{"version":3,"file":"noble_curves.min.mjs","sources":["../../node_modules/@noble/curves/esm/utils.js","../../node_modules/@noble/curves/esm/abstract/modular.js","../../node_modules/@noble/hashes/esm/hmac.js","../../node_modules/@noble/curves/esm/abstract/curve.js","../../node_modules/@noble/curves/esm/abstract/weierstrass.js","../../node_modules/@noble/curves/esm/_shortw_utils.js","../../node_modules/@noble/curves/esm/nist.js","../../node_modules/@noble/curves/esm/p256.js","../../node_modules/@noble/curves/esm/p384.js","../../node_modules/@noble/curves/esm/p521.js","../../node_modules/@noble/curves/esm/abstract/edwards.js","../../node_modules/@noble/curves/esm/abstract/montgomery.js","../../node_modules/@noble/curves/esm/ed448.js","../../node_modules/@noble/curves/esm/secp256k1.js","../../../../src/crypto/public_key/elliptic/brainpool/brainpoolP256r1.ts","../../../../src/crypto/public_key/elliptic/brainpool/brainpoolP384r1.ts","../../../../src/crypto/public_key/elliptic/brainpool/brainpoolP512r1.ts","../../../../src/crypto/public_key/elliptic/noble_curves.js"],"sourcesContent":["/**\n * Hex, bytes and number utilities.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { abytes as abytes_, bytesToHex as bytesToHex_, concatBytes as concatBytes_, hexToBytes as hexToBytes_, isBytes as isBytes_, } from '@noble/hashes/utils.js';\nexport { abytes, anumber, bytesToHex, bytesToUtf8, concatBytes, hexToBytes, isBytes, randomBytes, utf8ToBytes, } from '@noble/hashes/utils.js';\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\nexport function abool(title, value) {\n    if (typeof value !== 'boolean')\n        throw new Error(title + ' boolean expected, got ' + value);\n}\n// tmp name until v2\nexport function _abool2(value, title = '') {\n    if (typeof value !== 'boolean') {\n        const prefix = title && `\"${title}\"`;\n        throw new Error(prefix + 'expected boolean, got type=' + typeof value);\n    }\n    return value;\n}\n// tmp name until v2\n/** Asserts something is Uint8Array. */\nexport function _abytes2(value, length, title = '') {\n    const bytes = isBytes_(value);\n    const len = value?.length;\n    const needsLen = length !== undefined;\n    if (!bytes || (needsLen && len !== length)) {\n        const prefix = title && `\"${title}\" `;\n        const ofLen = needsLen ? ` of length ${length}` : '';\n        const got = bytes ? `length=${len}` : `type=${typeof value}`;\n        throw new Error(prefix + 'expected Uint8Array' + ofLen + ', got ' + got);\n    }\n    return value;\n}\n// Used in weierstrass, der\nexport function numberToHexUnpadded(num) {\n    const hex = num.toString(16);\n    return hex.length & 1 ? '0' + hex : hex;\n}\nexport function hexToNumber(hex) {\n    if (typeof hex !== 'string')\n        throw new Error('hex string expected, got ' + typeof hex);\n    return hex === '' ? _0n : BigInt('0x' + hex); // Big Endian\n}\n// BE: Big Endian, LE: Little Endian\nexport function bytesToNumberBE(bytes) {\n    return hexToNumber(bytesToHex_(bytes));\n}\nexport function bytesToNumberLE(bytes) {\n    abytes_(bytes);\n    return hexToNumber(bytesToHex_(Uint8Array.from(bytes).reverse()));\n}\nexport function numberToBytesBE(n, len) {\n    return hexToBytes_(n.toString(16).padStart(len * 2, '0'));\n}\nexport function numberToBytesLE(n, len) {\n    return numberToBytesBE(n, len).reverse();\n}\n// Unpadded, rarely used\nexport function numberToVarBytesBE(n) {\n    return hexToBytes_(numberToHexUnpadded(n));\n}\n/**\n * Takes hex string or Uint8Array, converts to Uint8Array.\n * Validates output length.\n * Will throw error for other types.\n * @param title descriptive title for an error e.g. 'secret key'\n * @param hex hex string or Uint8Array\n * @param expectedLength optional, will compare to result array's length\n * @returns\n */\nexport function ensureBytes(title, hex, expectedLength) {\n    let res;\n    if (typeof hex === 'string') {\n        try {\n            res = hexToBytes_(hex);\n        }\n        catch (e) {\n            throw new Error(title + ' must be hex string or Uint8Array, cause: ' + e);\n        }\n    }\n    else if (isBytes_(hex)) {\n        // Uint8Array.from() instead of hash.slice() because node.js Buffer\n        // is instance of Uint8Array, and its slice() creates **mutable** copy\n        res = Uint8Array.from(hex);\n    }\n    else {\n        throw new Error(title + ' must be hex string or Uint8Array');\n    }\n    const len = res.length;\n    if (typeof expectedLength === 'number' && len !== expectedLength)\n        throw new Error(title + ' of length ' + expectedLength + ' expected, got ' + len);\n    return res;\n}\n// Compares 2 u8a-s in kinda constant time\nexport function equalBytes(a, b) {\n    if (a.length !== b.length)\n        return false;\n    let diff = 0;\n    for (let i = 0; i < a.length; i++)\n        diff |= a[i] ^ b[i];\n    return diff === 0;\n}\n/**\n * Copies Uint8Array. We can't use u8a.slice(), because u8a can be Buffer,\n * and Buffer#slice creates mutable copy. Never use Buffers!\n */\nexport function copyBytes(bytes) {\n    return Uint8Array.from(bytes);\n}\n/**\n * Decodes 7-bit ASCII string to Uint8Array, throws on non-ascii symbols\n * Should be safe to use for things expected to be ASCII.\n * Returns exact same result as utf8ToBytes for ASCII or throws.\n */\nexport function asciiToBytes(ascii) {\n    return Uint8Array.from(ascii, (c, i) => {\n        const charCode = c.charCodeAt(0);\n        if (c.length !== 1 || charCode > 127) {\n            throw new Error(`string contains non-ASCII character \"${ascii[i]}\" with code ${charCode} at position ${i}`);\n        }\n        return charCode;\n    });\n}\n/**\n * @example utf8ToBytes('abc') // new Uint8Array([97, 98, 99])\n */\n// export const utf8ToBytes: typeof utf8ToBytes_ = utf8ToBytes_;\n/**\n * Converts bytes to string using UTF8 encoding.\n * @example bytesToUtf8(Uint8Array.from([97, 98, 99])) // 'abc'\n */\n// export const bytesToUtf8: typeof bytesToUtf8_ = bytesToUtf8_;\n// Is positive bigint\nconst isPosBig = (n) => typeof n === 'bigint' && _0n <= n;\nexport function inRange(n, min, max) {\n    return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;\n}\n/**\n * Asserts min <= n < max. NOTE: It's < max and not <= max.\n * @example\n * aInRange('x', x, 1n, 256n); // would assume x is in (1n..255n)\n */\nexport function aInRange(title, n, min, max) {\n    // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)?\n    // consider P=256n, min=0n, max=P\n    // - a for min=0 would require -1:          `inRange('x', x, -1n, P)`\n    // - b would commonly require subtraction:  `inRange('x', x, 0n, P - 1n)`\n    // - our way is the cleanest:               `inRange('x', x, 0n, P)\n    if (!inRange(n, min, max))\n        throw new Error('expected valid ' + title + ': ' + min + ' <= n < ' + max + ', got ' + n);\n}\n// Bit operations\n/**\n * Calculates amount of bits in a bigint.\n * Same as `n.toString(2).length`\n * TODO: merge with nLength in modular\n */\nexport function bitLen(n) {\n    let len;\n    for (len = 0; n > _0n; n >>= _1n, len += 1)\n        ;\n    return len;\n}\n/**\n * Gets single bit at position.\n * NOTE: first bit position is 0 (same as arrays)\n * Same as `!!+Array.from(n.toString(2)).reverse()[pos]`\n */\nexport function bitGet(n, pos) {\n    return (n >> BigInt(pos)) & _1n;\n}\n/**\n * Sets single bit at position.\n */\nexport function bitSet(n, pos, value) {\n    return n | ((value ? _1n : _0n) << BigInt(pos));\n}\n/**\n * Calculate mask for N bits. Not using ** operator with bigints because of old engines.\n * Same as BigInt(`0b${Array(i).fill('1').join('')}`)\n */\nexport const bitMask = (n) => (_1n << BigInt(n)) - _1n;\n/**\n * Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n * @returns function that will call DRBG until 2nd arg returns something meaningful\n * @example\n *   const drbg = createHmacDRBG<Key>(32, 32, hmac);\n *   drbg(seed, bytesToKey); // bytesToKey must return Key or undefined\n */\nexport function createHmacDrbg(hashLen, qByteLen, hmacFn) {\n    if (typeof hashLen !== 'number' || hashLen < 2)\n        throw new Error('hashLen must be a number');\n    if (typeof qByteLen !== 'number' || qByteLen < 2)\n        throw new Error('qByteLen must be a number');\n    if (typeof hmacFn !== 'function')\n        throw new Error('hmacFn must be a function');\n    // Step B, Step C: set hashLen to 8*ceil(hlen/8)\n    const u8n = (len) => new Uint8Array(len); // creates Uint8Array\n    const u8of = (byte) => Uint8Array.of(byte); // another shortcut\n    let v = u8n(hashLen); // Minimal non-full-spec HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n    let k = u8n(hashLen); // Steps B and C of RFC6979 3.2: set hashLen, in our case always same\n    let i = 0; // Iterations counter, will throw when over 1000\n    const reset = () => {\n        v.fill(1);\n        k.fill(0);\n        i = 0;\n    };\n    const h = (...b) => hmacFn(k, v, ...b); // hmac(k)(v, ...values)\n    const reseed = (seed = u8n(0)) => {\n        // HMAC-DRBG reseed() function. Steps D-G\n        k = h(u8of(0x00), seed); // k = hmac(k || v || 0x00 || seed)\n        v = h(); // v = hmac(k || v)\n        if (seed.length === 0)\n            return;\n        k = h(u8of(0x01), seed); // k = hmac(k || v || 0x01 || seed)\n        v = h(); // v = hmac(k || v)\n    };\n    const gen = () => {\n        // HMAC-DRBG generate() function\n        if (i++ >= 1000)\n            throw new Error('drbg: tried 1000 values');\n        let len = 0;\n        const out = [];\n        while (len < qByteLen) {\n            v = h();\n            const sl = v.slice();\n            out.push(sl);\n            len += v.length;\n        }\n        return concatBytes_(...out);\n    };\n    const genUntil = (seed, pred) => {\n        reset();\n        reseed(seed); // Steps D-G\n        let res = undefined; // Step H: grind until k is in [1..n-1]\n        while (!(res = pred(gen())))\n            reseed();\n        reset();\n        return res;\n    };\n    return genUntil;\n}\n// Validating curves and fields\nconst validatorFns = {\n    bigint: (val) => typeof val === 'bigint',\n    function: (val) => typeof val === 'function',\n    boolean: (val) => typeof val === 'boolean',\n    string: (val) => typeof val === 'string',\n    stringOrUint8Array: (val) => typeof val === 'string' || isBytes_(val),\n    isSafeInteger: (val) => Number.isSafeInteger(val),\n    array: (val) => Array.isArray(val),\n    field: (val, object) => object.Fp.isValid(val),\n    hash: (val) => typeof val === 'function' && Number.isSafeInteger(val.outputLen),\n};\n// type Record<K extends string | number | symbol, T> = { [P in K]: T; }\nexport function validateObject(object, validators, optValidators = {}) {\n    const checkField = (fieldName, type, isOptional) => {\n        const checkVal = validatorFns[type];\n        if (typeof checkVal !== 'function')\n            throw new Error('invalid validator function');\n        const val = object[fieldName];\n        if (isOptional && val === undefined)\n            return;\n        if (!checkVal(val, object)) {\n            throw new Error('param ' + String(fieldName) + ' is invalid. Expected ' + type + ', got ' + val);\n        }\n    };\n    for (const [fieldName, type] of Object.entries(validators))\n        checkField(fieldName, type, false);\n    for (const [fieldName, type] of Object.entries(optValidators))\n        checkField(fieldName, type, true);\n    return object;\n}\n// validate type tests\n// const o: { a: number; b: number; c: number } = { a: 1, b: 5, c: 6 };\n// const z0 = validateObject(o, { a: 'isSafeInteger' }, { c: 'bigint' }); // Ok!\n// // Should fail type-check\n// const z1 = validateObject(o, { a: 'tmp' }, { c: 'zz' });\n// const z2 = validateObject(o, { a: 'isSafeInteger' }, { c: 'zz' });\n// const z3 = validateObject(o, { test: 'boolean', z: 'bug' });\n// const z4 = validateObject(o, { a: 'boolean', z: 'bug' });\nexport function isHash(val) {\n    return typeof val === 'function' && Number.isSafeInteger(val.outputLen);\n}\nexport function _validateObject(object, fields, optFields = {}) {\n    if (!object || typeof object !== 'object')\n        throw new Error('expected valid options object');\n    function checkField(fieldName, expectedType, isOpt) {\n        const val = object[fieldName];\n        if (isOpt && val === undefined)\n            return;\n        const current = typeof val;\n        if (current !== expectedType || val === null)\n            throw new Error(`param \"${fieldName}\" is invalid: expected ${expectedType}, got ${current}`);\n    }\n    Object.entries(fields).forEach(([k, v]) => checkField(k, v, false));\n    Object.entries(optFields).forEach(([k, v]) => checkField(k, v, true));\n}\n/**\n * throws not implemented error\n */\nexport const notImplemented = () => {\n    throw new Error('not implemented');\n};\n/**\n * Memoizes (caches) computation result.\n * Uses WeakMap: the value is going auto-cleaned by GC after last reference is removed.\n */\nexport function memoized(fn) {\n    const map = new WeakMap();\n    return (arg, ...args) => {\n        const val = map.get(arg);\n        if (val !== undefined)\n            return val;\n        const computed = fn(arg, ...args);\n        map.set(arg, computed);\n        return computed;\n    };\n}\n//# sourceMappingURL=utils.js.map","/**\n * Utils for modular division and fields.\n * Field over 11 is a finite (Galois) field is integer number operations `mod 11`.\n * There is no division: it is replaced by modular multiplicative inverse.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { _validateObject, anumber, bitMask, bytesToNumberBE, bytesToNumberLE, ensureBytes, numberToBytesBE, numberToBytesLE, } from \"../utils.js\";\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _3n = /* @__PURE__ */ BigInt(3);\n// prettier-ignore\nconst _4n = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5), _7n = /* @__PURE__ */ BigInt(7);\n// prettier-ignore\nconst _8n = /* @__PURE__ */ BigInt(8), _9n = /* @__PURE__ */ BigInt(9), _16n = /* @__PURE__ */ BigInt(16);\n// Calculates a modulo b\nexport function mod(a, b) {\n    const result = a % b;\n    return result >= _0n ? result : b + result;\n}\n/**\n * Efficiently raise num to power and do modular division.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * @example\n * pow(2n, 6n, 11n) // 64n % 11n == 9n\n */\nexport function pow(num, power, modulo) {\n    return FpPow(Field(modulo), num, power);\n}\n/** Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)` */\nexport function pow2(x, power, modulo) {\n    let res = x;\n    while (power-- > _0n) {\n        res *= res;\n        res %= modulo;\n    }\n    return res;\n}\n/**\n * Inverses number over modulo.\n * Implemented using [Euclidean GCD](https://brilliant.org/wiki/extended-euclidean-algorithm/).\n */\nexport function invert(number, modulo) {\n    if (number === _0n)\n        throw new Error('invert: expected non-zero number');\n    if (modulo <= _0n)\n        throw new Error('invert: expected positive modulus, got ' + modulo);\n    // Fermat's little theorem \"CT-like\" version inv(n) = n^(m-2) mod m is 30x slower.\n    let a = mod(number, modulo);\n    let b = modulo;\n    // prettier-ignore\n    let x = _0n, y = _1n, u = _1n, v = _0n;\n    while (a !== _0n) {\n        // JIT applies optimization if those two lines follow each other\n        const q = b / a;\n        const r = b % a;\n        const m = x - u * q;\n        const n = y - v * q;\n        // prettier-ignore\n        b = a, a = r, x = u, y = v, u = m, v = n;\n    }\n    const gcd = b;\n    if (gcd !== _1n)\n        throw new Error('invert: does not exist');\n    return mod(x, modulo);\n}\nfunction assertIsSquare(Fp, root, n) {\n    if (!Fp.eql(Fp.sqr(root), n))\n        throw new Error('Cannot find square root');\n}\n// Not all roots are possible! Example which will throw:\n// const NUM =\n// n = 72057594037927816n;\n// Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'));\nfunction sqrt3mod4(Fp, n) {\n    const p1div4 = (Fp.ORDER + _1n) / _4n;\n    const root = Fp.pow(n, p1div4);\n    assertIsSquare(Fp, root, n);\n    return root;\n}\nfunction sqrt5mod8(Fp, n) {\n    const p5div8 = (Fp.ORDER - _5n) / _8n;\n    const n2 = Fp.mul(n, _2n);\n    const v = Fp.pow(n2, p5div8);\n    const nv = Fp.mul(n, v);\n    const i = Fp.mul(Fp.mul(nv, _2n), v);\n    const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));\n    assertIsSquare(Fp, root, n);\n    return root;\n}\n// Based on RFC9380, Kong algorithm\n// prettier-ignore\nfunction sqrt9mod16(P) {\n    const Fp_ = Field(P);\n    const tn = tonelliShanks(P);\n    const c1 = tn(Fp_, Fp_.neg(Fp_.ONE)); //  1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F\n    const c2 = tn(Fp_, c1); //  2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F\n    const c3 = tn(Fp_, Fp_.neg(c1)); //  3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F\n    const c4 = (P + _7n) / _16n; //  4. c4 = (q + 7) / 16        # Integer arithmetic\n    return (Fp, n) => {\n        let tv1 = Fp.pow(n, c4); //  1. tv1 = x^c4\n        let tv2 = Fp.mul(tv1, c1); //  2. tv2 = c1 * tv1\n        const tv3 = Fp.mul(tv1, c2); //  3. tv3 = c2 * tv1\n        const tv4 = Fp.mul(tv1, c3); //  4. tv4 = c3 * tv1\n        const e1 = Fp.eql(Fp.sqr(tv2), n); //  5.  e1 = (tv2^2) == x\n        const e2 = Fp.eql(Fp.sqr(tv3), n); //  6.  e2 = (tv3^2) == x\n        tv1 = Fp.cmov(tv1, tv2, e1); //  7. tv1 = CMOV(tv1, tv2, e1)  # Select tv2 if (tv2^2) == x\n        tv2 = Fp.cmov(tv4, tv3, e2); //  8. tv2 = CMOV(tv4, tv3, e2)  # Select tv3 if (tv3^2) == x\n        const e3 = Fp.eql(Fp.sqr(tv2), n); //  9.  e3 = (tv2^2) == x\n        const root = Fp.cmov(tv1, tv2, e3); // 10.  z = CMOV(tv1, tv2, e3)   # Select sqrt from tv1 & tv2\n        assertIsSquare(Fp, root, n);\n        return root;\n    };\n}\n/**\n * Tonelli-Shanks square root search algorithm.\n * 1. https://eprint.iacr.org/2012/685.pdf (page 12)\n * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks\n * @param P field order\n * @returns function that takes field Fp (created from P) and number n\n */\nexport function tonelliShanks(P) {\n    // Initialization (precomputation).\n    // Caching initialization could boost perf by 7%.\n    if (P < _3n)\n        throw new Error('sqrt is not defined for small field');\n    // Factor P - 1 = Q * 2^S, where Q is odd\n    let Q = P - _1n;\n    let S = 0;\n    while (Q % _2n === _0n) {\n        Q /= _2n;\n        S++;\n    }\n    // Find the first quadratic non-residue Z >= 2\n    let Z = _2n;\n    const _Fp = Field(P);\n    while (FpLegendre(_Fp, Z) === 1) {\n        // Basic primality test for P. After x iterations, chance of\n        // not finding quadratic non-residue is 2^x, so 2^1000.\n        if (Z++ > 1000)\n            throw new Error('Cannot find square root: probably non-prime P');\n    }\n    // Fast-path; usually done before Z, but we do \"primality test\".\n    if (S === 1)\n        return sqrt3mod4;\n    // Slow-path\n    // TODO: test on Fp2 and others\n    let cc = _Fp.pow(Z, Q); // c = z^Q\n    const Q1div2 = (Q + _1n) / _2n;\n    return function tonelliSlow(Fp, n) {\n        if (Fp.is0(n))\n            return n;\n        // Check if n is a quadratic residue using Legendre symbol\n        if (FpLegendre(Fp, n) !== 1)\n            throw new Error('Cannot find square root');\n        // Initialize variables for the main loop\n        let M = S;\n        let c = Fp.mul(Fp.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp\n        let t = Fp.pow(n, Q); // t = n^Q, first guess at the fudge factor\n        let R = Fp.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root\n        // Main loop\n        // while t != 1\n        while (!Fp.eql(t, Fp.ONE)) {\n            if (Fp.is0(t))\n                return Fp.ZERO; // if t=0 return R=0\n            let i = 1;\n            // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P)\n            let t_tmp = Fp.sqr(t); // t^(2^1)\n            while (!Fp.eql(t_tmp, Fp.ONE)) {\n                i++;\n                t_tmp = Fp.sqr(t_tmp); // t^(2^2)...\n                if (i === M)\n                    throw new Error('Cannot find square root');\n            }\n            // Calculate the exponent for b: 2^(M - i - 1)\n            const exponent = _1n << BigInt(M - i - 1); // bigint is important\n            const b = Fp.pow(c, exponent); // b = 2^(M - i - 1)\n            // Update variables\n            M = i;\n            c = Fp.sqr(b); // c = b^2\n            t = Fp.mul(t, c); // t = (t * b^2)\n            R = Fp.mul(R, b); // R = R*b\n        }\n        return R;\n    };\n}\n/**\n * Square root for a finite field. Will try optimized versions first:\n *\n * 1. P ≡ 3 (mod 4)\n * 2. P ≡ 5 (mod 8)\n * 3. P ≡ 9 (mod 16)\n * 4. Tonelli-Shanks algorithm\n *\n * Different algorithms can give different roots, it is up to user to decide which one they want.\n * For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).\n */\nexport function FpSqrt(P) {\n    // P ≡ 3 (mod 4) => √n = n^((P+1)/4)\n    if (P % _4n === _3n)\n        return sqrt3mod4;\n    // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf\n    if (P % _8n === _5n)\n        return sqrt5mod8;\n    // P ≡ 9 (mod 16) => Kong algorithm, page 11 of https://eprint.iacr.org/2012/685.pdf (algorithm 4)\n    if (P % _16n === _9n)\n        return sqrt9mod16(P);\n    // Tonelli-Shanks algorithm\n    return tonelliShanks(P);\n}\n// Little-endian check for first LE bit (last BE bit);\nexport const isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n) === _1n;\n// prettier-ignore\nconst FIELD_FIELDS = [\n    'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',\n    'eql', 'add', 'sub', 'mul', 'pow', 'div',\n    'addN', 'subN', 'mulN', 'sqrN'\n];\nexport function validateField(field) {\n    const initial = {\n        ORDER: 'bigint',\n        MASK: 'bigint',\n        BYTES: 'number',\n        BITS: 'number',\n    };\n    const opts = FIELD_FIELDS.reduce((map, val) => {\n        map[val] = 'function';\n        return map;\n    }, initial);\n    _validateObject(field, opts);\n    // const max = 16384;\n    // if (field.BYTES < 1 || field.BYTES > max) throw new Error('invalid field');\n    // if (field.BITS < 1 || field.BITS > 8 * max) throw new Error('invalid field');\n    return field;\n}\n// Generic field functions\n/**\n * Same as `pow` but for Fp: non-constant-time.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n */\nexport function FpPow(Fp, num, power) {\n    if (power < _0n)\n        throw new Error('invalid exponent, negatives unsupported');\n    if (power === _0n)\n        return Fp.ONE;\n    if (power === _1n)\n        return num;\n    let p = Fp.ONE;\n    let d = num;\n    while (power > _0n) {\n        if (power & _1n)\n            p = Fp.mul(p, d);\n        d = Fp.sqr(d);\n        power >>= _1n;\n    }\n    return p;\n}\n/**\n * Efficiently invert an array of Field elements.\n * Exception-free. Will return `undefined` for 0 elements.\n * @param passZero map 0 to 0 (instead of undefined)\n */\nexport function FpInvertBatch(Fp, nums, passZero = false) {\n    const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : undefined);\n    // Walk from first to last, multiply them by each other MOD p\n    const multipliedAcc = nums.reduce((acc, num, i) => {\n        if (Fp.is0(num))\n            return acc;\n        inverted[i] = acc;\n        return Fp.mul(acc, num);\n    }, Fp.ONE);\n    // Invert last element\n    const invertedAcc = Fp.inv(multipliedAcc);\n    // Walk from last to first, multiply them by inverted each other MOD p\n    nums.reduceRight((acc, num, i) => {\n        if (Fp.is0(num))\n            return acc;\n        inverted[i] = Fp.mul(acc, inverted[i]);\n        return Fp.mul(acc, num);\n    }, invertedAcc);\n    return inverted;\n}\n// TODO: remove\nexport function FpDiv(Fp, lhs, rhs) {\n    return Fp.mul(lhs, typeof rhs === 'bigint' ? invert(rhs, Fp.ORDER) : Fp.inv(rhs));\n}\n/**\n * Legendre symbol.\n * Legendre constant is used to calculate Legendre symbol (a | p)\n * which denotes the value of a^((p-1)/2) (mod p).\n *\n * * (a | p) ≡ 1    if a is a square (mod p), quadratic residue\n * * (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue\n * * (a | p) ≡ 0    if a ≡ 0 (mod p)\n */\nexport function FpLegendre(Fp, n) {\n    // We can use 3rd argument as optional cache of this value\n    // but seems unneeded for now. The operation is very fast.\n    const p1mod2 = (Fp.ORDER - _1n) / _2n;\n    const powered = Fp.pow(n, p1mod2);\n    const yes = Fp.eql(powered, Fp.ONE);\n    const zero = Fp.eql(powered, Fp.ZERO);\n    const no = Fp.eql(powered, Fp.neg(Fp.ONE));\n    if (!yes && !zero && !no)\n        throw new Error('invalid Legendre symbol result');\n    return yes ? 1 : zero ? 0 : -1;\n}\n// This function returns True whenever the value x is a square in the field F.\nexport function FpIsSquare(Fp, n) {\n    const l = FpLegendre(Fp, n);\n    return l === 1;\n}\n// CURVE.n lengths\nexport function nLength(n, nBitLength) {\n    // Bit size, byte size of CURVE.n\n    if (nBitLength !== undefined)\n        anumber(nBitLength);\n    const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length;\n    const nByteLength = Math.ceil(_nBitLength / 8);\n    return { nBitLength: _nBitLength, nByteLength };\n}\n/**\n * Creates a finite field. Major performance optimizations:\n * * 1. Denormalized operations like mulN instead of mul.\n * * 2. Identical object shape: never add or remove keys.\n * * 3. `Object.freeze`.\n * Fragile: always run a benchmark on a change.\n * Security note: operations don't check 'isValid' for all elements for performance reasons,\n * it is caller responsibility to check this.\n * This is low-level code, please make sure you know what you're doing.\n *\n * Note about field properties:\n * * CHARACTERISTIC p = prime number, number of elements in main subgroup.\n * * ORDER q = similar to cofactor in curves, may be composite `q = p^m`.\n *\n * @param ORDER field order, probably prime, or could be composite\n * @param bitLen how many bits the field consumes\n * @param isLE (default: false) if encoding / decoding should be in little-endian\n * @param redef optional faster redefinitions of sqrt and other methods\n */\nexport function Field(ORDER, bitLenOrOpts, // TODO: use opts only in v2?\nisLE = false, opts = {}) {\n    if (ORDER <= _0n)\n        throw new Error('invalid field: expected ORDER > 0, got ' + ORDER);\n    let _nbitLength = undefined;\n    let _sqrt = undefined;\n    let modFromBytes = false;\n    let allowedLengths = undefined;\n    if (typeof bitLenOrOpts === 'object' && bitLenOrOpts != null) {\n        if (opts.sqrt || isLE)\n            throw new Error('cannot specify opts in two arguments');\n        const _opts = bitLenOrOpts;\n        if (_opts.BITS)\n            _nbitLength = _opts.BITS;\n        if (_opts.sqrt)\n            _sqrt = _opts.sqrt;\n        if (typeof _opts.isLE === 'boolean')\n            isLE = _opts.isLE;\n        if (typeof _opts.modFromBytes === 'boolean')\n            modFromBytes = _opts.modFromBytes;\n        allowedLengths = _opts.allowedLengths;\n    }\n    else {\n        if (typeof bitLenOrOpts === 'number')\n            _nbitLength = bitLenOrOpts;\n        if (opts.sqrt)\n            _sqrt = opts.sqrt;\n    }\n    const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, _nbitLength);\n    if (BYTES > 2048)\n        throw new Error('invalid field: expected ORDER of <= 2048 bytes');\n    let sqrtP; // cached sqrtP\n    const f = Object.freeze({\n        ORDER,\n        isLE,\n        BITS,\n        BYTES,\n        MASK: bitMask(BITS),\n        ZERO: _0n,\n        ONE: _1n,\n        allowedLengths: allowedLengths,\n        create: (num) => mod(num, ORDER),\n        isValid: (num) => {\n            if (typeof num !== 'bigint')\n                throw new Error('invalid field element: expected bigint, got ' + typeof num);\n            return _0n <= num && num < ORDER; // 0 is valid element, but it's not invertible\n        },\n        is0: (num) => num === _0n,\n        // is valid and invertible\n        isValidNot0: (num) => !f.is0(num) && f.isValid(num),\n        isOdd: (num) => (num & _1n) === _1n,\n        neg: (num) => mod(-num, ORDER),\n        eql: (lhs, rhs) => lhs === rhs,\n        sqr: (num) => mod(num * num, ORDER),\n        add: (lhs, rhs) => mod(lhs + rhs, ORDER),\n        sub: (lhs, rhs) => mod(lhs - rhs, ORDER),\n        mul: (lhs, rhs) => mod(lhs * rhs, ORDER),\n        pow: (num, power) => FpPow(f, num, power),\n        div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),\n        // Same as above, but doesn't normalize\n        sqrN: (num) => num * num,\n        addN: (lhs, rhs) => lhs + rhs,\n        subN: (lhs, rhs) => lhs - rhs,\n        mulN: (lhs, rhs) => lhs * rhs,\n        inv: (num) => invert(num, ORDER),\n        sqrt: _sqrt ||\n            ((n) => {\n                if (!sqrtP)\n                    sqrtP = FpSqrt(ORDER);\n                return sqrtP(f, n);\n            }),\n        toBytes: (num) => (isLE ? numberToBytesLE(num, BYTES) : numberToBytesBE(num, BYTES)),\n        fromBytes: (bytes, skipValidation = true) => {\n            if (allowedLengths) {\n                if (!allowedLengths.includes(bytes.length) || bytes.length > BYTES) {\n                    throw new Error('Field.fromBytes: expected ' + allowedLengths + ' bytes, got ' + bytes.length);\n                }\n                const padded = new Uint8Array(BYTES);\n                // isLE add 0 to right, !isLE to the left.\n                padded.set(bytes, isLE ? 0 : padded.length - bytes.length);\n                bytes = padded;\n            }\n            if (bytes.length !== BYTES)\n                throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);\n            let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n            if (modFromBytes)\n                scalar = mod(scalar, ORDER);\n            if (!skipValidation)\n                if (!f.isValid(scalar))\n                    throw new Error('invalid field element: outside of range 0..ORDER');\n            // NOTE: we don't validate scalar here, please use isValid. This done such way because some\n            // protocol may allow non-reduced scalar that reduced later or changed some other way.