)\n */\n validateW(windowSize, fieldN.BITS);\n validateMSMPoints(points, c);\n const zero = c.ZERO;\n const tableSize = 2 ** windowSize - 1; // table size (without zero)\n const chunks = Math.ceil(fieldN.BITS / windowSize); // chunks of item\n const MASK = bitMask(windowSize);\n const tables = points.map((p: P) => {\n const res = [];\n for (let i = 0, acc = p; i < tableSize; i++) {\n res.push(acc);\n acc = acc.add(p);\n }\n return res;\n });\n return (scalars: bigint[]): P => {\n validateMSMScalars(scalars, fieldN);\n if (scalars.length > points.length)\n throw new Error('array of scalars must be smaller than array of points');\n let res = zero;\n for (let i = 0; i < chunks; i++) {\n // No need to double if accumulator is still zero.\n if (res !== zero) for (let j = 0; j < windowSize; j++) res = res.double();\n const shiftBy = BigInt(chunks * windowSize - (i + 1) * windowSize);\n for (let j = 0; j < scalars.length; j++) {\n const n = scalars[j];\n const curr = Number((n >> shiftBy) & MASK);\n if (!curr) continue; // skip zero scalars chunks\n res = res.add(tables[j][curr - 1]);\n }\n }\n return res;\n };\n}\n\n// TODO: remove\n/**\n * Generic BasicCurve interface: works even for polynomial fields (BLS): P, n, h would be ok.\n * Though generator can be different (Fp2 / Fp6 for BLS).\n */\nexport type BasicCurve = {\n Fp: IField; // Field over which we'll do calculations (Fp)\n n: bigint; // Curve order, total count of valid points in the field\n nBitLength?: number; // bit length of curve order\n nByteLength?: number; // byte length of curve order\n h: bigint; // cofactor. we can assign default=1, but users will just ignore it w/o validation\n hEff?: bigint; // Number to multiply to clear cofactor\n Gx: T; // base point X coordinate\n Gy: T; // base point Y coordinate\n allowInfinityPoint?: boolean; // bls12-381 requires it. ZERO point is valid, but invalid pubkey\n};\n\n// TODO: remove\n/** @deprecated */\nexport function validateBasic(\n curve: BasicCurve & T\n): Readonly<\n {\n readonly nBitLength: number;\n readonly nByteLength: number;\n } & BasicCurve &\n T & {\n p: bigint;\n }\n> {\n validateField(curve.Fp);\n validateObject(\n curve,\n {\n n: 'bigint',\n h: 'bigint',\n Gx: 'field',\n Gy: 'field',\n },\n {\n nBitLength: 'isSafeInteger',\n nByteLength: 'isSafeInteger',\n }\n );\n // Set defaults\n return Object.freeze({\n ...nLength(curve.n, curve.nBitLength),\n ...curve,\n ...{ p: curve.Fp.ORDER },\n } as const);\n}\n\nexport type ValidCurveParams = {\n p: bigint;\n n: bigint;\n h: bigint;\n a: T;\n b?: T;\n d?: T;\n Gx: T;\n Gy: T;\n};\n\nfunction createField(order: bigint, field?: IField, isLE?: boolean): IField {\n if (field) {\n if (field.ORDER !== order) throw new Error('Field.ORDER must match order: Fp == p, Fn == n');\n validateField(field);\n return field;\n } else {\n return Field(order, { isLE }) as unknown as IField;\n }\n}\nexport type FpFn = { Fp: IField; Fn: IField };\n\n/** Validates CURVE opts and creates fields */\nexport function _createCurveFields(\n type: 'weierstrass' | 'edwards',\n CURVE: ValidCurveParams,\n curveOpts: Partial> = {},\n FpFnLE?: boolean\n): FpFn & { CURVE: ValidCurveParams } {\n if (FpFnLE === undefined) FpFnLE = type === 'edwards';\n if (!CURVE || typeof CURVE !== 'object') throw new Error(`expected valid ${type} CURVE object`);\n for (const p of ['p', 'n', 'h'] as const) {\n const val = CURVE[p];\n if (!(typeof val === 'bigint' && val > _0n))\n throw new Error(`CURVE.${p} must be positive bigint`);\n }\n const Fp = createField(CURVE.p, curveOpts.Fp, FpFnLE);\n const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);\n const _b: 'b' | 'd' = type === 'weierstrass' ? 'b' : 'd';\n const params = ['Gx', 'Gy', 'a', _b] as const;\n for (const p of params) {\n // @ts-ignore\n if (!Fp.isValid(CURVE[p]))\n throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);\n }\n CURVE = Object.freeze(Object.assign({}, CURVE));\n return { CURVE, Fp, Fn };\n}\n","/**\n * Twisted Edwards curve. The formula is: ax² + y² = 1 + dx²y².\n * For design rationale of types / exports, see weierstrass module documentation.\n * Untwisted Edwards curves exist, but they aren't used in real-world protocols.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport {\n _validateObject,\n _abool2 as abool,\n _abytes2 as abytes,\n aInRange,\n bytesToHex,\n bytesToNumberLE,\n concatBytes,\n copyBytes,\n ensureBytes,\n isBytes,\n memoized,\n notImplemented,\n randomBytes as randomBytesWeb,\n type FHash,\n type Hex,\n} from '../utils.ts';\nimport {\n _createCurveFields,\n normalizeZ,\n pippenger,\n wNAF,\n type AffinePoint,\n type BasicCurve,\n type CurveLengths,\n type CurvePoint,\n type CurvePointCons,\n} from './curve.ts';\nimport { Field, type IField, type NLength } from './modular.ts';\n\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _8n = BigInt(8);\n\nexport type UVRatio = (u: bigint, v: bigint) => { isValid: boolean; value: bigint };\n\n/** Instance of Extended Point with coordinates in X, Y, Z, T. */\nexport interface EdwardsPoint extends CurvePoint {\n /** extended X coordinate. Different from affine x. */\n readonly X: bigint;\n /** extended Y coordinate. Different from affine y. */\n readonly Y: bigint;\n /** extended Z coordinate */\n readonly Z: bigint;\n /** extended T coordinate */\n readonly T: bigint;\n\n /** @deprecated use `toBytes` */\n toRawBytes(): Uint8Array;\n /** @deprecated use `p.precompute(windowSize)` */\n _setWindowSize(windowSize: number): void;\n /** @deprecated use .X */\n readonly ex: bigint;\n /** @deprecated use .Y */\n readonly ey: bigint;\n /** @deprecated use .Z */\n readonly ez: bigint;\n /** @deprecated use .T */\n readonly et: bigint;\n}\n/** Static methods of Extended Point with coordinates in X, Y, Z, T. */\nexport interface EdwardsPointCons extends CurvePointCons {\n new (X: bigint, Y: bigint, Z: bigint, T: bigint): EdwardsPoint;\n CURVE(): EdwardsOpts;\n fromBytes(bytes: Uint8Array, zip215?: boolean): EdwardsPoint;\n fromHex(hex: Hex, zip215?: boolean): EdwardsPoint;\n /** @deprecated use `import { pippenger } from '@noble/curves/abstract/curve.js';` */\n msm(points: EdwardsPoint[], scalars: bigint[]): EdwardsPoint;\n}\n/** @deprecated use EdwardsPoint */\nexport type ExtPointType = EdwardsPoint;\n/** @deprecated use EdwardsPointCons */\nexport type ExtPointConstructor = EdwardsPointCons;\n\n/**\n * Twisted Edwards curve options.\n *\n * * a: formula param\n * * d: formula param\n * * p: prime characteristic (order) of finite field, in which arithmetics is done\n * * n: order of prime subgroup a.k.a total amount of valid curve points\n * * h: cofactor. h*n is group order; n is subgroup order\n * * Gx: x coordinate of generator point a.k.a. base point\n * * Gy: y coordinate of generator point\n */\nexport type EdwardsOpts = Readonly<{\n p: bigint;\n n: bigint;\n h: bigint;\n a: bigint;\n d: bigint;\n Gx: bigint;\n Gy: bigint;\n}>;\n\n/**\n * Extra curve options for Twisted Edwards.\n *\n * * Fp: redefined Field over curve.p\n * * Fn: redefined Field over curve.n\n * * uvRatio: helper function for decompression, calculating √(u/v)\n */\nexport type EdwardsExtraOpts = Partial<{\n Fp: IField;\n Fn: IField;\n FpFnLE: boolean;\n uvRatio: (u: bigint, v: bigint) => { isValid: boolean; value: bigint };\n}>;\n\n/**\n * EdDSA (Edwards Digital Signature algorithm) options.\n *\n * * hash: hash function used to hash secret keys and messages\n * * adjustScalarBytes: clears bits to get valid field element\n * * domain: Used for hashing\n * * mapToCurve: for hash-to-curve standard\n * * prehash: RFC 8032 pre-hashing of messages to sign() / verify()\n * * randomBytes: function generating random bytes, used for randomSecretKey\n */\nexport type EdDSAOpts = Partial<{\n adjustScalarBytes: (bytes: Uint8Array) => Uint8Array;\n domain: (data: Uint8Array, ctx: Uint8Array, phflag: boolean) => Uint8Array;\n mapToCurve: (scalar: bigint[]) => AffinePoint;\n prehash: FHash;\n randomBytes: (bytesLength?: number) => Uint8Array;\n}>;\n\n/**\n * EdDSA (Edwards Digital Signature algorithm) interface.\n *\n * Allows to create and verify signatures, create public and secret keys.\n */\nexport interface EdDSA {\n keygen: (seed?: Uint8Array) => { secretKey: Uint8Array; publicKey: Uint8Array };\n getPublicKey: (secretKey: Hex) => Uint8Array;\n sign: (message: Hex, secretKey: Hex, options?: { context?: Hex }) => Uint8Array;\n verify: (\n sig: Hex,\n message: Hex,\n publicKey: Hex,\n options?: { context?: Hex; zip215: boolean }\n ) => boolean;\n Point: EdwardsPointCons;\n utils: {\n randomSecretKey: (seed?: Uint8Array) => Uint8Array;\n isValidSecretKey: (secretKey: Uint8Array) => boolean;\n isValidPublicKey: (publicKey: Uint8Array, zip215?: boolean) => boolean;\n\n /**\n * Converts ed public key to x public key.\n *\n * There is NO `fromMontgomery`:\n * - There are 2 valid ed25519 points for every x25519, with flipped coordinate\n * - Sometimes there are 0 valid ed25519 points, because x25519 *additionally*\n * accepts inputs on the quadratic twist, which can't be moved to ed25519\n *\n * @example\n * ```js\n * const someonesPub = ed25519.getPublicKey(ed25519.utils.randomSecretKey());\n * const aPriv = x25519.utils.randomSecretKey();\n * x25519.getSharedSecret(aPriv, ed25519.utils.toMontgomery(someonesPub))\n * ```\n */\n toMontgomery: (publicKey: Uint8Array) => Uint8Array;\n /**\n * Converts ed secret key to x secret key.\n * @example\n * ```js\n * const someonesPub = x25519.getPublicKey(x25519.utils.randomSecretKey());\n * const aPriv = ed25519.utils.randomSecretKey();\n * x25519.getSharedSecret(ed25519.utils.toMontgomerySecret(aPriv), someonesPub)\n * ```\n */\n toMontgomerySecret: (privateKey: Uint8Array) => Uint8Array;\n getExtendedPublicKey: (key: Hex) => {\n head: Uint8Array;\n prefix: Uint8Array;\n scalar: bigint;\n point: EdwardsPoint;\n pointBytes: Uint8Array;\n };\n\n /** @deprecated use `randomSecretKey` */\n randomPrivateKey: (seed?: Uint8Array) => Uint8Array;\n /** @deprecated use `point.precompute()` */\n precompute: (windowSize?: number, point?: EdwardsPoint) => EdwardsPoint;\n };\n lengths: CurveLengths;\n}\n\nfunction isEdValidXY(Fp: IField, CURVE: EdwardsOpts, x: bigint, y: bigint): boolean {\n const x2 = Fp.sqr(x);\n const y2 = Fp.sqr(y);\n const left = Fp.add(Fp.mul(CURVE.a, x2), y2);\n const right = Fp.add(Fp.ONE, Fp.mul(CURVE.d, Fp.mul(x2, y2)));\n return Fp.eql(left, right);\n}\n\nexport function edwards(params: EdwardsOpts, extraOpts: EdwardsExtraOpts = {}): EdwardsPointCons {\n const validated = _createCurveFields('edwards', params, extraOpts, extraOpts.FpFnLE);\n const { Fp, Fn } = validated;\n let CURVE = validated.CURVE as EdwardsOpts;\n const { h: cofactor } = CURVE;\n _validateObject(extraOpts, {}, { uvRatio: 'function' });\n\n // Important:\n // There are some places where Fp.BYTES is used instead of nByteLength.\n // So far, everything has been tested with curves of Fp.BYTES == nByteLength.\n // TODO: test and find curves which behave otherwise.\n const MASK = _2n << (BigInt(Fn.BYTES * 8) - _1n);\n const modP = (n: bigint) => Fp.create(n); // Function overrides\n\n // sqrt(u/v)\n const uvRatio =\n extraOpts.uvRatio ||\n ((u: bigint, v: bigint) => {\n try {\n return { isValid: true, value: Fp.sqrt(Fp.div(u, v)) };\n } catch (e) {\n return { isValid: false, value: _0n };\n }\n });\n\n // Validate whether the passed curve params are valid.\n // equation ax² + y² = 1 + dx²y² should work for generator point.\n if (!isEdValidXY(Fp, CURVE, CURVE.Gx, CURVE.Gy))\n throw new Error('bad curve params: generator point');\n\n /**\n * Asserts coordinate is valid: 0 <= n < MASK.\n * Coordinates >= Fp.ORDER are allowed for zip215.\n */\n function acoord(title: string, n: bigint, banZero = false) {\n const min = banZero ? _1n : _0n;\n aInRange('coordinate ' + title, n, min, MASK);\n return n;\n }\n\n function aextpoint(other: unknown) {\n if (!(other instanceof Point)) throw new Error('ExtendedPoint expected');\n }\n // Converts Extended point to default (x, y) coordinates.\n // Can accept precomputed Z^-1 - for example, from invertBatch.\n const toAffineMemo = memoized((p: Point, iz?: bigint): AffinePoint => {\n const { X, Y, Z } = p;\n const is0 = p.is0();\n if (iz == null) iz = is0 ? _8n : (Fp.inv(Z) as bigint); // 8 was chosen arbitrarily\n const x = modP(X * iz);\n const y = modP(Y * iz);\n const zz = Fp.mul(Z, iz);\n if (is0) return { x: _0n, y: _1n };\n if (zz !== _1n) throw new Error('invZ was invalid');\n return { x, y };\n });\n const assertValidMemo = memoized((p: Point) => {\n const { a, d } = CURVE;\n if (p.is0()) throw new Error('bad point: ZERO'); // TODO: optimize, with vars below?\n // Equation in affine coordinates: ax² + y² = 1 + dx²y²\n // Equation in projective coordinates (X/Z, Y/Z, Z): (aX² + Y²)Z² = Z⁴ + dX²Y²\n const { X, Y, Z, T } = p;\n const X2 = modP(X * X); // X²\n const Y2 = modP(Y * Y); // Y²\n const Z2 = modP(Z * Z); // Z²\n const Z4 = modP(Z2 * Z2); // Z⁴\n const aX2 = modP(X2 * a); // aX²\n const left = modP(Z2 * modP(aX2 + Y2)); // (aX² + Y²)Z²\n const right = modP(Z4 + modP(d * modP(X2 * Y2))); // Z⁴ + dX²Y²\n if (left !== right) throw new Error('bad point: equation left != right (1)');\n // In Extended coordinates we also have T, which is x*y=T/Z: check X*Y == Z*T\n const XY = modP(X * Y);\n const ZT = modP(Z * T);\n if (XY !== ZT) throw new Error('bad point: equation left != right (2)');\n return true;\n });\n\n // Extended Point works in extended coordinates: (X, Y, Z, T) ∋ (x=X/Z, y=Y/Z, T=xy).\n // https://en.wikipedia.org/wiki/Twisted_Edwards_curve#Extended_coordinates\n class Point implements EdwardsPoint {\n // base / generator point\n static readonly BASE = new Point(CURVE.Gx, CURVE.Gy, _1n, modP(CURVE.Gx * CURVE.Gy));\n // zero / infinity / identity point\n static readonly ZERO = new Point(_0n, _1n, _1n, _0n); // 0, 1, 1, 0\n // math field\n static readonly Fp = Fp;\n // scalar field\n static readonly Fn = Fn;\n\n readonly X: bigint;\n readonly Y: bigint;\n readonly Z: bigint;\n readonly T: bigint;\n\n constructor(X: bigint, Y: bigint, Z: bigint, T: bigint) {\n this.X = acoord('x', X);\n this.Y = acoord('y', Y);\n this.Z = acoord('z', Z, true);\n this.T = acoord('t', T);\n Object.freeze(this);\n }\n\n static CURVE(): EdwardsOpts {\n return CURVE;\n }\n\n static fromAffine(p: AffinePoint): Point {\n if (p instanceof Point) throw new Error('extended point not allowed');\n const { x, y } = p || {};\n acoord('x', x);\n acoord('y', y);\n return new Point(x, y, _1n, modP(x * y));\n }\n\n // Uses algo from RFC8032 5.1.3.\n static fromBytes(bytes: Uint8Array, zip215 = false): Point {\n const len = Fp.BYTES;\n const { a, d } = CURVE;\n bytes = copyBytes(abytes(bytes, len, 'point'));\n abool(zip215, 'zip215');\n const normed = copyBytes(bytes); // copy again, we'll manipulate it\n const lastByte = bytes[len - 1]; // select last byte\n normed[len - 1] = lastByte & ~0x80; // clear last bit\n const y = bytesToNumberLE(normed);\n\n // zip215=true is good for consensus-critical apps. =false follows RFC8032 / NIST186-5.\n // RFC8032 prohibits >= p, but ZIP215 doesn't\n // zip215=true: 0 <= y < MASK (2^256 for ed25519)\n // zip215=false: 0 <= y < P (2^255-19 for ed25519)\n const max = zip215 ? MASK : Fp.ORDER;\n aInRange('point.y', y, _0n, max);\n\n // Ed25519: x² = (y²-1)/(dy²+1) mod p. Ed448: x² = (y²-1)/(dy²-1) mod p. Generic case:\n // ax²+y²=1+dx²y² => y²-1=dx²y²-ax² => y²-1=x²(dy²-a) => x²=(y²-1)/(dy²-a)\n const y2 = modP(y * y); // denominator is always non-0 mod p.\n const u = modP(y2 - _1n); // u = y² - 1\n const v = modP(d * y2 - a); // v = d y² + 1.\n let { isValid, value: x } = uvRatio(u, v); // √(u/v)\n if (!isValid) throw new Error('bad point: invalid y coordinate');\n const isXOdd = (x & _1n) === _1n; // There are 2 square roots. Use x_0 bit to select proper\n const isLastByteOdd = (lastByte & 0x80) !== 0; // x_0, last bit\n if (!zip215 && x === _0n && isLastByteOdd)\n // if x=0 and x_0 = 1, fail\n throw new Error('bad point: x=0 and x_0=1');\n if (isLastByteOdd !== isXOdd) x = modP(-x); // if x_0 != x mod 2, set x = p-x\n return Point.fromAffine({ x, y });\n }\n static fromHex(bytes: Uint8Array, zip215 = false): Point {\n return Point.fromBytes(ensureBytes('point', bytes), zip215);\n }\n\n get x(): bigint {\n return this.toAffine().x;\n }\n get y(): bigint {\n return this.toAffine().y;\n }\n\n precompute(windowSize: number = 8, isLazy = true) {\n wnaf.createCache(this, windowSize);\n if (!isLazy) this.multiply(_2n); // random number\n return this;\n }\n\n // Useful in fromAffine() - not for fromBytes(), which always created valid points.\n assertValidity(): void {\n assertValidMemo(this);\n }\n\n // Compare one point to another.\n equals(other: Point): boolean {\n aextpoint(other);\n const { X: X1, Y: Y1, Z: Z1 } = this;\n const { X: X2, Y: Y2, Z: Z2 } = other;\n const X1Z2 = modP(X1 * Z2);\n const X2Z1 = modP(X2 * Z1);\n const Y1Z2 = modP(Y1 * Z2);\n const Y2Z1 = modP(Y2 * Z1);\n return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;\n }\n\n is0(): boolean {\n return this.equals(Point.ZERO);\n }\n\n negate(): Point {\n // Flips point sign to a negative one (-x, y in affine coords)\n return new Point(modP(-this.X), this.Y, this.Z, modP(-this.T));\n }\n\n // Fast algo for doubling Extended Point.\n // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd\n // Cost: 4M + 4S + 1*a + 6add + 1*2.\n double(): Point {\n const { a } = CURVE;\n const { X: X1, Y: Y1, Z: Z1 } = this;\n const A = modP(X1 * X1); // A = X12\n const B = modP(Y1 * Y1); // B = Y12\n const C = modP(_2n * modP(Z1 * Z1)); // C = 2*Z12\n const D = modP(a * A); // D = a*A\n const x1y1 = X1 + Y1;\n const E = modP(modP(x1y1 * x1y1) - A - B); // E = (X1+Y1)2-A-B\n const G = D + B; // G = D+B\n const F = G - C; // F = G-C\n const H = D - B; // H = D-B\n const X3 = modP(E * F); // X3 = E*F\n const Y3 = modP(G * H); // Y3 = G*H\n const T3 = modP(E * H); // T3 = E*H\n const Z3 = modP(F * G); // Z3 = F*G\n return new Point(X3, Y3, Z3, T3);\n }\n\n // Fast algo for adding 2 Extended Points.\n // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd\n // Cost: 9M + 1*a + 1*d + 7add.\n add(other: Point) {\n aextpoint(other);\n const { a, d } = CURVE;\n const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;\n const { X: X2, Y: Y2, Z: Z2, T: T2 } = other;\n const A = modP(X1 * X2); // A = X1*X2\n const B = modP(Y1 * Y2); // B = Y1*Y2\n const C = modP(T1 * d * T2); // C = T1*d*T2\n const D = modP(Z1 * Z2); // D = Z1*Z2\n const E = modP((X1 + Y1) * (X2 + Y2) - A - B); // E = (X1+Y1)*(X2+Y2)-A-B\n const F = D - C; // F = D-C\n const G = D + C; // G = D+C\n const H = modP(B - a * A); // H = B-a*A\n const X3 = modP(E * F); // X3 = E*F\n const Y3 = modP(G * H); // Y3 = G*H\n const T3 = modP(E * H); // T3 = E*H\n const Z3 = modP(F * G); // Z3 = F*G\n return new Point(X3, Y3, Z3, T3);\n }\n\n subtract(other: Point): Point {\n return this.add(other.negate());\n }\n\n // Constant-time multiplication.\n multiply(scalar: bigint): Point {\n // 1 <= scalar < L\n if (!Fn.isValidNot0(scalar)) throw new Error('invalid scalar: expected 1 <= sc < curve.n');\n const { p, f } = wnaf.cached(this, scalar, (p) => normalizeZ(Point, p));\n return normalizeZ(Point, [p, f])[0];\n }\n\n // Non-constant-time multiplication. Uses double-and-add algorithm.\n // It's faster, but should only be used when you don't care about\n // an exposed private key e.g. sig verification.\n // Does NOT allow scalars higher than CURVE.n.\n // Accepts optional accumulator to merge with multiply (important for sparse scalars)\n multiplyUnsafe(scalar: bigint, acc = Point.ZERO): Point {\n // 0 <= scalar < L\n if (!Fn.isValid(scalar)) throw new Error('invalid scalar: expected 0 <= sc < curve.n');\n if (scalar === _0n) return Point.ZERO;\n if (this.is0() || scalar === _1n) return this;\n return wnaf.unsafe(this, scalar, (p) => normalizeZ(Point, p), acc);\n }\n\n // Checks if point is of small order.\n // If you add something to small order point, you will have \"dirty\"\n // point with torsion component.\n // Multiplies point by cofactor and checks if the result is 0.\n isSmallOrder(): boolean {\n return this.multiplyUnsafe(cofactor).is0();\n }\n\n // Multiplies point by curve order and checks if the result is 0.\n // Returns `false` is the point is dirty.\n isTorsionFree(): boolean {\n return wnaf.unsafe(this, CURVE.n).is0();\n }\n\n // Converts Extended point to default (x, y) coordinates.\n // Can accept precomputed Z^-1 - for example, from invertBatch.\n toAffine(invertedZ?: bigint): AffinePoint {\n return toAffineMemo(this, invertedZ);\n }\n\n clearCofactor(): Point {\n if (cofactor === _1n) return this;\n return this.multiplyUnsafe(cofactor);\n }\n\n toBytes(): Uint8Array {\n const { x, y } = this.toAffine();\n // Fp.toBytes() allows non-canonical encoding of y (>= p).\n const bytes = Fp.toBytes(y);\n // Each y has 2 valid points: (x, y), (x,-y).\n // When compressing, it's enough to store y and use the last byte to encode sign of x\n bytes[bytes.length - 1] |= x & _1n ? 0x80 : 0;\n return bytes;\n }\n toHex(): string {\n return bytesToHex(this.toBytes());\n }\n\n toString() {\n return ``;\n }\n\n // TODO: remove\n get ex(): bigint {\n return this.X;\n }\n get ey(): bigint {\n return this.Y;\n }\n get ez(): bigint {\n return this.Z;\n }\n get et(): bigint {\n return this.T;\n }\n static normalizeZ(points: Point[]): Point[] {\n return normalizeZ(Point, points);\n }\n static msm(points: Point[], scalars: bigint[]): Point {\n return pippenger(Point, Fn, points, scalars);\n }\n _setWindowSize(windowSize: number) {\n this.precompute(windowSize);\n }\n toRawBytes(): Uint8Array {\n return this.toBytes();\n }\n }\n const wnaf = new wNAF(Point, Fn.BITS);\n Point.BASE.precompute(8); // Enable precomputes. Slows down first publicKey computation by 20ms.\n return Point;\n}\n\n/**\n * Base class for prime-order points like Ristretto255 and Decaf448.\n * These points eliminate cofactor issues by representing equivalence classes\n * of Edwards curve points.\n */\nexport abstract class PrimeEdwardsPoint>\n implements CurvePoint\n{\n static BASE: PrimeEdwardsPoint;\n static ZERO: PrimeEdwardsPoint;\n static Fp: IField;\n static Fn: IField;\n\n protected readonly ep: EdwardsPoint;\n\n constructor(ep: EdwardsPoint) {\n this.ep = ep;\n }\n\n // Abstract methods that must be implemented by subclasses\n abstract toBytes(): Uint8Array;\n abstract equals(other: T): boolean;\n\n // Static methods that must be implemented by subclasses\n static fromBytes(_bytes: Uint8Array): any {\n notImplemented();\n }\n\n static fromHex(_hex: Hex): any {\n notImplemented();\n }\n\n get x(): bigint {\n return this.toAffine().x;\n }\n get y(): bigint {\n return this.toAffine().y;\n }\n\n // Common implementations\n clearCofactor(): T {\n // no-op for prime-order groups\n return this as any;\n }\n\n assertValidity(): void {\n this.ep.assertValidity();\n }\n\n toAffine(invertedZ?: bigint): AffinePoint {\n return this.ep.toAffine(invertedZ);\n }\n\n toHex(): string {\n return bytesToHex(this.toBytes());\n }\n\n toString(): string {\n return this.toHex();\n }\n\n isTorsionFree(): boolean {\n return true;\n }\n\n isSmallOrder(): boolean {\n return false;\n }\n\n add(other: T): T {\n this.assertSame(other);\n return this.init(this.ep.add(other.ep));\n }\n\n subtract(other: T): T {\n this.assertSame(other);\n return this.init(this.ep.subtract(other.ep));\n }\n\n multiply(scalar: bigint): T {\n return this.init(this.ep.multiply(scalar));\n }\n\n multiplyUnsafe(scalar: bigint): T {\n return this.init(this.ep.multiplyUnsafe(scalar));\n }\n\n double(): T {\n return this.init(this.ep.double());\n }\n\n negate(): T {\n return this.init(this.ep.negate());\n }\n\n precompute(windowSize?: number, isLazy?: boolean): T {\n return this.init(this.ep.precompute(windowSize, isLazy));\n }\n\n // Helper methods\n abstract is0(): boolean;\n protected abstract assertSame(other: T): void;\n protected abstract init(ep: EdwardsPoint): T;\n\n /** @deprecated use `toBytes` */\n toRawBytes(): Uint8Array {\n return this.toBytes();\n }\n}\n\n/**\n * Initializes EdDSA signatures over given Edwards curve.\n */\nexport function eddsa(Point: EdwardsPointCons, cHash: FHash, eddsaOpts: EdDSAOpts = {}): EdDSA {\n if (typeof cHash !== 'function') throw new Error('\"hash\" function param is required');\n _validateObject(\n eddsaOpts,\n {},\n {\n adjustScalarBytes: 'function',\n randomBytes: 'function',\n domain: 'function',\n prehash: 'function',\n mapToCurve: 'function',\n }\n );\n\n const { prehash } = eddsaOpts;\n const { BASE, Fp, Fn } = Point;\n\n const randomBytes = eddsaOpts.randomBytes || randomBytesWeb;\n const adjustScalarBytes = eddsaOpts.adjustScalarBytes || ((bytes: Uint8Array) => bytes);\n const domain =\n eddsaOpts.domain ||\n ((data: Uint8Array, ctx: Uint8Array, phflag: boolean) => {\n abool(phflag, 'phflag');\n if (ctx.length || phflag) throw new Error('Contexts/pre-hash are not supported');\n return data;\n }); // NOOP\n\n // Little-endian SHA512 with modulo n\n function modN_LE(hash: Uint8Array): bigint {\n return Fn.create(bytesToNumberLE(hash)); // Not Fn.fromBytes: it has length limit\n }\n\n // Get the hashed private scalar per RFC8032 5.1.5\n function getPrivateScalar(key: Hex) {\n const len = lengths.secretKey;\n key = ensureBytes('private key', key, len);\n // Hash private key with curve's hash function to produce uniformingly random input\n // Check byte lengths: ensure(64, h(ensure(32, key)))\n const hashed = ensureBytes('hashed private key', cHash(key), 2 * len);\n const head = adjustScalarBytes(hashed.slice(0, len)); // clear first half bits, produce FE\n const prefix = hashed.slice(len, 2 * len); // second half is called key prefix (5.1.6)\n const scalar = modN_LE(head); // The actual private scalar\n return { head, prefix, scalar };\n }\n\n /** Convenience method that creates public key from scalar. RFC8032 5.1.5 */\n function getExtendedPublicKey(secretKey: Hex) {\n const { head, prefix, scalar } = getPrivateScalar(secretKey);\n const point = BASE.multiply(scalar); // Point on Edwards curve aka public key\n const pointBytes = point.toBytes();\n return { head, prefix, scalar, point, pointBytes };\n }\n\n /** Calculates EdDSA pub key. RFC8032 5.1.5. */\n function getPublicKey(secretKey: Hex): Uint8Array {\n return getExtendedPublicKey(secretKey).pointBytes;\n }\n\n // int('LE', SHA512(dom2(F, C) || msgs)) mod N\n function hashDomainToScalar(context: Hex = Uint8Array.of(), ...msgs: Uint8Array[]) {\n const msg = concatBytes(...msgs);\n return modN_LE(cHash(domain(msg, ensureBytes('context', context), !!prehash)));\n }\n\n /** Signs message with privateKey. RFC8032 5.1.6 */\n function sign(msg: Hex, secretKey: Hex, options: { context?: Hex } = {}): Uint8Array {\n msg = ensureBytes('message', msg);\n if (prehash) msg = prehash(msg); // for ed25519ph etc.\n const { prefix, scalar, pointBytes } = getExtendedPublicKey(secretKey);\n const r = hashDomainToScalar(options.context, prefix, msg); // r = dom2(F, C) || prefix || PH(M)\n const R = BASE.multiply(r).toBytes(); // R = rG\n const k = hashDomainToScalar(options.context, R, pointBytes, msg); // R || A || PH(M)\n const s = Fn.create(r + k * scalar); // S = (r + k * s) mod L\n if (!Fn.isValid(s)) throw new Error('sign failed: invalid s'); // 0 <= s < L\n const rs = concatBytes(R, Fn.toBytes(s));\n return abytes(rs, lengths.signature, 'result');\n }\n\n // verification rule is either zip215 or rfc8032 / nist186-5. Consult fromHex:\n const verifyOpts: { context?: Hex; zip215?: boolean } = { zip215: true };\n\n /**\n * Verifies EdDSA signature against message and public key. RFC8032 5.1.7.\n * An extended group equation is checked.\n */\n function verify(sig: Hex, msg: Hex, publicKey: Hex, options = verifyOpts): boolean {\n const { context, zip215 } = options;\n const len = lengths.signature;\n sig = ensureBytes('signature', sig, len);\n msg = ensureBytes('message', msg);\n publicKey = ensureBytes('publicKey', publicKey, lengths.publicKey);\n if (zip215 !== undefined) abool(zip215, 'zip215');\n if (prehash) msg = prehash(msg); // for ed25519ph, etc\n\n const mid = len / 2;\n const r = sig.subarray(0, mid);\n const s = bytesToNumberLE(sig.subarray(mid, len));\n let A, R, SB;\n try {\n // zip215=true is good for consensus-critical apps. =false follows RFC8032 / NIST186-5.\n // zip215=true: 0 <= y < MASK (2^256 for ed25519)\n // zip215=false: 0 <= y < P (2^255-19 for ed25519)\n A = Point.fromBytes(publicKey, zip215);\n R = Point.fromBytes(r, zip215);\n SB = BASE.multiplyUnsafe(s); // 0 <= s < l is done inside\n } catch (error) {\n return false;\n }\n if (!zip215 && A.isSmallOrder()) return false; // zip215 allows public keys of small order\n\n const k = hashDomainToScalar(context, R.toBytes(), A.toBytes(), msg);\n const RkA = R.add(A.multiplyUnsafe(k));\n // Extended group equation\n // [8][S]B = [8]R + [8][k]A'\n return RkA.subtract(SB).clearCofactor().is0();\n }\n\n const _size = Fp.BYTES; // 32 for ed25519, 57 for ed448\n const lengths = {\n secretKey: _size,\n publicKey: _size,\n signature: 2 * _size,\n seed: _size,\n };\n function randomSecretKey(seed = randomBytes(lengths.seed)): Uint8Array {\n return abytes(seed, lengths.seed, 'seed');\n }\n function keygen(seed?: Uint8Array) {\n const secretKey = utils.randomSecretKey(seed);\n return { secretKey, publicKey: getPublicKey(secretKey) };\n }\n function isValidSecretKey(key: Uint8Array): boolean {\n return isBytes(key) && key.length === Fn.BYTES;\n }\n function isValidPublicKey(key: Uint8Array, zip215?: boolean): boolean {\n try {\n return !!Point.fromBytes(key, zip215);\n } catch (error) {\n return false;\n }\n }\n\n const utils = {\n getExtendedPublicKey,\n randomSecretKey,\n isValidSecretKey,\n isValidPublicKey,\n /**\n * Converts ed public key to x public key. Uses formula:\n * - ed25519:\n * - `(u, v) = ((1+y)/(1-y), sqrt(-486664)*u/x)`\n * - `(x, y) = (sqrt(-486664)*u/v, (u-1)/(u+1))`\n * - ed448:\n * - `(u, v) = ((y-1)/(y+1), sqrt(156324)*u/x)`\n * - `(x, y) = (sqrt(156324)*u/v, (1+u)/(1-u))`\n */\n toMontgomery(publicKey: Uint8Array): Uint8Array {\n const { y } = Point.fromBytes(publicKey);\n const size = lengths.publicKey;\n const is25519 = size === 32;\n if (!is25519 && size !== 57) throw new Error('only defined for 25519 and 448');\n const u = is25519 ? Fp.div(_1n + y, _1n - y) : Fp.div(y - _1n, y + _1n);\n return Fp.toBytes(u);\n },\n\n toMontgomerySecret(secretKey: Uint8Array): Uint8Array {\n const size = lengths.secretKey;\n abytes(secretKey, size);\n const hashed = cHash(secretKey.subarray(0, size));\n return adjustScalarBytes(hashed).subarray(0, size);\n },\n\n /** @deprecated */\n randomPrivateKey: randomSecretKey,\n /** @deprecated */\n precompute(windowSize = 8, point: EdwardsPoint = Point.BASE): EdwardsPoint {\n return point.precompute(windowSize, false);\n },\n };\n\n return Object.freeze({\n keygen,\n getPublicKey,\n sign,\n verify,\n utils,\n Point,\n lengths,\n });\n}\n\n// TODO: remove everything below\nexport type CurveType = BasicCurve & {\n a: bigint; // curve param a\n d: bigint; // curve param d\n /** @deprecated the property will be removed in next release */\n hash: FHash; // Hashing\n randomBytes?: (bytesLength?: number) => Uint8Array; // CSPRNG\n adjustScalarBytes?: (bytes: Uint8Array) => Uint8Array; // clears bits to get valid field elemtn\n domain?: (data: Uint8Array, ctx: Uint8Array, phflag: boolean) => Uint8Array; // Used for hashing\n uvRatio?: UVRatio; // Ratio √(u/v)\n prehash?: FHash; // RFC 8032 pre-hashing of messages to sign() / verify()\n mapToCurve?: (scalar: bigint[]) => AffinePoint; // for hash-to-curve standard\n};\nexport type CurveTypeWithLength = Readonly>;\nexport type CurveFn = {\n /** @deprecated the property will be removed in next release */\n CURVE: CurveType;\n keygen: EdDSA['keygen'];\n getPublicKey: EdDSA['getPublicKey'];\n sign: EdDSA['sign'];\n verify: EdDSA['verify'];\n Point: EdwardsPointCons;\n /** @deprecated use `Point` */\n ExtendedPoint: EdwardsPointCons;\n utils: EdDSA['utils'];\n lengths: CurveLengths;\n};\nexport type EdComposed = {\n CURVE: EdwardsOpts;\n curveOpts: EdwardsExtraOpts;\n hash: FHash;\n eddsaOpts: EdDSAOpts;\n};\nfunction _eddsa_legacy_opts_to_new(c: CurveTypeWithLength): EdComposed {\n const CURVE: EdwardsOpts = {\n a: c.a,\n d: c.d,\n p: c.Fp.ORDER,\n n: c.n,\n h: c.h,\n Gx: c.Gx,\n Gy: c.Gy,\n };\n const Fp = c.Fp;\n const Fn = Field(CURVE.n, c.nBitLength, true);\n const curveOpts: EdwardsExtraOpts = { Fp, Fn, uvRatio: c.uvRatio };\n const eddsaOpts: EdDSAOpts = {\n randomBytes: c.randomBytes,\n adjustScalarBytes: c.adjustScalarBytes,\n domain: c.domain,\n prehash: c.prehash,\n mapToCurve: c.mapToCurve,\n };\n return { CURVE, curveOpts, hash: c.hash, eddsaOpts };\n}\nfunction _eddsa_new_output_to_legacy(c: CurveTypeWithLength, eddsa: EdDSA): CurveFn {\n const Point = eddsa.Point;\n const legacy = Object.assign({}, eddsa, {\n ExtendedPoint: Point,\n CURVE: c,\n nBitLength: Point.Fn.BITS,\n nByteLength: Point.Fn.BYTES,\n });\n return legacy;\n}\n// TODO: remove. Use eddsa\nexport function twistedEdwards(c: CurveTypeWithLength): CurveFn {\n const { CURVE, curveOpts, hash, eddsaOpts } = _eddsa_legacy_opts_to_new(c);\n const Point = edwards(CURVE, curveOpts);\n const EDDSA = eddsa(Point, hash, eddsaOpts);\n return _eddsa_new_output_to_legacy(c, EDDSA);\n}\n","/**\n * ed25519 Twisted Edwards curve with following addons:\n * - X25519 ECDH\n * - Ristretto cofactor elimination\n * - Elligator hash-to-group / point indistinguishability\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha512 } from '@noble/hashes/sha2.js';\nimport { abytes, concatBytes, utf8ToBytes } from '@noble/hashes/utils.js';\nimport { pippenger, type AffinePoint } from './abstract/curve.ts';\nimport {\n PrimeEdwardsPoint,\n twistedEdwards,\n type CurveFn,\n type EdwardsOpts,\n type EdwardsPoint,\n} from './abstract/edwards.ts';\nimport {\n _DST_scalar,\n createHasher,\n expand_message_xmd,\n type H2CHasher,\n type H2CHasherBase,\n type H2CMethod,\n type htfBasicOpts,\n} from './abstract/hash-to-curve.ts';\nimport {\n Field,\n FpInvertBatch,\n FpSqrtEven,\n isNegativeLE,\n mod,\n pow2,\n type IField,\n} from './abstract/modular.ts';\nimport { montgomery, type MontgomeryECDH as XCurveFn } from './abstract/montgomery.ts';\nimport { bytesToNumberLE, ensureBytes, equalBytes, type Hex } from './utils.ts';\n\n// prettier-ignore\nconst _0n = /* @__PURE__ */ BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3);\n// prettier-ignore\nconst _5n = BigInt(5), _8n = BigInt(8);\n\n// P = 2n**255n-19n\nconst ed25519_CURVE_p = BigInt(\n '0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed'\n);\n\n// N = 2n**252n + 27742317777372353535851937790883648493n\n// a = Fp.create(BigInt(-1))\n// d = -121665/121666 a.k.a. Fp.neg(121665 * Fp.inv(121666))\nconst ed25519_CURVE: EdwardsOpts = /* @__PURE__ */ (() => ({\n p: ed25519_CURVE_p,\n n: BigInt('0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed'),\n h: _8n,\n a: BigInt('0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec'),\n d: BigInt('0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3'),\n Gx: BigInt('0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a'),\n Gy: BigInt('0x6666666666666666666666666666666666666666666666666666666666666658'),\n}))();\n\nfunction ed25519_pow_2_252_3(x: bigint) {\n // prettier-ignore\n const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);\n const P = ed25519_CURVE_p;\n const x2 = (x * x) % P;\n const b2 = (x2 * x) % P; // x^3, 11\n const b4 = (pow2(b2, _2n, P) * b2) % P; // x^15, 1111\n const b5 = (pow2(b4, _1n, P) * x) % P; // x^31\n const b10 = (pow2(b5, _5n, P) * b5) % P;\n const b20 = (pow2(b10, _10n, P) * b10) % P;\n const b40 = (pow2(b20, _20n, P) * b20) % P;\n const b80 = (pow2(b40, _40n, P) * b40) % P;\n const b160 = (pow2(b80, _80n, P) * b80) % P;\n const b240 = (pow2(b160, _80n, P) * b80) % P;\n const b250 = (pow2(b240, _10n, P) * b10) % P;\n const pow_p_5_8 = (pow2(b250, _2n, P) * x) % P;\n // ^ To pow to (p+3)/8, multiply it by x.