\n            return scalar;\n        },\n        // TODO: we don't need it here, move out to separate fn\n        invertBatch: (lst) => FpInvertBatch(f, lst),\n        // We can't move this out because Fp6, Fp12 implement it\n        // and it's unclear what to return in there.\n        cmov: (a, b, c) => (c ? b : a),\n    });\n    return Object.freeze(f);\n}\n// Generic random scalar, we can do same for other fields if via Fp2.mul(Fp2.ONE, Fp2.random)?\n// This allows unsafe methods like ignore bias or zero. These unsafe, but often used in different protocols (if deterministic RNG).\n// which mean we cannot force this via opts.\n// Not sure what to do with randomBytes, we can accept it inside opts if wanted.\n// Probably need to export getMinHashLength somewhere?\n// random(bytes?: Uint8Array, unsafeAllowZero = false, unsafeAllowBias = false) {\n//   const LEN = !unsafeAllowBias ? getMinHashLength(ORDER) : BYTES;\n//   if (bytes === undefined) bytes = randomBytes(LEN); // _opts.randomBytes?\n//   const num = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n//   // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n//   const reduced = unsafeAllowZero ? mod(num, ORDER) : mod(num, ORDER - _1n) + _1n;\n//   return reduced;\n// },\nexport function FpSqrtOdd(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? root : Fp.neg(root);\n}\nexport function FpSqrtEven(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? Fp.neg(root) : root;\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Same as mapKeyToField, but accepts less bytes (40 instead of 48 for 32-byte field).\n * Which makes it slightly more biased, less secure.\n * @deprecated use `mapKeyToField` instead\n */\nexport function hashToPrivateScalar(hash, groupOrder, isLE = false) {\n    hash = ensureBytes('privateHash', hash);\n    const hashLen = hash.length;\n    const minLen = nLength(groupOrder).nByteLength + 8;\n    if (minLen < 24 || hashLen < minLen || hashLen > 1024)\n        throw new Error('hashToPrivateScalar: expected ' + minLen + '-1024 bytes of input, got ' + hashLen);\n    const num = isLE ? bytesToNumberLE(hash) : bytesToNumberBE(hash);\n    return mod(num, groupOrder - _1n) + _1n;\n}\n/**\n * Returns total number of bytes consumed by the field element.\n * For example, 32 bytes for usual 256-bit weierstrass curve.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of field\n */\nexport function getFieldBytesLength(fieldOrder) {\n    if (typeof fieldOrder !== 'bigint')\n        throw new Error('field order must be bigint');\n    const bitLength = fieldOrder.toString(2).length;\n    return Math.ceil(bitLength / 8);\n}\n/**\n * Returns minimal amount of bytes that can be safely reduced\n * by field order.\n * Should be 2^-128 for 128-bit curve such as P256.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of target hash\n */\nexport function getMinHashLength(fieldOrder) {\n    const length = getFieldBytesLength(fieldOrder);\n    return length + Math.ceil(length / 2);\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF\n * and convert them into private scalar, with the modulo bias being negligible.\n * Needs at least 48 bytes of input for 32-byte private key.\n * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/\n * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final\n * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5\n * @param hash hash output from SHA3 or a similar function\n * @param groupOrder size of subgroup - (e.g. secp256k1.CURVE.n)\n * @param isLE interpret hash bytes as LE num\n * @returns valid private scalar\n */\nexport function mapHashToField(key, fieldOrder, isLE = false) {\n    const len = key.length;\n    const fieldLen = getFieldBytesLength(fieldOrder);\n    const minLen = getMinHashLength(fieldOrder);\n    // No small numbers: need to understand bias story. No huge numbers: easier to detect JS timings.\n    if (len < 16 || len < minLen || len > 1024)\n        throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);\n    const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);\n    // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n    const reduced = mod(num, fieldOrder - _1n) + _1n;\n    return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);\n}\n//# sourceMappingURL=modular.js.map","/**\n * HMAC: RFC2104 message authentication code.\n * @module\n */\nimport { abytes, aexists, ahash, clean, Hash, toBytes } from \"./utils.js\";\nexport class HMAC extends Hash {\n    constructor(hash, _key) {\n        super();\n        this.finished = false;\n        this.destroyed = false;\n        ahash(hash);\n        const key = toBytes(_key);\n        this.iHash = hash.create();\n        if (typeof this.iHash.update !== 'function')\n            throw new Error('Expected instance of class which extends utils.Hash');\n        this.blockLen = this.iHash.blockLen;\n        this.outputLen = this.iHash.outputLen;\n        const blockLen = this.blockLen;\n        const pad = new Uint8Array(blockLen);\n        // blockLen can be bigger than outputLen\n        pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36;\n        this.iHash.update(pad);\n        // By doing update (processing of first block) of outer hash here we can re-use it between multiple calls via clone\n        this.oHash = hash.create();\n        // Undo internal XOR && apply outer XOR\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36 ^ 0x5c;\n        this.oHash.update(pad);\n        clean(pad);\n    }\n    update(buf) {\n        aexists(this);\n        this.iHash.update(buf);\n        return this;\n    }\n    digestInto(out) {\n        aexists(this);\n        abytes(out, this.outputLen);\n        this.finished = true;\n        this.iHash.digestInto(out);\n        this.oHash.update(out);\n        this.oHash.digestInto(out);\n        this.destroy();\n    }\n    digest() {\n        const out = new Uint8Array(this.oHash.outputLen);\n        this.digestInto(out);\n        return out;\n    }\n    _cloneInto(to) {\n        // Create new instance without calling constructor since key already in state and we don't know it.\n        to || (to = Object.create(Object.getPrototypeOf(this), {}));\n        const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;\n        to = to;\n        to.finished = finished;\n        to.destroyed = destroyed;\n        to.blockLen = blockLen;\n        to.outputLen = outputLen;\n        to.oHash = oHash._cloneInto(to.oHash);\n        to.iHash = iHash._cloneInto(to.iHash);\n        return to;\n    }\n    clone() {\n        return this._cloneInto();\n    }\n    destroy() {\n        this.destroyed = true;\n        this.oHash.destroy();\n        this.iHash.destroy();\n    }\n}\n/**\n * HMAC: RFC2104 message authentication code.\n * @param hash - function that would be used e.g. sha256\n * @param key - message key\n * @param message - message data\n * @example\n * import { hmac } from '@noble/hashes/hmac';\n * import { sha256 } from '@noble/hashes/sha2';\n * const mac1 = hmac(sha256, 'key', 'message');\n */\nexport const hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();\nhmac.create = (hash, key) => new HMAC(hash, key);\n//# sourceMappingURL=hmac.js.map","/**\n * Methods for elliptic curve multiplication by scalars.\n * Contains wNAF, pippenger.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { bitLen, bitMask, validateObject } from \"../utils.js\";\nimport { Field, FpInvertBatch, nLength, validateField } from \"./modular.js\";\nconst _0n = BigInt(0);\nconst _1n = BigInt(1);\nexport function negateCt(condition, item) {\n    const neg = item.negate();\n    return condition ? neg : item;\n}\n/**\n * Takes a bunch of Projective Points but executes only one\n * inversion on all of them. Inversion is very slow operation,\n * so this improves performance massively.\n * Optimization: converts a list of projective points to a list of identical points with Z=1.\n */\nexport function normalizeZ(c, points) {\n    const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));\n    return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));\n}\nfunction validateW(W, bits) {\n    if (!Number.isSafeInteger(W) || W <= 0 || W > bits)\n        throw new Error('invalid window size, expected [1..' + bits + '], got W=' + W);\n}\nfunction calcWOpts(W, scalarBits) {\n    validateW(W, scalarBits);\n    const windows = Math.ceil(scalarBits / W) + 1; // W=8 33. Not 32, because we skip zero\n    const windowSize = 2 ** (W - 1); // W=8 128. Not 256, because we skip zero\n    const maxNumber = 2 ** W; // W=8 256\n    const mask = bitMask(W); // W=8 255 == mask 0b11111111\n    const shiftBy = BigInt(W); // W=8 8\n    return { windows, windowSize, mask, maxNumber, shiftBy };\n}\nfunction calcOffsets(n, window, wOpts) {\n    const { windowSize, mask, maxNumber, shiftBy } = wOpts;\n    let wbits = Number(n & mask); // extract W bits.\n    let nextN = n >> shiftBy; // shift number by W bits.\n    // What actually happens here:\n    // const highestBit = Number(mask ^ (mask >> 1n));\n    // let wbits2 = wbits - 1; // skip zero\n    // if (wbits2 & highestBit) { wbits2 ^= Number(mask); // (~);\n    // split if bits > max: +224 => 256-32\n    if (wbits > windowSize) {\n        // we skip zero, which means instead of `>= size-1`, we do `> size`\n        wbits -= maxNumber; // -32, can be maxNumber - wbits, but then we need to set isNeg here.\n        nextN += _1n; // +256 (carry)\n    }\n    const offsetStart = window * windowSize;\n    const offset = offsetStart + Math.abs(wbits) - 1; // -1 because we skip zero\n    const isZero = wbits === 0; // is current window slice a 0?\n    const isNeg = wbits < 0; // is current window slice negative?\n    const isNegF = window % 2 !== 0; // fake random statement for noise\n    const offsetF = offsetStart; // fake offset for noise\n    return { nextN, offset, isZero, isNeg, isNegF, offsetF };\n}\nfunction validateMSMPoints(points, c) {\n    if (!Array.isArray(points))\n        throw new Error('array expected');\n    points.forEach((p, i) => {\n        if (!(p instanceof c))\n            throw new Error('invalid point at index ' + i);\n    });\n}\nfunction validateMSMScalars(scalars, field) {\n    if (!Array.isArray(scalars))\n        throw new Error('array of scalars expected');\n    scalars.forEach((s, i) => {\n        if (!field.isValid(s))\n            throw new Error('invalid scalar at index ' + i);\n    });\n}\n// Since points in different groups cannot be equal (different object constructor),\n// we can have single place to store precomputes.\n// Allows to make points frozen / immutable.\nconst pointPrecomputes = new WeakMap();\nconst pointWindowSizes = new WeakMap();\nfunction getW(P) {\n    // To disable precomputes:\n    // return 1;\n    return pointWindowSizes.get(P) || 1;\n}\nfunction assert0(n) {\n    if (n !== _0n)\n        throw new Error('invalid wNAF');\n}\n/**\n * Elliptic curve multiplication of Point by scalar. Fragile.\n * Table generation takes **30MB of ram and 10ms on high-end CPU**,\n * but may take much longer on slow devices. Actual generation will happen on\n * first call of `multiply()`. By default, `BASE` point is precomputed.\n *\n * Scalars should always be less than curve order: this should be checked inside of a curve itself.\n * Creates precomputation tables for fast multiplication:\n * - private scalar is split by fixed size windows of W bits\n * - every window point is collected from window's table & added to accumulator\n * - since windows are different, same point inside tables won't be accessed more than once per calc\n * - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)\n * - +1 window is neccessary for wNAF\n * - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication\n *\n * @todo Research returning 2d JS array of windows, instead of a single window.\n * This would allow windows to be in different memory locations\n */\nexport class wNAF {\n    // Parametrized with a given Point class (not individual point)\n    constructor(Point, bits) {\n        this.BASE = Point.BASE;\n        this.ZERO = Point.ZERO;\n        this.Fn = Point.Fn;\n        this.bits = bits;\n    }\n    // non-const time multiplication ladder\n    _unsafeLadder(elm, n, p = this.ZERO) {\n        let d = elm;\n        while (n > _0n) {\n            if (n & _1n)\n                p = p.add(d);\n            d = d.double();\n            n >>= _1n;\n        }\n        return p;\n    }\n    /**\n     * Creates a wNAF precomputation window. Used for caching.\n     * Default window size is set by `utils.precompute()` and is equal to 8.\n     * Number of precomputed points depends on the curve size:\n     * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:\n     * - 𝑊 is the window size\n     * - 𝑛 is the bitlength of the curve order.\n     * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.\n     * @param point Point instance\n     * @param W window size\n     * @returns precomputed point tables flattened to a single array\n     */\n    precomputeWindow(point, W) {\n        const { windows, windowSize } = calcWOpts(W, this.bits);\n        const points = [];\n        let p = point;\n        let base = p;\n        for (let window = 0; window < windows; window++) {\n            base = p;\n            points.push(base);\n            // i=1, bc we skip 0\n            for (let i = 1; i < windowSize; i++) {\n                base = base.add(p);\n                points.push(base);\n            }\n            p = base.double();\n        }\n        return points;\n    }\n    /**\n     * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.\n     * More compact implementation:\n     * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541\n     * @returns real and fake (for const-time) points\n     */\n    wNAF(W, precomputes, n) {\n        // Scalar should be smaller than field order\n        if (!this.Fn.isValid(n))\n            throw new Error('invalid scalar');\n        // Accumulators\n        let p = this.ZERO;\n        let f = this.BASE;\n        // This code was first written with assumption that 'f' and 'p' will never be infinity point:\n        // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,\n        // there is negate now: it is possible that negated element from low value\n        // would be the same as high element, which will create carry into next window.\n        // It's not obvious how this can fail, but still worth investigating later.\n        const wo = calcWOpts(W, this.bits);\n        for (let window = 0; window < wo.windows; window++) {\n            // (n === _0n) is handled and not early-exited. isEven and offsetF are used for noise\n            const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);\n            n = nextN;\n            if (isZero) {\n                // bits are 0: add garbage to fake point\n                // Important part for const-time getPublicKey: add random \"noise\" point to f.\n                f = f.add(negateCt(isNegF, precomputes[offsetF]));\n            }\n            else {\n                // bits are 1: add to result point\n                p = p.add(negateCt(isNeg, precomputes[offset]));\n            }\n        }\n        assert0(n);\n        // Return both real and fake points: JIT won't eliminate f.\n        // At this point there is a way to F be infinity-point even if p is not,\n        // which makes it less const-time: around 1 bigint multiply.\n        return { p, f };\n    }\n    /**\n     * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.\n     * @param acc accumulator point to add result of multiplication\n     * @returns point\n     */\n    wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {\n        const wo = calcWOpts(W, this.bits);\n        for (let window = 0; window < wo.windows; window++) {\n            if (n === _0n)\n                break; // Early-exit, skip 0 value\n            const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);\n            n = nextN;\n            if (isZero) {\n                // Window bits are 0: skip processing.\n                // Move to next window.\n                continue;\n            }\n            else {\n                const item = precomputes[offset];\n                acc = acc.add(isNeg ? item.negate() : item); // Re-using acc allows to save adds in MSM\n            }\n        }\n        assert0(n);\n        return acc;\n    }\n    getPrecomputes(W, point, transform) {\n        // Calculate precomputes on a first run, reuse them after\n        let comp = pointPrecomputes.get(point);\n        if (!comp) {\n            comp = this.precomputeWindow(point, W);\n            if (W !== 1) {\n                // Doing transform outside of if brings 15% perf hit\n                if (typeof transform === 'function')\n                    comp = transform(comp);\n                pointPrecomputes.set(point, comp);\n            }\n        }\n        return comp;\n    }\n    cached(point, scalar, transform) {\n        const W = getW(point);\n        return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);\n    }\n    unsafe(point, scalar, transform, prev) {\n        const W = getW(point);\n        if (W === 1)\n            return this._unsafeLadder(point, scalar, prev); // For W=1 ladder is ~x2 faster\n        return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);\n    }\n    // We calculate precomputes for elliptic curve point multiplication\n    // using windowed method. This specifies window size and\n    // stores precomputed values. Usually only base point would be precomputed.\n    createCache(P, W) {\n        validateW(W, this.bits);\n        pointWindowSizes.set(P, W);\n        pointPrecomputes.delete(P);\n    }\n    hasCache(elm) {\n        return getW(elm) !== 1;\n    }\n}\n/**\n * Endomorphism-specific multiplication for Koblitz curves.\n * Cost: 128 dbl, 0-256 adds.\n */\nexport function mulEndoUnsafe(Point, point, k1, k2) {\n    let acc = point;\n    let p1 = Point.ZERO;\n    let p2 = Point.ZERO;\n    while (k1 > _0n || k2 > _0n) {\n        if (k1 & _1n)\n            p1 = p1.add(acc);\n        if (k2 & _1n)\n            p2 = p2.add(acc);\n        acc = acc.double();\n        k1 >>= _1n;\n        k2 >>= _1n;\n    }\n    return { p1, p2 };\n}\n/**\n * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * 30x faster vs naive addition on L=4096, 10x faster than precomputes.\n * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.\n * Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.\n * @param c Curve Point constructor\n * @param fieldN field over CURVE.N - important that it's not over CURVE.P\n * @param points array of L curve points\n * @param scalars array of L scalars (aka secret keys / bigints)\n */\nexport function pippenger(c, fieldN, points, scalars) {\n    // If we split scalars by some window (let's say 8 bits), every chunk will only\n    // take 256 buckets even if there are 4096 scalars, also re-uses double.\n    // TODO:\n    // - https://eprint.iacr.org/2024/750.pdf\n    // - https://tches.iacr.org/index.php/TCHES/article/view/10287\n    // 0 is accepted in scalars\n    validateMSMPoints(points, c);\n    validateMSMScalars(scalars, fieldN);\n    const plength = points.length;\n    const slength = scalars.length;\n    if (plength !== slength)\n        throw new Error('arrays of points and scalars must have equal length');\n    // if (plength === 0) throw new Error('array must be of length >= 2');\n    const zero = c.ZERO;\n    const wbits = bitLen(BigInt(plength));\n    let windowSize = 1; // bits\n    if (wbits > 12)\n        windowSize = wbits - 3;\n    else if (wbits > 4)\n        windowSize = wbits - 2;\n    else if (wbits > 0)\n        windowSize = 2;\n    const MASK = bitMask(windowSize);\n    const buckets = new Array(Number(MASK) + 1).fill(zero); // +1 for zero array\n    const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;\n    let sum = zero;\n    for (let i = lastBits; i >= 0; i -= windowSize) {\n        buckets.fill(zero);\n        for (let j = 0; j < slength; j++) {\n            const scalar = scalars[j];\n            const wbits = Number((scalar >> BigInt(i)) & MASK);\n            buckets[wbits] = buckets[wbits].add(points[j]);\n        }\n        let resI = zero; // not using this will do small speed-up, but will lose ct\n        // Skip first bucket, because it is zero\n        for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {\n            sumI = sumI.add(buckets[j]);\n            resI = resI.add(sumI);\n        }\n        sum = sum.add(resI);\n        if (i !== 0)\n            for (let j = 0; j < windowSize; j++)\n                sum = sum.double();\n    }\n    return sum;\n}\n/**\n * Precomputed multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * @param c Curve Point constructor\n * @param fieldN field over CURVE.N - important that it's not over CURVE.P\n * @param points array of L curve points\n * @returns function which multiplies points with scaars\n */\nexport function precomputeMSMUnsafe(c, fieldN, points, windowSize) {\n    /**\n     * Performance Analysis of Window-based Precomputation\n     *\n     * Base Case (256-bit scalar, 8-bit window):\n     * - Standard precomputation requires:\n     *   - 31 additions per scalar × 256 scalars = 7,936 ops\n     *   - Plus 255 summary additions = 8,191 total ops\n     *   Note: Summary additions can be optimized via accumulator\n     *\n     * Chunked Precomputation Analysis:\n     * - Using 32 chunks requires:\n     *   - 255 additions per chunk\n     *   - 256 doublings\n     *   - Total: (255 × 32) + 256 = 8,416 ops\n     *\n     * Memory Usage Comparison:\n     * Window Size | Standard Points | Chunked Points\n     * ------------|-----------------|---------------\n     *     4-bit   |     520         |      15\n     *     8-bit   |    4,224        |     255\n     *    10-bit   |   13,824        |   1,023\n     *    16-bit   |  557,056        |  65,535\n     *\n     * Key Advantages:\n     * 1. Enables larger window sizes due to reduced memory overhead\n     * 2. More efficient for smaller scalar counts:\n     *    - 16 chunks: (16 × 255) + 256 = 4,336 ops\n     *    - ~2x faster than standard 8,191 ops\n     *\n     * Limitations:\n     * - Not suitable for plain precomputes (requires 256 constant doublings)\n     * - Performance degrades with larger scalar counts:\n     *   - Optimal for ~256 scalars\n     *   - Less efficient for 4096+ scalars (Pippenger preferred)\n     */\n    validateW(windowSize, fieldN.BITS);\n    validateMSMPoints(points, c);\n    const zero = c.ZERO;\n    const tableSize = 2 ** windowSize - 1; // table size (without zero)\n    const chunks = Math.ceil(fieldN.BITS / windowSize); // chunks of item\n    const MASK = bitMask(windowSize);\n    const tables = points.map((p) => {\n        const res = [];\n        for (let i = 0, acc = p; i < tableSize; i++) {\n            res.push(acc);\n            acc = acc.add(p);\n        }\n        return res;\n    });\n    return (scalars) => {\n        validateMSMScalars(scalars, fieldN);\n        if (scalars.length > points.length)\n            throw new Error('array of scalars must be smaller than array of points');\n        let res = zero;\n        for (let i = 0; i < chunks; i++) {\n            // No need to double if accumulator is still zero.\n            if (res !== zero)\n                for (let j = 0; j < windowSize; j++)\n                    res = res.double();\n            const shiftBy = BigInt(chunks * windowSize - (i + 1) * windowSize);\n            for (let j = 0; j < scalars.length; j++) {\n                const n = scalars[j];\n                const curr = Number((n >> shiftBy) & MASK);\n                if (!curr)\n                    continue; // skip zero scalars chunks\n                res = res.add(tables[j][curr - 1]);\n            }\n        }\n        return res;\n    };\n}\n// TODO: remove\n/** @deprecated */\nexport function validateBasic(curve) {\n    validateField(curve.Fp);\n    validateObject(curve, {\n        n: 'bigint',\n        h: 'bigint',\n        Gx: 'field',\n        Gy: 'field',\n    }, {\n        nBitLength: 'isSafeInteger',\n        nByteLength: 'isSafeInteger',\n    });\n    // Set defaults\n    return Object.freeze({\n        ...nLength(curve.n, curve.nBitLength),\n        ...curve,\n        ...{ p: curve.Fp.ORDER },\n    });\n}\nfunction createField(order, field, isLE) {\n    if (field) {\n        if (field.ORDER !== order)\n            throw new Error('Field.ORDER must match order: Fp == p, Fn == n');\n        validateField(field);\n        return field;\n    }\n    else {\n        return Field(order, { isLE });\n    }\n}\n/** Validates CURVE opts and creates fields */\nexport function _createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {\n    if (FpFnLE === undefined)\n        FpFnLE = type === 'edwards';\n    if (!CURVE || typeof CURVE !== 'object')\n        throw new Error(`expected valid ${type} CURVE object`);\n    for (const p of ['p', 'n', 'h']) {\n        const val = CURVE[p];\n        if (!(typeof val === 'bigint' && val > _0n))\n            throw new Error(`CURVE.${p} must be positive bigint`);\n    }\n    const Fp = createField(CURVE.p, curveOpts.Fp, FpFnLE);\n    const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);\n    const _b = type === 'weierstrass' ? 'b' : 'd';\n    const params = ['Gx', 'Gy', 'a', _b];\n    for (const p of params) {\n        // @ts-ignore\n        if (!Fp.isValid(CURVE[p]))\n            throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);\n    }\n    CURVE = Object.freeze(Object.assign({}, CURVE));\n    return { CURVE, Fp, Fn };\n}\n//# sourceMappingURL=curve.js.map","/**\n * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.\n *\n * ### Design rationale for types\n *\n * * Interaction between classes from different curves should fail:\n *   `k256.Point.BASE.add(p256.Point.BASE)`\n * * For this purpose we want to use `instanceof` operator, which is fast and works during runtime\n * * Different calls of `curve()` would return different classes -\n *   `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,\n *   it won't affect others\n *\n * TypeScript can't infer types for classes created inside a function. Classes is one instance\n * of nominative types in TypeScript and interfaces only check for shape, so it's hard to create\n * unique type for every function call.\n *\n * We can use generic types via some param, like curve opts, but that would:\n *     1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)\n *     which is hard to debug.\n *     2. Params can be generic and we can't enforce them to be constant value:\n *     if somebody creates curve from non-constant params,\n *     it would be allowed to interact with other curves with non-constant params\n *\n * @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { hmac as nobleHmac } from '@noble/hashes/hmac.js';\nimport { ahash } from '@noble/hashes/utils';\nimport { _validateObject, _abool2 as abool, _abytes2 as abytes, aInRange, bitLen, bitMask, bytesToHex, bytesToNumberBE, concatBytes, createHmacDrbg, ensureBytes, hexToBytes, inRange, isBytes, memoized, numberToHexUnpadded, randomBytes as randomBytesWeb, } from \"../utils.js\";\nimport { _createCurveFields, mulEndoUnsafe, negateCt, normalizeZ, pippenger, wNAF, } from \"./curve.js\";\nimport { Field, FpInvertBatch, getMinHashLength, mapHashToField, nLength, validateField, } from \"./modular.js\";\n// We construct basis in such way that den is always positive and equals n, but num sign depends on basis (not on secret value)\nconst divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n) / den;\n/**\n * Splits scalar for GLV endomorphism.\n */\nexport function _splitEndoScalar(k, basis, n) {\n    // Split scalar into two such that part is ~half bits: `abs(part) < sqrt(N)`\n    // Since part can be negative, we need to do this on point.\n    // TODO: verifyScalar function which consumes lambda\n    const [[a1, b1], [a2, b2]] = basis;\n    const c1 = divNearest(b2 * k, n);\n    const c2 = divNearest(-b1 * k, n);\n    // |k1|/|k2| is < sqrt(N), but can be negative.\n    // If we do `k1 mod N`, we'll get big scalar (`> sqrt(N)`): so, we do cheaper negation instead.\n    let k1 = k - c1 * a1 - c2 * a2;\n    let k2 = -c1 * b1 - c2 * b2;\n    const k1neg = k1 < _0n;\n    const k2neg = k2 < _0n;\n    if (k1neg)\n        k1 = -k1;\n    if (k2neg)\n        k2 = -k2;\n    // Double check that resulting scalar less than half bits of N: otherwise wNAF will fail.\n    // This should only happen on wrong basises. Also, math inside is too complex and I don't trust it.\n    const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n; // Half bits of N\n    if (k1 < _0n || k1 >= MAX_NUM || k2 < _0n || k2 >= MAX_NUM) {\n        throw new Error('splitScalar (endomorphism): failed, k=' + k);\n    }\n    return { k1neg, k1, k2neg, k2 };\n}\nfunction validateSigFormat(format) {\n    if (!['compact', 'recovered', 'der'].includes(format))\n        throw new Error('Signature format must be \"compact\", \"recovered\", or \"der\"');\n    return format;\n}\nfunction validateSigOpts(opts, def) {\n    const optsn = {};\n    for (let optName of Object.keys(def)) {\n        // @ts-ignore\n        optsn[optName] = opts[optName] === undefined ? def[optName] : opts[optName];\n    }\n    abool(optsn.lowS, 'lowS');\n    abool(optsn.prehash, 'prehash');\n    if (optsn.format !