\n return { pow_p_5_8, b2 };\n}\n\nfunction adjustScalarBytes(bytes: Uint8Array): Uint8Array {\n // Section 5: For X25519, in order to decode 32 random bytes as an integer scalar,\n // set the three least significant bits of the first byte\n bytes[0] &= 248; // 0b1111_1000\n // and the most significant bit of the last to zero,\n bytes[31] &= 127; // 0b0111_1111\n // set the second most significant bit of the last byte to 1\n bytes[31] |= 64; // 0b0100_0000\n return bytes;\n}\n\n// √(-1) aka √(a) aka 2^((p-1)/4)\n// Fp.sqrt(Fp.neg(1))\nconst ED25519_SQRT_M1 = /* @__PURE__ */ BigInt(\n '19681161376707505956807079304988542015446066515923890162744021073123829784752'\n);\n// sqrt(u/v)\nfunction uvRatio(u: bigint, v: bigint): { isValid: boolean; value: bigint } {\n const P = ed25519_CURVE_p;\n const v3 = mod(v * v * v, P); // v³\n const v7 = mod(v3 * v3 * v, P); // v⁷\n // (p+3)/8 and (p-5)/8\n const pow = ed25519_pow_2_252_3(u * v7).pow_p_5_8;\n let x = mod(u * v3 * pow, P); // (uv³)(uv⁷)^(p-5)/8\n const vx2 = mod(v * x * x, P); // vx²\n const root1 = x; // First root candidate\n const root2 = mod(x * ED25519_SQRT_M1, P); // Second root candidate\n const useRoot1 = vx2 === u; // If vx² = u (mod p), x is a square root\n const useRoot2 = vx2 === mod(-u, P); // If vx² = -u, set x <-- x * 2^((p-1)/4)\n const noRoot = vx2 === mod(-u * ED25519_SQRT_M1, P); // There is no valid root, vx² = -u√(-1)\n if (useRoot1) x = root1;\n if (useRoot2 || noRoot) x = root2; // We return root2 anyway, for const-time\n if (isNegativeLE(x, P)) x = mod(-x, P);\n return { isValid: useRoot1 || useRoot2, value: x };\n}\n\nconst Fp = /* @__PURE__ */ (() => Field(ed25519_CURVE.p, { isLE: true }))();\nconst Fn = /* @__PURE__ */ (() => Field(ed25519_CURVE.n, { isLE: true }))();\n\nconst ed25519Defaults = /* @__PURE__ */ (() => ({\n ...ed25519_CURVE,\n Fp,\n hash: sha512,\n adjustScalarBytes,\n // dom2\n // Ratio of u to v. Allows us to combine inversion and square root. Uses algo from RFC8032 5.1.3.\n // Constant-time, u/√v\n uvRatio,\n}))();\n\n/**\n * ed25519 curve with EdDSA signatures.\n * @example\n * import { ed25519 } from '@noble/curves/ed25519';\n * const { secretKey, publicKey } = ed25519.keygen();\n * const msg = new TextEncoder().encode('hello');\n * const sig = ed25519.sign(msg, priv);\n * ed25519.verify(sig, msg, pub); // Default mode: follows ZIP215\n * ed25519.verify(sig, msg, pub, { zip215: false }); // RFC8032 / FIPS 186-5\n */\nexport const ed25519: CurveFn = /* @__PURE__ */ (() => twistedEdwards(ed25519Defaults))();\n\nfunction ed25519_domain(data: Uint8Array, ctx: Uint8Array, phflag: boolean) {\n if (ctx.length > 255) throw new Error('Context is too big');\n return concatBytes(\n utf8ToBytes('SigEd25519 no Ed25519 collisions'),\n new Uint8Array([phflag ? 1 : 0, ctx.length]),\n ctx,\n data\n );\n}\n\n/** Context of ed25519. Uses context for domain separation. */\nexport const ed25519ctx: CurveFn = /* @__PURE__ */ (() =>\n twistedEdwards({\n ...ed25519Defaults,\n domain: ed25519_domain,\n }))();\n\n/** Prehashed version of ed25519. Accepts already-hashed messages in sign() and verify(). */\nexport const ed25519ph: CurveFn = /* @__PURE__ */ (() =>\n twistedEdwards(\n Object.assign({}, ed25519Defaults, {\n domain: ed25519_domain,\n prehash: sha512,\n })\n ))();\n\n/**\n * ECDH using curve25519 aka x25519.\n * @example\n * import { x25519 } from '@noble/curves/ed25519';\n * const priv = 'a546e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449ac4';\n * const pub = 'e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c';\n * x25519.getSharedSecret(priv, pub) === x25519.scalarMult(priv, pub); // aliases\n * x25519.getPublicKey(priv) === x25519.scalarMultBase(priv);\n * x25519.getPublicKey(x25519.utils.randomSecretKey());\n */\nexport const x25519: XCurveFn = /* @__PURE__ */ (() => {\n const P = Fp.ORDER;\n return montgomery({\n P,\n type: 'x25519',\n powPminus2: (x: bigint): bigint => {\n // x^(p-2) aka x^(2^255-21)\n const { pow_p_5_8, b2 } = ed25519_pow_2_252_3(x);\n return mod(pow2(pow_p_5_8, _3n, P) * b2, P);\n },\n adjustScalarBytes,\n });\n})();\n\n// Hash To Curve Elligator2 Map (NOTE: different from ristretto255 elligator)\n// NOTE: very important part is usage of FpSqrtEven for ELL2_C1_EDWARDS, since\n// SageMath returns different root first and everything falls apart\nconst ELL2_C1 = /* @__PURE__ */ (() => (ed25519_CURVE_p + _3n) / _8n)(); // 1. c1 = (q + 3) / 8 # Integer arithmetic\nconst ELL2_C2 = /* @__PURE__ */ (() => Fp.pow(_2n, ELL2_C1))(); // 2. c2 = 2^c1\nconst ELL2_C3 = /* @__PURE__ */ (() => Fp.sqrt(Fp.neg(Fp.ONE)))(); // 3. c3 = sqrt(-1)\n\n// prettier-ignore\nfunction map_to_curve_elligator2_curve25519(u: bigint) {\n const ELL2_C4 = (ed25519_CURVE_p - _5n) / _8n; // 4. c4 = (q - 5) / 8 # Integer arithmetic\n const ELL2_J = BigInt(486662);\n\n let tv1 = Fp.sqr(u); // 1. tv1 = u^2\n tv1 = Fp.mul(tv1, _2n); // 2. tv1 = 2 * tv1\n let xd = Fp.add(tv1, Fp.ONE); // 3. xd = tv1 + 1 # Nonzero: -1 is square (mod p), tv1 is not\n let x1n = Fp.neg(ELL2_J); // 4. x1n = -J # x1 = x1n / xd = -J / (1 + 2 * u^2)\n let tv2 = Fp.sqr(xd); // 5. tv2 = xd^2\n let gxd = Fp.mul(tv2, xd); // 6. gxd = tv2 * xd # gxd = xd^3\n let gx1 = Fp.mul(tv1, ELL2_J);// 7. gx1 = J * tv1 # x1n + J * xd\n gx1 = Fp.mul(gx1, x1n); // 8. gx1 = gx1 * x1n # x1n^2 + J * x1n * xd\n gx1 = Fp.add(gx1, tv2); // 9. gx1 = gx1 + tv2 # x1n^2 + J * x1n * xd + xd^2\n gx1 = Fp.mul(gx1, x1n); // 10. gx1 = gx1 * x1n # x1n^3 + J * x1n^2 * xd + x1n * xd^2\n let tv3 = Fp.sqr(gxd); // 11. tv3 = gxd^2\n tv2 = Fp.sqr(tv3); // 12. tv2 = tv3^2 # gxd^4\n tv3 = Fp.mul(tv3, gxd); // 13. tv3 = tv3 * gxd # gxd^3\n tv3 = Fp.mul(tv3, gx1); // 14. tv3 = tv3 * gx1 # gx1 * gxd^3\n tv2 = Fp.mul(tv2, tv3); // 15. tv2 = tv2 * tv3 # gx1 * gxd^7\n let y11 = Fp.pow(tv2, ELL2_C4); // 16. y11 = tv2^c4 # (gx1 * gxd^7)^((p - 5) / 8)\n y11 = Fp.mul(y11, tv3); // 17. y11 = y11 * tv3 # gx1*gxd^3*(gx1*gxd^7)^((p-5)/8)\n let y12 = Fp.mul(y11, ELL2_C3); // 18. y12 = y11 * c3\n tv2 = Fp.sqr(y11); // 19. tv2 = y11^2\n tv2 = Fp.mul(tv2, gxd); // 20. tv2 = tv2 * gxd\n let e1 = Fp.eql(tv2, gx1); // 21. e1 = tv2 == gx1\n let y1 = Fp.cmov(y12, y11, e1); // 22. y1 = CMOV(y12, y11, e1) # If g(x1) is square, this is its sqrt\n let x2n = Fp.mul(x1n, tv1); // 23. x2n = x1n * tv1 # x2 = x2n / xd = 2 * u^2 * x1n / xd\n let y21 = Fp.mul(y11, u); // 24. y21 = y11 * u\n y21 = Fp.mul(y21, ELL2_C2); // 25. y21 = y21 * c2\n let y22 = Fp.mul(y21, ELL2_C3); // 26. y22 = y21 * c3\n let gx2 = Fp.mul(gx1, tv1); // 27. gx2 = gx1 * tv1 # g(x2) = gx2 / gxd = 2 * u^2 * g(x1)\n tv2 = Fp.sqr(y21); // 28. tv2 = y21^2\n tv2 = Fp.mul(tv2, gxd); // 29. tv2 = tv2 * gxd\n let e2 = Fp.eql(tv2, gx2); // 30. e2 = tv2 == gx2\n let y2 = Fp.cmov(y22, y21, e2); // 31. y2 = CMOV(y22, y21, e2) # If g(x2) is square, this is its sqrt\n tv2 = Fp.sqr(y1); // 32. tv2 = y1^2\n tv2 = Fp.mul(tv2, gxd); // 33. tv2 = tv2 * gxd\n let e3 = Fp.eql(tv2, gx1); // 34. e3 = tv2 == gx1\n let xn = Fp.cmov(x2n, x1n, e3); // 35. xn = CMOV(x2n, x1n, e3) # If e3, x = x1, else x = x2\n let y = Fp.cmov(y2, y1, e3); // 36. y = CMOV(y2, y1, e3) # If e3, y = y1, else y = y2\n let e4 = Fp.isOdd!(y); // 37. e4 = sgn0(y) == 1 # Fix sign of y\n y = Fp.cmov(y, Fp.neg(y), e3 !== e4); // 38. y = CMOV(y, -y, e3 XOR e4)\n return { xMn: xn, xMd: xd, yMn: y, yMd: _1n }; // 39. return (xn, xd, y, 1)\n}\n\nconst ELL2_C1_EDWARDS = /* @__PURE__ */ (() => FpSqrtEven(Fp, Fp.neg(BigInt(486664))))(); // sgn0(c1) MUST equal 0\nfunction map_to_curve_elligator2_edwards25519(u: bigint) {\n const { xMn, xMd, yMn, yMd } = map_to_curve_elligator2_curve25519(u); // 1. (xMn, xMd, yMn, yMd) =\n // map_to_curve_elligator2_curve25519(u)\n let xn = Fp.mul(xMn, yMd); // 2. xn = xMn * yMd\n xn = Fp.mul(xn, ELL2_C1_EDWARDS); // 3. xn = xn * c1\n let xd = Fp.mul(xMd, yMn); // 4. xd = xMd * yMn # xn / xd = c1 * xM / yM\n let yn = Fp.sub(xMn, xMd); // 5. yn = xMn - xMd\n let yd = Fp.add(xMn, xMd); // 6. yd = xMn + xMd # (n / d - 1) / (n / d + 1) = (n - d) / (n + d)\n let tv1 = Fp.mul(xd, yd); // 7. tv1 = xd * yd\n let e = Fp.eql(tv1, Fp.ZERO); // 8. e = tv1 == 0\n xn = Fp.cmov(xn, Fp.ZERO, e); // 9. xn = CMOV(xn, 0, e)\n xd = Fp.cmov(xd, Fp.ONE, e); // 10. xd = CMOV(xd, 1, e)\n yn = Fp.cmov(yn, Fp.ONE, e); // 11. yn = CMOV(yn, 1, e)\n yd = Fp.cmov(yd, Fp.ONE, e); // 12. yd = CMOV(yd, 1, e)\n const [xd_inv, yd_inv] = FpInvertBatch(Fp, [xd, yd], true); // batch division\n return { x: Fp.mul(xn, xd_inv), y: Fp.mul(yn, yd_inv) }; // 13. return (xn, xd, yn, yd)\n}\n\n/** Hashing to ed25519 points / field. RFC 9380 methods. */\nexport const ed25519_hasher: H2CHasher = /* @__PURE__ */ (() =>\n createHasher(\n ed25519.Point,\n (scalars: bigint[]) => map_to_curve_elligator2_edwards25519(scalars[0]),\n {\n DST: 'edwards25519_XMD:SHA-512_ELL2_RO_',\n encodeDST: 'edwards25519_XMD:SHA-512_ELL2_NU_',\n p: ed25519_CURVE_p,\n m: 1,\n k: 128,\n expand: 'xmd',\n hash: sha512,\n }\n ))();\n\n// √(-1) aka √(a) aka 2^((p-1)/4)\nconst SQRT_M1 = ED25519_SQRT_M1;\n// √(ad - 1)\nconst SQRT_AD_MINUS_ONE = /* @__PURE__ */ BigInt(\n '25063068953384623474111414158702152701244531502492656460079210482610430750235'\n);\n// 1 / √(a-d)\nconst INVSQRT_A_MINUS_D = /* @__PURE__ */ BigInt(\n '54469307008909316920995813868745141605393597292927456921205312896311721017578'\n);\n// 1-d²\nconst ONE_MINUS_D_SQ = /* @__PURE__ */ BigInt(\n '1159843021668779879193775521855586647937357759715417654439879720876111806838'\n);\n// (d-1)²\nconst D_MINUS_ONE_SQ = /* @__PURE__ */ BigInt(\n '40440834346308536858101042469323190826248399146238708352240133220865137265952'\n);\n// Calculates 1/√(number)\nconst invertSqrt = (number: bigint) => uvRatio(_1n, number);\n\nconst MAX_255B = /* @__PURE__ */ BigInt(\n '0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'\n);\nconst bytes255ToNumberLE = (bytes: Uint8Array) =>\n ed25519.Point.Fp.create(bytesToNumberLE(bytes) & MAX_255B);\n\ntype ExtendedPoint = EdwardsPoint;\n\n/**\n * Computes Elligator map for Ristretto255.\n * Described in [RFC9380](https://www.rfc-editor.org/rfc/rfc9380#appendix-B) and on\n * the [website](https://ristretto.group/formulas/elligator.html).\n */\nfunction calcElligatorRistrettoMap(r0: bigint): ExtendedPoint {\n const { d } = ed25519_CURVE;\n const P = ed25519_CURVE_p;\n const mod = (n: bigint) => Fp.create(n);\n const r = mod(SQRT_M1 * r0 * r0); // 1\n const Ns = mod((r + _1n) * ONE_MINUS_D_SQ); // 2\n let c = BigInt(-1); // 3\n const D = mod((c - d * r) * mod(r + d)); // 4\n let { isValid: Ns_D_is_sq, value: s } = uvRatio(Ns, D); // 5\n let s_ = mod(s * r0); // 6\n if (!isNegativeLE(s_, P)) s_ = mod(-s_);\n if (!Ns_D_is_sq) s = s_; // 7\n if (!Ns_D_is_sq) c = r; // 8\n const Nt = mod(c * (r - _1n) * D_MINUS_ONE_SQ - D); // 9\n const s2 = s * s;\n const W0 = mod((s + s) * D); // 10\n const W1 = mod(Nt * SQRT_AD_MINUS_ONE); // 11\n const W2 = mod(_1n - s2); // 12\n const W3 = mod(_1n + s2); // 13\n return new ed25519.Point(mod(W0 * W3), mod(W2 * W1), mod(W1 * W3), mod(W0 * W2));\n}\n\nfunction ristretto255_map(bytes: Uint8Array): _RistrettoPoint {\n abytes(bytes, 64);\n const r1 = bytes255ToNumberLE(bytes.subarray(0, 32));\n const R1 = calcElligatorRistrettoMap(r1);\n const r2 = bytes255ToNumberLE(bytes.subarray(32, 64));\n const R2 = calcElligatorRistrettoMap(r2);\n return new _RistrettoPoint(R1.add(R2));\n}\n\n/**\n * Wrapper over Edwards Point for ristretto255.\n *\n * Each ed25519/ExtendedPoint has 8 different equivalent points. This can be\n * a source of bugs for protocols like ring signatures. Ristretto was created to solve this.\n * Ristretto point operates in X:Y:Z:T extended coordinates like ExtendedPoint,\n * but it should work in its own namespace: do not combine those two.\n * See [RFC9496](https://www.rfc-editor.org/rfc/rfc9496).\n */\nclass _RistrettoPoint extends PrimeEdwardsPoint<_RistrettoPoint> {\n // Do NOT change syntax: the following gymnastics is done,\n // because typescript strips comments, which makes bundlers disable tree-shaking.\n // prettier-ignore\n static BASE: _RistrettoPoint =\n /* @__PURE__ */ (() => new _RistrettoPoint(ed25519.Point.BASE))();\n // prettier-ignore\n static ZERO: _RistrettoPoint =\n /* @__PURE__ */ (() => new _RistrettoPoint(ed25519.Point.ZERO))();\n // prettier-ignore\n static Fp: IField =\n /* @__PURE__ */ (() => Fp)();\n // prettier-ignore\n static Fn: IField =\n /* @__PURE__ */ (() => Fn)();\n\n constructor(ep: ExtendedPoint) {\n super(ep);\n }\n\n static fromAffine(ap: AffinePoint): _RistrettoPoint {\n return new _RistrettoPoint(ed25519.Point.fromAffine(ap));\n }\n\n protected assertSame(other: _RistrettoPoint): void {\n if (!(other instanceof _RistrettoPoint)) throw new Error('RistrettoPoint expected');\n }\n\n protected init(ep: EdwardsPoint): _RistrettoPoint {\n return new _RistrettoPoint(ep);\n }\n\n /** @deprecated use `import { ristretto255_hasher } from '@noble/curves/ed25519.js';` */\n static hashToCurve(hex: Hex): _RistrettoPoint {\n return ristretto255_map(ensureBytes('ristrettoHash', hex, 64));\n }\n\n static fromBytes(bytes: Uint8Array): _RistrettoPoint {\n abytes(bytes, 32);\n const { a, d } = ed25519_CURVE;\n const P = ed25519_CURVE_p;\n const mod = (n: bigint) => Fp.create(n);\n const s = bytes255ToNumberLE(bytes);\n // 1. Check that s_bytes is the canonical encoding of a field element, or else abort.\n // 3. Check that s is non-negative, or else abort\n if (!equalBytes(Fp.toBytes(s), bytes) || isNegativeLE(s, P))\n throw new Error('invalid ristretto255 encoding 1');\n const s2 = mod(s * s);\n const u1 = mod(_1n + a * s2); // 4 (a is -1)\n const u2 = mod(_1n - a * s2); // 5\n const u1_2 = mod(u1 * u1);\n const u2_2 = mod(u2 * u2);\n const v = mod(a * d * u1_2 - u2_2); // 6\n const { isValid, value: I } = invertSqrt(mod(v * u2_2)); // 7\n const Dx = mod(I * u2); // 8\n const Dy = mod(I * Dx * v); // 9\n let x = mod((s + s) * Dx); // 10\n if (isNegativeLE(x, P)) x = mod(-x); // 10\n const y = mod(u1 * Dy); // 11\n const t = mod(x * y); // 12\n if (!isValid || isNegativeLE(t, P) || y === _0n)\n throw new Error('invalid ristretto255 encoding 2');\n return new _RistrettoPoint(new ed25519.Point(x, y, _1n, t));\n }\n\n /**\n * Converts ristretto-encoded string to ristretto point.\n * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).\n * @param hex Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding\n */\n static fromHex(hex: Hex): _RistrettoPoint {\n return _RistrettoPoint.fromBytes(ensureBytes('ristrettoHex', hex, 32));\n }\n\n static msm(points: _RistrettoPoint[], scalars: bigint[]): _RistrettoPoint {\n return pippenger(_RistrettoPoint, ed25519.Point.Fn, points, scalars);\n }\n\n /**\n * Encodes ristretto point to Uint8Array.\n * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode).\n */\n toBytes(): Uint8Array {\n let { X, Y, Z, T } = this.ep;\n const P = ed25519_CURVE_p;\n const mod = (n: bigint) => Fp.create(n);\n const u1 = mod(mod(Z + Y) * mod(Z - Y)); // 1\n const u2 = mod(X * Y); // 2\n // Square root always exists\n const u2sq = mod(u2 * u2);\n const { value: invsqrt } = invertSqrt(mod(u1 * u2sq)); // 3\n const D1 = mod(invsqrt * u1); // 4\n const D2 = mod(invsqrt * u2); // 5\n const zInv = mod(D1 * D2 * T); // 6\n let D: bigint; // 7\n if (isNegativeLE(T * zInv, P)) {\n let _x = mod(Y * SQRT_M1);\n let _y = mod(X * SQRT_M1);\n X = _x;\n Y = _y;\n D = mod(D1 * INVSQRT_A_MINUS_D);\n } else {\n D = D2; // 8\n }\n if (isNegativeLE(X * zInv, P)) Y = mod(-Y); // 9\n let s = mod((Z - Y) * D); // 10 (check footer's note, no sqrt(-a))\n if (isNegativeLE(s, P)) s = mod(-s);\n return Fp.toBytes(s); // 11\n }\n\n /**\n * Compares two Ristretto points.\n * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals).\n */\n equals(other: _RistrettoPoint): boolean {\n this.assertSame(other);\n const { X: X1, Y: Y1 } = this.ep;\n const { X: X2, Y: Y2 } = other.ep;\n const mod = (n: bigint) => Fp.create(n);\n // (x1 * y2 == y1 * x2) | (y1 * y2 == x1 * x2)\n const one = mod(X1 * Y2) === mod(Y1 * X2);\n const two = mod(Y1 * Y2) === mod(X1 * X2);\n return one || two;\n }\n\n is0(): boolean {\n return this.equals(_RistrettoPoint.ZERO);\n }\n}\n\nexport const ristretto255: {\n Point: typeof _RistrettoPoint;\n} = { Point: _RistrettoPoint };\n\n/** Hashing to ristretto255 points / field. RFC 9380 methods. */\nexport const ristretto255_hasher: H2CHasherBase = {\n hashToCurve(msg: Uint8Array, options?: htfBasicOpts): _RistrettoPoint {\n const DST = options?.DST || 'ristretto255_XMD:SHA-512_R255MAP_RO_';\n const xmd = expand_message_xmd(msg, DST, 64, sha512);\n return ristretto255_map(xmd);\n },\n hashToScalar(msg: Uint8Array, options: htfBasicOpts = { DST: _DST_scalar }) {\n const xmd = expand_message_xmd(msg, options.DST, 64, sha512);\n return Fn.create(bytesToNumberLE(xmd));\n },\n};\n\n// export const ristretto255_oprf: OPRF = createORPF({\n// name: 'ristretto255-SHA512',\n// Point: RistrettoPoint,\n// hash: sha512,\n// hashToGroup: ristretto255_hasher.hashToCurve,\n// hashToScalar: ristretto255_hasher.hashToScalar,\n// });\n\n/**\n * Weird / bogus points, useful for debugging.\n * All 8 ed25519 points of 8-torsion subgroup can be generated from the point\n * T = `26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05`.\n * ⟨T⟩ = { O, T, 2T, 3T, 4T, 5T, 6T, 7T }\n */\nexport const ED25519_TORSION_SUBGROUP: string[] = [\n '0100000000000000000000000000000000000000000000000000000000000000',\n 'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a',\n '0000000000000000000000000000000000000000000000000000000000000080',\n '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05',\n 'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',\n '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85',\n '0000000000000000000000000000000000000000000000000000000000000000',\n 'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',\n];\n\n/** @deprecated use `ed25519.utils.toMontgomery` */\nexport function edwardsToMontgomeryPub(edwardsPub: Hex): Uint8Array {\n return ed25519.utils.toMontgomery(ensureBytes('pub', edwardsPub));\n}\n/** @deprecated use `ed25519.utils.toMontgomery` */\nexport const edwardsToMontgomery: typeof edwardsToMontgomeryPub = edwardsToMontgomeryPub;\n\n/** @deprecated use `ed25519.utils.toMontgomerySecret` */\nexport function edwardsToMontgomeryPriv(edwardsPriv: Uint8Array): Uint8Array {\n return ed25519.utils.toMontgomerySecret(ensureBytes('pub', edwardsPriv));\n}\n\n/** @deprecated use `ristretto255.Point` */\nexport const RistrettoPoint: typeof _RistrettoPoint = _RistrettoPoint;\n/** @deprecated use `import { ed25519_hasher } from '@noble/curves/ed25519.js';` */\nexport const hashToCurve: H2CMethod = /* @__PURE__ */ (() => ed25519_hasher.hashToCurve)();\n/** @deprecated use `import { ed25519_hasher } from '@noble/curves/ed25519.js';` */\nexport const encodeToCurve: H2CMethod = /* @__PURE__ */ (() =>\n ed25519_hasher.encodeToCurve)();\ntype RistHasher = (msg: Uint8Array, options: htfBasicOpts) => _RistrettoPoint;\n/** @deprecated use `import { ristretto255_hasher } from '@noble/curves/ed25519.js';` */\nexport const hashToRistretto255: RistHasher = /* @__PURE__ */ (() =>\n ristretto255_hasher.hashToCurve as RistHasher)();\n/** @deprecated use `import { ristretto255_hasher } from '@noble/curves/ed25519.js';` */\nexport const hash_to_ristretto255: RistHasher = /* @__PURE__ */ (() =>\n ristretto255_hasher.hashToCurve as RistHasher)();\n","import type { HttpClient } from './http.js';\nimport type { ProjectConfig } from './types.js';\n\nconst CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes\n\nexport class ConfigFetcher {\n protected readonly httpClient: HttpClient;\n private cachedConfig: ProjectConfig | null = null;\n private cacheTimestamp = 0;\n\n constructor(httpClient: HttpClient) {\n this.httpClient = httpClient;\n }\n\n async getConfig(): Promise {\n const now = Date.now();\n\n if (this.cachedConfig && now - this.cacheTimestamp < CACHE_TTL_MS) {\n return this.cachedConfig;\n }\n\n try {\n const response = await this.httpClient.request('GET', '/v1/config');\n\n if (response.error || !response.data) {\n return null;\n }\n\n this.cachedConfig = response.data;\n this.cacheTimestamp = now;\n\n return this.cachedConfig;\n } catch {\n return null;\n }\n }\n}\n","export class PalbaseError extends Error {\n readonly code: string;\n readonly status: number;\n readonly details?: unknown;\n\n constructor(code: string, message: string, status: number, details?: unknown) {\n super(message);\n this.name = 'PalbaseError';\n this.code = code;\n this.status = status;\n this.details = details;\n }\n}\n","export type Platform = 'browser' | 'node' | 'react-native' | 'deno' | 'bun';\n\ndeclare const Deno: unknown;\n\nexport function detectPlatform(): Platform {\n if (typeof Deno !== 'undefined') {\n return 'deno';\n }\n\n const runtime = globalThis as typeof globalThis & {\n process?: { versions?: Record };\n };\n if (runtime.process?.versions) {\n if ('bun' in runtime.process.versions) {\n return 'bun';\n }\n if ('node' in runtime.process.versions) {\n return 'node';\n }\n }\n\n if (typeof navigator !== 'undefined' && navigator.product === 'ReactNative') {\n return 'react-native';\n }\n\n return 'browser';\n}\n\n/**\n * The platform word this SDK puts on the wire (`X-Platform`), which the server\n * reads to target flags and to label telemetry.\n *\n * It is NOT `detectPlatform()`'s value verbatim: that reports the JS host\n * (\"browser\"), while the wire wants the platform. iOS sends \"ios\", not the name\n * of its runtime, and a condition author writes `client.platform == 'web'` —\n * the word every other flag vendor uses too. Server hosts keep their own names,\n * where the distinction is the useful part.\n */\nexport function wirePlatform(): string {\n const host = detectPlatform();\n return host === 'browser' ? 'web' : host;\n}\n","// Proof-of-work: the bot gate in front of /auth/signup and /auth/login.\n//\n// The server answers an unsolved request with 403 and a challenge in the body:\n//\n// { \"error\": \"pow_required\", \"challenge\": { \"id\", \"prefix\", \"difficulty\" } }\n//\n// A client finds any nonce whose SHA-256(prefix + nonce) begins with\n// `difficulty` zero bits, then repeats the request carrying the id and nonce as\n// headers. The work is the point: a person signing up pays it once and does not\n// notice, a script signing up ten thousand times pays it ten thousand times.\n//\n// # Why this lives in core, and not one layer up\n//\n// Until 2026-08-14 nothing shipped could solve it: the gate was written with the\n// server and its own integration harness, and every real client sent requests\n// without the headers and got 403. It was then solved in @palbase/web's own\n// request path — which covers `pb.call` and the module facades and NOT\n// `pb.auth.*`, because those go through @palbase/auth's client and from there\n// into core's HttpClient. So the fix landed everywhere except the two endpoints\n// the gate actually guards, and `npm i @palbase/web` still could not sign a\n// person in. Measured 2026-08-18 against a real stack, on the published 7.3.0.\n//\n// The lesson is where a retry belongs: at the layer that ISSUES the request.\n// Core owns fetch for every client in this repo, so core owns the challenge.\n//\n// WebCrypto rather than a hashing dependency: `crypto.subtle` is present in\n// browsers and in Node 18+, which is the same floor the rest of the SDK sets.\n// Measured at the server's default difficulty of 16: ~330ms, ~65k digests.\n\n/** The challenge a `pow_required` response carries. */\nexport interface PowChallenge {\n id: string;\n prefix: string;\n difficulty: number;\n}\n\n/** Header names the retry must carry. Mirrors the server's constants. */\nexport const POW_CHALLENGE_ID_HEADER = 'X-PoW-Challenge-ID';\nexport const POW_NONCE_HEADER = 'X-PoW-Nonce';\n\n/**\n * Reads a challenge out of an error envelope, or returns null when the envelope\n * is not a `pow_required` one.\n *\n * The whole wire envelope is stored on the error, so the challenge arrives\n * without the HTTP layer having to know about proof-of-work at all.\n */\nexport function asPowChallenge(details: unknown): PowChallenge | null {\n if (typeof details !== 'object' || details === null) return null;\n const env = details as Record;\n if (env.error !== 'pow_required') return null;\n const c = env.challenge;\n if (typeof c !== 'object' || c === null) return null;\n const { id, prefix, difficulty } = c as Record;\n if (typeof id !== 'string' || typeof prefix !== 'string') return null;\n if (typeof difficulty !== 'number' || !Number.isInteger(difficulty) || difficulty < 0)\n return null;\n return { id, prefix, difficulty };\n}\n\nconst encoder = new TextEncoder();\n\n/**\n * One SHA-256, by the fastest route this runtime offers.\n *\n * Awaiting `crypto.subtle.digest` once per nonce is what made this expensive,\n * and the cost is the await rather than the hashing. Measured on one machine,\n * 200k digests of a 40-byte input:\n *\n *\tawaited crypto.subtle.digest 105,597 digests/s\n *\tsync node:crypto createHash 1,324,503 digests/s — 12.5x\n *\n * That is the difference between difficulty 24 taking 159 seconds and taking\n * 13. Node, Bun and Deno all have the sync one; a browser has only WebCrypto,\n * and there it stays async.\n *\n * The specifier is assembled at runtime so a browser bundler does not try to\n * resolve `node:crypto` and fail the build over a branch that never runs there.\n */\ntype Hasher = (input: string) => Uint8Array | Promise;\n\nlet hasher: Hasher | null = null;\n\nasync function digester(): Promise {\n if (hasher) return hasher;\n // Read off globalThis with an inline shape rather than by naming `process`,\n // which needs @types/node — a dependency this package does not have and should\n // not grow for one branch. It typechecked locally only because those types\n // were hoisted into node_modules by a sibling package; the publish workflow's\n // clean checkout is what said so, which is exactly what it is for.\n const runtime = globalThis as {\n process?: { versions?: { node?: string; bun?: string } };\n };\n const nodeish =\n runtime.process?.versions?.node !== undefined || runtime.process?.versions?.bun !== undefined;\n if (nodeish) {\n try {\n const mod = (await import(/* @vite-ignore */ `${'node:'}crypto`)) as {\n createHash?: (alg: string) => { update(s: string): { digest(): Uint8Array } };\n };\n if (typeof mod.createHash === 'function') {\n const createHash = mod.createHash;\n hasher = (input: string) => new Uint8Array(createHash('sha256').update(input).digest());\n return hasher;\n }\n } catch {\n // No node:crypto here. WebCrypto below is not a fallback in the apologetic\n // sense — it is the only hash a browser has, and it is correct.\n }\n }\n hasher = async (input: string) =>\n new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(input)));\n return hasher;\n}\n\n/** Monotonic where it exists, wall-clock where it does not. */\nconst now = (): number =>\n typeof performance !== 'undefined' && typeof performance.now === 'function'\n ? performance.now()\n : Date.now();\n\n/** Counts leading zero bits, stopping at the first byte that has a one. */\nfunction leadingZeroBits(hash: Uint8Array): number {\n let bits = 0;\n for (const byte of hash) {\n if (byte === 0) {\n bits += 8;\n continue;\n }\n // clz32 counts across 32 bits; a byte occupies the low 8, so the first 24\n // are always zero and get subtracted back off.\n return bits + Math.clz32(byte) - 24;\n }\n return bits;\n}\n\n/**\n * The hardest challenge this client will attempt.\n *\n * Not a taste: it is the server's own ceiling. palauth maps a risk score to a\n * difficulty and its worst case is 24 (`DifficultyForRisk`, bot/pow.go:156-166).\n * Anything above that cannot have come from a stack behaving as designed, and\n * the cost of humouring it falls entirely on this side — each step up DOUBLES\n * the work, so difficulty 30 is sixty-four times a legitimate worst case and, on\n * the web, sixty-four times a frozen main thread. Refused immediately, by name.\n */\nexport const MAX_POW_DIFFICULTY = 24;\n\n/**\n * Finds a nonce satisfying the challenge and returns the headers a retry needs.\n *\n * THE BUDGET SCALES WITH THE CHALLENGE, and the first version of this did not.\n * It bounded the search at a flat `1 << 24` — which is not a generous bound for\n * difficulty 24, it is the EXPECTED number of attempts. Finding a nonce is a\n * geometric process: the chance of needing more than 2^d attempts is 1/e, so a\n * flat 2^24 would have failed roughly 37% of legitimate hardest-risk challenges,\n * and failed them for precisely the users the gate exists to slow down — who\n * would have been unable to sign in at all rather than made to wait.\n *\n * Eight times expected puts that at e^-8, about three in ten thousand, while\n * leaving the common case (the server's default 16, and 12 for an unremarkable\n * caller) exactly as cheap as it was.\n *\n * `powBudget` is exported and separate so the RELATIONSHIP can be asserted\n * directly. A test that only watches a cheap challenge succeed cannot tell this\n * budget from the flat one it replaced — measured: reinstating `1 << 24` left\n * such a test green.\n */\nexport function powBudget(difficulty: number): number {\n return 8 * 2 ** difficulty;\n}\n\n/**\n * The longest a solve may be ALLOWED to take, and the difference from a\n * deadline is the whole point.\n *\n * The first version of this was a flat 120s deadline, and it was measured to be\n * worse than the flat iteration budget it was meant to backstop: at ~105k\n * digests/s, difficulty 24 EXPECTS 159 seconds, so a 120s clock killed the\n * majority of legitimate hardest-risk solves — reintroducing, larger, exactly\n * the class of defect that replacing `1 << 24` had removed. Guessing a number\n * for an unknown machine cannot work: the same difficulty is 13 seconds on a\n * runtime with a sync hasher and 159 on one without.\n *\n * So the machine is MEASURED, and the decision moves to the front. A short\n * calibration gives the rate this process actually hashes at; if the whole\n * iteration budget cannot fit in this window at that rate, the solve is refused\n * IMMEDIATELY, naming the numbers. A caller then learns in milliseconds that\n * this difficulty is unpayable here, instead of after two minutes of work\n * thrown away.\n *\n * What remains after that is a guarantee rather than a gamble: a solve that\n * starts can always finish inside its budget, so the only failure left is the\n * budget's own e^-8.\n */\nexport const POW_TIME_BUDGET_MS = 120_000;\n\n/**\n * The window the rate is measured over, and the warm-up it deliberately skips.\n *\n * All of these are REAL attempts — the search starts at nonce 0 and never\n * restarts — so calibration costs nothing but the reading. The first 1024 are\n * excluded from the timing because they include this loop's own JIT warm-up:\n * measured, timing from zero reported 747k digests/s on a machine whose steady\n * rate is 1.32M, and the decision below would have refused a difficulty this\n * machine can pay in half the allowance.\n */\nconst CALIBRATION_WARMUP = 1024;\nconst CALIBRATION_END = 9216;\n\nexport async function solvePowChallenge(\n challenge: PowChallenge,\n maxIterations = powBudget(challenge.difficulty),\n // The caller's AbortSignal, honoured INSIDE the loop rather than only around\n // the fetch it precedes — for the callers that have one. `pb.auth.signIn` does\n // NOT: it reaches the network through @palbase/auth's client, which takes\n // credentials and nothing else. So it is the extra a caller can opt into, and\n // POW_TIME_BUDGET_MS below is what actually bounds the work.\n signal?: AbortSignal,\n): Promise> {\n if (challenge.difficulty > MAX_POW_DIFFICULTY) {\n throw new Error(\n `proof-of-work: refusing difficulty ${challenge.difficulty}; this client attempts at most ${MAX_POW_DIFFICULTY}, which is the highest a Palbase stack issues`,\n );\n }\n\n const digest = await digester();\n let warmedAt = 0;\n let calibrated = false;\n // Armed by the calibration below, never before it: until the rate is known\n // there is no honest number to put here.\n let deadline = Number.POSITIVE_INFINITY;\n\n for (let nonce = 0; nonce < maxIterations; nonce++) {\n // Checked in batches: reading them is cheap but not free, and a\n // 1024-digest granularity bounds the delay at a few milliseconds.\n if ((nonce & 1023) === 0) {\n if (signal?.aborted) {\n throw new DOMException('proof-of-work solve aborted', 'AbortError');\n }\n if (now() > deadline) {\n throw new Error(\n `proof-of-work: gave up on difficulty ${challenge.difficulty} after ${POW_TIME_BUDGET_MS / 1000}s ` +\n `and ${nonce.toLocaleString()} attempts — the tail this run drew is longer than the allowance`,\n );\n }\n }\n\n // THE DECISION, TAKEN ONCE AND TAKEN EARLY.\n //\n // After CALIBRATION_DIGESTS real attempts the rate of THIS process is\n // known, so the question \"can this machine pay this difficulty\" has an\n // answer instead of an assumption. If the whole budget cannot fit in the\n // time budget, refuse here — milliseconds in, with the numbers — rather\n // than spend two minutes and throw them away. If it fits, everything after\n // this point is guaranteed to finish inside the window, so the only\n // remaining failure is the budget's own e^-8.\n if (nonce === CALIBRATION_WARMUP) {\n warmedAt = now();\n }\n if (!calibrated && nonce === CALIBRATION_END) {\n calibrated = true;\n const elapsed = Math.max(now() - warmedAt, 0.001);\n const rate = (CALIBRATION_END - CALIBRATION_WARMUP) / (elapsed / 1000);\n // EXPECTED, not worst case, and the difference is the whole judgement.\n //\n // Finding a nonce is geometric: 2^difficulty attempts on average, with a\n // long tail the 8x budget covers. Refusing because the TAIL will not fit\n // would turn away work whose expected cost is seventeen seconds — measured\n // exactly that on this machine at difficulty 24. Refusing on the EXPECTED\n // cost turns away only what is genuinely unpayable here, and what it lets\n // through is then cut by the clock with probability e^-(budget/expected):\n // at 120s against a 17s expectation that is one run in a thousand, and at\n // difficulty 20 on a browser it is one in a hundred and fifty thousand.\n const expectedMs = (2 ** challenge.difficulty / rate) * 1000;\n if (expectedMs > POW_TIME_BUDGET_MS) {\n throw new Error(\n `proof-of-work: difficulty ${challenge.difficulty} needs about ${Math.round(expectedMs / 1000)}s here ` +\n `(${Math.round(rate).toLocaleString()} digests/s) and this client allows ${POW_TIME_BUDGET_MS / 1000}s; ` +\n `refusing before spending the time rather than after`,\n );\n }\n deadline = now() + (POW_TIME_BUDGET_MS - (now() - warmedAt));\n }\n\n const hash = await digest(challenge.prefix + nonce);\n if (leadingZeroBits(hash) >= challenge.difficulty) {\n return {\n [POW_CHALLENGE_ID_HEADER]: challenge.id,\n [POW_NONCE_HEADER]: String(nonce),\n };\n }\n }\n throw new Error(\n `proof-of-work: no nonce found for difficulty ${challenge.difficulty} within ${maxIterations} attempts`,\n );\n}\n","import { Chacha20Poly1305 } from '@hpke/chacha20poly1305';\nimport { CipherSuite, HkdfSha256 } from '@hpke/core';\nimport { DhkemX25519HkdfSha256 } from '@hpke/dhkem-x25519';\nimport { PalbaseError } from './errors.js';\nimport { fromBase64, toBase64 } from './sealed-json.js';\nimport type { SealingKey } from './sealed-keys.js';\n\nexport const SEALED_CONTENT_TYPE = 'application/palbase-sealed+json';\nexport const SEALED_HEADER = 'X-Palbase-Sealed';\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder('utf-8', { fatal: true });\nconst responseLabel = 'palbase-sealed/response/v1';\n\nexport function sealingRequired(path: string): boolean {\n // Mirrors v2/internal/server/sealed.go. Tenant/runtime routes cannot unseal.\n return new URL(path, 'https://unused.invalid').pathname.startsWith('/auth/');\n}\n\nexport function requestAAD(\n host: string,\n method: string,\n path: string,\n ict: string,\n ts: number,\n idem: string,\n): Uint8Array {\n const fields = [host, method, path, ict, idem].map((field) => encoder.encode(field));\n const bytes = new Uint8Array(fields.reduce((size, field) => size + 4 + field.length, 8));\n const view = new DataView(bytes.buffer);\n let offset = 0;\n for (const [index, field] of fields.entries()) {\n if (index === 4) {\n view.setBigUint64(offset, BigInt(ts));\n offset += 8;\n }\n view.setUint32(offset, field.length);\n offset += 4;\n bytes.set(field, offset);\n offset += field.length;\n }\n return bytes;\n}\n\nexport function sealingSuite(): CipherSuite {\n return new CipherSuite({\n kem: new DhkemX25519HkdfSha256(),\n kdf: new HkdfSha256(),\n aead: new Chacha20Poly1305(),\n });\n}\n\nexport async function sealRequest(\n key: SealingKey,\n url: string,\n init: RequestInit,\n): Promise> {\n const suite = sealingSuite();\n const sender = await suite.createSenderContext({\n recipientPublicKey: await suite.kem.importKey('raw', key.publicKey.buffer),\n });\n const headers = new Headers(init.headers);\n const ict = headers.get('content-type') ?? 'application/json';\n const ts = Math.floor(Date.now() / 1000);\n const target = new URL(url);\n const method = init.method ?? 'GET';\n // Go binds r.URL.Path (decoded, without the query), not RequestURI.\n const aad = requestAAD(\n target.host,\n method,\n decodeURIComponent(target.pathname),\n ict,\n ts,\n headers.get('idempotency-key') ?? '',\n );\n const ct = await sender.seal(encoder.encode(typeof init.body === 'string' ? init.body : ''), aad);\n const envelope = JSON.stringify({\n v: 2,\n kid: key.kid,\n enc: toBase64(new Uint8Array(sender.enc)),\n ct: toBase64(new Uint8Array(ct)),\n ict,\n ts,\n });\n if (method === 'GET' || method === 'HEAD' || init.body === undefined) {\n headers.set(\n SEALED_HEADER,\n toBase64(encoder.encode(envelope)).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, ''),\n );\n delete init.body;\n } else {\n headers.delete(SEALED_HEADER);\n headers.set('Content-Type', SEALED_CONTENT_TYPE);\n init.body = envelope;\n }\n headers.delete('Content-Length');\n init.headers = Object.fromEntries(headers.entries());\n // Do not redirect a credential-bearing envelope to a different endpoint.\n init.redirect = 'error';\n return new Uint8Array(await sender.export(encoder.encode(responseLabel), 32));\n}\n\nexport async function openSealedResponse(\n response: Response,\n exporter: Uint8Array | undefined,\n method: string,\n): Promise {\n if (\n response.headers.get('content-type')?.split(';')[0]?.trim().toLowerCase() !==\n SEALED_CONTENT_TYPE\n ) {\n // Edge/middleware errors are plaintext. A successful auth result cannot be.\n if (exporter && response.ok && method !== 'HEAD') {\n throw new PalbaseError(\n 'sealed_response_invalid',\n 'The server returned an unencrypted response.',\n response.status,\n );\n }\n return response;\n }\n // HTTP HEAD has no response body, including when the handler sealed it.\n if (method === 'HEAD') return response;\n try {\n if (!exporter) throw new Error('No sealing context');\n const envelope = (await response.json()) as {\n v: number;\n n: string;\n ct: string;\n ict: string;\n st: number;\n };\n if (\n envelope.v !== 2 ||\n !Number.isInteger(envelope.st) ||\n envelope.st < 200 ||\n envelope.st > 599 ||\n typeof envelope.ict !== 'string'\n ) {\n throw new Error('Invalid response envelope');\n }\n const plaintext = await new Chacha20Poly1305()\n .createEncryptionContext(exporter)\n .open(\n fromBase64(envelope.n),\n fromBase64(envelope.ct),\n encoder.encode(`${responseLabel}\\n${envelope.ict}\\n${envelope.st}`),\n );\n const headers = new Headers(response.headers);\n headers.set('Content-Type', envelope.ict);\n headers.delete('Content-Length');\n headers.delete('Content-Encoding');\n // The outer status is always 200; auth failures and PoW live inside the seal.\n return new Response([204, 205, 304].includes(envelope.st) ? null : decoder.decode(plaintext), {\n status: envelope.st,\n headers,\n });\n } catch {\n throw new PalbaseError(\n 'sealed_response_invalid',\n 'The encrypted server response could not be verified.',\n response.status,\n );\n }\n}\n","// Signatures cover the original JSON bytes, not JSON.stringify(JSON.parse(raw)).\n// Go's encoder preserves struct field order and escapes characters differently.\nexport function rawObjectFields(raw: string): Map {\n const parsed: unknown = JSON.parse(raw);\n if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {\n throw new Error('Expected a JSON object');\n }\n const fields = new Map();\n let i = 0;\n const space = () => {\n while (/\\s/.test(raw[i] ?? '') && i < raw.length) i++;\n };\n const stringEnd = (start: number) => {\n let end = start + 1;\n while (end < raw.length) {\n if (raw[end] === '\\\\') end += 2;\n else if (raw[end++] === '\"') return end;\n }\n throw new Error('Unterminated JSON string');\n };\n space();\n i++; // opening object, already validated by JSON.parse\n while (true) {\n space();\n if (raw[i] === '}') return fields;\n const nameEnd = stringEnd(i);\n const name = JSON.parse(raw.slice(i, nameEnd)) as string;\n i = nameEnd;\n space();\n i++; // colon\n space();\n const start = i;\n if (raw[i] === '\"') i = stringEnd(i);\n else if (raw[i] === '{' || raw[i] === '[') {\n let depth = 0;\n do {\n const c = raw[i];\n if (c === '\"') {\n i = stringEnd(i);\n continue;\n }\n if (c === '{' || c === '[') depth++;\n if (c === '}' || c === ']') depth--;\n i++;\n } while (depth > 0 && i < raw.length);\n } else {\n while (i < raw.length && !/[\\s,}]/.test(raw[i] ?? '')) i++;\n }\n // A first-match slice and JSON.parse's last-match value must never disagree.\n if (fields.has(name)) throw new Error('Duplicate JSON field');\n fields.set(name, raw.slice(start, i));\n space();\n if (raw[i] === ',') i++;\n }\n}\n\nexport function fromBase64(value: string): Uint8Array {\n return Uint8Array.from(atob(value), (c) => c.charCodeAt(0));\n}\n\nexport function toBase64(bytes: Uint8Array): string {\n // Avoid a spread: envelopes can exceed the engine's argument-count limit.\n let binary = '';\n for (const byte of bytes) binary += String.fromCharCode(byte);\n return btoa(binary);\n}\n","import { ed25519 } from '@noble/curves/ed25519.js';\nimport { PalbaseError } from './errors.js';\nimport { fromBase64, rawObjectFields } from './sealed-json.js';\nimport type { HttpClientOptions } from './types.js';\nimport { endpointUrl } from './url.js';\n\nexport const SEALED_KEYSET_PATH = '/palbase-sealed-keys.json';\nexport const SEALED_SUITE = 'DHKEM-X25519-HKDF-SHA256/HKDF-SHA256/ChaCha20Poly1305';\n// Fleet PUBLIC key, identical to the iOS SDK pin. Never learned from a response.\nconst FLEET_ROOT = 'mRDTIWzhW0JCk0e2Jvkn679VeZBB38zOOfPTMO6vBpU=';\nconst REFRESH_MS = 5 * 60_000;\nconst FAILURE_COOLDOWN_MS = 60_000;\nconst encoder = new TextEncoder();\n\nexport interface SealingKey {\n kid: string;\n publicKey: Uint8Array;\n expires: number;\n version: number;\n}\n\nexport function expectedSealedStack(baseUrl: string, apiKey: string): string {\n // Fleet tenant hosts name the stack even when a legacy key says pb_project_.\n // Apex/custom/self-host URLs instead need the key's ref (or an explicit pin).\n const host = new URL(baseUrl).hostname;\n return (\n /^([a-z0-9]{4,24})\\.(?:(?:dev|staging)\\.)?palbase\\.studio$/.exec(host)?.[1] ??\n /^pb_([^_]+)_/.exec(apiKey)?.[1] ??\n ''\n );\n}\n\nfunction record(raw: string | undefined): Record {\n if (!raw) throw new Error('Missing signed object');\n rawObjectFields(raw); // also refuses duplicate fields\n return JSON.parse(raw) as Record;\n}\n\nfunction string(value: unknown): string {\n if (typeof value !== 'string' || !value) throw new Error('Missing string');\n return value;\n}\n\nfunction integer(value: unknown): number {\n if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0) {\n throw new Error('Invalid integer');\n }\n return value;\n}\n\nfunction verifySignature(raw: string, signed: Record, publicKey: Uint8Array) {\n if (\n signed.alg !== 'ed25519' ||\n publicKey.length !== 32 ||\n !ed25519.verify(fromBase64(string(signed.sig)), encoder.encode(raw), publicKey, {\n zip215: false,\n })\n )\n throw new Error('Invalid sealed key signature');\n}\n\n/** Verify fleet → expected stack → keyset, retaining the exact signed bytes. */\nexport function verifySealingKey(\n raw: string,\n expectedRef: string,\n root: string,\n lastVersion: number,\n now: number,\n): SealingKey {\n const fields = rawObjectFields(raw);\n const signed = record(raw);\n const statementRaw = fields.get('binding');\n const statement = record(statementRaw);\n const bindingRaw = rawObjectFields(statementRaw ?? '').get('binding');\n if (!bindingRaw || statement.rootKid !== 'sealed-root-v1') {\n throw new Error('Unknown sealed trust root');\n }\n verifySignature(bindingRaw, statement, fromBase64(root));\n const binding = record(bindingRaw);\n if (\n binding.v !== 1 ||\n !expectedRef ||\n string(binding.stackRef).trim().toLowerCase() !== expectedRef.toLowerCase()\n ) {\n throw new Error('Sealed binding belongs to another stack');\n }\n const bindingExpiry = integer(binding.expires);\n if (bindingExpiry * 1000 <= now) throw new Error('Expired sealed binding');\n const keysetRaw = fields.get('keyset');\n if (!keysetRaw) throw new Error('Missing sealed keyset');\n verifySignature(keysetRaw, signed, fromBase64(string(binding.signingKey)));\n const keyset = record(keysetRaw);\n const version = integer(keyset.version);\n const expires = Math.min(integer(keyset.expires), bindingExpiry);\n if (version < lastVersion) throw new Error('Sealed keyset version went backwards');\n if (expires * 1000 <= now) throw new Error('Expired sealed keyset');\n if (keyset.v !== 1 || !Array.isArray(keyset.keys)) throw new Error('Invalid sealed keyset');\n for (const item of keyset.keys) {\n if (item === null || typeof item !== 'object') continue;\n const entry = item as Record;\n if (entry.alg !== SEALED_SUITE) continue;\n const publicKey = fromBase64(string(entry.pub));\n if (publicKey.length !== 32) throw new Error('Invalid sealing public key');\n return { kid: string(entry.kid), publicKey, expires, version };\n }\n throw new Error('No supported sealing key');\n}\n\nexport class SealedKeyStore {\n private cached?: SealingKey;\n private pending?: Promise;\n private fetchedAt = 0;\n private retryAfter = 0;\n private lastVersion = 0;\n private lastError?: PalbaseError;\n private rotationRefreshAt = 0;\n\n constructor(\n private readonly baseUrl: string,\n private readonly apiKey: string,\n private readonly options?: Exclude,\n ) {}\n\n async current(signal?: AbortSignal, rotate = false): Promise {\n signal?.throwIfAborted();\n const now = Date.now();\n const valid = this.cached && this.cached.expires * 1000 > now ? this.cached : undefined;\n if (this.pending) return this.waitFor(this.pending, signal);\n // A forged unknown-kid response cannot turn every request into a key fetch.\n if (rotate && now - this.rotationRefreshAt >= FAILURE_COOLDOWN_MS) {\n this.fetchedAt = 0;\n this.retryAfter = 0;\n this.rotationRefreshAt = now;\n }\n if (valid && now - this.fetchedAt < REFRESH_MS) return valid;\n if (now < this.retryAfter) {\n if (valid) return valid;\n throw this.lastError;\n }\n const pending = this.fetchKey()\n .then((key) => {\n this.cached = key;\n this.lastVersion = key.version;\n this.fetchedAt = Date.now();\n this.retryAfter = 0;\n return key;\n })\n .catch((error: unknown) => {\n this.retryAfter = Date.now() + FAILURE_COOLDOWN_MS;\n this.lastError =\n error instanceof PalbaseError\n ? error\n : new PalbaseError(\n 'sealed_key_unavailable',\n 'The server encryption key could not be verified. Please try again later.',\n 0,\n );\n // A transient refresh failure may reuse a verified, unexpired key only.\n if (this.cached && this.cached.expires * 1000 > Date.now()) return this.cached;\n throw this.lastError;\n })\n .finally(() => {\n this.pending = undefined;\n });\n this.pending = pending;\n return this.waitFor(pending, signal);\n }\n\n private async fetchKey(): Promise {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), 15_000);\n try {\n const response = await fetch(endpointUrl(this.baseUrl, SEALED_KEYSET_PATH), {\n headers: this.apiKey ? { apikey: this.apiKey } : {},\n signal: controller.signal,\n cache: 'no-store',\n redirect: 'error',\n });\n if (!response.ok) throw new Error('Sealed keyset unavailable');\n const raw = await response.text();\n if (raw.length > 64 * 1024) throw new Error('Sealed keyset too large');\n const expectedRef = this.options?.stackRef ?? expectedSealedStack(this.baseUrl, this.apiKey);\n return verifySealingKey(\n raw,\n expectedRef,\n this.options?.root ?? FLEET_ROOT,\n this.lastVersion,\n Date.now(),\n );\n } finally {\n clearTimeout(timer);\n }\n }\n\n // One caller's cancellation must not abort a shared key fetch for other calls.\n private waitFor(pending: Promise, signal?: AbortSignal): Promise {\n if (!signal) return pending;\n return new Promise((resolve, reject) => {\n const aborted = () => reject(signal.reason);\n signal.addEventListener('abort', aborted, { once: true });\n pending.then(resolve, reject).finally(() => signal.removeEventListener('abort', aborted));\n if (signal.aborted) aborted();\n });\n }\n}\n","/**\n * Join the configured base URL with an SDK path.\n *\n * A BASE URL MAY CARRY A PATH, NOT JUST AN ORIGIN — a self-host published\n * under `https://api.example.com/palbase`, or an app that routes the browser\n * through its own server (`/pb`, rewritten upstream) because the\n * Environment's edge does not answer its origin with CORS headers.\n *\n * `new URL('/palbase-sealed-keys.json', base)` reads as the careful way to do\n * this and is the one form that DROPS that path: the leading slash makes the\n * path absolute against the base's ORIGIN. The sealed key store used it while\n * every ordinary request concatenated, so one request in the client asked a\n * different server than all the others — measured live 2026-09-11, the keyset\n * fetch landed on the app's own 404 page and every sealed call failed with\n * `sealed_key_unavailable`. The other two SDK surfaces never had the split:\n * iOS appends (`SealedKeyStore.swift`), Android concatenates onto a\n * slash-trimmed base (`SealedKeyStore.kt`) — this is their shape.\n */\nexport function endpointUrl(base: string, path: string): string {\n return `${base.replace(/\\/+$/, '')}${path}`;\n}\n","import { PalbaseError } from './errors.js';\nimport { wirePlatform } from './platform.js';\nimport { asPowChallenge, solvePowChallenge } from './pow.js';\nimport { openSealedResponse, sealingRequired, sealRequest } from './sealed.js';\nimport { SealedKeyStore } from './sealed-keys.js';\nimport type { TokenManager } from './token.js';\nimport type { HttpClientOptions, PalbaseResponse, RequestOptions } from './types.js';\nimport { endpointUrl } from './url.js';\n\n/**\n * Default production host. Dev / staging / local callers override via\n * `options.url`. Apex-style routing is the only supported production path;\n * Kong resolves Environment identity from the API key.\n */\nconst PALBASE_DEFAULT_HOST = 'api.palbase.studio';\n\n/**\n * Parse the Environment ref from a Palbase API key.\n *\n * Canonical shape: `pb_{environment_ref}_c{random}`, where the Environment ref\n * is 4-24 lowercase ASCII alphanumeric characters and random is AT LEAST 20\n * base62 chars.\n *\n * The length is a floor, not an equality. The stack's own minter writes 20\n * (v2/cmd/palsvc/initenv.go) and the cloud control plane writes 32\n * (cloud/platform/server/services/keys.ts), and the door that admits the\n * request refuses to rule on the difference: *\"a shorter or longer secret is\n * not a security property this door can rule on\"*\n * (v2/internal/platform/identitymw.go: parseAPIKey). A client that is stricter\n * than the server does not add safety — it just refuses working keys, which is\n * exactly what this one did to every cloud project until 2026-08-25.\n *\n * Returns the Environment ref on match; `null` otherwise.\n */\nconst API_KEY_RE = /^pb_([a-z0-9]{4,24})_c[A-Za-z0-9]{20,}$/;\n\nfunction parseEnvironmentRef(apiKey: string): string | null {\n return API_KEY_RE.exec(apiKey)?.[1] ?? null;\n}\nconst MAX_RETRIES = 3;\nconst INITIAL_BACKOFF_MS = 200;\n/**\n * Upper bound on a single 429 retry sleep. A server may return a long\n * Retry-After (a locked account can send minutes/hours); honoring it verbatim\n * would HANG the request for that whole window. Cap each retry at 10s — after\n * MAX_RETRIES the 429 envelope surfaces to the caller (fail fast, don't sleep\n * minutes). The clamp never skips a retry; it only bounds how long each waits.\n */\nconst MAX_RETRY_DELAY_MS = 10_000;\n\n/**\n * The edge's refusals this client is allowed to WAIT for — an ALLOWLIST.\n *\n * NEVER a denylist. Enumerating the exceptions cannot see the set GROW: a name\n * added at the edge tomorrow would be waited for by a client that never heard\n * of it. The client waits only for what it was taught.\n *\n * `request_too_large` is absent on purpose — the same body earns the same\n * refusal, so waiting cannot help. `handoff_failed` is absent because the\n * project may ALREADY have applied the request: the edge counts a hand-off\n * ATTEMPT before it knows the outcome, and a connection can break after the\n * body was fully delivered. A silent retry there writes an insert twice.\n */\nconst RETRYABLE_HOLD_REFUSALS: ReadonlySet = new Set([\n 'holder_full',\n 'wake_budget_exceeded',\n]);\n\n/**\n * How long to wait for a held-request refusal, or null when it must surface.\n *\n * READS THE NAME, NEVER THE STATUS: an unnamed 503 is Envoy's `no healthy\n * upstream` and this client keeps surfacing it exactly as it does today.\n *\n * READS THE HINT FROM THE PARSED BODY, never from the header alone. A browser\n * cannot see `Retry-After` unless CORS exposes it, and the edge does not — it\n * was measured live on an AWAKE project, whose expose list carries\n * `x-request-id, palbase-auth-contract, etag` and not `Retry-After`. A\n * header-only read is inert exactly where this fix matters.\n */\nfunction heldRefusalWait(\n status: number,\n body: { error?: string; retry_after?: number } | undefined,\n): number | null {\n if (status !== 503) return null;\n if (body?.error === undefined || !RETRYABLE_HOLD_REFUSALS.has(body.error)) return null;\n const seconds = body.retry_after;\n const advertised =\n typeof seconds === 'number' && Number.isFinite(seconds) && seconds > 0\n ? seconds * 1000\n : INITIAL_BACKOFF_MS;\n // The 429 path's own ceiling — no second backoff is invented.\n return Math.min(advertised, MAX_RETRY_DELAY_MS);\n}\n\n/**\n * Carry a 429's retry hint into the error envelope when only the header has it.\n *\n * A REFUSAL FROM THE EDGE CARRIES NOTHING BUT THE HEADER. Envoy and the\n * gateway limiter answer before any Palbase service is reached, so their 429\n * has no `retry_after` and no `data.retryAfter` — and every reader above this\n * layer (`@palbase/web`'s BackendError, the iOS SDK) looks in the BODY. The\n * seconds were on the wire and unreachable to all of them.\n *\n * Lifted under `retry_after`, the platform's own name for it (palauth's\n * rate-limit envelope), never overwriting a hint the service itself sent — a\n * service knows its window, the edge only knows its own.\n */\nfunction withRetryHint(\n body: Record | undefined,\n response: Response,\n): Record | undefined {\n // 429, OR a 503 the edge NAMED as a held request. NOT \"any 503\": an unnamed\n // 503 is Envoy's `no healthy upstream` and FR-006 keeps it exactly as it is\n // today — gaining a hint would already be a behaviour change.\n const namedHold =\n response.status === 503 &&\n typeof body?.error === 'string' &&\n RETRYABLE_HOLD_REFUSALS.has(body.error);\n if (response.status !== 429 && !namedHold) return body;\n const data = body?.data;\n const alreadyStated =\n typeof body?.retry_after === 'number' ||\n (typeof data === 'object' && data !== null && 'retryAfter' in data);\n if (alreadyStated) return body;\n const seconds = Number.parseInt(response.headers.get('Retry-After') ?? '', 10);\n if (Number.isNaN(seconds) || seconds <= 0) return body;\n return { ...body, retry_after: seconds };\n}\n\n/**\n * Request interceptor. Runs before every HTTP request.\n * Can modify headers, body, or reject the request.\n */\nexport type RequestInterceptor = (request: {\n headers: Record;\n method: string;\n path: string;\n}) => void | Promise;\n\nexport class HttpClient {\n protected readonly apiKey: string;\n protected readonly options?: HttpClientOptions;\n\n tokenManager: TokenManager | null = null;\n\n /**\n * Admin JWT used for platform admin endpoints (/admin/*).\n * When set, takes precedence over tokenManager access token in the\n * Authorization header.\n */\n adminToken: string | null = null;\n\n private readonly interceptors: RequestInterceptor[] = [];\n private readonly forbiddenListeners = new Set<(body: Record) => void>();\n private sealedKeys?: SealedKeyStore;\n\n constructor(apiKey: string, options?: HttpClientOptions) {\n this.apiKey = apiKey;\n this.options = options;\n }\n\n /** Set (or clear) the admin JWT used on admin endpoints. */\n setAdminToken(token: string | null): void {\n this.adminToken = token;\n }\n\n /**\n * Called with the RAW body of every 403 this client receives (FR-010). Core\n * does not know the envelope's fields — the layer that does (palbe) reads\n * `required` out of it. Nothing is retried or swallowed: the error still\n * returns to the caller.\n */\n onForbidden(handler: (body: Record) => void): () => void {\n this.forbiddenListeners.add(handler);\n return () => {\n this.forbiddenListeners.delete(handler);\n };\n }\n\n /**\n * Create a scoped HttpClient that adds the given extra headers to every\n * request. The returned client shares the admin token and token manager\n * with the parent at runtime — later changes on the parent propagate to\n * the scope and vice versa.\n *\n * Typical use: adding an Environment-routing header for an admin call.\n */\n withHeaders(extra: Record): HttpClient {\n const mergedHeaders = { ...(this.options?.headers ?? {}), ...extra };\n\n const scoped: HttpClient = new HttpClient(this.apiKey, {\n ...this.options,\n headers: mergedHeaders,\n });\n scoped.tokenManager = this.tokenManager;\n // Delegate adminToken reads + writes to the parent so the scope always\n // sees the latest token, and setAdminToken on the scope affects the parent.\n // The scope shares the parent's 403 listeners: a refusal is a refusal\n // whichever header set the request carried.\n Object.defineProperty(scoped, 'forbiddenListeners', {\n get: () => this.forbiddenListeners,\n });\n Object.defineProperty(scoped, 'adminToken', {\n get: () => this.adminToken,\n set: (v: string | null) => {\n this.adminToken = v;\n },\n configurable: true,\n });\n Object.defineProperty(scoped, 'sealedKeys', {\n get: () => this.sealedKeys,\n set: (v: SealedKeyStore | undefined) => {\n this.sealedKeys = v;\n },\n });\n return scoped;\n }\n\n /** Add a request interceptor. Runs before every request. */\n addInterceptor(interceptor: RequestInterceptor): void {\n this.interceptors.push(interceptor);\n }\n\n async request(\n method: string,\n path: string,\n options?: RequestOptions,\n ): Promise> {\n // If token is expired and refresh is available, refresh before making the request\n if (\n !options?.skipSessionRefresh &&\n this.tokenManager?.isExpired() &&\n this.tokenManager.getRefreshToken() &&\n this.tokenManager.refreshFunction\n ) {\n try {\n await this.tokenManager.refreshSession();\n } catch (e) {\n const status = e instanceof PalbaseError ? e.status : 0;\n if (status === 400 || status === 401 || status === 403) {\n // Terminal: the refresh token is dead (revoked/expired/forbidden).\n // Clear the session (listeners persist the sign-out) and proceed\n // unauthenticated — the endpoint will 401 into the normal error\n // envelope instead of bricking every subsequent call including\n // the recovery sign-in.\n this.tokenManager.clearSession();\n } else {\n throw e; // network/5xx: transient, stay loud\n }\n }\n }\n\n return this.executeWithRetry(method.toUpperCase(), path, options, 0);\n }\n\n /**\n * A response read as it arrives, for `text/event-stream` routes.\n *\n * Deliberately NOT `executeWithRetry`: a retry replays the request, and a\n * stream the caller has already begun reading cannot be replayed — the frames\n * it handed over would arrive a second time. A stream that fails to open fails\n * to the caller, once, with its status.\n *\n * The buffered path's headers, base URL and interceptors are reused verbatim,\n * so a streaming call is authenticated exactly like every other call; only the\n * body handling differs. `Accept` says what the caller wants, and the status\n * is returned beside the body because the CALLER decides what a non-2xx means\n * (an error envelope arrives as an ordinary buffered body).\n */\n async requestStream(\n method: string,\n path: string,\n options?: RequestOptions,\n ): Promise<{ status: number; body: ReadableStream | null; contentType: string }> {\n method = method.toUpperCase();\n if (\n !options?.skipSessionRefresh &&\n this.tokenManager?.isExpired() &&\n this.tokenManager.getRefreshToken() &&\n this.tokenManager.refreshFunction\n ) {\n try {\n await this.tokenManager.refreshSession();\n } catch (e) {\n const status = e instanceof PalbaseError ? e.status : 0;\n if (status === 400 || status === 401 || status === 403) {\n this.tokenManager.clearSession();\n } else {\n throw e;\n }\n }\n }\n\n const url = endpointUrl(this.getBaseUrl(), path);\n const headers = { ...this.buildHeaders(options), Accept: 'text/event-stream' };\n for (const interceptor of this.interceptors) {\n await interceptor({ headers, method, path });\n }\n\n const fetchOptions: RequestInit = { method, headers, signal: options?.signal };\n if (options?.body !== undefined) fetchOptions.body = JSON.stringify(options.body);\n const exporter = await this.prepareSealed(url, path, fetchOptions);\n\n const response = await openSealedResponse(await fetch(url, fetchOptions), exporter, method);\n return {\n status: response.status,\n body: response.body,\n contentType: response.headers.get('content-type') ?? '',\n };\n }\n\n private async prepareSealed(\n url: string,\n path: string,\n init: RequestInit,\n ): Promise | undefined> {\n if (this.options?.sealed === false || !sealingRequired(path)) return undefined;\n this.sealedKeys ??= new SealedKeyStore(this.getBaseUrl(), this.apiKey, this.options?.sealed);\n const key = await this.sealedKeys.current(init.signal ?? undefined);\n init.signal?.throwIfAborted();\n try {\n return await sealRequest(key, url, init);\n } catch (error) {\n init.signal?.throwIfAborted();\n if (error instanceof PalbaseError) throw error;\n throw new PalbaseError('sealed_request_failed', 'The request could not be encrypted.', 0);\n }\n }\n\n private getBaseUrl(): string {\n // Explicit URL always wins (local dev, staging, test rigs).\n if (this.options?.url) {\n return this.options.url;\n }\n\n // Validate the key shape up front so apex-routed callers still\n // fail loud on a malformed key instead of hitting the gateway\n // with bad credentials.\n if (this.apiKey && parseEnvironmentRef(this.apiKey) === null) {\n throw new PalbaseError(\n 'invalid_api_key',\n 'Invalid API key format. Expected pb_{environment_ref}_c{at least 20 base62 chars}. For dev/staging pass `url: \"https://api.dev.palbase.studio\"` via options.',\n 0,\n );\n }\n\n return `https://${PALBASE_DEFAULT_HOST}`;\n }\n\n private buildHeaders(options?: RequestOptions): Record {\n const headers: Record = {\n 'Content-Type': 'application/json',\n // Client identity, the web counterpart of the iOS SDK's\n // ClientInfo.augment(). The server reads these to resolve flag targeting\n // conditions and to label telemetry, so an app declares nothing and calls\n // nothing — whatever the SDK can know, it sends.\n 'X-Platform': wirePlatform(),\n };\n // The host app's own version is not knowable on the web (no bundle to read\n // it from), so it is opt-in; when given it fills the same header iOS fills\n // from CFBundleShortVersionString.\n const appVersion = this.options?.appVersion?.trim();\n if (appVersion) {\n headers['X-Palbase-Client-Version'] = appVersion;\n }\n\n // Palbase Environment keys live in the `apikey` header — never in\n // `Authorization` — because Kong's key-auth resolves them on that\n // header and the gateway's pre-function plugin stamps the downstream\n // identity.\n const effectiveKey = this.apiKey;\n if (effectiveKey) {\n headers['apikey'] = effectiveKey;\n }\n\n // User session token, if any. Kong's pre-function plugin strips\n // Authorization on /v1/* routes anyway (PostgREST has no JWT\n // secret and would crash on a Bearer it can't decode), but\n // sending it preserves the contract for /auth/* endpoints that\n // do consume the bearer (e.g. session refresh).\n const token = this.tokenManager?.getAccessToken();\n if (token) {\n headers['Authorization'] = `Bearer ${token}`;\n }\n\n // adminToken (platform admin JWT) takes precedence — used by the\n // @palbase/admin internal flows that hit /admin/* routes; those\n // routes verify the bearer themselves and aren't subject to the\n // /v1/* Authorization-strip rule.\n if (this.adminToken) {\n headers['Authorization'] = `Bearer ${this.adminToken}`;\n }\n\n // Merge global custom headers\n if (this.options?.headers) {\n Object.assign(headers, this.options.headers);\n }\n\n // Merge per-request headers\n if (options?.headers) {\n Object.assign(headers, options.headers);\n }\n\n return headers;\n }\n\n private async executeWithRetry(\n method: string,\n path: string,\n options: RequestOptions | undefined,\n attempt: number,\n // Headers a PREVIOUS attempt earned and this one has to carry. Today that\n // is only the solved proof-of-work pair; it is a parameter rather than a\n // field because it belongs to one request's second try, and a field would\n // leak it onto every later call made through this client.\n earned?: Record,\n rotated = false,\n ): Promise> {\n const url = endpointUrl(this.getBaseUrl(), path);\n const headers = { ...this.buildHeaders(options), ...earned };\n\n // Run interceptors\n for (const interceptor of this.interceptors) {\n await interceptor({ headers, method, path });\n }\n\n const fetchOptions: RequestInit = {\n method,\n headers,\n signal: options?.signal,\n };\n\n if (options?.body !