== undefined)\n        validateSigFormat(optsn.format);\n    return optsn;\n}\nexport class DERErr extends Error {\n    constructor(m = '') {\n        super(m);\n    }\n}\n/**\n * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:\n *\n *     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]\n *\n * Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html\n */\nexport const DER = {\n    // asn.1 DER encoding utils\n    Err: DERErr,\n    // Basic building block is TLV (Tag-Length-Value)\n    _tlv: {\n        encode: (tag, data) => {\n            const { Err: E } = DER;\n            if (tag < 0 || tag > 256)\n                throw new E('tlv.encode: wrong tag');\n            if (data.length & 1)\n                throw new E('tlv.encode: unpadded data');\n            const dataLen = data.length / 2;\n            const len = numberToHexUnpadded(dataLen);\n            if ((len.length / 2) & 128)\n                throw new E('tlv.encode: long form length too big');\n            // length of length with long form flag\n            const lenLen = dataLen > 127 ? numberToHexUnpadded((len.length / 2) | 128) : '';\n            const t = numberToHexUnpadded(tag);\n            return t + lenLen + len + data;\n        },\n        // v - value, l - left bytes (unparsed)\n        decode(tag, data) {\n            const { Err: E } = DER;\n            let pos = 0;\n            if (tag < 0 || tag > 256)\n                throw new E('tlv.encode: wrong tag');\n            if (data.length < 2 || data[pos++] !== tag)\n                throw new E('tlv.decode: wrong tlv');\n            const first = data[pos++];\n            const isLong = !!(first & 128); // First bit of first length byte is flag for short/long form\n            let length = 0;\n            if (!isLong)\n                length = first;\n            else {\n                // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]\n                const lenLen = first & 127;\n                if (!lenLen)\n                    throw new E('tlv.decode(long): indefinite length not supported');\n                if (lenLen > 4)\n                    throw new E('tlv.decode(long): byte length is too big'); // this will overflow u32 in js\n                const lengthBytes = data.subarray(pos, pos + lenLen);\n                if (lengthBytes.length !== lenLen)\n                    throw new E('tlv.decode: length bytes not complete');\n                if (lengthBytes[0] === 0)\n                    throw new E('tlv.decode(long): zero leftmost byte');\n                for (const b of lengthBytes)\n                    length = (length << 8) | b;\n                pos += lenLen;\n                if (length < 128)\n                    throw new E('tlv.decode(long): not minimal encoding');\n            }\n            const v = data.subarray(pos, pos + length);\n            if (v.length !== length)\n                throw new E('tlv.decode: wrong value length');\n            return { v, l: data.subarray(pos + length) };\n        },\n    },\n    // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,\n    // since we always use positive integers here. It must always be empty:\n    // - add zero byte if exists\n    // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)\n    _int: {\n        encode(num) {\n            const { Err: E } = DER;\n            if (num < _0n)\n                throw new E('integer: negative integers are not allowed');\n            let hex = numberToHexUnpadded(num);\n            // Pad with zero byte if negative flag is present\n            if (Number.parseInt(hex[0], 16) & 0b1000)\n                hex = '00' + hex;\n            if (hex.length & 1)\n                throw new E('unexpected DER parsing assertion: unpadded hex');\n            return hex;\n        },\n        decode(data) {\n            const { Err: E } = DER;\n            if (data[0] & 128)\n                throw new E('invalid signature integer: negative');\n            if (data[0] === 0x00 && !(data[1] & 128))\n                throw new E('invalid signature integer: unnecessary leading zero');\n            return bytesToNumberBE(data);\n        },\n    },\n    toSig(hex) {\n        // parse DER signature\n        const { Err: E, _int: int, _tlv: tlv } = DER;\n        const data = ensureBytes('signature', hex);\n        const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);\n        if (seqLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        const { v: rBytes, l: rLeftBytes } = tlv.decode(0x02, seqBytes);\n        const { v: sBytes, l: sLeftBytes } = tlv.decode(0x02, rLeftBytes);\n        if (sLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        return { r: int.decode(rBytes), s: int.decode(sBytes) };\n    },\n    hexFromSig(sig) {\n        const { _tlv: tlv, _int: int } = DER;\n        const rs = tlv.encode(0x02, int.encode(sig.r));\n        const ss = tlv.encode(0x02, int.encode(sig.s));\n        const seq = rs + ss;\n        return tlv.encode(0x30, seq);\n    },\n};\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);\nexport function _normFnElement(Fn, key) {\n    const { BYTES: expected } = Fn;\n    let num;\n    if (typeof key === 'bigint') {\n        num = key;\n    }\n    else {\n        let bytes = ensureBytes('private key', key);\n        try {\n            num = Fn.fromBytes(bytes);\n        }\n        catch (error) {\n            throw new Error(`invalid private key: expected ui8a of size ${expected}, got ${typeof key}`);\n        }\n    }\n    if (!Fn.isValidNot0(num))\n        throw new Error('invalid private key: out of range [1..N-1]');\n    return num;\n}\n/**\n * Creates weierstrass Point constructor, based on specified curve options.\n *\n * @example\n```js\nconst opts = {\n  p: BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff'),\n  n: BigInt('0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'),\n  h: BigInt(1),\n  a: BigInt('0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc'),\n  b: BigInt('0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b'),\n  Gx: BigInt('0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296'),\n  Gy: BigInt('0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5'),\n};\nconst p256_Point = weierstrass(opts);\n```\n */\nexport function weierstrassN(params, extraOpts = {}) {\n    const validated = _createCurveFields('weierstrass', params, extraOpts);\n    const { Fp, Fn } = validated;\n    let CURVE = validated.CURVE;\n    const { h: cofactor, n: CURVE_ORDER } = CURVE;\n    _validateObject(extraOpts, {}, {\n        allowInfinityPoint: 'boolean',\n        clearCofactor: 'function',\n        isTorsionFree: 'function',\n        fromBytes: 'function',\n        toBytes: 'function',\n        endo: 'object',\n        wrapPrivateKey: 'boolean',\n    });\n    const { endo } = extraOpts;\n    if (endo) {\n        // validateObject(endo, { beta: 'bigint', splitScalar: 'function' });\n        if (!Fp.is0(CURVE.a) || typeof endo.beta !== 'bigint' || !Array.isArray(endo.basises)) {\n            throw new Error('invalid endo: expected \"beta\": bigint and \"basises\": array');\n        }\n    }\n    const lengths = getWLengths(Fp, Fn);\n    function assertCompressionIsSupported() {\n        if (!Fp.isOdd)\n            throw new Error('compression is not supported: Field does not have .isOdd()');\n    }\n    // Implements IEEE P1363 point encoding\n    function pointToBytes(_c, point, isCompressed) {\n        const { x, y } = point.toAffine();\n        const bx = Fp.toBytes(x);\n        abool(isCompressed, 'isCompressed');\n        if (isCompressed) {\n            assertCompressionIsSupported();\n            const hasEvenY = !Fp.isOdd(y);\n            return concatBytes(pprefix(hasEvenY), bx);\n        }\n        else {\n            return concatBytes(Uint8Array.of(0x04), bx, Fp.toBytes(y));\n        }\n    }\n    function pointFromBytes(bytes) {\n        abytes(bytes, undefined, 'Point');\n        const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths; // e.g. for 32-byte: 33, 65\n        const length = bytes.length;\n        const head = bytes[0];\n        const tail = bytes.subarray(1);\n        // No actual validation is done here: use .assertValidity()\n        if (length === comp && (head === 0x02 || head === 0x03)) {\n            const x = Fp.fromBytes(tail);\n            if (!Fp.isValid(x))\n                throw new Error('bad point: is not on curve, wrong x');\n            const y2 = weierstrassEquation(x); // y² = x³ + ax + b\n            let y;\n            try {\n                y = Fp.sqrt(y2); // y = y² ^ (p+1)/4\n            }\n            catch (sqrtError) {\n                const err = sqrtError instanceof Error ? ': ' + sqrtError.message : '';\n                throw new Error('bad point: is not on curve, sqrt error' + err);\n            }\n            assertCompressionIsSupported();\n            const isYOdd = Fp.isOdd(y); // (y & _1n) === _1n;\n            const isHeadOdd = (head & 1) === 1; // ECDSA-specific\n            if (isHeadOdd !== isYOdd)\n                y = Fp.neg(y);\n            return { x, y };\n        }\n        else if (length === uncomp && head === 0x04) {\n            // TODO: more checks\n            const L = Fp.BYTES;\n            const x = Fp.fromBytes(tail.subarray(0, L));\n            const y = Fp.fromBytes(tail.subarray(L, L * 2));\n            if (!isValidXY(x, y))\n                throw new Error('bad point: is not on curve');\n            return { x, y };\n        }\n        else {\n            throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);\n        }\n    }\n    const encodePoint = extraOpts.toBytes || pointToBytes;\n    const decodePoint = extraOpts.fromBytes || pointFromBytes;\n    function weierstrassEquation(x) {\n        const x2 = Fp.sqr(x); // x * x\n        const x3 = Fp.mul(x2, x); // x² * x\n        return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b); // x³ + a * x + b\n    }\n    // TODO: move top-level\n    /** Checks whether equation holds for given x, y: y² == x³ + ax + b */\n    function isValidXY(x, y) {\n        const left = Fp.sqr(y); // y²\n        const right = weierstrassEquation(x); // x³ + ax + b\n        return Fp.eql(left, right);\n    }\n    // Validate whether the passed curve params are valid.\n    // Test 1: equation y² = x³ + ax + b should work for generator point.\n    if (!isValidXY(CURVE.Gx, CURVE.Gy))\n        throw new Error('bad curve params: generator point');\n    // Test 2: discriminant Δ part should be non-zero: 4a³ + 27b² != 0.\n    // Guarantees curve is genus-1, smooth (non-singular).\n    const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);\n    const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));\n    if (Fp.is0(Fp.add(_4a3, _27b2)))\n        throw new Error('bad curve params: a or b');\n    /** Asserts coordinate is valid: 0 <= n < Fp.ORDER. */\n    function acoord(title, n, banZero = false) {\n        if (!Fp.isValid(n) || (banZero && Fp.is0(n)))\n            throw new Error(`bad point coordinate ${title}`);\n        return n;\n    }\n    function aprjpoint(other) {\n        if (!(other instanceof Point))\n            throw new Error('ProjectivePoint expected');\n    }\n    function splitEndoScalarN(k) {\n        if (!endo || !endo.basises)\n            throw new Error('no endo');\n        return _splitEndoScalar(k, endo.basises, Fn.ORDER);\n    }\n    // Memoized toAffine / validity check. They are heavy. Points are immutable.\n    // Converts Projective point to affine (x, y) coordinates.\n    // Can accept precomputed Z^-1 - for example, from invertBatch.\n    // (X, Y, Z) ∋ (x=X/Z, y=Y/Z)\n    const toAffineMemo = memoized((p, iz) => {\n        const { X, Y, Z } = p;\n        // Fast-path for normalized points\n        if (Fp.eql(Z, Fp.ONE))\n            return { x: X, y: Y };\n        const is0 = p.is0();\n        // If invZ was 0, we return zero point. However we still want to execute\n        // all operations, so we replace invZ with a random number, 1.\n        if (iz == null)\n            iz = is0 ? Fp.ONE : Fp.inv(Z);\n        const x = Fp.mul(X, iz);\n        const y = Fp.mul(Y, iz);\n        const zz = Fp.mul(Z, iz);\n        if (is0)\n            return { x: Fp.ZERO, y: Fp.ZERO };\n        if (!Fp.eql(zz, Fp.ONE))\n            throw new Error('invZ was invalid');\n        return { x, y };\n    });\n    // NOTE: on exception this will crash 'cached' and no value will be set.\n    // Otherwise true will be return\n    const assertValidMemo = memoized((p) => {\n        if (p.is0()) {\n            // (0, 1, 0) aka ZERO is invalid in most contexts.\n            // In BLS, ZERO can be serialized, so we allow it.\n            // (0, 0, 0) is invalid representation of ZERO.\n            if (extraOpts.allowInfinityPoint && !Fp.is0(p.Y))\n                return;\n            throw new Error('bad point: ZERO');\n        }\n        // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`\n        const { x, y } = p.toAffine();\n        if (!Fp.isValid(x) || !Fp.isValid(y))\n            throw new Error('bad point: x or y not field elements');\n        if (!isValidXY(x, y))\n            throw new Error('bad point: equation left != right');\n        if (!p.isTorsionFree())\n            throw new Error('bad point: not in prime-order subgroup');\n        return true;\n    });\n    function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {\n        k2p = new Point(Fp.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);\n        k1p = negateCt(k1neg, k1p);\n        k2p = negateCt(k2neg, k2p);\n        return k1p.add(k2p);\n    }\n    /**\n     * Projective Point works in 3d / projective (homogeneous) coordinates:(X, Y, Z) ∋ (x=X/Z, y=Y/Z).\n     * Default Point works in 2d / affine coordinates: (x, y).\n     * We're doing calculations in projective, because its operations don't require costly inversion.\n     */\n    class Point {\n        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n        constructor(X, Y, Z) {\n            this.X = acoord('x', X);\n            this.Y = acoord('y', Y, true);\n            this.Z = acoord('z', Z);\n            Object.freeze(this);\n        }\n        static CURVE() {\n            return CURVE;\n        }\n        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n        static fromAffine(p) {\n            const { x, y } = p || {};\n            if (!p || !Fp.isValid(x) || !Fp.isValid(y))\n                throw new Error('invalid affine point');\n            if (p instanceof Point)\n                throw new Error('projective point not allowed');\n            // (0, 0) would've produced (0, 0, 1) - instead, we need (0, 1, 0)\n            if (Fp.is0(x) && Fp.is0(y))\n                return Point.ZERO;\n            return new Point(x, y, Fp.ONE);\n        }\n        static fromBytes(bytes) {\n            const P = Point.fromAffine(decodePoint(abytes(bytes, undefined, 'point')));\n            P.assertValidity();\n            return P;\n        }\n        static fromHex(hex) {\n            return Point.fromBytes(ensureBytes('pointHex', hex));\n        }\n        get x() {\n            return this.toAffine().x;\n        }\n        get y() {\n            return this.toAffine().y;\n        }\n        /**\n         *\n         * @param windowSize\n         * @param isLazy true will defer table computation until the first multiplication\n         * @returns\n         */\n        precompute(windowSize = 8, isLazy = true) {\n            wnaf.createCache(this, windowSize);\n            if (!isLazy)\n                this.multiply(_3n); // random number\n            return this;\n        }\n        // TODO: return `this`\n        /** A point on curve is valid if it conforms to equation. */\n        assertValidity() {\n            assertValidMemo(this);\n        }\n        hasEvenY() {\n            const { y } = this.toAffine();\n            if (!Fp.isOdd)\n                throw new Error(\"Field doesn't support isOdd\");\n            return !Fp.isOdd(y);\n        }\n        /** Compare one point to another. */\n        equals(other) {\n            aprjpoint(other);\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            const { X: X2, Y: Y2, Z: Z2 } = other;\n            const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));\n            const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));\n            return U1 && U2;\n        }\n        /** Flips point to one corresponding to (x, -y) in Affine coordinates. */\n        negate() {\n            return new Point(this.X, Fp.neg(this.Y), this.Z);\n        }\n        // Renes-Costello-Batina exception-free doubling formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 3\n        // Cost: 8M + 3S + 3*a + 2*b3 + 15add.\n        double() {\n            const { a, b } = CURVE;\n            const b3 = Fp.mul(b, _3n);\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            let t0 = Fp.mul(X1, X1); // step 1\n            let t1 = Fp.mul(Y1, Y1);\n            let t2 = Fp.mul(Z1, Z1);\n            let t3 = Fp.mul(X1, Y1);\n            t3 = Fp.add(t3, t3); // step 5\n            Z3 = Fp.mul(X1, Z1);\n            Z3 = Fp.add(Z3, Z3);\n            X3 = Fp.mul(a, Z3);\n            Y3 = Fp.mul(b3, t2);\n            Y3 = Fp.add(X3, Y3); // step 10\n            X3 = Fp.sub(t1, Y3);\n            Y3 = Fp.add(t1, Y3);\n            Y3 = Fp.mul(X3, Y3);\n            X3 = Fp.mul(t3, X3);\n            Z3 = Fp.mul(b3, Z3); // step 15\n            t2 = Fp.mul(a, t2);\n            t3 = Fp.sub(t0, t2);\n            t3 = Fp.mul(a, t3);\n            t3 = Fp.add(t3, Z3);\n            Z3 = Fp.add(t0, t0); // step 20\n            t0 = Fp.add(Z3, t0);\n            t0 = Fp.add(t0, t2);\n            t0 = Fp.mul(t0, t3);\n            Y3 = Fp.add(Y3, t0);\n            t2 = Fp.mul(Y1, Z1); // step 25\n            t2 = Fp.add(t2, t2);\n            t0 = Fp.mul(t2, t3);\n            X3 = Fp.sub(X3, t0);\n            Z3 = Fp.mul(t2, t1);\n            Z3 = Fp.add(Z3, Z3); // step 30\n            Z3 = Fp.add(Z3, Z3);\n            return new Point(X3, Y3, Z3);\n        }\n        // Renes-Costello-Batina exception-free addition formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 1\n        // Cost: 12M + 0S + 3*a + 3*b3 + 23add.\n        add(other) {\n            aprjpoint(other);\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            const { X: X2, Y: Y2, Z: Z2 } = other;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            const a = CURVE.a;\n            const b3 = Fp.mul(CURVE.b, _3n);\n            let t0 = Fp.mul(X1, X2); // step 1\n            let t1 = Fp.mul(Y1, Y2);\n            let t2 = Fp.mul(Z1, Z2);\n            let t3 = Fp.add(X1, Y1);\n            let t4 = Fp.add(X2, Y2); // step 5\n            t3 = Fp.mul(t3, t4);\n            t4 = Fp.add(t0, t1);\n            t3 = Fp.sub(t3, t4);\n            t4 = Fp.add(X1, Z1);\n            let t5 = Fp.add(X2, Z2); // step 10\n            t4 = Fp.mul(t4, t5);\n            t5 = Fp.add(t0, t2);\n            t4 = Fp.sub(t4, t5);\n            t5 = Fp.add(Y1, Z1);\n            X3 = Fp.add(Y2, Z2); // step 15\n            t5 = Fp.mul(t5, X3);\n            X3 = Fp.add(t1, t2);\n            t5 = Fp.sub(t5, X3);\n            Z3 = Fp.mul(a, t4);\n            X3 = Fp.mul(b3, t2); // step 20\n            Z3 = Fp.add(X3, Z3);\n            X3 = Fp.sub(t1, Z3);\n            Z3 = Fp.add(t1, Z3);\n            Y3 = Fp.mul(X3, Z3);\n            t1 = Fp.add(t0, t0); // step 25\n            t1 = Fp.add(t1, t0);\n            t2 = Fp.mul(a, t2);\n            t4 = Fp.mul(b3, t4);\n            t1 = Fp.add(t1, t2);\n            t2 = Fp.sub(t0, t2); // step 30\n            t2 = Fp.mul(a, t2);\n            t4 = Fp.add(t4, t2);\n            t0 = Fp.mul(t1, t4);\n            Y3 = Fp.add(Y3, t0);\n            t0 = Fp.mul(t5, t4); // step 35\n            X3 = Fp.mul(t3, X3);\n            X3 = Fp.sub(X3, t0);\n            t0 = Fp.mul(t3, t1);\n            Z3 = Fp.mul(t5, Z3);\n            Z3 = Fp.add(Z3, t0); // step 40\n            return new Point(X3, Y3, Z3);\n        }\n        subtract(other) {\n            return this.add(other.negate());\n        }\n        is0() {\n            return this.equals(Point.ZERO);\n        }\n        /**\n         * Constant time multiplication.\n         * Uses wNAF method. Windowed method may be 10% faster,\n         * but takes 2x longer to generate and consumes 2x memory.\n         * Uses precomputes when available.\n         * Uses endomorphism for Koblitz curves.\n         * @param scalar by which the point would be multiplied\n         * @returns New point\n         */\n        multiply(scalar) {\n            const { endo } = extraOpts;\n            if (!Fn.isValidNot0(scalar))\n                throw new Error('invalid scalar: out of range'); // 0 is invalid\n            let point, fake; // Fake point is used to const-time mult\n            const mul = (n) => wnaf.cached(this, n, (p) => normalizeZ(Point, p));\n            /** See docs for {@link EndomorphismOpts} */\n            if (endo) {\n                const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(scalar);\n                const { p: k1p, f: k1f } = mul(k1);\n                const { p: k2p, f: k2f } = mul(k2);\n                fake = k1f.add(k2f);\n                point = finishEndo(endo.beta, k1p, k2p, k1neg, k2neg);\n            }\n            else {\n                const { p, f } = mul(scalar);\n                point = p;\n                fake = f;\n            }\n            // Normalize `z` for both points, but return only real one\n            return normalizeZ(Point, [point, fake])[0];\n        }\n        /**\n         * Non-constant-time multiplication. Uses double-and-add algorithm.\n         * It's faster, but should only be used when you don't care about\n         * an exposed secret key e.g. sig verification, which works over *public* keys.\n         */\n        multiplyUnsafe(sc) {\n            const { endo } = extraOpts;\n            const p = this;\n            if (!Fn.isValid(sc))\n                throw new Error('invalid scalar: out of range'); // 0 is valid\n            if (sc === _0n || p.is0())\n                return Point.ZERO;\n            if (sc === _1n)\n                return p; // fast-path\n            if (wnaf.hasCache(this))\n                return this.multiply(sc);\n            if (endo) {\n                const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(sc);\n                const { p1, p2 } = mulEndoUnsafe(Point, p, k1, k2); // 30% faster vs wnaf.unsafe\n                return finishEndo(endo.beta, p1, p2, k1neg, k2neg);\n            }\n            else {\n                return wnaf.unsafe(p, sc);\n            }\n        }\n        multiplyAndAddUnsafe(Q, a, b) {\n            const sum = this.multiplyUnsafe(a).add(Q.multiplyUnsafe(b));\n            return sum.is0() ? undefined : sum;\n        }\n        /**\n         * Converts Projective point to affine (x, y) coordinates.\n         * @param invertedZ Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch\n         */\n        toAffine(invertedZ) {\n            return toAffineMemo(this, invertedZ);\n        }\n        /**\n         * Checks whether Point is free of torsion elements (is in prime subgroup).\n         * Always torsion-free for cofactor=1 curves.\n         */\n        isTorsionFree() {\n            const { isTorsionFree } = extraOpts;\n            if (cofactor === _1n)\n                return true;\n            if (isTorsionFree)\n                return isTorsionFree(Point, this);\n            return wnaf.unsafe(this, CURVE_ORDER).is0();\n        }\n        clearCofactor() {\n            const { clearCofactor } = extraOpts;\n            if (cofactor === _1n)\n                return this; // Fast-path\n            if (clearCofactor)\n                return clearCofactor(Point, this);\n            return this.multiplyUnsafe(cofactor);\n        }\n        isSmallOrder() {\n            // can we use this.clearCofactor()?\n            return this.multiplyUnsafe(cofactor).is0();\n        }\n        toBytes(isCompressed = true) {\n            abool(isCompressed, 'isCompressed');\n            this.assertValidity();\n            return encodePoint(Point, this, isCompressed);\n        }\n        toHex(isCompressed = true) {\n            return bytesToHex(this.toBytes(isCompressed));\n        }\n        toString() {\n            return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;\n        }\n        // TODO: remove\n        get px() {\n            return this.X;\n        }\n        get py() {\n            return this.X;\n        }\n        get pz() {\n            return this.Z;\n        }\n        toRawBytes(isCompressed = true) {\n            return this.toBytes(isCompressed);\n        }\n        _setWindowSize(windowSize) {\n            this.precompute(windowSize);\n        }\n        static normalizeZ(points) {\n            return normalizeZ(Point, points);\n        }\n        static msm(points, scalars) {\n            return pippenger(Point, Fn, points, scalars);\n        }\n        static fromPrivateKey(privateKey) {\n            return Point.BASE.multiply(_normFnElement(Fn, privateKey));\n        }\n    }\n    // base / generator point\n    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);\n    // zero / infinity / identity point\n    Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO); // 0, 1, 0\n    // math field\n    Point.Fp = Fp;\n    // scalar field\n    Point.Fn = Fn;\n    const bits = Fn.BITS;\n    const wnaf = new wNAF(Point, extraOpts.endo ? Math.ceil(bits / 2) : bits);\n    Point.BASE.precompute(8); // Enable precomputes. Slows down first publicKey computation by 20ms.\n    return Point;\n}\n// Points start with byte 0x02 when y is even; otherwise 0x03\nfunction pprefix(hasEvenY) {\n    return Uint8Array.of(hasEvenY ? 0x02 : 0x03);\n}\n/**\n * Implementation of the Shallue and van de Woestijne method for any weierstrass curve.\n * TODO: check if there is a way to merge this with uvRatio in Edwards; move to modular.\n * b = True and y = sqrt(u / v) if (u / v) is square in F, and\n * b = False and y = sqrt(Z * (u / v)) otherwise.\n * @param Fp\n * @param Z\n * @returns\n */\nexport function SWUFpSqrtRatio(Fp, Z) {\n    // Generic implementation\n    const q = Fp.ORDER;\n    let l = _0n;\n    for (let o = q - _1n; o % _2n === _0n; o /= _2n)\n        l += _1n;\n    const c1 = l; // 1. c1, the largest integer such that 2^c1 divides q - 1.\n    // We need 2n ** c1 and 2n ** (c1-1). We can't use **; but we can use <<.\n    // 2n ** c1 == 2n << (c1-1)\n    const _2n_pow_c1_1 = _2n << (c1 - _1n - _1n);\n    const _2n_pow_c1 = _2n_pow_c1_1 * _2n;\n    const c2 = (q - _1n) / _2n_pow_c1; // 2. c2 = (q - 1) / (2^c1)  # Integer arithmetic\n    const c3 = (c2 - _1n) / _2n; // 3. c3 = (c2 - 1) / 2            # Integer arithmetic\n    const c4 = _2n_pow_c1 - _1n; // 4. c4 = 2^c1 - 1                # Integer arithmetic\n    const c5 = _2n_pow_c1_1; // 5. c5 = 2^(c1 - 1)                  # Integer arithmetic\n    const c6 = Fp.pow(Z, c2); // 6. c6 = Z^c2\n    const c7 = Fp.pow(Z, (c2 + _1n) / _2n); // 7. c7 = Z^((c2 + 1) / 2)\n    let sqrtRatio = (u, v) => {\n        let tv1 = c6; // 1. tv1 = c6\n        let tv2 = Fp.pow(v, c4); // 2. tv2 = v^c4\n        let tv3 = Fp.sqr(tv2); // 3. tv3 = tv2^2\n        tv3 = Fp.mul(tv3, v); // 4. tv3 = tv3 * v\n        let tv5 = Fp.mul(u, tv3); // 5. tv5 = u * tv3\n        tv5 = Fp.pow(tv5, c3); // 6. tv5 = tv5^c3\n        tv5 = Fp.mul(tv5, tv2); // 7. tv5 = tv5 * tv2\n        tv2 = Fp.mul(tv5, v); // 8. tv2 = tv5 * v\n        tv3 = Fp.mul(tv5, u); // 9. tv3 = tv5 * u\n        let tv4 = Fp.mul(tv3, tv2); // 10. tv4 = tv3 * tv2\n        tv5 = Fp.pow(tv4, c5); // 11. tv5 = tv4^c5\n        let isQR = Fp.eql(tv5, Fp.ONE); // 12. isQR = tv5 == 1\n        tv2 = Fp.mul(tv3, c7); // 13. tv2 = tv3 * c7\n        tv5 = Fp.mul(tv4, tv1); // 14. tv5 = tv4 * tv1\n        tv3 = Fp.cmov(tv2, tv3, isQR); // 15. tv3 = CMOV(tv2, tv3, isQR)\n        tv4 = Fp.cmov(tv5, tv4, isQR); // 16. tv4 = CMOV(tv5, tv4, isQR)\n        // 17. for i in (c1, c1 - 1, ..., 2):\n        for (let i = c1; i > _1n; i--) {\n            let tv5 = i - _2n; // 18.    tv5 = i - 2\n            tv5 = _2n << (tv5 - _1n); // 19.    tv5 = 2^tv5\n            let tvv5 = Fp.pow(tv4, tv5); // 20.    tv5 = tv4^tv5\n            const e1 = Fp.eql(tvv5, Fp.ONE); // 21.    e1 = tv5 == 1\n            tv2 = Fp.mul(tv3, tv1); // 22.    tv2 = tv3 * tv1\n            tv1 = Fp.mul(tv1, tv1); // 23.    tv1 = tv1 * tv1\n            tvv5 = Fp.mul(tv4, tv1); // 24.    tv5 = tv4 * tv1\n            tv3 = Fp.cmov(tv2, tv3, e1); // 25.    tv3 = CMOV(tv2, tv3, e1)\n            tv4 = Fp.cmov(tvv5, tv4, e1); // 26.    tv4 = CMOV(tv5, tv4, e1)\n        }\n        return { isValid: isQR, value: tv3 };\n    };\n    if (Fp.ORDER % _4n === _3n) {\n        // sqrt_ratio_3mod4(u, v)\n        const c1 = (Fp.ORDER - _3n) / _4n; // 1. c1 = (q - 3) / 4     # Integer arithmetic\n        const c2 = Fp.sqrt(Fp.neg(Z)); // 2. c2 = sqrt(-Z)\n        sqrtRatio = (u, v) => {\n            let tv1 = Fp.sqr(v); // 1. tv1 = v^2\n            const tv2 = Fp.mul(u, v); // 2. tv2 = u * v\n            tv1 = Fp.mul(tv1, tv2); // 3. tv1 = tv1 * tv2\n            let y1 = Fp.pow(tv1, c1); // 4. y1 = tv1^c1\n            y1 = Fp.mul(y1, tv2); // 5. y1 = y1 * tv2\n            const y2 = Fp.mul(y1, c2); // 6. y2 = y1 * c2\n            const tv3 = Fp.mul(Fp.sqr(y1), v); // 7. tv3 = y1^2; 8. tv3 = tv3 * v\n            const isQR = Fp.eql(tv3, u); // 9. isQR = tv3 == u\n            let y = Fp.cmov(y2, y1, isQR); // 10. y = CMOV(y2, y1, isQR)\n            return { isValid: isQR, value: y }; // 11. return (isQR, y) isQR ? y : y*c2\n        };\n    }\n    // No curves uses that\n    // if (Fp.ORDER % _8n === _5n) // sqrt_ratio_5mod8\n    return sqrtRatio;\n}\n/**\n * Simplified Shallue-van de Woestijne-Ulas Method\n * https://www.rfc-editor.org/rfc/rfc9380#section-6.6.2\n */\nexport function mapToCurveSimpleSWU(Fp, opts) {\n    validateField(Fp);\n    const { A, B, Z } = opts;\n    if (!Fp.isValid(A) || !Fp.isValid(B) || !Fp.isValid(Z))\n        throw new Error('mapToCurveSimpleSWU: invalid opts');\n    const sqrtRatio = SWUFpSqrtRatio(Fp, Z);\n    if (!Fp.isOdd)\n        throw new Error('Field does not have .isOdd()');\n    // Input: u, an element of F.\n    // Output: (x, y), a point on E.\n    return (u) => {\n        // prettier-ignore\n        let tv1, tv2, tv3, tv4, tv5, tv6, x, y;\n        tv1 = Fp.sqr(u); // 1.  tv1 = u^2\n        tv1 = Fp.mul(tv1, Z); // 2.  tv1 = Z * tv1\n        tv2 = Fp.sqr(tv1); // 3.  tv2 = tv1^2\n        tv2 = Fp.add(tv2, tv1); // 4.  