== undefined) {\n fetchOptions.body = JSON.stringify(options.body);\n }\n // A fresh HPKE encapsulation on EVERY attempt: reusing an envelope trips\n // the server replay guard, even when the first response was lost.\n const exporter = await this.prepareSealed(url, path, fetchOptions);\n\n let response: Response;\n try {\n response = await fetch(url, fetchOptions);\n } catch (error) {\n options?.signal?.throwIfAborted();\n // Network error — retry with backoff\n if (options?.retry !== false && attempt < MAX_RETRIES - 1) {\n const backoff = INITIAL_BACKOFF_MS * 2 ** attempt;\n await this.delay(backoff);\n // WITHOUT `earned`, and that is the whole point of this line.\n //\n // A network error means the response was lost, not that the request\n // was. If it reached the server, the challenge is already SPENT —\n // palauth's VerifyChallenge reads and deletes in one step\n // (bot/pow.go:96-104), deliberately, because a proof presented twice is\n // not proof. Replaying the nonce would then answer `pow_invalid`, and\n // the one-solve guard below would refuse to try again: a request one\n // fresh solve away from succeeding, failed. Dropping it costs nothing\n // in the other case — if the server never saw the request, a fresh\n // challenge works exactly as well as the old one.\n return this.executeWithRetry(method, path, options, attempt + 1, undefined, rotated);\n }\n\n // All retries exhausted — throw PalbaseError\n throw new PalbaseError(\n 'network_error',\n error instanceof Error ? error.message : 'Network request failed',\n 0,\n );\n }\n response = await openSealedResponse(response, exporter, method);\n\n // Handle 429 Too Many Requests — retry with Retry-After or backoff;\n // if retries exhausted, fall through to normal error response handling below\n if (response.status === 429) {\n if (options?.retry !== false && attempt < MAX_RETRIES - 1) {\n const retryAfter = response.headers.get('Retry-After');\n const parsed = retryAfter ? Number.parseInt(retryAfter, 10) : Number.NaN;\n // Clamp the server-requested wait: a long Retry-After (locked account)\n // must not hang the request — cap each sleep, exhaust MAX_RETRIES, then\n // fall through to surface the 429 envelope below.\n const delayMs = Number.isNaN(parsed)\n ? INITIAL_BACKOFF_MS * 2 ** attempt\n : Math.min(parsed * 1000, MAX_RETRY_DELAY_MS);\n await this.delay(delayMs);\n // WITH `earned`, unlike the network path above: a 429 is a refusal the\n // server issued INSTEAD of doing the work, so the challenge was never\n // consumed. The edge's rate limiter answers before palsvc, and on the\n // auth routes palauth's own limiter runs BEFORE the proof-of-work\n // middleware (auth/internal/server/server.go: rl.LoginByIP, then powMW).\n return this.executeWithRetry(method, path, options, attempt + 1, earned, rotated);\n }\n }\n\n // Parse response body\n let data: T | null = null;\n let errorBody:\n | {\n error?: string;\n error_description?: string;\n status?: number;\n required?: string;\n retry_after?: number;\n }\n | undefined;\n\n // HEAD responses have no body by spec — skip parsing.\n const contentType = response.headers.get('Content-Type');\n if (\n method !== 'HEAD' &&\n ![204, 205, 304].includes(response.status) &&\n contentType?.includes('json')\n ) {\n if (response.ok) {\n data = (await response.json()) as T;\n } else {\n // A REFUSAL WHOSE BODY DID NOT ARRIVE WHOLE IS STILL A REFUSAL.\n //\n // This path became REACHABLE with the edge's named envelope: before it,\n // a held-request refusal was `text/plain` and was never parsed, so a\n // truncated body could not surface. Now the edge answers 503 with\n // `application/json`, and a body cut short mid-flight would throw a\n // bare `SyntaxError` straight out of this client — no `PalbaseError`,\n // no status, nothing the application can read. That is exactly the\n // failure this whole change exists to remove, re-entering through the\n // door it opened.\n //\n // The refusal keeps its status and surfaces as `unknown_error` below;\n // an unreadable body costs the NAME, not the answer.\n //\n // Only on the error path: a SUCCESS body that cannot be parsed is a\n // real failure and must keep throwing — swallowing it would hand the\n // caller `{ data: null, error: null }`, which is a silent lie.\n errorBody = (await response.json().catch(() => undefined)) as typeof errorBody;\n }\n }\n\n // A HELD REQUEST IS NOT AN ERROR — the edge is starting a sleeping project.\n //\n // This sits AFTER the body parse, and not beside the 429 check above, on\n // purpose: the name and the hint live in the BODY, and the body does not\n // exist yet where the 429 block runs.\n if (options?.retry !== false && attempt < MAX_RETRIES - 1) {\n const heldWait = heldRefusalWait(response.status, errorBody);\n if (heldWait !== null) {\n await this.delay(heldWait);\n // WITH `earned`, like the 429 path: the edge refused INSTEAD of doing\n // the work, so the challenge was never consumed.\n return this.executeWithRetry(method, path, options, attempt + 1, earned, rotated);\n }\n }\n\n if (\n exporter &&\n !rotated &&\n response.status === 400 &&\n errorBody?.error === 'sealed_unknown_kid'\n ) {\n await this.sealedKeys?.current(options?.signal, true);\n return this.executeWithRetry(method, path, options, attempt, earned, true);\n }\n\n // Proof-of-work: /auth/signup and /auth/token sit behind a bot gate that\n // answers an unsolved request with 403 and the challenge in the body. Solve\n // it and repeat the request carrying the two headers; the caller never\n // learns the gate is there.\n //\n // HERE, in core, because this is the layer that issues the request for every\n // client in the repo — @palbase/auth's sign-in, @palbase/web's facades, the\n // server SDK. The same retry lived one layer up in @palbase/web until\n // 2026-08-18 and covered everything EXCEPT `pb.auth.*`, which reaches the\n // network through this method; so the gate stayed unsatisfiable on exactly\n // the two endpoints it guards.\n //\n // ONE retry, and only when the body really carries a challenge: `earned`\n // being set already means this IS the second try. A 403 that says\n // pow_required without a challenge is a server the client cannot satisfy,\n // and looping on it would turn a broken gate into a hang.\n if (response.status === 403 && !earned) {\n const challenge = asPowChallenge(errorBody);\n if (challenge) {\n return this.executeWithRetry(\n method,\n path,\n options,\n attempt,\n await solvePowChallenge(challenge, undefined, options?.signal),\n rotated,\n );\n }\n }\n\n if (!response.ok) {\n if (response.status === 403 && errorBody !== undefined) {\n const body: Record = errorBody;\n for (const listener of this.forbiddenListeners) {\n try {\n listener(body);\n } catch {\n // A consumer's handler must not turn a well-formed refusal into a\n // thrown error, nor stop the listeners after it (same rule as\n // internal.ts' configured listeners).\n }\n }\n }\n return {\n data: null,\n error: new PalbaseError(\n errorBody?.error ?? 'unknown_error',\n errorBody?.error_description ?? response.statusText,\n response.status,\n withRetryHint(errorBody, response),\n ),\n status: response.status,\n };\n }\n\n // Parse PostgREST Content-Range for count queries (e.g. \"0-9/42\" or \"*/42\").\n const contentRange = response.headers.get('Content-Range');\n let count: number | undefined;\n if (contentRange) {\n const slash = contentRange.lastIndexOf('/');\n if (slash >= 0) {\n const totalPart = contentRange.slice(slash + 1);\n if (totalPart !== '*') {\n const parsed = Number.parseInt(totalPart, 10);\n if (!Number.isNaN(parsed)) {\n count = parsed;\n }\n }\n }\n }\n\n // Header names are case-insensitive and `Headers.get` already honours that;\n // the wire spells this one lowercase.\n const etag = response.headers.get('etag');\n\n return {\n data,\n error: null,\n status: response.status,\n ...(count !== undefined ? { count } : {}),\n ...(etag ? { etag } : {}),\n };\n }\n\n private delay(ms: number): Promise {\n return new Promise((resolve) => setTimeout(resolve, ms));\n }\n}\n","import type { AuthStateCallback, Session, Unsubscribe } from './types.js';\n\nexport class TokenManager {\n private session: Session | null = null;\n private listeners: Set = new Set();\n private refreshPromise: Promise | null = null;\n private refreshing = false;\n\n refreshFunction: ((refreshToken: string) => Promise) | null = null;\n\n setSession(session: Session): void {\n this.session = session;\n this.notify('SESSION_SET', session);\n }\n\n getAccessToken(): string | null {\n return this.session?.accessToken ?? null;\n }\n\n getRefreshToken(): string | null {\n return this.session?.refreshToken ?? null;\n }\n\n clearSession(): void {\n this.session = null;\n this.notify('SESSION_CLEARED', null);\n }\n\n isExpired(): boolean {\n if (!this.session) return true;\n return Date.now() >= this.session.expiresAt;\n }\n\n async refreshSession(): Promise {\n if (!this.session?.refreshToken || !this.refreshFunction) {\n return;\n }\n\n // Collapse concurrent refresh calls into a single request\n if (this.refreshPromise) {\n return this.refreshPromise;\n }\n\n // Re-entrancy guard: the wired refreshFunction issues its own HTTP request\n // (POST /auth/token/refresh) through HttpClient, whose pre-flight calls\n // refreshSession() again SYNCHRONOUSLY — before `refreshPromise` below is\n // assigned (the whole chain runs before the first real await). Without\n // this flag that recursion is unbounded (stack overflow). Returning early\n // lets the refresh request itself proceed unauthenticated — it carries\n // the refresh token in its body, not the Bearer header.\n if (this.refreshing) {\n return;\n }\n\n this.refreshing = true;\n this.refreshPromise = this.executeRefresh(this.session.refreshToken);\n\n try {\n await this.refreshPromise;\n } finally {\n this.refreshPromise = null;\n this.refreshing = false;\n }\n }\n\n onAuthStateChange(callback: AuthStateCallback): Unsubscribe {\n this.listeners.add(callback);\n return () => {\n this.listeners.delete(callback);\n };\n }\n\n private async executeRefresh(refreshToken: string): Promise {\n if (!this.refreshFunction) return;\n const startedSession = this.session;\n try {\n const newSession = await this.refreshFunction(refreshToken);\n // Sign-out, a new sign-in, or another session adoption takes precedence\n // over a refresh that started against an older session.\n if (this.session === startedSession) this.setSession(newSession);\n } catch (error) {\n // The caller would clear its session on a terminal refresh error. An\n // error from an older session must not clear a newer one.\n if (this.session === startedSession) throw error;\n }\n }\n\n private notify(event: 'SESSION_SET' | 'SESSION_CLEARED', session: Session | null): void {\n for (const listener of this.listeners) {\n listener(event, session);\n }\n }\n}\n","/**\n * `pb__` → environmentRef ('' if malformed).\n *\n * THE KEY IS THE ONLY SOURCE. There is no `environmentRef` on `PalbeConfig` to\n * prefer over this parse: the field was a second copy of what the key already\n * carries, `palbase link` was measured writing one value while minting a key\n * carrying another, and it was removed everywhere (see `runtime.ts`'s note).\n * So app-bound runtime storage (`runtime.ts`) and palbe/next cookie naming\n * (client, server, proxy, callback) all reach the ref through the publishable\n * parser below, off `config.apiKey`.\n *\n * The key is shape-validated (prefix `pb`, a 4-24 character lowercase ASCII\n * alphanumeric environmentRef, and a `` secret\n * segment where scope ∈ {c,s}) before a ref is returned.\n *\n * THE SECRET'S LENGTH IS NOT PART OF THE CONTRACT — only its floor is. Two\n * minters ship two lengths (the stack's own `initenv` writes 20 base62, the\n * cloud control plane writes 32), and the gate that actually admits a request\n * says so outright: *\"a shorter or longer secret is not a security property\n * this door can rule on, and refusing one would only turn off a stack whose key\n * works everywhere else\"* (v2/internal/platform/identitymw.go: parseAPIKey).\n * Pinning EXACTLY 20 here made this SDK refuse every key the cloud has ever\n * minted (measured 2026-08-25: `buildRuntime` threw and palbe-gen never ran).\n * The floor stays, because the short/loose body is what the finding below was\n * about; the ceiling was never anyone's rule. A structurally-invalid key returns\n * '' so session storage stays\n * UNSCOPED rather than getting bound to a partially-parsed ref — a loose parse\n * (e.g. `pb_victim_cXX`) must not scope persisted sessions to `victim` and\n * hydrate a session belonging to a different, real key. The backend remains the\n * authority that rejects a bad key on the first request; this keeps the client's\n * local session-storage scoping honest. (Audit finding apikey-ref-mismatch.)\n */\nconst API_KEY_RE = /^pb_([a-z0-9]{4,24})_[cs][A-Za-z0-9]{20,}$/;\nconst PUBLISHABLE_API_KEY_RE = /^pb_([a-z0-9]{4,24})_c[A-Za-z0-9]{20,}$/;\n\nexport function environmentRefFromApiKey(apiKey: string): string {\n const m = API_KEY_RE.exec(apiKey);\n return m ? (m[1] ?? '') : '';\n}\n\n/** Internal app-runtime parser: browser config accepts publishable keys only. */\nexport function environmentRefFromPublishableApiKey(apiKey: string): string {\n const match = PUBLISHABLE_API_KEY_RE.exec(apiKey);\n return match ? (match[1] ?? '') : '';\n}\n","import { PalbaseError, type PalbaseResponse } from '@palbase/core';\n\nexport interface FieldError {\n field: string;\n message: string;\n}\n\nexport type BackendErrorKind =\n | 'notConfigured'\n | 'validation'\n | 'unauthorized'\n | 'rateLimited'\n | 'server'\n | 'network'\n | 'decode';\n\ninterface BackendErrorParams {\n code: string;\n message: string;\n status?: number;\n requestId?: string;\n fields?: FieldError[];\n retryAfter?: number;\n data?: unknown;\n}\n\nexport class BackendError extends Error {\n readonly kind: BackendErrorKind;\n readonly code: string;\n readonly status: number;\n readonly requestId?: string;\n readonly fields?: FieldError[];\n readonly retryAfter?: number;\n readonly data?: unknown;\n\n constructor(kind: BackendErrorKind, params: BackendErrorParams) {\n super(params.message);\n this.name = 'BackendError';\n this.kind = kind;\n this.code = params.code;\n this.status = params.status ?? 0;\n this.requestId = params.requestId;\n this.fields = params.fields;\n this.retryAfter = params.retryAfter;\n this.data = params.data;\n }\n\n static notConfigured(): BackendError {\n return new BackendError('notConfigured', {\n code: 'not_configured',\n message:\n \"Palbe is not configured. Run 'palbase web link' in your project and make sure palbe.gen.ts is imported once at app startup.\",\n });\n }\n}\n\nfunction isFieldErrorArray(value: unknown): value is FieldError[] {\n return (\n Array.isArray(value) &&\n value.length > 0 &&\n value.every(\n (v) =>\n typeof v === 'object' &&\n v !== null &&\n typeof (v as Record).field === 'string' &&\n typeof (v as Record).message === 'string',\n )\n );\n}\n\n/**\n * Find the field-error array in a wire envelope.\n *\n * `data.fields` IS THE CONTRACT: the backend SDK declares\n * `bad_request: { fields: [{ field, message }] }` in its error registry, so\n * codegen types it as `error.data.fields`, `throw new BadRequest({ fields })`\n * answers in that shape, and — since 22.1.0 — so do the engine's own automatic\n * `@Body`/`@QueryParams`/`@Headers` refusals.\n *\n * The top-level `fields` is the SAME array as emitted by backend 22.0.x and\n * earlier, which is still what every tenant deployed before that release\n * answers. A browser gets the SDK long before its tenant redeploys, so this\n * reader covers both until the fleet has rolled; drop it once it has.\n *\n * A nested `details: [{ field, message }]` was read here until 8.0.0 and is NOT\n * read any more: no Palbase surface has ever emitted it. Believing in it is why\n * `kind: 'validation'` was unreachable for every real 400 the platform sends.\n */\nfunction fieldErrorsOf(envelope: unknown): FieldError[] | undefined {\n const scoped = pickField(pickField(envelope, 'data'), 'fields');\n if (isFieldErrorArray(scoped)) return scoped;\n const flat = pickField(envelope, 'fields');\n return isFieldErrorArray(flat) ? flat : undefined;\n}\n\n/**\n * Find the rate-limit hint in a wire envelope.\n *\n * Two producers, both real and both measured. palauth answers a lockout with a\n * top-level `retry_after` (`auth/internal/ratelimit/limiter.go`). Everything\n * built on the backend SDK — the engine's per-route limiter, and\n * `throw new TooManyRequests({ retryAfter })` — answers with `data.retryAfter`,\n * the name its error registry publishes and codegen types.\n */\nfunction retryAfterOf(envelope: unknown): number | undefined {\n return (\n pickNumber(envelope, 'retry_after') ?? pickNumber(pickField(envelope, 'data'), 'retryAfter')\n );\n}\n\nfunction pickField(value: unknown, key: string): unknown {\n if (typeof value === 'object' && value !== null) {\n return (value as Record)[key];\n }\n return undefined;\n}\n\nfunction pickNumber(value: unknown, key: string): number | undefined {\n const n = pickField(value, key);\n return typeof n === 'number' ? n : undefined;\n}\n\nfunction pickString(value: unknown, key: string): string | undefined {\n const s = pickField(value, key);\n return typeof s === 'string' ? s : undefined;\n}\n\nexport function fromPalbaseError(err: PalbaseError): BackendError {\n // HttpClient stores the WHOLE wire envelope as err.details:\n // { error, error_description, status, request_id, retry_after?, data? }\n const base: BackendErrorParams = {\n code: err.code,\n message: err.message,\n status: err.status,\n requestId: pickString(err.details, 'request_id'),\n data: pickField(err.details, 'data'),\n };\n if (err.code === 'network_error') return new BackendError('network', base);\n if (err.status === 401) return new BackendError('unauthorized', base);\n if (err.status === 429)\n return new BackendError('rateLimited', { ...base, retryAfter: retryAfterOf(err.details) });\n const fields = fieldErrorsOf(err.details);\n if (err.status === 400 && fields) return new BackendError('validation', { ...base, fields });\n // Fallthrough also covers status-0 non-network errors (e.g. auth client's\n // synthetic 'no_refresh_token' with status 0) — those intentionally map to 'server'.\n return new BackendError('server', base);\n}\n\n/** Decode a raw wire body (used by paths that bypass HttpClient, e.g. upload). */\nexport function fromEnvelope(status: number, body: unknown): BackendError {\n const code = pickString(body, 'error') ?? 'http_error';\n const message = pickString(body, 'error_description') ?? `HTTP ${status}`;\n const requestId = pickString(body, 'request_id');\n const params: BackendErrorParams = {\n code,\n message,\n status,\n requestId,\n data: pickField(body, 'data'),\n };\n if (status === 401) return new BackendError('unauthorized', params);\n if (status === 429)\n return new BackendError('rateLimited', { ...params, retryAfter: retryAfterOf(body) });\n const fields = fieldErrorsOf(body);\n if (status === 400 && fields) return new BackendError('validation', { ...params, fields });\n return new BackendError('server', params);\n}\n\n/**\n * Type guard for BackendError that survives module-identity splits.\n * This package ships dual ESM + CJS builds; if both end up loaded (or the\n * package is installed twice), two distinct BackendError classes coexist and\n * `instanceof` fails for errors thrown by \"the other\" copy. Falls back to a\n * structural check on `name` + `kind`.\n */\nexport function isBackendError(e: unknown): e is BackendError {\n return (\n e instanceof BackendError ||\n (typeof e === 'object' &&\n e !== null &&\n (e as Record).name === 'BackendError' &&\n typeof (e as Record).kind === 'string')\n );\n}\n\n/**\n * Structural fallback after instanceof for PalbaseError — same dual ESM+CJS\n * identity-split rationale as isBackendError above: two loaded PalbaseError\n * classes break `instanceof` across copies; the name check bridges that.\n * Returns the error as PalbaseError, or null when it isn't one.\n */\nexport function asPalbaseError(e: unknown): PalbaseError | null {\n if (e instanceof PalbaseError) return e;\n if (e instanceof Error && e.name === 'PalbaseError') return e as PalbaseError;\n return null;\n}\n\n/** Convert an internal {data,error} envelope into data-or-throw. */\nexport function unwrap(res: PalbaseResponse): T {\n if (res.error) throw fromPalbaseError(res.error);\n return res.data as T;\n}\n","/**\n * Session-cookie codec shared by EVERY palbe/next surface (browser storage\n * adapter, pbServer cookie adapter, middleware, auth callback). Pure\n * functions — no 'next' imports, no palbe runtime imports — so both sides\n * provably read and write the SAME bytes.\n *\n * Format (P3 design contract):\n * - name: `palbe-session-`; overflow chunk names append `.0`,\n * `.1`, … (cookie names otherwise avoid dots — tooling friendliness).\n * - value: `encodeURIComponent(JSON.stringify({ a, r, e }))` with a=access\n * token, r=refresh token, e=expiry (ms epoch).\n * - one cookie when the encoded value fits MAX_COOKIE_VALUE chars, else\n * chunks ONLY (the base name must not coexist with chunks — callers clear\n * stale names via clearedSessionCookieNames before writing, then honor the\n * encode result's `clear` overflow guard after writing).\n */\n\nexport { environmentRefFromApiKey } from '../api-key.js';\n\nexport interface StoredSession {\n accessToken: string;\n refreshToken: string;\n /** ms epoch */\n expiresAt: number;\n}\n\n/** Browsers cap a cookie at ~4096 bytes incl. name + attributes; 3500 leaves headroom. */\nconst MAX_COOKIE_VALUE = 3500;\n\n/**\n * The P3 cookie contract attributes, shared by every server-side writer\n * (pbServer adapter, middleware, callback); the browser writer mirrors them\n * in document.cookie string form (next/client.ts). NOT HttpOnly by design —\n * the browser SDK must read/write the session (Supabase-paradigm tradeoff);\n * Max-Age = 30d = the refresh-token TTL.\n */\nexport const SESSION_COOKIE_ATTRS = {\n path: '/',\n sameSite: 'lax',\n secure: true,\n maxAge: 2_592_000,\n} as const;\n\nexport function sessionCookieName(environmentRef: string): string {\n return `palbe-session-${environmentRef}`;\n}\n\nexport interface SessionCookieWrite {\n /** Cookies to SET, in order. */\n set: Array<{ name: string; value: string }>;\n /**\n * Names to DELETE alongside the set: the one-past-the-end OVERFLOW GUARD\n * (base write → `.0`; chunks `.0..n` → `.(n+1)`). Decode stops at the\n * first missing chunk, so deleting exactly one-past-the-end guarantees a\n * stale orphan chunk (left behind a gap, where presence-probing cleanup\n * cannot see it) can never concatenate into the freshly written run.\n * Writers MUST honor both lists.\n */\n clear: string[];\n}\n\nexport function encodeSessionCookies(\n environmentRef: string,\n session: StoredSession,\n): SessionCookieWrite {\n const name = sessionCookieName(environmentRef);\n const value = encodeURIComponent(\n JSON.stringify({ a: session.accessToken, r: session.refreshToken, e: session.expiresAt }),\n );\n if (value.length <= MAX_COOKIE_VALUE) {\n return { set: [{ name, value }], clear: [`${name}.0`] };\n }\n const chunks: Array<{ name: string; value: string }> = [];\n // Chunk WITHOUT splitting a %XX escape (every '%' in the encoded value\n // starts one — encodeURIComponent never emits a bare '%'). Next's cookie\n // layer percent-DECODES values on read and silently DROPS a cookie whose\n // value is an invalid escape sequence, so a split escape would lose that\n // chunk server-side; independent decodability also lets\n // encodeSessionCookiesDecoded mirror this run byte-exactly.\n for (let start = 0; start < value.length; ) {\n let end = Math.min(start + MAX_COOKIE_VALUE, value.length);\n if (end < value.length) {\n if (value[end - 1] === '%') end -= 1;\n else if (value[end - 2] === '%') end -= 2;\n }\n chunks.push({ name: `${name}.${chunks.length}`, value: value.slice(start, end) });\n start = end;\n }\n return { set: chunks, clear: [`${name}.${chunks.length}`] };\n}\n\n/**\n * encodeSessionCookies for percent-ENCODING cookie stores. Next's request\n * and response cookie APIs apply encodeURIComponent to values when\n * serializing (and decodeURIComponent on read) — handing them the codec's\n * already-encoded values would DOUBLE-encode the wire bytes and break the\n * browser-side reader. This variant returns the same cookie run with\n * DECODED values: `encodeURIComponent(value)` reproduces the\n * encodeSessionCookies bytes exactly (chunk boundaries never split an\n * escape), so an encoding store writes byte-identical cookies to a raw\n * writer like document.cookie.\n */\nexport function encodeSessionCookiesDecoded(\n environmentRef: string,\n session: StoredSession,\n): SessionCookieWrite {\n const { set, clear } = encodeSessionCookies(environmentRef, session);\n return {\n set: set.map(({ name, value }) => ({ name, value: decodeURIComponent(value) })),\n clear,\n };\n}\n\n/**\n * Read the session back from a cookie getter: the base name wins; otherwise\n * `.0`, `.1`, … are concatenated until the first missing chunk. Tolerant:\n * malformed URI escapes / JSON / shape → null (treated as \"no session\").\n *\n * Accepts BOTH value forms. Next's cookie stores percent-DECODE values once\n * on read, so server-side callers (pbServer adapter, middleware) hand us the\n * already-decoded JSON; raw readers (document.cookie) hand us the encoded\n * form. The raw (already-decoded) parse runs FIRST because it is\n * unambiguous — an encoded value can never raw-parse as JSON\n * (encodeURIComponent escapes `{` itself, so it starts with `%7B`) — whereas\n * decode-first would silently corrupt a literal `%XX` run inside a token\n * (decodeURIComponent('%41') → 'A', no throw) or throw on an invalid escape.\n */\nexport function decodeSessionCookies(\n get: (name: string) => string | undefined,\n environmentRef: string,\n): StoredSession | null {\n const base = sessionCookieName(environmentRef);\n let encoded = get(base);\n if (encoded === undefined) {\n let joined = '';\n for (let i = 0; ; i++) {\n const part = get(`${base}.${i}`);\n if (part === undefined) break;\n joined += part;\n }\n if (joined === '') return null;\n encoded = joined;\n }\n const raw = parseStoredSession(encoded);\n if (raw !== null) return raw;\n try {\n return parseStoredSession(decodeURIComponent(encoded));\n } catch {\n return null;\n }\n}\n\n/** JSON-parse + shape-check one candidate value; malformed → null. */\nfunction parseStoredSession(json: string): StoredSession | null {\n try {\n const parsed: unknown = JSON.parse(json);\n if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {\n const obj = parsed as Record;\n if (typeof obj.a === 'string' && typeof obj.r === 'string' && typeof obj.e === 'number') {\n return { accessToken: obj.a, refreshToken: obj.r, expiresAt: obj.e };\n }\n }\n return null;\n } catch {\n return null;\n }\n}\n\n/**\n * Names a writer must delete before/while writing: the base name (when\n * present) plus every existing `.N` chunk, probed in order until the first\n * missing one (writes are always a contiguous `.0..n` run, so a gap means\n * the end of palbe-owned chunks).\n */\nexport function clearedSessionCookieNames(\n environmentRef: string,\n present: (name: string) => boolean,\n): string[] {\n const base = sessionCookieName(environmentRef);\n const names: string[] = [];\n if (present(base)) names.push(base);\n for (let i = 0; ; i++) {\n const chunk = `${base}.${i}`;\n if (!present(chunk)) break;\n names.push(chunk);\n }\n return names;\n}\n\n/**\n * Parse the canonical chunk index out of `palbe-session-.N`; non-chunk\n * names (the bare base, a foreign ref, junk suffixes like `.x` / `.01` /\n * `.-1`) → null. The index is a non-negative integer with NO leading zeros\n * (the encoder emits `.0`, `.1`, … verbatim), so `String(n) === suffix`\n * round-trips it exactly.\n */\nfunction chunkIndex(base: string, name: string): number | null {\n if (!name.startsWith(`${base}.`)) return null;\n const suffix = name.slice(base.length + 1);\n if (!/^\\d+$/.test(suffix)) return null;\n const idx = Number.parseInt(suffix, 10);\n return String(idx) === suffix ? idx : null;\n}\n\n/**\n * getAll-powered orphan sweep — the deletion list a writer with the FULL\n * cookie jar should clear, catching crash-orphans that presence-probing\n * (clearedSessionCookieNames, which stops at the first gap) CANNOT see.\n *\n * Given every cookie name in the jar, returns the `palbe-session-`-family\n * names that are NOT part of a single valid session:\n * - A valid session is EITHER the bare base alone, OR the contiguous chunk\n * run `.0, .1, …, n` (starting at `.0`, no gaps).\n * - Any `.N` beyond the first gap from `.0` is an orphan (incl. ALL chunks\n * when `.0` is absent — no run exists).\n * - The base coexisting with ANY chunk is inconsistent (the contract forbids\n * it; decode lets the base win and silently strands the chunks): the base\n * is kept, the chunks are swept (a fresh write replaces the base in place).\n *\n * Only canonical `.N` names count; foreign refs and malformed suffixes are\n * ignored. Output order: base (if inconsistent) first, then chunks ascending.\n */\nexport function orphanSessionCookieNames(environmentRef: string, allNames: string[]): string[] {\n const base = sessionCookieName(environmentRef);\n const hasBase = allNames.includes(base);\n const indices = new Set();\n for (const name of allNames) {\n const idx = chunkIndex(base, name);\n if (idx !== null) indices.add(idx);\n }\n if (indices.size === 0) return []; // unchunked (base alone) or no palbe cookies\n\n // Length of the contiguous run from .0 (0 when .0 is missing).\n let runLen = 0;\n while (indices.has(runLen)) runLen++;\n\n const orphans: string[] = [];\n // Base coexisting with chunks: base wins on decode → chunks are stale.\n // Sweep the base too only when there are NO chunks behind the run to keep\n // (the contract forbids the mix; clearing chunks alone resolves it, but if\n // the run itself is invalid—no .0—the base is the real session and stays).\n // Decision: when base coexists with ANY chunk, the chunks are orphans; the\n // base is the live session and is kept — UNLESS the chunk set forms a valid\n // run AND there is also a gap-orphan, in which case both base+gap-orphan are\n // inconsistent leftovers. Concretely: keep it simple and SAFE — the base is\n // only swept when it sits alongside a partial/gapped chunk set (a crash mid\n // base→chunk migration), never when chunks form a clean run the base shadows.\n const everyChunkContiguous = indices.size === runLen && runLen > 0;\n if (hasBase && !everyChunkContiguous) orphans.push(base);\n\n for (const idx of [...indices].sort((a, b) => a - b)) {\n if (idx >= runLen) orphans.push(`${base}.${idx}`);\n }\n // Base + clean contiguous run: base wins on decode, chunks are stranded.\n if (hasBase && everyChunkContiguous) {\n for (let i = 0; i < runLen; i++) orphans.push(`${base}.${i}`);\n }\n return orphans;\n}\n","/**\n * The lazy 'next/server' import, shared by every palbe/next surface that\n * builds a NextResponse (palbeProxy, handleAuthCallback).\n *\n * MODULE-GRAPH RULE: this module must stay reachable from the proxy entry,\n * which Next compiles into its own separate bundle — so it may import\n * NOTHING that leads to ../runtime.js. Keep it at errors.js and below.\n * (Global-config lookup, which does reach the runtime, lives in\n * ./global-config.ts.)\n */\nimport { BackendError } from '../errors.js';\n\nlet nextServerModule: Promise | undefined;\n\n/**\n * Lazy 'next/server' import (MODULE-GRAPH RULE: never top-level — importing\n * palbe/next must work without next installed) with a guided failure.\n * The module promise is memoized: bundler dynamic-import machinery can take\n * macrotask-scale hops PER CALL, so without the cache two near-simultaneous\n * middleware invocations could straddle a refresh — every call after the\n * first now resolves in pure microtasks.\n */\nexport async function importNextServer(caller: string): Promise {\n nextServerModule ??= import('next/server');\n try {\n return await nextServerModule;\n } catch (cause) {\n nextServerModule = undefined; // never poison later calls with a cached rejection\n const detail = cause instanceof Error && cause.message ? ` (${cause.message})` : '';\n throw new BackendError('validation', {\n code: 'next_required',\n message: `${caller}() requires Next.js — 'next/server' could not be resolved${detail}.