tv2 = tv2 + tv1\n        tv3 = Fp.add(tv2, Fp.ONE); // 5.  tv3 = tv2 + 1\n        tv3 = Fp.mul(tv3, B); // 6.  tv3 = B * tv3\n        tv4 = Fp.cmov(Z, Fp.neg(tv2), !Fp.eql(tv2, Fp.ZERO)); // 7.  tv4 = CMOV(Z, -tv2, tv2 != 0)\n        tv4 = Fp.mul(tv4, A); // 8.  tv4 = A * tv4\n        tv2 = Fp.sqr(tv3); // 9.  tv2 = tv3^2\n        tv6 = Fp.sqr(tv4); // 10. tv6 = tv4^2\n        tv5 = Fp.mul(tv6, A); // 11. tv5 = A * tv6\n        tv2 = Fp.add(tv2, tv5); // 12. tv2 = tv2 + tv5\n        tv2 = Fp.mul(tv2, tv3); // 13. tv2 = tv2 * tv3\n        tv6 = Fp.mul(tv6, tv4); // 14. tv6 = tv6 * tv4\n        tv5 = Fp.mul(tv6, B); // 15. tv5 = B * tv6\n        tv2 = Fp.add(tv2, tv5); // 16. tv2 = tv2 + tv5\n        x = Fp.mul(tv1, tv3); // 17.   x = tv1 * tv3\n        const { isValid, value } = sqrtRatio(tv2, tv6); // 18. (is_gx1_square, y1) = sqrt_ratio(tv2, tv6)\n        y = Fp.mul(tv1, u); // 19.   y = tv1 * u  -> Z * u^3 * y1\n        y = Fp.mul(y, value); // 20.   y = y * y1\n        x = Fp.cmov(x, tv3, isValid); // 21.   x = CMOV(x, tv3, is_gx1_square)\n        y = Fp.cmov(y, value, isValid); // 22.   y = CMOV(y, y1, is_gx1_square)\n        const e1 = Fp.isOdd(u) === Fp.isOdd(y); // 23.  e1 = sgn0(u) == sgn0(y)\n        y = Fp.cmov(Fp.neg(y), y, e1); // 24.   y = CMOV(-y, y, e1)\n        const tv4_inv = FpInvertBatch(Fp, [tv4], true)[0];\n        x = Fp.mul(x, tv4_inv); // 25.   x = x / tv4\n        return { x, y };\n    };\n}\nfunction getWLengths(Fp, Fn) {\n    return {\n        secretKey: Fn.BYTES,\n        publicKey: 1 + Fp.BYTES,\n        publicKeyUncompressed: 1 + 2 * Fp.BYTES,\n        publicKeyHasPrefix: true,\n        signature: 2 * Fn.BYTES,\n    };\n}\n/**\n * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.\n * This helper ensures no signature functionality is present. Less code, smaller bundle size.\n */\nexport function ecdh(Point, ecdhOpts = {}) {\n    const { Fn } = Point;\n    const randomBytes_ = ecdhOpts.randomBytes || randomBytesWeb;\n    const lengths = Object.assign(getWLengths(Point.Fp, Fn), { seed: getMinHashLength(Fn.ORDER) });\n    function isValidSecretKey(secretKey) {\n        try {\n            return !!_normFnElement(Fn, secretKey);\n        }\n        catch (error) {\n            return false;\n        }\n    }\n    function isValidPublicKey(publicKey, isCompressed) {\n        const { publicKey: comp, publicKeyUncompressed } = lengths;\n        try {\n            const l = publicKey.length;\n            if (isCompressed === true && l !== comp)\n                return false;\n            if (isCompressed === false && l !== publicKeyUncompressed)\n                return false;\n            return !!Point.fromBytes(publicKey);\n        }\n        catch (error) {\n            return false;\n        }\n    }\n    /**\n     * Produces cryptographically secure secret key from random of size\n     * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.\n     */\n    function randomSecretKey(seed = randomBytes_(lengths.seed)) {\n        return mapHashToField(abytes(seed, lengths.seed, 'seed'), Fn.ORDER);\n    }\n    /**\n     * Computes public key for a secret key. Checks for validity of the secret key.\n     * @param isCompressed whether to return compact (default), or full key\n     * @returns Public key, full when isCompressed=false; short when isCompressed=true\n     */\n    function getPublicKey(secretKey, isCompressed = true) {\n        return Point.BASE.multiply(_normFnElement(Fn, secretKey)).toBytes(isCompressed);\n    }\n    function keygen(seed) {\n        const secretKey = randomSecretKey(seed);\n        return { secretKey, publicKey: getPublicKey(secretKey) };\n    }\n    /**\n     * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.\n     */\n    function isProbPub(item) {\n        if (typeof item === 'bigint')\n            return false;\n        if (item instanceof Point)\n            return true;\n        const { secretKey, publicKey, publicKeyUncompressed } = lengths;\n        if (Fn.allowedLengths || secretKey === publicKey)\n            return undefined;\n        const l = ensureBytes('key', item).length;\n        return l === publicKey || l === publicKeyUncompressed;\n    }\n    /**\n     * ECDH (Elliptic Curve Diffie Hellman).\n     * Computes shared public key from secret key A and public key B.\n     * Checks: 1) secret key validity 2) shared key is on-curve.\n     * Does NOT hash the result.\n     * @param isCompressed whether to return compact (default), or full key\n     * @returns shared public key\n     */\n    function getSharedSecret(secretKeyA, publicKeyB, isCompressed = true) {\n        if (isProbPub(secretKeyA) === true)\n            throw new Error('first arg must be private key');\n        if (isProbPub(publicKeyB) === false)\n            throw new Error('second arg must be public key');\n        const s = _normFnElement(Fn, secretKeyA);\n        const b = Point.fromHex(publicKeyB); // checks for being on-curve\n        return b.multiply(s).toBytes(isCompressed);\n    }\n    const utils = {\n        isValidSecretKey,\n        isValidPublicKey,\n        randomSecretKey,\n        // TODO: remove\n        isValidPrivateKey: isValidSecretKey,\n        randomPrivateKey: randomSecretKey,\n        normPrivateKeyToScalar: (key) => _normFnElement(Fn, key),\n        precompute(windowSize = 8, point = Point.BASE) {\n            return point.precompute(windowSize, false);\n        },\n    };\n    return Object.freeze({ getPublicKey, getSharedSecret, keygen, Point, utils, lengths });\n}\n/**\n * Creates ECDSA signing interface for given elliptic curve `Point` and `hash` function.\n * We need `hash` for 2 features:\n * 1. Message prehash-ing. NOT used if `sign` / `verify` are called with `prehash: false`\n * 2. k generation in `sign`, using HMAC-drbg(hash)\n *\n * ECDSAOpts are only rarely needed.\n *\n * @example\n * ```js\n * const p256_Point = weierstrass(...);\n * const p256_sha256 = ecdsa(p256_Point, sha256);\n * const p256_sha224 = ecdsa(p256_Point, sha224);\n * const p256_sha224_r = ecdsa(p256_Point, sha224, { randomBytes: (length) => { ... } });\n * ```\n */\nexport function ecdsa(Point, hash, ecdsaOpts = {}) {\n    ahash(hash);\n    _validateObject(ecdsaOpts, {}, {\n        hmac: 'function',\n        lowS: 'boolean',\n        randomBytes: 'function',\n        bits2int: 'function',\n        bits2int_modN: 'function',\n    });\n    const randomBytes = ecdsaOpts.randomBytes || randomBytesWeb;\n    const hmac = ecdsaOpts.hmac ||\n        ((key, ...msgs) => nobleHmac(hash, key, concatBytes(...msgs)));\n    const { Fp, Fn } = Point;\n    const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;\n    const { keygen, getPublicKey, getSharedSecret, utils, lengths } = ecdh(Point, ecdsaOpts);\n    const defaultSigOpts = {\n        prehash: false,\n        lowS: typeof ecdsaOpts.lowS === 'boolean' ? ecdsaOpts.lowS : false,\n        format: undefined, //'compact' as ECDSASigFormat,\n        extraEntropy: false,\n    };\n    const defaultSigOpts_format = 'compact';\n    function isBiggerThanHalfOrder(number) {\n        const HALF = CURVE_ORDER >> _1n;\n        return number > HALF;\n    }\n    function validateRS(title, num) {\n        if (!Fn.isValidNot0(num))\n            throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);\n        return num;\n    }\n    function validateSigLength(bytes, format) {\n        validateSigFormat(format);\n        const size = lengths.signature;\n        const sizer = format === 'compact' ? size : format === 'recovered' ? size + 1 : undefined;\n        return abytes(bytes, sizer, `${format} signature`);\n    }\n    /**\n     * ECDSA signature with its (r, s) properties. Supports compact, recovered & DER representations.\n     */\n    class Signature {\n        constructor(r, s, recovery) {\n            this.r = validateRS('r', r); // r in [1..N-1];\n            this.s = validateRS('s', s); // s in [1..N-1];\n            if (recovery != null)\n                this.recovery = recovery;\n            Object.freeze(this);\n        }\n        static fromBytes(bytes, format = defaultSigOpts_format) {\n            validateSigLength(bytes, format);\n            let recid;\n            if (format === 'der') {\n                const { r, s } = DER.toSig(abytes(bytes));\n                return new Signature(r, s);\n            }\n            if (format === 'recovered') {\n                recid = bytes[0];\n                format = 'compact';\n                bytes = bytes.subarray(1);\n            }\n            const L = Fn.BYTES;\n            const r = bytes.subarray(0, L);\n            const s = bytes.subarray(L, L * 2);\n            return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);\n        }\n        static fromHex(hex, format) {\n            return this.fromBytes(hexToBytes(hex), format);\n        }\n        addRecoveryBit(recovery) {\n            return new Signature(this.r, this.s, recovery);\n        }\n        recoverPublicKey(messageHash) {\n            const FIELD_ORDER = Fp.ORDER;\n            const { r, s, recovery: rec } = this;\n            if (rec == null || ![0, 1, 2, 3].includes(rec))\n                throw new Error('recovery id invalid');\n            // ECDSA recovery is hard for cofactor > 1 curves.\n            // In sign, `r = q.x mod n`, and here we recover q.x from r.\n            // While recovering q.x >= n, we need to add r+n for cofactor=1 curves.\n            // However, for cofactor>1, r+n may not get q.x:\n            // r+n*i would need to be done instead where i is unknown.\n            // To easily get i, we either need to:\n            // a. increase amount of valid recid values (4, 5...); OR\n            // b. prohibit non-prime-order signatures (recid > 1).\n            const hasCofactor = CURVE_ORDER * _2n < FIELD_ORDER;\n            if (hasCofactor && rec > 1)\n                throw new Error('recovery id is ambiguous for h>1 curve');\n            const radj = rec === 2 || rec === 3 ? r + CURVE_ORDER : r;\n            if (!Fp.isValid(radj))\n                throw new Error('recovery id 2 or 3 invalid');\n            const x = Fp.toBytes(radj);\n            const R = Point.fromBytes(concatBytes(pprefix((rec & 1) === 0), x));\n            const ir = Fn.inv(radj); // r^-1\n            const h = bits2int_modN(ensureBytes('msgHash', messageHash)); // Truncate hash\n            const u1 = Fn.create(-h * ir); // -hr^-1\n            const u2 = Fn.create(s * ir); // sr^-1\n            // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1). unsafe is fine: there is no private data.\n            const Q = Point.BASE.multiplyUnsafe(u1).add(R.multiplyUnsafe(u2));\n            if (Q.is0())\n                throw new Error('point at infinify');\n            Q.assertValidity();\n            return Q;\n        }\n        // Signatures should be low-s, to prevent malleability.\n        hasHighS() {\n            return isBiggerThanHalfOrder(this.s);\n        }\n        toBytes(format = defaultSigOpts_format) {\n            validateSigFormat(format);\n            if (format === 'der')\n                return hexToBytes(DER.hexFromSig(this));\n            const r = Fn.toBytes(this.r);\n            const s = Fn.toBytes(this.s);\n            if (format === 'recovered') {\n                if (this.recovery == null)\n                    throw new Error('recovery bit must be present');\n                return concatBytes(Uint8Array.of(this.recovery), r, s);\n            }\n            return concatBytes(r, s);\n        }\n        toHex(format) {\n            return bytesToHex(this.toBytes(format));\n        }\n        // TODO: remove\n        assertValidity() { }\n        static fromCompact(hex) {\n            return Signature.fromBytes(ensureBytes('sig', hex), 'compact');\n        }\n        static fromDER(hex) {\n            return Signature.fromBytes(ensureBytes('sig', hex), 'der');\n        }\n        normalizeS() {\n            return this.hasHighS() ? new Signature(this.r, Fn.neg(this.s), this.recovery) : this;\n        }\n        toDERRawBytes() {\n            return this.toBytes('der');\n        }\n        toDERHex() {\n            return bytesToHex(this.toBytes('der'));\n        }\n        toCompactRawBytes() {\n            return this.toBytes('compact');\n        }\n        toCompactHex() {\n            return bytesToHex(this.toBytes('compact'));\n        }\n    }\n    // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.\n    // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.\n    // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.\n    // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors\n    const bits2int = ecdsaOpts.bits2int ||\n        function bits2int_def(bytes) {\n            // Our custom check \"just in case\", for protection against DoS\n            if (bytes.length > 8192)\n                throw new Error('input is too large');\n            // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)\n            // for some cases, since bytes.length * 8 is not actual bitLength.\n            const num = bytesToNumberBE(bytes); // check for == u8 done here\n            const delta = bytes.length * 8 - fnBits; // truncate to nBitLength leftmost bits\n            return delta > 0 ? num >> BigInt(delta) : num;\n        };\n    const bits2int_modN = ecdsaOpts.bits2int_modN ||\n        function bits2int_modN_def(bytes) {\n            return Fn.create(bits2int(bytes)); // can't use bytesToNumberBE here\n        };\n    // Pads output with zero as per spec\n    const ORDER_MASK = bitMask(fnBits);\n    /** Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`. */\n    function int2octets(num) {\n        // IMPORTANT: the check ensures working for case `Fn.BYTES != Fn.BITS * 8`\n        aInRange('num < 2^' + fnBits, num, _0n, ORDER_MASK);\n        return Fn.toBytes(num);\n    }\n    function validateMsgAndHash(message, prehash) {\n        abytes(message, undefined, 'message');\n        return prehash ? abytes(hash(message), undefined, 'prehashed message') : message;\n    }\n    /**\n     * Steps A, D of RFC6979 3.2.\n     * Creates RFC6979 seed; converts msg/privKey to numbers.\n     * Used only in sign, not in verify.\n     *\n     * Warning: we cannot assume here that message has same amount of bytes as curve order,\n     * this will be invalid at least for P521. Also it can be bigger for P224 + SHA256.\n     */\n    function prepSig(message, privateKey, opts) {\n        if (['recovered', 'canonical'].some((k) => k in opts))\n            throw new Error('sign() legacy options not supported');\n        const { lowS, prehash, extraEntropy } = validateSigOpts(opts, defaultSigOpts);\n        message = validateMsgAndHash(message, prehash); // RFC6979 3.2 A: h1 = H(m)\n        // We can't later call bits2octets, since nested bits2int is broken for curves\n        // with fnBits % 8 !== 0. Because of that, we unwrap it here as int2octets call.\n        // const bits2octets = (bits) => int2octets(bits2int_modN(bits))\n        const h1int = bits2int_modN(message);\n        const d = _normFnElement(Fn, privateKey); // validate secret key, convert to bigint\n        const seedArgs = [int2octets(d), int2octets(h1int)];\n        // extraEntropy. RFC6979 3.6: additional k' (optional).\n        if (extraEntropy != null && extraEntropy !== false) {\n            // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')\n            // gen random bytes OR pass as-is\n            const e = extraEntropy === true ? randomBytes(lengths.secretKey) : extraEntropy;\n            seedArgs.push(ensureBytes('extraEntropy', e)); // check for being bytes\n        }\n        const seed = concatBytes(...seedArgs); // Step D of RFC6979 3.2\n        const m = h1int; // NOTE: no need to call bits2int second time here, it is inside truncateHash!\n        // Converts signature params into point w r/s, checks result for validity.\n        // To transform k => Signature:\n        // q = k⋅G\n        // r = q.x mod n\n        // s = k^-1(m + rd) mod n\n        // Can use scalar blinding b^-1(bm + bdr) where b ∈ [1,q−1] according to\n        // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. We've decided against it:\n        // a) dependency on CSPRNG b) 15% slowdown c) doesn't really help since bigints are not CT\n        function k2sig(kBytes) {\n            // RFC 6979 Section 3.2, step 3: k = bits2int(T)\n            // Important: all mod() calls here must be done over N\n            const k = bits2int(kBytes); // mod n, not mod p\n            if (!Fn.isValidNot0(k))\n                return; // Valid scalars (including k) must be in 1..N-1\n            const ik = Fn.inv(k); // k^-1 mod n\n            const q = Point.BASE.multiply(k).toAffine(); // q = k⋅G\n            const r = Fn.create(q.x); // r = q.x mod n\n            if (r === _0n)\n                return;\n            const s = Fn.create(ik * Fn.create(m + r * d)); // Not using blinding here, see comment above\n            if (s === _0n)\n                return;\n            let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3, when q.x > n)\n            let normS = s;\n            if (lowS && isBiggerThanHalfOrder(s)) {\n                normS = Fn.neg(s); // if lowS was passed, ensure s is always\n                recovery ^= 1; // // in the bottom half of N\n            }\n            return new Signature(r, normS, recovery); // use normS, not s\n        }\n        return { seed, k2sig };\n    }\n    /**\n     * Signs message hash with a secret key.\n     *\n     * ```\n     * sign(m, d) where\n     *   k = rfc6979_hmac_drbg(m, d)\n     *   (x, y) = G × k\n     *   r = x mod n\n     *   s = (m + dr) / k mod n\n     * ```\n     */\n    function sign(message, secretKey, opts = {}) {\n        message = ensureBytes('message', message);\n        const { seed, k2sig } = prepSig(message, secretKey, opts); // Steps A, D of RFC6979 3.2.\n        const drbg = createHmacDrbg(hash.outputLen, Fn.BYTES, hmac);\n        const sig = drbg(seed, k2sig); // Steps B, C, D, E, F, G\n        return sig;\n    }\n    function tryParsingSig(sg) {\n        // Try to deduce format\n        let sig = undefined;\n        const isHex = typeof sg === 'string' || isBytes(sg);\n        const isObj = !isHex &&\n            sg !== null &&\n            typeof sg === 'object' &&\n            typeof sg.r === 'bigint' &&\n            typeof sg.s === 'bigint';\n        if (!isHex && !isObj)\n            throw new Error('invalid signature, expected Uint8Array, hex string or Signature instance');\n        if (isObj) {\n            sig = new Signature(sg.r, sg.s);\n        }\n        else if (isHex) {\n            try {\n                sig = Signature.fromBytes(ensureBytes('sig', sg), 'der');\n            }\n            catch (derError) {\n                if (!(derError instanceof DER.Err))\n                    throw derError;\n            }\n            if (!sig) {\n                try {\n                    sig = Signature.fromBytes(ensureBytes('sig', sg), 'compact');\n                }\n                catch (error) {\n                    return false;\n                }\n            }\n        }\n        if (!sig)\n            return false;\n        return sig;\n    }\n    /**\n     * Verifies a signature against message and public key.\n     * Rejects lowS signatures by default: see {@link ECDSAVerifyOpts}.\n     * Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:\n     *\n     * ```\n     * verify(r, s, h, P) where\n     *   u1 = hs^-1 mod n\n     *   u2 = rs^-1 mod n\n     *   R = u1⋅G + u2⋅P\n     *   mod(R.x, n) == r\n     * ```\n     */\n    function verify(signature, message, publicKey, opts = {}) {\n        const { lowS, prehash, format } = validateSigOpts(opts, defaultSigOpts);\n        publicKey = ensureBytes('publicKey', publicKey);\n        message = validateMsgAndHash(ensureBytes('message', message), prehash);\n        if ('strict' in opts)\n            throw new Error('options.strict was renamed to lowS');\n        const sig = format === undefined\n            ? tryParsingSig(signature)\n            : Signature.fromBytes(ensureBytes('sig', signature), format);\n        if (sig === false)\n            return false;\n        try {\n            const P = Point.fromBytes(publicKey);\n            if (lowS && sig.hasHighS())\n                return false;\n            const { r, s } = sig;\n            const h = bits2int_modN(message); // mod n, not mod p\n            const is = Fn.inv(s); // s^-1 mod n\n            const u1 = Fn.create(h * is); // u1 = hs^-1 mod n\n            const u2 = Fn.create(r * is); // u2 = rs^-1 mod n\n            const R = Point.BASE.multiplyUnsafe(u1).add(P.multiplyUnsafe(u2)); // u1⋅G + u2⋅P\n            if (R.is0())\n                return false;\n            const v = Fn.create(R.x); // v = r.x mod n\n            return v === r;\n        }\n        catch (e) {\n            return false;\n        }\n    }\n    function recoverPublicKey(signature, message, opts = {}) {\n        const { prehash } = validateSigOpts(opts, defaultSigOpts);\n        message = validateMsgAndHash(message, prehash);\n        return Signature.fromBytes(signature, 'recovered').recoverPublicKey(message).toBytes();\n    }\n    return Object.freeze({\n        keygen,\n        getPublicKey,\n        getSharedSecret,\n        utils,\n        lengths,\n        Point,\n        sign,\n        verify,\n        recoverPublicKey,\n        Signature,\n        hash,\n    });\n}\n/** @deprecated use `weierstrass` in newer releases */\nexport function weierstrassPoints(c) {\n    const { CURVE, curveOpts } = _weierstrass_legacy_opts_to_new(c);\n    const Point = weierstrassN(CURVE, curveOpts);\n    return _weierstrass_new_output_to_legacy(c, Point);\n}\nfunction _weierstrass_legacy_opts_to_new(c) {\n    const CURVE = {\n        a: c.a,\n        b: c.b,\n        p: c.Fp.ORDER,\n        n: c.n,\n        h: c.h,\n        Gx: c.Gx,\n        Gy: c.Gy,\n    };\n    const Fp = c.Fp;\n    let allowedLengths = c.allowedPrivateKeyLengths\n        ? Array.from(new Set(c.allowedPrivateKeyLengths.map((l) => Math.ceil(l / 2))))\n        : undefined;\n    const Fn = Field(CURVE.n, {\n        BITS: c.nBitLength,\n        allowedLengths: allowedLengths,\n        modFromBytes: c.wrapPrivateKey,\n    });\n    const curveOpts = {\n        Fp,\n        Fn,\n        allowInfinityPoint: c.allowInfinityPoint,\n        endo: c.endo,\n        isTorsionFree: c.isTorsionFree,\n        clearCofactor: c.clearCofactor,\n        fromBytes: c.fromBytes,\n        toBytes: c.toBytes,\n    };\n    return { CURVE, curveOpts };\n}\nfunction _ecdsa_legacy_opts_to_new(c) {\n    const { CURVE, curveOpts } = _weierstrass_legacy_opts_to_new(c);\n    const ecdsaOpts = {\n        hmac: c.hmac,\n        randomBytes: c.randomBytes,\n        lowS: c.lowS,\n        bits2int: c.bits2int,\n        bits2int_modN: c.bits2int_modN,\n    };\n    return { CURVE, curveOpts, hash: c.hash, ecdsaOpts };\n}\nexport function _legacyHelperEquat(Fp, a, b) {\n    /**\n     * y² = x³ + ax + b: Short weierstrass curve formula. Takes x, returns y².\n     * @returns y²\n     */\n    function weierstrassEquation(x) {\n        const x2 = Fp.sqr(x); // x * x\n        const x3 = Fp.mul(x2, x); // x² * x\n        return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x³ + a * x + b\n    }\n    return weierstrassEquation;\n}\nfunction _weierstrass_new_output_to_legacy(c, Point) {\n    const { Fp, Fn } = Point;\n    function isWithinCurveOrder(num) {\n        return inRange(num, _1n, Fn.ORDER);\n    }\n    const weierstrassEquation = _legacyHelperEquat(Fp, c.a, c.b);\n    return Object.assign({}, {\n        CURVE: c,\n        Point: Point,\n        ProjectivePoint: Point,\n        normPrivateKeyToScalar: (key) => _normFnElement(Fn, key),\n        weierstrassEquation,\n        isWithinCurveOrder,\n    });\n}\nfunction _ecdsa_new_output_to_legacy(c, _ecdsa) {\n    const Point = _ecdsa.Point;\n    return Object.assign({}, _ecdsa, {\n        ProjectivePoint: Point,\n        CURVE: Object.assign({}, c, nLength(Point.Fn.ORDER, Point.Fn.BITS)),\n    });\n}\n// _ecdsa_legacy\nexport function weierstrass(c) {\n    const { CURVE, curveOpts, hash, ecdsaOpts } = _ecdsa_legacy_opts_to_new(c);\n    const Point = weierstrassN(CURVE, curveOpts);\n    const signs = ecdsa(Point, hash, ecdsaOpts);\n    return _ecdsa_new_output_to_legacy(c, signs);\n}\n//# sourceMappingURL=weierstrass.js.map","/**\n * Utilities for short weierstrass curves, combined with noble-hashes.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { weierstrass } from \"./abstract/weierstrass.js\";\n/** connects noble-curves to noble-hashes */\nexport function getHash(hash) {\n    return { hash };\n}\n/** @deprecated use new `weierstrass()` and `ecdsa()` methods */\nexport function createCurve(curveDef, defHash) {\n    const create = (hash) => weierstrass({ ...curveDef, hash: hash });\n    return { ...create(defHash), create };\n}\n//# sourceMappingURL=_shortw_utils.js.map","/**\n * Internal module for NIST P256, P384, P521 curves.\n * Do not use for now.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha256, sha384, sha512 } from '@noble/hashes/sha2.js';\nimport { createCurve } from \"./_shortw_utils.js\";\nimport { createHasher } from \"./abstract/hash-to-curve.js\";\nimport { Field } from \"./abstract/modular.js\";\nimport { mapToCurveSimpleSWU, } from \"./abstract/weierstrass.js\";\n// p = 2n**224n * (2n**32n-1n) + 2n**192n + 2n**96n - 1n\n// a = Fp256.create(BigInt('-3'));\nconst p256_CURVE = {\n    p: BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff'),\n    n: BigInt('0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'),\n    h: BigInt(1),\n    a: BigInt('0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc'),\n    b: BigInt('0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b'),\n    Gx: BigInt('0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296'),\n    Gy: BigInt('0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5'),\n};\n// p = 2n**384n - 2n**128n - 2n**96n + 2n**32n - 1n\nconst p384_CURVE = {\n    p: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff'),\n    n: BigInt('0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973'),\n    h: BigInt(1),\n    a: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffc'),\n    b: BigInt('0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef'),\n    Gx: BigInt('0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7'),\n    Gy: BigInt('0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f'),\n};\n// p = 2n**521n - 1n\nconst p521_CURVE = {\n    p: BigInt('0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'),\n    n: BigInt('0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409'),\n    h: BigInt(1),\n    a: BigInt('0x1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc'),\n    b: BigInt('0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00'),\n    Gx: BigInt('0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66'),\n    Gy: BigInt('0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650'),\n};\nconst Fp256 = Field(p256_CURVE.p);\nconst Fp384 = Field(p384_CURVE.p);\nconst Fp521 = Field(p521_CURVE.p);\nfunction createSWU(Point, opts) {\n    const map = mapToCurveSimpleSWU(Point.Fp, opts);\n    return (scalars) => map(scalars[0]);\n}\n/** NIST P256 (aka secp256r1, prime256v1) curve, ECDSA and ECDH methods. */\nexport const p256 = createCurve({ ...p256_CURVE, Fp: Fp256, lowS: false }, sha256);\n/** Hashing / encoding to p256 points / field. RFC 9380 methods. */\nexport const p256_hasher = /* @__PURE__ */ (() => {\n    return createHasher(p256.Point, createSWU(p256.Point, {\n        A: p256_CURVE.a,\n        B: p256_CURVE.b,\n        Z: p256.Point.Fp.create(BigInt('-10')),\n    }), {\n        DST: 'P256_XMD:SHA-256_SSWU_RO_',\n        encodeDST: 'P256_XMD:SHA-256_SSWU_NU_',\n        p: p256_CURVE.p,\n        m: 1,\n        k: 128,\n        expand: 'xmd',\n        hash: sha256,\n    });\n})();\n// export const p256_oprf: OPRF = createORPF({\n//   name: 'P256-SHA256',\n//   Point: p256.Point,\n//   hash: sha256,\n//   hashToGroup: p256_hasher.hashToCurve,\n//   hashToScalar: p256_hasher.hashToScalar,\n// });\n/** NIST P384 (aka secp384r1) curve, ECDSA and ECDH methods. */\nexport const p384 = createCurve({ ...p384_CURVE, Fp: Fp384, lowS: false }, sha384);\n/** Hashing / encoding to p384 points / field. RFC 9380 methods. */\nexport const p384_hasher = /* @__PURE__ */ (() => {\n    return createHasher(p384.Point, createSWU(p384.Point, {\n        A: p384_CURVE.a,\n        B: p384_CURVE.b,\n        Z: p384.Point.Fp.create(BigInt('-12')),\n    }), {\n        DST: 'P384_XMD:SHA-384_SSWU_RO_',\n        encodeDST: 'P384_XMD:SHA-384_SSWU_NU_',\n        p: p384_CURVE.p,\n        m: 1,\n        k: 192,\n        expand: 'xmd',\n        hash: sha384,\n    });\n})();\n// export const p384_oprf: OPRF = createORPF({\n//   name: 'P384-SHA384',\n//   Point: p384.Point,\n//   hash: sha384,\n//   hashToGroup: p384_hasher.hashToCurve,\n//   hashToScalar: p384_hasher.hashToScalar,\n// });\n// const Fn521 = Field(p521_CURVE.n, { allowedScalarLengths: [65, 66] });\n/** NIST P521 (aka secp521r1) curve, ECDSA and ECDH methods. */\nexport const p521 = createCurve({ ...p521_CURVE, Fp: Fp521, lowS: false, allowedPrivateKeyLengths: [130, 131, 132] }, sha512);\n/** @deprecated use `p256` for consistency with `p256_hasher` */\nexport const secp256r1 = p256;\n/** @deprecated use `p384` for consistency with `p384_hasher` */\nexport const secp384r1 = p384;\n/** @deprecated use `p521` for consistency with `p521_hasher` */\nexport const secp521r1 = p521;\n/** Hashing / encoding to p521 points / field. RFC 9380 methods. */\nexport const p521_hasher = /* @__PURE__ */ (() => {\n    return createHasher(p521.Point, createSWU(p521.Point, {\n        A: p521_CURVE.a,\n        B: p521_CURVE.b,\n        Z: p521.Point.Fp.create(BigInt('-4')),\n    }), {\n        DST: 'P521_XMD:SHA-512_SSWU_RO_',\n        encodeDST: 'P521_XMD:SHA-512_SSWU_NU_',\n        p: p521_CURVE.p,\n        m: 1,\n        k: 256,\n        expand: 'xmd',\n        hash: sha512,\n    });\n})();\n// export const p521_oprf: OPRF = createORPF({\n//   name: 'P521-SHA512',\n//   Point: p521.Point,\n//   hash: sha512,\n//   hashToGroup: p521_hasher.hashToCurve,\n//   hashToScalar: p521_hasher.hashToScalar, // produces L=98 just like in RFC\n// });\n//# sourceMappingURL=nist.js.map","/**\n * NIST secp256r1 aka p256.