`,\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA,gBAAAA;AAAA,EAAA;AAAA;AAAA,IAGa,WACAA;AAJb;AAAA;AAAA;AAGO,IAAM,YAAY,WAAW;AAC7B,IAAMA,UAAS,WAAW;AAAA;AAAA;;;ACJjC;AAAA;AAAA;AAAA;AAAA;;;ACIO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACjC,YAAY,GAAG;AACX,QAAI;AACJ,QAAI,aAAa,OAAO;AACpB,gBAAU,EAAE;AAAA,IAChB,WACS,OAAO,MAAM,UAAU;AAC5B,gBAAU;AAAA,IACd,OACK;AACD,gBAAU;AAAA,IACd;AACA,UAAM,OAAO;AACb,SAAK,OAAO,KAAK,YAAY;AAAA,EACjC;AACJ;AAKO,IAAM,oBAAN,cAAgC,UAAU;AACjD;AAWO,IAAM,iBAAN,cAA6B,UAAU;AAC9C;AAKO,IAAM,mBAAN,cAA+B,UAAU;AAChD;AAKO,IAAM,aAAN,cAAyB,UAAU;AAC1C;AAKO,IAAM,aAAN,cAAyB,UAAU;AAC1C;AAKO,IAAM,cAAN,cAA0B,UAAU;AAC3C;AAKO,IAAM,YAAN,cAAwB,UAAU;AACzC;AAKO,IAAM,YAAN,cAAwB,UAAU;AACzC;AAKO,IAAM,2BAAN,cAAuC,UAAU;AACxD;AAKO,IAAM,qBAAN,cAAiC,UAAU;AAClD;AAKO,IAAM,oBAAN,cAAgC,UAAU;AACjD;;;AC3FA,IAAM,aAAa,CAAC;AACb,IAAM,gBAAgB,iBAAiB,YAAY,UAAU;AACpE,SAAS,iBAAiB,SAAS,QAAQ;AACvC,SAAO,IAAI,MAAM,SAAS;AAAA,IACtB,IAAI,SAAS,MAAM,WAAW;AAC1B,UAAI,QAAQ,QAAQ;AAChB,eAAO,OAAO,IAAI;AAAA,MACtB,OACK;AACD,eAAO,QAAQ,IAAI;AAAA,MACvB;AAAA,IACJ;AAAA,IACA,IAAI,SAAS,MAAM,OAAO;AACtB,UAAI,QAAQ,QAAQ;AAChB,eAAO,OAAO,IAAI;AAAA,MACtB;AACA,cAAQ,IAAI,IAAI;AAChB,aAAO;AAAA,IACX;AAAA,IACA,eAAe,SAAS,MAAM;AAC1B,UAAI,UAAU;AACd,UAAI,QAAQ,QAAQ;AAChB,eAAO,OAAO,IAAI;AAClB,kBAAU;AAAA,MACd;AACA,UAAI,QAAQ,SAAS;AACjB,eAAO,QAAQ,IAAI;AACnB,kBAAU;AAAA,MACd;AACA,aAAO;AAAA,IACX;AAAA,IACA,QAAQ,SAAS;AACb,YAAM,WAAW,QAAQ,QAAQ,OAAO;AACxC,YAAM,UAAU,QAAQ,QAAQ,MAAM;AACtC,YAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAO,CAAC,GAAG,SAAS,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,GAAG,OAAO;AAAA,IACrE;AAAA,IACA,eAAe,SAAS,MAAM,MAAM;AAChC,UAAI,QAAQ,QAAQ;AAChB,eAAO,OAAO,IAAI;AAAA,MACtB;AACA,cAAQ,eAAe,SAAS,MAAM,IAAI;AAC1C,aAAO;AAAA,IACX;AAAA,IACA,yBAAyB,SAAS,MAAM;AACpC,UAAI,QAAQ,QAAQ;AAChB,eAAO,QAAQ,yBAAyB,QAAQ,IAAI;AAAA,MACxD,OACK;AACD,eAAO,QAAQ,yBAAyB,SAAS,IAAI;AAAA,MACzD;AAAA,IACJ;AAAA,IACA,IAAI,SAAS,MAAM;AACf,aAAO,QAAQ,UAAU,QAAQ;AAAA,IACrC;AAAA,EACJ,CAAC;AACL;;;ACtDA,eAAe,mBAAmB;AAC9B,MAAY,kBAAkB,UAAa,WAAW,WAAW,QAAW;AAExE,WAAO,WAAW,OAAO;AAAA,EAC7B;AAEA,MAAI;AAEA,UAAM,EAAE,WAAAC,WAAU,IAAI,MAAM;AAC5B,WAAOA,WAAU;AAAA,EACrB,SACO,GAAG;AACN,UAAM,IAAI,kBAAkB,CAAC;AAAA,EACjC;AACJ;AACO,IAAM,kBAAN,MAAsB;AAAA,EACzB,cAAc;AACV,WAAO,eAAe,MAAM,QAAQ;AAAA,MAChC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AAAA,EACL;AAAA,EACA,MAAM,SAAS;AACX,QAAI,KAAK,SAAS,QAAW;AACzB;AAAA,IACJ;AACA,SAAK,OAAO,MAAM,iBAAiB;AAAA,EACvC;AACJ;;;AC7BO,IAAM,OAAO;AAAA,EAChB,MAAM;AAAA,EACN,KAAK;AAAA,EACL,MAAM;AAAA,EACN,SAAS;AACb;AAIO,IAAM,QAAQ;AAAA,EACjB,aAAa;AAAA,EACb,qBAAqB;AAAA,EACrB,qBAAqB;AAAA,EACrB,qBAAqB;AAAA,EACrB,0BAA0B;AAAA,EAC1B,uBAAuB;AAAA,EACvB,qBAAqB;AAAA,EACrB,yBAAyB;AAAA,EACzB,UAAU;AAAA,EACV,UAAU;AAAA,EACV,WAAW;AAAA,EACX,OAAO;AACX;AAIO,IAAM,QAAQ;AAAA,EACjB,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,SAAS;AAAA,EACT,SAAS;AAAA,EACT,UAAU;AAAA,EACV,UAAU;AAAA,EACV,eAAe;AAAA,EACf,eAAe;AACnB;AAIO,IAAM,SAAS;AAAA,EAClB,WAAW;AAAA,EACX,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,YAAY;AAChB;;;AChDO,IAAM,qBAAqB;AAC3B,IAAM,oBAAoB;AAE1B,IAAM,qBAAqB;AAE3B,IAAM,QAAwB,oBAAI,WAAW,CAAC;AAE9C,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,MAAM;;;ACTZ,IAAM,sBAAsC,oBAAI,WAAW;AAAA,EAC9D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,CAAC;;;ACFD,IAAM,eAA+B,oBAAI,WAAW;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,CAAC;AACM,SAAS,aAAa,OAAO;AAChC,SAAO,IAAI,WAAW,cAAc,KAAK,CAAC;AAC9C;AACO,SAAS,cAAc,OAAO;AACjC,MAAI,iBAAiB,aAAa;AAC9B,WAAO;AAAA,EACX;AACA,MAAI,YAAY,OAAO,KAAK,GAAG;AAC3B,WAAO,IAAI,WAAW,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,EACjE,MAAM,EAAE;AAAA,EACjB;AACA,SAAO,IAAI,WAAW,KAAK,EAAE,MAAM,EAAE;AACzC;AACO,IAAM,aAAN,cAAyB,gBAAgB;AAAA,EAC5C,cAAc;AACV,UAAM;AACN,WAAO,eAAe,MAAM,MAAM;AAAA,MAC9B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,MAAM;AAAA,IACjB,CAAC;AACD,WAAO,eAAe,MAAM,YAAY;AAAA,MACpC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,YAAY;AAAA,MACpC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,WAAW;AAAA,MACnC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,QACH,MAAM;AAAA,QACN,MAAM;AAAA,QACN,QAAQ;AAAA,MACZ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EACA,KAAK,SAAS;AACV,SAAK,WAAW;AAAA,EACpB;AAAA,EACA,gBAAgB,OAAO,KAAK;AACxB,SAAK,WAAW;AAChB,UAAM,MAAM,IAAI,WAAW,IAAI,KAAK,SAAS,aAAa,MAAM,aAAa,IAAI,UAAU;AAC3F,QAAI,IAAI,cAAc,CAAC;AACvB,QAAI,IAAI,KAAK,UAAU,CAAC;AACxB,QAAI,IAAI,OAAO,IAAI,KAAK,SAAS,UAAU;AAC3C,QAAI,IAAI,KAAK,IAAI,KAAK,SAAS,aAAa,MAAM,UAAU;AAC5D,WAAO;AAAA,EACX;AAAA,EACA,iBAAiB,OAAO,MAAM,KAAK;AAC/B,SAAK,WAAW;AAChB,UAAM,MAAM,IAAI,WAAW,IAAI,KAAK,SAAS,aAAa,MAAM,aAAa,KAAK,UAAU;AAC5F,QAAI,IAAI,IAAI,WAAW,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;AACnC,QAAI,IAAI,cAAc,CAAC;AACvB,QAAI,IAAI,KAAK,UAAU,CAAC;AACxB,QAAI,IAAI,OAAO,IAAI,KAAK,SAAS,UAAU;AAC3C,QAAI,IAAI,MAAM,IAAI,KAAK,SAAS,aAAa,MAAM,UAAU;AAC7D,WAAO;AAAA,EACX;AAAA,EACA,MAAM,QAAQ,MAAM,KAAK;AACrB,UAAM,KAAK,OAAO;AAClB,UAAM,UAAU,KAAK,eAAe,IAC9B,IAAI,YAAY,KAAK,QAAQ,IAC7B,cAAc,IAAI;AACxB,QAAI,QAAQ,eAAe,KAAK,UAAU;AACtC,YAAM,IAAI,kBAAkB,kDAAkD;AAAA,IAClF;AACA,UAAM,SAAS,cAAc,GAAG;AAChC,UAAM,MAAM,MAAM,KAAK,KAAK,UAAU,OAAO,SAAS,KAAK,SAAS,OAAO;AAAA,MACvE;AAAA,IACJ,CAAC;AACD,WAAO,MAAM,KAAK,KAAK,KAAK,QAAQ,KAAK,MAAM;AAAA,EACnD;AAAA,EACA,MAAM,OAAO,KAAK,MAAM,KAAK;AACzB,UAAM,KAAK,OAAO;AAClB,UAAM,SAAS,cAAc,GAAG;AAChC,UAAM,MAAM,MAAM,KAAK,KAAK,UAAU,OAAO,QAAQ,KAAK,SAAS,OAAO;AAAA,MACtE;AAAA,IACJ,CAAC;AACD,UAAM,MAAM,IAAI,YAAY,GAAG;AAC/B,UAAM,WAAW,IAAI,WAAW,GAAG;AACnC,QAAI,OAAO;AACX,UAAM,MAAM,aAAa,IAAI;AAC7B,UAAM,OAAO,IAAI,WAAW,CAAC;AAC7B,QAAI,MAAM,MAAM,KAAK,UAAU;AAC3B,YAAM,IAAI,MAAM,uBAAuB;AAAA,IAC3C;AACA,UAAM,MAAM,IAAI,WAAW,KAAK,WAAW,IAAI,SAAS,CAAC;AACzD,aAAS,IAAI,GAAG,MAAM,GAAG,MAAM,SAAS,QAAQ,KAAK;AACjD,WAAK,CAAC,IAAI;AACV,UAAI,IAAI,MAAM,CAAC;AACf,UAAI,IAAI,KAAK,KAAK,MAAM;AACxB,UAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM;AACtC,aAAO,IAAI,WAAW,MAAM,KAAK,KAAK,KAAK,QAAQ,KAAK,IAAI,MAAM,GAAG,KAAK,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC;AACnG,UAAI,SAAS,SAAS,OAAO,KAAK,QAAQ;AACtC,iBAAS,IAAI,MAAM,GAAG;AACtB,eAAO,KAAK;AAAA,MAChB,OACK;AACD,iBAAS,IAAI,KAAK,MAAM,GAAG,SAAS,SAAS,GAAG,GAAG,GAAG;AACtD,eAAO,SAAS,SAAS;AAAA,MAC7B;AAAA,IACJ;AACA,WAAO;AAAA,EACX;AAAA,EACA,MAAM,iBAAiB,MAAM,KAAK,MAAM,KAAK;AACzC,UAAM,KAAK,OAAO;AAClB,UAAM,SAAS,cAAc,GAAG;AAChC,UAAM,UAAU,MAAM,KAAK,KAAK,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACtF,WAAO,MAAM,KAAK,KAAK,WAAW;AAAA,MAC9B,MAAM;AAAA,MACN,MAAM,KAAK,QAAQ;AAAA,MACnB,MAAM,cAAc,IAAI;AAAA,MACxB,MAAM,cAAc,IAAI;AAAA,IAC5B,GAAG,SAAS,MAAM,CAAC;AAAA,EACvB;AAAA,EACA,MAAM,eAAe,MAAM,OAAO,KAAK;AACnC,WAAO,MAAM,KAAK,QAAQ,MAAM,KAAK,gBAAgB,OAAO,GAAG,CAAC;AAAA,EACpE;AAAA,EACA,MAAM,cAAc,KAAK,OAAO,MAAM,KAAK;AACvC,WAAO,MAAM,KAAK,OAAO,KAAK,KAAK,iBAAiB,OAAO,MAAM,GAAG,GAAG,GAAG;AAAA,EAC9E;AAAA,EACA,aAAa;AACT,QAAI,KAAK,aAAa,OAAO;AACzB,YAAM,IAAI,MAAM,8BAA8B;AAAA,IAClD;AAAA,EACJ;AACJ;AACO,IAAM,mBAAN,cAA+B,WAAW;AAAA,EAC7C,cAAc;AACV,UAAM,GAAG,SAAS;AAElB,WAAO,eAAe,MAAM,MAAM;AAAA,MAC9B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,MAAM;AAAA,IACjB,CAAC;AAED,WAAO,eAAe,MAAM,YAAY;AAAA,MACpC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AAED,WAAO,eAAe,MAAM,WAAW;AAAA,MACnC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,QACH,MAAM;AAAA,QACN,MAAM;AAAA,QACN,QAAQ;AAAA,MACZ;AAAA,IACJ,CAAC;AAAA,EACL;AACJ;;;AC/JO,IAAM,kBAAkB,CAAC,MAAM,OAAO,MAAM,YAC/C,MAAM,QACN,OAAO,EAAE,eAAe,YACxB,OAAO,EAAE,cAAc;AAIpB,SAAS,MAAM,GAAG,GAAG;AACxB,MAAI,KAAK,GAAG;AACR,UAAM,IAAI,MAAM,uBAAuB;AAAA,EAC3C;AACA,MAAI,KAAK,OAAO,GAAG;AACf,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC9C;AACA,QAAM,MAAM,IAAI,WAAW,CAAC;AAC5B,WAAS,IAAI,GAAG,IAAI,KAAK,GAAG,KAAK;AAC7B,QAAI,KAAK,IAAI,EAAE,IAAI,IAAI;AACvB,QAAI,KAAK,MAAM,IAAI,GAAG;AAAA,EAC1B;AACA,SAAO;AACX;AAOO,SAAS,OAAO,GAAG,GAAG;AACzB,QAAM,MAAM,IAAI,WAAW,EAAE,SAAS,EAAE,MAAM;AAC9C,MAAI,IAAI,GAAG,CAAC;AACZ,MAAI,IAAI,GAAG,EAAE,MAAM;AACnB,SAAO;AACX;AAMO,SAAS,iBAAiB,GAAG;AAChC,QAAM,SAAS,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACrD,QAAM,aAAa,KAAK,MAAM;AAC9B,QAAM,MAAM,IAAI,WAAW,WAAW,MAAM;AAC5C,WAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK;AACxC,QAAI,CAAC,IAAI,WAAW,WAAW,CAAC;AAAA,EACpC;AACA,SAAO;AACX;AAkFA,eAAsB,aAAa;AAC/B,MAAI,OAAe,kBAAkB,eAAe,WAAW,WAAW,QAAW;AAEjF,WAAO,WAAW;AAAA,EACtB;AAEA,MAAI;AAEA,UAAM,EAAE,WAAAC,WAAU,IAAI,MAAM;AAC5B,WAAOA;AAAA,EACX,SACO,IAAI;AACP,UAAM,IAAI,MAAM,uBAAuB;AAAA,EAC3C;AACJ;AAIO,SAAS,IAAI,GAAG,GAAG;AACtB,MAAI,EAAE,eAAe,EAAE,YAAY;AAC/B,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAClD;AACA,QAAM,MAAM,IAAI,WAAW,EAAE,UAAU;AACvC,WAAS,IAAI,GAAG,IAAI,EAAE,YAAY,KAAK;AACnC,QAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;AAAA,EACvB;AACA,SAAO;AACX;;;ACzKA,IAAM,gBAAgC,oBAAI,WAAW;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,CAAC;AAGD,IAAM,sBAAsC,oBAAI,WAAW;AAAA,EACvD;AAAA,EAAK;AAAA,EAAK;AAAA,EAAI;AAAA,EAAK;AAAA,EAAK;AAAA,EAAK;AAAA,EAAI;AAAA,EAAK;AAAA,EAAK;AAAA,EAC3C;AAAA,EAAK;AAAA,EAAK;AACd,CAAC;AACD,SAAS,QAAQ,GAAG,GAAG,GAAG;AACtB,QAAM,MAAM,IAAI,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM;AACzD,MAAI,IAAI,GAAG,CAAC;AACZ,MAAI,IAAI,GAAG,EAAE,MAAM;AACnB,MAAI,IAAI,GAAG,EAAE,SAAS,EAAE,MAAM;AAC9B,SAAO;AACX;AACO,IAAM,QAAN,MAAY;AAAA,EACf,YAAY,IAAI,MAAM,KAAK;AACvB,WAAO,eAAe,MAAM,MAAM;AAAA,MAC9B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,cAAc;AAAA,MACtC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,WAAW;AAAA,MACnC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,iBAAiB;AAAA,MACzC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,kBAAkB;AAAA,MAC1C,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,SAAS;AAAA,MACjC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,QAAQ;AAAA,MAChC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,SAAK,KAAK;AACV,SAAK,QAAQ;AACb,SAAK,OAAO;AACZ,UAAM,UAAU,IAAI,WAAW,mBAAmB;AAClD,YAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,GAAG,CAAC;AAChC,SAAK,KAAK,KAAK,OAAO;AAAA,EAC1B;AAAA,EACA,MAAM,mBAAmB,KAAK;AAC1B,WAAO,MAAM,KAAK,MAAM,mBAAmB,GAAG;AAAA,EAClD;AAAA,EACA,MAAM,qBAAqB,KAAK;AAC5B,WAAO,MAAM,KAAK,MAAM,qBAAqB,cAAc,GAAG,CAAC;AAAA,EACnE;AAAA,EACA,MAAM,oBAAoB,KAAK;AAC3B,WAAO,MAAM,KAAK,MAAM,oBAAoB,GAAG;AAAA,EACnD;AAAA,EACA,MAAM,sBAAsB,KAAK;AAC7B,WAAO,MAAM,KAAK,MAAM,sBAAsB,cAAc,GAAG,CAAC;AAAA,EACpE;AAAA,EACA,MAAM,UAAU,QAAQ,KAAK,WAAW,MAAM;AAC1C,WAAO,MAAM,KAAK,MAAM,UAAU,QAAQ,KAAK,QAAQ;AAAA,EAC3D;AAAA,EACA,MAAM,kBAAkB;AACpB,WAAO,MAAM,KAAK,MAAM,gBAAgB;AAAA,EAC5C;AAAA,EACA,MAAM,cAAc,KAAK;AACrB,UAAM,SAAS,cAAc,GAAG;AAChC,QAAI,OAAO,aAAa,oBAAoB;AACxC,YAAM,IAAI,kBAAkB,cAAc;AAAA,IAC9C;AACA,WAAO,MAAM,KAAK,MAAM,cAAc,MAAM;AAAA,EAChD;AAAA,EACA,MAAM,MAAM,QAAQ;AAChB,QAAI;AACJ,QAAI,OAAO,QAAQ,QAAW;AAC1B,WAAK,MAAM,KAAK,gBAAgB;AAAA,IACpC,WACS,gBAAgB,OAAO,GAAG,GAAG;AAElC,WAAK,OAAO;AAAA,IAChB,OACK;AAED,WAAK,MAAM,KAAK,cAAc,OAAO,GAAG;AAAA,IAC5C;AACA,UAAM,MAAM,MAAM,KAAK,MAAM,mBAAmB,GAAG,SAAS;AAC5D,UAAM,OAAO,MAAM,KAAK,MAAM,mBAAmB,OAAO,kBAAkB;AAC1E,QAAI;AACA,UAAI;AACJ,UAAI,OAAO,cAAc,QAAW;AAChC,aAAK,IAAI,WAAW,MAAM,KAAK,MAAM,GAAG,GAAG,YAAY,OAAO,kBAAkB,CAAC;AAAA,MACrF,OACK;AACD,cAAM,MAAM,gBAAgB,OAAO,SAAS,IACtC,OAAO,UAAU,aACjB,OAAO;AACb,cAAM,MAAM,IAAI,WAAW,MAAM,KAAK,MAAM,GAAG,GAAG,YAAY,OAAO,kBAAkB,CAAC;AACxF,cAAM,MAAM,IAAI,WAAW,MAAM,KAAK,MAAM,GAAG,KAAK,OAAO,kBAAkB,CAAC;AAC9E,aAAK,OAAO,KAAK,GAAG;AAAA,MACxB;AACA,UAAI;AACJ,UAAI,OAAO,cAAc,QAAW;AAChC,qBAAa,OAAO,IAAI,WAAW,GAAG,GAAG,IAAI,WAAW,IAAI,CAAC;AAAA,MACjE,OACK;AACD,cAAM,MAAM,gBAAgB,OAAO,SAAS,IACtC,OAAO,UAAU,YACjB,MAAM,KAAK,MAAM,gBAAgB,OAAO,SAAS;AACvD,cAAM,OAAO,MAAM,KAAK,MAAM,mBAAmB,GAAG;AACpD,qBAAa,QAAQ,IAAI,WAAW,GAAG,GAAG,IAAI,WAAW,IAAI,GAAG,IAAI,WAAW,IAAI,CAAC;AAAA,MACxF;AACA,YAAM,eAAe,MAAM,KAAK,sBAAsB,IAAI,UAAU;AACpE,aAAO;AAAA,QACH;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,SACO,GAAG;AACN,YAAM,IAAI,WAAW,CAAC;AAAA,IAC1B;AAAA,EACJ;AAAA,EACA,MAAM,MAAM,QAAQ;AAChB,UAAM,MAAM,cAAc,OAAO,GAAG;AACpC,UAAM,MAAM,MAAM,KAAK,MAAM,qBAAqB,GAAG;AACrD,UAAM,MAAM,gBAAgB,OAAO,YAAY,IACzC,OAAO,aAAa,aACpB,OAAO;AACb,UAAM,MAAM,gBAAgB,OAAO,YAAY,IACzC,OAAO,aAAa,YACpB,MAAM,KAAK,MAAM,gBAAgB,OAAO,YAAY;AAC1D,UAAM,OAAO,MAAM,KAAK,MAAM,mBAAmB,GAAG;AACpD,QAAI;AACA,UAAI;AACJ,UAAI,OAAO,oBAAoB,QAAW;AACtC,aAAK,IAAI,WAAW,MAAM,KAAK,MAAM,GAAG,KAAK,GAAG,CAAC;AAAA,MACrD,OACK;AACD,cAAM,MAAM,IAAI,WAAW,MAAM,KAAK,MAAM,GAAG,KAAK,GAAG,CAAC;AACxD,cAAM,MAAM,IAAI,WAAW,MAAM,KAAK,MAAM,GAAG,KAAK,OAAO,eAAe,CAAC;AAC3E,aAAK,OAAO,KAAK,GAAG;AAAA,MACxB;AACA,UAAI;AACJ,UAAI,OAAO,oBAAoB,QAAW;AACtC,qBAAa,OAAO,IAAI,WAAW,GAAG,GAAG,IAAI,WAAW,IAAI,CAAC;AAAA,MACjE,OACK;AACD,cAAM,OAAO,MAAM,KAAK,MAAM,mBAAmB,OAAO,eAAe;AACvE,qBAAa,IAAI,WAAW,IAAI,aAAa,KAAK,aAAa,KAAK,UAAU;AAC9E,mBAAW,IAAI,IAAI,WAAW,GAAG,GAAG,CAAC;AACrC,mBAAW,IAAI,IAAI,WAAW,IAAI,GAAG,IAAI,UAAU;AACnD,mBAAW,IAAI,IAAI,WAAW,IAAI,GAAG,IAAI,aAAa,KAAK,UAAU;AAAA,MACzE;AACA,aAAO,MAAM,KAAK,sBAAsB,IAAI,UAAU;AAAA,IAC1D,SACO,GAAG;AACN,YAAM,IAAI,WAAW,CAAC;AAAA,IAC1B;AAAA,EACJ;AAAA,EACA,MAAM,sBAAsB,IAAI,YAAY;AACxC,UAAM,aAAa,KAAK,KAAK,gBAAgB,eAAe,EAAE;AAC9D,UAAM,cAAc,KAAK,KAAK,iBAAiB,qBAAqB,YAAY,KAAK,UAAU;AAC/F,WAAO,MAAM,KAAK,KAAK,iBAAiB,OAAO,YAAY,aAAa,KAAK,UAAU;AAAA,EAC3F;AACJ;;;AClMO,IAAM,aAAa,CAAC,YAAY;AAEhC,IAAM,gBAAgC,oBAAI,WAAW;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,CAAC;AAEM,IAAM,WAA2B,oBAAI,WAAW,CAAC,KAAK,GAAG,CAAC;;;ACgEjE,IAAM,kBAAkB;AAAA,EACpB,IAAI,MAAM,QAAQ;AAAA,EAClB,GAAG;AAAA,EACH,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,gBAAgB;AACpB;;;ACnFO,IAAM,aAAN,MAAiB;AAAA,EACpB,YAAY,MAAM,KAAK,MAAM,SAAS,CAAC,GAAG;AACtC,WAAO,eAAe,MAAM,OAAO;AAAA,MAC/B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,QAAQ;AAAA,MAChC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,eAAe;AAAA,MACvC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,aAAa;AAAA,MACrC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,UAAU;AAAA,MAClC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,SAAK,MAAM;AACX,SAAK,OAAO;AACZ,SAAK,YAAY,EAAE,KAAW;AAC9B,SAAK,SAAS;AACd,QAAI,SAAS,UAAU;AACnB,WAAK,SAAS,CAAC;AAAA,IACnB;AAAA,EACJ;AACJ;;;AC5BO,IAAM,wBAAN,MAA4B;AAAA,EAC/B,YAAY,SAAS,SAAS,OAAO,MAAM;AACvC,WAAO,eAAe,MAAM,YAAY;AAAA,MACpC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,UAAU;AAAA,MAClC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,SAAS;AAAA,MACjC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,QAAQ;AAAA,MAChC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,QAAQ;AAAA,MAChC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,SAAK,WAAW;AAChB,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AAAA,EACjB;AAAA,EACA,mBAAmB,KAAK;AACpB,QAAI;AACA,aAAO,QAAQ,QAAQ,IAAI,IAAI,MAAM;AAAA,IACzC,SACO,GAAG;AACN,aAAO,QAAQ,OAAO,IAAI,eAAe,CAAC,CAAC;AAAA,IAC/C;AAAA,EACJ;AAAA,EACA,MAAM,qBAAqB,KAAK;AAC5B,QAAI;AACA,aAAO,MAAM,KAAK,cAAc,cAAc,GAAG,GAAG,IAAI;AAAA,IAC5D,SACO,GAAG;AACN,YAAM,IAAI,iBAAiB,CAAC;AAAA,IAChC;AAAA,EACJ;AAAA,EACA,oBAAoB,KAAK;AACrB,QAAI;AACA,aAAO,QAAQ,QAAQ,IAAI,IAAI,MAAM;AAAA,IACzC,SACO,GAAG;AACN,aAAO,QAAQ,OAAO,IAAI,eAAe,CAAC,CAAC;AAAA,IAC/C;AAAA,EACJ;AAAA,EACA,MAAM,sBAAsB,KAAK;AAC7B,QAAI;AACA,aAAO,MAAM,KAAK,cAAc,cAAc,GAAG,GAAG,KAAK;AAAA,IAC7D,SACO,GAAG;AACN,YAAM,IAAI,iBAAiB,CAAC;AAAA,IAChC;AAAA,EACJ;AAAA,EACA,MAAM,UAAU,QAAQ,KAAK,UAAU;AACnC,QAAI;AACA,UAAI,WAAW,OAAO;AAClB,eAAO,MAAM,KAAK,cAAc,KAAK,QAAQ;AAAA,MACjD;AAEA,UAAI,eAAe,aAAa;AAC5B,cAAM,IAAI,MAAM,wBAAwB;AAAA,MAC5C;AACA,aAAO,MAAM,KAAK,WAAW,KAAK,QAAQ;AAAA,IAC9C,SACO,GAAG;AACN,YAAM,IAAI,iBAAiB,CAAC;AAAA,IAChC;AAAA,EACJ;AAAA,EACA,MAAM,kBAAkB;AACpB,QAAI;AACA,YAAM,QAAQ,MAAM,KAAK,OAAO,MAAM,gBAAgB;AACtD,YAAM,KAAK,IAAI,WAAW,KAAK,UAAU,OAAO,WAAW,UAAU;AACrE,YAAM,KAAK,MAAM,KAAK,gBAAgB,EAAE;AACxC,aAAO,EAAE,WAAW,IAAI,YAAY,GAAG;AAAA,IAC3C,SACO,GAAG;AACN,YAAM,IAAI,kBAAkB,CAAC;AAAA,IACjC;AAAA,EACJ;AAAA,EACA,MAAM,cAAc,KAAK;AACrB,QAAI;AACA,YAAM,SAAS,cAAc,GAAG;AAChC,YAAM,SAAS,MAAM,KAAK,MAAM,eAAe,MAAM,QAAQ,eAAe,IAAI,WAAW,MAAM,CAAC;AAClG,YAAM,QAAQ,MAAM,KAAK,MAAM,cAAc,QAAQ,UAAU,OAAO,KAAK,IAAI;AAC/E,YAAM,KAAK,IAAI,WAAW,KAAK,UAAU,IAAI,WAAW,KAAK,GAAG,WAAW,UAAU;AACrF,aAAO;AAAA,QACH,YAAY;AAAA,QACZ,WAAW,MAAM,KAAK,gBAAgB,EAAE;AAAA,MAC5C;AAAA,IACJ,SACO,GAAG;AACN,YAAM,IAAI,mBAAmB,CAAC;AAAA,IAClC;AAAA,EACJ;AAAA,EACA,gBAAgB,KAAK;AACjB,QAAI;AACA,YAAM,KAAK,KAAK,OAAO,aAAa,IAAI,GAAG;AAC3C,aAAO,QAAQ,QAAQ,IAAI,WAAW,KAAK,UAAU,IAAI,QAAQ,CAAC;AAAA,IACtE,SACO,GAAG;AACN,aAAO,QAAQ,OAAO,IAAI,iBAAiB,CAAC,CAAC;AAAA,IACjD;AAAA,EACJ;AAAA,EACA,GAAG,IAAI,IAAI;AACP,QAAI;AACA,aAAO,QAAQ,QAAQ,KAAK,OAAO,gBAAgB,GAAG,KAAK,GAAG,GAAG,EAAE,MAAM;AAAA,IAC7E,SACO,GAAG;AACN,aAAO,QAAQ,OAAO,IAAI,eAAe,CAAC,CAAC;AAAA,IAC/C;AAAA,EACJ;AAAA,EACA,cAAc,KAAK,UAAU;AACzB,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACpC,UAAI,YAAY,IAAI,eAAe,KAAK,MAAM;AAC1C,eAAO,IAAI,MAAM,2BAA2B,CAAC;AAAA,MACjD;AACA,UAAI,CAAC,YAAY,IAAI,eAAe,KAAK,MAAM;AAC3C,eAAO,IAAI,MAAM,2BAA2B,CAAC;AAAA,MACjD;AACA,cAAQ,IAAI,WAAW,KAAK,UAAU,IAAI,WAAW,GAAG,GAAG,WAAW,WAAW,WAAW,WAAW,CAAC,IAAI,UAAU,CAAC;AAAA,IAC3H,CAAC;AAAA,EACL;AAAA,EACA,WAAW,KAAK,UAAU;AACtB,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACpC,UAAI,IAAI,QAAQ,OAAO;AACnB,eAAO,IAAI,MAAM,gBAAgB,IAAI,GAAG,EAAE,CAAC;AAAA,MAC/C;AACA,UAAI,IAAI,QAAQ,KAAK,UAAU;AAC3B,eAAO,IAAI,MAAM,gBAAgB,IAAI,GAAG,EAAE,CAAC;AAAA,MAC/C;AACA,UAAI,UAAU;AACV,YAAI,OAAO,IAAI,MAAM,aAAa;AAC9B,iBAAO,IAAI,MAAM,oCAAoC,CAAC;AAAA,QAC1D;AACA,YAAI,OAAO,IAAI,MAAM,UAAU;AAC3B,iBAAO,IAAI,MAAM,4BAA4B,CAAC;AAAA,QAClD;AACA,gBAAQ,IAAI,WAAW,KAAK,UAAU,iBAAiB,IAAI,CAAC,GAAG,QAAQ,CAAC;AAAA,MAC5E,OACK;AACD,YAAI,OAAO,IAAI,MAAM,UAAU;AAC3B,iBAAO,IAAI,MAAM,4BAA4B,CAAC;AAAA,QAClD;AACA,gBAAQ,IAAI,WAAW,KAAK,UAAU,iBAAiB,IAAI,CAAC,GAAG,WAAW,UAAU,CAAC;AAAA,MACzF;AAAA,IACJ,CAAC;AAAA,EACL;AACJ;;;AChKO,SAAS,QAAQ,GAAG;AACvB,SAAO,aAAa,cACf,YAAY,OAAO,CAAC,KAAK,EAAE,YAAY,SAAS;AACzD;AAEO,SAAS,QAAQ,GAAG,QAAQ,IAAI;AACnC,MAAI,CAAC,OAAO,cAAc,CAAC,KAAK,IAAI,GAAG;AACnC,UAAM,SAAS,SAAS,IAAI,KAAK;AACjC,UAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B,CAAC,EAAE;AAAA,EAC5D;AACJ;AAEO,SAAS,OAAO,OAAO,QAAQ,QAAQ,IAAI;AAC9C,QAAM,QAAQ,QAAQ,KAAK;AAC3B,QAAM,MAAM,OAAO;AACnB,QAAM,WAAW,WAAW;AAC5B,MAAI,CAAC,SAAU,YAAY,QAAQ,QAAS;AACxC,UAAM,SAAS,SAAS,IAAI,KAAK;AACjC,UAAM,QAAQ,WAAW,cAAc,MAAM,KAAK;AAClD,UAAM,MAAM,QAAQ,UAAU,GAAG,KAAK,QAAQ,OAAO,KAAK;AAC1D,UAAM,IAAI,MAAM,SAAS,wBAAwB,QAAQ,WAAW,GAAG;AAAA,EAC3E;AACA,SAAO;AACX;AAGO,SAAS,QAAQ,UAAU,gBAAgB,MAAM;AACpD,MAAI,SAAS;AACT,UAAM,IAAI,MAAM,kCAAkC;AACtD,MAAI,iBAAiB,SAAS,UAAU;AACpC,UAAM,IAAI,MAAM,uCAAuC;AAAA,EAC3D;AACJ;AAEO,SAAS,QAAQ,KAAK,UAAU;AACnC,SAAO,KAAK,QAAW,qBAAqB;AAC5C,QAAM,MAAM,SAAS;AACrB,MAAI,IAAI,SAAS,KAAK;AAClB,UAAM,IAAI,MAAM,sDAAsD,GAAG;AAAA,EAC7E;AACJ;AAEA,SAAS,UAAU,GAAG;AAClB,MAAI,OAAO,MAAM,UAAU;AACvB,QAAI,CAAC,SAAS,CAAC;AACX,YAAM,IAAI,MAAM,mCAAmC,CAAC;AAAA,EAC5D;AAEI,YAAQ,CAAC;AACb,SAAO;AACX;AAEO,SAAS,IAAI,KAAK;AACrB,SAAO,IAAI,YAAY,IAAI,QAAQ,IAAI,YAAY,KAAK,MAAM,IAAI,aAAa,CAAC,CAAC;AACrF;AAEO,SAAS,SAAS,QAAQ;AAC7B,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACpC,WAAO,CAAC,EAAE,KAAK,CAAC;AAAA,EACpB;AACJ;AAEA,IAAM,oBAAoC,oBAAI,YAAY,CAAC,SAAU,CAAC;AACtE,IAAM,mBAAmC,oBAAI,WAAW,kBAAkB,MAAM;AAEzE,IAAM,OAAuB,iBAAiB,CAAC,MAAM;AAyBrD,SAAS,WAAW,KAAK;AAC5B,SAAO,IAAI,SAAS,IAAI,QAAQ,IAAI,YAAY,IAAI,UAAU;AAClE;AAEO,SAAS,KAAK,MAAM,OAAO;AAC9B,SAAQ,QAAS,KAAK,QAAW,SAAS;AAC9C;AAEA,IAAM,gBAAiC;AAAA;AAAA,EAEvC,OAAO,WAAW,KAAK,CAAC,CAAC,EAAE,UAAU;AAAA,EAEjC,OAAO,WAAW,YAAY;AAAA,GAAY;AAE9C,IAAM,QAAwB,sBAAM,KAAK,EAAE,QAAQ,IAAI,GAAG,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AACnG,IAAM,gBAAgC;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ;AAKO,SAAS,WAAW,OAAO;AAC9B,SAAO,KAAK;AAEZ,MAAI;AACA,WAAO,MAAM,MAAM;AAEvB,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACnC,WAAO,MAAM,MAAM,CAAC,CAAC;AAAA,EACzB;AACA,SAAO;AACX;AAEA,IAAM,SAAS,EAAE,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI;AAC7D,SAAS,cAAc,IAAI;AACvB,MAAI,MAAM,OAAO,MAAM,MAAM,OAAO;AAChC,WAAO,KAAK,OAAO;AACvB,MAAI,MAAM,OAAO,KAAK,MAAM,OAAO;AAC/B,WAAO,MAAM,OAAO,IAAI;AAC5B,MAAI,MAAM,OAAO,KAAK,MAAM,OAAO;AAC/B,WAAO,MAAM,OAAO,IAAI;AAC5B;AACJ;AAKO,SAAS,WAAW,KAAK;AAC5B,MAAI,OAAO,QAAQ,UAAU;AACzB,UAAM,IAAI,MAAM,8BAA8B,OAAO,GAAG;AAAA,EAC5D;AAEA,MAAI;AACA,WAAO,WAAW,QAAQ,GAAG;AACjC,QAAM,KAAK,IAAI;AACf,QAAM,KAAK,KAAK;AAChB,MAAI,KAAK,GAAG;AACR,UAAM,IAAI,MAAM,qDAAqD,EAAE;AAAA,EAC3E;AACA,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,WAAS,KAAK,GAAG,KAAK,GAAG,KAAK,IAAI,MAAM,MAAM,GAAG;AAC7C,UAAM,KAAK,cAAc,IAAI,WAAW,EAAE,CAAC;AAC3C,UAAM,KAAK,cAAc,IAAI,WAAW,KAAK,CAAC,CAAC;AAC/C,QAAI,OAAO,UAAa,OAAO,QAAW;AACtC,YAAM,OAAO,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC;AACjC,YAAM,IAAI,MAAM,iDAAiD,OAAO,gBACpE,EAAE;AAAA,IACV;AACA,UAAM,EAAE,IAAI,KAAK,KAAK;AAAA,EAC1B;AACA,SAAO;AACX;AAqBO,SAAS,YAAY,KAAK;AAC7B,MAAI,OAAO,QAAQ,UAAU;AACzB,UAAM,IAAI,MAAM,8BAA8B,OAAO,GAAG;AAAA,EAC5D;AACA,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACjC,UAAM,IAAI,cAAc,IAAI,WAAW,CAAC,CAAC;AACzC,QAAI,MAAM,QAAW;AACjB,YAAM,IAAI,MAAM,iDAAiD,IAAI,CAAC,IAClE,gBAAgB,CAAC;AAAA,IACzB;AACA,UAAO,OAAO,KAAM,cAAc,CAAC;AAAA,EACvC;AACA,SAAO;AACX;AACO,SAAS,eAAe,KAAK;AAChC,UAAQ,KAAK,gBAAgB;AAC7B,MAAI,IAAI;AACR,MAAI,MAAM;AACV,MAAI,MAAM;AACV,SAAO,IAAI,GAAG;AACV,QAAI,IAAI,MAAM;AACV,aAAO;AACX,QAAI,KAAK,MAAM,IAAI,CAAC;AACpB,YAAQ;AAAA,EACZ;AACA,SAAO;AACX;AAKO,SAAS,gBAAgB,OAAO;AACnC,SAAO,YAAY,WAAW,UAAU,OAAO,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AACrE;AACO,SAAS,gBAAgB,GAAG,KAAK;AACpC,UAAQ,GAAG;AACX,MAAI,UAAU,CAAC;AACf,QAAM,MAAM,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,MAAM,GAAG,GAAG,CAAC;AAC5D,MAAI,IAAI,WAAW;AACf,UAAM,IAAI,MAAM,kBAAkB;AACtC,SAAO;AACX;AACO,SAAS,gBAAgB,GAAG,KAAK;AACpC,SAAO,gBAAgB,GAAG,GAAG,EAAE,QAAQ;AAC3C;AAKO,SAAS,UAAU,OAAO;AAC7B,SAAO,WAAW,KAAK,KAAK;AAChC;AAgCA,SAAS,SAAS,GAAG;AACjB,SAAO,OAAO,MAAM,YAAY,OAAO;AAC3C;AACO,SAAS,QAAQ,GAAG,KAAK,KAAK;AACjC,SAAO,SAAS,CAAC,KAAK,SAAS,GAAG,KAAK,SAAS,GAAG,KAAK,OAAO,KAAK,IAAI;AAC5E;AAMO,SAAS,SAAS,OAAO,GAAG,KAAK,KAAK;AAMzC,MAAI,CAAC,QAAQ,GAAG,KAAK,GAAG,GAAG;AACvB,UAAM,IAAI,MAAM,oBAAoB,QAAQ,OAAO,MAAM,aAAa,MAAM,WAAW,CAAC;AAAA,EAC5F;AACJ;AACO,SAAS,eAAe,QAAQ,SAAS,CAAC,GAAG,YAAY,CAAC,GAAG;AAChE,MAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACvC,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACnD;AACA,WAAS,WAAW,WAAW,cAAc,OAAO;AAChD,UAAM,MAAM,OAAO,SAAS;AAC5B,QAAI,SAAS,QAAQ;AACjB;AACJ,UAAM,UAAU,OAAO;AACvB,QAAI,YAAY,gBAAgB,QAAQ,MAAM;AAC1C,YAAM,IAAI,MAAM,UAAU,SAAS,0BAA0B,YAAY,SAAS,OAAO,EAAE;AAAA,IAC/F;AAAA,EACJ;AACA,QAAM,OAAO,CAAC,GAAG,UAAU,OAAO,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,WAAW,GAAG,GAAG,KAAK,CAAC;AACxF,OAAK,QAAQ,KAAK;AAClB,OAAK,WAAW,IAAI;AACxB;AAWA,eAAsB,iBAAiB,cAAc,IAAI;AACrD,QAAM,MAAM,MAAM,WAAW;AAC7B,QAAM,MAAM,IAAI,WAAW,WAAW;AACtC,MAAI,gBAAgB,GAAG;AACvB,SAAO;AACX;AAEO,SAAS,QAAQ,QAAQ;AAC5B,SAAO;AAAA,IACH,KAAK,WAAW,KAAK;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACJ,CAAC;AAAA,EACL;AACJ;;;ACpWO,SAAS,MAAM,GAAG;AACrB,MAAI,OAAO,MAAM,cAAc,OAAO,EAAE,WAAW,YAAY;AAC3D,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC7D;AACA,UAAQ,EAAE,SAAS;AACnB,UAAQ,EAAE,QAAQ;AACtB;AACO,SAAS,aAAa,UAAU,OAAO,CAAC,GAAG;AAC9C,QAAM,SAAS,CAAC,KAAK,SAAS,SAAS,IAAI,EAAE,OAAO,GAAG,EAAE,OAAO;AAChE,QAAM,MAAM,SAAS,MAAS;AAC9B,QAAM,QAAQ,OAAO,OAAO,QAAQ;AAAA,IAChC,WAAW,IAAI;AAAA,IACf,UAAU,IAAI;AAAA,IACd,QAAQ,CAAC,SAAS,SAAS,IAAI;AAAA,IAC/B,GAAG;AAAA,EACP,CAAC;AACD,SAAO,OAAO,OAAO,KAAK;AAC9B;;;AChBO,IAAM,QAAN,MAAY;AAAA,EACf,YAAY,MAAM,KAAK;AACnB,WAAO,eAAe,MAAM,SAAS;AAAA,MACjC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,SAAS;AAAA,MACjC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,YAAY;AAAA,MACpC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,aAAa;AAAA,MACrC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,YAAY;AAAA,MACpC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,aAAa;AAAA,MACrC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,UAAM,IAAI;AACV,WAAO,KAAK,QAAW,KAAK;AAC5B,SAAK,QAAQ,KAAK,OAAO;AACzB,QAAI,OAAO,KAAK,MAAM,WAAW,YAAY;AACzC,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACzE;AACA,SAAK,WAAW,KAAK,MAAM;AAC3B,SAAK,YAAY,KAAK,MAAM;AAC5B,UAAM,WAAW,KAAK;AACtB,UAAM,MAAM,IAAI,WAAW,QAAQ;AAEnC,QAAI,IAAI,IAAI,SAAS,WAAW,KAAK,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,IAAI,GAAG;AACxE,aAAS,IAAI,GAAG,IAAI,IAAI,QAAQ;AAC5B,UAAI,CAAC,KAAK;AACd,SAAK,MAAM,OAAO,GAAG;AAErB,SAAK,QAAQ,KAAK,OAAO;AAEzB,aAAS,IAAI,GAAG,IAAI,IAAI,QAAQ;AAC5B,UAAI,CAAC,KAAK,KAAO;AACrB,SAAK,MAAM,OAAO,GAAG;AACrB,UAAM,GAAG;AAAA,EACb;AAAA,EACA,OAAO,KAAK;AACR,YAAQ,IAAI;AACZ,SAAK,MAAM,OAAO,GAAG;AACrB,WAAO;AAAA,EACX;AAAA,EACA,WAAW,KAAK;AACZ,YAAQ,IAAI;AACZ,WAAO,KAAK,KAAK,WAAW,QAAQ;AACpC,SAAK,WAAW;AAChB,SAAK,MAAM,WAAW,GAAG;AACzB,SAAK,MAAM,OAAO,GAAG;AACrB,SAAK,MAAM,WAAW,GAAG;AACzB,SAAK,QAAQ;AAAA,EACjB;AAAA,EACA,SAAS;AACL,UAAM,MAAM,IAAI,WAAW,KAAK,MAAM,SAAS;AAC/C,SAAK,WAAW,GAAG;AACnB,WAAO;AAAA,EACX;AAAA,EACA,WAAW,IAAI;AAEX,WAAO,OAAO,OAAO,OAAO,eAAe,IAAI,GAAG,CAAC,CAAC;AACpD,UAAM,EAAE,OAAO,OAAO,UAAU,WAAW,UAAU,UAAU,IAAI;AACnE,SAAK;AACL,OAAG,WAAW;AACd,OAAG,YAAY;AACf,OAAG,WAAW;AACd,OAAG,YAAY;AACf,OAAG,QAAQ,MAAM,WAAW,GAAG,KAAK;AACpC,OAAG,QAAQ,MAAM,WAAW,GAAG,KAAK;AACpC,WAAO;AAAA,EACX;AAAA,EACA,QAAQ;AACJ,WAAO,KAAK,WAAW;AAAA,EAC3B;AAAA,EACA,UAAU;AACN,SAAK,YAAY;AACjB,SAAK,MAAM,QAAQ;AACnB,SAAK,MAAM,QAAQ;AAAA,EACvB;AACJ;AAWO,IAAM,OAAO,CAAC,MAAM,KAAK,YAAY,IAAI,MAAM,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,OAAO;AACxF,KAAK,SAAS,CAAC,MAAM,QAAQ,IAAI,MAAM,MAAM,GAAG;;;ACjHzC,SAAS,IAAI,GAAG,GAAG,GAAG;AACzB,SAAQ,IAAI,IAAM,CAAC,IAAI;AAC3B;AAEO,SAAS,IAAI,GAAG,GAAG,GAAG;AACzB,SAAQ,IAAI,IAAM,IAAI,IAAM,IAAI;AACpC;AAKO,IAAM,SAAN,MAAa;AAAA,EAChB,YAAY,UAAU,WAAW,WAAWC,OAAM;AAC9C,WAAO,eAAe,MAAM,YAAY;AAAA,MACpC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,aAAa;AAAA,MACrC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,aAAa;AAAA,MACrC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,QAAQ;AAAA,MAChC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AAED,WAAO,eAAe,MAAM,UAAU;AAAA,MAClC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,QAAQ;AAAA,MAChC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,YAAY;AAAA,MACpC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,UAAU;AAAA,MAClC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,OAAO;AAAA,MAC/B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,aAAa;AAAA,MACrC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,SAAK,WAAW;AAChB,SAAK,YAAY;AACjB,SAAK,YAAY;AACjB,SAAK,OAAOA;AACZ,SAAK,SAAS,IAAI,WAAW,QAAQ;AACrC,SAAK,OAAO,WAAW,KAAK,MAAM;AAAA,EACtC;AAAA,EACA,OAAO,MAAM;AACT,YAAQ,IAAI;AACZ,WAAO,IAAI;AACX,UAAM,EAAE,MAAM,QAAQ,SAAS,IAAI;AACnC,UAAM,MAAM,KAAK;AACjB,aAAS,MAAM,GAAG,MAAM,OAAM;AAC1B,YAAM,OAAO,KAAK,IAAI,WAAW,KAAK,KAAK,MAAM,GAAG;AAEpD,UAAI,SAAS,UAAU;AACnB,cAAM,WAAW,WAAW,IAAI;AAChC,eAAO,YAAY,MAAM,KAAK,OAAO,UAAU;AAC3C,eAAK,QAAQ,UAAU,GAAG;AAAA,QAC9B;AACA;AAAA,MACJ;AACA,aAAO,IAAI,KAAK,SAAS,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG;AACnD,WAAK,OAAO;AACZ,aAAO;AACP,UAAI,KAAK,QAAQ,UAAU;AACvB,aAAK,QAAQ,MAAM,CAAC;AACpB,aAAK,MAAM;AAAA,MACf;AAAA,IACJ;AACA,SAAK,UAAU,KAAK;AACpB,SAAK,WAAW;AAChB,WAAO;AAAA,EACX;AAAA,EACA,WAAW,KAAK;AACZ,YAAQ,IAAI;AACZ,YAAQ,KAAK,IAAI;AACjB,SAAK,WAAW;AAIhB,UAAM,EAAE,QAAQ,MAAM,UAAU,MAAAA,MAAK,IAAI;AACzC,QAAI,EAAE,IAAI,IAAI;AAEd,WAAO,KAAK,IAAI;AAChB,UAAM,KAAK,OAAO,SAAS,GAAG,CAAC;AAG/B,QAAI,KAAK,YAAY,WAAW,KAAK;AACjC,WAAK,QAAQ,MAAM,CAAC;AACpB,YAAM;AAAA,IACV;AAEA,aAAS,IAAI,KAAK,IAAI,UAAU;AAC5B,aAAO,CAAC,IAAI;AAIhB,SAAK,aAAa,WAAW,GAAG,eAAe,KAAK,SAAS,CAAC,GAAGA,KAAI;AACrE,SAAK,QAAQ,MAAM,CAAC;AACpB,UAAM,QAAQ,WAAW,GAAG;AAC5B,UAAM,MAAM,KAAK;AAEjB,QAAI,MAAM;AACN,YAAM,IAAI,MAAM,2CAA2C;AAC/D,UAAM,SAAS,MAAM;AACrB,UAAM,QAAQ,KAAK,IAAI;AACvB,QAAI,SAAS,MAAM,QAAQ;AACvB,YAAM,IAAI,MAAM,oCAAoC;AAAA,IACxD;AACA,aAAS,IAAI,GAAG,IAAI,QAAQ;AACxB,YAAM,UAAU,IAAI,GAAG,MAAM,CAAC,GAAGA,KAAI;AAAA,EAC7C;AAAA,EACA,SAAS;AACL,UAAM,EAAE,QAAQ,UAAU,IAAI;AAC9B,SAAK,WAAW,MAAM;AACtB,UAAM,MAAM,OAAO,MAAM,GAAG,SAAS;AACrC,SAAK,QAAQ;AACb,WAAO;AAAA,EACX;AAAA,EACA,WAAW,IAAI;AACX,WAAO,IAAI,KAAK,YAAY;AAC5B,OAAG,IAAI,GAAG,KAAK,IAAI,CAAC;AACpB,UAAM,EAAE,UAAU,QAAQ,QAAQ,UAAU,WAAW,IAAI,IAAI;AAC/D,OAAG,YAAY;AACf,OAAG,WAAW;AACd,OAAG,SAAS;AACZ,OAAG,MAAM;AACT,QAAI,SAAS;AACT,SAAG,OAAO,IAAI,MAAM;AACxB,WAAO;AAAA,EACX;AAAA,EACA,QAAQ;AACJ,WAAO,KAAK,WAAW;AAAA,EAC3B;AACJ;AAMO,IAAM,YAA4B,4BAAY,KAAK;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,CAAC;;;AC1LD,IAAM,aAAa;AACnB,IAAM,OAAO;AACb,SAAS,QAAQ,GAAG,KAAK,OAAO;AAC5B,MAAI,IAAI;AACJ,WAAO,EAAE,GAAG,OAAO,IAAI,UAAU,GAAG,GAAG,OAAQ,KAAK,OAAQ,UAAU,EAAE;AAAA,EAC5E;AACA,SAAO;AAAA,IACH,GAAG,OAAQ,KAAK,OAAQ,UAAU,IAAI;AAAA,IACtC,GAAG,OAAO,IAAI,UAAU,IAAI;AAAA,EAChC;AACJ;AACA,SAAS,MAAM,KAAK,KAAK,OAAO;AAC5B,QAAM,MAAM,IAAI;AAChB,QAAM,KAAK,IAAI,YAAY,GAAG;AAC9B,QAAM,KAAK,IAAI,YAAY,GAAG;AAC9B,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC1B,UAAM,EAAE,GAAG,EAAE,IAAI,QAAQ,IAAI,CAAC,GAAG,EAAE;AACnC,KAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAAA,EAC1B;AACA,SAAO,CAAC,IAAI,EAAE;AAClB;;;ACVA,IAAM,WAA2B,4BAAY,KAAK;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,CAAC;AAED,IAAM,WAA2B,oBAAI,YAAY,EAAE;AAEnD,IAAM,WAAN,cAAuB,OAAO;AAAA,EAC1B,YAAY,WAAW;AACnB,UAAM,IAAI,WAAW,GAAG,KAAK;AAAA,EACjC;AAAA,EACA,MAAM;AACF,UAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,IAAI;AACnC,WAAO,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAAA,EAClC;AAAA,EACA,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG;AACxB,SAAK,IAAI,IAAI;AACb,SAAK,IAAI,IAAI;AACb,SAAK,IAAI,IAAI;AACb,SAAK,IAAI,IAAI;AACb,SAAK,IAAI,IAAI;AACb,SAAK,IAAI,IAAI;AACb,SAAK,IAAI,IAAI;AACb,SAAK,IAAI,IAAI;AAAA,EACjB;AAAA,EACA,QAAQ,MAAM,QAAQ;AAElB,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK,UAAU,GAAG;AACtC,eAAS,CAAC,IAAI,KAAK,UAAU,QAAQ,KAAK;AAAA,IAC9C;AACA,aAAS,IAAI,IAAI,IAAI,IAAI,KAAK;AAC1B,YAAM,MAAM,SAAS,IAAI,EAAE;AAC3B,YAAM,KAAK,SAAS,IAAI,CAAC;AACzB,YAAM,KAAK,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,IAAK,QAAQ;AACnD,YAAM,KAAK,KAAK,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,IAAK,OAAO;AACjD,eAAS,CAAC,IAAK,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAK;AAAA,IACnE;AAEA,QAAI,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,IAAI;AACjC,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AACzB,YAAM,SAAS,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE;AACpD,YAAM,KAAM,IAAI,SAAS,IAAI,GAAG,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,SAAS,CAAC,IAAK;AACrE,YAAM,SAAS,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE;AACpD,YAAM,KAAM,SAAS,IAAI,GAAG,GAAG,CAAC,IAAK;AACrC,UAAI;AACJ,UAAI;AACJ,UAAI;AACJ,UAAK,IAAI,KAAM;AACf,UAAI;AACJ,UAAI;AACJ,UAAI;AACJ,UAAK,KAAK,KAAM;AAAA,IACpB;AAEA,QAAK,IAAI,KAAK,IAAK;AACnB,QAAK,IAAI,KAAK,IAAK;AACnB,QAAK,IAAI,KAAK,IAAK;AACnB,QAAK,IAAI,KAAK,IAAK;AACnB,QAAK,IAAI,KAAK,IAAK;AACnB,QAAK,IAAI,KAAK,IAAK;AACnB,QAAK,IAAI,KAAK,IAAK;AACnB,QAAK,IAAI,KAAK,IAAK;AACnB,SAAK,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAAA,EACnC;AAAA,EACA,aAAa;AACT,UAAM,QAAQ;AAAA,EAClB;AAAA,EACA,UAAU;AACN,SAAK,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAC/B,UAAM,KAAK,MAAM;AAAA,EACrB;AACJ;AAEO,IAAM,UAAN,cAAsB,SAAS;AAAA,EAClC,cAAc;AACV,UAAM,EAAE;AAGR,WAAO,eAAe,MAAM,KAAK;AAAA,MAC7B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,UAAU,CAAC,IAAI;AAAA,IAC1B,CAAC;AACD,WAAO,eAAe,MAAM,KAAK;AAAA,MAC7B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,UAAU,CAAC,IAAI;AAAA,IAC1B,CAAC;AACD,WAAO,eAAe,MAAM,KAAK;AAAA,MAC7B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,UAAU,CAAC,IAAI;AAAA,IAC1B,CAAC;AACD,WAAO,eAAe,MAAM,KAAK;AAAA,MAC7B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,UAAU,CAAC,IAAI;AAAA,IAC1B,CAAC;AACD,WAAO,eAAe,MAAM,KAAK;AAAA,MAC7B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,UAAU,CAAC,IAAI;AAAA,IAC1B,CAAC;AACD,WAAO,eAAe,MAAM,KAAK;AAAA,MAC7B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,UAAU,CAAC,IAAI;AAAA,IAC1B,CAAC;AACD,WAAO,eAAe,MAAM,KAAK;AAAA,MAC7B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,UAAU,CAAC,IAAI;AAAA,IAC1B,CAAC;AACD,WAAO,eAAe,MAAM,KAAK;AAAA,MAC7B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,UAAU,CAAC,IAAI;AAAA,IAC1B,CAAC;AAAA,EACL;AACJ;AA8ZO,IAAM,SAAyB;AAAA,EAAa,MAAM,IAAI,QAAQ;AAAA,EACrD,wBAAQ,CAAI;AAAC;;;AC1lB7B,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,QAAQ;AACd,IAAM,SAAS;AACf,IAAM,UAAU,CAAC;AACjB,IAAM,YAAY,CAAC;AACnB,IAAM,aAAa,CAAC;AACpB,SAAS,QAAQ,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,GAAG,QAAQ,IAAI,SAAS;AAE5D,GAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;AAChC,UAAQ,KAAK,KAAK,IAAI,IAAI,EAAE;AAE5B,YAAU,MAAQ,QAAQ,MAAM,QAAQ,KAAM,IAAK,EAAE;AAErD,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AACxB,SAAM,KAAK,OAAS,KAAK,OAAO,UAAW;AAC3C,QAAI,IAAI;AACJ,WAAK,QAAS,OAAO,OAAO,CAAC,KAAK;AAAA,EAC1C;AACA,aAAW,KAAK,CAAC;AACrB;AACA,IAAM,QAAQ,MAAM,YAAY,IAAI;AACpC,IAAM,cAAc,MAAM,CAAC;AAC3B,IAAM,cAAc,MAAM,CAAC;;;ACjCpB,SAAS,IAAI,GAAG,GAAG;AACtB,QAAM,SAAS,IAAI;AACnB,SAAO,UAAU,MAAM,SAAS,IAAI;AACxC;AAEO,SAAS,KAAK,GAAG,OAAO,QAAQ;AACnC,MAAI,MAAM;AACV,SAAO,UAAU,KAAK;AAClB,WAAO;AACP,WAAO;AAAA,EACX;AACA,SAAO;AACX;;;ACtBO,SAAS,aAEhB,iBAAiB,cAAc;AAC3B,SAAO,SAAS,OAAO,MAAM;AACzB,UAAM,YAAY,gBAAgB,IAAI;AACtC,WAAO,EAAE,WAAW,WAAW,aAAa,SAAS,EAAE;AAAA,EAC3D;AACJ;;;ACIA,SAAS,aAAa,OAAO;AACzB,iBAAe,OAAO;AAAA,IAClB,mBAAmB;AAAA,IACnB,YAAY;AAAA,EAChB,CAAC;AACD,SAAO,OAAO,OAAO,EAAE,GAAG,MAAM,CAAC;AACrC;AACO,SAAS,WAAW,UAAU;AACjC,QAAM,QAAQ,aAAa,QAAQ;AACnC,QAAM,EAAE,GAAG,MAAM,mBAAAC,oBAAmB,YAAY,aAAa,KAAK,IAAI;AACtE,QAAM,UAAU,SAAS;AACzB,MAAI,CAAC,WAAW,SAAS;AACrB,UAAM,IAAI,MAAM,cAAc;AAClC,QAAM,eAAe,QAAQ;AAC7B,QAAM,iBAAiB,UAAU,OAAO;AACxC,QAAM,WAAW,UAAU,KAAK;AAChC,QAAM,KAAK,UAAU,KAAK;AAK1B,QAAM,MAAM,UAAU,UAAU;AAIhC,QAAM,YAAY,UAAU,OAAO,OAAO,OAAO;AACjD,QAAM,WAAW,UAAU,KAAK,OAAO,OAAO,MAAM,KAAK,OAAO,OAAO;AACvE,QAAM,YAAY,YAAY,WAAW;AACzC,QAAM,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;AAC5B,QAAM,UAAU,QAAQ,EAAE;AAC1B,WAAS,QAAQ,GAAG;AAChB,WAAO,gBAAgB,KAAK,CAAC,GAAG,QAAQ;AAAA,EAC5C;AACA,WAAS,QAAQ,GAAG;AAChB,UAAM,KAAK,UAAU,OAAO,GAAG,UAAU,aAAa,CAAC;AAGvD,QAAI;AACA,SAAG,EAAE,KAAK;AAKd,WAAO,KAAK,gBAAgB,EAAE,CAAC;AAAA,EACnC;AACA,WAAS,aAAa,QAAQ;AAC1B,WAAO,gBAAgBA,mBAAkB,UAAU,OAAO,QAAQ,UAAU,QAAQ,CAAC,CAAC,CAAC;AAAA,EAC3F;AACA,WAAS,WAAW,QAAQ,GAAG;AAC3B,UAAM,KAAK,iBAAiB,QAAQ,CAAC,GAAG,aAAa,MAAM,CAAC;AAI5D,QAAI,OAAO;AACP,YAAM,IAAI,MAAM,wCAAwC;AAC5D,WAAO,QAAQ,EAAE;AAAA,EACrB;AAEA,WAAS,eAAe,QAAQ;AAC5B,WAAO,WAAW,QAAQ,OAAO;AAAA,EACrC;AACA,QAAM,eAAe;AACrB,QAAM,kBAAkB;AAExB,WAAS,MAAM,MAAM,KAAK,KAAK;AAI3B,UAAM,QAAQ,KAAK,QAAQ,MAAM,IAAI;AACrC,UAAM,KAAK,MAAM,KAAK;AACtB,UAAM,KAAK,MAAM,KAAK;AACtB,WAAO,EAAE,KAAK,IAAI;AAAA,EACtB;AAOA,WAAS,iBAAiB,GAAG,QAAQ;AACjC,aAAS,KAAK,GAAG,KAAK,CAAC;AACvB,aAAS,UAAU,QAAQ,WAAW,SAAS;AAC/C,UAAM,IAAI;AACV,UAAM,MAAM;AACZ,QAAI,MAAM;AACV,QAAI,MAAM;AACV,QAAI,MAAM;AACV,QAAI,MAAM;AACV,QAAI,OAAO;AACX,aAAS,IAAI,iBAAiB,IAAI,KAAK,KAAK,KAAK;AAC7C,YAAM,MAAO,KAAK,IAAK;AACvB,cAAQ;AACR,OAAC,EAAE,KAAK,IAAI,IAAI,MAAM,MAAM,KAAK,GAAG;AACpC,OAAC,EAAE,KAAK,KAAK,KAAK,IAAI,IAAI,MAAM,MAAM,KAAK,GAAG;AAC9C,aAAO;AACP,YAAM,IAAI,MAAM;AAChB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,IAAI,MAAM;AAChB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,IAAI,KAAK;AACf,YAAM,IAAI,MAAM;AAChB,YAAM,IAAI,MAAM;AAChB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,OAAO,KAAK;AAClB,YAAM,QAAQ,KAAK;AACnB,YAAM,KAAK,OAAO,IAAI;AACtB,YAAM,KAAK,MAAM,KAAK,QAAQ,KAAK,CAAC;AACpC,YAAM,KAAK,KAAK,EAAE;AAClB,YAAM,KAAK,KAAK,KAAK,KAAK,MAAM,CAAC,EAAE;AAAA,IACvC;AACA,KAAC,EAAE,KAAK,IAAI,IAAI,MAAM,MAAM,KAAK,GAAG;AACpC,KAAC,EAAE,KAAK,KAAK,KAAK,IAAI,IAAI,MAAM,MAAM,KAAK,GAAG;AAC9C,UAAM,KAAK,WAAW,GAAG;AACzB,WAAO,KAAK,MAAM,EAAE;AAAA,EACxB;AACA,QAAM,UAAU;AAAA,IACZ,WAAW;AAAA,IACX,WAAW;AAAA,IACX,MAAM;AAAA,EACV;AACA,QAAM,kBAAkB,OAAO,SAAS;AACpC,QAAI,SAAS,QAAW;AACpB,aAAO,MAAM,aAAa,QAAQ;AAAA,IACtC;AACA,WAAO,MAAM,QAAQ,MAAM,MAAM;AACjC,WAAO;AAAA,EACX;AACA,QAAM,QAAQ,EAAE,gBAAgB;AAChC,SAAO,OAAO,OAAO;AAAA,IACjB,QAAQ,aAAa,iBAAiB,YAAY;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,QAAQ,MAAM;AAAA,IACvB;AAAA,EACJ,CAAC;AACL;;;AC/IO,SAAS,MAAM,GAAG;AACrB,MAAI,OAAO,MAAM;AACb,UAAM,IAAI,MAAM,yBAAyB,CAAC,EAAE;AACpD;AAUO,IAAM,wCAAa,CAAC,QAAQ,gBAAgB;AAE/C,WAAS,cAAc,QAAQ,MAAM;AAEjC,WAAO,KAAK,QAAW,KAAK;AAE5B,QAAI,CAAC,MAAM;AACP,YAAM,IAAI,MAAM,iDAAiD;AAAA,IACrE;AAEA,QAAI,OAAO,gBAAgB,QAAW;AAClC,YAAM,QAAQ,KAAK,CAAC;AACpB,aAAO,OAAO,OAAO,eAAe,SAAY,OAAO,aAAa,OAAO;AAAA,IAC/E;AAEA,UAAM,OAAO,OAAO;AACpB,QAAI,QAAQ,KAAK,CAAC,MAAM;AACpB,aAAO,KAAK,CAAC,GAAG,QAAW,KAAK;AACpC,UAAM,SAAS,YAAY,KAAK,GAAG,IAAI;AACvC,UAAM,cAAc,CAAC,UAAU,WAAW;AACtC,UAAI,WAAW,QAAW;AACtB,YAAI,aAAa;AACb,gBAAM,IAAI,MAAM,6BAA6B;AACjD,eAAO,QAAQ,QAAW,QAAQ;AAAA,MACtC;AAAA,IACJ;AAEA,QAAI,SAAS;AACb,UAAM,WAAW;AAAA,MACb,QAAQ,MAAM,QAAQ;AAClB,YAAI,QAAQ;AACR,gBAAM,IAAI,MAAM,8CAA8C;AAAA,QAClE;AACA,iBAAS;AACT,eAAO,IAAI;AACX,oBAAY,OAAO,QAAQ,QAAQ,MAAM;AACzC,eAAO,OAAO,QAAQ,MAAM,MAAM;AAAA,MACtC;AAAA,MACA,QAAQ,MAAM,QAAQ;AAClB,eAAO,IAAI;AACX,YAAI,QAAQ,KAAK,SAAS,MAAM;AAC5B,gBAAM,IAAI,MAAM,wDAAwD,IAAI;AAAA,QAChF;AACA,oBAAY,OAAO,QAAQ,QAAQ,MAAM;AACzC,eAAO,OAAO,QAAQ,MAAM,MAAM;AAAA,MACtC;AAAA,IACJ;AACA,WAAO;AAAA,EACX;AACA,SAAO,OAAO,eAAe,MAAM;AACnC,SAAO;AACX;AACO,SAAS,UAAU,UAAU,MAAM;AACtC,MAAI,QAAQ,QAAQ,OAAO,SAAS,UAAU;AAC1C,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC7C;AACA,QAAM,SAAS,OAAO,OAAO,UAAU,IAAI;AAC3C,SAAO;AACX;AAEO,SAAS,WAAW,GAAG,GAAG;AAC7B,MAAI,EAAE,WAAW,EAAE;AACf,WAAO;AACX,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ;AAC1B,YAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;AACtB,SAAO,SAAS;AACpB;AAKO,SAAS,UAAU,gBAAgB,KAAK,cAAc,MAAM;AAC/D,MAAI,QAAQ;AACR,WAAO,IAAI,WAAW,cAAc;AACxC,MAAI,IAAI,WAAW,gBAAgB;AAC/B,UAAM,IAAI,MAAM,4CAA4C,iBAAiB,YACzE,IAAI,MAAM;AAAA,EAClB;AACA,MAAI,eAAe,CAAC,YAAY,GAAG,GAAG;AAClC,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACrD;AACA,SAAO;AACX;AACO,SAAS,WAAW,YAAY,WAAWC,OAAM;AACpD,QAAMA,KAAI;AACV,QAAM,MAAM,IAAI,WAAW,EAAE;AAC7B,QAAM,OAAO,WAAW,GAAG;AAC3B,OAAK,aAAa,GAAG,eAAe,SAAS,GAAGA,KAAI;AACpD,OAAK,aAAa,GAAG,eAAe,UAAU,GAAGA,KAAI;AACrD,SAAO;AACX;AAEO,SAAS,YAAY,OAAO;AAC/B,SAAO,MAAM,aAAa,MAAM;AACpC;;;AC3EA,IAAM,eAAe,CAAC,QAAQ,WAAW,KAAK,IAAI,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AACvF,IAAM,UAAU,aAAa,kBAAkB;AAC/C,IAAM,UAAU,aAAa,kBAAkB;AAC/C,IAAM,aAAa,IAAI,OAAO;AAC9B,IAAM,aAAa,IAAI,OAAO;AAEvB,SAAS,KAAK,GAAG,GAAG;AACvB,SAAQ,KAAK,IAAM,MAAO,KAAK;AACnC;AAEA,SAASC,aAAY,GAAG;AACpB,SAAO,EAAE,aAAa,MAAM;AAChC;AAEA,IAAM,YAAY;AAClB,IAAM,cAAc;AAGpB,IAAM,cAAc,KAAK,KAAK;AAC9B,IAAM,YAAY,YAAY,GAAG;AACjC,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO,MAAM,QAAQ,SAAS,QAAQ;AACvE,QAAM,MAAM,KAAK;AACjB,QAAM,QAAQ,IAAI,WAAW,SAAS;AACtC,QAAM,MAAM,IAAI,KAAK;AAErB,QAAM,YAAYA,aAAY,IAAI,KAAKA,aAAY,MAAM;AACzD,QAAM,MAAM,YAAY,IAAI,IAAI,IAAI;AACpC,QAAM,MAAM,YAAY,IAAI,MAAM,IAAI;AACtC,WAAS,MAAM,GAAG,MAAM,KAAK,WAAW;AACpC,SAAK,OAAO,KAAK,OAAO,KAAK,SAAS,MAAM;AAC5C,QAAI,WAAW;AACX,YAAM,IAAI,MAAM,uBAAuB;AAC3C,UAAM,OAAO,KAAK,IAAI,WAAW,MAAM,GAAG;AAE1C,QAAI,aAAa,SAAS,WAAW;AACjC,YAAM,QAAQ,MAAM;AACpB,UAAI,MAAM,MAAM;AACZ,cAAM,IAAI,MAAM,6BAA6B;AACjD,eAAS,IAAI,GAAG,MAAM,IAAI,aAAa,KAAK;AACxC,eAAO,QAAQ;AACf,YAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;AAAA,MACjC;AACA,aAAO;AACP;AAAA,IACJ;AACA,aAAS,IAAI,GAAG,MAAM,IAAI,MAAM,KAAK;AACjC,aAAO,MAAM;AACb,aAAO,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC;AAAA,IACvC;AACA,WAAO;AAAA,EACX;AACJ;AAEO,SAAS,aAAa,MAAM,MAAM;AACrC,QAAM,EAAE,gBAAgB,eAAe,eAAe,cAAc,OAAO,IAAI,UAAU;AAAA,IACrF,gBAAgB;AAAA,IAChB,eAAe;AAAA,IACf,cAAc;AAAA,IACd,QAAQ;AAAA,EACZ,GAAG,IAAI;AACP,MAAI,OAAO,SAAS;AAChB,UAAM,IAAI,MAAM,yBAAyB;AAC7C,UAAQ,aAAa;AACrB,UAAQ,MAAM;AACd,QAAM,YAAY;AAClB,QAAM,cAAc;AACpB,SAAO,CAAC,KAAK,OAAO,MAAM,QAAQ,UAAU,MAAM;AAC9C,WAAO,KAAK,QAAW,KAAK;AAC5B,WAAO,OAAO,QAAW,OAAO;AAChC,WAAO,MAAM,QAAW,MAAM;AAC9B,UAAM,MAAM,KAAK;AACjB,QAAI,WAAW;AACX,eAAS,IAAI,WAAW,GAAG;AAC/B,WAAO,QAAQ,QAAW,QAAQ;AAClC,YAAQ,OAAO;AACf,QAAI,UAAU,KAAK,WAAW,aAAa;AACvC,YAAM,IAAI,MAAM,uBAAuB;AAAA,IAC3C;AACA,QAAI,OAAO,SAAS,KAAK;AACrB,YAAM,IAAI,MAAM,gBAAgB,OAAO,MAAM,2BAA2B,GAAG,GAAG;AAAA,IAClF;AACA,UAAM,UAAU,CAAC;AAIjB,UAAM,IAAI,IAAI;AACd,QAAI;AACJ,QAAI;AACJ,QAAI,MAAM,IAAI;AACV,cAAQ,KAAK,IAAI,UAAU,GAAG,CAAC;AAC/B,cAAQ;AAAA,IACZ,WACS,MAAM,MAAM,gBAAgB;AACjC,UAAI,IAAI,WAAW,EAAE;AACrB,QAAE,IAAI,GAAG;AACT,QAAE,IAAI,KAAK,EAAE;AACb,cAAQ;AACR,cAAQ,KAAK,CAAC;AAAA,IAClB,OACK;AACD,aAAO,KAAK,IAAI,SAAS;AACzB,YAAM,IAAI,MAAM,kBAAkB;AAAA,IAEtC;AAQA,QAAI,CAACA,aAAY,KAAK;AAClB,cAAQ,KAAK,QAAQ,UAAU,KAAK,CAAC;AACzC,UAAM,MAAM,IAAI,CAAC;AAEjB,QAAI,eAAe;AACf,UAAI,MAAM,WAAW,IAAI;AACrB,cAAM,IAAI,MAAM,sCAAsC;AAAA,MAC1D;AACA,oBAAc,OAAO,KAAK,IAAI,MAAM,SAAS,GAAG,EAAE,CAAC,GAAG,GAAG;AACzD,cAAQ,MAAM,SAAS,EAAE;AAAA,IAC7B;AAEA,UAAM,aAAa,KAAK;AACxB,QAAI,eAAe,MAAM,QAAQ;AAC7B,YAAM,IAAI,MAAM,sBAAsB,UAAU,cAAc;AAAA,IAClE;AAEA,QAAI,eAAe,IAAI;AACnB,YAAM,KAAK,IAAI,WAAW,EAAE;AAC5B,SAAG,IAAI,OAAO,eAAe,IAAI,KAAK,MAAM,MAAM;AAClD,cAAQ;AACR,cAAQ,KAAK,KAAK;AAAA,IACtB;AACA,UAAM,MAAM,IAAI,KAAK;AACrB,cAAU,MAAM,OAAO,KAAK,KAAK,MAAM,QAAQ,SAAS,MAAM;AAC9D,UAAM,GAAG,OAAO;AAChB,WAAO;AAAA,EACX;AACJ;;;AC/JA,SAAS,OAAO,GAAG,GAAG;AAClB,SAAQ,EAAE,GAAG,IAAI,OAAU,EAAE,GAAG,IAAI,QAAS;AACjD;AA0CO,IAAM,WAAN,MAAe;AAAA;AAAA,EAElB,YAAY,KAAK;AACb,WAAO,eAAe,MAAM,YAAY;AAAA,MACpC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,aAAa;AAAA,MACrC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,UAAU;AAAA,MAClC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,IAAI,WAAW,EAAE;AAAA,IAC5B,CAAC;AACD,WAAO,eAAe,MAAM,KAAK;AAAA,MAC7B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,IAAI,YAAY,EAAE;AAAA,IAC7B,CAAC;AACD,WAAO,eAAe,MAAM,KAAK;AAAA,MAC7B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,IAAI,YAAY,EAAE;AAAA,IAC7B,CAAC;AACD,WAAO,eAAe,MAAM,OAAO;AAAA,MAC/B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,IAAI,YAAY,CAAC;AAAA,IAC5B,CAAC;AACD,WAAO,eAAe,MAAM,OAAO;AAAA,MAC/B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,YAAY;AAAA,MACpC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,UAAM,UAAU,OAAO,KAAK,IAAI,KAAK,CAAC;AACtC,UAAM,KAAK,OAAO,KAAK,CAAC;AACxB,UAAM,KAAK,OAAO,KAAK,CAAC;AACxB,UAAM,KAAK,OAAO,KAAK,CAAC;AACxB,UAAM,KAAK,OAAO,KAAK,CAAC;AACxB,UAAM,KAAK,OAAO,KAAK,CAAC;AACxB,UAAM,KAAK,OAAO,KAAK,EAAE;AACzB,UAAM,KAAK,OAAO,KAAK,EAAE;AACzB,UAAM,KAAK,OAAO,KAAK,EAAE;AAEzB,SAAK,EAAE,CAAC,IAAI,KAAK;AACjB,SAAK,EAAE,CAAC,KAAM,OAAO,KAAO,MAAM,KAAM;AACxC,SAAK,EAAE,CAAC,KAAM,OAAO,KAAO,MAAM,KAAM;AACxC,SAAK,EAAE,CAAC,KAAM,OAAO,IAAM,MAAM,KAAM;AACvC,SAAK,EAAE,CAAC,KAAM,OAAO,IAAM,MAAM,MAAO;AACxC,SAAK,EAAE,CAAC,IAAK,OAAO,IAAK;AACzB,SAAK,EAAE,CAAC,KAAM,OAAO,KAAO,MAAM,KAAM;AACxC,SAAK,EAAE,CAAC,KAAM,OAAO,KAAO,MAAM,KAAM;AACxC,SAAK,EAAE,CAAC,KAAM,OAAO,IAAM,MAAM,KAAM;AACvC,SAAK,EAAE,CAAC,IAAK,OAAO,IAAK;AACzB,aAAS,IAAI,GAAG,IAAI,GAAG;AACnB,WAAK,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC;AAAA,EAC5C;AAAA,EACA,QAAQ,MAAM,QAAQ,SAAS,OAAO;AAClC,UAAM,QAAQ,SAAS,IAAI,KAAK;AAChC,UAAM,EAAE,GAAG,EAAE,IAAI;AACjB,UAAM,KAAK,EAAE,CAAC;AACd,UAAM,KAAK,EAAE,CAAC;AACd,UAAM,KAAK,EAAE,CAAC;AACd,UAAM,KAAK,EAAE,CAAC;AACd,UAAM,KAAK,EAAE,CAAC;AACd,UAAM,KAAK,EAAE,CAAC;AACd,UAAM,KAAK,EAAE,CAAC;AACd,UAAM,KAAK,EAAE,CAAC;AACd,UAAM,KAAK,EAAE,CAAC;AACd,UAAM,KAAK,EAAE,CAAC;AACd,UAAM,KAAK,OAAO,MAAM,SAAS,CAAC;AAClC,UAAM,KAAK,OAAO,MAAM,SAAS,CAAC;AAClC,UAAM,KAAK,OAAO,MAAM,SAAS,CAAC;AAClC,UAAM,KAAK,OAAO,MAAM,SAAS,CAAC;AAClC,UAAM,KAAK,OAAO,MAAM,SAAS,CAAC;AAClC,UAAM,KAAK,OAAO,MAAM,SAAS,EAAE;AACnC,UAAM,KAAK,OAAO,MAAM,SAAS,EAAE;AACnC,UAAM,KAAK,OAAO,MAAM,SAAS,EAAE;AACnC,UAAM,KAAK,EAAE,CAAC,KAAK,KAAK;AACxB,UAAM,KAAK,EAAE,CAAC,MAAO,OAAO,KAAO,MAAM,KAAM;AAC/C,UAAM,KAAK,EAAE,CAAC,MAAO,OAAO,KAAO,MAAM,KAAM;AAC/C,UAAM,KAAK,EAAE,CAAC,MAAO,OAAO,IAAM,MAAM,KAAM;AAC9C,UAAM,KAAK,EAAE,CAAC,MAAO,OAAO,IAAM,MAAM,MAAO;AAC/C,UAAM,KAAK,EAAE,CAAC,KAAM,OAAO,IAAK;AAChC,UAAM,KAAK,EAAE,CAAC,MAAO,OAAO,KAAO,MAAM,KAAM;AAC/C,UAAM,KAAK,EAAE,CAAC,MAAO,OAAO,KAAO,MAAM,KAAM;AAC/C,UAAM,KAAK,EAAE,CAAC,MAAO,OAAO,IAAM,MAAM,KAAM;AAC9C,UAAM,KAAK,EAAE,CAAC,KAAM,OAAO,IAAK;AAChC,QAAI,IAAI;AACR,QAAI,KAAK,IAAI,KAAK,KAAK,MAAM,IAAI,MAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAC7D,MAAM,IAAI;AACd,QAAI,OAAO;AACX,UAAM;AACN,UAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAC5D,MAAM,IAAI;AACd,SAAK,OAAO;AACZ,UAAM;AACN,QAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,MAAM,IAAI,MAAM,MAAM,IAAI,MACvD,MAAM,IAAI;AACd,QAAI,OAAO;AACX,UAAM;AACN,UAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAC5D,MAAM,IAAI;AACd,SAAK,OAAO;AACZ,UAAM;AACN,QAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,MAAM,IAAI,MAAM,MAAM,IAAI;AACrE,QAAI,OAAO;AACX,UAAM;AACN,UAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAC5D,MAAM,IAAI;AACd,SAAK,OAAO;AACZ,UAAM;AACN,QAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,MAAM,IAAI;AAC/D,QAAI,OAAO;AACX,UAAM;AACN,UAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAC5D,MAAM,IAAI;AACd,SAAK,OAAO;AACZ,UAAM;AACN,QAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK;AAC1D,QAAI,OAAO;AACX,UAAM;AACN,UAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MAC5D,MAAM,IAAI;AACd,SAAK,OAAO;AACZ,UAAM;AACN,QAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK;AAC1D,QAAI,OAAO;AACX,UAAM;AACN,UAAM,KAAK,KAAK,MAAM,IAAI,MAAM,MAAM,IAAI,MAAM,MAAM,IAAI,MACtD,MAAM,IAAI;AACd,SAAK,OAAO;AACZ,UAAM;AACN,QAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK;AAC1D,QAAI,OAAO;AACX,UAAM;AACN,UAAM,KAAK,KAAK,KAAK,KAAK,MAAM,IAAI,MAAM,MAAM,IAAI,MAAM,MAAM,IAAI;AACpE,SAAK,OAAO;AACZ,UAAM;AACN,QAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK;AAC1D,QAAI,OAAO;AACX,UAAM;AACN,UAAM,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,MAAM,IAAI,MAAM,MAAM,IAAI;AAC9D,SAAK,OAAO;AACZ,UAAM;AACN,QAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK;AAC1D,QAAI,OAAO;AACX,UAAM;AACN,UAAM,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,MAAM,IAAI;AACxD,SAAK,OAAO;AACZ,UAAM;AACN,QAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK;AAC1D,QAAI,OAAO;AACX,UAAM;AACN,UAAM,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK;AACnD,SAAK,OAAO;AACZ,UAAM;AACN,SAAM,KAAK,KAAK,IAAK;AACrB,QAAK,IAAI,KAAM;AACf,SAAK,IAAI;AACT,QAAI,MAAM;AACV,UAAM;AACN,MAAE,CAAC,IAAI;AACP,MAAE,CAAC,IAAI;AACP,MAAE,CAAC,IAAI;AACP,MAAE,CAAC,IAAI;AACP,MAAE,CAAC,IAAI;AACP,MAAE,CAAC,IAAI;AACP,MAAE,CAAC,IAAI;AACP,MAAE,CAAC,IAAI;AACP,MAAE,CAAC,IAAI;AACP,MAAE,CAAC,IAAI;AAAA,EACX;AAAA,EACA,WAAW;AACP,UAAM,EAAE,GAAG,IAAI,IAAI;AACnB,UAAM,IAAI,IAAI,YAAY,EAAE;AAC5B,QAAI,IAAI,EAAE,CAAC,MAAM;AACjB,MAAE,CAAC,KAAK;AACR,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AACzB,QAAE,CAAC,KAAK;AACR,UAAI,EAAE,CAAC,MAAM;AACb,QAAE,CAAC,KAAK;AAAA,IACZ;AACA,MAAE,CAAC,KAAK,IAAI;AACZ,QAAI,EAAE,CAAC,MAAM;AACb,MAAE,CAAC,KAAK;AACR,MAAE,CAAC,KAAK;AACR,QAAI,EAAE,CAAC,MAAM;AACb,MAAE,CAAC,KAAK;AACR,MAAE,CAAC,KAAK;AACR,MAAE,CAAC,IAAI,EAAE,CAAC,IAAI;AACd,QAAI,EAAE,CAAC,MAAM;AACb,MAAE,CAAC,KAAK;AACR,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AACzB,QAAE,CAAC,IAAI,EAAE,CAAC,IAAI;AACd,UAAI,EAAE,CAAC,MAAM;AACb,QAAE,CAAC,KAAK;AAAA,IACZ;AACA,MAAE,CAAC,KAAK,KAAK;AACb,QAAI,QAAQ,IAAI,KAAK;AACrB,aAAS,IAAI,GAAG,IAAI,IAAI;AACpB,QAAE,CAAC,KAAK;AACZ,WAAO,CAAC;AACR,aAAS,IAAI,GAAG,IAAI,IAAI;AACpB,QAAE,CAAC,IAAK,EAAE,CAAC,IAAI,OAAQ,EAAE,CAAC;AAC9B,MAAE,CAAC,KAAK,EAAE,CAAC,IAAK,EAAE,CAAC,KAAK,MAAO;AAC/B,MAAE,CAAC,KAAM,EAAE,CAAC,MAAM,IAAM,EAAE,CAAC,KAAK,MAAO;AACvC,MAAE,CAAC,KAAM,EAAE,CAAC,MAAM,IAAM,EAAE,CAAC,KAAK,KAAM;AACtC,MAAE,CAAC,KAAM,EAAE,CAAC,MAAM,IAAM,EAAE,CAAC,KAAK,KAAM;AACtC,MAAE,CAAC,KAAM,EAAE,CAAC,MAAM,KAAO,EAAE,CAAC,KAAK,IAAM,EAAE,CAAC,KAAK,MAAO;AACtD,MAAE,CAAC,KAAM,EAAE,CAAC,MAAM,IAAM,EAAE,CAAC,KAAK,MAAO;AACvC,MAAE,CAAC,KAAM,EAAE,CAAC,MAAM,IAAM,EAAE,CAAC,KAAK,KAAM;AACtC,MAAE,CAAC,KAAM,EAAE,CAAC,MAAM,IAAM,EAAE,CAAC,KAAK,KAAM;AACtC,QAAI,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC;AACpB,MAAE,CAAC,IAAI,IAAI;AACX,aAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AACxB,WAAO,EAAE,CAAC,IAAI,IAAI,CAAC,IAAK,MAAM,MAAM,MAAO;AAC3C,QAAE,CAAC,IAAI,IAAI;AAAA,IACf;AACA,UAAM,CAAC;AAAA,EACX;AAAA,EACA,OAAO,MAAM;AACT,YAAQ,IAAI;AACZ,WAAO,IAAI;AACX,WAAO,UAAU,IAAI;AACrB,UAAM,EAAE,QAAQ,SAAS,IAAI;AAC7B,UAAM,MAAM,KAAK;AACjB,aAAS,MAAM,GAAG,MAAM,OAAM;AAC1B,YAAM,OAAO,KAAK,IAAI,WAAW,KAAK,KAAK,MAAM,GAAG;AAEpD,UAAI,SAAS,UAAU;AACnB,eAAO,YAAY,MAAM,KAAK,OAAO;AACjC,eAAK,QAAQ,MAAM,GAAG;AAC1B;AAAA,MACJ;AACA,aAAO,IAAI,KAAK,SAAS,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG;AACnD,WAAK,OAAO;AACZ,aAAO;AACP,UAAI,KAAK,QAAQ,UAAU;AACvB,aAAK,QAAQ,QAAQ,GAAG,KAAK;AAC7B,aAAK,MAAM;AAAA,MACf;AAAA,IACJ;AACA,WAAO;AAAA,EACX;AAAA,EACA,UAAU;AACN,UAAM,KAAK,GAAG,KAAK,GAAG,KAAK,QAAQ,KAAK,GAAG;AAAA,EAC/C;AAAA,EACA,WAAW,KAAK;AACZ,YAAQ,IAAI;AACZ,YAAQ,KAAK,IAAI;AACjB,SAAK,WAAW;AAChB,UAAM,EAAE,QAAQ,EAAE,IAAI;AACtB,QAAI,EAAE,IAAI,IAAI;AACd,QAAI,KAAK;AACL,aAAO,KAAK,IAAI;AAChB,aAAO,MAAM,IAAI;AACb,eAAO,GAAG,IAAI;AAClB,WAAK,QAAQ,QAAQ,GAAG,IAAI;AAAA,IAChC;AACA,SAAK,SAAS;AACd,QAAI,OAAO;AACX,aAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AACxB,UAAI,MAAM,IAAI,EAAE,CAAC,MAAM;AACvB,UAAI,MAAM,IAAI,EAAE,CAAC,MAAM;AAAA,IAC3B;AACA,WAAO;AAAA,EACX;AAAA,EACA,SAAS;AACL,UAAM,EAAE,QAAQ,UAAU,IAAI;AAC9B,SAAK,WAAW,MAAM;AACtB,UAAM,MAAM,OAAO,MAAM,GAAG,SAAS;AACrC,SAAK,QAAQ;AACb,WAAO;AAAA,EACX;AACJ;AACO,SAAS,uBAAuB,UAAU;AAC7C,QAAM,QAAQ,CAAC,KAAK,QAAQ,SAAS,GAAG,EAAE,OAAO,GAAG,EAAE,OAAO;AAC7D,QAAM,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;AACvC,QAAM,YAAY,IAAI;AACtB,QAAM,WAAW,IAAI;AACrB,QAAM,SAAS,CAAC,QAAQ,SAAS,GAAG;AACpC,SAAO;AACX;AAEO,IAAM,WACK,uBAAM,uBAAuB,CAAC,QAAQ,IAAI,SAAS,GAAG,CAAC,GAAG;;;ACtV5E,SAAS,WAAW,GAAG,GAAG,GAAG,KAAK,KAAK,SAAS,IAAI;AAChD,QAAM,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,GACnD,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,GAC7C,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,GAC7C,MAAM,KAAK,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC;AAE5C,MAAI,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM;AAC/K,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK,GAAG;AAChC,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AACvB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AACvB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AACvB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AACvB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AACvB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AACvB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AACvB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AACvB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AACvB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AACvB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AACvB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AACvB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AACvB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AACvB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,EAAE;AACxB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AACvB,UAAO,MAAM,MAAO;AACpB,UAAM,KAAK,MAAM,KAAK,CAAC;AAAA,EAC3B;AAEA,MAAI,KAAK;AACT,MAAI,IAAI,IAAK,MAAM,MAAO;AAC1B,MAAI,IAAI,IAAK,MAAM,MAAO;AAC1B,MAAI,IAAI,IAAK,MAAM,MAAO;AAC1B,MAAI,IAAI,IAAK,MAAM,MAAO;AAC1B,MAAI,IAAI,IAAK,MAAM,MAAO;AAC1B,MAAI,IAAI,IAAK,MAAM,MAAO;AAC1B,MAAI,IAAI,IAAK,MAAM,MAAO;AAC1B,MAAI,IAAI,IAAK,MAAM,MAAO;AAC1B,MAAI,IAAI,IAAK,MAAM,MAAO;AAC1B,MAAI,IAAI,IAAK,MAAM,MAAO;AAC1B,MAAI,IAAI,IAAK,MAAM,MAAO;AAC1B,MAAI,IAAI,IAAK,MAAM,MAAO;AAC1B,MAAI,IAAI,IAAK,MAAM,MAAO;AAC1B,MAAI,IAAI,IAAK,MAAM,MAAO;AAC1B,MAAI,IAAI,IAAK,MAAM,MAAO;AAC1B,MAAI,IAAI,IAAK,MAAM,MAAO;AAC9B;AAKO,IAAM,WAA2B,6BAAa,YAAY;AAAA,EAC7D,cAAc;AAAA,EACd,eAAe;AAAA,EACf,gBAAgB;AACpB,CAAC;AACD,IAAM,UAA0B,oBAAI,WAAW,EAAE;AAEjD,IAAM,eAAe,CAAC,GAAG,QAAQ;AAC7B,IAAE,OAAO,GAAG;AACZ,QAAM,WAAW,IAAI,SAAS;AAC9B,MAAI;AACA,MAAE,OAAO,QAAQ,SAAS,QAAQ,CAAC;AAC3C;AACA,IAAM,UAA0B,oBAAI,WAAW,EAAE;AACjD,SAAS,WAAW,IAAI,KAAK,OAAO,YAAY,KAAK;AACjD,MAAI,QAAQ;AACR,WAAO,KAAK,QAAW,KAAK;AAChC,QAAM,UAAU,GAAG,KAAK,OAAO,OAAO;AACtC,QAAM,UAAU,WAAW,WAAW,QAAQ,MAAM,IAAI,SAAS,GAAG,IAAI;AAGxE,QAAM,IAAI,SAAS,OAAO,OAAO;AACjC,MAAI;AACA,iBAAa,GAAG,GAAG;AACvB,eAAa,GAAG,UAAU;AAC1B,IAAE,OAAO,OAAO;AAChB,QAAM,MAAM,EAAE,OAAO;AACrB,QAAM,SAAS,OAAO;AACtB,SAAO;AACX;AAQO,IAAM,iBAAiB,CAAC,cAAc,CAAC,KAAK,OAAO,QAAQ;AAC9D,QAAM,YAAY;AAClB,SAAO;AAAA,IACH,QAAQ,WAAW,QAAQ;AACvB,YAAM,UAAU,UAAU;AAC1B,eAAS,UAAU,UAAU,WAAW,QAAQ,KAAK;AACrD,aAAO,IAAI,SAAS;AACpB,YAAM,SAAS,OAAO,SAAS,GAAG,CAAC,SAAS;AAE5C,gBAAU,KAAK,OAAO,QAAQ,QAAQ,CAAC;AACvC,YAAM,MAAM,WAAW,WAAW,KAAK,OAAO,QAAQ,GAAG;AACzD,aAAO,IAAI,KAAK,OAAO;AACvB,YAAM,GAAG;AACT,aAAO;AAAA,IACX;AAAA,IACA,QAAQ,YAAY,QAAQ;AACxB,eAAS,UAAU,WAAW,SAAS,WAAW,QAAQ,KAAK;AAC/D,YAAM,OAAO,WAAW,SAAS,GAAG,CAAC,SAAS;AAC9C,YAAM,YAAY,WAAW,SAAS,CAAC,SAAS;AAChD,YAAM,MAAM,WAAW,WAAW,KAAK,OAAO,MAAM,GAAG;AACvD,UAAI,CAAC,WAAW,WAAW,GAAG;AAC1B,cAAM,IAAI,MAAM,aAAa;AACjC,aAAO,IAAI,WAAW,SAAS,GAAG,CAAC,SAAS,CAAC;AAE7C,gBAAU,KAAK,OAAO,QAAQ,QAAQ,CAAC;AACvC,YAAM,GAAG;AACT,aAAO;AAAA,IACX;AAAA,EACJ;AACJ;AAOO,IAAM,mBAAmC,2BAAW,EAAE,WAAW,IAAI,aAAa,IAAI,WAAW,GAAG,GAAG,eAAe,QAAQ,CAAC;;;ACxM/H,IAAM,0BAAN,MAA8B;AAAA,EACjC,YAAY,KAAK;AACb,WAAO,eAAe,MAAM,QAAQ;AAAA,MAChC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,SAAK,OAAO,IAAI,WAAW,cAAc,GAAG,CAAC;AAAA,EACjD;AAAA,EACA,MAAM,KAAK,IAAI,MAAM,KAAK;AACtB,WAAO,MAAM,KAAK,MAAM,cAAc,EAAE,GAAG,cAAc,IAAI,GAAG,cAAc,GAAG,CAAC;AAAA,EACtF;AAAA,EACA,MAAM,KAAK,IAAI,MAAM,KAAK;AACtB,WAAO,MAAM,KAAK,MAAM,cAAc,EAAE,GAAG,cAAc,IAAI,GAAG,cAAc,GAAG,CAAC;AAAA,EACtF;AAAA,EACA,MAAM,IAAI,MAAM,KAAK;AACjB,WAAO,IAAI,QAAQ,CAAC,YAAY;AAC5B,YAAM,MAAM,iBAAiB,KAAK,MAAM,IAAI,WAAW,EAAE,GAAG,IAAI,WAAW,GAAG,CAAC,EAAE,QAAQ,IAAI,WAAW,IAAI,CAAC;AAC7G,cAAQ,IAAI,MAAM;AAAA,IACtB,CAAC;AAAA,EACL;AAAA,EACA,MAAM,IAAI,MAAM,KAAK;AACjB,WAAO,IAAI,QAAQ,CAAC,YAAY;AAC5B,YAAM,MAAM,iBAAiB,KAAK,MAAM,IAAI,WAAW,EAAE,GAAG,IAAI,WAAW,GAAG,CAAC,EAAE,QAAQ,IAAI,WAAW,IAAI,CAAC;AAC7G,cAAQ,IAAI,MAAM;AAAA,IACtB,CAAC;AAAA,EACL;AACJ;AA8BO,IAAM,mBAAN,MAAuB;AAAA,EAC1B,cAAc;AAEV,WAAO,eAAe,MAAM,MAAM;AAAA,MAC9B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,OAAO;AAAA,IAClB,CAAC;AAED,WAAO,eAAe,MAAM,WAAW;AAAA,MACnC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AAED,WAAO,eAAe,MAAM,aAAa;AAAA,MACrC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AAED,WAAO,eAAe,MAAM,WAAW;AAAA,MACnC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AAAA,EACL;AAAA,EACA,wBAAwB,KAAK;AACzB,WAAO,IAAI,wBAAwB,GAAG;AAAA,EAC1C;AACJ;;;AC7FO,SAAS,mBAAmB;AAC/B,SAAO,IAAI,QAAQ,CAAC,UAAU,WAAW;AACrC,WAAO,IAAI,kBAAkB,eAAe,CAAC;AAAA,EACjD,CAAC;AACL;;;ACFA,IAAM,YAAY,IAAI,WAAW,CAAC,KAAK,KAAK,EAAE,CAAC;AACxC,IAAM,sBAAN,MAA0B;AAAA,EAC7B,YAAY,KAAK,KAAK,gBAAgB;AAClC,WAAO,eAAe,MAAM,QAAQ;AAAA,MAChC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,kBAAkB;AAAA,MAC1C,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,QAAQ;AAAA,MAChC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,iBAAiB;AAAA,EAC1B;AAAA,EACA,MAAM,KAAK,OAAO,MAAM;AACpB,WAAO,MAAM,iBAAiB;AAAA,EAClC;AAAA,EACA,MAAM,KAAK,OAAO,MAAM;AACpB,WAAO,MAAM,iBAAiB;AAAA,EAClC;AAAA,EACA,MAAM,OAAO,iBAAiB,KAAK;AAC/B,UAAM,qBAAqB,cAAc,eAAe;AACxD,QAAI,mBAAmB,aAAa,oBAAoB;AACpD,YAAM,IAAI,kBAAkB,2BAA2B;AAAA,IAC3D;AACA,QAAI;AACA,aAAO,MAAM,KAAK,KAAK,cAAc,KAAK,gBAAgB,WAAW,IAAI,WAAW,kBAAkB,GAAG,GAAG;AAAA,IAChH,SACO,GAAG;AACN,YAAM,IAAI,YAAY,CAAC;AAAA,IAC3B;AAAA,EACJ;AACJ;AACO,IAAM,+BAAN,cAA2C,oBAAoB;AACtE;AACO,IAAM,4BAAN,cAAwC,oBAAoB;AAAA,EAC/D,YAAY,KAAK,KAAK,gBAAgB,KAAK;AACvC,UAAM,KAAK,KAAK,cAAc;AAC9B,WAAO,eAAe,MAAM,OAAO;AAAA,MAC/B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,SAAK,MAAM;AACX;AAAA,EACJ;AACJ;;;AC3DO,IAAM,wBAAN,cAAoC,oBAAoB;AAAA,EAC3D,YAAY,KAAK,KAAK,QAAQ;AAC1B,UAAM,KAAK,KAAK,OAAO,cAAc;AAErC,WAAO,eAAe,MAAM,SAAS;AAAA,MACjC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AAED,WAAO,eAAe,MAAM,OAAO;AAAA,MAC/B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AAED,WAAO,eAAe,MAAM,OAAO;AAAA,MAC/B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AAED,WAAO,eAAe,MAAM,OAAO;AAAA,MAC/B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AAED,WAAO,eAAe,MAAM,QAAQ;AAAA,MAChC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,QAAI,OAAO,QAAQ,UAAa,OAAO,cAAc,UACjD,OAAO,QAAQ,QAAW;AAC1B,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACrD;AACA,SAAK,QAAQ,OAAO;AACpB,SAAK,MAAM,KAAK,MAAM;AACtB,SAAK,MAAM,KAAK,MAAM;AACtB,SAAK,MAAM,KAAK,MAAM;AACtB,UAAM,MAAM,KAAK,MAAM,wBAAwB,OAAO,GAAG;AACzD,SAAK,OAAO;AAAA,MACR;AAAA,MACA,WAAW,OAAO;AAAA,MAClB,KAAK,OAAO;AAAA,IAChB;AAAA,EACJ;AAAA,EACA,aAAa,GAAG;AACZ,UAAM,WAAW,MAAM,EAAE,KAAK,EAAE,UAAU,UAAU;AACpD,WAAO,IAAI,EAAE,WAAW,QAAQ,EAAE;AAAA,EACtC;AAAA,EACA,aAAa,GAAG;AAEZ,QAAI,EAAE,MAAM,OAAO,kBAAkB;AACjC,YAAM,IAAI,yBAAyB,uBAAuB;AAAA,IAC9D;AACA,MAAE,OAAO;AACT;AAAA,EACJ;AACJ;;;ACnEA,IAAI,yBAAkE,SAAU,UAAU,OAAO,MAAM,GAAG;AACtG,MAAI,SAAS,OAAO,CAAC,EAAG,OAAM,IAAI,UAAU,+CAA+C;AAC3F,MAAI,OAAO,UAAU,aAAa,aAAa,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAG,OAAM,IAAI,UAAU,0EAA0E;AACjL,SAAO,SAAS,MAAM,IAAI,SAAS,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,EAAE,QAAQ,MAAM,IAAI,QAAQ;AAChG;AACA,IAAI,yBAAkE,SAAU,UAAU,OAAO,OAAO,MAAM,GAAG;AAC7G,MAAI,SAAS,IAAK,OAAM,IAAI,UAAU,gCAAgC;AACtE,MAAI,SAAS,OAAO,CAAC,EAAG,OAAM,IAAI,UAAU,+CAA+C;AAC3F,MAAI,OAAO,UAAU,aAAa,aAAa,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAG,OAAM,IAAI,UAAU,yEAAyE;AAChL,SAAQ,SAAS,MAAM,EAAE,KAAK,UAAU,KAAK,IAAI,IAAI,EAAE,QAAQ,QAAQ,MAAM,IAAI,UAAU,KAAK,GAAI;AACxG;AACA,IAAI;AACG,IAAM,QAAN,MAAY;AAAA,EACf,cAAc;AACV,kBAAc,IAAI,MAAM,QAAQ,QAAQ,CAAC;AAAA,EAC7C;AAAA,EACA,MAAM,OAAO;AACT,QAAI;AACJ,UAAM,WAAW,IAAI,QAAQ,CAAC,YAAY;AACtC,oBAAc;AAAA,IAClB,CAAC;AACD,UAAM,eAAe,uBAAuB,MAAM,eAAe,GAAG;AACpE,2BAAuB,MAAM,eAAe,UAAU,GAAG;AACzD,UAAM;AACN,WAAO;AAAA,EACX;AACJ;AACA,gBAAgB,oBAAI,QAAQ;;;AC3B5B,IAAIC,0BAAkE,SAAU,UAAU,OAAO,MAAM,GAAG;AACtG,MAAI,SAAS,OAAO,CAAC,EAAG,OAAM,IAAI,UAAU,+CAA+C;AAC3F,MAAI,OAAO,UAAU,aAAa,aAAa,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAG,OAAM,IAAI,UAAU,0EAA0E;AACjL,SAAO,SAAS,MAAM,IAAI,SAAS,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,EAAE,QAAQ,MAAM,IAAI,QAAQ;AAChG;AACA,IAAIC,0BAAkE,SAAU,UAAU,OAAO,OAAO,MAAM,GAAG;AAC7G,MAAI,SAAS,IAAK,OAAM,IAAI,UAAU,gCAAgC;AACtE,MAAI,SAAS,OAAO,CAAC,EAAG,OAAM,IAAI,UAAU,+CAA+C;AAC3F,MAAI,OAAO,UAAU,aAAa,aAAa,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAG,OAAM,IAAI,UAAU,yEAAyE;AAChL,SAAQ,SAAS,MAAM,EAAE,KAAK,UAAU,KAAK,IAAI,IAAI,EAAE,QAAQ,QAAQ,MAAM,IAAI,UAAU,KAAK,GAAI;AACxG;AACA,IAAI;AAIG,IAAM,uBAAN,cAAmC,sBAAsB;AAAA,EAC5D,cAAc;AACV,UAAM,GAAG,SAAS;AAClB,gCAA4B,IAAI,MAAM,MAAM;AAAA,EAChD;AAAA,EACA,MAAM,KAAK,MAAM,MAAM,MAAM,QAAQ;AACjC,IAAAA,wBAAuB,MAAM,6BAA6BD,wBAAuB,MAAM,6BAA6B,GAAG,KAAK,IAAI,MAAM,GAAG,GAAG;AAC5I,UAAM,UAAU,MAAMA,wBAAuB,MAAM,6BAA6B,GAAG,EAAE,KAAK;AAC1F,QAAI;AACJ,QAAI;AACA,WAAK,MAAM,KAAK,KAAK,IAAI,KAAK,KAAK,aAAa,KAAK,IAAI,GAAG,cAAc,IAAI,GAAG,cAAc,GAAG,CAAC;AAAA,IACvG,SACO,GAAG;AACN,YAAM,IAAI,UAAU,CAAC;AAAA,IACzB,UACA;AACI,cAAQ;AAAA,IACZ;AACA,SAAK,aAAa,KAAK,IAAI;AAC3B,WAAO;AAAA,EACX;AACJ;AACA,8BAA8B,oBAAI,QAAQ;;;ACrC1C,IAAIE,0BAAkE,SAAU,UAAU,OAAO,MAAM,GAAG;AACtG,MAAI,SAAS,OAAO,CAAC,EAAG,OAAM,IAAI,UAAU,+CAA+C;AAC3F,MAAI,OAAO,UAAU,aAAa,aAAa,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAG,OAAM,IAAI,UAAU,0EAA0E;AACjL,SAAO,SAAS,MAAM,IAAI,SAAS,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,EAAE,QAAQ,MAAM,IAAI,QAAQ;AAChG;AACA,IAAIC,0BAAkE,SAAU,UAAU,OAAO,OAAO,MAAM,GAAG;AAC7G,MAAI,SAAS,IAAK,OAAM,IAAI,UAAU,gCAAgC;AACtE,MAAI,SAAS,OAAO,CAAC,EAAG,OAAM,IAAI,UAAU,+CAA+C;AAC3F,MAAI,OAAO,UAAU,aAAa,aAAa,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAG,OAAM,IAAI,UAAU,yEAAyE;AAChL,SAAQ,SAAS,MAAM,EAAE,KAAK,UAAU,KAAK,IAAI,IAAI,EAAE,QAAQ,QAAQ,MAAM,IAAI,UAAU,KAAK,GAAI;AACxG;AACA,IAAI;AAIG,IAAM,oBAAN,cAAgC,sBAAsB;AAAA,EACzD,YAAY,KAAK,KAAK,QAAQ,KAAK;AAC/B,UAAM,KAAK,KAAK,MAAM;AACtB,WAAO,eAAe,MAAM,OAAO;AAAA,MAC/B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,6BAAyB,IAAI,MAAM,MAAM;AACzC,SAAK,MAAM;AAAA,EACf;AAAA,EACA,MAAM,KAAK,MAAM,MAAM,MAAM,QAAQ;AACjC,IAAAA,wBAAuB,MAAM,0BAA0BD,wBAAuB,MAAM,0BAA0B,GAAG,KAAK,IAAI,MAAM,GAAG,GAAG;AACtI,UAAM,UAAU,MAAMA,wBAAuB,MAAM,0BAA0B,GAAG,EAAE,KAAK;AACvF,QAAI;AACJ,QAAI;AACA,WAAK,MAAM,KAAK,KAAK,IAAI,KAAK,KAAK,aAAa,KAAK,IAAI,GAAG,cAAc,IAAI,GAAG,cAAc,GAAG,CAAC;AAAA,IACvG,SACO,GAAG;AACN,YAAM,IAAI,UAAU,CAAC;AAAA,IACzB,UACA;AACI,cAAQ;AAAA,IACZ;AACA,SAAK,aAAa,KAAK,IAAI;AAC3B,WAAO;AAAA,EACX;AACJ;AACA,2BAA2B,oBAAI,QAAQ;;;ACtCvC,IAAM,mBAAmB,IAAI,WAAW;AAAA,EACpC;AAAA,EAAI;AAAA,EAAI;AAAA,EAAK;AAAA,EAAK;AAAA,EAAI;AAAA,EAAK;AAAA,EAAK;AAAA,EAAK;AAAA,EAAI;AAC7C,CAAC;AAED,IAAM,YAAY,IAAI,WAAW,CAAC,KAAK,KAAK,GAAG,CAAC;AAGhD,IAAM,kBAAkB,IAAI,WAAW;AAAA,EACnC;AAAA,EAAK;AAAA,EAAK;AAAA,EAAK;AAAA,EAAK;AAAA,EAAI;AAAA,EAAK;AAAA,EAAI;AAAA,EAAK;AAC1C,CAAC;AAED,IAAM,YAAY,IAAI,WAAW,CAAC,KAAK,KAAK,GAAG,CAAC;AAGhD,IAAM,oBAAoB,IAAI,WAAW;AAAA,EACrC;AAAA,EAAK;AAAA,EAAK;AAAA,EAAK;AAAA,EAAI;AAAA,EAAK;AAAA,EAAK;AAAA,EAAI;AAAA,EAAK;AAAA,EAAI;AAAA,EAAK;AACnD,CAAC;AAED,IAAM,eAAe,IAAI,WAAW,CAAC,KAAK,KAAK,IAAI,KAAK,KAAK,GAAG,CAAC;AAGjE,IAAM,uBAAuB,IAAI,WAAW;AAAA,EACxC;AAAA,EAAI;AAAA,EAAI;AAAA,EAAI;AAAA,EAAI;AAAA,EAAG;AAAA,EAAG;AAAA,EAAG;AAAA,EAAG;AAAA,EAAG;AACnC,CAAC;AAiEM,IAAM,oBAAN,cAAgC,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQnD,YAAY,QAAQ;AAChB,UAAM;AACN,WAAO,eAAe,MAAM,QAAQ;AAAA,MAChC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,QAAQ;AAAA,MAChC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,SAAS;AAAA,MACjC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AACD,WAAO,eAAe,MAAM,YAAY;AAAA,MACpC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AAED,QAAI,OAAO,OAAO,QAAQ,UAAU;AAChC,YAAM,IAAI,kBAAkB,sBAAsB;AAAA,IACtD;AACA,SAAK,OAAO,OAAO;AAEnB,QAAI,OAAO,OAAO,QAAQ,UAAU;AAChC,YAAM,IAAI,kBAAkB,sBAAsB;AAAA,IACtD;AACA,SAAK,OAAO,OAAO;AAEnB,QAAI,OAAO,OAAO,SAAS,UAAU;AACjC,YAAM,IAAI,kBAAkB,uBAAuB;AAAA,IACvD;AACA,SAAK,QAAQ,OAAO;AACpB,SAAK,WAAW,IAAI,WAAW,oBAAoB;AACnD,SAAK,SAAS,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC;AAC3C,SAAK,SAAS,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC;AAC3C,SAAK,SAAS,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC;AAC5C,SAAK,KAAK,KAAK,KAAK,QAAQ;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA,EAIA,IAAI,MAAM;AACN,WAAO,KAAK;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAIA,IAAI,MAAM;AACN,WAAO,KAAK;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAIA,IAAI,OAAO;AACP,WAAO,KAAK;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,oBAAoB,QAAQ;AAC9B,SAAK,qBAAqB,MAAM;AAChC,UAAM,KAAK,OAAO;AAClB,UAAM,KAAK,MAAM,KAAK,KAAK,MAAM,MAAM;AACvC,QAAI;AACJ,QAAI,OAAO,QAAQ,QAAW;AAC1B,aAAO,OAAO,cAAc,SAAY,KAAK,UAAU,KAAK;AAAA,IAChE,OACK;AACD,aAAO,OAAO,cAAc,SAAY,KAAK,OAAO,KAAK;AAAA,IAC7D;AACA,WAAO,MAAM,KAAK,cAAc,MAAM,GAAG,cAAc,GAAG,KAAK,MAAM;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,uBAAuB,QAAQ;AACjC,SAAK,qBAAqB,MAAM;AAChC,UAAM,KAAK,OAAO;AAClB,UAAM,eAAe,MAAM,KAAK,KAAK,MAAM,MAAM;AACjD,QAAI;AACJ,QAAI,OAAO,QAAQ,QAAW;AAC1B,aAAO,OAAO,oBAAoB,SAAY,KAAK,UAAU,KAAK;AAAA,IACtE,OACK;AACD,aAAO,OAAO,oBAAoB,SAAY,KAAK,OAAO,KAAK;AAAA,IACnE;AACA,WAAO,MAAM,KAAK,cAAc,MAAM,cAAc,MAAM;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,KAAK,QAAQ,IAAI,MAAM,MAAM,QAAQ;AACvC,UAAM,MAAM,MAAM,KAAK,oBAAoB,MAAM;AACjD,WAAO;AAAA,MACH,IAAI,MAAM,IAAI,KAAK,IAAI,GAAG;AAAA,MAC1B,KAAK,IAAI;AAAA,IACb;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,KAAK,QAAQ,IAAI,MAAM,MAAM,QAAQ;AACvC,UAAM,MAAM,MAAM,KAAK,uBAAuB,MAAM;AACpD,WAAO,MAAM,IAAI,KAAK,IAAI,GAAG;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,aAAa,MAAM,cAAc,QAAQ;AAK3C,UAAM,QAAQ,OAAO,QAAQ,SACvB,QACA,aAAa,OAAO,IAAI,EAAE;AAChC,UAAM,YAAY,MAAM,KAAK,KAAK,eAAe,OAAO,mBAAmB,KAAK;AAChF,UAAM,OAAO,OAAO,SAAS,SAAY,QAAQ,aAAa,OAAO,IAAI;AACzE,UAAM,WAAW,MAAM,KAAK,KAAK,eAAe,OAAO,iBAAiB,IAAI;AAC5E,UAAM,qBAAqB,IAAI,WAAW,IAAI,UAAU,aAAa,SAAS,UAAU;AACxF,uBAAmB,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;AAChD,uBAAmB,IAAI,IAAI,WAAW,SAAS,GAAG,CAAC;AACnD,uBAAmB,IAAI,IAAI,WAAW,QAAQ,GAAG,IAAI,UAAU,UAAU;AACzE,UAAM,MAAM,OAAO,QAAQ,SAAY,QAAQ,aAAa,OAAO,IAAI,GAAG;AAC1E,UAAM,MAAM,KAAK,KAAK,gBAAgB,cAAc,GAAG;AACvD,UAAM,qBAAqB,KAAK,KAAK,iBAAiB,WAAW,oBAAoB,KAAK,KAAK,QAAQ;AACvG,UAAM,iBAAiB,MAAM,KAAK,KAAK,iBAAiB,cAAc,KAAK,oBAAoB,KAAK,KAAK,QAAQ;AACjH,QAAI,KAAK,MAAM,OAAO,OAAO,YAAY;AACrC,aAAO,EAAE,MAAM,KAAK,OAAO,eAA+B;AAAA,IAC9D;AACA,UAAM,UAAU,KAAK,KAAK,iBAAiB,WAAW,oBAAoB,KAAK,MAAM,OAAO;AAC5F,UAAM,MAAM,MAAM,KAAK,KAAK,iBAAiB,cAAc,KAAK,SAAS,KAAK,MAAM,OAAO;AAC3F,UAAM,gBAAgB,KAAK,KAAK,iBAAiB,kBAAkB,oBAAoB,KAAK,MAAM,SAAS;AAC3G,UAAM,YAAY,MAAM,KAAK,KAAK,iBAAiB,cAAc,KAAK,eAAe,KAAK,MAAM,SAAS;AACzG,WAAO;AAAA,MACH,MAAM,KAAK;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW,IAAI,WAAW,SAAS;AAAA,MACnC,KAAK;AAAA,IACT;AAAA,EACJ;AAAA,EACA,MAAM,cAAc,MAAM,cAAc,KAAK,QAAQ;AACjD,UAAM,MAAM,MAAM,KAAK,aAAa,MAAM,cAAc,MAAM;AAC9D,QAAI,IAAI,QAAQ,QAAW;AACvB,aAAO,IAAI,0BAA0B,KAAK,MAAM,KAAK,MAAM,IAAI,gBAAgB,GAAG;AAAA,IACtF;AACA,WAAO,IAAI,kBAAkB,KAAK,MAAM,KAAK,MAAM,KAAK,GAAG;AAAA,EAC/D;AAAA,EACA,MAAM,cAAc,MAAM,cAAc,QAAQ;AAC5C,UAAM,MAAM,MAAM,KAAK,aAAa,MAAM,cAAc,MAAM;AAC9D,QAAI,IAAI,QAAQ,QAAW;AACvB,aAAO,IAAI,6BAA6B,KAAK,MAAM,KAAK,MAAM,IAAI,cAAc;AAAA,IACpF;AACA,WAAO,IAAI,qBAAqB,KAAK,MAAM,KAAK,MAAM,GAAG;AAAA,EAC7D;AAAA,EACA,qBAAqB,QAAQ;AACzB,QAAI,OAAO,SAAS,UAChB,OAAO,KAAK,aAAa,mBAAmB;AAC5C,YAAM,IAAI,kBAAkB,eAAe;AAAA,IAC/C;AACA,QAAI,OAAO,QAAQ,QAAW;AAC1B,UAAI,OAAO,IAAI,IAAI,aAAa,oBAAoB;AAChD,cAAM,IAAI,kBAAkB,0BAA0B,kBAAkB,QAAQ;AAAA,MACpF;AACA,UAAI,OAAO,IAAI,IAAI,aAAa,oBAAoB;AAChD,cAAM,IAAI,kBAAkB,kBAAkB;AAAA,MAClD;AACA,UAAI,OAAO,IAAI,GAAG,aAAa,oBAAoB;AAC/C,cAAM,IAAI,kBAAkB,iBAAiB;AAAA,MACjD;AAAA,IACJ;AACA;AAAA,EACJ;AACJ;;;ACjQO,IAAM,cAAN,cAA0B,kBAAkB;AACnD;AA0GO,IAAM,aAAN,cAAyB,iBAAiB;AACjD;;;AC7KA,IAAM,sBAAsB,IAAI,WAAW;AAAA,EACvC;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAC1C;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAC9C,CAAC;;;ACHD,IAAM,oBAAoB,IAAI,WAAW;AAAA,EACrC;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAC1C;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAC9C,CAAC;;;ACWD,IAAME,OAAM;AACZ,IAAMC,OAAM;AACZ,IAAM,MAAM;AACZ,IAAM,MAAM;AAEZ,IAAM,kBAAkB;AACxB,SAAS,oBAAoB,GAAG;AAC5B,QAAM,OAAO;AACb,QAAM,OAAO;AACb,QAAM,OAAO;AACb,QAAM,OAAO;AACb,QAAM,IAAI;AACV,QAAM,KAAM,IAAI,IAAK;AACrB,QAAM,KAAM,KAAK,IAAK;AACtB,QAAM,KAAM,KAAK,IAAIA,MAAK,CAAC,IAAI,KAAM;AACrC,QAAM,KAAM,KAAK,IAAID,MAAK,CAAC,IAAI,IAAK;AACpC,QAAM,MAAO,KAAK,IAAI,KAAK,CAAC,IAAI,KAAM;AACtC,QAAM,MAAO,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO;AACzC,QAAM,MAAO,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO;AACzC,QAAM,MAAO,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO;AACzC,QAAM,OAAQ,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO;AAC1C,QAAM,OAAQ,KAAK,MAAM,MAAM,CAAC,IAAI,MAAO;AAC3C,QAAM,OAAQ,KAAK,MAAM,MAAM,CAAC,IAAI,MAAO;AAC3C,QAAM,YAAa,KAAK,MAAMC,MAAK,CAAC,IAAI,IAAK;AAE7C,SAAO,EAAE,WAAW,GAAG;AAC3B;AACA,SAAS,kBAAkB,OAAO;AAG9B,QAAM,CAAC,KAAK;AAEZ,QAAM,EAAE,KAAK;AAEb,QAAM,EAAE,KAAK;AACb,SAAO;AACX;AACO,IAAM,SAA0B,uBAAM;AACzC,QAAM,IAAI;AACV,SAAO,WAAW;AAAA,IACd;AAAA,IACA,MAAM;AAAA,IACN,YAAY,CAAC,MAAM;AAEf,YAAM,EAAE,WAAW,GAAG,IAAI,oBAAoB,CAAC;AAC/C,aAAO,IAAI,KAAK,WAAW,KAAK,CAAC,IAAI,IAAI,CAAC;AAAA,IAC9C;AAAA,IACA;AAAA,EACJ,CAAC;AACL,GAAG;;;ACjEI,IAAMC,cAAN,cAAyB,iBAAiB;AAAA,EAC7C,MAAM,QAAQ,MAAM,KAAK;AACrB,UAAM,KAAK,OAAO;AAClB,UAAM,UAAU,KAAK,eAAe,IAC9B,IAAI,YAAY,KAAK,QAAQ,IAC7B,cAAc,IAAI;AACxB,UAAM,SAAS,cAAc,GAAG;AAChC,QAAI,QAAQ,eAAe,KAAK,UAAU;AACtC,aAAO,KAAK,QAAQ,IAAI,WAAW,OAAO,GAAG,IAAI,WAAW,MAAM,CAAC,EAC9D;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,KAAK,UAAU,OAAO,SAAS,KAAK,SAAS,OAAO;AAAA,MACvE;AAAA,IACJ,CAAC;AACD,WAAO,MAAM,KAAK,KAAK,KAAK,QAAQ,KAAK,MAAM;AAAA,EACnD;AACJ;;;ACdO,IAAMC,UAAN,cAAqB,sBAAsB;AAAA,EAC9C,YAAY,MAAM;AACd,UAAM,UAAU,IAAI,QAAQ,IAAI;AAAA,EACpC;AAAA,EACA,OAAO,IAAI,IAAI;AACX,QAAI;AACA,aAAO,QAAQ,QAAQ,KAAK,OAAO,gBAAgB,IAAI,EAAE,CAAC;AAAA,IAC9D,SACO,GAAG;AACN,aAAO,QAAQ,OAAO,IAAI,eAAe,CAAC,CAAC;AAAA,IAC/C;AAAA,EACJ;AACJ;AA2BO,IAAMC,yBAAN,cAAoC,MAAM;AAAA,EAC7C,cAAc;AACV,UAAM,MAAM,IAAIC,YAAW;AAC3B,UAAM,MAAM,uBAAuB,IAAIF,QAAO,GAAG,GAAG,GAAG;AAEvD,WAAO,eAAe,MAAM,MAAM;AAAA,MAC9B,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO,MAAM;AAAA,IACjB,CAAC;AAED,WAAO,eAAe,MAAM,cAAc;AAAA,MACtC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AAED,WAAO,eAAe,MAAM,WAAW;AAAA,MACnC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AAED,WAAO,eAAe,MAAM,iBAAiB;AAAA,MACzC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AAED,WAAO,eAAe,MAAM,kBAAkB;AAAA,MAC1C,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACX,CAAC;AAAA,EACL;AACJ;;;ACtEA;AAGM,SAAUG,SAAQ,GAAU;AAChC,SAAO,aAAa,cAAe,YAAY,OAAO,CAAC,KAAK,EAAE,YAAY,SAAS;AACrF;AAGM,SAAUC,SAAQ,GAAS;AAC/B,MAAI,CAAC,OAAO,cAAc,CAAC,KAAK,IAAI;AAAG,UAAM,IAAI,MAAM,oCAAoC,CAAC;AAC9F;AAGM,SAAUC,QAAO,MAA8B,SAAiB;AACpE,MAAI,CAACF,SAAQ,CAAC;AAAG,UAAM,IAAI,MAAM,qBAAqB;AACtD,MAAI,QAAQ,SAAS,KAAK,CAAC,QAAQ,SAAS,EAAE,MAAM;AAClD,UAAM,IAAI,MAAM,mCAAmC,UAAU,kBAAkB,EAAE,MAAM;AAC3F;AAWM,SAAUG,SAAQ,UAAe,gBAAgB,MAAI;AACzD,MAAI,SAAS;AAAW,UAAM,IAAI,MAAM,kCAAkC;AAC1E,MAAI,iBAAiB,SAAS;AAAU,UAAM,IAAI,MAAM,uCAAuC;AACjG;AAGM,SAAUC,SAAQ,KAAU,UAAa;AAC7C,EAAAC,QAAO,GAAG;AACV,QAAM,MAAM,SAAS;AACrB,MAAI,IAAI,SAAS,KAAK;AACpB,UAAM,IAAI,MAAM,2DAA2D,GAAG;EAChF;AACF;AAkBM,SAAUC,UAAS,QAAoB;AAC3C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,WAAO,CAAC,EAAE,KAAK,CAAC;EAClB;AACF;AAGM,SAAUC,YAAW,KAAe;AACxC,SAAO,IAAI,SAAS,IAAI,QAAQ,IAAI,YAAY,IAAI,UAAU;AAChE;AA6CA,IAAMC,iBAA0C;;EAE9C,OAAO,WAAW,KAAK,CAAA,CAAE,EAAE,UAAU,cAAc,OAAO,WAAW,YAAY;GAAW;AAG9F,IAAMC,SAAwB,sBAAM,KAAK,EAAE,QAAQ,IAAG,GAAI,CAAC,GAAG,MAC5D,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAO3B,SAAUC,YAAW,OAAiB;AAC1C,EAAAC,QAAO,KAAK;AAEZ,MAAIH;AAAe,WAAO,MAAM,MAAK;AAErC,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,WAAOC,OAAM,MAAM,CAAC,CAAC;EACvB;AACA,SAAO;AACT;AAGA,IAAMG,UAAS,EAAE,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAG;AAC5D,SAASC,eAAc,IAAU;AAC/B,MAAI,MAAMD,QAAO,MAAM,MAAMA,QAAO;AAAI,WAAO,KAAKA,QAAO;AAC3D,MAAI,MAAMA,QAAO,KAAK,MAAMA,QAAO;AAAG,WAAO,MAAMA,QAAO,IAAI;AAC9D,MAAI,MAAMA,QAAO,KAAK,MAAMA,QAAO;AAAG,WAAO,MAAMA,QAAO,IAAI;AAC9D;AACF;AAMM,SAAUE,YAAW,KAAW;AACpC,MAAI,OAAO,QAAQ;AAAU,UAAM,IAAI,MAAM,8BAA8B,OAAO,GAAG;AAErF,MAAIN;AAAe,WAAO,WAAW,QAAQ,GAAG;AAChD,QAAM,KAAK,IAAI;AACf,QAAM,KAAK,KAAK;AAChB,MAAI,KAAK;AAAG,UAAM,IAAI,MAAM,qDAAqD,EAAE;AACnF,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,WAAS,KAAK,GAAG,KAAK,GAAG,KAAK,IAAI,MAAM,MAAM,GAAG;AAC/C,UAAM,KAAKK,eAAc,IAAI,WAAW,EAAE,CAAC;AAC3C,UAAM,KAAKA,eAAc,IAAI,WAAW,KAAK,CAAC,CAAC;AAC/C,QAAI,OAAO,UAAa,OAAO,QAAW;AACxC,YAAM,OAAO,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC;AACjC,YAAM,IAAI,MAAM,iDAAiD,OAAO,gBAAgB,EAAE;IAC5F;AACA,UAAM,EAAE,IAAI,KAAK,KAAK;EACxB;AACA,SAAO;AACT;AAkCM,SAAU,YAAY,KAAW;AACrC,MAAI,OAAO,QAAQ;AAAU,UAAM,IAAI,MAAM,iBAAiB;AAC9D,SAAO,IAAI,WAAW,IAAI,YAAW,EAAG,OAAO,GAAG,CAAC;AACrD;AAiBM,SAAU,QAAQ,MAAW;AACjC,MAAI,OAAO,SAAS;AAAU,WAAO,YAAY,IAAI;AACrD,EAAAE,QAAO,IAAI;AACX,SAAO;AACT;AAeM,SAAU,eAAe,QAAoB;AACjD,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,IAAI,OAAO,CAAC;AAClB,IAAAC,QAAO,CAAC;AACR,WAAO,EAAE;EACX;AACA,QAAM,MAAM,IAAI,WAAW,GAAG;AAC9B,WAAS,IAAI,GAAG,MAAM,GAAG,IAAI,OAAO,QAAQ,KAAK;AAC/C,UAAM,IAAI,OAAO,CAAC;AAClB,QAAI,IAAI,GAAG,GAAG;AACd,WAAO,EAAE;EACX;AACA,SAAO;AACT;AAsBM,IAAgB,OAAhB,MAAoB;;AA4CpB,SAAUC,cACd,UAAuB;AAOvB,QAAM,QAAQ,CAAC,QAA2B,SAAQ,EAAG,OAAO,QAAQ,GAAG,CAAC,EAAE,OAAM;AAChF,QAAM,MAAM,SAAQ;AACpB,QAAM,YAAY,IAAI;AACtB,QAAM,WAAW,IAAI;AACrB,QAAM,SAAS,MAAM,SAAQ;AAC7B,SAAO;AACT;AAsCM,SAAU,YAAY,cAAc,IAAE;AAC1C,MAAIC,WAAU,OAAOA,QAAO,oBAAoB,YAAY;AAC1D,WAAOA,QAAO,gBAAgB,IAAI,WAAW,WAAW,CAAC;EAC3D;AAEA,MAAIA,WAAU,OAAOA,QAAO,gBAAgB,YAAY;AACtD,WAAO,WAAW,KAAKA,QAAO,YAAY,WAAW,CAAC;EACxD;AACA,QAAM,IAAI,MAAM,wCAAwC;AAC1D;;;ACnYM,SAAU,aACd,MACA,YACA,OACAC,OAAa;AAEb,MAAI,OAAO,KAAK,iBAAiB;AAAY,WAAO,KAAK,aAAa,YAAY,OAAOA,KAAI;AAC7F,QAAMC,QAAO,OAAO,EAAE;AACtB,QAAM,WAAW,OAAO,UAAU;AAClC,QAAM,KAAK,OAAQ,SAASA,QAAQ,QAAQ;AAC5C,QAAM,KAAK,OAAO,QAAQ,QAAQ;AAClC,QAAM,IAAID,QAAO,IAAI;AACrB,QAAM,IAAIA,QAAO,IAAI;AACrB,OAAK,UAAU,aAAa