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport {} from \"./abstract/hash-to-curve.js\";\nimport { p256_hasher, p256 as p256n } from \"./nist.js\";\n/** @deprecated use `import { p256 } from '@noble/curves/nist.js';` */\nexport const p256 = p256n;\n/** @deprecated use `import { p256 } from '@noble/curves/nist.js';` */\nexport const secp256r1 = p256n;\n/** @deprecated use `import { p256_hasher } from '@noble/curves/nist.js';` */\nexport const hashToCurve = /* @__PURE__ */ (() => p256_hasher.hashToCurve)();\n/** @deprecated use `import { p256_hasher } from '@noble/curves/nist.js';` */\nexport const encodeToCurve = /* @__PURE__ */ (() => p256_hasher.encodeToCurve)();\n//# sourceMappingURL=p256.js.map","/**\n * NIST secp384r1 aka p384.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport {} from \"./abstract/hash-to-curve.js\";\nimport { p384_hasher, p384 as p384n } from \"./nist.js\";\n/** @deprecated use `import { p384 } from '@noble/curves/nist.js';` */\nexport const p384 = p384n;\n/** @deprecated use `import { p384 } from '@noble/curves/nist.js';` */\nexport const secp384r1 = p384n;\n/** @deprecated use `import { p384_hasher } from '@noble/curves/nist.js';` */\nexport const hashToCurve = /* @__PURE__ */ (() => p384_hasher.hashToCurve)();\n/** @deprecated use `import { p384_hasher } from '@noble/curves/nist.js';` */\nexport const encodeToCurve = /* @__PURE__ */ (() => p384_hasher.encodeToCurve)();\n//# sourceMappingURL=p384.js.map","/**\n * NIST secp521r1 aka p521.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport {} from \"./abstract/hash-to-curve.js\";\nimport { p521_hasher, p521 as p521n } from \"./nist.js\";\n/** @deprecated use `import { p521 } from '@noble/curves/nist.js';` */\nexport const p521 = p521n;\n/** @deprecated use `import { p521 } from '@noble/curves/nist.js';` */\nexport const secp521r1 = p521n;\n/** @deprecated use `import { p521_hasher } from '@noble/curves/nist.js';` */\nexport const hashToCurve = /* @__PURE__ */ (() => p521_hasher.hashToCurve)();\n/** @deprecated use `import { p521_hasher } from '@noble/curves/nist.js';` */\nexport const encodeToCurve = /* @__PURE__ */ (() => p521_hasher.encodeToCurve)();\n//# sourceMappingURL=p521.js.map","/**\n * Twisted Edwards curve. The formula is: ax² + y² = 1 + dx²y².\n * For design rationale of types / exports, see weierstrass module documentation.\n * Untwisted Edwards curves exist, but they aren't used in real-world protocols.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { _validateObject, _abool2 as abool, _abytes2 as abytes, aInRange, bytesToHex, bytesToNumberLE, concatBytes, copyBytes, ensureBytes, isBytes, memoized, notImplemented, randomBytes as randomBytesWeb, } from \"../utils.js\";\nimport { _createCurveFields, normalizeZ, pippenger, wNAF, } from \"./curve.js\";\nimport { Field } from \"./modular.js\";\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _8n = BigInt(8);\nfunction isEdValidXY(Fp, CURVE, x, y) {\n    const x2 = Fp.sqr(x);\n    const y2 = Fp.sqr(y);\n    const left = Fp.add(Fp.mul(CURVE.a, x2), y2);\n    const right = Fp.add(Fp.ONE, Fp.mul(CURVE.d, Fp.mul(x2, y2)));\n    return Fp.eql(left, right);\n}\nexport function edwards(params, extraOpts = {}) {\n    const validated = _createCurveFields('edwards', params, extraOpts, extraOpts.FpFnLE);\n    const { Fp, Fn } = validated;\n    let CURVE = validated.CURVE;\n    const { h: cofactor } = CURVE;\n    _validateObject(extraOpts, {}, { uvRatio: 'function' });\n    // Important:\n    // There are some places where Fp.BYTES is used instead of nByteLength.\n    // So far, everything has been tested with curves of Fp.BYTES == nByteLength.\n    // TODO: test and find curves which behave otherwise.\n    const MASK = _2n << (BigInt(Fn.BYTES * 8) - _1n);\n    const modP = (n) => Fp.create(n); // Function overrides\n    // sqrt(u/v)\n    const uvRatio = extraOpts.uvRatio ||\n        ((u, v) => {\n            try {\n                return { isValid: true, value: Fp.sqrt(Fp.div(u, v)) };\n            }\n            catch (e) {\n                return { isValid: false, value: _0n };\n            }\n        });\n    // Validate whether the passed curve params are valid.\n    // equation ax² + y² = 1 + dx²y² should work for generator point.\n    if (!isEdValidXY(Fp, CURVE, CURVE.Gx, CURVE.Gy))\n        throw new Error('bad curve params: generator point');\n    /**\n     * Asserts coordinate is valid: 0 <= n < MASK.\n     * Coordinates >= Fp.ORDER are allowed for zip215.\n     */\n    function acoord(title, n, banZero = false) {\n        const min = banZero ? _1n : _0n;\n        aInRange('coordinate ' + title, n, min, MASK);\n        return n;\n    }\n    function aextpoint(other) {\n        if (!(other instanceof Point))\n            throw new Error('ExtendedPoint expected');\n    }\n    // Converts Extended point to default (x, y) coordinates.\n    // Can accept precomputed Z^-1 - for example, from invertBatch.\n    const toAffineMemo = memoized((p, iz) => {\n        const { X, Y, Z } = p;\n        const is0 = p.is0();\n        if (iz == null)\n            iz = is0 ? _8n : Fp.inv(Z); // 8 was chosen arbitrarily\n        const x = modP(X * iz);\n        const y = modP(Y * iz);\n        const zz = Fp.mul(Z, iz);\n        if (is0)\n            return { x: _0n, y: _1n };\n        if (zz !== _1n)\n            throw new Error('invZ was invalid');\n        return { x, y };\n    });\n    const assertValidMemo = memoized((p) => {\n        const { a, d } = CURVE;\n        if (p.is0())\n            throw new Error('bad point: ZERO'); // TODO: optimize, with vars below?\n        // Equation in affine coordinates: ax² + y² = 1 + dx²y²\n        // Equation in projective coordinates (X/Z, Y/Z, Z):  (aX² + Y²)Z² = Z⁴ + dX²Y²\n        const { X, Y, Z, T } = p;\n        const X2 = modP(X * X); // X²\n        const Y2 = modP(Y * Y); // Y²\n        const Z2 = modP(Z * Z); // Z²\n        const Z4 = modP(Z2 * Z2); // Z⁴\n        const aX2 = modP(X2 * a); // aX²\n        const left = modP(Z2 * modP(aX2 + Y2)); // (aX² + Y²)Z²\n        const right = modP(Z4 + modP(d * modP(X2 * Y2))); // Z⁴ + dX²Y²\n        if (left !== right)\n            throw new Error('bad point: equation left != right (1)');\n        // In Extended coordinates we also have T, which is x*y=T/Z: check X*Y == Z*T\n        const XY = modP(X * Y);\n        const ZT = modP(Z * T);\n        if (XY !== ZT)\n            throw new Error('bad point: equation left != right (2)');\n        return true;\n    });\n    // Extended Point works in extended coordinates: (X, Y, Z, T) ∋ (x=X/Z, y=Y/Z, T=xy).\n    // https://en.wikipedia.org/wiki/Twisted_Edwards_curve#Extended_coordinates\n    class Point {\n        constructor(X, Y, Z, T) {\n            this.X = acoord('x', X);\n            this.Y = acoord('y', Y);\n            this.Z = acoord('z', Z, true);\n            this.T = acoord('t', T);\n            Object.freeze(this);\n        }\n        static CURVE() {\n            return CURVE;\n        }\n        static fromAffine(p) {\n            if (p instanceof Point)\n                throw new Error('extended point not allowed');\n            const { x, y } = p || {};\n            acoord('x', x);\n            acoord('y', y);\n            return new Point(x, y, _1n, modP(x * y));\n        }\n        // Uses algo from RFC8032 5.1.3.\n        static fromBytes(bytes, zip215 = false) {\n            const len = Fp.BYTES;\n            const { a, d } = CURVE;\n            bytes = copyBytes(abytes(bytes, len, 'point'));\n            abool(zip215, 'zip215');\n            const normed = copyBytes(bytes); // copy again, we'll manipulate it\n            const lastByte = bytes[len - 1]; // select last byte\n            normed[len - 1] = lastByte & ~0x80; // clear last bit\n            const y = bytesToNumberLE(normed);\n            // zip215=true is good for consensus-critical apps. =false follows RFC8032 / NIST186-5.\n            // RFC8032 prohibits >= p, but ZIP215 doesn't\n            // zip215=true:  0 <= y < MASK (2^256 for ed25519)\n            // zip215=false: 0 <= y < P (2^255-19 for ed25519)\n            const max = zip215 ? MASK : Fp.ORDER;\n            aInRange('point.y', y, _0n, max);\n            // Ed25519: x² = (y²-1)/(dy²+1) mod p. Ed448: x² = (y²-1)/(dy²-1) mod p. Generic case:\n            // ax²+y²=1+dx²y² => y²-1=dx²y²-ax² => y²-1=x²(dy²-a) => x²=(y²-1)/(dy²-a)\n            const y2 = modP(y * y); // denominator is always non-0 mod p.\n            const u = modP(y2 - _1n); // u = y² - 1\n            const v = modP(d * y2 - a); // v = d y² + 1.\n            let { isValid, value: x } = uvRatio(u, v); // √(u/v)\n            if (!isValid)\n                throw new Error('bad point: invalid y coordinate');\n            const isXOdd = (x & _1n) === _1n; // There are 2 square roots. Use x_0 bit to select proper\n            const isLastByteOdd = (lastByte & 0x80) !== 0; // x_0, last bit\n            if (!zip215 && x === _0n && isLastByteOdd)\n                // if x=0 and x_0 = 1, fail\n                throw new Error('bad point: x=0 and x_0=1');\n            if (isLastByteOdd !== isXOdd)\n                x = modP(-x); // if x_0 != x mod 2, set x = p-x\n            return Point.fromAffine({ x, y });\n        }\n        static fromHex(bytes, zip215 = false) {\n            return Point.fromBytes(ensureBytes('point', bytes), zip215);\n        }\n        get x() {\n            return this.toAffine().x;\n        }\n        get y() {\n            return this.toAffine().y;\n        }\n        precompute(windowSize = 8, isLazy = true) {\n            wnaf.createCache(this, windowSize);\n            if (!isLazy)\n                this.multiply(_2n); // random number\n            return this;\n        }\n        // Useful in fromAffine() - not for fromBytes(), which always created valid points.\n        assertValidity() {\n            assertValidMemo(this);\n        }\n        // Compare one point to another.\n        equals(other) {\n            aextpoint(other);\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            const { X: X2, Y: Y2, Z: Z2 } = other;\n            const X1Z2 = modP(X1 * Z2);\n            const X2Z1 = modP(X2 * Z1);\n            const Y1Z2 = modP(Y1 * Z2);\n            const Y2Z1 = modP(Y2 * Z1);\n            return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;\n        }\n        is0() {\n            return this.equals(Point.ZERO);\n        }\n        negate() {\n            // Flips point sign to a negative one (-x, y in affine coords)\n            return new Point(modP(-this.X), this.Y, this.Z, modP(-this.T));\n        }\n        // Fast algo for doubling Extended Point.\n        // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd\n        // Cost: 4M + 4S + 1*a + 6add + 1*2.\n        double() {\n            const { a } = CURVE;\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            const A = modP(X1 * X1); // A = X12\n            const B = modP(Y1 * Y1); // B = Y12\n            const C = modP(_2n * modP(Z1 * Z1)); // C = 2*Z12\n            const D = modP(a * A); // D = a*A\n            const x1y1 = X1 + Y1;\n            const E = modP(modP(x1y1 * x1y1) - A - B); // E = (X1+Y1)2-A-B\n            const G = D + B; // G = D+B\n            const F = G - C; // F = G-C\n            const H = D - B; // H = D-B\n            const X3 = modP(E * F); // X3 = E*F\n            const Y3 = modP(G * H); // Y3 = G*H\n            const T3 = modP(E * H); // T3 = E*H\n            const Z3 = modP(F * G); // Z3 = F*G\n            return new Point(X3, Y3, Z3, T3);\n        }\n        // Fast algo for adding 2 Extended Points.\n        // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd\n        // Cost: 9M + 1*a + 1*d + 7add.\n        add(other) {\n            aextpoint(other);\n            const { a, d } = CURVE;\n            const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;\n            const { X: X2, Y: Y2, Z: Z2, T: T2 } = other;\n            const A = modP(X1 * X2); // A = X1*X2\n            const B = modP(Y1 * Y2); // B = Y1*Y2\n            const C = modP(T1 * d * T2); // C = T1*d*T2\n            const D = modP(Z1 * Z2); // D = Z1*Z2\n            const E = modP((X1 + Y1) * (X2 + Y2) - A - B); // E = (X1+Y1)*(X2+Y2)-A-B\n            const F = D - C; // F = D-C\n            const G = D + C; // G = D+C\n            const H = modP(B - a * A); // H = B-a*A\n            const X3 = modP(E * F); // X3 = E*F\n            const Y3 = modP(G * H); // Y3 = G*H\n            const T3 = modP(E * H); // T3 = E*H\n            const Z3 = modP(F * G); // Z3 = F*G\n            return new Point(X3, Y3, Z3, T3);\n        }\n        subtract(other) {\n            return this.add(other.negate());\n        }\n        // Constant-time multiplication.\n        multiply(scalar) {\n            // 1 <= scalar < L\n            if (!Fn.isValidNot0(scalar))\n                throw new Error('invalid scalar: expected 1 <= sc < curve.n');\n            const { p, f } = wnaf.cached(this, scalar, (p) => normalizeZ(Point, p));\n            return normalizeZ(Point, [p, f])[0];\n        }\n        // Non-constant-time multiplication. Uses double-and-add algorithm.\n        // It's faster, but should only be used when you don't care about\n        // an exposed private key e.g. sig verification.\n        // Does NOT allow scalars higher than CURVE.n.\n        // Accepts optional accumulator to merge with multiply (important for sparse scalars)\n        multiplyUnsafe(scalar, acc = Point.ZERO) {\n            // 0 <= scalar < L\n            if (!Fn.isValid(scalar))\n                throw new Error('invalid scalar: expected 0 <= sc < curve.n');\n            if (scalar === _0n)\n                return Point.ZERO;\n            if (this.is0() || scalar === _1n)\n                return this;\n            return wnaf.unsafe(this, scalar, (p) => normalizeZ(Point, p), acc);\n        }\n        // Checks if point is of small order.\n        // If you add something to small order point, you will have \"dirty\"\n        // point with torsion component.\n        // Multiplies point by cofactor and checks if the result is 0.\n        isSmallOrder() {\n            return this.multiplyUnsafe(cofactor).is0();\n        }\n        // Multiplies point by curve order and checks if the result is 0.\n        // Returns `false` is the point is dirty.\n        isTorsionFree() {\n            return wnaf.unsafe(this, CURVE.n).is0();\n        }\n        // Converts Extended point to default (x, y) coordinates.\n        // Can accept precomputed Z^-1 - for example, from invertBatch.\n        toAffine(invertedZ) {\n            return toAffineMemo(this, invertedZ);\n        }\n        clearCofactor() {\n            if (cofactor === _1n)\n                return this;\n            return this.multiplyUnsafe(cofactor);\n        }\n        toBytes() {\n            const { x, y } = this.toAffine();\n            // Fp.toBytes() allows non-canonical encoding of y (>= p).\n            const bytes = Fp.toBytes(y);\n            // Each y has 2 valid points: (x, y), (x,-y).\n            // When compressing, it's enough to store y and use the last byte to encode sign of x\n            bytes[bytes.length - 1] |= x & _1n ? 0x80 : 0;\n            return bytes;\n        }\n        toHex() {\n            return bytesToHex(this.toBytes());\n        }\n        toString() {\n            return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;\n        }\n        // TODO: remove\n        get ex() {\n            return this.X;\n        }\n        get ey() {\n            return this.Y;\n        }\n        get ez() {\n            return this.Z;\n        }\n        get et() {\n            return this.T;\n        }\n        static normalizeZ(points) {\n            return normalizeZ(Point, points);\n        }\n        static msm(points, scalars) {\n            return pippenger(Point, Fn, points, scalars);\n        }\n        _setWindowSize(windowSize) {\n            this.precompute(windowSize);\n        }\n        toRawBytes() {\n            return this.toBytes();\n        }\n    }\n    // base / generator point\n    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, _1n, modP(CURVE.Gx * CURVE.Gy));\n    // zero / infinity / identity point\n    Point.ZERO = new Point(_0n, _1n, _1n, _0n); // 0, 1, 1, 0\n    // math field\n    Point.Fp = Fp;\n    // scalar field\n    Point.Fn = Fn;\n    const wnaf = new wNAF(Point, Fn.BITS);\n    Point.BASE.precompute(8); // Enable precomputes. Slows down first publicKey computation by 20ms.\n    return Point;\n}\n/**\n * Base class for prime-order points like Ristretto255 and Decaf448.\n * These points eliminate cofactor issues by representing equivalence classes\n * of Edwards curve points.\n */\nexport class PrimeEdwardsPoint {\n    constructor(ep) {\n        this.ep = ep;\n    }\n    // Static methods that must be implemented by subclasses\n    static fromBytes(_bytes) {\n        notImplemented();\n    }\n    static fromHex(_hex) {\n        notImplemented();\n    }\n    get x() {\n        return this.toAffine().x;\n    }\n    get y() {\n        return this.toAffine().y;\n    }\n    // Common implementations\n    clearCofactor() {\n        // no-op for prime-order groups\n        return this;\n    }\n    assertValidity() {\n        this.ep.assertValidity();\n    }\n    toAffine(invertedZ) {\n        return this.ep.toAffine(invertedZ);\n    }\n    toHex() {\n        return bytesToHex(this.toBytes());\n    }\n    toString() {\n        return this.toHex();\n    }\n    isTorsionFree() {\n        return true;\n    }\n    isSmallOrder() {\n        return false;\n    }\n    add(other) {\n        this.assertSame(other);\n        return this.init(this.ep.add(other.ep));\n    }\n    subtract(other) {\n        this.assertSame(other);\n        return this.init(this.ep.subtract(other.ep));\n    }\n    multiply(scalar) {\n        return this.init(this.ep.multiply(scalar));\n    }\n    multiplyUnsafe(scalar) {\n        return this.init(this.ep.multiplyUnsafe(scalar));\n    }\n    double() {\n        return this.init(this.ep.double());\n    }\n    negate() {\n        return this.init(this.ep.negate());\n    }\n    precompute(windowSize, isLazy) {\n        return this.init(this.ep.precompute(windowSize, isLazy));\n    }\n    /** @deprecated use `toBytes` */\n    toRawBytes() {\n        return this.toBytes();\n    }\n}\n/**\n * Initializes EdDSA signatures over given Edwards curve.\n */\nexport function eddsa(Point, cHash, eddsaOpts = {}) {\n    if (typeof cHash !== 'function')\n        throw new Error('\"hash\" function param is required');\n    _validateObject(eddsaOpts, {}, {\n        adjustScalarBytes: 'function',\n        randomBytes: 'function',\n        domain: 'function',\n        prehash: 'function',\n        mapToCurve: 'function',\n    });\n    const { prehash } = eddsaOpts;\n    const { BASE, Fp, Fn } = Point;\n    const randomBytes = eddsaOpts.randomBytes || randomBytesWeb;\n    const adjustScalarBytes = eddsaOpts.adjustScalarBytes || ((bytes) => bytes);\n    const domain = eddsaOpts.domain ||\n        ((data, ctx, phflag) => {\n            abool(phflag, 'phflag');\n            if (ctx.length || phflag)\n                throw new Error('Contexts/pre-hash are not supported');\n            return data;\n        }); // NOOP\n    // Little-endian SHA512 with modulo n\n    function modN_LE(hash) {\n        return Fn.create(bytesToNumberLE(hash)); // Not Fn.fromBytes: it has length limit\n    }\n    // Get the hashed private scalar per RFC8032 5.1.5\n    function getPrivateScalar(key) {\n        const len = lengths.secretKey;\n        key = ensureBytes('private key', key, len);\n        // Hash private key with curve's hash function to produce uniformingly random input\n        // Check byte lengths: ensure(64, h(ensure(32, key)))\n        const hashed = ensureBytes('hashed private key', cHash(key), 2 * len);\n        const head = adjustScalarBytes(hashed.slice(0, len)); // clear first half bits, produce FE\n        const prefix = hashed.slice(len, 2 * len); // second half is called key prefix (5.1.6)\n        const scalar = modN_LE(head); // The actual private scalar\n        return { head, prefix, scalar };\n    }\n    /** Convenience method that creates public key from scalar. RFC8032 5.1.5 */\n    function getExtendedPublicKey(secretKey) {\n        const { head, prefix, scalar } = getPrivateScalar(secretKey);\n        const point = BASE.multiply(scalar); // Point on Edwards curve aka public key\n        const pointBytes = point.toBytes();\n        return { head, prefix, scalar, point, pointBytes };\n    }\n    /** Calculates EdDSA pub key. RFC8032 5.1.5. */\n    function getPublicKey(secretKey) {\n        return getExtendedPublicKey(secretKey).pointBytes;\n    }\n    // int('LE', SHA512(dom2(F, C) || msgs)) mod N\n    function hashDomainToScalar(context = Uint8Array.of(), ...msgs) {\n        const msg = concatBytes(...msgs);\n        return modN_LE(cHash(domain(msg, ensureBytes('context', context), !!prehash)));\n    }\n    /** Signs message with privateKey. RFC8032 5.1.6 */\n    function sign(msg, secretKey, options = {}) {\n        msg = ensureBytes('message', msg);\n        if (prehash)\n            msg = prehash(msg); // for ed25519ph etc.\n        const { prefix, scalar, pointBytes } = getExtendedPublicKey(secretKey);\n        const r = hashDomainToScalar(options.context, prefix, msg); // r = dom2(F, C) || prefix || PH(M)\n        const R = BASE.multiply(r).toBytes(); // R = rG\n        const k = hashDomainToScalar(options.context, R, pointBytes, msg); // R || A || PH(M)\n        const s = Fn.create(r + k * scalar); // S = (r + k * s) mod L\n        if (!Fn.isValid(s))\n            throw new Error('sign failed: invalid s'); // 0 <= s < L\n        const rs = concatBytes(R, Fn.toBytes(s));\n        return abytes(rs, lengths.signature, 'result');\n    }\n    // verification rule is either zip215 or rfc8032 / nist186-5. Consult fromHex:\n    const verifyOpts = { zip215: true };\n    /**\n     * Verifies EdDSA signature against message and public key. RFC8032 5.1.7.\n     * An extended group equation is checked.\n     */\n    function verify(sig, msg, publicKey, options = verifyOpts) {\n        const { context, zip215 } = options;\n        const len = lengths.signature;\n        sig = ensureBytes('signature', sig, len);\n        msg = ensureBytes('message', msg);\n        publicKey = ensureBytes('publicKey', publicKey, lengths.publicKey);\n        if (zip215 !== undefined)\n            abool(zip215, 'zip215');\n        if (prehash)\n            msg = prehash(msg); // for ed25519ph, etc\n        const mid = len / 2;\n        const r = sig.subarray(0, mid);\n        const s = bytesToNumberLE(sig.subarray(mid, len));\n        let A, R, SB;\n        try {\n            // zip215=true is good for consensus-critical apps. =false follows RFC8032 / NIST186-5.\n            // zip215=true:  0 <= y < MASK (2^256 for ed25519)\n            // zip215=false: 0 <= y < P (2^255-19 for ed25519)\n            A = Point.fromBytes(publicKey, zip215);\n            R = Point.fromBytes(r, zip215);\n            SB = BASE.multiplyUnsafe(s); // 0 <= s < l is done inside\n        }\n        catch (error) {\n            return false;\n        }\n        if (!zip215 && A.isSmallOrder())\n            return false; // zip215 allows public keys of small order\n        const k = hashDomainToScalar(context, R.toBytes(), A.toBytes(), msg);\n        const RkA = R.add(A.multiplyUnsafe(k));\n        // Extended group equation\n        // [8][S]B = [8]R + [8][k]A'\n        return RkA.subtract(SB).clearCofactor().is0();\n    }\n    const _size = Fp.BYTES; // 32 for ed25519, 57 for ed448\n    const lengths = {\n        secretKey: _size,\n        publicKey: _size,\n        signature: 2 * _size,\n        seed: _size,\n    };\n    function randomSecretKey(seed = randomBytes(lengths.seed)) {\n        return abytes(seed, lengths.seed, 'seed');\n    }\n    function keygen(seed) {\n        const secretKey = utils.randomSecretKey(seed);\n        return { secretKey, publicKey: getPublicKey(secretKey) };\n    }\n    function isValidSecretKey(key) {\n        return isBytes(key) && key.length === Fn.BYTES;\n    }\n    function isValidPublicKey(key, zip215) {\n        try {\n            return !!Point.fromBytes(key, zip215);\n        }\n        catch (error) {\n            return false;\n        }\n    }\n    const utils = {\n        getExtendedPublicKey,\n        randomSecretKey,\n        isValidSecretKey,\n        isValidPublicKey,\n        /**\n         * Converts ed public key to x public key. Uses formula:\n         * - ed25519:\n         *   - `(u, v) = ((1+y)/(1-y), sqrt(-486664)*u/x)`\n         *   - `(x, y) = (sqrt(-486664)*u/v, (u-1)/(u+1))`\n         * - ed448:\n         *   - `(u, v) = ((y-1)/(y+1), sqrt(156324)*u/x)`\n         *   - `(x, y) = (sqrt(156324)*u/v, (1+u)/(1-u))`\n         */\n        toMontgomery(publicKey) {\n            const { y } = Point.fromBytes(publicKey);\n            const size = lengths.publicKey;\n            const is25519 = size === 32;\n            if (!is25519 && size !== 57)\n                throw new Error('only defined for 25519 and 448');\n            const u = is25519 ? Fp.div(_1n + y, _1n - y) : Fp.div(y - _1n, y + _1n);\n            return Fp.toBytes(u);\n        },\n        toMontgomerySecret(secretKey) {\n            const size = lengths.secretKey;\n            abytes(secretKey, size);\n            const hashed = cHash(secretKey.subarray(0, size));\n            return adjustScalarBytes(hashed).subarray(0, size);\n        },\n        /** @deprecated */\n        randomPrivateKey: randomSecretKey,\n        /** @deprecated */\n        precompute(windowSize = 8, point = Point.BASE) {\n            return point.precompute(windowSize, false);\n        },\n    };\n    return Object.freeze({\n        keygen,\n        getPublicKey,\n        sign,\n        verify,\n        utils,\n        Point,\n        lengths,\n    });\n}\nfunction _eddsa_legacy_opts_to_new(c) {\n    const CURVE = {\n        a: c.a,\n        d: c.d,\n        p: c.Fp.ORDER,\n        n: c.n,\n        h: c.h,\n        Gx: c.Gx,\n        Gy: c.Gy,\n    };\n    const Fp = c.Fp;\n    const Fn = Field(CURVE.n, c.nBitLength, true);\n    const curveOpts = { Fp, Fn, uvRatio: c.uvRatio };\n    const eddsaOpts = {\n        randomBytes: c.randomBytes,\n        adjustScalarBytes: c.adjustScalarBytes,\n        domain: c.domain,\n        prehash: c.prehash,\n        mapToCurve: c.mapToCurve,\n    };\n    return { CURVE, curveOpts, hash: c.hash, eddsaOpts };\n}\nfunction _eddsa_new_output_to_legacy(c, eddsa) {\n    const Point = eddsa.Point;\n    const legacy = Object.assign({}, eddsa, {\n        ExtendedPoint: Point,\n        CURVE: c,\n        nBitLength: Point.Fn.BITS,\n        nByteLength: Point.Fn.BYTES,\n    });\n    return legacy;\n}\n// TODO: remove. Use eddsa\nexport function twistedEdwards(c) {\n    const { CURVE, curveOpts, hash, eddsaOpts } = _eddsa_legacy_opts_to_new(c);\n    const Point = edwards(CURVE, curveOpts);\n    const EDDSA = eddsa(Point, hash, eddsaOpts);\n    return _eddsa_new_output_to_legacy(c, EDDSA);\n}\n//# sourceMappingURL=edwards.js.map","/**\n * Montgomery curve methods. It's not really whole montgomery curve,\n * just bunch of very specific methods for X25519 / X448 from\n * [RFC 7748](https://www.rfc-editor.org/rfc/rfc7748)\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { _validateObject, abytes, aInRange, bytesToNumberLE, ensureBytes, numberToBytesLE, randomBytes, } from \"../utils.js\";\nimport { mod } from \"./modular.js\";\nconst _0n = BigInt(0);\nconst _1n = BigInt(1);\nconst _2n = BigInt(2);\nfunction validateOpts(curve) {\n    _validateObject(curve, {\n        adjustScalarBytes: 'function',\n        powPminus2: 'function',\n    });\n    return Object.freeze({ ...curve });\n}\nexport function montgomery(curveDef) {\n    const CURVE = validateOpts(curveDef);\n    const { P, type, adjustScalarBytes, powPminus2, randomBytes: rand } = CURVE;\n    const is25519 = type === 'x25519';\n    if (!is25519 && type !== 'x448')\n        throw new Error('invalid type');\n    const randomBytes_ = rand || randomBytes;\n    const montgomeryBits = is25519 ? 255 : 448;\n    const fieldLen = is25519 ? 32 : 56;\n    const Gu = is25519 ? BigInt(9) : BigInt(5);\n    // RFC 7748 #5:\n    // The constant a24 is (486662 - 2) / 4 = 121665 for curve25519/X25519 and\n    // (156326 - 2) / 4 = 39081 for curve448/X448\n    // const a = is25519 ? 156326n : 486662n;\n    const a24 = is25519 ? BigInt(121665) : BigInt(39081);\n    // RFC: x25519 \"the resulting integer is of the form 2^254 plus\n    // eight times a value between 0 and 2^251 - 1 (inclusive)\"\n    // x448: \"2^447 plus four times a value between 0 and 2^445 - 1 (inclusive)\"\n    const minScalar = is25519 ? _2n ** BigInt(254) : _2n ** BigInt(447);\n    const maxAdded = is25519\n        ? BigInt(8) * _2n ** BigInt(251) - _1n\n        : BigInt(4) * _2n ** BigInt(445) - _1n;\n    const maxScalar = minScalar + maxAdded + _1n; // (inclusive)\n    const modP = (n) => mod(n, P);\n    const GuBytes = encodeU(Gu);\n    function encodeU(u) {\n        return numberToBytesLE(modP(u), fieldLen);\n    }\n    function decodeU(u) {\n        const _u = ensureBytes('u coordinate', u, fieldLen);\n        // RFC: When receiving such an array, implementations of X25519\n        // (but not X448) MUST mask the most significant bit in the final byte.\n        if (is25519)\n            _u[31] &= 127; // 0b0111_1111\n        // RFC: Implementations MUST accept non-canonical values and process them as\n        // if they had been reduced modulo the field prime.  The non-canonical\n        // values are 2^255 - 19 through 2^255 - 1 for X25519 and 2^448 - 2^224\n        // - 1 through 2^448 - 1 for X448.\n        return modP(bytesToNumberLE(_u));\n    }\n    function decodeScalar(scalar) {\n        return bytesToNumberLE(adjustScalarBytes(ensureBytes('scalar', scalar, fieldLen)));\n    }\n    function scalarMult(scalar, u) {\n        const pu = montgomeryLadder(decodeU(u), decodeScalar(scalar));\n        // Some public keys are useless, of low-order. Curve author doesn't think\n        // it needs to be validated, but we do it nonetheless.\n        // https://cr.yp.to/ecdh.html#validate\n        if (pu === _0n)\n            throw new Error('invalid private or public key received');\n        return encodeU(pu);\n    }\n    // Computes public key from private. By doing scalar multiplication of base point.\n    function scalarMultBase(scalar) {\n        return scalarMult(scalar, GuBytes);\n    }\n    // cswap from RFC7748 \"example code\"\n    function cswap(swap, x_2, x_3) {\n        // dummy = mask(swap) AND (x_2 XOR x_3)\n        // Where mask(swap) is the all-1 or all-0 word of the same length as x_2\n        // and x_3, computed, e.g., as mask(swap) = 0 - swap.\n        const dummy = modP(swap * (x_2 - x_3));\n        x_2 = modP(x_2 - dummy); // x_2 = x_2 XOR dummy\n        x_3 = modP(x_3 + dummy); // x_3 = x_3 XOR dummy\n        return { x_2, x_3 };\n    }\n    /**\n     * Montgomery x-only multiplication ladder.\n     * @param pointU u coordinate (x) on Montgomery Curve 25519\n     * @param scalar by which the point would be multiplied\n     * @returns new Point on Montgomery curve\n     */\n    function montgomeryLadder(u, scalar) {\n        aInRange('u', u, _0n, P);\n        aInRange('scalar', scalar, minScalar, maxScalar);\n        const k = scalar;\n        const x_1 = u;\n        let x_2 = _1n;\n        let z_2 = _0n;\n        let x_3 = u;\n        let z_3 = _1n;\n        let swap = _0n;\n        for (let t = BigInt(montgomeryBits - 1); t >= _0n; t--) {\n            const k_t = (k >> t) & _1n;\n            swap ^= k_t;\n            ({ x_2, x_3 } = cswap(swap, x_2, x_3));\n            ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));\n            swap = k_t;\n            const A = x_2 + z_2;\n            const AA = modP(A * A);\n            const B = x_2 - z_2;\n            const BB = modP(B * B);\n            const E = AA - BB;\n            const C = x_3 + z_3;\n            const D = x_3 - z_3;\n            const DA = modP(D * A);\n            const CB = modP(C * B);\n            const dacb = DA + CB;\n            const da_cb = DA - CB;\n            x_3 = modP(dacb * dacb);\n            z_3 = modP(x_1 * modP(da_cb * da_cb));\n            x_2 = modP(AA * BB);\n            z_2 = modP(E * (AA + modP(a24 * E)));\n        }\n        ({ x_2, x_3 } = cswap(swap, x_2, x_3));\n        ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));\n        const z2 = powPminus2(z_2); // `Fp.pow(x, P - _2n)` is much slower equivalent\n        return modP(x_2 * z2); // Return x_2 * (z_2^(p - 2))\n    }\n    const lengths = {\n        secretKey: fieldLen,\n        publicKey: fieldLen,\n        seed: fieldLen,\n    };\n    const randomSecretKey = (seed = randomBytes_(fieldLen)) => {\n        abytes(seed, lengths.seed);\n        return seed;\n    };\n    function keygen(seed) {\n        const secretKey = randomSecretKey(seed);\n        return { secretKey, publicKey: scalarMultBase(secretKey) };\n    }\n    const utils = {\n        randomSecretKey,\n        randomPrivateKey: randomSecretKey,\n    };\n    return {\n        keygen,\n        getSharedSecret: (secretKey, publicKey) => scalarMult(secretKey, publicKey),\n        getPublicKey: (secretKey) => scalarMultBase(secretKey),\n        scalarMult,\n        scalarMultBase,\n        utils,\n        GuBytes: GuBytes.slice(),\n        lengths,\n    };\n}\n//# sourceMappingURL=montgomery.js.map","/**\n * Edwards448 (not Ed448-Goldilocks) curve with following addons:\n * - X448 ECDH\n * - Decaf cofactor elimination\n * - Elligator hash-to-group / point indistinguishability\n * Conforms to RFC 8032 https://www.rfc-editor.org/rfc/rfc8032.html#section-5.2\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { shake256 } from '@noble/hashes/sha3.js';\nimport { abytes, concatBytes, createHasher as wrapConstructor } from '@noble/hashes/utils.js';\nimport { pippenger } from \"./abstract/curve.js\";\nimport { edwards, PrimeEdwardsPoint, twistedEdwards, } from \"./abstract/edwards.js\";\nimport { _DST_scalar, createHasher, expand_message_xof, } from \"./abstract/hash-to-curve.js\";\nimport { Field, FpInvertBatch, isNegativeLE, mod, pow2 } from \"./abstract/modular.js\";\nimport { montgomery } from \"./abstract/montgomery.js\";\nimport { asciiToBytes, bytesToNumberLE, ensureBytes, equalBytes } from \"./utils.js\";\n// edwards448 curve\n// a = 1n\n// d = Fp.neg(39081n)\n// Finite field 2n**448n - 2n**224n - 1n\n// Subgroup order\n// 2n**446n - 13818066809895115352007386748515426880336692474882178609894547503885n\nconst ed448_CURVE = {\n    p: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffff'),\n    n: BigInt('0x3fffffffffffffffffffffffffffffffffffffffffffffffffffffff7cca23e9c44edb49aed63690216cc2728dc58f552378c292ab5844f3'),\n    h: BigInt(4),\n    a: BigInt(1),\n    d: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffff6756'),\n    Gx: BigInt('0x4f1970c66bed0ded221d15a622bf36da9e146570470f1767ea6de324a3d3a46412ae1af72ab66511433b80e18b00938e2626a82bc70cc05e'),\n    Gy: BigInt('0x693f46716eb6bc248876203756c9c7624bea73736ca3984087789c1e05a0c2d73ad3ff1ce67c39c4fdbd132c4ed7c8ad9808795bf230fa14'),\n};\n// E448 NIST curve is identical to edwards448, except for:\n// d = 39082/39081\n// Gx = 3/2\nconst E448_CURVE = Object.assign({}, ed448_CURVE, {\n    d: BigInt('0xd78b4bdc7f0daf19f24f38c29373a2ccad46157242a50f37809b1da3412a12e79ccc9c81264cfe9ad080997058fb61c4243cc32dbaa156b9'),\n    Gx: BigInt('0x79a70b2b70400553ae7c9df416c792c61128751ac92969240c25a07d728bdc93e21f7787ed6972249de732f38496cd11698713093e9c04fc'),\n    Gy: BigInt('0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffff80000000000000000000000000000000000000000000000000000001'),\n});\nconst shake256_114 = /* @__PURE__ */ wrapConstructor(() => shake256.create({ dkLen: 114 }));\nconst shake256_64 = /* @__PURE__ */ wrapConstructor(() => shake256.create({ dkLen: 64 }));\n// prettier-ignore\nconst _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4), _11n = BigInt(11);\n// prettier-ignore\nconst _22n = BigInt(22), _44n = BigInt(44), _88n = BigInt(88), _223n = BigInt(223);\n// powPminus3div4 calculates z = x^k mod p, where k = (p-3)/4.\n// Used for efficient square root calculation.\n// ((P-3)/4).toString(2) would produce bits [223x 1, 0, 222x 1]\nfunction ed448_pow_Pminus3div4(x) {\n    const P = ed448_CURVE.p;\n    const b2 = (x * x * x) % P;\n    const b3 = (b2 * b2 * x) % P;\n    const b6 = (pow2(b3, _3n, P) * b3) % P;\n    const b9 = (pow2(b6, _3n, P) * b3) % P;\n    const b11 = (pow2(b9, _2n, P) * b2) % P;\n    const b22 = (pow2(b11, _11n, P) * b11) % P;\n    const b44 = (pow2(b22, _22n, P) * b22) % P;\n    const b88 = (pow2(b44, _44n, P) * b44) % P;\n    const b176 = (pow2(b88, _88n, P) * b88) % P;\n    const b220 = (pow2(b176, _44n, P) * b44) % P;\n    const b222 = (pow2(b220, _2n, P) * b2) % P;\n    const b223 = (pow2(b222, _1n, P) * x) % P;\n    return (pow2(b223, _223n, P) * b222) % P;\n}\nfunction adjustScalarBytes(bytes) {\n    // Section 5: Likewise, for X448, set the two least significant bits of the first byte to 0,\n    bytes[0] &= 252; // 0b11111100\n    // and the most significant bit of the last byte to 1.\n    bytes[55] |= 128; // 0b10000000\n    // NOTE: is NOOP for 56 bytes scalars (X25519/X448)\n    bytes[56] = 0; // Byte outside of group (456 buts vs 448 bits)\n    return bytes;\n}\n// Constant-time ratio of u to v. Allows to combine inversion and square root u/√v.\n// Uses algo from RFC8032 5.1.3.\nfunction uvRatio(u, v) {\n    const P = ed448_CURVE.p;\n    // https://www.rfc-editor.org/rfc/rfc8032#section-5.2.3\n    // To compute the square root of (u/v), the first step is to compute the\n    //   candidate root x = (u/v)^((p+1)/4).  This can be done using the\n    // following trick, to use a single modular powering for both the\n    // inversion of v and the square root:\n    // x = (u/v)^((p+1)/4)   = u³v(u⁵v³)^((p-3)/4)   (mod p)\n    const u2v = mod(u * u * v, P); // u²v\n    const u3v = mod(u2v * u, P); // u³v\n    const u5v3 = mod(u3v * u2v * v, P); // u⁵v³\n    const root = ed448_pow_Pminus3div4(u5v3);\n    const x = mod(u3v * root, P);\n    // Verify that root is exists\n    const x2 = mod(x * x, P); // x²\n    // If vx² = u, the recovered x-coordinate is x.  Otherwise, no\n    // square root exists, and the decoding fails.\n    return { isValid: mod(x2 * v, P) === u, value: x };\n}\n// Finite field 2n**448n - 2n**224n - 1n\n// The value fits in 448 bits, but we use 456-bit (57-byte) elements because of bitflags.\n// - ed25519 fits in 255 bits, allowing using last 1 byte for specifying bit flag of point negation.\n// - ed448 fits in 448 bits. We can't use last 1 byte: we can only use a bit 224 in the middle.\nconst Fp = /* @__PURE__ */ (() => Field(ed448_CURVE.p, { BITS: 456, isLE: true }))();\nconst Fn = /* @__PURE__ */ (() => Field(ed448_CURVE.n, { BITS: 456, isLE: true }))();\n// decaf448 uses 448-bit (56-byte) keys\nconst Fp448 = /* @__PURE__ */ (() => Field(ed448_CURVE.p, { BITS: 448, isLE: true }))();\nconst Fn448 = /* @__PURE__ */ (() => Field(ed448_CURVE.n, { BITS: 448, isLE: true }))();\n// SHAKE256(dom4(phflag,context)||x, 114)\nfunction dom4(data, ctx, phflag) {\n    if (ctx.length > 255)\n        throw new Error('context must be smaller than 255, got: ' + ctx.length);\n    return concatBytes(asciiToBytes('SigEd448'), new Uint8Array([phflag ? 1 : 0, ctx.length]), ctx, data);\n}\n// const ed448_eddsa_opts = { adjustScalarBytes, domain: dom4 };\n// const ed448_Point = edwards(ed448_CURVE, { Fp, Fn, uvRatio });\nconst ED448_DEF = /* @__PURE__ */ (() => ({\n    ...ed448_CURVE,\n    Fp,\n    Fn,\n    nBitLength: Fn.BITS,\n    hash: shake256_114,\n    adjustScalarBytes,\n    domain: dom4,\n    uvRatio,\n}))();\n/**\n * ed448 EdDSA curve and methods.\n * @example\n * import { ed448 } from '@noble/curves/ed448';\n * const { secretKey, publicKey } = ed448.keygen();\n * const msg = new TextEncoder().encode('hello');\n * const sig = ed448.sign(msg, secretKey);\n * const isValid = ed448.verify(sig, msg, publicKey);\n */\nexport const ed448 = twistedEdwards(ED448_DEF);\n// There is no ed448ctx, since ed448 supports ctx by default\n/** Prehashed version of ed448. Accepts already-hashed messages in sign() and verify(). */\nexport const ed448ph = /* @__PURE__ */ (() => twistedEdwards({\n    ...ED448_DEF,\n    prehash: shake256_64,\n}))();\n/**\n * E448 curve, defined by NIST.\n * E448 != edwards448 used in ed448.\n * E448 is birationally equivalent to edwards448.\n */\nexport const E448 = edwards(E448_CURVE);\n/**\n * ECDH using curve448 aka x448.\n * x448 has 56-byte keys as per RFC 7748, while\n * ed448 has 57-byte keys as per RFC 8032.\n */\nexport const x448 = /* @__PURE__ */ (() => {\n    const P = ed448_CURVE.p;\n    return montgomery({\n        P,\n        type: 'x448',\n        powPminus2: (x) => {\n            const Pminus3div4 = ed448_pow_Pminus3div4(x);\n            const Pminus3 = pow2(Pminus3div4, _2n, P);\n            return mod(Pminus3 * x, P); // Pminus3 * x = Pminus2\n        },\n        adjustScalarBytes,\n    });\n})();\n// Hash To Curve Elligator2 Map\nconst ELL2_C1 = /* @__PURE__ */ (() => (Fp.ORDER - BigInt(3)) / BigInt(4))(); // 1. c1 = (q - 3) / 4         # Integer arithmetic\nconst ELL2_J = /* @__PURE__ */ BigInt(156326);\nfunction map_to_curve_elligator2_curve448(u) {\n    let tv1 = Fp.sqr(u); // 1.  tv1 = u^2\n    let e1 = Fp.eql(tv1, Fp.ONE); // 2.   e1 = tv1 == 1\n    tv1 = Fp.cmov(tv1, Fp.ZERO, e1); // 3.  tv1 = CMOV(tv1, 0, e1)  # If Z * u^2 == -1, set tv1 = 0\n    let xd = Fp.sub(Fp.ONE, tv1); // 4.   xd = 1 - tv1\n    let x1n = Fp.neg(ELL2_J); // 5.  x1n = -J\n    let tv2 = Fp.sqr(xd); // 6.  tv2 = xd^2\n    let gxd = Fp.mul(tv2, xd); // 7.  gxd = tv2 * xd          # gxd = xd^3\n    let gx1 = Fp.mul(tv1, Fp.neg(ELL2_J)); // 8.  gx1 = -J * tv1          # x1n + J * xd\n    gx1 = Fp.mul(gx1, x1n); // 9.  gx1 = gx1 * x1n         # x1n^2 + J * x1n * xd\n    gx1 = Fp.add(gx1, tv2); // 10. gx1 = gx1 + tv2         # x1n^2 + J * x1n * xd + xd^2\n    gx1 = Fp.mul(gx1, x1n); // 11. gx1 = gx1 * x1n         # x1n^3 + J * x1n^2 * xd + x1n * xd^2\n    let tv3 = Fp.sqr(gxd); // 12. tv3 = gxd^2\n    tv2 = Fp.mul(gx1, gxd); // 13. tv2 = gx1 * gxd         # gx1 * gxd\n    tv3 = Fp.mul(tv3, tv2); // 14. tv3 = tv3 * tv2         # gx1 * gxd^3\n    let y1 = Fp.pow(tv3, ELL2_C1); // 15.  y1 = tv3^c1            # (gx1 * gxd^3)^((p - 3) / 4)\n    y1 = Fp.mul(y1, tv2); // 16.  y1 = y1 * tv2          # gx1 * gxd * (gx1 * gxd^3)^((p - 3) / 4)\n    let x2n = Fp.mul(x1n, Fp.neg(tv1)); // 17. x2n = -tv1 * x1n        # x2 = x2n / xd = -1 * u^2 * x1n / xd\n    let y2 = Fp.mul(y1, u); // 18.  y2 = y1 * u\n    y2 = Fp.cmov(y2, Fp.ZERO, e1); // 19.  y2 = CMOV(y2, 0, e1)\n    tv2 = Fp.sqr(y1); // 20. tv2 = y1^2\n    tv2 = Fp.mul(tv2, gxd); // 21. tv2 = tv2 * gxd\n    let e2 = Fp.eql(tv2, gx1); // 22.  e2 = tv2 == gx1\n    let xn = Fp.cmov(x2n, x1n, e2); // 23.  xn = CMOV(x2n, x1n, e2)  # If e2, x = x1, else x = x2\n    let y = Fp.cmov(y2, y1, e2); // 24.   y = CMOV(y2, y1, e2)    # If e2, y = y1, else y = y2\n    let e3 = Fp.isOdd(y); // 25.  e3 = sgn0(y) == 1        # Fix sign of y\n    y = Fp.cmov(y, Fp.neg(y), e2 !== e3); // 26.   y = CMOV(y, -y, e2 XOR e3)\n    return { xn, xd, yn: y, yd: Fp.ONE }; // 27. return (xn, xd, y, 1)\n}\nfunction map_to_curve_elligator2_edwards448(u) {\n    let { xn, xd, yn, yd } = map_to_curve_elligator2_curve448(u); // 1. (xn, xd, yn, yd) = map_to_curve_elligator2_curve448(u)\n    let xn2 = Fp.sqr(xn); // 2.  xn2 = xn^2\n    let xd2 = Fp.sqr(xd); // 3.  xd2 = xd^2\n    let xd4 = Fp.sqr(xd2); // 4.  xd4 = xd2^2\n    let yn2 = Fp.sqr(yn); // 5.  yn2 = yn^2\n    let yd2 = Fp.sqr(yd); // 6.  yd2 = yd^2\n    let xEn = Fp.sub(xn2, xd2); // 7.  xEn = xn2 - xd2\n    let tv2 = Fp.sub(xEn, xd2); // 8.  tv2 = xEn - xd2\n    xEn = Fp.mul(xEn, xd2); // 9.  xEn = xEn * xd2\n    xEn = Fp.mul(xEn, yd); // 10. xEn = xEn * yd\n    xEn = Fp.mul(xEn, yn); // 11. xEn = xEn * yn\n    xEn = Fp.mul(xEn, _4n); // 12. xEn = xEn * 4\n    tv2 = Fp.mul(tv2, xn2); // 13. tv2 = tv2 * xn2\n    tv2 = Fp.mul(tv2, yd2); // 14. tv2 = tv2 * yd2\n    let tv3 = Fp.mul(yn2, _4n); // 15. tv3 = 4 * yn2\n    let tv1 = Fp.add(tv3, yd2); // 16. tv1 = tv3 + yd2\n    tv1 = Fp.mul(tv1, xd4); // 17. tv1 = tv1 * xd4\n    let xEd = Fp.add(tv1, tv2); // 18. xEd = tv1 + tv2\n    tv2 = Fp.mul(tv2, xn); // 19. tv2 = tv2 * xn\n    let tv4 = Fp.mul(xn, xd4); // 20. tv4 = xn * xd4\n    let yEn = Fp.sub(tv3, yd2); // 21. yEn = tv3 - yd2\n    yEn = Fp.mul(yEn, tv4); // 22. yEn = yEn * tv4\n    yEn = Fp.sub(yEn, tv2); // 23. yEn = yEn - tv2\n    tv1 = Fp.add(xn2, xd2); // 24. tv1 = xn2 + xd2\n    tv1 = Fp.mul(tv1, xd2); // 25. tv1 = tv1 * xd2\n    tv1 = Fp.mul(tv1, xd); // 26. tv1 = tv1 * xd\n    tv1 = Fp.mul(tv1, yn2); // 27. tv1 = tv1 * yn2\n    tv1 = Fp.mul(tv1, BigInt(-2)); // 28. tv1 = -2 * tv1\n    let yEd = Fp.add(tv2, tv1); // 29. yEd = tv2 + tv1\n    tv4 = Fp.mul(tv4, yd2); // 30. tv4 = tv4 * yd2\n    yEd = Fp.add(yEd, tv4); // 31. yEd = yEd + tv4\n    tv1 = Fp.mul(xEd, yEd); // 32. tv1 = xEd * yEd\n    let e = Fp.eql(tv1, Fp.ZERO); // 33.   e = tv1 == 0\n    xEn = Fp.cmov(xEn, Fp.ZERO, e); // 34. xEn = CMOV(xEn, 0, e)\n    xEd = Fp.cmov(xEd, Fp.ONE, e); // 35. xEd = CMOV(xEd, 1, e)\n    yEn = Fp.cmov(yEn, Fp.ONE, e); // 36. yEn = CMOV(yEn, 1, e)\n    yEd = Fp.cmov(yEd, Fp.ONE, e); // 37. yEd = CMOV(yEd, 1, e)\n    const inv = FpInvertBatch(Fp, [xEd, yEd], true); // batch division\n    return { x: Fp.mul(xEn, inv[0]), y: Fp.mul(yEn, inv[1]) }; // 38. return (xEn, xEd, yEn, yEd)\n}\n/** Hashing / encoding to ed448 points / field. RFC 9380 methods. */\nexport const ed448_hasher = /* @__PURE__ */ (() => createHasher(ed448.Point, (scalars) => map_to_curve_elligator2_edwards448(scalars[0]), {\n    DST: 'edwards448_XOF:SHAKE256_ELL2_RO_',\n    encodeDST: 'edwards448_XOF:SHAKE256_ELL2_NU_',\n    p: Fp.ORDER,\n    m: 1,\n    k: 224,\n    expand: 'xof',\n    hash: shake256,\n}))();\n// 1-d\nconst ONE_MINUS_D = /* @__PURE__ */ BigInt('39082');\n// 1-2d\nconst ONE_MINUS_TWO_D = /* @__PURE__ */ BigInt('78163');\n// √(-d)\nconst SQRT_MINUS_D = /* @__PURE__ */ BigInt('98944233647732219769177004876929019128417576295529901074099889598043702116001257856802131563896515373927712232092845883226922417596214');\n// 1 / √(-d)\nconst INVSQRT_MINUS_D = /* @__PURE__ */ BigInt('315019913931389607337177038330951043522456072897266928557328499619017160722351061360252776265186336876723201881398623946864393857820716');\n// Calculates 1/√(number)\nconst invertSqrt = (number) => uvRatio(_1n, number);\n/**\n * Elligator map for hash-to-curve of decaf448.\n * Described in [RFC9380](https://www.rfc-editor.org/rfc/rfc9380#appendix-C)\n * and [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-element-derivation-2).\n */\nfunction calcElligatorDecafMap(r0) {\n    const { d } = ed448_CURVE;\n    const P = Fp.ORDER;\n    const mod = (n) => Fp.create(n);\n    const r = mod(-(r0 * r0)); // 1\n    const u0 = mod(d * (r - _1n)); // 2\n    const u1 = mod((u0 + _1n) * (u0 - r)); // 3\n    const { isValid: was_square, value: v } = uvRatio(ONE_MINUS_TWO_D, mod((r + _1n) * u1)); // 4\n    let v_prime = v; // 5\n    if (!was_square)\n        v_prime = mod(r0 * v);\n    let sgn = _1n; // 6\n    if (!was_square)\n        sgn = mod(-_1n);\n    const s = mod(v_prime * (r + _1n)); // 7\n    let s_abs = s;\n    if (isNegativeLE(s, P))\n        s_abs = mod(-s);\n    const s2 = s * s;\n    const W0 = mod(s_abs * _2n); // 8\n    const W1 = mod(s2 + _1n); // 9\n    const W2 = mod(s2 - _1n); // 10\n    const W3 = mod(v_prime * s * (r - _1n) * ONE_MINUS_TWO_D + sgn); // 11\n    return new ed448.Point(mod(W0 * W3), mod(W2 * W1), mod(W1 * W3), mod(W0 * W2));\n}\nfunction decaf448_map(bytes) {\n    abytes(bytes, 112);\n    const skipValidation = true;\n    // Note: Similar to the field element decoding described in\n    // [RFC7748], and unlike the field element decoding described in\n    // Section 5.3.1, non-canonical values are accepted.\n    const r1 = Fp448.create(Fp448.fromBytes(bytes.subarray(0, 56), skipValidation));\n    const R1 = calcElligatorDecafMap(r1);\n    const r2 = Fp448.create(Fp448.fromBytes(bytes.subarray(56, 112), skipValidation));\n    const R2 = calcElligatorDecafMap(r2);\n    return new _DecafPoint(R1.add(R2));\n}\n/**\n * Each ed448/EdwardsPoint has 4 different equivalent points. This can be\n * a source of bugs for protocols like ring signatures. Decaf was created to solve this.\n * Decaf point operates in X:Y:Z:T extended coordinates like EdwardsPoint,\n * but it should work in its own namespace: do not combine those two.\n * See [RFC9496](https://www.rfc-editor.org/rfc/rfc9496).\n */\nclass _DecafPoint extends PrimeEdwardsPoint {\n    constructor(ep) {\n        super(ep);\n    }\n    static fromAffine(ap) {\n        return new _DecafPoint(ed448.Point.fromAffine(ap));\n    }\n    assertSame(other) {\n        if (!(other instanceof _DecafPoint))\n            throw new Error('DecafPoint expected');\n    }\n    init(ep) {\n        return new _DecafPoint(ep);\n    }\n    /** @deprecated use `import { decaf448_hasher } from '@noble/curves/ed448.js';` */\n    static hashToCurve(hex) {\n        return decaf448_map(ensureBytes('decafHash', hex, 112));\n    }\n    static fromBytes(bytes) {\n        abytes(bytes, 56);\n        const { d } = ed448_CURVE;\n        const P = Fp.ORDER;\n        const mod = (n) => Fp448.create(n);\n        const s = Fp448.fromBytes(bytes);\n        // 1. Check that s_bytes is the canonical encoding of a field element, or else abort.\n        // 2. Check that s is non-negative, or else abort\n        if (!equalBytes(Fn448.toBytes(s), bytes) || isNegativeLE(s, P))\n            throw new Error('invalid decaf448 encoding 1');\n        const s2 = mod(s * s); // 1\n        const u1 = mod(_1n + s2); // 2\n        const u1sq = mod(u1 * u1);\n        const u2 = mod(u1sq - _4n * d * s2); // 3\n        const { isValid, value: invsqrt } = invertSqrt(mod(u2 * u1sq)); // 4\n        let u3 = mod((s + s) * invsqrt * u1 * SQRT_MINUS_D); // 5\n        if (isNegativeLE(u3, P))\n            u3 = mod(-u3);\n        const x = mod(u3 * invsqrt * u2 * INVSQRT_MINUS_D); // 6\n        const y = mod((_1n - s2) * invsqrt * u1); // 7\n        const t = mod(x * y); // 8\n        if (!isValid)\n            throw new Error('invalid decaf448 encoding 2');\n        return new _DecafPoint(new ed448.Point(x, y, _1n, t));\n    }\n    /**\n     * Converts decaf-encoded string to decaf point.\n     * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode-2).\n     * @param hex Decaf-encoded 56 bytes. Not every 56-byte string is valid decaf encoding\n     */\n    static fromHex(hex) {\n        return _DecafPoint.fromBytes(ensureBytes('decafHex', hex, 56));\n    }\n    /** @deprecated use `import { pippenger } from '@noble/curves/abstract/curve.js';` */\n    static msm(points, scalars) {\n        return pippenger(_DecafPoint, Fn, points, scalars);\n    }\n    /**\n     * Encodes decaf point to Uint8Array.\n     * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode-2).\n     */\n    toBytes() {\n        const { X, Z, T } = this.ep;\n        const P = Fp.ORDER;\n        const mod = (n) => Fp.create(n);\n        const u1 = mod(mod(X + T) * mod(X - T)); // 1\n        const x2 = mod(X * X);\n        const { value: invsqrt } = invertSqrt(mod(u1 * ONE_MINUS_D * x2)); // 2\n        let ratio = mod(invsqrt * u1 * SQRT_MINUS_D); // 3\n        if (isNegativeLE(ratio, P))\n            ratio = mod(-ratio);\n        const u2 = mod(INVSQRT_MINUS_D * ratio * Z - T); // 4\n        let s = mod(ONE_MINUS_D * invsqrt * X * u2); // 5\n        if (isNegativeLE(s, P))\n            s = mod(-s);\n        return Fn448.toBytes(s);\n    }\n    /**\n     * Compare one point to another.\n     * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals-2).\n     */\n    equals(other) {\n        this.assertSame(other);\n        const { X: X1, Y: Y1 } = this.ep;\n        const { X: X2, Y: Y2 } = other.ep;\n        // (x1 * y2 == y1 * x2)\n        return Fp.create(X1 * Y2) === Fp.create(Y1 * X2);\n    }\n    is0() {\n        return this.equals(_DecafPoint.ZERO);\n    }\n}\n// The following gymnastics is done because typescript strips comments otherwise\n// prettier-ignore\n_DecafPoint.BASE = \n/* @__PURE__ */ (() => new _DecafPoint(ed448.Point.BASE).multiplyUnsafe(_2n))();\n// prettier-ignore\n_DecafPoint.ZERO = \n/* @__PURE__ */ (() => new _DecafPoint(ed448.Point.ZERO))();\n// prettier-ignore\n_DecafPoint.Fp = \n/* @__PURE__ */ (() => Fp448)();\n// prettier-ignore\n_DecafPoint.Fn = \n/* @__PURE__ */ (() => Fn448)();\nexport const decaf448 = { Point: _DecafPoint };\n/** Hashing to decaf448 points / field. RFC 9380 methods. */\nexport const decaf448_hasher = {\n    hashToCurve(msg, options) {\n        const DST = options?.DST || 'decaf448_XOF:SHAKE256_D448MAP_RO_';\n        return decaf448_map(expand_message_xof(msg, DST, 112, 224, shake256));\n    },\n    // Warning: has big modulo bias of 2^-64.\n    // RFC is invalid. RFC says \"use 64-byte xof\", while for 2^-112 bias\n    // it must use 84-byte xof (56+56/2), not 64.\n    hashToScalar(msg, options = { DST: _DST_scalar }) {\n        // Can't use `Fn448.fromBytes()`. 64-byte input => 56-byte field element\n        const xof = expand_message_xof(msg, options.DST, 64, 256, shake256);\n        return Fn448.create(bytesToNumberLE(xof));\n    },\n};\n// export const decaf448_oprf: OPRF = createORPF({\n//   name: 'decaf448-SHAKE256',\n//   Point: DecafPoint,\n//   hash: (msg: Uint8Array) => shake256(msg, { dkLen: 64 }),\n//   hashToGroup: decaf448_hasher.hashToCurve,\n//   hashToScalar: decaf448_hasher.hashToScalar,\n// });\n/**\n * Weird / bogus points, useful for debugging.\n * Unlike ed25519, there is no ed448 generator point which can produce full T subgroup.\n * Instead, there is a Klein four-group, which spans over 2 independent 2-torsion points:\n * (0, 1), (0, -1), (-1, 0), (1, 0).\n */\nexport const ED448_TORSION_SUBGROUP = [\n    '010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',\n    'fefffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffff00',\n    '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',\n    '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080',\n];\n/** @deprecated use `decaf448.Point` */\nexport const DecafPoint = _DecafPoint;\n/** @deprecated use `import { ed448_hasher } from '@noble/curves/ed448.js';` */\nexport const hashToCurve = /* @__PURE__ */ (() => ed448_hasher.hashToCurve)();\n/** @deprecated use `import { ed448_hasher } from '@noble/curves/ed448.js';` */\nexport const encodeToCurve = /* @__PURE__ */ (() => ed448_hasher.encodeToCurve)();\n/** @deprecated use `import { decaf448_hasher } from '@noble/curves/ed448.js';` */\nexport const hashToDecaf448 = /* @__PURE__ */ (() => decaf448_hasher.hashToCurve)();\n/** @deprecated use `import { decaf448_hasher } from '@noble/curves/ed448.js';` */\nexport const hash_to_decaf448 = /* @__PURE__ */ (() => decaf448_hasher.hashToCurve)();\n/** @deprecated use `ed448.utils.toMontgomery` */\nexport function edwardsToMontgomeryPub(edwardsPub) {\n    return ed448.utils.toMontgomery(ensureBytes('pub', edwardsPub));\n}\n/** @deprecated use `ed448.utils.toMontgomery` */\nexport const edwardsToMontgomery = edwardsToMontgomeryPub;\n//# sourceMappingURL=ed448.js.map","/**\n * SECG secp256k1. See [pdf](https://www.secg.org/sec2-v2.pdf).\n *\n * Belongs to Koblitz curves: it has efficiently-computable GLV endomorphism ψ,\n * check out {@link EndomorphismOpts}. Seems to be rigid (not backdoored).\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha256 } from '@noble/hashes/sha2.js';\nimport { randomBytes } from '@noble/hashes/utils.js';\nimport { createCurve } from \"./_shortw_utils.js\";\nimport { createHasher, isogenyMap, } from \"./abstract/hash-to-curve.js\";\nimport { Field, mapHashToField, mod, pow2 } from \"./abstract/modular.js\";\nimport { _normFnElement, mapToCurveSimpleSWU, } from \"./abstract/weierstrass.js\";\nimport { bytesToNumberBE, concatBytes, ensureBytes, inRange, numberToBytesBE, utf8ToBytes, } from \"./utils.js\";\n// Seems like generator was produced from some seed:\n// `Point.BASE.multiply(Point.Fn.inv(2n, N)).toAffine().x`\n// // gives short x 0x3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63n\nconst secp256k1_CURVE = {\n    p: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f'),\n    n: BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141'),\n    h: BigInt(1),\n    a: BigInt(0),\n    b: BigInt(7),\n    Gx: BigInt('0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798'),\n    Gy: BigInt('0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8'),\n};\nconst secp256k1_ENDO = {\n    beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),\n    basises: [\n        [BigInt('0x3086d221a7d46bcde86c90e49284eb15'), -BigInt('0xe4437ed6010e88286f547fa90abfe4c3')],\n        [BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8'), BigInt('0x3086d221a7d46bcde86c90e49284eb15')],\n    ],\n};\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\nconst _2n = /* @__PURE__ */ BigInt(2);\n/**\n * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.\n * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]\n */\nfunction sqrtMod(y) {\n    const P = secp256k1_CURVE.p;\n    // prettier-ignore\n    const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);\n    // prettier-ignore\n    const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);\n    const b2 = (y * y * y) % P; // x^3, 11\n    const b3 = (b2 * b2 * y) % P; // x^7\n    const b6 = (pow2(b3, _3n, P) * b3) % P;\n    const b9 = (pow2(b6, _3n, P) * b3) % P;\n    const b11 = (pow2(b9, _2n, P) * b2) % P;\n    const b22 = (pow2(b11, _11n, P) * b11) % P;\n    const b44 = (pow2(b22, _22n, P) * b22) % P;\n    const b88 = (pow2(b44, _44n, P) * b44) % P;\n    const b176 = (pow2(b88, _88n, P) * b88) % P;\n    const b220 = (pow2(b176, _44n, P) * b44) % P;\n    const b223 = (pow2(b220, _3n, P) * b3) % P;\n    const t1 = (pow2(b223, _23n, P) * b22) % P;\n    const t2 = (pow2(t1, _6n, P) * b2) % P;\n    const root = pow2(t2, _2n, P);\n    if (!Fpk1.eql(Fpk1.sqr(root), y))\n        throw new Error('Cannot find square root');\n    return root;\n}\nconst Fpk1 = Field(secp256k1_CURVE.p, { sqrt: sqrtMod });\n/**\n * secp256k1 curve, ECDSA and ECDH methods.\n *\n * Field: `2n**256n - 2n**32n - 2n**9n - 2n**8n - 2n**7n - 2n**6n - 2n**4n - 1n`\n *\n * @example\n * ```js\n * import { secp256k1 } from '@noble/curves/secp256k1';\n * const { secretKey, publicKey } = secp256k1.keygen();\n * const msg = new TextEncoder().encode('hello');\n * const sig = secp256k1.sign(msg, secretKey);\n * const isValid = secp256k1.verify(sig, msg, publicKey) === true;\n * ```\n */\nexport const secp256k1 = createCurve({ ...secp256k1_CURVE, Fp: Fpk1, lowS: true, endo: secp256k1_ENDO }, sha256);\n// Schnorr signatures are superior to ECDSA from above. Below is Schnorr-specific BIP0340 code.\n// https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\n/** An object mapping tags to their tagged hash prefix of [SHA256(tag) | SHA256(tag)] */\nconst TAGGED_HASH_PREFIXES = {};\nfunction taggedHash(tag, ...messages) {\n    let tagP = TAGGED_HASH_PREFIXES[tag];\n    if (tagP === undefined) {\n        const tagH = sha256(utf8ToBytes(tag));\n        tagP = concatBytes(tagH, tagH);\n        TAGGED_HASH_PREFIXES[tag] = tagP;\n    }\n    return sha256(concatBytes(tagP, ...messages));\n}\n// ECDSA compact points are 33-byte. Schnorr is 32: we strip first byte 0x02 or 0x03\nconst pointToBytes = (point) => point.toBytes(true).slice(1);\nconst Pointk1 = /* @__PURE__ */ (() => secp256k1.Point)();\nconst hasEven = (y) => y % _2n === _0n;\n// Calculate point, scalar and bytes\nfunction schnorrGetExtPubKey(priv) {\n    const { Fn, BASE } = Pointk1;\n    const d_ = _normFnElement(Fn, priv);\n    const p = BASE.multiply(d_); // P = d'⋅G; 0 < d' < n check is done inside\n    const scalar = hasEven(p.y) ? d_ : Fn.neg(d_);\n    return { scalar, bytes: pointToBytes(p) };\n}\n/**\n * lift_x from BIP340. Convert 32-byte x coordinate to elliptic curve point.