,GAAG,IAAIA,KAAI;AACvC,OAAK,UAAU,aAAa,GAAG,IAAIA,KAAI;AACzC;AAgBM,IAAgBE,UAAhB,cAAoD,KAAO;EAoB/D,YAAY,UAAkB,WAAmB,WAAmBC,OAAa;AAC/E,UAAK;AANG,SAAA,WAAW;AACX,SAAA,SAAS;AACT,SAAA,MAAM;AACN,SAAA,YAAY;AAIpB,SAAK,WAAW;AAChB,SAAK,YAAY;AACjB,SAAK,YAAY;AACjB,SAAK,OAAOA;AACZ,SAAK,SAAS,IAAI,WAAW,QAAQ;AACrC,SAAK,OAAOC,YAAW,KAAK,MAAM;EACpC;EACA,OAAO,MAAW;AAChB,IAAAC,SAAQ,IAAI;AACZ,WAAO,QAAQ,IAAI;AACnB,IAAAC,QAAO,IAAI;AACX,UAAM,EAAE,MAAM,QAAQ,SAAQ,IAAK;AACnC,UAAM,MAAM,KAAK;AACjB,aAAS,MAAM,GAAG,MAAM,OAAO;AAC7B,YAAM,OAAO,KAAK,IAAI,WAAW,KAAK,KAAK,MAAM,GAAG;AAEpD,UAAI,SAAS,UAAU;AACrB,cAAM,WAAWF,YAAW,IAAI;AAChC,eAAO,YAAY,MAAM,KAAK,OAAO;AAAU,eAAK,QAAQ,UAAU,GAAG;AACzE;MACF;AACA,aAAO,IAAI,KAAK,SAAS,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG;AACnD,WAAK,OAAO;AACZ,aAAO;AACP,UAAI,KAAK,QAAQ,UAAU;AACzB,aAAK,QAAQ,MAAM,CAAC;AACpB,aAAK,MAAM;MACb;IACF;AACA,SAAK,UAAU,KAAK;AACpB,SAAK,WAAU;AACf,WAAO;EACT;EACA,WAAW,KAAe;AACxB,IAAAC,SAAQ,IAAI;AACZ,IAAAE,SAAQ,KAAK,IAAI;AACjB,SAAK,WAAW;AAIhB,UAAM,EAAE,QAAQ,MAAM,UAAU,MAAAJ,MAAI,IAAK;AACzC,QAAI,EAAE,IAAG,IAAK;AAEd,WAAO,KAAK,IAAI;AAChB,IAAAK,OAAM,KAAK,OAAO,SAAS,GAAG,CAAC;AAG/B,QAAI,KAAK,YAAY,WAAW,KAAK;AACnC,WAAK,QAAQ,MAAM,CAAC;AACpB,YAAM;IACR;AAEA,aAAS,IAAI,KAAK,IAAI,UAAU;AAAK,aAAO,CAAC,IAAI;AAIjD,iBAAa,MAAM,WAAW,GAAG,OAAO,KAAK,SAAS,CAAC,GAAGL,KAAI;AAC9D,SAAK,QAAQ,MAAM,CAAC;AACpB,UAAM,QAAQC,YAAW,GAAG;AAC5B,UAAM,MAAM,KAAK;AAEjB,QAAI,MAAM;AAAG,YAAM,IAAI,MAAM,6CAA6C;AAC1E,UAAM,SAAS,MAAM;AACrB,UAAM,QAAQ,KAAK,IAAG;AACtB,QAAI,SAAS,MAAM;AAAQ,YAAM,IAAI,MAAM,oCAAoC;AAC/E,aAAS,IAAI,GAAG,IAAI,QAAQ;AAAK,YAAM,UAAU,IAAI,GAAG,MAAM,CAAC,GAAGD,KAAI;EACxE;EACA,SAAM;AACJ,UAAM,EAAE,QAAQ,UAAS,IAAK;AAC9B,SAAK,WAAW,MAAM;AACtB,UAAM,MAAM,OAAO,MAAM,GAAG,SAAS;AACrC,SAAK,QAAO;AACZ,WAAO;EACT;EACA,WAAW,IAAM;AACf,WAAA,KAAO,IAAK,KAAK,YAAmB;AACpC,OAAG,IAAI,GAAG,KAAK,IAAG,CAAE;AACpB,UAAM,EAAE,UAAU,QAAQ,QAAQ,UAAU,WAAW,IAAG,IAAK;AAC/D,OAAG,YAAY;AACf,OAAG,WAAW;AACd,OAAG,SAAS;AACZ,OAAG,MAAM;AACT,QAAI,SAAS;AAAU,SAAG,OAAO,IAAI,MAAM;AAC3C,WAAO;EACT;EACA,QAAK;AACH,WAAO,KAAK,WAAU;EACxB;;AAyBK,IAAMM,aAAyC,4BAAY,KAAK;EACrE;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EACpF;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;CACrF;;;AC1KD,IAAMC,cAA6B,uBAAO,KAAK,KAAK,CAAC;AACrD,IAAMC,QAAuB,uBAAO,EAAE;AAEtC,SAASC,SACP,GACA,KAAK,OAAK;AAKV,MAAI;AAAI,WAAO,EAAE,GAAG,OAAO,IAAIF,WAAU,GAAG,GAAG,OAAQ,KAAKC,QAAQD,WAAU,EAAC;AAC/E,SAAO,EAAE,GAAG,OAAQ,KAAKC,QAAQD,WAAU,IAAI,GAAG,GAAG,OAAO,IAAIA,WAAU,IAAI,EAAC;AACjF;AAEA,SAASG,OAAM,KAAe,KAAK,OAAK;AACtC,QAAM,MAAM,IAAI;AAChB,MAAI,KAAK,IAAI,YAAY,GAAG;AAC5B,MAAI,KAAK,IAAI,YAAY,GAAG;AAC5B,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,UAAM,EAAE,GAAG,EAAC,IAAKD,SAAQ,IAAI,CAAC,GAAG,EAAE;AACnC,KAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;EACxB;AACA,SAAO,CAAC,IAAI,EAAE;AAChB;AAIA,IAAME,SAAQ,CAAC,GAAW,IAAY,MAAsB,MAAM;AAClE,IAAMC,SAAQ,CAAC,GAAW,GAAW,MAAuB,KAAM,KAAK,IAAO,MAAM;AAEpF,IAAMC,UAAS,CAAC,GAAW,GAAW,MAAuB,MAAM,IAAM,KAAM,KAAK;AACpF,IAAMC,UAAS,CAAC,GAAW,GAAW,MAAuB,KAAM,KAAK,IAAO,MAAM;AAErF,IAAMC,UAAS,CAAC,GAAW,GAAW,MAAuB,KAAM,KAAK,IAAO,MAAO,IAAI;AAC1F,IAAMC,UAAS,CAAC,GAAW,GAAW,MAAuB,MAAO,IAAI,KAAQ,KAAM,KAAK;AAa3F,SAASC,KACP,IACA,IACA,IACA,IAAU;AAKV,QAAM,KAAK,OAAO,MAAM,OAAO;AAC/B,SAAO,EAAE,GAAI,KAAK,MAAO,IAAI,KAAK,KAAM,KAAM,GAAG,GAAG,IAAI,EAAC;AAC3D;AAEA,IAAMC,SAAQ,CAAC,IAAY,IAAY,QAAwB,OAAO,MAAM,OAAO,MAAM,OAAO;AAChG,IAAMC,SAAQ,CAAC,KAAa,IAAY,IAAY,OACjD,KAAK,KAAK,MAAO,MAAM,KAAK,KAAM,KAAM;AAC3C,IAAMC,SAAQ,CAAC,IAAY,IAAY,IAAY,QAChD,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO;AACjD,IAAMC,SAAQ,CAAC,KAAa,IAAY,IAAY,IAAY,OAC7D,KAAK,KAAK,KAAK,MAAO,MAAM,KAAK,KAAM,KAAM;AAChD,IAAMC,SAAQ,CAAC,IAAY,IAAY,IAAY,IAAY,QAC5D,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO;AAC9D,IAAMC,SAAQ,CAAC,KAAa,IAAY,IAAY,IAAY,IAAY,OACzE,KAAK,KAAK,KAAK,KAAK,MAAO,MAAM,KAAK,KAAM,KAAM;;;ACmDrD,IAAM,OAAwB,uBAAUC,OAAM;EAC5C;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE;EAAsB;EAAsB;EAAsB;EAClE,IAAI,OAAK,OAAO,CAAC,CAAC,CAAC,GAAE;AACvB,IAAM,YAA6B,uBAAM,KAAK,CAAC,GAAE;AACjD,IAAM,YAA6B,uBAAM,KAAK,CAAC,GAAE;AAGjD,IAAM,aAA6B,oBAAI,YAAY,EAAE;AACrD,IAAM,aAA6B,oBAAI,YAAY,EAAE;AAE/C,IAAO,SAAP,cAAsBC,QAAc;EAqBxC,YAAY,YAAoB,IAAE;AAChC,UAAM,KAAK,WAAW,IAAI,KAAK;AAlBvB,SAAA,KAAaC,WAAU,CAAC,IAAI;AAC5B,SAAA,KAAaA,WAAU,CAAC,IAAI;AAC5B,SAAA,KAAaA,WAAU,CAAC,IAAI;AAC5B,SAAA,KAAaA,WAAU,CAAC,IAAI;AAC5B,SAAA,KAAaA,WAAU,CAAC,IAAI;AAC5B,SAAA,KAAaA,WAAU,CAAC,IAAI;AAC5B,SAAA,KAAaA,WAAU,CAAC,IAAI;AAC5B,SAAA,KAAaA,WAAU,CAAC,IAAI;AAC5B,SAAA,KAAaA,WAAU,CAAC,IAAI;AAC5B,SAAA,KAAaA,WAAU,CAAC,IAAI;AAC5B,SAAA,KAAaA,WAAU,EAAE,IAAI;AAC7B,SAAA,KAAaA,WAAU,EAAE,IAAI;AAC7B,SAAA,KAAaA,WAAU,EAAE,IAAI;AAC7B,SAAA,KAAaA,WAAU,EAAE,IAAI;AAC7B,SAAA,KAAaA,WAAU,EAAE,IAAI;AAC7B,SAAA,KAAaA,WAAU,EAAE,IAAI;EAIvC;;EAEU,MAAG;AAIX,UAAM,EAAE,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAE,IAAK;AAC3E,WAAO,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;EACxE;;EAEU,IACR,IAAY,IAAY,IAAY,IAAY,IAAY,IAAY,IAAY,IACpF,IAAY,IAAY,IAAY,IAAY,IAAY,IAAY,IAAY,IAAU;AAE9F,SAAK,KAAK,KAAK;AACf,SAAK,KAAK,KAAK;AACf,SAAK,KAAK,KAAK;AACf,SAAK,KAAK,KAAK;AACf,SAAK,KAAK,KAAK;AACf,SAAK,KAAK,KAAK;AACf,SAAK,KAAK,KAAK;AACf,SAAK,KAAK,KAAK;AACf,SAAK,KAAK,KAAK;AACf,SAAK,KAAK,KAAK;AACf,SAAK,KAAK,KAAK;AACf,SAAK,KAAK,KAAK;AACf,SAAK,KAAK,KAAK;AACf,SAAK,KAAK,KAAK;AACf,SAAK,KAAK,KAAK;AACf,SAAK,KAAK,KAAK;EACjB;EACU,QAAQ,MAAgB,QAAc;AAE9C,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK,UAAU,GAAG;AACxC,iBAAW,CAAC,IAAI,KAAK,UAAU,MAAM;AACrC,iBAAW,CAAC,IAAI,KAAK,UAAW,UAAU,CAAE;IAC9C;AACA,aAAS,IAAI,IAAI,IAAI,IAAI,KAAK;AAE5B,YAAM,OAAO,WAAW,IAAI,EAAE,IAAI;AAClC,YAAM,OAAO,WAAW,IAAI,EAAE,IAAI;AAClC,YAAM,MAAUC,QAAO,MAAM,MAAM,CAAC,IAAQA,QAAO,MAAM,MAAM,CAAC,IAAQC,OAAM,MAAM,MAAM,CAAC;AAC3F,YAAM,MAAUC,QAAO,MAAM,MAAM,CAAC,IAAQA,QAAO,MAAM,MAAM,CAAC,IAAQC,OAAM,MAAM,MAAM,CAAC;AAE3F,YAAM,MAAM,WAAW,IAAI,CAAC,IAAI;AAChC,YAAM,MAAM,WAAW,IAAI,CAAC,IAAI;AAChC,YAAM,MAAUH,QAAO,KAAK,KAAK,EAAE,IAAQI,QAAO,KAAK,KAAK,EAAE,IAAQH,OAAM,KAAK,KAAK,CAAC;AACvF,YAAM,MAAUC,QAAO,KAAK,KAAK,EAAE,IAAQG,QAAO,KAAK,KAAK,EAAE,IAAQF,OAAM,KAAK,KAAK,CAAC;AAEvF,YAAM,OAAWG,OAAM,KAAK,KAAK,WAAW,IAAI,CAAC,GAAG,WAAW,IAAI,EAAE,CAAC;AACtE,YAAM,OAAWC,OAAM,MAAM,KAAK,KAAK,WAAW,IAAI,CAAC,GAAG,WAAW,IAAI,EAAE,CAAC;AAC5E,iBAAW,CAAC,IAAI,OAAO;AACvB,iBAAW,CAAC,IAAI,OAAO;IACzB;AACA,QAAI,EAAE,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAE,IAAK;AAEzE,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAE3B,YAAM,UAAcP,QAAO,IAAI,IAAI,EAAE,IAAQA,QAAO,IAAI,IAAI,EAAE,IAAQI,QAAO,IAAI,IAAI,EAAE;AACvF,YAAM,UAAcF,QAAO,IAAI,IAAI,EAAE,IAAQA,QAAO,IAAI,IAAI,EAAE,IAAQG,QAAO,IAAI,IAAI,EAAE;AAEvF,YAAM,OAAQ,KAAK,KAAO,CAAC,KAAK;AAChC,YAAM,OAAQ,KAAK,KAAO,CAAC,KAAK;AAGhC,YAAM,OAAWG,OAAM,IAAI,SAAS,MAAM,UAAU,CAAC,GAAG,WAAW,CAAC,CAAC;AACrE,YAAM,MAAUC,OAAM,MAAM,IAAI,SAAS,MAAM,UAAU,CAAC,GAAG,WAAW,CAAC,CAAC;AAC1E,YAAM,MAAM,OAAO;AAEnB,YAAM,UAAcT,QAAO,IAAI,IAAI,EAAE,IAAQI,QAAO,IAAI,IAAI,EAAE,IAAQA,QAAO,IAAI,IAAI,EAAE;AACvF,YAAM,UAAcF,QAAO,IAAI,IAAI,EAAE,IAAQG,QAAO,IAAI,IAAI,EAAE,IAAQA,QAAO,IAAI,IAAI,EAAE;AACvF,YAAM,OAAQ,KAAK,KAAO,KAAK,KAAO,KAAK;AAC3C,YAAM,OAAQ,KAAK,KAAO,KAAK,KAAO,KAAK;AAC3C,WAAK,KAAK;AACV,WAAK,KAAK;AACV,WAAK,KAAK;AACV,WAAK,KAAK;AACV,WAAK,KAAK;AACV,WAAK,KAAK;AACV,OAAC,EAAE,GAAG,IAAI,GAAG,GAAE,IAASK,KAAI,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAC5D,WAAK,KAAK;AACV,WAAK,KAAK;AACV,WAAK,KAAK;AACV,WAAK,KAAK;AACV,WAAK,KAAK;AACV,WAAK,KAAK;AACV,YAAM,MAAUC,OAAM,KAAK,SAAS,IAAI;AACxC,WAASC,OAAM,KAAK,KAAK,SAAS,IAAI;AACtC,WAAK,MAAM;IACb;AAEA,KAAC,EAAE,GAAG,IAAI,GAAG,GAAE,IAASF,KAAI,KAAK,KAAK,GAAG,KAAK,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AACpE,KAAC,EAAE,GAAG,IAAI,GAAG,GAAE,IAASA,KAAI,KAAK,KAAK,GAAG,KAAK,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AACpE,KAAC,EAAE,GAAG,IAAI,GAAG,GAAE,IAASA,KAAI,KAAK,KAAK,GAAG,KAAK,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AACpE,KAAC,EAAE,GAAG,IAAI,GAAG,GAAE,IAASA,KAAI,KAAK,KAAK,GAAG,KAAK,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AACpE,KAAC,EAAE,GAAG,IAAI,GAAG,GAAE,IAASA,KAAI,KAAK,KAAK,GAAG,KAAK,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AACpE,KAAC,EAAE,GAAG,IAAI,GAAG,GAAE,IAASA,KAAI,KAAK,KAAK,GAAG,KAAK,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AACpE,KAAC,EAAE,GAAG,IAAI,GAAG,GAAE,IAASA,KAAI,KAAK,KAAK,GAAG,KAAK,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AACpE,KAAC,EAAE,GAAG,IAAI,GAAG,GAAE,IAASA,KAAI,KAAK,KAAK,GAAG,KAAK,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AACpE,SAAK,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;EACzE;EACU,aAAU;AAClB,IAAAG,OAAM,YAAY,UAAU;EAC9B;EACA,UAAO;AACL,IAAAA,OAAM,KAAK,MAAM;AACjB,SAAK,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;EACzD;;AAuGK,IAAMC,UAAgC,gBAAAC,cAAa,MAAM,IAAI,OAAM,CAAE;;;AC7W5E,IAAMC,OAAsB,uBAAO,CAAC;AACpC,IAAMC,OAAsB,uBAAO,CAAC;AAgB9B,SAAU,QAAQ,OAAgB,QAAgB,IAAE;AACxD,MAAI,OAAO,UAAU,WAAW;AAC9B,UAAM,SAAS,SAAS,IAAI,KAAK;AACjC,UAAM,IAAI,MAAM,SAAS,gCAAgC,OAAO,KAAK;EACvE;AACA,SAAO;AACT;AAIM,SAAU,SAAS,OAAmB,QAAiB,QAAgB,IAAE;AAC7E,QAAM,QAAQC,SAAS,KAAK;AAC5B,QAAM,MAAM,OAAO;AACnB,QAAM,WAAW,WAAW;AAC5B,MAAI,CAAC,SAAU,YAAY,QAAQ,QAAS;AAC1C,UAAM,SAAS,SAAS,IAAI,KAAK;AACjC,UAAM,QAAQ,WAAW,cAAc,MAAM,KAAK;AAClD,UAAM,MAAM,QAAQ,UAAU,GAAG,KAAK,QAAQ,OAAO,KAAK;AAC1D,UAAM,IAAI,MAAM,SAAS,wBAAwB,QAAQ,WAAW,GAAG;EACzE;AACA,SAAO;AACT;AAQM,SAAUC,aAAY,KAAW;AACrC,MAAI,OAAO,QAAQ;AAAU,UAAM,IAAI,MAAM,8BAA8B,OAAO,GAAG;AACrF,SAAO,QAAQ,KAAKC,OAAM,OAAO,OAAO,GAAG;AAC7C;AAGM,SAAU,gBAAgB,OAAiB;AAC/C,SAAOD,aAAYE,YAAY,KAAK,CAAC;AACvC;AACM,SAAUC,iBAAgB,OAAiB;AAC/C,EAAAC,QAAQ,KAAK;AACb,SAAOJ,aAAYE,YAAY,WAAW,KAAK,KAAK,EAAE,QAAO,CAAE,CAAC;AAClE;AAEM,SAAUG,iBAAgB,GAAoB,KAAW;AAC7D,SAAOC,YAAY,EAAE,SAAS,EAAE,EAAE,SAAS,MAAM,GAAG,GAAG,CAAC;AAC1D;AACM,SAAUC,iBAAgB,GAAoB,KAAW;AAC7D,SAAOF,iBAAgB,GAAG,GAAG,EAAE,QAAO;AACxC;AAeM,SAAU,YAAY,OAAe,KAAU,gBAAuB;AAC1E,MAAI;AACJ,MAAI,OAAO,QAAQ,UAAU;AAC3B,QAAI;AACF,YAAMG,YAAY,GAAG;IACvB,SAAS,GAAG;AACV,YAAM,IAAI,MAAM,QAAQ,+CAA+C,CAAC;IAC1E;EACF,WAAWC,SAAS,GAAG,GAAG;AAGxB,UAAM,WAAW,KAAK,GAAG;EAC3B,OAAO;AACL,UAAM,IAAI,MAAM,QAAQ,mCAAmC;EAC7D;AACA,QAAM,MAAM,IAAI;AAChB,MAAI,OAAO,mBAAmB,YAAY,QAAQ;AAChD,UAAM,IAAI,MAAM,QAAQ,gBAAgB,iBAAiB,oBAAoB,GAAG;AAClF,SAAO;AACT;AAGM,SAAUC,YAAW,GAAe,GAAa;AACrD,MAAI,EAAE,WAAW,EAAE;AAAQ,WAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ;AAAK,YAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;AACrD,SAAO,SAAS;AAClB;AAKM,SAAUC,WAAU,OAAiB;AACzC,SAAO,WAAW,KAAK,KAAK;AAC9B;AA8BA,IAAMC,YAAW,CAAC,MAAc,OAAO,MAAM,YAAYC,QAAO;AAE1D,SAAUC,SAAQ,GAAW,KAAa,KAAW;AACzD,SAAOF,UAAS,CAAC,KAAKA,UAAS,GAAG,KAAKA,UAAS,GAAG,KAAK,OAAO,KAAK,IAAI;AAC1E;AAOM,SAAUG,UAAS,OAAe,GAAW,KAAa,KAAW;AAMzE,MAAI,CAACD,SAAQ,GAAG,KAAK,GAAG;AACtB,UAAM,IAAI,MAAM,oBAAoB,QAAQ,OAAO,MAAM,aAAa,MAAM,WAAW,CAAC;AAC5F;AASM,SAAU,OAAO,GAAS;AAC9B,MAAI;AACJ,OAAK,MAAM,GAAG,IAAID,MAAK,MAAMG,MAAK,OAAO;AAAE;AAC3C,SAAO;AACT;AAsBO,IAAM,UAAU,CAAC,OAAuBC,QAAO,OAAO,CAAC,KAAKA;AAkH7D,SAAU,gBACd,QACA,QACA,YAAoC,CAAA,GAAE;AAEtC,MAAI,CAAC,UAAU,OAAO,WAAW;AAAU,UAAM,IAAI,MAAM,+BAA+B;AAE1F,WAAS,WAAW,WAAiB,cAAsB,OAAc;AACvE,UAAM,MAAM,OAAO,SAAS;AAC5B,QAAI,SAAS,QAAQ;AAAW;AAChC,UAAM,UAAU,OAAO;AACvB,QAAI,YAAY,gBAAgB,QAAQ;AACtC,YAAM,IAAI,MAAM,UAAU,SAAS,0BAA0B,YAAY,SAAS,OAAO,EAAE;EAC/F;AACA,SAAO,QAAQ,MAAM,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,WAAW,GAAG,GAAG,KAAK,CAAC;AAClE,SAAO,QAAQ,SAAS,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC;AACtE;AAKO,IAAM,iBAAiB,MAAY;AACxC,QAAM,IAAI,MAAM,iBAAiB;AACnC;AAMM,SAAU,SACd,IAA6B;AAE7B,QAAM,MAAM,oBAAI,QAAO;AACvB,SAAO,CAAC,QAAW,SAAc;AAC/B,UAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAI,QAAQ;AAAW,aAAO;AAC9B,UAAM,WAAW,GAAG,KAAK,GAAG,IAAI;AAChC,QAAI,IAAI,KAAK,QAAQ;AACrB,WAAO;EACT;AACF;;;ACpWA,IAAMC,OAAM,OAAO,CAAC;AAApB,IAAuBC,OAAM,OAAO,CAAC;AAArC,IAAwCC,OAAsB,uBAAO,CAAC;AAAtE,IAAyEC,OAAsB,uBAAO,CAAC;AAEvG,IAAM,MAAsB,uBAAO,CAAC;AAApC,IAAuCC,OAAsB,uBAAO,CAAC;AAArE,IAAwEC,OAAsB,uBAAO,CAAC;AAEtG,IAAM,MAAsB,uBAAO,CAAC;AAApC,IAAuC,MAAsB,uBAAO,CAAC;AAArE,IAAwE,OAAuB,uBAAO,EAAE;AAGlG,SAAUC,KAAI,GAAW,GAAS;AACtC,QAAM,SAAS,IAAI;AACnB,SAAO,UAAUN,OAAM,SAAS,IAAI;AACtC;AAYM,SAAUO,MAAK,GAAW,OAAe,QAAc;AAC3D,MAAI,MAAM;AACV,SAAO,UAAUC,MAAK;AACpB,WAAO;AACP,WAAO;EACT;AACA,SAAO;AACT;AAMM,SAAU,OAAO,QAAgB,QAAc;AACnD,MAAI,WAAWA;AAAK,UAAM,IAAI,MAAM,kCAAkC;AACtE,MAAI,UAAUA;AAAK,UAAM,IAAI,MAAM,4CAA4C,MAAM;AAErF,MAAI,IAAIC,KAAI,QAAQ,MAAM;AAC1B,MAAI,IAAI;AAER,MAAI,IAAID,MAAK,IAAIE,MAAK,IAAIA,MAAK,IAAIF;AACnC,SAAO,MAAMA,MAAK;AAEhB,UAAM,IAAI,IAAI;AACd,UAAM,IAAI,IAAI;AACd,UAAM,IAAI,IAAI,IAAI;AAClB,UAAM,IAAI,IAAI,IAAI;AAElB,QAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI;EACzC;AACA,QAAM,MAAM;AACZ,MAAI,QAAQE;AAAK,UAAM,IAAI,MAAM,wBAAwB;AACzD,SAAOD,KAAI,GAAG,MAAM;AACtB;AAEA,SAAS,eAAkBE,KAAe,MAAS,GAAI;AACrD,MAAI,CAACA,IAAG,IAAIA,IAAG,IAAI,IAAI,GAAG,CAAC;AAAG,UAAM,IAAI,MAAM,yBAAyB;AACzE;AAMA,SAAS,UAAaA,KAAe,GAAI;AACvC,QAAM,UAAUA,IAAG,QAAQD,QAAO;AAClC,QAAM,OAAOC,IAAG,IAAI,GAAG,MAAM;AAC7B,iBAAeA,KAAI,MAAM,CAAC;AAC1B,SAAO;AACT;AAEA,SAAS,UAAaA,KAAe,GAAI;AACvC,QAAM,UAAUA,IAAG,QAAQC,QAAO;AAClC,QAAM,KAAKD,IAAG,IAAI,GAAGE,IAAG;AACxB,QAAM,IAAIF,IAAG,IAAI,IAAI,MAAM;AAC3B,QAAM,KAAKA,IAAG,IAAI,GAAG,CAAC;AACtB,QAAM,IAAIA,IAAG,IAAIA,IAAG,IAAI,IAAIE,IAAG,GAAG,CAAC;AACnC,QAAM,OAAOF,IAAG,IAAI,IAAIA,IAAG,IAAI,GAAGA,IAAG,GAAG,CAAC;AACzC,iBAAeA,KAAI,MAAM,CAAC;AAC1B,SAAO;AACT;AAIA,SAAS,WAAW,GAAS;AAC3B,QAAM,MAAM,MAAM,CAAC;AACnB,QAAM,KAAK,cAAc,CAAC;AAC1B,QAAM,KAAK,GAAG,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC;AACnC,QAAM,KAAK,GAAG,KAAK,EAAE;AACrB,QAAM,KAAK,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC;AAC9B,QAAM,MAAM,IAAIG,QAAO;AACvB,SAAO,CAAIH,KAAe,MAAQ;AAChC,QAAI,MAAMA,IAAG,IAAI,GAAG,EAAE;AACtB,QAAI,MAAMA,IAAG,IAAI,KAAK,EAAE;AACxB,UAAM,MAAMA,IAAG,IAAI,KAAK,EAAE;AAC1B,UAAM,MAAMA,IAAG,IAAI,KAAK,EAAE;AAC1B,UAAM,KAAKA,IAAG,IAAIA,IAAG,IAAI,GAAG,GAAG,CAAC;AAChC,UAAM,KAAKA,IAAG,IAAIA,IAAG,IAAI,GAAG,GAAG,CAAC;AAChC,UAAMA,IAAG,KAAK,KAAK,KAAK,EAAE;AAC1B,UAAMA,IAAG,KAAK,KAAK,KAAK,EAAE;AAC1B,UAAM,KAAKA,IAAG,IAAIA,IAAG,IAAI,GAAG,GAAG,CAAC;AAChC,UAAM,OAAOA,IAAG,KAAK,KAAK,KAAK,EAAE;AACjC,mBAAeA,KAAI,MAAM,CAAC;AAC1B,WAAO;EACT;AACF;AASM,SAAU,cAAc,GAAS;AAGrC,MAAI,IAAII;AAAK,UAAM,IAAI,MAAM,qCAAqC;AAElE,MAAI,IAAI,IAAIL;AACZ,MAAI,IAAI;AACR,SAAO,IAAIG,SAAQL,MAAK;AACtB,SAAKK;AACL;EACF;AAGA,MAAI,IAAIA;AACR,QAAM,MAAM,MAAM,CAAC;AACnB,SAAO,WAAW,KAAK,CAAC,MAAM,GAAG;AAG/B,QAAI,MAAM;AAAM,YAAM,IAAI,MAAM,+CAA+C;EACjF;AAEA,MAAI,MAAM;AAAG,WAAO;AAIpB,MAAI,KAAK,IAAI,IAAI,GAAG,CAAC;AACrB,QAAM,UAAU,IAAIH,QAAOG;AAC3B,SAAO,SAAS,YAAeF,KAAe,GAAI;AAChD,QAAIA,IAAG,IAAI,CAAC;AAAG,aAAO;AAEtB,QAAI,WAAWA,KAAI,CAAC,MAAM;AAAG,YAAM,IAAI,MAAM,yBAAyB;AAGtE,QAAI,IAAI;AACR,QAAI,IAAIA,IAAG,IAAIA,IAAG,KAAK,EAAE;AACzB,QAAI,IAAIA,IAAG,IAAI,GAAG,CAAC;AACnB,QAAI,IAAIA,IAAG,IAAI,GAAG,MAAM;AAIxB,WAAO,CAACA,IAAG,IAAI,GAAGA,IAAG,GAAG,GAAG;AACzB,UAAIA,IAAG,IAAI,CAAC;AAAG,eAAOA,IAAG;AACzB,UAAI,IAAI;AAGR,UAAI,QAAQA,IAAG,IAAI,CAAC;AACpB,aAAO,CAACA,IAAG,IAAI,OAAOA,IAAG,GAAG,GAAG;AAC7B;AACA,gBAAQA,IAAG,IAAI,KAAK;AACpB,YAAI,MAAM;AAAG,gBAAM,IAAI,MAAM,yBAAyB;MACxD;AAGA,YAAM,WAAWD,QAAO,OAAO,IAAI,IAAI,CAAC;AACxC,YAAM,IAAIC,IAAG,IAAI,GAAG,QAAQ;AAG5B,UAAI;AACJ,UAAIA,IAAG,IAAI,CAAC;AACZ,UAAIA,IAAG,IAAI,GAAG,CAAC;AACf,UAAIA,IAAG,IAAI,GAAG,CAAC;IACjB;AACA,WAAO;EACT;AACF;AAaM,SAAU,OAAO,GAAS;AAE9B,MAAI,IAAI,QAAQI;AAAK,WAAO;AAE5B,MAAI,IAAI,QAAQH;AAAK,WAAO;AAE5B,MAAI,IAAI,SAAS;AAAK,WAAO,WAAW,CAAC;AAEzC,SAAO,cAAc,CAAC;AACxB;AAGO,IAAM,eAAe,CAAC,KAAa,YACvCH,KAAI,KAAK,MAAM,IAAIC,UAASA;AA+C/B,IAAM,eAAe;EACnB;EAAU;EAAW;EAAO;EAAO;EAAO;EAAQ;EAClD;EAAO;EAAO;EAAO;EAAO;EAAO;EACnC;EAAQ;EAAQ;EAAQ;;AAEpB,SAAU,cAAiB,OAAgB;AAC/C,QAAM,UAAU;IACd,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;;AAER,QAAM,OAAO,aAAa,OAAO,CAAC,KAAK,QAAe;AACpD,QAAI,GAAG,IAAI;AACX,WAAO;EACT,GAAG,OAAO;AACV,kBAAgB,OAAO,IAAI;AAI3B,SAAO;AACT;AAQM,SAAU,MAASC,KAAe,KAAQ,OAAa;AAC3D,MAAI,QAAQH;AAAK,UAAM,IAAI,MAAM,yCAAyC;AAC1E,MAAI,UAAUA;AAAK,WAAOG,IAAG;AAC7B,MAAI,UAAUD;AAAK,WAAO;AAC1B,MAAI,IAAIC,IAAG;AACX,MAAI,IAAI;AACR,SAAO,QAAQH,MAAK;AAClB,QAAI,QAAQE;AAAK,UAAIC,IAAG,IAAI,GAAG,CAAC;AAChC,QAAIA,IAAG,IAAI,CAAC;AACZ,cAAUD;EACZ;AACA,SAAO;AACT;AAOM,SAAU,cAAiBC,KAAe,MAAW,WAAW,OAAK;AACzE,QAAM,WAAW,IAAI,MAAM,KAAK,MAAM,EAAE,KAAK,WAAWA,IAAG,OAAO,MAAS;AAE3E,QAAM,gBAAgB,KAAK,OAAO,CAAC,KAAK,KAAK,MAAK;AAChD,QAAIA,IAAG,IAAI,GAAG;AAAG,aAAO;AACxB,aAAS,CAAC,IAAI;AACd,WAAOA,IAAG,IAAI,KAAK,GAAG;EACxB,GAAGA,IAAG,GAAG;AAET,QAAM,cAAcA,IAAG,IAAI,aAAa;AAExC,OAAK,YAAY,CAAC,KAAK,KAAK,MAAK;AAC/B,QAAIA,IAAG,IAAI,GAAG;AAAG,aAAO;AACxB,aAAS,CAAC,IAAIA,IAAG,IAAI,KAAK,SAAS,CAAC,CAAC;AACrC,WAAOA,IAAG,IAAI,KAAK,GAAG;EACxB,GAAG,WAAW;AACd,SAAO;AACT;AAgBM,SAAU,WAAcK,KAAe,GAAI;AAG/C,QAAM,UAAUA,IAAG,QAAQC,QAAOC;AAClC,QAAM,UAAUF,IAAG,IAAI,GAAG,MAAM;AAChC,QAAM,MAAMA,IAAG,IAAI,SAASA,IAAG,GAAG;AAClC,QAAM,OAAOA,IAAG,IAAI,SAASA,IAAG,IAAI;AACpC,QAAM,KAAKA,IAAG,IAAI,SAASA,IAAG,IAAIA,IAAG,GAAG,CAAC;AACzC,MAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;AAAI,UAAM,IAAI,MAAM,gCAAgC;AAC1E,SAAO,MAAM,IAAI,OAAO,IAAI;AAC9B;AAUM,SAAU,QAAQ,GAAW,YAAmB;AAEpD,MAAI,eAAe;AAAW,IAAAG,SAAQ,UAAU;AAChD,QAAM,cAAc,eAAe,SAAY,aAAa,EAAE,SAAS,CAAC,EAAE;AAC1E,QAAM,cAAc,KAAK,KAAK,cAAc,CAAC;AAC7C,SAAO,EAAE,YAAY,aAAa,YAAW;AAC/C;AA8BM,SAAU,MACd,OACA,cACAC,QAAO,OACP,OAA0B,CAAA,GAAE;AAE5B,MAAI,SAASC;AAAK,UAAM,IAAI,MAAM,4CAA4C,KAAK;AACnF,MAAI,cAAkC;AACtC,MAAI,QAA4B;AAChC,MAAI,eAAwB;AAC5B,MAAI,iBAAgD;AACpD,MAAI,OAAO,iBAAiB,YAAY,gBAAgB,MAAM;AAC5D,QAAI,KAAK,QAAQD;AAAM,YAAM,IAAI,MAAM,sCAAsC;AAC7E,UAAM,QAAQ;AACd,QAAI,MAAM;AAAM,oBAAc,MAAM;AACpC,QAAI,MAAM;AAAM,cAAQ,MAAM;AAC9B,QAAI,OAAO,MAAM,SAAS;AAAW,MAAAA,QAAO,MAAM;AAClD,QAAI,OAAO,MAAM,iBAAiB;AAAW,qBAAe,MAAM;AAClE,qBAAiB,MAAM;EACzB,OAAO;AACL,QAAI,OAAO,iBAAiB;AAAU,oBAAc;AACpD,QAAI,KAAK;AAAM,cAAQ,KAAK;EAC9B;AACA,QAAM,EAAE,YAAY,MAAM,aAAa,MAAK,IAAK,QAAQ,OAAO,WAAW;AAC3E,MAAI,QAAQ;AAAM,UAAM,IAAI,MAAM,gDAAgD;AAClF,MAAI;AACJ,QAAM,IAAuB,OAAO,OAAO;IACzC;IACA,MAAAA;IACA;IACA;IACA,MAAM,QAAQ,IAAI;IAClB,MAAMC;IACN,KAAKC;IACL;IACA,QAAQ,CAAC,QAAQC,KAAI,KAAK,KAAK;IAC/B,SAAS,CAAC,QAAO;AACf,UAAI,OAAO,QAAQ;AACjB,cAAM,IAAI,MAAM,iDAAiD,OAAO,GAAG;AAC7E,aAAOF,QAAO,OAAO,MAAM;IAC7B;IACA,KAAK,CAAC,QAAQ,QAAQA;;IAEtB,aAAa,CAAC,QAAgB,CAAC,EAAE,IAAI,GAAG,KAAK,EAAE,QAAQ,GAAG;IAC1D,OAAO,CAAC,SAAS,MAAMC,UAASA;IAChC,KAAK,CAAC,QAAQC,KAAI,CAAC,KAAK,KAAK;IAC7B,KAAK,CAAC,KAAK,QAAQ,QAAQ;IAE3B,KAAK,CAAC,QAAQA,KAAI,MAAM,KAAK,KAAK;IAClC,KAAK,CAAC,KAAK,QAAQA,KAAI,MAAM,KAAK,KAAK;IACvC,KAAK,CAAC,KAAK,QAAQA,KAAI,MAAM,KAAK,KAAK;IACvC,KAAK,CAAC,KAAK,QAAQA,KAAI,MAAM,KAAK,KAAK;IACvC,KAAK,CAAC,KAAK,UAAU,MAAM,GAAG,KAAK,KAAK;IACxC,KAAK,CAAC,KAAK,QAAQA,KAAI,MAAM,OAAO,KAAK,KAAK,GAAG,KAAK;;IAGtD,MAAM,CAAC,QAAQ,MAAM;IACrB,MAAM,CAAC,KAAK,QAAQ,MAAM;IAC1B,MAAM,CAAC,KAAK,QAAQ,MAAM;IAC1B,MAAM,CAAC,KAAK,QAAQ,MAAM;IAE1B,KAAK,CAAC,QAAQ,OAAO,KAAK,KAAK;IAC/B,MACE,UACC,CAAC,MAAK;AACL,UAAI,CAAC;AAAO,gBAAQ,OAAO,KAAK;AAChC,aAAO,MAAM,GAAG,CAAC;IACnB;IACF,SAAS,CAAC,QAASH,QAAOI,iBAAgB,KAAK,KAAK,IAAIC,iBAAgB,KAAK,KAAK;IAClF,WAAW,CAAC,OAAO,iBAAiB,SAAQ;AAC1C,UAAI,gBAAgB;AAClB,YAAI,CAAC,eAAe,SAAS,MAAM,MAAM,KAAK,MAAM,SAAS,OAAO;AAClE,gBAAM,IAAI,MACR,+BAA+B,iBAAiB,iBAAiB,MAAM,MAAM;QAEjF;AACA,cAAM,SAAS,IAAI,WAAW,KAAK;AAEnC,eAAO,IAAI,OAAOL,QAAO,IAAI,OAAO,SAAS,MAAM,MAAM;AACzD,gBAAQ;MACV;AACA,UAAI,MAAM,WAAW;AACnB,cAAM,IAAI,MAAM,+BAA+B,QAAQ,iBAAiB,MAAM,MAAM;AACtF,UAAI,SAASA,QAAOM,iBAAgB,KAAK,IAAI,gBAAgB,KAAK;AAClE,UAAI;AAAc,iBAASH,KAAI,QAAQ,KAAK;AAC5C,UAAI,CAAC;AACH,YAAI,CAAC,EAAE,QAAQ,MAAM;AAAG,gBAAM,IAAI,MAAM,kDAAkD;;AAG5F,aAAO;IACT;;IAEA,aAAa,CAAC,QAAQ,cAAc,GAAG,GAAG;;;IAG1C,MAAM,CAAC,GAAG,GAAG,MAAO,IAAI,IAAI;GAClB;AACZ,SAAO,OAAO,OAAO,CAAC;AACxB;;;ACjfA,IAAMI,OAAM,OAAO,CAAC;AACpB,IAAMC,OAAM,OAAO,CAAC;AA0Id,SAAU,SAAwC,WAAoB,MAAO;AACjF,QAAM,MAAM,KAAK,OAAM;AACvB,SAAO,YAAY,MAAM;AAC3B;AAQM,SAAU,WACd,GACA,QAAW;AAEX,QAAM,aAAa,cACjB,EAAE,IACF,OAAO,IAAI,CAAC,MAAM,EAAE,CAAE,CAAC;AAEzB,SAAO,OAAO,IAAI,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,SAAS,WAAW,CAAC,CAAC,CAAC,CAAC;AACrE;AAEA,SAAS,UAAU,GAAW,MAAY;AACxC,MAAI,CAAC,OAAO,cAAc,CAAC,KAAK,KAAK,KAAK,IAAI;AAC5C,UAAM,IAAI,MAAM,uCAAuC,OAAO,cAAc,CAAC;AACjF;AAWA,SAAS,UAAU,GAAW,YAAkB;AAC9C,YAAU,GAAG,UAAU;AACvB,QAAM,UAAU,KAAK,KAAK,aAAa,CAAC,IAAI;AAC5C,QAAM,aAAa,MAAM,IAAI;AAC7B,QAAM,YAAY,KAAK;AACvB,QAAM,OAAO,QAAQ,CAAC;AACtB,QAAM,UAAU,OAAO,CAAC;AACxB,SAAO,EAAE,SAAS,YAAY,MAAM,WAAW,QAAO;AACxD;AAEA,SAAS,YAAY,GAAW,QAAgB,OAAY;AAC1D,QAAM,EAAE,YAAY,MAAM,WAAW,QAAO,IAAK;AACjD,MAAI,QAAQ,OAAO,IAAI,IAAI;AAC3B,MAAI,QAAQ,KAAK;AAQjB,MAAI,QAAQ,YAAY;AAEtB,aAAS;AACT,aAASA;EACX;AACA,QAAM,cAAc,SAAS;AAC7B,QAAM,SAAS,cAAc,KAAK,IAAI,KAAK,IAAI;AAC/C,QAAM,SAAS,UAAU;AACzB,QAAM,QAAQ,QAAQ;AACtB,QAAM,SAAS,SAAS,MAAM;AAC9B,QAAM,UAAU;AAChB,SAAO,EAAE,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAO;AACxD;AAEA,SAAS,kBAAkB,QAAe,GAAM;AAC9C,MAAI,CAAC,MAAM,QAAQ,MAAM;AAAG,UAAM,IAAI,MAAM,gBAAgB;AAC5D,SAAO,QAAQ,CAAC,GAAG,MAAK;AACtB,QAAI,EAAE,aAAa;AAAI,YAAM,IAAI,MAAM,4BAA4B,CAAC;EACtE,CAAC;AACH;AACA,SAAS,mBAAmB,SAAgB,OAAU;AACpD,MAAI,CAAC,MAAM,QAAQ,OAAO;AAAG,UAAM,IAAI,MAAM,2BAA2B;AACxE,UAAQ,QAAQ,CAAC,GAAG,MAAK;AACvB,QAAI,CAAC,MAAM,QAAQ,CAAC;AAAG,YAAM,IAAI,MAAM,6BAA6B,CAAC;EACvE,CAAC;AACH;AAKA,IAAM,mBAAmB,oBAAI,QAAO;AACpC,IAAM,mBAAmB,oBAAI,QAAO;AAEpC,SAAS,KAAK,GAAM;AAGlB,SAAO,iBAAiB,IAAI,CAAC,KAAK;AACpC;AAEA,SAAS,QAAQ,GAAS;AACxB,MAAI,MAAMD;AAAK,UAAM,IAAI,MAAM,cAAc;AAC/C;AAoBM,IAAO,OAAP,MAAW;;EAOf,YAAY,OAAW,MAAY;AACjC,SAAK,OAAO,MAAM;AAClB,SAAK,OAAO,MAAM;AAClB,SAAK,KAAK,MAAM;AAChB,SAAK,OAAO;EACd;;EAGA,cAAc,KAAe,GAAW,IAAc,KAAK,MAAI;AAC7D,QAAI,IAAc;AAClB,WAAO,IAAIA,MAAK;AACd,UAAI,IAAIC;AAAK,YAAI,EAAE,IAAI,CAAC;AACxB,UAAI,EAAE,OAAM;AACZ,YAAMA;IACR;AACA,WAAO;EACT;;;;;;;;;;;;;EAcQ,iBAAiB,OAAiB,GAAS;AACjD,UAAM,EAAE,SAAS,WAAU,IAAK,UAAU,GAAG,KAAK,IAAI;AACtD,UAAM,SAAqB,CAAA;AAC3B,QAAI,IAAc;AAClB,QAAI,OAAO;AACX,aAAS,SAAS,GAAG,SAAS,SAAS,UAAU;AAC/C,aAAO;AACP,aAAO,KAAK,IAAI;AAEhB,eAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACnC,eAAO,KAAK,IAAI,CAAC;AACjB,eAAO,KAAK,IAAI;MAClB;AACA,UAAI,KAAK,OAAM;IACjB;AACA,WAAO;EACT;;;;;;;EAQQ,KAAK,GAAW,aAAyB,GAAS;AAExD,QAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;AAAG,YAAM,IAAI,MAAM,gBAAgB;AAEzD,QAAI,IAAI,KAAK;AACb,QAAI,IAAI,KAAK;AAMb,UAAM,KAAK,UAAU,GAAG,KAAK,IAAI;AACjC,aAAS,SAAS,GAAG,SAAS,GAAG,SAAS,UAAU;AAElD,YAAM,EAAE,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAO,IAAK,YAAY,GAAG,QAAQ,EAAE;AACnF,UAAI;AACJ,UAAI,QAAQ;AAGV,YAAI,EAAE,IAAI,SAAS,QAAQ,YAAY,OAAO,CAAC,CAAC;MAClD,OAAO;AAEL,YAAI,EAAE,IAAI,SAAS,OAAO,YAAY,MAAM,CAAC,CAAC;MAChD;IACF;AACA,YAAQ,CAAC;AAIT,WAAO,EAAE,GAAG,EAAC;EACf;;;;;;EAOQ,WACN,GACA,aACA,GACA,MAAgB,KAAK,MAAI;AAEzB,UAAM,KAAK,UAAU,GAAG,KAAK,IAAI;AACjC,aAAS,SAAS,GAAG,SAAS,GAAG,SAAS,UAAU;AAClD,UAAI,MAAMD;AAAK;AACf,YAAM,EAAE,OAAO,QAAQ,QAAQ,MAAK,IAAK,YAAY,GAAG,QAAQ,EAAE;AAClE,UAAI;AACJ,UAAI,QAAQ;AAGV;MACF,OAAO;AACL,cAAM,OAAO,YAAY,MAAM;AAC/B,cAAM,IAAI,IAAI,QAAQ,KAAK,OAAM,IAAK,IAAI;MAC5C;IACF;AACA,YAAQ,CAAC;AACT,WAAO;EACT;EAEQ,eAAe,GAAW,OAAiB,WAA4B;AAE7E,QAAI,OAAO,iBAAiB,IAAI,KAAK;AACrC,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,iBAAiB,OAAO,CAAC;AACrC,UAAI,MAAM,GAAG;AAEX,YAAI,OAAO,cAAc;AAAY,iBAAO,UAAU,IAAI;AAC1D,yBAAiB,IAAI,OAAO,IAAI;MAClC;IACF;AACA,WAAO;EACT;EAEA,OACE,OACA,QACA,WAA4B;AAE5B,UAAM,IAAI,KAAK,KAAK;AACpB,WAAO,KAAK,KAAK,GAAG,KAAK,eAAe,GAAG,OAAO,SAAS,GAAG,MAAM;EACtE;EAEA,OAAO,OAAiB,QAAgB,WAA8B,MAAe;AACnF,UAAM,IAAI,KAAK,KAAK;AACpB,QAAI,MAAM;AAAG,aAAO,KAAK,cAAc,OAAO,QAAQ,IAAI;AAC1D,WAAO,KAAK,WAAW,GAAG,KAAK,eAAe,GAAG,OAAO,SAAS,GAAG,QAAQ,IAAI;EAClF;;;;EAKA,YAAY,GAAa,GAAS;AAChC,cAAU,GAAG,KAAK,IAAI;AACtB,qBAAiB,IAAI,GAAG,CAAC;AACzB,qBAAiB,OAAO,CAAC;EAC3B;EAEA,SAAS,KAAa;AACpB,WAAO,KAAK,GAAG,MAAM;EACvB;;AAoCI,SAAU,UACd,GACA,QACA,QACA,SAAiB;AAQjB,oBAAkB,QAAQ,CAAC;AAC3B,qBAAmB,SAAS,MAAM;AAClC,QAAM,UAAU,OAAO;AACvB,QAAM,UAAU,QAAQ;AACxB,MAAI,YAAY;AAAS,UAAM,IAAI,MAAM,qDAAqD;AAE9F,QAAM,OAAO,EAAE;AACf,QAAM,QAAQ,OAAO,OAAO,OAAO,CAAC;AACpC,MAAI,aAAa;AACjB,MAAI,QAAQ;AAAI,iBAAa,QAAQ;WAC5B,QAAQ;AAAG,iBAAa,QAAQ;WAChC,QAAQ;AAAG,iBAAa;AACjC,QAAM,OAAO,QAAQ,UAAU;AAC/B,QAAM,UAAU,IAAI,MAAM,OAAO,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI;AACrD,QAAM,WAAW,KAAK,OAAO,OAAO,OAAO,KAAK,UAAU,IAAI;AAC9D,MAAI,MAAM;AACV,WAAS,IAAI,UAAU,KAAK,GAAG,KAAK,YAAY;AAC9C,YAAQ,KAAK,IAAI;AACjB,aAAS,IAAI,GAAG,IAAI,SAAS,KAAK;AAChC,YAAM,SAAS,QAAQ,CAAC;AACxB,YAAME,SAAQ,OAAQ,UAAU,OAAO,CAAC,IAAK,IAAI;AACjD,cAAQA,MAAK,IAAI,QAAQA,MAAK,EAAE,IAAI,OAAO,CAAC,CAAC;IAC/C;AACA,QAAI,OAAO;AAEX,aAAS,IAAI,QAAQ,SAAS,GAAG,OAAO,MAAM,IAAI,GAAG,KAAK;AACxD,aAAO,KAAK,IAAI,QAAQ,CAAC,CAAC;AAC1B,aAAO,KAAK,IAAI,IAAI;IACtB;AACA,UAAM,IAAI,IAAI,IAAI;AAClB,QAAI,MAAM;AAAG,eAAS,IAAI,GAAG,IAAI,YAAY;AAAK,cAAM,IAAI,OAAM;EACpE;AACA,SAAO;AACT;AAkJA,SAAS,YAAe,OAAe,OAAmBC,OAAc;AACtE,MAAI,OAAO;AACT,QAAI,MAAM,UAAU;AAAO,YAAM,IAAI,MAAM,gDAAgD;AAC3F,kBAAc,KAAK;AACnB,WAAO;EACT,OAAO;AACL,WAAO,MAAM,OAAO,EAAE,MAAAA,MAAI,CAAE;EAC9B;AACF;AAIM,SAAU,mBACd,MACA,OACA,YAA8B,CAAA,GAC9B,QAAgB;AAEhB,MAAI,WAAW;AAAW,aAAS,SAAS;AAC5C,MAAI,CAAC,SAAS,OAAO,UAAU;AAAU,UAAM,IAAI,MAAM,kBAAkB,IAAI,eAAe;AAC9F,aAAW,KAAK,CAAC,KAAK,KAAK,GAAG,GAAY;AACxC,UAAM,MAAM,MAAM,CAAC;AACnB,QAAI,EAAE,OAAO,QAAQ,YAAY,MAAMC;AACrC,YAAM,IAAI,MAAM,SAAS,CAAC,0BAA0B;EACxD;AACA,QAAMC,MAAK,YAAY,MAAM,GAAG,UAAU,IAAI,MAAM;AACpD,QAAMC,MAAK,YAAY,MAAM,GAAG,UAAU,IAAI,MAAM;AACpD,QAAM,KAAgB,SAAS,gBAAgB,MAAM;AACrD,QAAM,SAAS,CAAC,MAAM,MAAM,KAAK,EAAE;AACnC,aAAW,KAAK,QAAQ;AAEtB,QAAI,CAACD,IAAG,QAAQ,MAAM,CAAC,CAAC;AACtB,YAAM,IAAI,MAAM,SAAS,CAAC,0CAA0C;EACxE;AACA,UAAQ,OAAO,OAAO,OAAO,OAAO,CAAA,GAAI,KAAK,CAAC;AAC9C,SAAO,EAAE,OAAO,IAAAA,KAAI,IAAAC,IAAE;AACxB;;;AC5oBA,IAAMC,OAAM,OAAO,CAAC;AAApB,IAAuBC,OAAM,OAAO,CAAC;AAArC,IAAwCC,OAAM,OAAO,CAAC;AAAtD,IAAyDC,OAAM,OAAO,CAAC;AA8JvE,SAAS,YAAYC,KAAoB,OAAoB,GAAW,GAAS;AAC/E,QAAM,KAAKA,IAAG,IAAI,CAAC;AACnB,QAAM,KAAKA,IAAG,IAAI,CAAC;AACnB,QAAM,OAAOA,IAAG,IAAIA,IAAG,IAAI,MAAM,GAAG,EAAE,GAAG,EAAE;AAC3C,QAAM,QAAQA,IAAG,IAAIA,IAAG,KAAKA,IAAG,IAAI,MAAM,GAAGA,IAAG,IAAI,IAAI,EAAE,CAAC,CAAC;AAC5D,SAAOA,IAAG,IAAI,MAAM,KAAK;AAC3B;AAEM,SAAU,QAAQ,QAAqB,YAA8B,CAAA,GAAE;AAC3E,QAAM,YAAY,mBAAmB,WAAW,QAAQ,WAAW,UAAU,MAAM;AACnF,QAAM,EAAE,IAAAA,KAAI,IAAAC,IAAE,IAAK;AACnB,MAAI,QAAQ,UAAU;AACtB,QAAM,EAAE,GAAG,SAAQ,IAAK;AACxB,kBAAgB,WAAW,CAAA,GAAI,EAAE,SAAS,WAAU,CAAE;AAMtD,QAAM,OAAOH,QAAQ,OAAOG,IAAG,QAAQ,CAAC,IAAIJ;AAC5C,QAAM,OAAO,CAAC,MAAcG,IAAG,OAAO,CAAC;AAGvC,QAAME,WACJ,UAAU,YACT,CAAC,GAAW,MAAa;AACxB,QAAI;AACF,aAAO,EAAE,SAAS,MAAM,OAAOF,IAAG,KAAKA,IAAG,IAAI,GAAG,CAAC,CAAC,EAAC;IACtD,SAAS,GAAG;AACV,aAAO,EAAE,SAAS,OAAO,OAAOJ,KAAG;IACrC;EACF;AAIF,MAAI,CAAC,YAAYI,KAAI,OAAO,MAAM,IAAI,MAAM,EAAE;AAC5C,UAAM,IAAI,MAAM,mCAAmC;AAMrD,WAAS,OAAO,OAAe,GAAW,UAAU,OAAK;AACvD,UAAM,MAAM,UAAUH,OAAMD;AAC5B,IAAAO,UAAS,gBAAgB,OAAO,GAAG,KAAK,IAAI;AAC5C,WAAO;EACT;AAEA,WAAS,UAAU,OAAc;AAC/B,QAAI,EAAE,iBAAiB;AAAQ,YAAM,IAAI,MAAM,wBAAwB;EACzE;AAGA,QAAM,eAAe,SAAS,CAAC,GAAU,OAAoC;AAC3E,UAAM,EAAE,GAAG,GAAG,EAAC,IAAK;AACpB,UAAM,MAAM,EAAE,IAAG;AACjB,QAAI,MAAM;AAAM,WAAK,MAAMJ,OAAOC,IAAG,IAAI,CAAC;AAC1C,UAAM,IAAI,KAAK,IAAI,EAAE;AACrB,UAAM,IAAI,KAAK,IAAI,EAAE;AACrB,UAAM,KAAKA,IAAG,IAAI,GAAG,EAAE;AACvB,QAAI;AAAK,aAAO,EAAE,GAAGJ,MAAK,GAAGC,KAAG;AAChC,QAAI,OAAOA;AAAK,YAAM,IAAI,MAAM,kBAAkB;AAClD,WAAO,EAAE,GAAG,EAAC;EACf,CAAC;AACD,QAAM,kBAAkB,SAAS,CAAC,MAAY;AAC5C,UAAM,EAAE,GAAG,EAAC,IAAK;AACjB,QAAI,EAAE,IAAG;AAAI,YAAM,IAAI,MAAM,iBAAiB;AAG9C,UAAM,EAAE,GAAG,GAAG,GAAG,EAAC,IAAK;AACvB,UAAM,KAAK,KAAK,IAAI,CAAC;AACrB,UAAM,KAAK,KAAK,IAAI,CAAC;AACrB,UAAM,KAAK,KAAK,IAAI,CAAC;AACrB,UAAM,KAAK,KAAK,KAAK,EAAE;AACvB,UAAM,MAAM,KAAK,KAAK,CAAC;AACvB,UAAM,OAAO,KAAK,KAAK,KAAK,MAAM,EAAE,CAAC;AACrC,UAAM,QAAQ,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;AAC/C,QAAI,SAAS;AAAO,YAAM,IAAI,MAAM,uCAAuC;AAE3E,UAAM,KAAK,KAAK,IAAI,CAAC;AACrB,UAAM,KAAK,KAAK,IAAI,CAAC;AACrB,QAAI,OAAO;AAAI,YAAM,IAAI,MAAM,uCAAuC;AACtE,WAAO;EACT,CAAC;EAID,MAAM,MAAK;IAeT,YAAY,GAAW,GAAW,GAAW,GAAS;AACpD,WAAK,IAAI,OAAO,KAAK,CAAC;AACtB,WAAK,IAAI,OAAO,KAAK,CAAC;AACtB,WAAK,IAAI,OAAO,KAAK,GAAG,IAAI;AAC5B,WAAK,IAAI,OAAO,KAAK,CAAC;AACtB,aAAO,OAAO,IAAI;IACpB;IAEA,OAAO,QAAK;AACV,aAAO;IACT;IAEA,OAAO,WAAW,GAAsB;AACtC,UAAI,aAAa;AAAO,cAAM,IAAI,MAAM,4BAA4B;AACpE,YAAM,EAAE,GAAG,EAAC,IAAK,KAAK,CAAA;AACtB,aAAO,KAAK,CAAC;AACb,aAAO,KAAK,CAAC;AACb,aAAO,IAAI,MAAM,GAAG,GAAGA,MAAK,KAAK,IAAI,CAAC,CAAC;IACzC;;IAGA,OAAO,UAAU,OAAmB,SAAS,OAAK;AAChD,YAAM,MAAMG,IAAG;AACf,YAAM,EAAE,GAAG,EAAC,IAAK;AACjB,cAAQI,WAAU,SAAO,OAAO,KAAK,OAAO,CAAC;AAC7C,cAAM,QAAQ,QAAQ;AACtB,YAAM,SAASA,WAAU,KAAK;AAC9B,YAAM,WAAW,MAAM,MAAM,CAAC;AAC9B,aAAO,MAAM,CAAC,IAAI,WAAW,CAAC;AAC9B,YAAM,IAAIC,iBAAgB,MAAM;AAMhC,YAAM,MAAM,SAAS,OAAOL,IAAG;AAC/B,MAAAG,UAAS,WAAW,GAAGP,MAAK,GAAG;AAI/B,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,IAAI,KAAK,KAAKC,IAAG;AACvB,YAAM,IAAI,KAAK,IAAI,KAAK,CAAC;AACzB,UAAI,EAAE,SAAS,OAAO,EAAC,IAAKK,SAAQ,GAAG,CAAC;AACxC,UAAI,CAAC;AAAS,cAAM,IAAI,MAAM,iCAAiC;AAC/D,YAAM,UAAU,IAAIL,UAASA;AAC7B,YAAM,iBAAiB,WAAW,SAAU;AAC5C,UAAI,CAAC,UAAU,MAAMD,QAAO;AAE1B,cAAM,IAAI,MAAM,0BAA0B;AAC5C,UAAI,kBAAkB;AAAQ,YAAI,KAAK,CAAC,CAAC;AACzC,aAAO,MAAM,WAAW,EAAE,GAAG,EAAC,CAAE;IAClC;IACA,OAAO,QAAQ,OAAmB,SAAS,OAAK;AAC9C,aAAO,MAAM,UAAU,YAAY,SAAS,KAAK,GAAG,MAAM;IAC5D;IAEA,IAAI,IAAC;AACH,aAAO,KAAK,SAAQ,EAAG;IACzB;IACA,IAAI,IAAC;AACH,aAAO,KAAK,SAAQ,EAAG;IACzB;IAEA,WAAW,aAAqB,GAAG,SAAS,MAAI;AAC9C,WAAK,YAAY,MAAM,UAAU;AACjC,UAAI,CAAC;AAAQ,aAAK,SAASE,IAAG;AAC9B,aAAO;IACT;;IAGA,iBAAc;AACZ,sBAAgB,IAAI;IACtB;;IAGA,OAAO,OAAY;AACjB,gBAAU,KAAK;AACf,YAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,GAAE,IAAK;AAChC,YAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,GAAE,IAAK;AAChC,YAAM,OAAO,KAAK,KAAK,EAAE;AACzB,YAAM,OAAO,KAAK,KAAK,EAAE;AACzB,YAAM,OAAO,KAAK,KAAK,EAAE;AACzB,YAAM,OAAO,KAAK,KAAK,EAAE;AACzB,aAAO,SAAS,QAAQ,SAAS;IACnC;IAEA,MAAG;AACD,aAAO,KAAK,OAAO,MAAM,IAAI;IAC/B;IAEA,SAAM;AAEJ,aAAO,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D;;;;IAKA,SAAM;AACJ,YAAM,EAAE,EAAC,IAAK;AACd,YAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,GAAE,IAAK;AAChC,YAAM,IAAI,KAAK,KAAK,EAAE;AACtB,YAAM,IAAI,KAAK,KAAK,EAAE;AACtB,YAAM,IAAI,KAAKA,OAAM,KAAK,KAAK,EAAE,CAAC;AAClC,YAAM,IAAI,KAAK,IAAI,CAAC;AACpB,YAAM,OAAO,KAAK;AAClB,YAAM,IAAI,KAAK,KAAK,OAAO,IAAI,IAAI,IAAI,CAAC;AACxC,YAAM,IAAI,IAAI;AACd,YAAM,IAAI,IAAI;AACd,YAAM,IAAI,IAAI;AACd,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,aAAO,IAAI,MAAM,IAAI,IAAI,IAAI,EAAE;IACjC;;;;IAKA,IAAI,OAAY;AACd,gBAAU,KAAK;AACf,YAAM,EAAE,GAAG,EAAC,IAAK;AACjB,YAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,GAAE,IAAK;AACvC,YAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,GAAE,IAAK;AACvC,YAAM,IAAI,KAAK,KAAK,EAAE;AACtB,YAAM,IAAI,KAAK,KAAK,EAAE;AACtB,YAAM,IAAI,KAAK,KAAK,IAAI,EAAE;AAC1B,YAAM,IAAI,KAAK,KAAK,EAAE;AACtB,YAAM,IAAI,MAAM,KAAK,OAAO,KAAK,MAAM,IAAI,CAAC;AAC5C,YAAM,IAAI,IAAI;AACd,YAAM,IAAI,IAAI;AACd,YAAM,IAAI,KAAK,IAAI,IAAI,CAAC;AACxB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,YAAM,KAAK,KAAK,IAAI,CAAC;AACrB,aAAO,IAAI,MAAM,IAAI,IAAI,IAAI,EAAE;IACjC;IAEA,SAAS,OAAY;AACnB,aAAO,KAAK,IAAI,MAAM,OAAM,CAAE;IAChC;;IAGA,SAAS,QAAc;AAErB,UAAI,CAACG,IAAG,YAAY,MAAM;AAAG,cAAM,IAAI,MAAM,4CAA4C;AACzF,YAAM,EAAE,GAAG,EAAC,IAAK,KAAK,OAAO,MAAM,QAAQ,CAACK,OAAM,WAAW,OAAOA,EAAC,CAAC;AACtE,aAAO,WAAW,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IACpC;;;;;;IAOA,eAAe,QAAgB,MAAM,MAAM,MAAI;AAE7C,UAAI,CAACL,IAAG,QAAQ,MAAM;AAAG,cAAM,IAAI,MAAM,4CAA4C;AACrF,UAAI,WAAWL;AAAK,eAAO,MAAM;AACjC,UAAI,KAAK,IAAG,KAAM,WAAWC;AAAK,eAAO;AACzC,aAAO,KAAK,OAAO,MAAM,QAAQ,CAAC,MAAM,WAAW,OAAO,CAAC,GAAG,GAAG;IACnE;;;;;IAMA,eAAY;AACV,aAAO,KAAK,eAAe,QAAQ,EAAE,IAAG;IAC1C;;;IAIA,gBAAa;AACX,aAAO,KAAK,OAAO,MAAM,MAAM,CAAC,EAAE,IAAG;IACvC;;;IAIA,SAAS,WAAkB;AACzB,aAAO,aAAa,MAAM,SAAS;IACrC;IAEA,gBAAa;AACX,UAAI,aAAaA;AAAK,eAAO;AAC7B,aAAO,KAAK,eAAe,QAAQ;IACrC;IAEA,UAAO;AACL,YAAM,EAAE,GAAG,EAAC,IAAK,KAAK,SAAQ;AAE9B,YAAM,QAAQG,IAAG,QAAQ,CAAC;AAG1B,YAAM,MAAM,SAAS,CAAC,KAAK,IAAIH,OAAM,MAAO;AAC5C,aAAO;IACT;IACA,QAAK;AACH,aAAOU,YAAW,KAAK,QAAO,CAAE;IAClC;IAEA,WAAQ;AACN,aAAO,UAAU,KAAK,IAAG,IAAK,SAAS,KAAK,MAAK,CAAE;IACrD;;IAGA,IAAI,KAAE;AACJ,aAAO,KAAK;IACd;IACA,IAAI,KAAE;AACJ,aAAO,KAAK;IACd;IACA,IAAI,KAAE;AACJ,aAAO,KAAK;IACd;IACA,IAAI,KAAE;AACJ,aAAO,KAAK;IACd;IACA,OAAO,WAAW,QAAe;AAC/B,aAAO,WAAW,OAAO,MAAM;IACjC;IACA,OAAO,IAAI,QAAiB,SAAiB;AAC3C,aAAO,UAAU,OAAON,KAAI,QAAQ,OAAO;IAC7C;IACA,eAAe,YAAkB;AAC/B,WAAK,WAAW,UAAU;IAC5B;IACA,aAAU;AACR,aAAO,KAAK,QAAO;IACrB;;AArPgB,QAAA,OAAO,IAAI,MAAM,MAAM,IAAI,MAAM,IAAIJ,MAAK,KAAK,MAAM,KAAK,MAAM,EAAE,CAAC;AAEnE,QAAA,OAAO,IAAI,MAAMD,MAAKC,MAAKA,MAAKD,IAAG;AAEnC,QAAA,KAAKI;AAEL,QAAA,KAAKC;AAiPvB,QAAM,OAAO,IAAI,KAAK,OAAOA,IAAG,IAAI;AACpC,QAAM,KAAK,WAAW,CAAC;AACvB,SAAO;AACT;AAOM,IAAgB,oBAAhB,MAAiC;EAUrC,YAAY,IAAgB;AAC1B,SAAK,KAAK;EACZ;;EAOA,OAAO,UAAU,QAAkB;AACjC,mBAAc;EAChB;EAEA,OAAO,QAAQ,MAAS;AACtB,mBAAc;EAChB;EAEA,IAAI,IAAC;AACH,WAAO,KAAK,SAAQ,EAAG;EACzB;EACA,IAAI,IAAC;AACH,WAAO,KAAK,SAAQ,EAAG;EACzB;;EAGA,gBAAa;AAEX,WAAO;EACT;EAEA,iBAAc;AACZ,SAAK,GAAG,eAAc;EACxB;EAEA,SAAS,WAAkB;AACzB,WAAO,KAAK,GAAG,SAAS,SAAS;EACnC;EAEA,QAAK;AACH,WAAOM,YAAW,KAAK,QAAO,CAAE;EAClC;EAEA,WAAQ;AACN,WAAO,KAAK,MAAK;EACnB;EAEA,gBAAa;AACX,WAAO;EACT;EAEA,eAAY;AACV,WAAO;EACT;EAEA,IAAI,OAAQ;AACV,SAAK,WAAW,KAAK;AACrB,WAAO,KAAK,KAAK,KAAK,GAAG,IAAI,MAAM,EAAE,CAAC;EACxC;EAEA,SAAS,OAAQ;AACf,SAAK,WAAW,KAAK;AACrB,WAAO,KAAK,KAAK,KAAK,GAAG,SAAS,MAAM,EAAE,CAAC;EAC7C;EAEA,SAAS,QAAc;AACrB,WAAO,KAAK,KAAK,KAAK,GAAG,SAAS,MAAM,CAAC;EAC3C;EAEA,eAAe,QAAc;AAC3B,WAAO,KAAK,KAAK,KAAK,GAAG,eAAe,MAAM,CAAC;EACjD;EAEA,SAAM;AACJ,WAAO,KAAK,KAAK,KAAK,GAAG,OAAM,CAAE;EACnC;EAEA,SAAM;AACJ,WAAO,KAAK,KAAK,KAAK,GAAG,OAAM,CAAE;EACnC;EAEA,WAAW,YAAqB,QAAgB;AAC9C,WAAO,KAAK,KAAK,KAAK,GAAG,WAAW,YAAY,MAAM,CAAC;EACzD;;EAQA,aAAU;AACR,WAAO,KAAK,QAAO;EACrB;;AAMI,SAAU,MAAM,OAAyB,OAAc,YAAuB,CAAA,GAAE;AACpF,MAAI,OAAO,UAAU;AAAY,UAAM,IAAI,MAAM,mCAAmC;AACpF,kBACE,WACA,CAAA,GACA;IACE,mBAAmB;IACnB,aAAa;IACb,QAAQ;IACR,SAAS;IACT,YAAY;GACb;AAGH,QAAM,EAAE,QAAO,IAAK;AACpB,QAAM,EAAE,MAAM,IAAAP,KAAI,IAAAC,IAAE,IAAK;AAEzB,QAAMO,eAAc,UAAU,eAAe;AAC7C,QAAMC,qBAAoB,UAAU,sBAAsB,CAAC,UAAsB;AACjF,QAAM,SACJ,UAAU,WACT,CAAC,MAAkB,KAAiB,WAAmB;AACtD,YAAM,QAAQ,QAAQ;AACtB,QAAI,IAAI,UAAU;AAAQ,YAAM,IAAI,MAAM,qCAAqC;AAC/E,WAAO;EACT;AAGF,WAAS,QAAQ,MAAgB;AAC/B,WAAOR,IAAG,OAAOI,iBAAgB,IAAI,CAAC;EACxC;AAGA,WAAS,iBAAiB,KAAQ;AAChC,UAAM,MAAM,QAAQ;AACpB,UAAM,YAAY,eAAe,KAAK,GAAG;AAGzC,UAAM,SAAS,YAAY,sBAAsB,MAAM,GAAG,GAAG,IAAI,GAAG;AACpE,UAAM,OAAOI,mBAAkB,OAAO,MAAM,GAAG,GAAG,CAAC;AACnD,UAAM,SAAS,OAAO,MAAM,KAAK,IAAI,GAAG;AACxC,UAAM,SAAS,QAAQ,IAAI;AAC3B,WAAO,EAAE,MAAM,QAAQ,OAAM;EAC/B;AAGA,WAAS,qBAAqB,WAAc;AAC1C,UAAM,EAAE,MAAM,QAAQ,OAAM,IAAK,iBAAiB,SAAS;AAC3D,UAAM,QAAQ,KAAK,SAAS,MAAM;AAClC,UAAM,aAAa,MAAM,QAAO;AAChC,WAAO,EAAE,MAAM,QAAQ,QAAQ,OAAO,WAAU;EAClD;AAGA,WAAS,aAAa,WAAc;AAClC,WAAO,qBAAqB,SAAS,EAAE;EACzC;AAGA,WAAS,mBAAmB,UAAe,WAAW,GAAE,MAAO,MAAkB;AAC/E,UAAM,MAAM,YAAY,GAAG,IAAI;AAC/B,WAAO,QAAQ,MAAM,OAAO,KAAK,YAAY,WAAW,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;EAC/E;AAGA,WAAS,KAAK,KAAU,WAAgB,UAA6B,CAAA,GAAE;AACrE,UAAM,YAAY,WAAW,GAAG;AAChC,QAAI;AAAS,YAAM,QAAQ,GAAG;AAC9B,UAAM,EAAE,QAAQ,QAAQ,WAAU,IAAK,qBAAqB,SAAS;AACrE,UAAM,IAAI,mBAAmB,QAAQ,SAAS,QAAQ,GAAG;AACzD,UAAM,IAAI,KAAK,SAAS,CAAC,EAAE,QAAO;AAClC,UAAM,IAAI,mBAAmB,QAAQ,SAAS,GAAG,YAAY,GAAG;AAChE,UAAM,IAAIR,IAAG,OAAO,IAAI,IAAI,MAAM;AAClC,QAAI,CAACA,IAAG,QAAQ,CAAC;AAAG,YAAM,IAAI,MAAM,wBAAwB;AAC5D,UAAM,KAAK,YAAY,GAAGA,IAAG,QAAQ,CAAC,CAAC;AACvC,WAAO,SAAO,IAAI,QAAQ,WAAW,QAAQ;EAC/C;AAGA,QAAM,aAAkD,EAAE,QAAQ,KAAI;AAMtE,WAAS,OAAO,KAAU,KAAU,WAAgB,UAAU,YAAU;AACtE,UAAM,EAAE,SAAS,OAAM,IAAK;AAC5B,UAAM,MAAM,QAAQ;AACpB,UAAM,YAAY,aAAa,KAAK,GAAG;AACvC,UAAM,YAAY,WAAW,GAAG;AAChC,gBAAY,YAAY,aAAa,WAAW,QAAQ,SAAS;AACjE,QAAI,WAAW;AAAW,cAAM,QAAQ,QAAQ;AAChD,QAAI;AAAS,YAAM,QAAQ,GAAG;AAE9B,UAAM,MAAM,MAAM;AAClB,UAAM,IAAI,IAAI,SAAS,GAAG,GAAG;AAC7B,UAAM,IAAII,iBAAgB,IAAI,SAAS,KAAK,GAAG,CAAC;AAChD,QAAI,GAAG,GAAG;AACV,QAAI;AAIF,UAAI,MAAM,UAAU,WAAW,MAAM;AACrC,UAAI,MAAM,UAAU,GAAG,MAAM;AAC7B,WAAK,KAAK,eAAe,CAAC;IAC5B,SAAS,OAAO;AACd,aAAO;IACT;AACA,QAAI,CAAC,UAAU,EAAE,aAAY;AAAI,aAAO;AAExC,UAAM,IAAI,mBAAmB,SAAS,EAAE,QAAO,GAAI,EAAE,QAAO,GAAI,GAAG;AACnE,UAAM,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AAGrC,WAAO,IAAI,SAAS,EAAE,EAAE,cAAa,EAAG,IAAG;EAC7C;AAEA,QAAM,QAAQL,IAAG;AACjB,QAAM,UAAU;IACd,WAAW;IACX,WAAW;IACX,WAAW,IAAI;IACf,MAAM;;AAER,WAAS,gBAAgB,OAAOQ,aAAY,QAAQ,IAAI,GAAC;AACvD,WAAO,SAAO,MAAM,QAAQ,MAAM,MAAM;EAC1C;AACA,WAAS,OAAO,MAAiB;AAC/B,UAAM,YAAY,MAAM,gBAAgB,IAAI;AAC5C,WAAO,EAAE,WAAW,WAAW,aAAa,SAAS,EAAC;EACxD;AACA,WAAS,iBAAiB,KAAe;AACvC,WAAOE,SAAQ,GAAG,KAAK,IAAI,WAAWT,IAAG;EAC3C;AACA,WAAS,iBAAiB,KAAiB,QAAgB;AACzD,QAAI;AACF,aAAO,CAAC,CAAC,MAAM,UAAU,KAAK,MAAM;IACtC,SAAS,OAAO;AACd,aAAO;IACT;EACF;AAEA,QAAM,QAAQ;IACZ;IACA;IACA;IACA;;;;;;;;;;IAUA,aAAa,WAAqB;AAChC,YAAM,EAAE,EAAC,IAAK,MAAM,UAAU,SAAS;AACvC,YAAM,OAAO,QAAQ;AACrB,YAAM,UAAU,SAAS;AACzB,UAAI,CAAC,WAAW,SAAS;AAAI,cAAM,IAAI,MAAM,gCAAgC;AAC7E,YAAM,IAAI,UAAUD,IAAG,IAAIH,OAAM,GAAGA,OAAM,CAAC,IAAIG,IAAG,IAAI,IAAIH,MAAK,IAAIA,IAAG;AACtE,aAAOG,IAAG,QAAQ,CAAC;IACrB;IAEA,mBAAmB,WAAqB;AACtC,YAAM,OAAO,QAAQ;AACrB,eAAO,WAAW,IAAI;AACtB,YAAM,SAAS,MAAM,UAAU,SAAS,GAAG,IAAI,CAAC;AAChD,aAAOS,mBAAkB,MAAM,EAAE,SAAS,GAAG,IAAI;IACnD;;IAGA,kBAAkB;;IAElB,WAAW,aAAa,GAAG,QAAsB,MAAM,MAAI;AACzD,aAAO,MAAM,WAAW,YAAY,KAAK;IAC3C;;AAGF,SAAO,OAAO,OAAO;IACnB;IACA;IACA;IACA;IACA;IACA;IACA;GACD;AACH;AAmCA,SAAS,0BAA0B,GAAsB;AACvD,QAAM,QAAqB;IACzB,GAAG,EAAE;IACL,GAAG,EAAE;IACL,GAAG,EAAE,GAAG;IACR,GAAG,EAAE;IACL,GAAG,EAAE;IACL,IAAI,EAAE;IACN,IAAI,EAAE;;AAER,QAAMT,MAAK,EAAE;AACb,QAAMC,MAAK,MAAM,MAAM,GAAG,EAAE,YAAY,IAAI;AAC5C,QAAM,YAA8B,EAAE,IAAAD,KAAI,IAAAC,KAAI,SAAS,EAAE,QAAO;AAChE,QAAM,YAAuB;IAC3B,aAAa,EAAE;IACf,mBAAmB,EAAE;IACrB,QAAQ,EAAE;IACV,SAAS,EAAE;IACX,YAAY,EAAE;;AAEhB,SAAO,EAAE,OAAO,WAAW,MAAM,EAAE,MAAM,UAAS;AACpD;AACA,SAAS,4BAA4B,GAAwBU,QAAY;AACvE,QAAM,QAAQA,OAAM;AACpB,QAAM,SAAS,OAAO,OAAO,CAAA,GAAIA,QAAO;IACtC,eAAe;IACf,OAAO;IACP,YAAY,MAAM,GAAG;IACrB,aAAa,MAAM,GAAG;GACvB;AACD,SAAO;AACT;AAEM,SAAU,eAAe,GAAsB;AACnD,QAAM,EAAE,OAAO,WAAW,MAAM,UAAS,IAAK,0BAA0B,CAAC;AACzE,QAAM,QAAQ,QAAQ,OAAO,SAAS;AACtC,QAAM,QAAQ,MAAM,OAAO,MAAM,SAAS;AAC1C,SAAO,4BAA4B,GAAG,KAAK;AAC7C;;;ACz2BA,IAAMC,OAAsB,uBAAO,CAAC;AAApC,IAAuCC,OAAM,OAAO,CAAC;AAArD,IAAwDC,OAAM,OAAO,CAAC;AAAtE,IAAyEC,OAAM,OAAO,CAAC;AAEvF,IAAMC,OAAM,OAAO,CAAC;AAApB,IAAuBC,OAAM,OAAO,CAAC;AAGrC,IAAMC,mBAAkB,OACtB,oEAAoE;AAMtE,IAAM,gBAA8C,wBAAO;EACzD,GAAGA;EACH,GAAG,OAAO,oEAAoE;EAC9E,GAAGD;EACH,GAAG,OAAO,oEAAoE;EAC9E,GAAG,OAAO,oEAAoE;EAC9E,IAAI,OAAO,oEAAoE;EAC/E,IAAI,OAAO,oEAAoE;IAC9E;AAEH,SAASE,qBAAoB,GAAS;AAEpC,QAAM,OAAO,OAAO,EAAE,GAAG,OAAO,OAAO,EAAE,GAAG,OAAO,OAAO,EAAE,GAAG,OAAO,OAAO,EAAE;AAC/E,QAAM,IAAID;AACV,QAAM,KAAM,IAAI,IAAK;AACrB,QAAM,KAAM,KAAK,IAAK;AACtB,QAAM,KAAME,MAAK,IAAIN,MAAK,CAAC,IAAI,KAAM;AACrC,QAAM,KAAMM,MAAK,IAAIP,MAAK,CAAC,IAAI,IAAK;AACpC,QAAM,MAAOO,MAAK,IAAIJ,MAAK,CAAC,IAAI,KAAM;AACtC,QAAM,MAAOI,MAAK,KAAK,MAAM,CAAC,IAAI,MAAO;AACzC,QAAM,MAAOA,MAAK,KAAK,MAAM,CAAC,IAAI,MAAO;AACzC,QAAM,MAAOA,MAAK,KAAK,MAAM,CAAC,IAAI,MAAO;AACzC,QAAM,OAAQA,MAAK,KAAK,MAAM,CAAC,IAAI,MAAO;AAC1C,QAAM,OAAQA,MAAK,MAAM,MAAM,CAAC,IAAI,MAAO;AAC3C,QAAM,OAAQA,MAAK,MAAM,MAAM,CAAC,IAAI,MAAO;AAC3C,QAAM,YAAaA,MAAK,MAAMN,MAAK,CAAC,IAAI,IAAK;AAE7C,SAAO,EAAE,WAAW,GAAE;AACxB;AAEA,SAASO,mBAAkB,OAAiB;AAG1C,QAAM,CAAC,KAAK;AAEZ,QAAM,EAAE,KAAK;AAEb,QAAM,EAAE,KAAK;AACb,SAAO;AACT;AAIA,IAAM,kBAAkC,uBACtC,+EAA+E;AAGjF,SAAS,QAAQ,GAAW,GAAS;AACnC,QAAM,IAAIH;AACV,QAAM,KAAKI,KAAI,IAAI,IAAI,GAAG,CAAC;AAC3B,QAAM,KAAKA,KAAI,KAAK,KAAK,GAAG,CAAC;AAE7B,QAAM,MAAMH,qBAAoB,IAAI,EAAE,EAAE;AACxC,MAAI,IAAIG,KAAI,IAAI,KAAK,KAAK,CAAC;AAC3B,QAAM,MAAMA,KAAI,IAAI,IAAI,GAAG,CAAC;AAC5B,QAAM,QAAQ;AACd,QAAM,QAAQA,KAAI,IAAI,iBAAiB,CAAC;AACxC,QAAM,WAAW,QAAQ;AACzB,QAAM,WAAW,QAAQA,KAAI,CAAC,GAAG,CAAC;AAClC,QAAM,SAAS,QAAQA,KAAI,CAAC,IAAI,iBAAiB,CAAC;AAClD,MAAI;AAAU,QAAI;AAClB,MAAI,YAAY;AAAQ,QAAI;AAC5B,MAAI,aAAa,GAAG,CAAC;AAAG,QAAIA,KAAI,CAAC,GAAG,CAAC;AACrC,SAAO,EAAE,SAAS,YAAY,UAAU,OAAO,EAAC;AAClD;AAEA,IAAM,KAAsB,uBAAM,MAAM,cAAc,GAAG,EAAE,MAAM,KAAI,CAAE,GAAE;AACzE,IAAM,KAAsB,uBAAM,MAAM,cAAc,GAAG,EAAE,MAAM,KAAI,CAAE,GAAE;AAEzE,IAAM,kBAAmC,wBAAO;EAC9C,GAAG;EACH;EACA,MAAMC;EACN,mBAAAF;;;;EAIA;IACC;AAYI,IAAM,UAAoC,uBAAM,eAAe,eAAe,GAAE;AA6IvF,IAAM,UAAU;AAEhB,IAAM,oBAAoC,uBACxC,+EAA+E;AAGjF,IAAM,oBAAoC,uBACxC,+EAA+E;AAGjF,IAAM,iBAAiC,uBACrC,8EAA8E;AAGhF,IAAM,iBAAiC,uBACrC,+EAA+E;AAGjF,IAAM,aAAa,CAAC,WAAmB,QAAQG,MAAK,MAAM;AAE1D,IAAM,WAA2B,uBAC/B,oEAAoE;AAEtE,IAAM,qBAAqB,CAAC,UAC1B,QAAQ,MAAM,GAAG,OAAOC,iBAAgB,KAAK,IAAI,QAAQ;AAS3D,SAAS,0BAA0B,IAAU;AAC3C,QAAM,EAAE,EAAC,IAAK;AACd,QAAM,IAAIC;AACV,QAAMC,OAAM,CAAC,MAAc,GAAG,OAAO,CAAC;AACtC,QAAM,IAAIA,KAAI,UAAU,KAAK,EAAE;AAC/B,QAAM,KAAKA,MAAK,IAAIH,QAAO,cAAc;AACzC,MAAI,IAAI,OAAO,EAAE;AACjB,QAAM,IAAIG,MAAK,IAAI,IAAI,KAAKA,KAAI,IAAI,CAAC,CAAC;AACtC,MAAI,EAAE,SAAS,YAAY,OAAO,EAAC,IAAK,QAAQ,IAAI,CAAC;AACrD,MAAI,KAAKA,KAAI,IAAI,EAAE;AACnB,MAAI,CAAC,aAAa,IAAI,CAAC;AAAG,SAAKA,KAAI,CAAC,EAAE;AACtC,MAAI,CAAC;AAAY,QAAI;AACrB,MAAI,CAAC;AAAY,QAAI;AACrB,QAAM,KAAKA,KAAI,KAAK,IAAIH,QAAO,iBAAiB,CAAC;AACjD,QAAM,KAAK,IAAI;AACf,QAAM,KAAKG,MAAK,IAAI,KAAK,CAAC;AAC1B,QAAM,KAAKA,KAAI,KAAK,iBAAiB;AACrC,QAAM,KAAKA,KAAIH,OAAM,EAAE;AACvB,QAAM,KAAKG,KAAIH,OAAM,EAAE;AACvB,SAAO,IAAI,QAAQ,MAAMG,KAAI,KAAK,EAAE,GAAGA,KAAI,KAAK,EAAE,GAAGA,KAAI,KAAK,EAAE,GAAGA,KAAI,KAAK,EAAE,CAAC;AACjF;AAEA,SAAS,iBAAiB,OAAiB;AACzC,EAAAC,QAAO,OAAO,EAAE;AAChB,QAAM,KAAK,mBAAmB,MAAM,SAAS,GAAG,EAAE,CAAC;AACnD,QAAM,KAAK,0BAA0B,EAAE;AACvC,QAAM,KAAK,mBAAmB,MAAM,SAAS,IAAI,EAAE,CAAC;AACpD,QAAM,KAAK,0BAA0B,EAAE;AACvC,SAAO,IAAI,gBAAgB,GAAG,IAAI,EAAE,CAAC;AACvC;AAWA,IAAM,kBAAN,MAAM,yBAAwB,kBAAkC;EAgB9D,YAAY,IAAiB;AAC3B,UAAM,EAAE;EACV;EAEA,OAAO,WAAW,IAAuB;AACvC,WAAO,IAAI,iBAAgB,QAAQ,MAAM,WAAW,EAAE,CAAC;EACzD;EAEU,WAAW,OAAsB;AACzC,QAAI,EAAE,iBAAiB;AAAkB,YAAM,IAAI,MAAM,yBAAyB;EACpF;EAEU,KAAK,IAAgB;AAC7B,WAAO,IAAI,iBAAgB,EAAE;EAC/B;;EAGA,OAAO,YAAY,KAAQ;AACzB,WAAO,iBAAiB,YAAY,iBAAiB,KAAK,EAAE,CAAC;EAC/D;EAEA,OAAO,UAAU,OAAiB;AAChC,IAAAA,QAAO,OAAO,EAAE;AAChB,UAAM,EAAE,GAAG,EAAC,IAAK;AACjB,UAAM,IAAIF;AACV,UAAMC,OAAM,CAAC,MAAc,GAAG,OAAO,CAAC;AACtC,UAAM,IAAI,mBAAmB,KAAK;AAGlC,QAAI,CAACE,YAAW,GAAG,QAAQ,CAAC,GAAG,KAAK,KAAK,aAAa,GAAG,CAAC;AACxD,YAAM,IAAI,MAAM,iCAAiC;AACnD,UAAM,KAAKF,KAAI,IAAI,CAAC;AACpB,UAAM,KAAKA,KAAIH,OAAM,IAAI,EAAE;AAC3B,UAAM,KAAKG,KAAIH,OAAM,IAAI,EAAE;AAC3B,UAAM,OAAOG,KAAI,KAAK,EAAE;AACxB,UAAM,OAAOA,KAAI,KAAK,EAAE;AACxB,UAAM,IAAIA,KAAI,IAAI,IAAI,OAAO,IAAI;AACjC,UAAM,EAAE,SAAS,OAAO,EAAC,IAAK,WAAWA,KAAI,IAAI,IAAI,CAAC;AACtD,UAAM,KAAKA,KAAI,IAAI,EAAE;AACrB,UAAM,KAAKA,KAAI,IAAI,KAAK,CAAC;AACzB,QAAI,IAAIA,MAAK,IAAI,KAAK,EAAE;AACxB,QAAI,aAAa,GAAG,CAAC;AAAG,UAAIA,KAAI,CAAC,CAAC;AAClC,UAAM,IAAIA,KAAI,KAAK,EAAE;AACrB,UAAM,IAAIA,KAAI,IAAI,CAAC;AACnB,QAAI,CAAC,WAAW,aAAa,GAAG,CAAC,KAAK,MAAMG;AAC1C,YAAM,IAAI,MAAM,iCAAiC;AACnD,WAAO,IAAI,iBAAgB,IAAI,QAAQ,MAAM,GAAG,GAAGN,MAAK,CAAC,CAAC;EAC5D;;;;;;EAOA,OAAO,QAAQ,KAAQ;AACrB,WAAO,iBAAgB,UAAU,YAAY,gBAAgB,KAAK,EAAE,CAAC;EACvE;EAEA,OAAO,IAAI,QAA2B,SAAiB;AACrD,WAAO,UAAU,kBAAiB,QAAQ,MAAM,IAAI,QAAQ,OAAO;EACrE;;;;;EAMA,UAAO;AACL,QAAI,EAAE,GAAG,GAAG,GAAG,EAAC,IAAK,KAAK;AAC1B,UAAM,IAAIE;AACV,UAAMC,OAAM,CAAC,MAAc,GAAG,OAAO,CAAC;AACtC,UAAM,KAAKA,KAAIA,KAAI,IAAI,CAAC,IAAIA,KAAI,IAAI,CAAC,CAAC;AACtC,UAAM,KAAKA,KAAI,IAAI,CAAC;AAEpB,UAAM,OAAOA,KAAI,KAAK,EAAE;AACxB,UAAM,EAAE,OAAO,QAAO,IAAK,WAAWA,KAAI,KAAK,IAAI,CAAC;AACpD,UAAM,KAAKA,KAAI,UAAU,EAAE;AAC3B,UAAM,KAAKA,KAAI,UAAU,EAAE;AAC3B,UAAM,OAAOA,KAAI,KAAK,KAAK,CAAC;AAC5B,QAAI;AACJ,QAAI,aAAa,IAAI,MAAM,CAAC,GAAG;AAC7B,UAAI,KAAKA,KAAI,IAAI,OAAO;AACxB,UAAI,KAAKA,KAAI,IAAI,OAAO;AACxB,UAAI;AACJ,UAAI;AACJ,UAAIA,KAAI,KAAK,iBAAiB;IAChC,OAAO;AACL,UAAI;IACN;AACA,QAAI,aAAa,IAAI,MAAM,CAAC;AAAG,UAAIA,KAAI,CAAC,CAAC;AACzC,QAAI,IAAIA,MAAK,IAAI,KAAK,CAAC;AACvB,QAAI,aAAa,GAAG,CAAC;AAAG,UAAIA,KAAI,CAAC,CAAC;AAClC,WAAO,GAAG,QAAQ,CAAC;EACrB;;;;;EAMA,OAAO,OAAsB;AAC3B,SAAK,WAAW,KAAK;AACrB,UAAM,EAAE,GAAG,IAAI,GAAG,GAAE,IAAK,KAAK;AAC9B,UAAM,EAAE,GAAG,IAAI,GAAG,GAAE,IAAK,MAAM;AAC/B,UAAMA,OAAM,CAAC,MAAc,GAAG,OAAO,CAAC;AAEtC,UAAM,MAAMA,KAAI,KAAK,EAAE,MAAMA,KAAI,KAAK,EAAE;AACxC,UAAM,MAAMA,KAAI,KAAK,EAAE,MAAMA,KAAI,KAAK,EAAE;AACxC,WAAO,OAAO;EAChB;EAEA,MAAG;AACD,WAAO,KAAK,OAAO,iBAAgB,IAAI;EACzC;;AA3HO,gBAAA,OACY,uBAAM,IAAI,gBAAgB,QAAQ,MAAM,IAAI,GAAE;AAE1D,gBAAA,OACY,uBAAM,IAAI,gBAAgB,QAAQ,MAAM,IAAI,GAAE;AAE1D,gBAAA,KACY,uBAAM,IAAG;AAErB,gBAAA,KACY,uBAAM,IAAG;;;AC/W9B,IAAM,eAAe,IAAI,KAAK;ACHvB,IAAM,eAAN,cAA2B,MAAM;EAC7B;EACA;EACA;EAET,YAAY,MAAc,SAAiB,QAAgB,SAAmB;AAC5E,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;EACjB;AACF;ACRO,SAAS,iBAA2B;AACzC,MAAI,OAAO,SAAS,aAAa;AAC/B,WAAO;EACT;AAEA,QAAM,UAAU;AAGhB,MAAI,QAAQ,SAAS,UAAU;AAC7B,QAAI,SAAS,QAAQ,QAAQ,UAAU;AACrC,aAAO;IACT;AACA,QAAI,UAAU,QAAQ,QAAQ,UAAU;AACtC,aAAO;IACT;EACF;AAEA,MAAI,OAAO,cAAc,eAAe,UAAU,YAAY,eAAe;AAC3E,WAAO;EACT;AAEA,SAAO;AACT;AAYO,SAAS,eAAuB;AACrC,QAAM,OAAO,eAAe;AAC5B,SAAO,SAAS,YAAY,QAAQ;AACtC;ACJO,IAAM,0BAA0B;AAChC,IAAM,mBAAmB;AASzB,SAAS,eAAe,SAAuC;AACpE,MAAI,OAAO,YAAY,YAAY,YAAY,KAAM,QAAO;AAC5D,QAAM,MAAM;AACZ,MAAI,IAAI,UAAU,eAAgB,QAAO;AACzC,QAAM,IAAI,IAAI;AACd,MAAI,OAAO,MAAM,YAAY,MAAM,KAAM,QAAO;AAChD,QAAM,EAAE,IAAI,QAAQ,WAAW,IAAI;AACnC,MAAI,OAAO,OAAO,YAAY,OAAO,WAAW,SAAU,QAAO;AACjE,MAAI,OAAO,eAAe,YAAY,CAAC,OAAO,UAAU,UAAU,KAAK,aAAa;AAClF,WAAO;AACT,SAAO,EAAE,IAAI,QAAQ,WAAW;AAClC;AAEA,IAAM,UAAU,IAAI,YAAY;AAqBhC,IAAI,SAAwB;AAE5B,eAAe,WAA4B;AACzC,MAAI,OAAQ,QAAO;AAMnB,QAAM,UAAU;AAGhB,QAAM,UACJ,QAAQ,SAAS,UAAU,SAAS,UAAa,QAAQ,SAAS,UAAU,QAAQ;AACtF,MAAI,SAAS;AACX,QAAI;AACF,YAAMI,OAAO,MAAM;;QAA0B,GAAG,OAAO;;AAGvD,UAAI,OAAOA,KAAI,eAAe,YAAY;AACxC,cAAM,aAAaA,KAAI;AACvB,iBAAS,CAAC,UAAkB,IAAI,WAAW,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,CAAC;AACtF,eAAO;MACT;IACF,QAAQ;IAGR;EACF;AACA,WAAS,OAAO,UACd,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,OAAO,KAAK,CAAC,CAAC;AAC7E,SAAO;AACT;AAGA,IAAM,MAAM,MACV,OAAO,gBAAgB,eAAe,OAAO,YAAY,QAAQ,aAC7D,YAAY,IAAI,IAChB,KAAK,IAAI;AAGf,SAAS,gBAAgB,MAA0B;AACjD,MAAI,OAAO;AACX,aAAW,QAAQ,MAAM;AACvB,QAAI,SAAS,GAAG;AACd,cAAQ;AACR;IACF;AAGA,WAAO,OAAO,KAAK,MAAM,IAAI,IAAI;EACnC;AACA,SAAO;AACT;AAYO,IAAM,qBAAqB;AAsB3B,SAAS,UAAU,YAA4B;AACpD,SAAO,IAAI,KAAK;AAClB;AAyBO,IAAM,qBAAqB;AAYlC,IAAM,qBAAqB;AAC3B,IAAM,kBAAkB;AAExB,eAAsB,kBACpB,WACA,gBAAgB,UAAU,UAAU,UAAU,GAM9C,QACiC;AACjC,MAAI,UAAU,aAAa,oBAAoB;AAC7C,UAAM,IAAI;MACR,sCAAsC,UAAU,UAAU,kCAAkC,kBAAkB;IAChH;EACF;AAEA,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,WAAW;AACf,MAAI,aAAa;AAGjB,MAAI,WAAW,OAAO;AAEtB,WAAS,QAAQ,GAAG,QAAQ,eAAe,SAAS;AAGlD,SAAK,QAAQ,UAAU,GAAG;AACxB,UAAI,QAAQ,SAAS;AACnB,cAAM,IAAI,aAAa,+BAA+B,YAAY;MACpE;AACA,UAAI,IAAI,IAAI,UAAU;AACpB,cAAM,IAAI;UACR,wCAAwC,UAAU,UAAU,UAAU,qBAAqB,GAAI,SACtF,MAAM,eAAe,CAAC;QACjC;MACF;IACF;AAWA,QAAI,UAAU,oBAAoB;AAChC,iBAAW,IAAI;IACjB;AACA,QAAI,CAAC,cAAc,UAAU,iBAAiB;AAC5C,mBAAa;AACb,YAAM,UAAU,KAAK,IAAI,IAAI,IAAI,UAAU,IAAK;AAChD,YAAM,QAAQ,kBAAkB,uBAAuB,UAAU;AAWjE,YAAM,aAAc,KAAK,UAAU,aAAa,OAAQ;AACxD,UAAI,aAAa,oBAAoB;AACnC,cAAM,IAAI;UACR,6BAA6B,UAAU,UAAU,gBAAgB,KAAK,MAAM,aAAa,GAAI,CAAC,WACxF,KAAK,MAAM,IAAI,EAAE,eAAe,CAAC,sCAAsC,qBAAqB,GAAI;QAExG;MACF;AACA,iBAAW,IAAI,KAAK,sBAAsB,IAAI,IAAI;IACpD;AAEA,UAAM,OAAO,MAAM,OAAO,UAAU,SAAS,KAAK;AAClD,QAAI,gBAAgB,IAAI,KAAK,UAAU,YAAY;AACjD,aAAO;QACL,CAAC,uBAAuB,GAAG,UAAU;QACrC,CAAC,gBAAgB,GAAG,OAAO,KAAK;MAClC;IACF;EACF;AACA,QAAM,IAAI;IACR,gDAAgD,UAAU,UAAU,WAAW,aAAa;EAC9F;AACF;AEtSO,SAAS,gBAAgB,KAAkC;AAChE,QAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,MAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAC1E,UAAM,IAAI,MAAM,wBAAwB;EAC1C;AACA,QAAM,SAAS,oBAAI,IAAoB;AACvC,MAAI,IAAI;AACR,QAAM,QAAQ,MAAM;AAClB,WAAO,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,IAAI,OAAQ;EACpD;AACA,QAAM,YAAY,CAAC,UAAkB;AACnC,QAAI,MAAM,QAAQ;AAClB,WAAO,MAAM,IAAI,QAAQ;AACvB,UAAI,IAAI,GAAG,MAAM,KAAM,QAAO;eACrB,IAAI,KAAK,MAAM,IAAK,QAAO;IACtC;AACA,UAAM,IAAI,MAAM,0BAA0B;EAC5C;AACA,QAAM;AACN;AACA,SAAO,MAAM;AACX,UAAM;AACN,QAAI,IAAI,CAAC,MAAM,IAAK,QAAO;AAC3B,UAAM,UAAU,UAAU,CAAC;AAC3B,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM,GAAG,OAAO,CAAC;AAC7C,QAAI;AACJ,UAAM;AACN;AACA,UAAM;AACN,UAAM,QAAQ;AACd,QAAI,IAAI,CAAC,MAAM,IAAK,KAAI,UAAU,CAAC;aAC1B,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,KAAK;AACzC,UAAI,QAAQ;AACZ,SAAG;AACD,cAAM,IAAI,IAAI,CAAC;AACf,YAAI,MAAM,KAAK;AACb,cAAI,UAAU,CAAC;AACf;QACF;AACA,YAAI,MAAM,OAAO,MAAM,IAAK;AAC5B,YAAI,MAAM,OAAO,MAAM,IAAK;AAC5B;MACF,SAAS,QAAQ,KAAK,IAAI,IAAI;IAChC,OAAO;AACL,aAAO,IAAI,IAAI,UAAU,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,EAAE,EAAG;IACzD;AAEA,QAAI,OAAO,IAAI,IAAI,EAAG,OAAM,IAAI,MAAM,sBAAsB;AAC5D,WAAO,IAAI,MAAM,IAAI,MAAM,OAAO,CAAC,CAAC;AACpC,UAAM;AACN,QAAI,IAAI,CAAC,MAAM,IAAK;EACtB;AACF;AAEO,SAAS,WAAW,OAAwC;AACjE,SAAO,WAAW,KAAK,KAAK,KAAK,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAC5D;AAEO,SAAS,SAAS,OAA2B;AAElD,MAAI,SAAS;AACb,aAAW,QAAQ,MAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,SAAO,KAAK,MAAM;AACpB;AD1DO,IAAM,sBAAsB;AAC5B,IAAM,gBAAgB;AAC7B,IAAMC,WAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AACxD,IAAM,gBAAgB;AAEf,SAAS,gBAAgB,MAAuB;AAErD,SAAO,IAAI,IAAI,MAAM,wBAAwB,EAAE,SAAS,WAAW,QAAQ;AAC7E;AAEO,SAAS,WACd,MACA,QACA,MACA,KACA,IACA,MACyB;AACzB,QAAM,SAAS,CAAC,MAAM,QAAQ,MAAM,KAAK,IAAI,EAAE,IAAI,CAAC,UAAUA,SAAQ,OAAO,KAAK,CAAC;AACnF,QAAM,QAAQ,IAAI,WAAW,OAAO,OAAO,CAAC,MAAM,UAAU,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC;AACvF,QAAM,OAAO,IAAI,SAAS,MAAM,MAAM;AACtC,MAAI,SAAS;AACb,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,GAAG;AAC7C,QAAI,UAAU,GAAG;AACf,WAAK,aAAa,QAAQ,OAAO,EAAE,CAAC;AACpC,gBAAU;IACZ;AACA,SAAK,UAAU,QAAQ,MAAM,MAAM;AACnC,cAAU;AACV,UAAM,IAAI,OAAO,MAAM;AACvB,cAAU,MAAM;EAClB;AACA,SAAO;AACT;AAEO,SAAS,eAA4B;AAC1C,SAAO,IAAI,YAAY;IACrB,KAAK,IAAIC,uBAAsB;IAC/B,KAAK,IAAI,WAAW;IACpB,MAAM,IAAI,iBAAiB;EAC7B,CAAC;AACH;AAEA,eAAsB,YACpB,KACA,KACA,MACkC;AAClC,QAAM,QAAQ,aAAa;AAC3B,QAAM,SAAS,MAAM,MAAM,oBAAoB;IAC7C,oBAAoB,MAAM,MAAM,IAAI,UAAU,OAAO,IAAI,UAAU,MAAM;EAC3E,CAAC;AACD,QAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,QAAM,MAAM,QAAQ,IAAI,cAAc,KAAK;AAC3C,QAAM,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACvC,QAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,QAAM,SAAS,KAAK,UAAU;AAE9B,QAAM,MAAM;IACV,OAAO;IACP;IACA,mBAAmB,OAAO,QAAQ;IAClC;IACA;IACA,QAAQ,IAAI,iBAAiB,KAAK;EACpC;AACA,QAAM,KAAK,MAAM,OAAO,KAAKD,SAAQ,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,EAAE,GAAG,GAAG;AAChG,QAAM,WAAW,KAAK,UAAU;IAC9B,GAAG;IACH,KAAK,IAAI;IACT,KAAK,SAAS,IAAI,WAAW,OAAO,GAAG,CAAC;IACxC,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;IAC/B;IACA;EACF,CAAC;AACD,MAAI,WAAW,SAAS,WAAW,UAAU,KAAK,SAAS,QAAW;AACpE,YAAQ;MACN;MACA,SAASA,SAAQ,OAAO,QAAQ,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;IAC9F;AACA,WAAO,KAAK;EACd,OAAO;AACL,YAAQ,OAAO,aAAa;AAC5B,YAAQ,IAAI,gBAAgB,mBAAmB;AAC/C,SAAK,OAAO;EACd;AACA,UAAQ,OAAO,gBAAgB;AAC/B,OAAK,UAAU,OAAO,YAAY,QAAQ,QAAQ,CAAC;AAEnD,OAAK,WAAW;AAChB,SAAO,IAAI,WAAW,MAAM,OAAO,OAAOA,SAAQ,OAAO,aAAa,GAAG,EAAE,CAAC;AAC9E;AAEA,eAAsB,mBACpB,UACA,UACA,QACmB;AACnB,MACE,SAAS,QAAQ,IAAI,cAAc,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,YAAY,MACxE,qBACA;AAEA,QAAI,YAAY,SAAS,MAAM,WAAW,QAAQ;AAChD,YAAM,IAAI;QACR;QACA;QACA,SAAS;MACX;IACF;AACA,WAAO;EACT;AAEA,MAAI,WAAW,OAAQ,QAAO;AAC9B,MAAI;AACF,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,oBAAoB;AACnD,UAAM,WAAY,MAAM,SAAS,KAAK;AAOtC,QACE,SAAS,MAAM,KACf,CAAC,OAAO,UAAU,SAAS,EAAE,KAC7B,SAAS,KAAK,OACd,SAAS,KAAK,OACd,OAAO,SAAS,QAAQ,UACxB;AACA,YAAM,IAAI,MAAM,2BAA2B;IAC7C;AACA,UAAM,YAAY,MAAM,IAAI,iBAAiB,EAC1C,wBAAwB,QAAQ,EAChC;MACC,WAAW,SAAS,CAAC;MACrB,WAAW,SAAS,EAAE;MACtBA,SAAQ,OAAO,GAAG,aAAa;EAAK,SAAS,GAAG;EAAK,SAAS,EAAE,EAAE;IACpE;AACF,UAAM,UAAU,IAAI,QAAQ,SAAS,OAAO;AAC5C,YAAQ,IAAI,gBAAgB,SAAS,GAAG;AACxC,YAAQ,OAAO,gBAAgB;AAC/B,YAAQ,OAAO,kBAAkB;AAEjC,WAAO,IAAI,SAAS,CAAC,KAAK,KAAK,GAAG,EAAE,SAAS,SAAS,EAAE,IAAI,OAAO,QAAQ,OAAO,SAAS,GAAG;MAC5F,QAAQ,SAAS;MACjB;IACF,CAAC;EACH,QAAQ;AACN,UAAM,IAAI;MACR;MACA;MACA,SAAS;IACX;EACF;AACF;AGjJO,SAAS,YAAY,MAAc,MAAsB;AAC9D,SAAO,GAAG,KAAK,QAAQ,QAAQ,EAAE,CAAC,GAAG,IAAI;AAC3C;ADdO,IAAM,qBAAqB;AAC3B,IAAM,eAAe;AAE5B,IAAM,aAAa;AACnB,IAAM,aAAa,IAAI;AACvB,IAAM,sBAAsB;AAC5B,IAAMA,WAAU,IAAI,YAAY;AASzB,SAAS,oBAAoB,SAAiB,QAAwB;AAG3E,QAAM,OAAO,IAAI,IAAI,OAAO,EAAE;AAC9B,SACE,4DAA4D,KAAK,IAAI,IAAI,CAAC,KAC1E,eAAe,KAAK,MAAM,IAAI,CAAC,KAC/B;AAEJ;AAEA,SAAS,OAAO,KAAkD;AAChE,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,uBAAuB;AACjD,kBAAgB,GAAG;AACnB,SAAO,KAAK,MAAM,GAAG;AACvB;AAEA,SAAS,OAAO,OAAwB;AACtC,MAAI,OAAO,UAAU,YAAY,CAAC,MAAO,OAAM,IAAI,MAAM,gBAAgB;AACzE,SAAO;AACT;AAEA,SAAS,QAAQ,OAAwB;AACvC,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI,MAAM,iBAAiB;EACnC;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,KAAa,QAAiC,WAAuB;AAC5F,MACE,OAAO,QAAQ,aACf,UAAU,WAAW,MACrB,CAAC,QAAQ,OAAO,WAAW,OAAO,OAAO,GAAG,CAAC,GAAGA,SAAQ,OAAO,GAAG,GAAG,WAAW;IAC9E,QAAQ;EACV,CAAC;AAED,UAAM,IAAI,MAAM,8BAA8B;AAClD;AAGO,SAAS,iBACd,KACA,aACA,MACA,aACAE,MACY;AACZ,QAAM,SAAS,gBAAgB,GAAG;AAClC,QAAM,SAAS,OAAO,GAAG;AACzB,QAAM,eAAe,OAAO,IAAI,SAAS;AACzC,QAAM,YAAY,OAAO,YAAY;AACrC,QAAM,aAAa,gBAAgB,gBAAgB,EAAE,EAAE,IAAI,SAAS;AACpE,MAAI,CAAC,cAAc,UAAU,YAAY,kBAAkB;AACzD,UAAM,IAAI,MAAM,2BAA2B;EAC7C;AACA,kBAAgB,YAAY,WAAW,WAAW,IAAI,CAAC;AACvD,QAAM,UAAU,OAAO,UAAU;AACjC,MACE,QAAQ,MAAM,KACd,CAAC,eACD,OAAO,QAAQ,QAAQ,EAAE,KAAK,EAAE,YAAY,MAAM,YAAY,YAAY,GAC1E;AACA,UAAM,IAAI,MAAM,yCAAyC;EAC3D;AACA,QAAM,gBAAgB,QAAQ,QAAQ,OAAO;AAC7C,MAAI,gBAAgB,OAAQA,KAAK,OAAM,IAAI,MAAM,wBAAwB;AACzE,QAAM,YAAY,OAAO,IAAI,QAAQ;AACrC,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM,uBAAuB;AACvD,kBAAgB,WAAW,QAAQ,WAAW,OAAO,QAAQ,UAAU,CAAC,CAAC;AACzE,QAAM,SAAS,OAAO,SAAS;AAC/B,QAAM,UAAU,QAAQ,OAAO,OAAO;AACtC,QAAM,UAAU,KAAK,IAAI,QAAQ,OAAO,OAAO,GAAG,aAAa;AAC/D,MAAI,UAAU,YAAa,OAAM,IAAI,MAAM,sCAAsC;AACjF,MAAI,UAAU,OAAQA,KAAK,OAAM,IAAI,MAAM,uBAAuB;AAClE,MAAI,OAAO,MAAM,KAAK,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,OAAM,IAAI,MAAM,uBAAuB;AAC1F,aAAW,QAAQ,OAAO,MAAM;AAC9B,QAAI,SAAS,QAAQ,OAAO,SAAS,SAAU;AAC/C,UAAM,QAAQ;AACd,QAAI,MAAM,QAAQ,aAAc;AAChC,UAAM,YAAY,WAAW,OAAO,MAAM,GAAG,CAAC;AAC9C,QAAI,UAAU,WAAW,GAAI,OAAM,IAAI,MAAM,4BAA4B;AACzE,WAAO,EAAE,KAAK,OAAO,MAAM,GAAG,GAAG,WAAW,SAAS,QAAQ;EAC/D;AACA,QAAM,IAAI,MAAM,0BAA0B;AAC5C;AAEO,IAAM,iBAAN,MAAqB;EAS1B,YACmB,SACA,QACA,SACjB;AAHiB,SAAA,UAAA;AACA,SAAA,SAAA;AACA,SAAA,UAAA;EAChB;EAHgB;EACA;EACA;EAXX;EACA;EACA,YAAY;EACZ,aAAa;EACb,cAAc;EACd;EACA,oBAAoB;EAQ5B,MAAM,QAAQ,QAAsB,SAAS,OAA4B;AACvE,YAAQ,eAAe;AACvB,UAAMA,OAAM,KAAK,IAAI;AACrB,UAAM,QAAQ,KAAK,UAAU,KAAK,OAAO,UAAU,MAAOA,OAAM,KAAK,SAAS;AAC9E,QAAI,KAAK,QAAS,QAAO,KAAK,QAAQ,KAAK,SAAS,MAAM;AAE1D,QAAI,UAAUA,OAAM,KAAK,qBAAqB,qBAAqB;AACjE,WAAK,YAAY;AACjB,WAAK,aAAa;AAClB,WAAK,oBAAoBA;IAC3B;AACA,QAAI,SAASA,OAAM,KAAK,YAAY,WAAY,QAAO;AACvD,QAAIA,OAAM,KAAK,YAAY;AACzB,UAAI,MAAO,QAAO;AAClB,YAAM,KAAK;IACb;AACA,UAAM,UAAU,KAAK,SAAS,EAC3B,KAAK,CAAC,QAAQ;AACb,WAAK,SAAS;AACd,WAAK,cAAc,IAAI;AACvB,WAAK,YAAY,KAAK,IAAI;AAC1B,WAAK,aAAa;AAClB,aAAO;IACT,CAAC,EACA,MAAM,CAAC,UAAmB;AACzB,WAAK,aAAa,KAAK,IAAI,IAAI;AAC/B,WAAK,YACH,iBAAiB,eACb,QACA,IAAI;QACF;QACA;QACA;MACF;AAEN,UAAI,KAAK,UAAU,KAAK,OAAO,UAAU,MAAO,KAAK,IAAI,EAAG,QAAO,KAAK;AACxE,YAAM,KAAK;IACb,CAAC,EACA,QAAQ,MAAM;AACb,WAAK,UAAU;IACjB,CAAC;AACH,SAAK,UAAU;AACf,WAAO,KAAK,QAAQ,SAAS,MAAM;EACrC;EAEA,MAAc,WAAgC;AAC5C,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,IAAM;AACzD,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,YAAY,KAAK,SAAS,kBAAkB,GAAG;QAC1E,SAAS,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;QAClD,QAAQ,WAAW;QACnB,OAAO;QACP,UAAU;MACZ,CAAC;AACD,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,2BAA2B;AAC7D,YAAM,MAAM,MAAM,SAAS,KAAK;AAChC,UAAI,IAAI,SAAS,KAAK,KAAM,OAAM,IAAI,MAAM,yBAAyB;AACrE,YAAM,cAAc,KAAK,SAAS,YAAY,oBAAoB,KAAK,SAAS,KAAK,MAAM;AAC3F,aAAO;QACL;QACA;QACA,KAAK,SAAS,QAAQ;QACtB,KAAK;QACL,KAAK,IAAI;MACX;IACF,UAAA;AACE,mBAAa,KAAK;IACpB;EACF;;EAGQ,QAAQ,SAA8B,QAA2C;AACvF,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,UAAU,MAAM,OAAO,OAAO,MAAM;AAC1C,aAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,cAAQ,KAAK,SAAS,MAAM,EAAE,QAAQ,MAAM,OAAO,oBAAoB,SAAS,OAAO,CAAC;AACxF,UAAI,OAAO,QAAS,SAAQ;IAC9B,CAAC;EACH;AACF;AE9LA,IAAM,uBAAuB;AAoB7B,IAAM,aAAa;AAEnB,SAAS,oBAAoB,QAA+B;AAC1D,SAAO,WAAW,KAAK,MAAM,IAAI,CAAC,KAAK;AACzC;AACA,IAAM,cAAc;AACpB,IAAM,qBAAqB;AAQ3B,IAAM,qBAAqB;AAe3B,IAAM,0BAA+C,oBAAI,IAAI;EAC3D;EACA;AACF,CAAC;AAcD,SAAS,gBACP,QACA,MACe;AACf,MAAI,WAAW,IAAK,QAAO;AAC3B,MAAI,MAAM,UAAU,UAAa,CAAC,wBAAwB,IAAI,KAAK,KAAK,EAAG,QAAO;AAClF,QAAM,UAAU,KAAK;AACrB,QAAM,aACJ,OAAO,YAAY,YAAY,OAAO,SAAS,OAAO,KAAK,UAAU,IACjE,UAAU,MACV;AAEN,SAAO,KAAK,IAAI,YAAY,kBAAkB;AAChD;AAeA,SAAS,cACP,MACA,UACqC;AAIrC,QAAM,YACJ,SAAS,WAAW,OACpB,OAAO,MAAM,UAAU,YACvB,wBAAwB,IAAI,KAAK,KAAK;AACxC,MAAI,SAAS,WAAW,OAAO,CAAC,UAAW,QAAO;AAClD,QAAM,OAAO,MAAM;AACnB,QAAM,gBACJ,OAAO,MAAM,gBAAgB,YAC5B,OAAO,SAAS,YAAY,SAAS,QAAQ,gBAAgB;AAChE,MAAI,cAAe,QAAO;AAC1B,QAAM,UAAU,OAAO,SAAS,SAAS,QAAQ,IAAI,aAAa,KAAK,IAAI,EAAE;AAC7E,MAAI,OAAO,MAAM,OAAO,KAAK,WAAW,EAAG,QAAO;AAClD,SAAO,EAAE,GAAG,MAAM,aAAa,QAAQ;AACzC;AAYO,IAAM,aAAN,MAAM,YAAW;EACH;EACA;EAEnB,eAAoC;;;;;;EAOpC,aAA4B;EAEX,eAAqC,CAAC;EACtC,qBAAqB,oBAAI,IAA6C;EAC/E;EAER,YAAY,QAAgB,SAA6B;AACvD,SAAK,SAAS;AACd,SAAK,UAAU;EACjB;;EAGA,cAAc,OAA4B;AACxC,SAAK,aAAa;EACpB;;;;;;;EAQA,YAAY,SAA8D;AACxE,SAAK,mBAAmB,IAAI,OAAO;AACnC,WAAO,MAAM;AACX,WAAK,mBAAmB,OAAO,OAAO;IACxC;EACF;;;;;;;;;EAUA,YAAY,OAA2C;AACrD,UAAM,gBAAgB,EAAE,GAAI,KAAK,SAAS,WAAW,CAAC,GAAI,GAAG,MAAM;AAEnE,UAAM,SAAqB,IAAI,YAAW,KAAK,QAAQ;MACrD,GAAG,KAAK;MACR,SAAS;IACX,CAAC;AACD,WAAO,eAAe,KAAK;AAK3B,WAAO,eAAe,QAAQ,sBAAsB;MAClD,KAAK,MAAM,KAAK;IAClB,CAAC;AACD,WAAO,eAAe,QAAQ,cAAc;MAC1C,KAAK,MAAM,KAAK;MAChB,KAAK,CAAC,MAAqB;AACzB,aAAK,aAAa;MACpB;MACA,cAAc;IAChB,CAAC;AACD,WAAO,eAAe,QAAQ,cAAc;MAC1C,KAAK,MAAM,KAAK;MAChB,KAAK,CAAC,MAAkC;AACtC,aAAK,aAAa;MACpB;IACF,CAAC;AACD,WAAO;EACT;;EAGA,eAAe,aAAuC;AACpD,SAAK,aAAa,KAAK,WAAW;EACpC;EAEA,MAAM,QACJ,QACA,MACA,SAC6B;AAE7B,QACE,CAAC,SAAS,sBACV,KAAK,cAAc,UAAU,KAC7B,KAAK,aAAa,gBAAgB,KAClC,KAAK,aAAa,iBAClB;AACA,UAAI;AACF,cAAM,KAAK,aAAa,eAAe;MACzC,SAAS,GAAG;AACV,cAAM,SAAS,aAAa,eAAe,EAAE,SAAS;AACtD,YAAI,WAAW,OAAO,WAAW,OAAO,WAAW,KAAK;AAMtD,eAAK,aAAa,aAAa;QACjC,OAAO;AACL,gBAAM;QACR;MACF;IACF;AAEA,WAAO,KAAK,iBAAoB,OAAO,YAAY,GAAG,MAAM,SAAS,CAAC;EACxE;;;;;;;;;;;;;;;EAgBA,MAAM,cACJ,QACA,MACA,SAC2F;AAC3F,aAAS,OAAO,YAAY;AAC5B,QACE,CAAC,SAAS,sBACV,KAAK,cAAc,UAAU,KAC7B,KAAK,aAAa,gBAAgB,KAClC,KAAK,aAAa,iBAClB;AACA,UAAI;AACF,cAAM,KAAK,aAAa,eAAe;MACzC,SAAS,GAAG;AACV,cAAM,SAAS,aAAa,eAAe,EAAE,SAAS;AACtD,YAAI,WAAW,OAAO,WAAW,OAAO,WAAW,KAAK;AACtD,eAAK,aAAa,aAAa;QACjC,OAAO;AACL,gBAAM;QACR;MACF;IACF;AAEA,UAAM,MAAM,YAAY,KAAK,WAAW,GAAG,IAAI;AAC/C,UAAM,UAAU,EAAE,GAAG,KAAK,aAAa,OAAO,GAAG,QAAQ,oBAAoB;AAC7E,eAAW,eAAe,KAAK,cAAc;AAC3C,YAAM,YAAY,EAAE,SAAS,QAAQ,KAAK,CAAC;IAC7C;AAEA,UAAM,eAA4B,EAAE,QAAQ,SAAS,QAAQ,SAAS,OAAO;AAC7E,QAAI,SAAS,SAAS,OAAW,cAAa,OAAO,KAAK,UAAU,QAAQ,IAAI;AAChF,UAAM,WAAW,MAAM,KAAK,cAAc,KAAK,MAAM,YAAY;AAEjE,UAAM,WAAW,MAAM,mBAAmB,MAAM,MAAM,KAAK,YAAY,GAAG,UAAU,MAAM;AAC1F,WAAO;MACL,QAAQ,SAAS;MACjB,MAAM,SAAS;MACf,aAAa,SAAS,QAAQ,IAAI,cAAc,KAAK;IACvD;EACF;EAEA,MAAc,cACZ,KACA,MACA,MAC8C;AAC9C,QAAI,KAAK,SAAS,WAAW,SAAS,CAAC,gBAAgB,IAAI,EAAG,QAAO;AACrE,SAAK,eAAe,IAAI,eAAe,KAAK,WAAW,GAAG,KAAK,QAAQ,KAAK,SAAS,MAAM;AAC3F,UAAM,MAAM,MAAM,KAAK,WAAW,QAAQ,KAAK,UAAU,MAAS;AAClE,SAAK,QAAQ,eAAe;AAC5B,QAAI;AACF,aAAO,MAAM,YAAY,KAAK,KAAK,IAAI;IACzC,SAAS,OAAO;AACd,WAAK,QAAQ,eAAe;AAC5B,UAAI,iBAAiB,aAAc,OAAM;AACzC,YAAM,IAAI,aAAa,yBAAyB,uCAAuC,CAAC;IAC1F;EACF;EAEQ,aAAqB;AAE3B,QAAI,KAAK,SAAS,KAAK;AACrB,aAAO,KAAK,QAAQ;IACtB;AAKA,QAAI,KAAK,UAAU,oBAAoB,KAAK,MAAM,MAAM,MAAM;AAC5D,YAAM,IAAI;QACR;QACA;QACA;MACF;IACF;AAEA,WAAO,WAAW,oBAAoB;EACxC;EAEQ,aAAa,SAAkD;AACrE,UAAM,UAAkC;MACtC,gBAAgB;;;;;MAKhB,cAAc,aAAa;IAC7B;AAIA,UAAM,aAAa,KAAK,SAAS,YAAY,KAAK;AAClD,QAAI,YAAY;AACd,cAAQ,0BAA0B,IAAI;IACxC;AAMA,UAAM,eAAe,KAAK;AAC1B,QAAI,cAAc;AAChB,cAAQ,QAAQ,IAAI;IACtB;AAOA,UAAM,QAAQ,KAAK,cAAc,eAAe;AAChD,QAAI,OAAO;AACT,cAAQ,eAAe,IAAI,UAAU,KAAK;IAC5C;AAMA,QAAI,KAAK,YAAY;AACnB,cAAQ,eAAe,IAAI,UAAU,KAAK,UAAU;IACtD;AAGA,QAAI,KAAK,SAAS,SAAS;AACzB,aAAO,OAAO,SAAS,KAAK,QAAQ,OAAO;IAC7C;AAGA,QAAI,SAAS,SAAS;AACpB,aAAO,OAAO,SAAS,QAAQ,OAAO;IACxC;AAEA,WAAO;EACT;EAEA,MAAc,iBACZ,QACA,MACA,SACA,SAKA,QACA,UAAU,OACmB;AAC7B,UAAM,MAAM,YAAY,KAAK,WAAW,GAAG,IAAI;AAC/C,UAAM,UAAU,EAAE,GAAG,KAAK,aAAa,OAAO,GAAG,GAAG,OAAO;AAG3D,eAAW,eAAe,KAAK,cAAc;AAC3C,YAAM,YAAY,EAAE,SAAS,QAAQ,KAAK,CAAC;IAC7C;AAEA,UAAM,eAA4B;MAChC;MACA;MACA,QAAQ,SAAS;IACnB;AAEA,QAAI,SAAS,SAAS,QAAW;AAC/B,mBAAa,OAAO,KAAK,UAAU,QAAQ,IAAI;IACjD;AAGA,UAAM,WAAW,MAAM,KAAK,cAAc,KAAK,MAAM,YAAY;AAEjE,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,KAAK,YAAY;IAC1C,SAAS,OAAO;AACd,eAAS,QAAQ,eAAe;AAEhC,UAAI,SAAS,UAAU,SAAS,UAAU,cAAc,GAAG;AACzD,cAAM,UAAU,qBAAqB,KAAK;AAC1C,cAAM,KAAK,MAAM,OAAO;AAYxB,eAAO,KAAK,iBAAoB,QAAQ,MAAM,SAAS,UAAU,GAAG,QAAW,OAAO;MACxF;AAGA,YAAM,IAAI;QACR;QACA,iBAAiB,QAAQ,MAAM,UAAU;QACzC;MACF;IACF;AACA,eAAW,MAAM,mBAAmB,UAAU,UAAU,MAAM;AAI9D,QAAI,SAAS,WAAW,KAAK;AAC3B,UAAI,SAAS,UAAU,SAAS,UAAU,cAAc,GAAG;AACzD,cAAM,aAAa,SAAS,QAAQ,IAAI,aAAa;AACrD,cAAM,SAAS,aAAa,OAAO,SAAS,YAAY,EAAE,IAAI,OAAO;AAIrE,cAAM,UAAU,OAAO,MAAM,MAAM,IAC/B,qBAAqB,KAAK,UAC1B,KAAK,IAAI,SAAS,KAAM,kBAAkB;AAC9C,cAAM,KAAK,MAAM,OAAO;AAMxB,eAAO,KAAK,iBAAoB,QAAQ,MAAM,SAAS,UAAU,GAAG,QAAQ,OAAO;MACrF;IACF;AAGA,QAAI,OAAiB;AACrB,QAAI;AAWJ,UAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;AACvD,QACE,WAAW,UACX,CAAC,CAAC,KAAK,KAAK,GAAG,EAAE,SAAS,SAAS,MAAM,KACzC,aAAa,SAAS,MAAM,GAC5B;AACA,UAAI,SAAS,IAAI;AACf,eAAQ,MAAM,SAAS,KAAK;MAC9B,OAAO;AAkBL,oBAAa,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,MAAS;MAC1D;IACF;AAOA,QAAI,SAAS,UAAU,SAAS,UAAU,cAAc,GAAG;AACzD,YAAM,WAAW,gBAAgB,SAAS,QAAQ,SAAS;AAC3D,UAAI,aAAa,MAAM;AACrB,cAAM,KAAK,MAAM,QAAQ;AAGzB,eAAO,KAAK,iBAAoB,QAAQ,MAAM,SAAS,UAAU,GAAG,QAAQ,OAAO;MACrF;IACF;AAEA,QACE,YACA,CAAC,WACD,SAAS,WAAW,OACpB,WAAW,UAAU,sBACrB;AACA,YAAM,KAAK,YAAY,QAAQ,SAAS,QAAQ,IAAI;AACpD,aAAO,KAAK,iBAAoB,QAAQ,MAAM,SAAS,SAAS,QAAQ,IAAI;IAC9E;AAkBA,QAAI,SAAS,WAAW,OAAO,CAAC,QAAQ;AACtC,YAAM,YAAY,eAAe,SAAS;AAC1C,UAAI,WAAW;AACb,eAAO,KAAK;UACV;UACA;UACA;UACA;UACA,MAAM,kBAAkB,WAAW,QAAW,SAAS,MAAM;UAC7D;QACF;MACF;IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,SAAS,WAAW,OAAO,cAAc,QAAW;AACtD,cAAM,OAAgC;AACtC,mBAAW,YAAY,KAAK,oBAAoB;AAC9C,cAAI;AACF,qBAAS,IAAI;UACf,QAAQ;UAIR;QACF;MACF;AACA,aAAO;QACL,MAAM;QACN,OAAO,IAAI;UACT,WAAW,SAAS;UACpB,WAAW,qBAAqB,SAAS;UACzC,SAAS;UACT,cAAc,WAAW,QAAQ;QACnC;QACA,QAAQ,SAAS;MACnB;IACF;AAGA,UAAM,eAAe,SAAS,QAAQ,IAAI,eAAe;AACzD,QAAI;AACJ,QAAI,cAAc;AAChB,YAAM,QAAQ,aAAa,YAAY,GAAG;AAC1C,UAAI,SAAS,GAAG;AACd,cAAM,YAAY,aAAa,MAAM,QAAQ,CAAC;AAC9C,YAAI,cAAc,KAAK;AACrB,gBAAM,SAAS,OAAO,SAAS,WAAW,EAAE;AAC5C,cAAI,CAAC,OAAO,MAAM,MAAM,GAAG;AACzB,oBAAQ;UACV;QACF;MACF;IACF;AAIA,UAAM,OAAO,SAAS,QAAQ,IAAI,MAAM;AAExC,WAAO;MACL;MACA,OAAO;MACP,QAAQ,SAAS;MACjB,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;MACvC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;IACzB;EACF;EAEQ,MAAM,IAA2B;AACvC,WAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;EACzD;AACF;;;AExmBA,IAAM,yBAAyB;AAQxB,SAAS,oCAAoC,QAAwB;AAC1E,QAAM,QAAQ,uBAAuB,KAAK,MAAM;AAChD,SAAO,QAAS,MAAM,CAAC,KAAK,KAAM;AACpC;;;AClBO,IAAM,eAAN,MAAM,sBAAqB,MAAM;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAwB,QAA4B;AAC9D,UAAM,OAAO,OAAO;AACpB,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,OAAO,OAAO;AACnB,SAAK,SAAS,OAAO,UAAU;AAC/B,SAAK,YAAY,OAAO;AACxB,SAAK,SAAS,OAAO;AACrB,SAAK,aAAa,OAAO;AACzB,SAAK,OAAO,OAAO;AAAA,EACrB;AAAA,EAEA,OAAO,gBAA8B;AACnC,WAAO,IAAI,cAAa,iBAAiB;AAAA,MACvC,MAAM;AAAA,MACN,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACF;;;AC3BA,IAAM,mBAAmB;AASlB,IAAM,uBAAuB;AAAA,EAClC,MAAM;AAAA,EACN,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,SAAS,kBAAkB,gBAAgC;AAChE,SAAO,iBAAiB,cAAc;AACxC;AAgBO,SAAS,qBACd,gBACA,SACoB;AACpB,QAAM,OAAO,kBAAkB,cAAc;AAC7C,QAAM,QAAQ;AAAA,IACZ,KAAK,UAAU,EAAE,GAAG,QAAQ,aAAa,GAAG,QAAQ,cAAc,GAAG,QAAQ,UAAU,CAAC;AAAA,EAC1F;AACA,MAAI,MAAM,UAAU,kBAAkB;AACpC,WAAO,EAAE,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE;AAAA,EACxD;AACA,QAAM,SAAiD,CAAC;AAOxD,WAAS,QAAQ,GAAG,QAAQ,MAAM,UAAU;AAC1C,QAAI,MAAM,KAAK,IAAI,QAAQ,kBAAkB,MAAM,MAAM;AACzD,QAAI,MAAM,MAAM,QAAQ;AACtB,UAAI,MAAM,MAAM,CAAC,MAAM,IAAK,QAAO;AAAA,eAC1B,MAAM,MAAM,CAAC,MAAM,IAAK,QAAO;AAAA,IAC1C;AACA,WAAO,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,OAAO,MAAM,IAAI,OAAO,MAAM,MAAM,OAAO,GAAG,EAAE,CAAC;AAChF,YAAQ;AAAA,EACV;AACA,SAAO,EAAE,KAAK,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,OAAO,MAAM,EAAE,EAAE;AAC5D;AAaO,SAAS,4BACd,gBACA,SACoB;AACpB,QAAM,EAAE,KAAK,MAAM,IAAI,qBAAqB,gBAAgB,OAAO;AACnE,SAAO;AAAA,IACL,KAAK,IAAI,IAAI,CAAC,EAAE,MAAM,MAAM,OAAO,EAAE,MAAM,OAAO,mBAAmB,KAAK,EAAE,EAAE;AAAA,IAC9E;AAAA,EACF;AACF;AAgBO,SAAS,qBACd,KACA,gBACsB;AACtB,QAAM,OAAO,kBAAkB,cAAc;AAC7C,MAAI,UAAU,IAAI,IAAI;AACtB,MAAI,YAAY,QAAW;AACzB,QAAI,SAAS;AACb,aAAS,IAAI,KAAK,KAAK;AACrB,YAAM,OAAO,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE;AAC/B,UAAI,SAAS,OAAW;AACxB,gBAAU;AAAA,IACZ;AACA,QAAI,WAAW,GAAI,QAAO;AAC1B,cAAU;AAAA,EACZ;AACA,QAAM,MAAM,mBAAmB,OAAO;AACtC,MAAI,QAAQ,KAAM,QAAO;AACzB,MAAI;AACF,WAAO,mBAAmB,mBAAmB,OAAO,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,mBAAmB,MAAoC;AAC9D,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,IAAI;AACvC,QAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC3E,YAAM,MAAM;AACZ,UAAI,OAAO,IAAI,MAAM,YAAY,OAAO,IAAI,MAAM,YAAY,OAAO,IAAI,MAAM,UAAU;AACvF,eAAO,EAAE,aAAa,IAAI,GAAG,cAAc,IAAI,GAAG,WAAW,IAAI,EAAE;AAAA,MACrE;AAAA,IACF;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQO,SAAS,0BACd,gBACA,SACU;AACV,QAAM,OAAO,kBAAkB,cAAc;AAC7C,QAAM,QAAkB,CAAC;AACzB,MAAI,QAAQ,IAAI,EAAG,OAAM,KAAK,IAAI;AAClC,WAAS,IAAI,KAAK,KAAK;AACrB,UAAM,QAAQ,GAAG,IAAI,IAAI,CAAC;AAC1B,QAAI,CAAC,QAAQ,KAAK,EAAG;AACrB,UAAM,KAAK,KAAK;AAAA,EAClB;AACA,SAAO;AACT;;;AC/KA,IAAI;AAUJ,eAAsB,iBAAiB,QAAuD;AAC5F,uBAAqB,OAAO,aAAa;AACzC,MAAI;AACF,WAAO,MAAM;AAAA,EACf,SAAS,OAAO;AACd,uBAAmB;AACnB,UAAM,SAAS,iBAAiB,SAAS,MAAM,UAAU,KAAK,MAAM,OAAO,MAAM;AACjF,UAAM,IAAI,aAAa,cAAc;AAAA,MACnC,MAAM;AAAA,MACN,SAAS,GAAG,MAAM,iEAA4D,MAAM;AAAA,IACtF,CAAC;AAAA,EACH;AACF;;;AhE6CA,IAAM,4BAA4B;AA+ClC,IAAM,oBAAoB,oBAAI,IAAqC;AAEnE,SAAS,oBACP,QACA,cACyB;AACzB,QAAM,WAAW,kBAAkB,IAAI,YAAY;AACnD,MAAI,SAAU,QAAO;AACrB,QAAM,UAAU,QAAQ,QAAQ,YAAY,EAAE,QAAQ,MAAM;AAC1D,sBAAkB,OAAO,YAAY;AAAA,EACvC,CAAC;AACD,oBAAkB,IAAI,cAAc,OAAO;AAC3C,SAAO;AACT;AAGA,eAAe,QAAQ,QAA0B,cAA+C;AAC9F,MAAI;AACF,UAAM,OAAO,IAAI,WAAW,OAAO,QAAQ,EAAE,KAAK,OAAO,KAAK,QAAQ,OAAO,OAAO,CAAC;AACrF,UAAM,MAAM,MAAM,KAAK,QAAiB,QAAQ,uBAAuB;AAAA,MACrE,MAAM,EAAE,eAAe,aAAa;AAAA,MACpC,OAAO;AAAA,IACT,CAAC;AACD,QAAI,IAAI,WAAW,OAAO,IAAI,WAAW,OAAO,IAAI,WAAW,KAAK;AAClE,aAAO,EAAE,MAAM,WAAW;AAAA,IAC5B;AACA,QAAI,IAAI,MAAO,QAAO,EAAE,MAAM,YAAY;AAC1C,UAAM,MAAe,IAAI;AACzB,QAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM;AAC3C,YAAM,MAAM;AACZ,UACE,OAAO,IAAI,iBAAiB,YAC5B,OAAO,IAAI,kBAAkB,YAC7B,OAAO,IAAI,eAAe,UAC1B;AACA,eAAO;AAAA,UACL,MAAM;AAAA,UACN,SAAS;AAAA,YACP,aAAa,IAAI;AAAA,YACjB,cAAc,IAAI;AAAA,YAClB,WAAW,KAAK,IAAI,IAAI,IAAI,aAAa;AAAA,UAC3C;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,MAAM,YAAY;AAAA,EAC7B,QAAQ;AACN,WAAO,EAAE,MAAM,YAAY;AAAA,EAC7B;AACF;AAgBA,eAAsB,WACpB,SACA,QACA,MACuB;AAKvB,QAAM,MAAM,oCAAoC,OAAO,MAAM;AAC7D,MAAI,QAAQ,IAAI;AACd,UAAM,IAAI,aAAa,cAAc;AAAA,MACnC,MAAM;AAAA,MACN,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACA,QAAM,EAAE,aAAa,IAAI,MAAM,iBAAiB,YAAY;AAC5D,QAAM,cAAc,MAAoB,MAAM,YAAY,aAAa,KAAK,EAAE,QAAQ,CAAC;AAEvF,QAAM,UAAU,qBAAqB,CAAC,SAAS,QAAQ,QAAQ,IAAI,IAAI,GAAG,OAAO,GAAG;AACpF,MAAI,CAAC,QAAS,QAAO,YAAY;AACjC,MAAI,QAAQ,YAAY,KAAK,IAAI,KAAK,MAAM,mBAAmB,4BAA4B;AACzF,WAAO,YAAY;AAAA,EACrB;AAEA,QAAM,UAAU,MAAM,oBAAoB,QAAQ,QAAQ,YAAY;AACtE,MAAI,QAAQ,SAAS,YAAa,QAAO,YAAY;AAGrD,QAAM,aAAa,0BAA0B,KAAK,CAAC,SAAS,QAAQ,QAAQ,IAAI,IAAI,CAAC;AAErF,MAAI,QAAQ,SAAS,YAAY;AAC/B,eAAW,QAAQ,WAAY,SAAQ,QAAQ,OAAO,IAAI;AAC1D,UAAMC,YAAW,MAAM,YAAY,aAAa,KAAK,EAAE,QAAQ,CAAC;AAChE,eAAW,QAAQ,YAAY;AAC7B,MAAAA,UAAS,QAAQ,IAAI,MAAM,IAAI,EAAE,GAAG,sBAAsB,QAAQ,EAAE,CAAC;AAAA,IACvE;AACA,IAAAA,UAAS,QAAQ,IAAI,iBAAiB,mBAAmB;AACzD,WAAOA;AAAA,EACT;AAEA,QAAM,QAAQ,4BAA4B,KAAK,QAAQ,OAAO;AAC9D,aAAW,QAAQ,WAAY,SAAQ,QAAQ,OAAO,IAAI;AAC1D,aAAW,EAAE,MAAM,MAAM,KAAK,MAAM,IAAK,SAAQ,QAAQ,IAAI,MAAM,KAAK;AACxE,aAAW,QAAQ,MAAM,MAAO,SAAQ,QAAQ,OAAO,IAAI;AAG3D,QAAM,WAAW,MAAM,YAAY,aAAa,KAAK,EAAE,QAAQ,CAAC;AAChE,QAAM,UAAU,IAAI,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AACpD,aAAW,EAAE,MAAM,MAAM,KAAK,MAAM,KAAK;AACvC,aAAS,QAAQ,IAAI,MAAM,OAAO,oBAAoB;AAAA,EACxD;AAGA,aAAW,QAAQ,oBAAI,IAAI,CAAC,GAAG,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG;AAC3D,QAAI,CAAC,QAAQ,IAAI,IAAI,GAAG;AACtB,eAAS,QAAQ,IAAI,MAAM,IAAI,EAAE,GAAG,sBAAsB,QAAQ,EAAE,CAAC;AAAA,IACvE;AAAA,EACF;AACA,WAAS,QAAQ,IAAI,iBAAiB,mBAAmB;AACzD,SAAO;AACT;","names":["crypto","webcrypto","webcrypto","isLE","adjustScalarBytes","isLE","isAligned32","__classPrivateFieldGet","__classPrivateFieldSet","__classPrivateFieldGet","__classPrivateFieldSet","_1n","_2n","HkdfSha256","X25519","DhkemX25519HkdfSha256","HkdfSha256","isBytes","anumber","abytes","aexists","aoutput","abytes","clean","createView","hasHexBuiltin","hexes","bytesToHex","abytes","asciis","asciiToBase16","hexToBytes","abytes","abytes","createHasher","crypto","isLE","_32n","HashMD","isLE","createView","aexists","abytes","aoutput","clean","SHA512_IV","U32_MASK64","_32n","fromBig","split","shrSH","shrSL","rotrSH","rotrSL","rotrBH","rotrBL","add","add3L","add3H","add4L","add4H","add5L","add5H","split","HashMD","SHA512_IV","rotrSH","shrSH","rotrSL","shrSL","rotrBH","rotrBL","add4L","add4H","add5L","add5H","add","add3L","add3H","clean","sha512","createHasher","_0n","_1n","isBytes","hexToNumber","_0n","bytesToHex","bytesToNumberLE","abytes","numberToBytesBE","hexToBytes","numberToBytesLE","hexToBytes","isBytes","equalBytes","copyBytes","isPosBig","_0n","inRange","aInRange","_1n","_1n","_0n","_1n","_2n","_3n","_5n","_7n","mod","pow2","_0n","mod","_1n","Fp","_5n","_2n","_7n","_3n","Fp","_1n","_2n","anumber","isLE","_0n","_1n","mod","numberToBytesLE","numberToBytesBE","bytesToNumberLE","_0n","_1n","wbits","isLE","_0n","Fp","Fn","_0n","_1n","_2n","_8n","Fp","Fn","uvRatio","aInRange","copyBytes","bytesToNumberLE","p","bytesToHex","randomBytes","adjustScalarBytes","isBytes","eddsa","_0n","_1n","_2n","_3n","_5n","_8n","ed25519_CURVE_p","ed25519_pow_2_252_3","pow2","adjustScalarBytes","mod","sha512","_1n","bytesToNumberLE","ed25519_CURVE_p","mod","abytes","equalBytes","_0n","mod","encoder","DhkemX25519HkdfSha256","now","response"]}