\n * @returns valid point checked for being on-curve\n */\nfunction lift_x(x) {\n    const Fp = Fpk1;\n    if (!Fp.isValidNot0(x))\n        throw new Error('invalid x: Fail if x ≥ p');\n    const xx = Fp.create(x * x);\n    const c = Fp.create(xx * x + BigInt(7)); // Let c = x³ + 7 mod p.\n    let y = Fp.sqrt(c); // Let y = c^(p+1)/4 mod p. Same as sqrt().\n    // Return the unique point P such that x(P) = x and\n    // y(P) = y if y mod 2 = 0 or y(P) = p-y otherwise.\n    if (!hasEven(y))\n        y = Fp.neg(y);\n    const p = Pointk1.fromAffine({ x, y });\n    p.assertValidity();\n    return p;\n}\nconst num = bytesToNumberBE;\n/**\n * Create tagged hash, convert it to bigint, reduce modulo-n.\n */\nfunction challenge(...args) {\n    return Pointk1.Fn.create(num(taggedHash('BIP0340/challenge', ...args)));\n}\n/**\n * Schnorr public key is just `x` coordinate of Point as per BIP340.\n */\nfunction schnorrGetPublicKey(secretKey) {\n    return schnorrGetExtPubKey(secretKey).bytes; // d'=int(sk). Fail if d'=0 or d'≥n. Ret bytes(d'⋅G)\n}\n/**\n * Creates Schnorr signature as per BIP340. Verifies itself before returning anything.\n * auxRand is optional and is not the sole source of k generation: bad CSPRNG won't be dangerous.\n */\nfunction schnorrSign(message, secretKey, auxRand = randomBytes(32)) {\n    const { Fn } = Pointk1;\n    const m = ensureBytes('message', message);\n    const { bytes: px, scalar: d } = schnorrGetExtPubKey(secretKey); // checks for isWithinCurveOrder\n    const a = ensureBytes('auxRand', auxRand, 32); // Auxiliary random data a: a 32-byte array\n    const t = Fn.toBytes(d ^ num(taggedHash('BIP0340/aux', a))); // Let t be the byte-wise xor of bytes(d) and hash/aux(a)\n    const rand = taggedHash('BIP0340/nonce', t, px, m); // Let rand = hash/nonce(t || bytes(P) || m)\n    // Let k' = int(rand) mod n. Fail if k' = 0. Let R = k'⋅G\n    const { bytes: rx, scalar: k } = schnorrGetExtPubKey(rand);\n    const e = challenge(rx, px, m); // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.\n    const sig = new Uint8Array(64); // Let sig = bytes(R) || bytes((k + ed) mod n).\n    sig.set(rx, 0);\n    sig.set(Fn.toBytes(Fn.create(k + e * d)), 32);\n    // If Verify(bytes(P), m, sig) (see below) returns failure, abort\n    if (!schnorrVerify(sig, m, px))\n        throw new Error('sign: Invalid signature produced');\n    return sig;\n}\n/**\n * Verifies Schnorr signature.\n * Will swallow errors & return false except for initial type validation of arguments.\n */\nfunction schnorrVerify(signature, message, publicKey) {\n    const { Fn, BASE } = Pointk1;\n    const sig = ensureBytes('signature', signature, 64);\n    const m = ensureBytes('message', message);\n    const pub = ensureBytes('publicKey', publicKey, 32);\n    try {\n        const P = lift_x(num(pub)); // P = lift_x(int(pk)); fail if that fails\n        const r = num(sig.subarray(0, 32)); // Let r = int(sig[0:32]); fail if r ≥ p.\n        if (!inRange(r, _1n, secp256k1_CURVE.p))\n            return false;\n        const s = num(sig.subarray(32, 64)); // Let s = int(sig[32:64]); fail if s ≥ n.\n        if (!inRange(s, _1n, secp256k1_CURVE.n))\n            return false;\n        // int(challenge(bytes(r)||bytes(P)||m))%n\n        const e = challenge(Fn.toBytes(r), pointToBytes(P), m);\n        // R = s⋅G - e⋅P, where -eP == (n-e)P\n        const R = BASE.multiplyUnsafe(s).add(P.multiplyUnsafe(Fn.neg(e)));\n        const { x, y } = R.toAffine();\n        // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.\n        if (R.is0() || !hasEven(y) || x !== r)\n            return false;\n        return true;\n    }\n    catch (error) {\n        return false;\n    }\n}\n/**\n * Schnorr signatures over secp256k1.\n * https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\n * @example\n * ```js\n * import { schnorr } from '@noble/curves/secp256k1';\n * const { secretKey, publicKey } = schnorr.keygen();\n * // const publicKey = schnorr.getPublicKey(secretKey);\n * const msg = new TextEncoder().encode('hello');\n * const sig = schnorr.sign(msg, secretKey);\n * const isValid = schnorr.verify(sig, msg, publicKey);\n * ```\n */\nexport const schnorr = /* @__PURE__ */ (() => {\n    const size = 32;\n    const seedLength = 48;\n    const randomSecretKey = (seed = randomBytes(seedLength)) => {\n        return mapHashToField(seed, secp256k1_CURVE.n);\n    };\n    // TODO: remove\n    secp256k1.utils.randomSecretKey;\n    function keygen(seed) {\n        const secretKey = randomSecretKey(seed);\n        return { secretKey, publicKey: schnorrGetPublicKey(secretKey) };\n    }\n    return {\n        keygen,\n        getPublicKey: schnorrGetPublicKey,\n        sign: schnorrSign,\n        verify: schnorrVerify,\n        Point: Pointk1,\n        utils: {\n            randomSecretKey: randomSecretKey,\n            randomPrivateKey: randomSecretKey,\n            taggedHash,\n            // TODO: remove\n            lift_x,\n            pointToBytes,\n            numberToBytesBE,\n            bytesToNumberBE,\n            mod,\n        },\n        lengths: {\n            secretKey: size,\n            publicKey: size,\n            publicKeyHasPrefix: false,\n            signature: size * 2,\n            seed: seedLength,\n        },\n    };\n})();\nconst isoMap = /* @__PURE__ */ (() => isogenyMap(Fpk1, [\n    // xNum\n    [\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7',\n        '0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581',\n        '0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262',\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c',\n    ],\n    // xDen\n    [\n        '0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b',\n        '0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n    // yNum\n    [\n        '0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c',\n        '0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3',\n        '0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931',\n        '0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84',\n    ],\n    // yDen\n    [\n        '0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b',\n        '0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573',\n        '0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n].map((i) => i.map((j) => BigInt(j)))))();\nconst mapSWU = /* @__PURE__ */ (() => mapToCurveSimpleSWU(Fpk1, {\n    A: BigInt('0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533'),\n    B: BigInt('1771'),\n    Z: Fpk1.create(BigInt('-11')),\n}))();\n/** Hashing / encoding to secp256k1 points / field. RFC 9380 methods. */\nexport const secp256k1_hasher = /* @__PURE__ */ (() => createHasher(secp256k1.Point, (scalars) => {\n    const { x, y } = mapSWU(Fpk1.create(scalars[0]));\n    return isoMap(x, y);\n}, {\n    DST: 'secp256k1_XMD:SHA-256_SSWU_RO_',\n    encodeDST: 'secp256k1_XMD:SHA-256_SSWU_NU_',\n    p: Fpk1.ORDER,\n    m: 1,\n    k: 128,\n    expand: 'xmd',\n    hash: sha256,\n}))();\n/** @deprecated use `import { secp256k1_hasher } from '@noble/curves/secp256k1.js';` */\nexport const hashToCurve = /* @__PURE__ */ (() => secp256k1_hasher.hashToCurve)();\n/** @deprecated use `import { secp256k1_hasher } from '@noble/curves/secp256k1.js';` */\nexport const encodeToCurve = /* @__PURE__ */ (() => secp256k1_hasher.encodeToCurve)();\n//# sourceMappingURL=secp256k1.js.map","/** @access private */\nimport { createCurve } from '@noble/curves/_shortw_utils';\nimport { sha256 } from '@noble/hashes/sha256';\nimport { Field } from '@noble/curves/abstract/modular';\n\n// brainpoolP256r1: https://datatracker.ietf.org/doc/html/rfc5639#section-3.4\n\nconst Fp = Field(BigInt('0xa9fb57dba1eea9bc3e660a909d838d726e3bf623d52620282013481d1f6e5377'));\nconst CURVE_A = Fp.create(BigInt('0x7d5a0975fc2c3057eef67530417affe7fb8055c126dc5c6ce94a4b44f330b5d9'));\nconst CURVE_B = BigInt('0x26dc5c6ce94a4b44f330b5d9bbd77cbf958416295cf7e1ce6bccdc18ff8c07b6');\n\n// prettier-ignore\nexport const brainpoolP256r1 = createCurve({\n  a: CURVE_A, // Equation params: a, b\n  b: CURVE_B,\n  Fp,\n  // Curve order (q), total count of valid points in the field\n  n: BigInt('0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974856a7'),\n  // Base (generator) point (x, y)\n  Gx: BigInt('0x8bd2aeb9cb7e57cb2c4b482ffc81b7afb9de27e1e3bd23c23a4453bd9ace3262'),\n  Gy: BigInt('0x547ef835c3dac4fd97f8461a14611dc9c27745132ded8e545c1d54c72f046997'),\n  h: BigInt(1),\n  lowS: false\n} as const, sha256);\n","/** @access private */\nimport { createCurve } from '@noble/curves/_shortw_utils';\nimport { sha384 } from '@noble/hashes/sha512';\nimport { Field } from '@noble/curves/abstract/modular';\n\n// brainpoolP384 r1: https://datatracker.ietf.org/doc/html/rfc5639#section-3.6\n\nconst Fp = Field(BigInt('0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b412b1da197fb71123acd3a729901d1a71874700133107ec53'));\nconst CURVE_A = Fp.create(BigInt('0x7bc382c63d8c150c3c72080ace05afa0c2bea28e4fb22787139165efba91f90f8aa5814a503ad4eb04a8c7dd22ce2826'));\nconst CURVE_B = BigInt('0x04a8c7dd22ce28268b39b55416f0447c2fb77de107dcd2a62e880ea53eeb62d57cb4390295dbc9943ab78696fa504c11');\n\n// prettier-ignore\nexport const brainpoolP384r1 = createCurve({\n  a: CURVE_A, // Equation params: a, b\n  b: CURVE_B,\n  Fp,\n  // Curve order (q), total count of valid points in the field\n  n: BigInt('0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e9046565'),\n  // Base (generator) point (x, y)\n  Gx: BigInt('0x1d1c64f068cf45ffa2a63a81b7c13f6b8847a3e77ef14fe3db7fcafe0cbd10e8e826e03436d646aaef87b2e247d4af1e'),\n  Gy: BigInt('0x8abe1d7520f9c2a45cb1eb8e95cfd55262b70b29feec5864e19c054ff99129280e4646217791811142820341263c5315'),\n  h: BigInt(1),\n  lowS: false\n} as const, sha384);\n","/** @access private */\nimport { createCurve } from '@noble/curves/_shortw_utils';\nimport { sha512 } from '@noble/hashes/sha512';\nimport { Field } from '@noble/curves/abstract/modular';\n\n// brainpoolP512r1: https://datatracker.ietf.org/doc/html/rfc5639#section-3.7\n\nconst Fp = Field(BigInt('0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca703308717d4d9b009bc66842aecda12ae6a380e62881ff2f2d82c68528aa6056583a48f3'));\nconst CURVE_A = Fp.create(BigInt('0x7830a3318b603b89e2327145ac234cc594cbdd8d3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94ca'));\nconst CURVE_B = BigInt('0x3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94cadc083e67984050b75ebae5dd2809bd638016f723');\n\n// prettier-ignore\nexport const brainpoolP512r1 = createCurve({\n  a: CURVE_A, // Equation params: a, b\n  b: CURVE_B,\n  Fp,\n  // Curve order (q), total count of valid points in the field\n  n: BigInt('0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90069'),\n  // Base (generator) point (x, y)\n  Gx: BigInt('0x81aee4bdd82ed9645a21322e9c4c6a9385ed9f70b5d916c1b43b62eef4d0098eff3b1f78e2d0d48d50d1687b93b97d5f7c6d5047406a5e688b352209bcb9f822'),\n  Gy: BigInt('0x7dde385d566332ecc0eabfa9cf7822fdf209f70024a57b1aa000c55b881f8111b2dcde494a5f485e5bca4bd88a2763aed1ca2b2fa8f0540678cd1e0f3ad80892'),\n  h: BigInt(1),\n  lowS: false\n} as const, sha512);\n","/**\n * @access private\n * This file is needed to dynamic import the noble-curves.\n * Separate dynamic imports are not convenient as they result in too many chunks,\n * which share a lot of code anyway.\n */\n\nimport { p256 as nistP256 } from '@noble/curves/p256';\nimport { p384 as nistP384 } from '@noble/curves/p384';\nimport { p521 as nistP521 } from '@noble/curves/p521';\nimport { x448, ed448 } from '@noble/curves/ed448';\nimport { secp256k1 } from '@noble/curves/secp256k1';\nimport { brainpoolP256r1 } from './brainpool/brainpoolP256r1';\nimport { brainpoolP384r1 } from './brainpool/brainpoolP384r1';\nimport { brainpoolP512r1 } from './brainpool/brainpoolP512r1';\n\nexport const nobleCurves = new Map(Object.entries({\n  nistP256,\n  nistP384,\n  nistP521,\n  brainpoolP256r1,\n  brainpoolP384r1,\n  brainpoolP512r1,\n  secp256k1,\n  x448,\n  ed448\n}));\n\n"],"names":["_0n","BigInt","_1n","_abool2","value","title","Error","_abytes2","length","bytes","isBytes_","len","needsLen","undefined","numberToHexUnpadded","num","hex","toString","hexToNumber","bytesToNumberBE","bytesToHex_","bytesToNumberLE","abytes_","Uint8Array","from","reverse","numberToBytesBE","n","hexToBytes_","padStart","numberToBytesLE","ensureBytes","expectedLength","res","e","copyBytes","isPosBig","aInRange","min","max","inRange","bitLen","bitMask","_validateObject","object","fields","optFields","checkField","fieldName","expectedType","isOpt","val","current","Object","entries","forEach","k","v","memoized","fn","map","WeakMap","arg","args","get","computed","set","_2n","_3n","_4n","_5n","_7n","_8n","_9n","_16n","mod","a","b","result","pow2","x","power","modulo","invert","number","u","r","m","assertIsSquare","Fp","root","eql","sqr","sqrt3mod4","p1div4","ORDER","pow","sqrt5mod8","p5div8","n2","mul","nv","i","sub","ONE","tonelliShanks","P","Q","S","Z","_Fp","Field","FpLegendre","cc","Q1div2","is0","M","c","t","R","ZERO","t_tmp","exponent","FpSqrt","Fp_","tn","c1","neg","c2","c3","c4","tv1","tv2","tv3","tv4","e1","e2","cmov","e3","sqrt9mod16","FIELD_FIELDS","FpInvertBatch","nums","passZero","inverted","Array","fill","multipliedAcc","reduce","acc","invertedAcc","inv","reduceRight","p1mod2","powered","yes","zero","no","nLength","nBitLength","anumber","_nBitLength","nByteLength","Math","ceil","bitLenOrOpts","isLE","opts","_nbitLength","_sqrt","allowedLengths","modFromBytes","sqrt","_opts","BITS","BYTES","sqrtP","f","freeze","MASK","create","isValid","isValidNot0","isOdd","lhs","rhs","add","p","d","FpPow","div","sqrN","addN","subN","mulN","toBytes","fromBytes","skipValidation","includes","padded","scalar","invertBatch","lst","getFieldBytesLength","fieldOrder","bitLength","getMinHashLength","HMAC","Hash","constructor","hash","_key","super","this","finished","destroyed","ahash","key","iHash","update","blockLen","outputLen","pad","digest","oHash","clean","buf","aexists","digestInto","out","abytes","destroy","_cloneInto","to","getPrototypeOf","clone","hmac","message","negateCt","condition","item","negate","normalizeZ","points","invertedZs","fromAffine","toAffine","validateW","W","bits","Number","isSafeInteger","calcWOpts","scalarBits","maxNumber","windows","windowSize","mask","shiftBy","calcOffsets","window","wOpts","wbits","nextN","offsetStart","offset","abs","isZero","isNeg","isNegF","offsetF","pointPrecomputes","pointWindowSizes","getW","assert0","wNAF","Point","BASE","Fn","_unsafeLadder","elm","double","precomputeWindow","point","base","push","precomputes","wo","wNAFUnsafe","getPrecomputes","transform","comp","cached","unsafe","prev","createCache","delete","hasCache","pippenger","fieldN","scalars","isArray","validateMSMPoints","field","s","validateMSMScalars","plength","slength","buckets","sum","floor","j","resI","sumI","createField","order","validateField","_createCurveFields","type","CURVE","curveOpts","FpFnLE","params","assign","divNearest","den","validateSigFormat","format","validateSigOpts","def","optsn","optName","keys","abool","lowS","prehash","DER","Err","_tlv","encode","tag","data","E","dataLen","lenLen","decode","pos","first","lengthBytes","subarray","l","_int","parseInt","toSig","int","tlv","seqBytes","seqLeftBytes","rBytes","rLeftBytes","sBytes","sLeftBytes","hexFromSig","sig","seq","_normFnElement","expected","error","weierstrassN","extraOpts","validated","h","cofactor","CURVE_ORDER","allowInfinityPoint","clearCofactor","isTorsionFree","endo","wrapPrivateKey","beta","basises","lengths","getWLengths","assertCompressionIsSupported","encodePoint","_c","isCompressed","y","bx","hasEvenY","concatBytes","pprefix","of","decodePoint","publicKey","publicKeyUncompressed","uncomp","head","tail","L","isValidXY","y2","weierstrassEquation","sqrtError","err","x2","x3","left","right","Gx","Gy","_4a3","_27b2","acoord","banZero","aprjpoint","other","splitEndoScalarN","basis","a1","b1","a2","b2","k1","k2","k1neg","k2neg","MAX_NUM","_splitEndoScalar","toAffineMemo","iz","X","Y","zz","assertValidMemo","finishEndo","endoBeta","k1p","k2p","assertValidity","fromHex","precompute","isLazy","wnaf","multiply","equals","X1","Y1","Z1","X2","Y2","Z2","U1","U2","b3","X3","Y3","Z3","t0","t1","t2","t3","t4","t5","subtract","fake","k1f","k2f","multiplyUnsafe","sc","p1","p2","mulEndoUnsafe","multiplyAndAddUnsafe","invertedZ","isSmallOrder","toHex","bytesToHex","px","py","pz","toRawBytes","_setWindowSize","msm","fromPrivateKey","privateKey","secretKey","publicKeyHasPrefix","signature","ecdh","ecdhOpts","randomBytes_","randomBytes","randomBytesWeb","seed","isValidSecretKey","randomSecretKey","fieldLen","minLen","reduced","mapHashToField","getPublicKey","isProbPub","utils","isValidPublicKey","isValidPrivateKey","randomPrivateKey","normPrivateKeyToScalar","getSharedSecret","secretKeyA","publicKeyB","keygen","ecdsa","ecdsaOpts","bits2int","bits2int_modN","msgs","nobleHmac","fnBits","defaultSigOpts","extraEntropy","defaultSigOpts_format","isBiggerThanHalfOrder","validateRS","Signature","recovery","recid","size","validateSigLength","hexToBytes","addRecoveryBit","recoverPublicKey","messageHash","FIELD_ORDER","rec","radj","ir","u1","u2","hasHighS","fromCompact","fromDER","normalizeS","toDERRawBytes","toDERHex","toCompactRawBytes","toCompactHex","delta","ORDER_MASK","int2octets","validateMsgAndHash","sign","k2sig","some","h1int","seedArgs","kBytes","ik","q","normS","prepSig","hashLen","qByteLen","hmacFn","u8n","u8of","byte","reset","reseed","gen","sl","slice","concatBytes_","pred","createHmacDrbg","drbg","verify","sg","isHex","isBytes","isObj","derError","tryParsingSig","is","_ecdsa_legacy_opts_to_new","allowedPrivateKeyLengths","Set","_weierstrass_legacy_opts_to_new","weierstrass","_ecdsa","ProjectivePoint","_ecdsa_new_output_to_legacy","createCurve","curveDef","defHash","p256_CURVE","p384_CURVE","p521_CURVE","Fp256","Fp384","Fp521","p256","sha256","p384","sha384","p521","sha512","edwards","uvRatio","modP","isEdValidXY","aextpoint","T","Z4","aX2","zip215","normed","lastByte","isXOdd","isLastByteOdd","X1Z2","X2Z1","Y1Z2","Y2Z1","A","B","C","D","x1y1","G","F","H","T3","T1","T2","ex","ey","ez","et","eddsa","cHash","eddsaOpts","adjustScalarBytes","domain","mapToCurve","ctx","phflag","modN_LE","getExtendedPublicKey","prefix","hashed","getPrivateScalar","pointBytes","hashDomainToScalar","context","msg","verifyOpts","_size","toMontgomery","is25519","toMontgomerySecret","options","mid","SB","montgomery","curve","powPminus2","rand","montgomeryBits","Gu","a24","minScalar","maxAdded","maxScalar","GuBytes","encodeU","scalarMult","pu","x_1","x_2","z_2","x_3","z_3","swap","k_t","cswap","AA","BB","DA","CB","dacb","da_cb","z2","montgomeryLadder","_u","decodeU","decodeScalar","scalarMultBase","dummy","ed448_CURVE","E448_CURVE","shake256_114","wrapConstructor","shake256","dkLen","_11n","_22n","_44n","_88n","_223n","ed448_pow_Pminus3div4","b6","b9","b11","b22","b44","b88","b176","b220","b222","b223","u2v","u3v","u5v3","dom4","ascii","charCode","charCodeAt","ed448","_eddsa_legacy_opts_to_new","ExtendedPoint","_eddsa_new_output_to_legacy","twistedEdwards","x448","secp256k1_CURVE","secp256k1_ENDO","Fpk1","_6n","_23n","secp256k1","brainpoolP256r1","brainpoolP384r1","brainpoolP512r1","nobleCurves","Map","nistP256","nistP384","nistP521"],"mappings":";;sEAOA,MAAMA,iBAAsBC,OAAO,GAC7BC,iBAAsBD,OAAO,GAM5B,SAASE,EAAQC,EAAOC,EAAQ,IACnC,GAAqB,kBAAVD,EAAqB,CAE5B,MAAUE,OADKD,GAAS,IAAIA,MACH,qCAAuCD,EACpE,CACA,OAAOA,CACX,CAGO,SAASG,EAASH,EAAOI,EAAQH,EAAQ,IAC5C,MAAMI,EAAQC,EAASN,GACjBO,EAAMP,GAAOI,OACbI,OAAsBC,IAAXL,EACjB,IAAKC,GAAUG,GAAYD,IAAQH,EAAS,CAIxC,MAAUF,OAHKD,GAAS,IAAIA,OAGH,uBAFXO,EAAW,cAAcJ,EAAW,IAEO,UAD7CC,EAAQ,UAAUE,EAAQ,eAAeP,GAEzD,CACA,OAAOA,CACX,CAEO,SAASU,EAAoBC,GAChC,MAAMC,EAAMD,EAAIE,SAAS,IACzB,OAAoB,EAAbD,EAAIR,OAAa,IAAMQ,EAAMA,CACxC,CACO,SAASE,EAAYF,GACxB,GAAmB,iBAARA,EACP,MAAUV,MAAM,mCAAqCU,GACzD,MAAe,KAARA,EAAahB,EAAMC,OAAO,KAAOe,EAC5C,CAEO,SAASG,EAAgBV,GAC5B,OAAOS,EAAYE,EAAYX,GACnC,CACO,SAASY,EAAgBZ,GAE5B,OADAa,EAAQb,GACDS,EAAYE,EAAYG,WAAWC,KAAKf,GAAOgB,WAC1D,CACO,SAASC,EAAgBC,EAAGhB,GAC/B,OAAOiB,EAAYD,EAAEV,SAAS,IAAIY,SAAe,EAANlB,EAAS,KACxD,CACO,SAASmB,EAAgBH,EAAGhB,GAC/B,OAAOe,EAAgBC,EAAGhB,GAAKc,SACnC,CAcO,SAASM,EAAY1B,EAAOW,EAAKgB,GACpC,IAAIC,EACJ,GAAmB,iBAARjB,EACP,IACIiB,EAAML,EAAYZ,EACtB,CACA,MAAOkB,GACH,MAAU5B,MAAMD,EAAQ,6CAA+C6B,EAC3E,KAEC,KAAIxB,EAASM,GAMd,MAAUV,MAAMD,EAAQ,qCAHxB4B,EAAMV,WAAWC,KAAKR,EAI1B,CACA,MAAML,EAAMsB,EAAIzB,OAChB,GAA8B,iBAAnBwB,GAA+BrB,IAAQqB,EAC9C,MAAU1B,MAAMD,EAAQ,cAAgB2B,EAAiB,kBAAoBrB,GACjF,OAAOsB,CACX,CAcO,SAASE,EAAU1B,GACtB,OAAOc,WAAWC,KAAKf,EAC3B,CAyBA,MAAM2B,EAAYT,GAAmB,iBAANA,GAAkB3B,GAAO2B,EASjD,SAASU,EAAShC,EAAOsB,EAAGW,EAAKC,GAMpC,IAdG,SAAiBZ,EAAGW,EAAKC,GAC5B,OAAOH,EAAST,IAAMS,EAASE,IAAQF,EAASG,IAAQD,GAAOX,GAAKA,EAAIY,CAC5E,CAYSC,CAAQb,EAAGW,EAAKC,GACjB,MAAUjC,MAAM,kBAAoBD,EAAQ,KAAOiC,EAAM,WAAaC,EAAM,SAAWZ,EAC/F,CAOO,SAASc,EAAOd,GACnB,IAAIhB,EACJ,IAAKA,EAAM,EAAGgB,EAAI3B,EAAK2B,IAAMzB,EAAKS,GAAO,GAEzC,OAAOA,CACX,CAmBO,MAAM+B,EAAWf,IAAOzB,GAAOD,OAAO0B,IAAMzB,EAuG5C,SAASyC,EAAgBC,EAAQC,EAAQC,EAAY,CAAA,GACxD,IAAKF,GAA4B,iBAAXA,EAClB,MAAUtC,MAAM,iCACpB,SAASyC,EAAWC,EAAWC,EAAcC,GACzC,MAAMC,EAAMP,EAAOI,GACnB,GAAIE,QAAiBrC,IAARsC,EACT,OACJ,MAAMC,SAAiBD,EACvB,GAAIC,IAAYH,GAAwB,OAARE,EAC5B,MAAU7C,MAAM,UAAU0C,2BAAmCC,UAAqBG,IAC1F,CACAC,OAAOC,QAAQT,GAAQU,SAAQ,EAAEC,EAAGC,KAAOV,EAAWS,EAAGC,GAAG,KAC5DJ,OAAOC,QAAQR,GAAWS,SAAQ,EAAEC,EAAGC,KAAOV,EAAWS,EAAGC,GAAG,IACnE,CAWO,SAASC,EAASC,GACrB,MAAMC,EAAM,IAAIC,QAChB,MAAO,CAACC,KAAQC,KACZ,MAAMZ,EAAMS,EAAII,IAAIF,GACpB,QAAYjD,IAARsC,EACA,OAAOA,EACX,MAAMc,EAAWN,EAAGG,KAAQC,GAE5B,OADAH,EAAIM,IAAIJ,EAAKG,GACNA,CAAQ,CAEvB;sECvTA,MAAMjE,EAAMC,OAAO,GAAIC,EAAMD,OAAO,GAAIkE,iBAAsBlE,OAAO,GAAImE,iBAAsBnE,OAAO,GAEhGoE,iBAAsBpE,OAAO,GAAIqE,iBAAsBrE,OAAO,GAAIsE,iBAAsBtE,OAAO,GAE/FuE,iBAAsBvE,OAAO,GAAIwE,iBAAsBxE,OAAO,GAAIyE,iBAAuBzE,OAAO,IAE/F,SAAS0E,EAAIC,EAAGC,GACnB,MAAMC,EAASF,EAAIC,EACnB,OAAOC,GAAU9E,EAAM8E,EAASD,EAAIC,CACxC,CAWO,SAASC,EAAKC,EAAGC,EAAOC,GAC3B,IAAIjD,EAAM+C,EACV,KAAOC,KAAUjF,GACbiC,GAAOA,EACPA,GAAOiD,EAEX,OAAOjD,CACX,CAKO,SAASkD,EAAOC,EAAQF,GAC3B,GAAIE,IAAWpF,EACX,MAAUM,MAAM,oCACpB,GAAI4E,GAAUlF,EACV,MAAUM,MAAM,0CAA4C4E,GAEhE,IAAIN,EAAID,EAAIS,EAAQF,GAChBL,EAAIK,EAEJF,EAAIhF,EAAcqF,EAAInF,EAC1B,KAAO0E,IAAM5E,GAAK,CAEd,MACMsF,EAAIT,EAAID,EACRW,EAAIP,EAAIK,GAFJR,EAAID,GAKdC,EAAID,EAAGA,EAAIU,EAAGN,EAAIK,EAAUA,EAAIE,CACpC,CAEA,GADYV,IACA3E,EACR,MAAUI,MAAM,0BACpB,OAAOqE,EAAIK,EAAGE,EAClB,CACA,SAASM,EAAeC,EAAIC,EAAM/D,GAC9B,IAAK8D,EAAGE,IAAIF,EAAGG,IAAIF,GAAO/D,GACtB,MAAUrB,MAAM,0BACxB,CAKA,SAASuF,EAAUJ,EAAI9D,GACnB,MAAMmE,GAAUL,EAAGM,MAAQ7F,GAAOmE,EAC5BqB,EAAOD,EAAGO,IAAIrE,EAAGmE,GAEvB,OADAN,EAAeC,EAAIC,EAAM/D,GAClB+D,CACX,CACA,SAASO,EAAUR,EAAI9D,GACnB,MAAMuE,GAAUT,EAAGM,MAAQzB,GAAOE,EAC5B2B,EAAKV,EAAGW,IAAIzE,EAAGwC,GACfV,EAAIgC,EAAGO,IAAIG,EAAID,GACfG,EAAKZ,EAAGW,IAAIzE,EAAG8B,GACf6C,EAAIb,EAAGW,IAAIX,EAAGW,IAAIC,EAAIlC,GAAMV,GAC5BiC,EAAOD,EAAGW,IAAIC,EAAIZ,EAAGc,IAAID,EAAGb,EAAGe,MAErC,OADAhB,EAAeC,EAAIC,EAAM/D,GAClB+D,CACX,CAgCO,SAASe,GAAcC,GAG1B,GAAIA,EAAItC,EACJ,MAAU9D,MAAM,uCAEpB,IAAIqG,EAAID,EAAIxG,EACR0G,EAAI,EACR,KAAOD,EAAIxC,IAAQnE,GACf2G,GAAKxC,EACLyC,IAGJ,IAAIC,EAAI1C,EACR,MAAM2C,EAAMC,GAAML,GAClB,KAA8B,IAAvBM,GAAWF,EAAKD,IAGnB,GAAIA,IAAM,IACN,MAAUvG,MAAM,iDAGxB,GAAU,IAANsG,EACA,OAAOf,EAGX,IAAIoB,EAAKH,EAAId,IAAIa,EAAGF,GACpB,MAAMO,GAAUP,EAAIzG,GAAOiE,EAC3B,OAAO,SAAqBsB,EAAI9D,GAC5B,GAAI8D,EAAG0B,IAAIxF,GACP,OAAOA,EAEX,GAA0B,IAAtBqF,GAAWvB,EAAI9D,GACf,MAAUrB,MAAM,2BAEpB,IAAI8G,EAAIR,EACJS,EAAI5B,EAAGW,IAAIX,EAAGe,IAAKS,GACnBK,EAAI7B,EAAGO,IAAIrE,EAAGgF,GACdY,EAAI9B,EAAGO,IAAIrE,EAAGuF,GAGlB,MAAQzB,EAAGE,IAAI2B,EAAG7B,EAAGe,MAAM,CACvB,GAAIf,EAAG0B,IAAIG,GACP,OAAO7B,EAAG+B,KACd,IAAIlB,EAAI,EAEJmB,EAAQhC,EAAGG,IAAI0B,GACnB,MAAQ7B,EAAGE,IAAI8B,EAAOhC,EAAGe,MAGrB,GAFAF,IACAmB,EAAQhC,EAAGG,IAAI6B,GACXnB,IAAMc,EACN,MAAU9G,MAAM,2BAGxB,MAAMoH,EAAWxH,GAAOD,OAAOmH,EAAId,EAAI,GACjCzB,EAAIY,EAAGO,IAAIqB,EAAGK,GAEpBN,EAAId,EACJe,EAAI5B,EAAGG,IAAIf,GACXyC,EAAI7B,EAAGW,IAAIkB,EAAGD,GACdE,EAAI9B,EAAGW,IAAImB,EAAG1C,EAClB,CACA,OAAO0C,CACX,CACJ,CAYO,SAASI,GAAOjB,GAEnB,OAAIA,EAAIrC,IAAQD,EACLyB,EAEPa,EAAIlC,IAAQF,EACL2B,EAEPS,EAAIhC,IAASD,EAjHrB,SAAoBiC,GAChB,MAAMkB,EAAMb,GAAML,GACZmB,EAAKpB,GAAcC,GACnBoB,EAAKD,EAAGD,EAAKA,EAAIG,IAAIH,EAAIpB,MACzBwB,EAAKH,EAAGD,EAAKE,GACbG,EAAKJ,EAAGD,EAAKA,EAAIG,IAAID,IACrBI,GAAMxB,EAAInC,GAAOG,EACvB,MAAO,CAACe,EAAI9D,KACR,IAAIwG,EAAM1C,EAAGO,IAAIrE,EAAGuG,GAChBE,EAAM3C,EAAGW,IAAI+B,EAAKL,GACtB,MAAMO,EAAM5C,EAAGW,IAAI+B,EAAKH,GAClBM,EAAM7C,EAAGW,IAAI+B,EAAKF,GAClBM,EAAK9C,EAAGE,IAAIF,EAAGG,IAAIwC,GAAMzG,GACzB6G,EAAK/C,EAAGE,IAAIF,EAAGG,IAAIyC,GAAM1G,GAC/BwG,EAAM1C,EAAGgD,KAAKN,EAAKC,EAAKG,GACxBH,EAAM3C,EAAGgD,KAAKH,EAAKD,EAAKG,GACxB,MAAME,EAAKjD,EAAGE,IAAIF,EAAGG,IAAIwC,GAAMzG,GACzB+D,EAAOD,EAAGgD,KAAKN,EAAKC,EAAKM,GAE/B,OADAlD,EAAeC,EAAIC,EAAM/D,GAClB+D,CAAI,CAEnB,CA6FeiD,CAAWjC,GAEfD,GAAcC,EACzB,CAIA,MAAMkC,GAAe,CACjB,SAAU,UAAW,MAAO,MAAO,MAAO,OAAQ,MAClD,MAAO,MAAO,MAAO,MAAO,MAAO,MACnC,OAAQ,OAAQ,OAAQ,QA8CrB,SAASC,GAAcpD,EAAIqD,EAAMC,GAAW,GAC/C,MAAMC,EAAeC,MAAMH,EAAKtI,QAAQ0I,KAAKH,EAAWtD,EAAG+B,UAAO3G,GAE5DsI,EAAgBL,EAAKM,QAAO,CAACC,EAAKtI,EAAKuF,IACrCb,EAAG0B,IAAIpG,GACAsI,GACXL,EAAS1C,GAAK+C,EACP5D,EAAGW,IAAIiD,EAAKtI,KACpB0E,EAAGe,KAEA8C,EAAc7D,EAAG8D,IAAIJ,GAQ3B,OANAL,EAAKU,aAAY,CAACH,EAAKtI,EAAKuF,IACpBb,EAAG0B,IAAIpG,GACAsI,GACXL,EAAS1C,GAAKb,EAAGW,IAAIiD,EAAKL,EAAS1C,IAC5Bb,EAAGW,IAAIiD,EAAKtI,KACpBuI,GACIN,CACX,CAcO,SAAShC,GAAWvB,EAAI9D,GAG3B,MAAM8H,GAAUhE,EAAGM,MAAQ7F,GAAOiE,EAC5BuF,EAAUjE,EAAGO,IAAIrE,EAAG8H,GACpBE,EAAMlE,EAAGE,IAAI+D,EAASjE,EAAGe,KACzBoD,EAAOnE,EAAGE,IAAI+D,EAASjE,EAAG+B,MAC1BqC,EAAKpE,EAAGE,IAAI+D,EAASjE,EAAGsC,IAAItC,EAAGe,MACrC,IAAKmD,IAAQC,IAASC,EAClB,MAAUvJ,MAAM,kCACpB,OAAOqJ,EAAM,EAAIC,EAAO,GAAI,CAChC,CAOO,SAASE,GAAQnI,EAAGoI,QAEJlJ,IAAfkJ,GACAC,EAAQD,GACZ,MAAME,OAA6BpJ,IAAfkJ,EAA2BA,EAAapI,EAAEV,SAAS,GAAGT,OAE1E,MAAO,CAAEuJ,WAAYE,EAAaC,YADdC,KAAKC,KAAKH,EAAc,GAEhD,CAoBO,SAASlD,GAAMhB,EAAOsE,EAC7BC,GAAO,EAAOC,EAAO,IACjB,GAAIxE,GAAS/F,EACT,MAAUM,MAAM,0CAA4CyF,GAChE,IAAIyE,EACAC,EAEAC,EADAC,GAAe,EAEnB,GAA4B,iBAAjBN,GAA6C,MAAhBA,EAAsB,CAC1D,GAAIE,EAAKK,MAAQN,EACb,MAAUhK,MAAM,wCACpB,MAAMuK,EAAQR,EACVQ,EAAMC,OACNN,EAAcK,EAAMC,MACpBD,EAAMD,OACNH,EAAQI,EAAMD,MACQ,kBAAfC,EAAMP,OACbA,EAAOO,EAAMP,MACiB,kBAAvBO,EAAMF,eACbA,EAAeE,EAAMF,cACzBD,EAAiBG,EAAMH,cAC3B,KAEgC,iBAAjBL,IACPG,EAAcH,GACdE,EAAKK,OACLH,EAAQF,EAAKK,MAErB,MAAQb,WAAYe,EAAMZ,YAAaa,GAAUjB,GAAQ/D,EAAOyE,GAChE,GAAIO,EAAQ,KACR,MAAUzK,MAAM,kDACpB,IAAI0K,EACJ,MAAMC,EAAI5H,OAAO6H,OAAO,CACpBnF,QACAuE,OACAQ,OACAC,QACAI,KAAMzI,EAAQoI,GACdtD,KAAMxH,EACNwG,IAAKtG,EACLwK,eAAgBA,EAChBU,OAASrK,GAAQ4D,EAAI5D,EAAKgF,GAC1BsF,QAAUtK,IACN,GAAmB,iBAARA,EACP,MAAUT,MAAM,sDAAwDS,GAC5E,OAAOf,GAAOe,GAAOA,EAAMgF,CAAK,EAEpCoB,IAAMpG,GAAQA,IAAQf,EAEtBsL,YAAcvK,IAASkK,EAAE9D,IAAIpG,IAAQkK,EAAEI,QAAQtK,GAC/CwK,MAAQxK,IAASA,EAAMb,KAASA,EAChC6H,IAAMhH,GAAQ4D,GAAK5D,EAAKgF,GACxBJ,IAAK,CAAC6F,EAAKC,IAAQD,IAAQC,EAC3B7F,IAAM7E,GAAQ4D,EAAI5D,EAAMA,EAAKgF,GAC7B2F,IAAK,CAACF,EAAKC,IAAQ9G,EAAI6G,EAAMC,EAAK1F,GAClCQ,IAAK,CAACiF,EAAKC,IAAQ9G,EAAI6G,EAAMC,EAAK1F,GAClCK,IAAK,CAACoF,EAAKC,IAAQ9G,EAAI6G,EAAMC,EAAK1F,GAClCC,IAAK,CAACjF,EAAKkE,IA7JZ,SAAeQ,EAAI1E,EAAKkE,GAC3B,GAAIA,EAAQjF,EACR,MAAUM,MAAM,2CACpB,GAAI2E,IAAUjF,EACV,OAAOyF,EAAGe,IACd,GAAIvB,IAAU/E,EACV,OAAOa,EACX,IAAI4K,EAAIlG,EAAGe,IACPoF,EAAI7K,EACR,KAAOkE,EAAQjF,GACPiF,EAAQ/E,IACRyL,EAAIlG,EAAGW,IAAIuF,EAAGC,IAClBA,EAAInG,EAAGG,IAAIgG,GACX3G,IAAU/E,EAEd,OAAOyL,CACX,CA6I6BE,CAAMZ,EAAGlK,EAAKkE,GACnC6G,IAAK,CAACN,EAAKC,IAAQ9G,EAAI6G,EAAMrG,EAAOsG,EAAK1F,GAAQA,GAEjDgG,KAAOhL,GAAQA,EAAMA,EACrBiL,KAAM,CAACR,EAAKC,IAAQD,EAAMC,EAC1BQ,KAAM,CAACT,EAAKC,IAAQD,EAAMC,EAC1BS,KAAM,CAACV,EAAKC,IAAQD,EAAMC,EAC1BlC,IAAMxI,GAAQoE,EAAOpE,EAAKgF,GAC1B6E,KAAMH,GACd,CAAc9I,IACOqJ,IACDA,EAAQrD,GAAO5B,IACZiF,EAAMC,EAAGtJ,KAExBwK,QAAUpL,GAASuJ,EAAOxI,EAAgBf,EAAKgK,GAASrJ,EAAgBX,EAAKgK,GAC7EqB,UAAW,CAAC3L,EAAO4L,GAAiB,KAChC,GAAI3B,EAAgB,CAChB,IAAKA,EAAe4B,SAAS7L,EAAMD,SAAWC,EAAMD,OAASuK,EACzD,MAAUzK,MAAM,6BAA+BoK,EAAiB,eAAiBjK,EAAMD,QAE3F,MAAM+L,EAAS,IAAIhL,WAAWwJ,GAE9BwB,EAAOrI,IAAIzD,EAAO6J,EAAO,EAAIiC,EAAO/L,OAASC,EAAMD,QACnDC,EAAQ8L,CACZ,CACA,GAAI9L,EAAMD,SAAWuK,EACjB,MAAUzK,MAAM,6BAA+ByK,EAAQ,eAAiBtK,EAAMD,QAClF,IAAIgM,EAASlC,EAAOjJ,EAAgBZ,GAASU,EAAgBV,GAG7D,GAFIkK,IACA6B,EAAS7H,EAAI6H,EAAQzG,KACpBsG,IACIpB,EAAEI,QAAQmB,GACX,MAAUlM,MAAM,oDAGxB,OAAOkM,CAAM,EAGjBC,YAAcC,GAAQ7D,GAAcoC,EAAGyB,GAGvCjE,KAAM,CAAC7D,EAAGC,EAAGwC,IAAOA,EAAIxC,EAAID,IAEhC,OAAOvB,OAAO6H,OAAOD,EACzB,CA+CO,SAAS0B,GAAoBC,GAChC,GAA0B,iBAAfA,EACP,MAAUtM,MAAM,8BACpB,MAAMuM,EAAYD,EAAW3L,SAAS,GAAGT,OACzC,OAAO2J,KAAKC,KAAKyC,EAAY,EACjC,CAQO,SAASC,GAAiBF,GAC7B,MAAMpM,EAASmM,GAAoBC,GACnC,OAAOpM,EAAS2J,KAAKC,KAAK5J,EAAS,EACvC,CClfO,MAAMuM,WAAaC,EACtB,WAAAC,CAAYC,EAAMC,GACdC,QACAC,KAAKC,UAAW,EAChBD,KAAKE,WAAY,EACjBC,EAAMN,GACN,MAAMO,EAAMtB,EAAQgB,GAEpB,GADAE,KAAKK,MAAQR,EAAK9B,SACe,mBAAtBiC,KAAKK,MAAMC,OAClB,MAAUrN,MAAM,uDACpB+M,KAAKO,SAAWP,KAAKK,MAAME,SAC3BP,KAAKQ,UAAYR,KAAKK,MAAMG,UAC5B,MAAMD,EAAWP,KAAKO,SAChBE,EAAM,IAAIvM,WAAWqM,GAE3BE,EAAI5J,IAAIuJ,EAAIjN,OAASoN,EAAWV,EAAK9B,SAASuC,OAAOF,GAAKM,SAAWN,GACrE,IAAK,IAAInH,EAAI,EAAGA,EAAIwH,EAAItN,OAAQ8F,IAC5BwH,EAAIxH,IAAM,GACd+G,KAAKK,MAAMC,OAAOG,GAElBT,KAAKW,MAAQd,EAAK9B,SAElB,IAAK,IAAI9E,EAAI,EAAGA,EAAIwH,EAAItN,OAAQ8F,IAC5BwH,EAAIxH,IAAM,IACd+G,KAAKW,MAAML,OAAOG,GAClBG,EAAMH,EACV,CACA,MAAAH,CAAOO,GAGH,OAFAC,EAAQd,MACRA,KAAKK,MAAMC,OAAOO,GACXb,IACX,CACA,UAAAe,CAAWC,GACPF,EAAQd,MACRiB,EAAOD,EAAKhB,KAAKQ,WACjBR,KAAKC,UAAW,EAChBD,KAAKK,MAAMU,WAAWC,GACtBhB,KAAKW,MAAML,OAAOU,GAClBhB,KAAKW,MAAMI,WAAWC,GACtBhB,KAAKkB,SACT,CACA,MAAAR,GACI,MAAMM,EAAM,IAAI9M,WAAW8L,KAAKW,MAAMH,WAEtC,OADAR,KAAKe,WAAWC,GACTA,CACX,CACA,UAAAG,CAAWC,GAEPA,IAAOA,EAAKpL,OAAO+H,OAAO/H,OAAOqL,eAAerB,MAAO,CAAA,IACvD,MAAMW,MAAEA,EAAKN,MAAEA,EAAKJ,SAAEA,EAAQC,UAAEA,EAASK,SAAEA,EAAQC,UAAEA,GAAcR,KAQnE,OANAoB,EAAGnB,SAAWA,EACdmB,EAAGlB,UAAYA,EACfkB,EAAGb,SAAWA,EACda,EAAGZ,UAAYA,EACfY,EAAGT,MAAQA,EAAMQ,WAAWC,EAAGT,OAC/BS,EAAGf,MAAQA,EAAMc,WAAWC,EAAGf,OACxBe,CACX,CACA,KAAAE,GACI,OAAOtB,KAAKmB,YAChB,CACA,OAAAD,GACIlB,KAAKE,WAAY,EACjBF,KAAKW,MAAMO,UACXlB,KAAKK,MAAMa,SACf,EAYG,MAAMK,GAAO,CAAC1B,EAAMO,EAAKoB,IAAY,IAAI9B,GAAKG,EAAMO,GAAKE,OAAOkB,GAASd,SAChFa,GAAKxD,OAAS,CAAC8B,EAAMO,IAAQ,IAAIV,GAAKG,EAAMO;uEC5E5C,MAAMzN,GAAMC,OAAO,GACbC,GAAMD,OAAO,GACZ,SAAS6O,GAASC,EAAWC,GAChC,MAAMjH,EAAMiH,EAAKC,SACjB,OAAOF,EAAYhH,EAAMiH,CAC7B,CAOO,SAASE,GAAW7H,EAAG8H,GAC1B,MAAMC,EAAavG,GAAcxB,EAAE5B,GAAI0J,EAAOvL,KAAK+H,GAAMA,EAAE9E,KAC3D,OAAOsI,EAAOvL,KAAI,CAAC+H,EAAGrF,IAAMe,EAAEgI,WAAW1D,EAAE2D,SAASF,EAAW9I,MACnE,CACA,SAASiJ,GAAUC,EAAGC,GAClB,IAAKC,OAAOC,cAAcH,IAAMA,GAAK,GAAKA,EAAIC,EAC1C,MAAUnP,MAAM,qCAAuCmP,EAAO,YAAcD,EACpF,CACA,SAASI,GAAUJ,EAAGK,GAClBN,GAAUC,EAAGK,GACb,MAEMC,EAAY,GAAKN,EAGvB,MAAO,CAAEO,QALO5F,KAAKC,KAAKyF,EAAaL,GAAK,EAK1BQ,WAJC,IAAMR,EAAI,GAICS,KAFjBvN,EAAQ8M,GAEeM,YAAWI,QAD/BjQ,OAAOuP,GAE3B,CACA,SAASW,GAAYxO,EAAGyO,EAAQC,GAC5B,MAAML,WAAEA,EAAUC,KAAEA,EAAIH,UAAEA,EAASI,QAAEA,GAAYG,EACjD,IAAIC,EAAQZ,OAAO/N,EAAIsO,GACnBM,EAAQ5O,GAAKuO,EAMbI,EAAQN,IAERM,GAASR,EACTS,GAASrQ,IAEb,MAAMsQ,EAAcJ,EAASJ,EAM7B,MAAO,CAAEO,QAAOE,OALDD,EAAcrG,KAAKuG,IAAIJ,GAAS,EAKvBK,OAJC,IAAVL,EAIiBM,MAHlBN,EAAQ,EAGiBO,OAFxBT,EAAS,GAAM,EAEiBU,QAD/BN,EAEpB,CAoBA,MAAMO,GAAmB,IAAIlN,QACvBmN,GAAmB,IAAInN,QAC7B,SAASoN,GAAKvK,GAGV,OAAOsK,GAAiBhN,IAAI0C,IAAM,CACtC,CACA,SAASwK,GAAQvP,GACb,GAAIA,IAAM3B,GACN,MAAUM,MAAM,eACxB,CAmBO,MAAM6Q,GAET,WAAAlE,CAAYmE,EAAO3B,GACfpC,KAAKgE,KAAOD,EAAMC,KAClBhE,KAAK7F,KAAO4J,EAAM5J,KAClB6F,KAAKiE,GAAKF,EAAME,GAChBjE,KAAKoC,KAAOA,CAChB,CAEA,aAAA8B,CAAcC,EAAK7P,EAAGgK,EAAI0B,KAAK7F,MAC3B,IAAIoE,EAAI4F,EACR,KAAO7P,EAAI3B,IACH2B,EAAIzB,KACJyL,EAAIA,EAAED,IAAIE,IACdA,EAAIA,EAAE6F,SACN9P,IAAMzB,GAEV,OAAOyL,CACX,CAaA,gBAAA+F,CAAiBC,EAAOnC,GACpB,MAAMO,QAAEA,EAAOC,WAAEA,GAAeJ,GAAUJ,EAAGnC,KAAKoC,MAC5CN,EAAS,GACf,IAAIxD,EAAIgG,EACJC,EAAOjG,EACX,IAAK,IAAIyE,EAAS,EAAGA,EAASL,EAASK,IAAU,CAC7CwB,EAAOjG,EACPwD,EAAO0C,KAAKD,GAEZ,IAAK,IAAItL,EAAI,EAAGA,EAAI0J,EAAY1J,IAC5BsL,EAAOA,EAAKlG,IAAIC,GAChBwD,EAAO0C,KAAKD,GAEhBjG,EAAIiG,EAAKH,QACb,CACA,OAAOtC,CACX,CAOA,IAAAgC,CAAK3B,EAAGsC,EAAanQ,GAEjB,IAAK0L,KAAKiE,GAAGjG,QAAQ1J,GACjB,MAAUrB,MAAM,kBAEpB,IAAIqL,EAAI0B,KAAK7F,KACTyD,EAAIoC,KAAKgE,KAMb,MAAMU,EAAKnC,GAAUJ,EAAGnC,KAAKoC,MAC7B,IAAK,IAAIW,EAAS,EAAGA,EAAS2B,EAAGhC,QAASK,IAAU,CAEhD,MAAMG,MAAEA,EAAKE,OAAEA,EAAME,OAAEA,EAAMC,MAAEA,EAAKC,OAAEA,EAAMC,QAAEA,GAAYX,GAAYxO,EAAGyO,EAAQ2B,GACjFpQ,EAAI4O,EACAI,EAGA1F,EAAIA,EAAES,IAAIoD,GAAS+B,EAAQiB,EAAYhB,KAIvCnF,EAAIA,EAAED,IAAIoD,GAAS8B,EAAOkB,EAAYrB,IAE9C,CAKA,OAJAS,GAAQvP,GAID,CAAEgK,IAAGV,IAChB,CAMA,UAAA+G,CAAWxC,EAAGsC,EAAanQ,EAAG0H,EAAMgE,KAAK7F,MACrC,MAAMuK,EAAKnC,GAAUJ,EAAGnC,KAAKoC,MAC7B,IAAK,IAAIW,EAAS,EAAGA,EAAS2B,EAAGhC,SACzBpO,IAAM3B,GAD4BoQ,IAAU,CAGhD,MAAMG,MAAEA,EAAKE,OAAEA,EAAME,OAAEA,EAAMC,MAAEA,GAAUT,GAAYxO,EAAGyO,EAAQ2B,GAEhE,GADApQ,EAAI4O,GACAI,EAKC,CACD,MAAM3B,EAAO8C,EAAYrB,GACzBpH,EAAMA,EAAIqC,IAAIkF,EAAQ5B,EAAKC,SAAWD,EAC1C,CACJ,CAEA,OADAkC,GAAQvP,GACD0H,CACX,CACA,cAAA4I,CAAezC,EAAGmC,EAAOO,GAErB,IAAIC,EAAOpB,GAAiB/M,IAAI2N,GAUhC,OATKQ,IACDA,EAAO9E,KAAKqE,iBAAiBC,EAAOnC,GAC1B,IAANA,IAEyB,mBAAd0C,IACPC,EAAOD,EAAUC,IACrBpB,GAAiB7M,IAAIyN,EAAOQ,KAG7BA,CACX,CACA,MAAAC,CAAOT,EAAOnF,EAAQ0F,GAClB,MAAM1C,EAAIyB,GAAKU,GACf,OAAOtE,KAAK8D,KAAK3B,EAAGnC,KAAK4E,eAAezC,EAAGmC,EAAOO,GAAY1F,EAClE,CACA,MAAA6F,CAAOV,EAAOnF,EAAQ0F,EAAWI,GAC7B,MAAM9C,EAAIyB,GAAKU,GACf,OAAU,IAANnC,EACOnC,KAAKkE,cAAcI,EAAOnF,EAAQ8F,GACtCjF,KAAK2E,WAAWxC,EAAGnC,KAAK4E,eAAezC,EAAGmC,EAAOO,GAAY1F,EAAQ8F,EAChF,CAIA,WAAAC,CAAY7L,EAAG8I,GACXD,GAAUC,EAAGnC,KAAKoC,MAClBuB,GAAiB9M,IAAIwC,EAAG8I,GACxBuB,GAAiByB,OAAO9L,EAC5B,CACA,QAAA+L,CAASjB,GACL,OAAqB,IAAdP,GAAKO,EAChB,EA+BG,SAASkB,GAAUrL,EAAGsL,EAAQxD,EAAQyD,IAjO7C,SAA2BzD,EAAQ9H,GAC/B,IAAK4B,MAAM4J,QAAQ1D,GACf,MAAU7O,MAAM,kBACpB6O,EAAO5L,SAAQ,CAACoI,EAAGrF,KACf,KAAMqF,aAAatE,GACf,MAAU/G,MAAM,0BAA4BgG,EAAE,GAE1D,CAiOIwM,CAAkB3D,EAAQ9H,GAhO9B,SAA4BuL,EAASG,GACjC,IAAK9J,MAAM4J,QAAQD,GACf,MAAUtS,MAAM,6BACpBsS,EAAQrP,SAAQ,CAACyP,EAAG1M,KAChB,IAAKyM,EAAM1H,QAAQ2H,GACf,MAAU1S,MAAM,2BAA6BgG,EAAE,GAE3D,CA0NI2M,CAAmBL,EAASD,GAC5B,MAAMO,EAAU/D,EAAO3O,OACjB2S,EAAUP,EAAQpS,OACxB,GAAI0S,IAAYC,EACZ,MAAU7S,MAAM,uDAEpB,MAAMsJ,EAAOvC,EAAEG,KACT8I,EAAQ7N,EAAOxC,OAAOiT,IAC5B,IAAIlD,EAAa,EACbM,EAAQ,GACRN,EAAaM,EAAQ,EAChBA,EAAQ,EACbN,EAAaM,EAAQ,EAChBA,EAAQ,IACbN,EAAa,GACjB,MAAM7E,EAAOzI,EAAQsN,GACfoD,EAAcnK,MAAMyG,OAAOvE,GAAQ,GAAGjC,KAAKU,GAEjD,IAAIyJ,EAAMzJ,EACV,IAAK,IAAItD,EAFQ6D,KAAKmJ,OAAOX,EAAO7H,KAAO,GAAKkF,GAAcA,EAEvC1J,GAAK,EAAGA,GAAK0J,EAAY,CAC5CoD,EAAQlK,KAAKU,GACb,IAAK,IAAI2J,EAAI,EAAGA,EAAIJ,EAASI,IAAK,CAC9B,MAAM/G,EAASoG,EAAQW,GACjBjD,EAAQZ,OAAQlD,GAAUvM,OAAOqG,GAAM6E,GAC7CiI,EAAQ9C,GAAS8C,EAAQ9C,GAAO5E,IAAIyD,EAAOoE,GAC/C,CACA,IAAIC,EAAO5J,EAEX,IAAK,IAAI2J,EAAIH,EAAQ5S,OAAS,EAAGiT,EAAO7J,EAAM2J,EAAI,EAAGA,IACjDE,EAAOA,EAAK/H,IAAI0H,EAAQG,IACxBC,EAAOA,EAAK9H,IAAI+H,GAGpB,GADAJ,EAAMA,EAAI3H,IAAI8H,GACJ,IAANlN,EACA,IAAK,IAAIiN,EAAI,EAAGA,EAAIvD,EAAYuD,IAC5BF,EAAMA,EAAI5B,QACtB,CACA,OAAO4B,CACX,CAoGA,SAASK,GAAYC,EAAOZ,EAAOzI,GAC/B,GAAIyI,EAAO,CACP,GAAIA,EAAMhN,QAAU4N,EAChB,MAAUrT,MAAM,kDAEpB,OF1ND,SAAuByS,GAW1BpQ,EAAgBoQ,EAJHnK,GAAaQ,QAAO,CAACxF,EAAKT,KACnCS,EAAIT,GAAO,WACJS,IARK,CACZmC,MAAO,SACPoF,KAAM,SACNJ,MAAO,SACPD,KAAM,WAWd,CEyMQ8I,CAAcb,GACPA,CACX,CAEI,OAAOhM,GAAM4M,EAAO,CAAErJ,QAE9B,CAEO,SAASuJ,GAAmBC,EAAMC,EAAOC,EAAY,CAAA,EAAIC,GAG5D,QAFepT,IAAXoT,IACAA,EAAkB,YAATH,IACRC,GAA0B,iBAAVA,EACjB,MAAUzT,MAAM,kBAAkBwT,kBACtC,IAAK,MAAMnI,IAAK,CAAC,IAAK,IAAK,KAAM,CAC7B,MAAMxI,EAAM4Q,EAAMpI,GAClB,KAAqB,iBAARxI,GAAoBA,EAAMnD,IACnC,MAAUM,MAAM,SAASqL,4BACjC,CACA,MAAMlG,EAAKiO,GAAYK,EAAMpI,EAAGqI,EAAUvO,GAAIwO,GACxC3C,EAAKoC,GAAYK,EAAMpS,EAAGqS,EAAU1C,GAAI2C,GAExCC,EAAS,CAAC,KAAM,KAAM,IADR,gBAATJ,EAAyB,IAAM,KAE1C,IAAK,MAAMnI,KAAKuI,EAEZ,IAAKzO,EAAG4F,QAAQ0I,EAAMpI,IAClB,MAAUrL,MAAM,SAASqL,6CAGjC,MAAO,CAAEoI,MADTA,EAAQ1Q,OAAO6H,OAAO7H,OAAO8Q,OAAO,CAAA,EAAIJ,IACxBtO,KAAI6L,KACxB;sEC9aA,MAAM8C,GAAa,CAACrT,EAAKsT,KAAStT,GAAOA,GAAO,EAAIsT,GAAOA,GAAOlQ,IAAOkQ,EA6BzE,SAASC,GAAkBC,GACvB,IAAK,CAAC,UAAW,YAAa,OAAOjI,SAASiI,GAC1C,MAAUjU,MAAM,6DACpB,OAAOiU,CACX,CACA,SAASC,GAAgBjK,EAAMkK,GAC3B,MAAMC,EAAQ,CAAA,EACd,IAAK,IAAIC,KAAWtR,OAAOuR,KAAKH,GAE5BC,EAAMC,QAA6B9T,IAAlB0J,EAAKoK,GAAyBF,EAAIE,GAAWpK,EAAKoK,GAMvE,OAJAE,EAAMH,EAAMI,KAAM,QAClBD,EAAMH,EAAMK,QAAS,gBACAlU,IAAjB6T,EAAMH,QACND,GAAkBI,EAAMH,QACrBG,CACX,CAaO,MAAMM,GAAM,CAEfC,IAdG,cAAqB3U,MACxB,WAAA2M,CAAY1H,EAAI,IACZ6H,MAAM7H,EACV,GAaA2P,KAAM,CACFC,OAAQ,CAACC,EAAKC,KACV,MAAQJ,IAAKK,GAAMN,GACnB,GAAII,EAAM,GAAKA,EAAM,IACjB,MAAM,IAAIE,EAAE,yBAChB,GAAkB,EAAdD,EAAK7U,OACL,MAAM,IAAI8U,EAAE,6BAChB,MAAMC,EAAUF,EAAK7U,OAAS,EACxBG,EAAMG,EAAoByU,GAChC,GAAK5U,EAAIH,OAAS,EAAK,IACnB,MAAM,IAAI8U,EAAE,wCAEhB,MAAME,EAASD,EAAU,IAAMzU,EAAqBH,EAAIH,OAAS,EAAK,KAAO,GAE7E,OADUM,EAAoBsU,GACnBI,EAAS7U,EAAM0U,CAAI,EAGlC,MAAAI,CAAOL,EAAKC,GACR,MAAQJ,IAAKK,GAAMN,GACnB,IAAIU,EAAM,EACV,GAAIN,EAAM,GAAKA,EAAM,IACjB,MAAM,IAAIE,EAAE,yBAChB,GAAID,EAAK7U,OAAS,GAAK6U,EAAKK,OAAWN,EACnC,MAAM,IAAIE,EAAE,yBAChB,MAAMK,EAAQN,EAAKK,KAEnB,IAAIlV,EAAS,EACb,MAF0B,IAARmV,GAIb,CAED,MAAMH,EAAiB,IAARG,EACf,IAAKH,EACD,MAAM,IAAIF,EAAE,qDAChB,GAAIE,EAAS,EACT,MAAM,IAAIF,EAAE,4CAChB,MAAMM,EAAcP,EAAKQ,SAASH,EAAKA,EAAMF,GAC7C,GAAII,EAAYpV,SAAWgV,EACvB,MAAM,IAAIF,EAAE,yCAChB,GAAuB,IAAnBM,EAAY,GACZ,MAAM,IAAIN,EAAE,wCAChB,IAAK,MAAMzQ,KAAK+Q,EACZpV,EAAUA,GAAU,EAAKqE,EAE7B,GADA6Q,GAAOF,EACHhV,EAAS,IACT,MAAM,IAAI8U,EAAE,yCACpB,MAlBI9U,EAASmV,EAmBb,MAAMlS,EAAI4R,EAAKQ,SAASH,EAAKA,EAAMlV,GACnC,GAAIiD,EAAEjD,SAAWA,EACb,MAAM,IAAI8U,EAAE,kCAChB,MAAO,CAAE7R,IAAGqS,EAAGT,EAAKQ,SAASH,EAAMlV,GACvC,GAMJuV,KAAM,CACF,MAAAZ,CAAOpU,GACH,MAAQkU,IAAKK,GAAMN,GACnB,GAAIjU,EAAMf,GACN,MAAM,IAAIsV,EAAE,8CAChB,IAAItU,EAAMF,EAAoBC,GAI9B,GAFkC,EAA9B2O,OAAOsG,SAAShV,EAAI,GAAI,MACxBA,EAAM,KAAOA,GACA,EAAbA,EAAIR,OACJ,MAAM,IAAI8U,EAAE,kDAChB,OAAOtU,CACX,EACA,MAAAyU,CAAOJ,GACH,MAAQJ,IAAKK,GAAMN,GACnB,GAAc,IAAVK,EAAK,GACL,MAAM,IAAIC,EAAE,uCAChB,GAAgB,IAAZD,EAAK,MAA2B,IAAVA,EAAK,IAC3B,MAAM,IAAIC,EAAE,uDAChB,OAAOnU,EAAgBkU,EAC3B,GAEJ,KAAAY,CAAMjV,GAEF,MAAQiU,IAAKK,EAAGS,KAAMG,EAAKhB,KAAMiB,GAAQnB,GACnCK,EAAOtT,EAAY,YAAaf,IAC9ByC,EAAG2S,EAAUN,EAAGO,GAAiBF,EAAIV,OAAO,GAAMJ,GAC1D,GAAIgB,EAAa7V,OACb,MAAM,IAAI8U,EAAE,+CAChB,MAAQ7R,EAAG6S,EAAQR,EAAGS,GAAeJ,EAAIV,OAAO,EAAMW,IAC9C3S,EAAG+S,EAAQV,EAAGW,GAAeN,EAAIV,OAAO,EAAMc,GACtD,GAAIE,EAAWjW,OACX,MAAM,IAAI8U,EAAE,+CAChB,MAAO,CAAEhQ,EAAG4Q,EAAIT,OAAOa,GAAStD,EAAGkD,EAAIT,OAAOe,GAClD,EACA,UAAAE,CAAWC,GACP,MAAQzB,KAAMiB,EAAKJ,KAAMG,GAAQlB,GAG3B4B,EAFKT,EAAIhB,OAAO,EAAMe,EAAIf,OAAOwB,EAAIrR,IAChC6Q,EAAIhB,OAAO,EAAMe,EAAIf,OAAOwB,EAAI3D,IAE3C,OAAOmD,EAAIhB,OAAO,GAAMyB,EAC5B,GAIE5W,GAAMC,OAAO,GAAIC,GAAMD,OAAO,GAAIkE,GAAMlE,OAAO,GAAImE,GAAMnE,OAAO,GAAIoE,GAAMpE,OAAO,GAChF,SAAS4W,GAAevF,EAAI7D,GAC/B,MAAQ1C,MAAO+L,GAAaxF,EAC5B,IAAIvQ,EACJ,GAAmB,iBAAR0M,EACP1M,EAAM0M,MAEL,CACD,IAAIhN,EAAQsB,EAAY,cAAe0L,GACvC,IACI1M,EAAMuQ,EAAGlF,UAAU3L,EACvB,CACA,MAAOsW,GACH,MAAUzW,MAAM,8CAA8CwW,iBAAwBrJ,IAC1F,CACJ,CACA,IAAK6D,EAAGhG,YAAYvK,GAChB,MAAUT,MAAM,8CACpB,OAAOS,CACX,CAkBO,SAASiW,GAAa9C,EAAQ+C,EAAY,IAC7C,MAAMC,EAAYrD,GAAmB,cAAeK,EAAQ+C,IACtDxR,GAAEA,EAAE6L,GAAEA,GAAO4F,EACnB,IAAInD,EAAQmD,EAAUnD,MACtB,MAAQoD,EAAGC,EAAUzV,EAAG0V,GAAgBtD,EACxCpR,EAAgBsU,EAAW,GAAI,CAC3BK,mBAAoB,UACpBC,cAAe,WACfC,cAAe,WACfpL,UAAW,WACXD,QAAS,WACTsL,KAAM,SACNC,eAAgB,YAEpB,MAAMD,KAAEA,GAASR,EACjB,GAAIQ,KAEKhS,EAAG0B,IAAI4M,EAAMnP,IAA2B,iBAAd6S,EAAKE,OAAsB1O,MAAM4J,QAAQ4E,EAAKG,UACzE,MAAUtX,MAAM,8DAGxB,MAAMuX,EAAUC,GAAYrS,EAAI6L,GAChC,SAASyG,IACL,IAAKtS,EAAG8F,MACJ,MAAUjL,MAAM,6DACxB,CAuDA,MAAM0X,EAAcf,EAAU9K,SArD9B,SAAsB8L,EAAItG,EAAOuG,GAC7B,MAAMlT,EAAEA,EAACmT,EAAEA,GAAMxG,EAAMrC,WACjB8I,EAAK3S,EAAG0G,QAAQnH,GAEtB,GADA6P,EAAMqD,EAAc,gBAChBA,EAAc,CACdH,IACA,MAAMM,GAAY5S,EAAG8F,MAAM4M,GAC3B,OAAOG,EAAYC,GAAQF,GAAWD,EAC1C,CAEI,OAAOE,EAAY/W,WAAWiX,GAAG,GAAOJ,EAAI3S,EAAG0G,QAAQgM,GAE/D,EA0CMM,EAAcxB,EAAU7K,WAzC9B,SAAwB3L,GACpB6N,EAAO7N,OAAOI,EAAW,SACzB,MAAQ6X,UAAWvG,EAAMwG,sBAAuBC,GAAWf,EACrDrX,EAASC,EAAMD,OACfqY,EAAOpY,EAAM,GACbqY,EAAOrY,EAAMoV,SAAS,GAE5B,GAAIrV,IAAW2R,GAAkB,IAAT0G,GAA0B,IAATA,EAoBpC,IAAIrY,IAAWoY,GAAmB,IAATC,EAAe,CAEzC,MAAME,EAAItT,EAAGsF,MACP/F,EAAIS,EAAG2G,UAAU0M,EAAKjD,SAAS,EAAGkD,IAClCZ,EAAI1S,EAAG2G,UAAU0M,EAAKjD,SAASkD,EAAO,EAAJA,IACxC,IAAKC,EAAUhU,EAAGmT,GACd,MAAU7X,MAAM,8BACpB,MAAO,CAAE0E,IAAGmT,IAChB,CAEI,MAAU7X,MAAM,yBAAyBE,0BAA+B2R,qBAAwByG,IACpG,CA/ByD,CACrD,MAAM5T,EAAIS,EAAG2G,UAAU0M,GACvB,IAAKrT,EAAG4F,QAAQrG,GACZ,MAAU1E,MAAM,uCACpB,MAAM2Y,EAAKC,EAAoBlU,GAC/B,IAAImT,EACJ,IACIA,EAAI1S,EAAGmF,KAAKqO,EAChB,CACA,MAAOE,GACH,MAAMC,EAAMD,aAAqB7Y,MAAQ,KAAO6Y,EAAUtK,QAAU,GACpE,MAAUvO,MAAM,yCAA2C8Y,EAC/D,CACArB,IAKA,QAHiC,GAAdc,KADJpT,EAAG8F,MAAM4M,KAGpBA,EAAI1S,EAAGsC,IAAIoQ,IACR,CAAEnT,IAAGmT,IAChB,CAaJ,EAGA,SAASe,EAAoBlU,GACzB,MAAMqU,EAAK5T,EAAGG,IAAIZ,GACZsU,EAAK7T,EAAGW,IAAIiT,EAAIrU,GACtB,OAAOS,EAAGiG,IAAIjG,EAAGiG,IAAI4N,EAAI7T,EAAGW,IAAIpB,EAAG+O,EAAMnP,IAAKmP,EAAMlP,EACxD,CAGA,SAASmU,EAAUhU,EAAGmT,GAClB,MAAMoB,EAAO9T,EAAGG,IAAIuS,GACdqB,EAAQN,EAAoBlU,GAClC,OAAOS,EAAGE,IAAI4T,EAAMC,EACxB,CAGA,IAAKR,EAAUjF,EAAM0F,GAAI1F,EAAM2F,IAC3B,MAAUpZ,MAAM,qCAGpB,MAAMqZ,EAAOlU,EAAGW,IAAIX,EAAGO,IAAI+N,EAAMnP,EAAGR,IAAMC,IACpCuV,EAAQnU,EAAGW,IAAIX,EAAGG,IAAImO,EAAMlP,GAAI5E,OAAO,KAC7C,GAAIwF,EAAG0B,IAAI1B,EAAGiG,IAAIiO,EAAMC,IACpB,MAAUtZ,MAAM,4BAEpB,SAASuZ,EAAOxZ,EAAOsB,EAAGmY,GAAU,GAChC,IAAKrU,EAAG4F,QAAQ1J,IAAOmY,GAAWrU,EAAG0B,IAAIxF,GACrC,MAAUrB,MAAM,wBAAwBD,GAC5C,OAAOsB,CACX,CACA,SAASoY,EAAUC,GACf,KAAMA,aAAiB5I,GACnB,MAAU9Q,MAAM,2BACxB,CACA,SAAS2Z,EAAiBzW,GACtB,IAAKiU,IAASA,EAAKG,QACf,MAAUtX,MAAM,WACpB,OA1TD,SAA0BkD,EAAG0W,EAAOvY,GAIvC,OAAQwY,EAAIC,IAAMC,EAAIC,IAAOJ,EACvBpS,EAAKsM,GAAWkG,EAAK9W,EAAG7B,GACxBqG,EAAKoM,IAAYgG,EAAK5W,EAAG7B,GAG/B,IAAI4Y,EAAK/W,EAAIsE,EAAKqS,EAAKnS,EAAKqS,EACxBG,GAAM1S,EAAKsS,EAAKpS,EAAKsS,EACzB,MAAMG,EAAQF,EAAKva,GACb0a,EAAQF,EAAKxa,GACfya,IACAF,GAAMA,GACNG,IACAF,GAAMA,GAGV,MAAMG,EAAUjY,EAAQyH,KAAKC,KAAK3H,EAAOd,GAAK,IAAMzB,GACpD,GAAIqa,EAAKva,IAAOua,GAAMI,GAAWH,EAAKxa,IAAOwa,GAAMG,EAC/C,MAAUra,MAAM,yCAA2CkD,GAE/D,MAAO,CAAEiX,QAAOF,KAAIG,QAAOF,KAC/B,CAkSeI,CAAiBpX,EAAGiU,EAAKG,QAAStG,EAAGvL,MAChD,CAKA,MAAM8U,EAAenX,GAAS,CAACiI,EAAGmP,KAC9B,MAAMC,EAAEA,EAACC,EAAEA,EAACnU,EAAEA,GAAM8E,EAEpB,GAAIlG,EAAGE,IAAIkB,EAAGpB,EAAGe,KACb,MAAO,CAAExB,EAAG+V,EAAG5C,EAAG6C,GACtB,MAAM7T,EAAMwE,EAAExE,MAGJ,MAAN2T,IACAA,EAAK3T,EAAM1B,EAAGe,IAAMf,EAAG8D,IAAI1C,IAC/B,MAAM7B,EAAIS,EAAGW,IAAI2U,EAAGD,GACd3C,EAAI1S,EAAGW,IAAI4U,EAAGF,GACdG,EAAKxV,EAAGW,IAAIS,EAAGiU,GACrB,GAAI3T,EACA,MAAO,CAAEnC,EAAGS,EAAG+B,KAAM2Q,EAAG1S,EAAG+B,MAC/B,IAAK/B,EAAGE,IAAIsV,EAAIxV,EAAGe,KACf,MAAUlG,MAAM,oBACpB,MAAO,CAAE0E,IAAGmT,IAAG,IAIb+C,EAAkBxX,GAAUiI,IAC9B,GAAIA,EAAExE,MAAO,CAIT,GAAI8P,EAAUK,qBAAuB7R,EAAG0B,IAAIwE,EAAEqP,GAC1C,OACJ,MAAU1a,MAAM,kBACpB,CAEA,MAAM0E,EAAEA,EAACmT,EAAEA,GAAMxM,EAAE2D,WACnB,IAAK7J,EAAG4F,QAAQrG,KAAOS,EAAG4F,QAAQ8M,GAC9B,MAAU7X,MAAM,wCACpB,IAAK0Y,EAAUhU,EAAGmT,GACd,MAAU7X,MAAM,qCACpB,IAAKqL,EAAE6L,gBACH,MAAUlX,MAAM,0CACpB,OAAO,CAAI,IAEf,SAAS6a,EAAWC,EAAUC,EAAKC,EAAKb,EAAOC,GAI3C,OAHAY,EAAM,IAAIlK,EAAM3L,EAAGW,IAAIkV,EAAIP,EAAGK,GAAWE,EAAIN,EAAGM,EAAIzU,GACpDwU,EAAMvM,GAAS2L,EAAOY,GACtBC,EAAMxM,GAAS4L,EAAOY,GACfD,EAAI3P,IAAI4P,EACnB,CAMA,MAAMlK,EAEF,WAAAnE,CAAY8N,EAAGC,EAAGnU,GACdwG,KAAK0N,EAAIlB,EAAO,IAAKkB,GACrB1N,KAAK2N,EAAInB,EAAO,IAAKmB,GAAG,GACxB3N,KAAKxG,EAAIgT,EAAO,IAAKhT,GACrBxD,OAAO6H,OAAOmC,KAClB,CACA,YAAO0G,GACH,OAAOA,CACX,CAEA,iBAAO1E,CAAW1D,GACd,MAAM3G,EAAEA,EAACmT,EAAEA,GAAMxM,GAAK,CAAA,EACtB,IAAKA,IAAMlG,EAAG4F,QAAQrG,KAAOS,EAAG4F,QAAQ8M,GACpC,MAAU7X,MAAM,wBACpB,GAAIqL,aAAayF,EACb,MAAU9Q,MAAM,gCAEpB,OAAImF,EAAG0B,IAAInC,IAAMS,EAAG0B,IAAIgR,GACb/G,EAAM5J,KACV,IAAI4J,EAAMpM,EAAGmT,EAAG1S,EAAGe,IAC9B,CACA,gBAAO4F,CAAU3L,GACb,MAAMiG,EAAI0K,EAAM/B,WAAWoJ,EAAYnK,EAAO7N,OAAOI,EAAW,WAEhE,OADA6F,EAAE6U,iBACK7U,CACX,CACA,cAAO8U,CAAQxa,GACX,OAAOoQ,EAAMhF,UAAUrK,EAAY,WAAYf,GACnD,CACA,KAAIgE,GACA,OAAOqI,KAAKiC,WAAWtK,CAC3B,CACA,KAAImT,GACA,OAAO9K,KAAKiC,WAAW6I,CAC3B,CAOA,UAAAsD,CAAWzL,EAAa,EAAG0L,GAAS,GAIhC,OAHAC,EAAKpJ,YAAYlF,KAAM2C,GAClB0L,GACDrO,KAAKuO,SAASxX,IACXiJ,IACX,CAGA,cAAAkO,GACIL,EAAgB7N,KACpB,CACA,QAAAgL,GACI,MAAMF,EAAEA,GAAM9K,KAAKiC,WACnB,IAAK7J,EAAG8F,MACJ,MAAUjL,MAAM,+BACpB,OAAQmF,EAAG8F,MAAM4M,EACrB,CAEA,MAAA0D,CAAO7B,GACHD,EAAUC,GACV,MAAQe,EAAGe,EAAId,EAAGe,EAAIlV,EAAGmV,GAAO3O,MACxB0N,EAAGkB,EAAIjB,EAAGkB,EAAIrV,EAAGsV,GAAOnC,EAC1BoC,EAAK3W,EAAGE,IAAIF,EAAGW,IAAI0V,EAAIK,GAAK1W,EAAGW,IAAI6V,EAAID,IACvCK,EAAK5W,EAAGE,IAAIF,EAAGW,IAAI2V,EAAII,GAAK1W,EAAGW,IAAI8V,EAAIF,IAC7C,OAAOI,GAAMC,CACjB,CAEA,MAAApN,GACI,OAAO,IAAImC,EAAM/D,KAAK0N,EAAGtV,EAAGsC,IAAIsF,KAAK2N,GAAI3N,KAAKxG,EAClD,CAKA,MAAA4K,GACI,MAAM7M,EAAEA,EAACC,EAAEA,GAAMkP,EACXuI,EAAK7W,EAAGW,IAAIvB,EAAGT,KACb2W,EAAGe,EAAId,EAAGe,EAAIlV,EAAGmV,GAAO3O,KAChC,IAAIkP,EAAK9W,EAAG+B,KAAMgV,EAAK/W,EAAG+B,KAAMiV,EAAKhX,EAAG+B,KACpCkV,EAAKjX,EAAGW,IAAI0V,EAAIA,GAChBa,EAAKlX,EAAGW,IAAI2V,EAAIA,GAChBa,EAAKnX,EAAGW,IAAI4V,EAAIA,GAChBa,EAAKpX,EAAGW,IAAI0V,EAAIC,GA4BpB,OA3BAc,EAAKpX,EAAGiG,IAAImR,EAAIA,GAChBJ,EAAKhX,EAAGW,IAAI0V,EAAIE,GAChBS,EAAKhX,EAAGiG,IAAI+Q,EAAIA,GAChBF,EAAK9W,EAAGW,IAAIxB,EAAG6X,GACfD,EAAK/W,EAAGW,IAAIkW,EAAIM,GAChBJ,EAAK/W,EAAGiG,IAAI6Q,EAAIC,GAChBD,EAAK9W,EAAGc,IAAIoW,EAAIH,GAChBA,EAAK/W,EAAGiG,IAAIiR,EAAIH,GAChBA,EAAK/W,EAAGW,IAAImW,EAAIC,GAChBD,EAAK9W,EAAGW,IAAIyW,EAAIN,GAChBE,EAAKhX,EAAGW,IAAIkW,EAAIG,GAChBG,EAAKnX,EAAGW,IAAIxB,EAAGgY,GACfC,EAAKpX,EAAGc,IAAImW,EAAIE,GAChBC,EAAKpX,EAAGW,IAAIxB,EAAGiY,GACfA,EAAKpX,EAAGiG,IAAImR,EAAIJ,GAChBA,EAAKhX,EAAGiG,IAAIgR,EAAIA,GAChBA,EAAKjX,EAAGiG,IAAI+Q,EAAIC,GAChBA,EAAKjX,EAAGiG,IAAIgR,EAAIE,GAChBF,EAAKjX,EAAGW,IAAIsW,EAAIG,GAChBL,EAAK/W,EAAGiG,IAAI8Q,EAAIE,GAChBE,EAAKnX,EAAGW,IAAI2V,EAAIC,GAChBY,EAAKnX,EAAGiG,IAAIkR,EAAIA,GAChBF,EAAKjX,EAAGW,IAAIwW,EAAIC,GAChBN,EAAK9W,EAAGc,IAAIgW,EAAIG,GAChBD,EAAKhX,EAAGW,IAAIwW,EAAID,GAChBF,EAAKhX,EAAGiG,IAAI+Q,EAAIA,GAChBA,EAAKhX,EAAGiG,IAAI+Q,EAAIA,GACT,IAAIrL,EAAMmL,EAAIC,EAAIC,EAC7B,CAKA,GAAA/Q,CAAIsO,GACAD,EAAUC,GACV,MAAQe,EAAGe,EAAId,EAAGe,EAAIlV,EAAGmV,GAAO3O,MACxB0N,EAAGkB,EAAIjB,EAAGkB,EAAIrV,EAAGsV,GAAOnC,EAChC,IAAIuC,EAAK9W,EAAG+B,KAAMgV,EAAK/W,EAAG+B,KAAMiV,EAAKhX,EAAG+B,KACxC,MAAM5C,EAAImP,EAAMnP,EACV0X,EAAK7W,EAAGW,IAAI2N,EAAMlP,EAAGT,IAC3B,IAAIsY,EAAKjX,EAAGW,IAAI0V,EAAIG,GAChBU,EAAKlX,EAAGW,IAAI2V,EAAIG,GAChBU,EAAKnX,EAAGW,IAAI4V,EAAIG,GAChBU,EAAKpX,EAAGiG,IAAIoQ,EAAIC,GAChBe,EAAKrX,EAAGiG,IAAIuQ,EAAIC,GACpBW,EAAKpX,EAAGW,IAAIyW,EAAIC,GAChBA,EAAKrX,EAAGiG,IAAIgR,EAAIC,GAChBE,EAAKpX,EAAGc,IAAIsW,EAAIC,GAChBA,EAAKrX,EAAGiG,IAAIoQ,EAAIE,GAChB,IAAIe,EAAKtX,EAAGiG,IAAIuQ,EAAIE,GA+BpB,OA9BAW,EAAKrX,EAAGW,IAAI0W,EAAIC,GAChBA,EAAKtX,EAAGiG,IAAIgR,EAAIE,GAChBE,EAAKrX,EAAGc,IAAIuW,EAAIC,GAChBA,EAAKtX,EAAGiG,IAAIqQ,EAAIC,GAChBO,EAAK9W,EAAGiG,IAAIwQ,EAAIC,GAChBY,EAAKtX,EAAGW,IAAI2W,EAAIR,GAChBA,EAAK9W,EAAGiG,IAAIiR,EAAIC,GAChBG,EAAKtX,EAAGc,IAAIwW,EAAIR,GAChBE,EAAKhX,EAAGW,IAAIxB,EAAGkY,GACfP,EAAK9W,EAAGW,IAAIkW,EAAIM,GAChBH,EAAKhX,EAAGiG,IAAI6Q,EAAIE,GAChBF,EAAK9W,EAAGc,IAAIoW,EAAIF,GAChBA,EAAKhX,EAAGiG,IAAIiR,EAAIF,GAChBD,EAAK/W,EAAGW,IAAImW,EAAIE,GAChBE,EAAKlX,EAAGiG,IAAIgR,EAAIA,GAChBC,EAAKlX,EAAGiG,IAAIiR,EAAID,GAChBE,EAAKnX,EAAGW,IAAIxB,EAAGgY,GACfE,EAAKrX,EAAGW,IAAIkW,EAAIQ,GAChBH,EAAKlX,EAAGiG,IAAIiR,EAAIC,GAChBA,EAAKnX,EAAGc,IAAImW,EAAIE,GAChBA,EAAKnX,EAAGW,IAAIxB,EAAGgY,GACfE,EAAKrX,EAAGiG,IAAIoR,EAAIF,GAChBF,EAAKjX,EAAGW,IAAIuW,EAAIG,GAChBN,EAAK/W,EAAGiG,IAAI8Q,EAAIE,GAChBA,EAAKjX,EAAGW,IAAI2W,EAAID,GAChBP,EAAK9W,EAAGW,IAAIyW,EAAIN,GAChBA,EAAK9W,EAAGc,IAAIgW,EAAIG,GAChBA,EAAKjX,EAAGW,IAAIyW,EAAIF,GAChBF,EAAKhX,EAAGW,IAAI2W,EAAIN,GAChBA,EAAKhX,EAAGiG,IAAI+Q,EAAIC,GACT,IAAItL,EAAMmL,EAAIC,EAAIC,EAC7B,CACA,QAAAO,CAAShD,GACL,OAAO3M,KAAK3B,IAAIsO,EAAM/K,SAC1B,CACA,GAAA9H,GACI,OAAOkG,KAAKwO,OAAOzK,EAAM5J,KAC7B,CAUA,QAAAoU,CAASpP,GACL,MAAMiL,KAAEA,GAASR,EACjB,IAAK3F,EAAGhG,YAAYkB,GAChB,MAAUlM,MAAM,gCACpB,IAAIqR,EAAOsL,EACX,MAAM7W,EAAOzE,GAAMga,EAAKvJ,OAAO/E,KAAM1L,GAAIgK,GAAMuD,GAAWkC,EAAOzF,KAEjE,GAAI8L,EAAM,CACN,MAAMgD,MAAEA,EAAKF,GAAEA,EAAEG,MAAEA,EAAKF,GAAEA,GAAOP,EAAiBzN,IAC1Cb,EAAG0P,EAAKpQ,EAAGiS,GAAQ9W,EAAImU,IACvB5O,EAAG2P,EAAKrQ,EAAGkS,GAAQ/W,EAAIoU,GAC/ByC,EAAOC,EAAIxR,IAAIyR,GACfxL,EAAQwJ,EAAW1D,EAAKE,KAAM0D,EAAKC,EAAKb,EAAOC,EACnD,KACK,CACD,MAAM/O,EAAEA,EAACV,GAAQ7E,EAAIoG,GACrBmF,EAAQhG,EACRsR,EAAOhS,CACX,CAEA,OAAOiE,GAAWkC,EAAO,CAACO,EAAOsL,IAAO,EAC5C,CAMA,cAAAG,CAAeC,GACX,MAAM5F,KAAEA,GAASR,EACXtL,EAAI0B,KACV,IAAKiE,EAAGjG,QAAQgS,GACZ,MAAU/c,MAAM,gCACpB,GAAI+c,IAAOrd,IAAO2L,EAAExE,MAChB,OAAOiK,EAAM5J,KACjB,GAAI6V,IAAOnd,GACP,OAAOyL,EACX,GAAIgQ,EAAKlJ,SAASpF,MACd,OAAOA,KAAKuO,SAASyB,GACzB,GAAI5F,EAAM,CACN,MAAMgD,MAAEA,EAAKF,GAAEA,EAAEG,MAAEA,EAAKF,GAAEA,GAAOP,EAAiBoD,IAC5CC,GAAEA,EAAEC,GAAEA,GDpXrB,SAAuBnM,EAAOO,EAAO4I,EAAIC,GAC5C,IAAInR,EAAMsI,EACN2L,EAAKlM,EAAM5J,KACX+V,EAAKnM,EAAM5J,KACf,KAAO+S,EAAKva,IAAOwa,EAAKxa,IAChBua,EAAKra,KACLod,EAAKA,EAAG5R,IAAIrC,IACZmR,EAAKta,KACLqd,EAAKA,EAAG7R,IAAIrC,IAChBA,EAAMA,EAAIoI,SACV8I,IAAOra,GACPsa,IAAOta,GAEX,MAAO,CAAEod,KAAIC,KACjB,CCsWmCC,CAAcpM,EAAOzF,EAAG4O,EAAIC,GAC/C,OAAOW,EAAW1D,EAAKE,KAAM2F,EAAIC,EAAI9C,EAAOC,EAChD,CAEI,OAAOiB,EAAKtJ,OAAO1G,EAAG0R,EAE9B,CACA,oBAAAI,CAAqB9W,EAAG/B,EAAGC,GACvB,MAAMwO,EAAMhG,KAAK+P,eAAexY,GAAG8G,IAAI/E,EAAEyW,eAAevY,IACxD,OAAOwO,EAAIlM,WAAQtG,EAAYwS,CACnC,CAKA,QAAA/D,CAASoO,GACL,OAAO7C,EAAaxN,KAAMqQ,EAC9B,CAKA,aAAAlG,GACI,MAAMA,cAAEA,GAAkBP,EAC1B,OAAIG,IAAalX,KAEbsX,EACOA,EAAcpG,EAAO/D,MACzBsO,EAAKtJ,OAAOhF,KAAMgK,GAAalQ,MAC1C,CACA,aAAAoQ,GACI,MAAMA,cAAEA,GAAkBN,EAC1B,OAAIG,IAAalX,GACNmN,KACPkK,EACOA,EAAcnG,EAAO/D,MACzBA,KAAK+P,eAAehG,EAC/B,CACA,YAAAuG,GAEI,OAAOtQ,KAAK+P,eAAehG,GAAUjQ,KACzC,CACA,OAAAgF,CAAQ+L,GAAe,GAGnB,OAFArD,EAAMqD,EAAc,gBACpB7K,KAAKkO,iBACEvD,EAAY5G,EAAO/D,KAAM6K,EACpC,CACA,KAAA0F,CAAM1F,GAAe,GACjB,OAAO2F,EAAWxQ,KAAKlB,QAAQ+L,GACnC,CACA,QAAAjX,GACI,MAAO,UAAUoM,KAAKlG,MAAQ,OAASkG,KAAKuQ,UAChD,CAEA,MAAIE,GACA,OAAOzQ,KAAK0N,CAChB,CACA,MAAIgD,GACA,OAAO1Q,KAAK0N,CAChB,CACA,MAAIiD,GACA,OAAO3Q,KAAKxG,CAChB,CACA,UAAAoX,CAAW/F,GAAe,GACtB,OAAO7K,KAAKlB,QAAQ+L,EACxB,CACA,cAAAgG,CAAelO,GACX3C,KAAKoO,WAAWzL,EACpB,CACA,iBAAOd,CAAWC,GACd,OAAOD,GAAWkC,EAAOjC,EAC7B,CACA,UAAOgP,CAAIhP,EAAQyD,GACf,OAAOF,GAAUtB,EAAOE,EAAInC,EAAQyD,EACxC,CACA,qBAAOwL,CAAeC,GAClB,OAAOjN,EAAMC,KAAKuK,SAAS/E,GAAevF,EAAI+M,GAClD,EAGJjN,EAAMC,KAAO,IAAID,EAAM2C,EAAM0F,GAAI1F,EAAM2F,GAAIjU,EAAGe,KAE9C4K,EAAM5J,KAAO,IAAI4J,EAAM3L,EAAG+B,KAAM/B,EAAGe,IAAKf,EAAG+B,MAE3C4J,EAAM3L,GAAKA,EAEX2L,EAAME,GAAKA,EACX,MAAM7B,EAAO6B,EAAGxG,KACV6Q,EAAO,IAAIxK,GAAKC,EAAO6F,EAAUQ,KAAOtN,KAAKC,KAAKqF,EAAO,GAAKA,GAEpE,OADA2B,EAAMC,KAAKoK,WAAW,GACfrK,CACX,CAEA,SAASmH,GAAQF,GACb,OAAO9W,WAAWiX,GAAGH,EAAW,EAAO,EAC3C,CA6HA,SAASP,GAAYrS,EAAI6L,GACrB,MAAO,CACHgN,UAAWhN,EAAGvG,MACd2N,UAAW,EAAIjT,EAAGsF,MAClB4N,sBAAuB,EAAI,EAAIlT,EAAGsF,MAClCwT,oBAAoB,EACpBC,UAAW,EAAIlN,EAAGvG,MAE1B,CAKO,SAAS0T,GAAKrN,EAAOsN,EAAW,IACnC,MAAMpN,GAAEA,GAAOF,EACTuN,EAAeD,EAASE,aAAeC,EACvChH,EAAUxU,OAAO8Q,OAAO2D,GAAY1G,EAAM3L,GAAI6L,GAAK,CAAEwN,KAAMhS,GAAiBwE,EAAGvL,SACrF,SAASgZ,EAAiBT,GACtB,IACI,QAASzH,GAAevF,EAAIgN,EAChC,CACA,MAAOvH,GACH,OAAO,CACX,CACJ,CAmBA,SAASiI,EAAgBF,EAAOH,EAAa9G,EAAQiH,OACjD,OH1XD,SAAwBrR,EAAKb,EAAYtC,GAAO,GACnD,MAAM3J,EAAM8M,EAAIjN,OACVye,EAAWtS,GAAoBC,GAC/BsS,EAASpS,GAAiBF,GAEhC,GAAIjM,EAAM,IAAMA,EAAMue,GAAUve,EAAM,KAClC,MAAUL,MAAM,YAAc4e,EAAS,6BAA+Bve,GAC1E,MAEMwe,EAAUxa,EAFJ2F,EAAOjJ,EAAgBoM,GAAOtM,EAAgBsM,GAEjCb,EAAa1M,GAAOA,EAC7C,OAAOoK,EAAOxI,EAAgBqd,EAASF,GAAYvd,EAAgByd,EAASF,EAChF,CG+WeG,CAAe9Q,EAAOwQ,EAAMjH,EAAQiH,KAAM,QAASxN,EAAGvL,MACjE,CAMA,SAASsZ,EAAaf,EAAWpG,GAAe,GAC5C,OAAO9G,EAAMC,KAAKuK,SAAS/E,GAAevF,EAAIgN,IAAYnS,QAAQ+L,EACtE,CAQA,SAASoH,EAAUtQ,GACf,GAAoB,iBAATA,EACP,OAAO,EACX,GAAIA,aAAgBoC,EAChB,OAAO,EACX,MAAMkN,UAAEA,EAAS5F,UAAEA,EAASC,sBAAEA,GAA0Bd,EACxD,GAAIvG,EAAG5G,gBAAkB4T,IAAc5F,EACnC,OACJ,MAAM5C,EAAI/T,EAAY,MAAOiN,GAAMxO,OACnC,OAAOsV,IAAM4C,GAAa5C,IAAM6C,CACpC,CAkBA,MAAM4G,EAAQ,CACVR,mBACAS,iBAlEJ,SAA0B9G,EAAWR,GACjC,MAAQQ,UAAWvG,EAAIwG,sBAAEA,GAA0Bd,EACnD,IACI,MAAM/B,EAAI4C,EAAUlY,OACpB,QAAqB,IAAjB0X,GAAyBpC,IAAM3D,OAEd,IAAjB+F,GAA0BpC,IAAM6C,MAE3BvH,EAAMhF,UAAUsM,GAC7B,CACA,MAAO3B,GACH,OAAO,CACX,CACJ,EAsDIiI,kBAEAS,kBAAmBV,EACnBW,iBAAkBV,EAClBW,uBAAyBlS,GAAQoJ,GAAevF,EAAI7D,GACpDgO,WAAU,CAACzL,EAAa,EAAG2B,EAAQP,EAAMC,OAC9BM,EAAM8J,WAAWzL,GAAY,IAG5C,OAAO3M,OAAO6H,OAAO,CAAEmU,eAAcO,gBArBrC,SAAyBC,EAAYC,EAAY5H,GAAe,GAC5D,IAA8B,IAA1BoH,EAAUO,GACV,MAAUvf,MAAM,iCACpB,IAA8B,IAA1Bgf,EAAUQ,GACV,MAAUxf,MAAM,iCACpB,MAAM0S,EAAI6D,GAAevF,EAAIuO,GAE7B,OADUzO,EAAMoK,QAAQsE,GACflE,SAAS5I,GAAG7G,QAAQ+L,EACjC,EAasD6H,OA/CtD,SAAgBjB,GACZ,MAAMR,EAAYU,EAAgBF,GAClC,MAAO,CAAER,YAAW5F,UAAW2G,EAAaf,GAChD,EA4C8DlN,QAAOmO,QAAO1H,WAChF,CAiBO,SAASmI,GAAM5O,EAAOlE,EAAM+S,EAAY,CAAA,GAC3CzS,EAAMN,GACNvK,EAAgBsd,EAAW,GAAI,CAC3BrR,KAAM,WACNkG,KAAM,UACN8J,YAAa,WACbsB,SAAU,WACVC,cAAe,aAEnB,MAAMvB,EAAcqB,EAAUrB,aAAeC,EACvCjQ,EAAOqR,EAAUrR,MAC3B,EAAUnB,KAAQ2S,IAASC,GAAUnT,EAAMO,EAAK6K,KAAe8H,MACrD3a,GAAEA,EAAE6L,GAAEA,GAAOF,GACXrL,MAAOsR,EAAavM,KAAMwV,GAAWhP,GACvCyO,OAAEA,EAAMV,aAAEA,EAAYO,gBAAEA,EAAeL,MAAEA,EAAK1H,QAAEA,GAAY4G,GAAKrN,EAAO6O,GACxEM,EAAiB,CACnBxL,SAAS,EACTD,KAAgC,kBAAnBmL,EAAUnL,MAAqBmL,EAAUnL,KACtDP,YAAQ1T,EACR2f,cAAc,GAEZC,EAAwB,UAC9B,SAASC,EAAsBtb,GAE3B,OAAOA,EADMiS,GAAenX,EAEhC,CACA,SAASygB,EAAWtgB,EAAOU,GACvB,IAAKuQ,EAAGhG,YAAYvK,GAChB,MAAUT,MAAM,qBAAqBD,qCACzC,OAAOU,CACX,CAUA,MAAM6f,EACF,WAAA3T,CAAY3H,EAAG0N,EAAG6N,GACdxT,KAAK/H,EAAIqb,EAAW,IAAKrb,GACzB+H,KAAK2F,EAAI2N,EAAW,IAAK3N,GACT,MAAZ6N,IACAxT,KAAKwT,SAAWA,GACpBxd,OAAO6H,OAAOmC,KAClB,CACA,gBAAOjB,CAAU3L,EAAO8T,EAASkM,GAE7B,IAAIK,EACJ,GApBR,SAA2BrgB,EAAO8T,GAC9BD,GAAkBC,GAClB,MAAMwM,EAAOlJ,EAAQ2G,UAEdlQ,EAAO7N,EADW,YAAX8T,EAAuBwM,EAAkB,cAAXxM,EAAyBwM,EAAO,OAAIlgB,EACjD0T,EAAH,aAChC,CAaQyM,CAAkBvgB,EAAO8T,GAEV,QAAXA,EAAkB,CAClB,MAAMjP,EAAEA,EAAC0N,EAAEA,GAAMgC,GAAIiB,MAAM3H,EAAO7N,IAClC,OAAO,IAAImgB,EAAUtb,EAAG0N,EAC5B,CACe,cAAXuB,IACAuM,EAAQrgB,EAAM,GACd8T,EAAS,UACT9T,EAAQA,EAAMoV,SAAS,IAE3B,MAAMkD,EAAIzH,EAAGvG,MACPzF,EAAI7E,EAAMoV,SAAS,EAAGkD,GACtB/F,EAAIvS,EAAMoV,SAASkD,EAAO,EAAJA,GAC5B,OAAO,IAAI6H,EAAUtP,EAAGlF,UAAU9G,GAAIgM,EAAGlF,UAAU4G,GAAI8N,EAC3D,CACA,cAAOtF,CAAQxa,EAAKuT,GAChB,OAAOlH,KAAKjB,UAAU6U,EAAWjgB,GAAMuT,EAC3C,CACA,cAAA2M,CAAeL,GACX,OAAO,IAAID,EAAUvT,KAAK/H,EAAG+H,KAAK2F,EAAG6N,EACzC,CACA,gBAAAM,CAAiBC,GACb,MAAMC,EAAc5b,EAAGM,OACjBT,EAAG0N,EAAEA,EAAG6N,SAAUS,GAAQjU,KAChC,GAAW,MAAPiU,IAAgB,CAAC,EAAG,EAAG,EAAG,GAAGhV,SAASgV,GACtC,MAAUhhB,MAAM,uBAUpB,GADoB+W,EAAclT,GAAMkd,GACrBC,EAAM,EACrB,MAAUhhB,MAAM,0CACpB,MAAMihB,EAAe,IAARD,GAAqB,IAARA,EAAYhc,EAAI+R,EAAc/R,EACxD,IAAKG,EAAG4F,QAAQkW,GACZ,MAAUjhB,MAAM,8BACpB,MAAM0E,EAAIS,EAAG0G,QAAQoV,GACfha,EAAI6J,EAAMhF,UAAUkM,EAAYC,KAAe,EAAN+I,IAAiBtc,IAC1Dwc,EAAKlQ,EAAG/H,IAAIgY,GACZpK,EAAIgJ,EAAcpe,EAAY,UAAWqf,IACzCK,EAAKnQ,EAAGlG,QAAQ+L,EAAIqK,GACpBE,EAAKpQ,EAAGlG,OAAO4H,EAAIwO,GAEnB7a,EAAIyK,EAAMC,KAAK+L,eAAeqE,GAAI/V,IAAInE,EAAE6V,eAAesE,IAC7D,GAAI/a,EAAEQ,MACF,MAAU7G,MAAM,qBAEpB,OADAqG,EAAE4U,iBACK5U,CACX,CAEA,QAAAgb,GACI,OAAOjB,EAAsBrT,KAAK2F,EACtC,CACA,OAAA7G,CAAQoI,EAASkM,GAEb,GADAnM,GAAkBC,GACH,QAAXA,EACA,OAAO0M,EAAWjM,GAAI0B,WAAWrJ,OACrC,MAAM/H,EAAIgM,EAAGnF,QAAQkB,KAAK/H,GACpB0N,EAAI1B,EAAGnF,QAAQkB,KAAK2F,GAC1B,GAAe,cAAXuB,EAAwB,CACxB,GAAqB,MAAjBlH,KAAKwT,SACL,MAAUvgB,MAAM,gCACpB,OAAOgY,EAAY/W,WAAWiX,GAAGnL,KAAKwT,UAAWvb,EAAG0N,EACxD,CACA,OAAOsF,EAAYhT,EAAG0N,EAC1B,CACA,KAAA4K,CAAMrJ,GACF,OAAOsJ,EAAWxQ,KAAKlB,QAAQoI,GACnC,CAEA,cAAAgH,GAAmB,CACnB,kBAAOqG,CAAY5gB,GACf,OAAO4f,EAAUxU,UAAUrK,EAAY,MAAOf,GAAM,UACxD,CACA,cAAO6gB,CAAQ7gB,GACX,OAAO4f,EAAUxU,UAAUrK,EAAY,MAAOf,GAAM,MACxD,CACA,UAAA8gB,GACI,OAAOzU,KAAKsU,WAAa,IAAIf,EAAUvT,KAAK/H,EAAGgM,EAAGvJ,IAAIsF,KAAK2F,GAAI3F,KAAKwT,UAAYxT,IACpF,CACA,aAAA0U,GACI,OAAO1U,KAAKlB,QAAQ,MACxB,CACA,QAAA6V,GACI,OAAOnE,EAAWxQ,KAAKlB,QAAQ,OACnC,CACA,iBAAA8V,GACI,OAAO5U,KAAKlB,QAAQ,UACxB,CACA,YAAA+V,GACI,OAAOrE,EAAWxQ,KAAKlB,QAAQ,WACnC,EAMJ,MAAM+T,EAAWD,EAAUC,UACvB,SAAsBzf,GAElB,GAAIA,EAAMD,OAAS,KACf,MAAUF,MAAM,sBAGpB,MAAMS,EAAMI,EAAgBV,GACtB0hB,EAAuB,EAAf1hB,EAAMD,OAAa8f,EACjC,OAAO6B,EAAQ,EAAIphB,GAAOd,OAAOkiB,GAASphB,CAC9C,EACEof,EAAgBF,EAAUE,eAC5B,SAA2B1f,GACvB,OAAO6Q,EAAGlG,OAAO8U,EAASzf,GAC9B,EAEE2hB,EAAa1f,EAAQ4d,GAE3B,SAAS+B,EAAWthB,GAGhB,OADAsB,EAAS,WAAaie,EAAQvf,EAAKf,GAAKoiB,GACjC9Q,EAAGnF,QAAQpL,EACtB,CACA,SAASuhB,EAAmBzT,EAASkG,GAEjC,OADAzG,EAAOO,OAAShO,EAAW,WACpBkU,EAAUzG,EAAOpB,EAAK2B,QAAUhO,EAAW,qBAAuBgO,CAC7E,CAkKA,OAAOxL,OAAO6H,OAAO,CACjB6U,SACAV,eACAO,kBACAL,QACA1H,UACAzG,QACAmR,KAjGJ,SAAc1T,EAASyP,EAAW/T,EAAO,CAAA,GACrCsE,EAAU9M,EAAY,UAAW8M,GACjC,MAAMiQ,KAAEA,EAAI0D,MAAEA,GAjElB,SAAiB3T,EAASwP,EAAY9T,GAClC,GAAI,CAAC,YAAa,aAAakY,MAAMjf,GAAMA,KAAK+G,IAC5C,MAAUjK,MAAM,uCACpB,MAAMwU,KAAEA,EAAIC,QAAEA,EAAOyL,aAAEA,GAAiBhM,GAAgBjK,EAAMgW,GAC9D1R,EAAUyT,EAAmBzT,EAASkG,GAItC,MAAM2N,EAAQvC,EAActR,GACtBjD,EAAIiL,GAAevF,EAAI+M,GACvBsE,EAAW,CAACN,EAAWzW,GAAIyW,EAAWK,IAE5C,GAAoB,MAAhBlC,IAAyC,IAAjBA,EAAwB,CAGhD,MAAMte,GAAqB,IAAjBse,EAAwB5B,EAAY/G,EAAQyG,WAAakC,EACnEmC,EAAS9Q,KAAK9P,EAAY,eAAgBG,GAC9C,CACA,MAAM4c,EAAOxG,KAAeqK,GACtBpd,EAAImd,EA+BV,MAAO,CAAE5D,OAAM0D,MAtBf,SAAeI,GAGX,MAAMpf,EAAI0c,EAAS0C,GACnB,IAAKtR,EAAGhG,YAAY9H,GAChB,OACJ,MAAMqf,EAAKvR,EAAG/H,IAAI/F,GACZsf,EAAI1R,EAAMC,KAAKuK,SAASpY,GAAG8L,WAC3BhK,EAAIgM,EAAGlG,OAAO0X,EAAE9d,GACtB,GAAIM,IAAMtF,GACN,OACJ,MAAMgT,EAAI1B,EAAGlG,OAAOyX,EAAKvR,EAAGlG,OAAO7F,EAAID,EAAIsG,IAC3C,GAAIoH,IAAMhT,GACN,OACJ,IAAI6gB,GAAYiC,EAAE9d,IAAMM,EAAI,EAAI,GAAKoK,OAAOoT,EAAE3K,EAAIjY,IAC9C6iB,EAAQ/P,EAKZ,OAJI8B,GAAQ4L,EAAsB1N,KAC9B+P,EAAQzR,EAAGvJ,IAAIiL,GACf6N,GAAY,GAET,IAAID,EAAUtb,EAAGyd,EAAOlC,EACnC,EAEJ,CAc4BmC,CAAQnU,EAASyP,EAAW/T,GAGpD,OJzgCD,SAAwB0Y,EAASC,EAAUC,GAC9C,GAAuB,iBAAZF,GAAwBA,EAAU,EACzC,MAAU3iB,MAAM,4BACpB,GAAwB,iBAAb4iB,GAAyBA,EAAW,EAC3C,MAAU5iB,MAAM,6BACpB,GAAsB,mBAAX6iB,EACP,MAAU7iB,MAAM,6BAEpB,MAAM8iB,EAAOziB,GAAQ,IAAIY,WAAWZ,GAC9B0iB,EAAQC,GAAS/hB,WAAWiX,GAAG8K,GACrC,IAAI7f,EAAI2f,EAAIH,GACRzf,EAAI4f,EAAIH,GACR3c,EAAI,EACR,MAAMid,EAAQ,KACV9f,EAAEyF,KAAK,GACP1F,EAAE0F,KAAK,GACP5C,EAAI,CAAC,EAEH6Q,EAAI,IAAItS,IAAMse,EAAO3f,EAAGC,KAAMoB,GAC9B2e,EAAS,CAAC1E,EAAOsE,EAAI,MAEvB5f,EAAI2T,EAAEkM,EAAK,GAAOvE,GAClBrb,EAAI0T,IACgB,IAAhB2H,EAAKte,SAETgD,EAAI2T,EAAEkM,EAAK,GAAOvE,GAClBrb,EAAI0T,IAAG,EAELsM,EAAM,KAER,GAAInd,KAAO,IACP,MAAUhG,MAAM,2BACpB,IAAIK,EAAM,EACV,MAAM0N,EAAM,GACZ,KAAO1N,EAAMuiB,GAAU,CACnBzf,EAAI0T,IACJ,MAAMuM,EAAKjgB,EAAEkgB,QACbtV,EAAIwD,KAAK6R,GACT/iB,GAAO8C,EAAEjD,MACb,CACA,OAAOojB,KAAgBvV,EAAI,EAW/B,MATiB,CAACyQ,EAAM+E,KAGpB,IAAI5hB,EACJ,IAHAshB,IACAC,EAAO1E,KAEE7c,EAAM4hB,EAAKJ,OAChBD,IAEJ,OADAD,IACOthB,CAAG,CAGlB,CIm9BqB6hB,CAAe5W,EAAKW,UAAWyD,EAAGvG,MAAO6D,EAC1CmV,CAAKjF,EAAM0D,EAE3B,EA4FIwB,OA3CJ,SAAgBxF,EAAW3P,EAAS6J,EAAWnO,EAAO,CAAA,GAClD,MAAMuK,KAAEA,EAAIC,QAAEA,EAAOR,OAAEA,GAAWC,GAAgBjK,EAAMgW,GAGxD,GAFA7H,EAAY3W,EAAY,YAAa2W,GACrC7J,EAAUyT,EAAmBvgB,EAAY,UAAW8M,GAAUkG,GAC1D,WAAYxK,EACZ,MAAUjK,MAAM,sCACpB,MAAMqW,OAAiB9V,IAAX0T,EAtDhB,SAAuB0P,GAEnB,IAAItN,EACJ,MAAMuN,EAAsB,iBAAPD,GAAmBE,EAAQF,GAC1CG,GAASF,GACJ,OAAPD,GACc,iBAAPA,GACS,iBAATA,EAAG3e,GACM,iBAAT2e,EAAGjR,EACd,IAAKkR,IAAUE,EACX,MAAU9jB,MAAM,4EACpB,GAAI8jB,EACAzN,EAAM,IAAIiK,EAAUqD,EAAG3e,EAAG2e,EAAGjR,QAE5B,GAAIkR,EAAO,CACZ,IACIvN,EAAMiK,EAAUxU,UAAUrK,EAAY,MAAOkiB,GAAK,MACtD,CACA,MAAOI,GACH,KAAMA,aAAoBrP,GAAIC,KAC1B,MAAMoP,CACd,CACA,IAAK1N,EACD,IACIA,EAAMiK,EAAUxU,UAAUrK,EAAY,MAAOkiB,GAAK,UACtD,CACA,MAAOlN,GACH,OAAO,CACX,CAER,CACA,OAAKJ,IACM,CAEf,CAqBU2N,CAAc9F,GACdoC,EAAUxU,UAAUrK,EAAY,MAAOyc,GAAYjK,GACzD,IAAY,IAARoC,EACA,OAAO,EACX,IACI,MAAMjQ,EAAI0K,EAAMhF,UAAUsM,GAC1B,GAAI5D,GAAQ6B,EAAIgL,WACZ,OAAO,EACX,MAAMrc,EAAG0N,EAAEA,GAAM2D,EACXQ,EAAIgJ,EAActR,GAClB0V,EAAKjT,EAAG/H,IAAIyJ,GACZyO,EAAKnQ,EAAGlG,OAAO+L,EAAIoN,GACnB7C,EAAKpQ,EAAGlG,OAAO9F,EAAIif,GACnBhd,EAAI6J,EAAMC,KAAK+L,eAAeqE,GAAI/V,IAAIhF,EAAE0W,eAAesE,IAC7D,GAAIna,EAAEJ,MACF,OAAO,EAEX,OADUmK,EAAGlG,OAAO7D,EAAEvC,KACTM,CACjB,CACA,MAAOpD,GACH,OAAO,CACX,CACJ,EAeIif,iBAdJ,SAA0B3C,EAAW3P,EAAStE,EAAO,CAAA,GACjD,MAAMwK,QAAEA,GAAYP,GAAgBjK,EAAMgW,GAE1C,OADA1R,EAAUyT,EAAmBzT,EAASkG,GAC/B6L,EAAUxU,UAAUoS,EAAW,aAAa2C,iBAAiBtS,GAAS1C,SACjF,EAWIyU,YACA1T,QAER,CAsCA,SAASsX,GAA0Bnd,GAC/B,MAAM0M,MAAEA,EAAKC,UAAEA,GAhCnB,SAAyC3M,GACrC,MAAM0M,EAAQ,CACVnP,EAAGyC,EAAEzC,EACLC,EAAGwC,EAAExC,EACL8G,EAAGtE,EAAE5B,GAAGM,MACRpE,EAAG0F,EAAE1F,EACLwV,EAAG9P,EAAE8P,EACLsC,GAAIpS,EAAEoS,GACNC,GAAIrS,EAAEqS,IAEJjU,EAAK4B,EAAE5B,GACb,IAAIiF,EAAiBrD,EAAEod,yBACjBxb,MAAMzH,KAAK,IAAIkjB,IAAIrd,EAAEod,yBAAyB7gB,KAAKkS,GAAM3L,KAAKC,KAAK0L,EAAI,YACvEjV,EAgBN,MAAO,CAAEkT,QAAOC,UAVE,CACdvO,KACA6L,GAPOvK,GAAMgN,EAAMpS,EAAG,CACtBmJ,KAAMzD,EAAE0C,WACRW,eAAgBA,EAChBC,aAActD,EAAEqQ,iBAKhBJ,mBAAoBjQ,EAAEiQ,mBACtBG,KAAMpQ,EAAEoQ,KACRD,cAAenQ,EAAEmQ,cACjBD,cAAelQ,EAAEkQ,cACjBnL,UAAW/E,EAAE+E,UACbD,QAAS9E,EAAE8E,SAGnB,CAEiCwY,CAAgCtd,GACvD4Y,EAAY,CACdrR,KAAMvH,EAAEuH,KACRgQ,YAAavX,EAAEuX,YACf9J,KAAMzN,EAAEyN,KACRoL,SAAU7Y,EAAE6Y,SACZC,cAAe9Y,EAAE8Y,eAErB,MAAO,CAAEpM,QAAOC,YAAW9G,KAAM7F,EAAE6F,KAAM+S,YAC7C,CAoCO,SAAS2E,GAAYvd,GACxB,MAAM0M,MAAEA,EAAKC,UAAEA,EAAS9G,KAAEA,EAAI+S,UAAEA,GAAcuE,GAA0Bnd,GAGxE,OAZJ,SAAqCA,EAAGwd,GACpC,MAAMzT,EAAQyT,EAAOzT,MACrB,OAAO/N,OAAO8Q,OAAO,CAAA,EAAI0Q,EAAQ,CAC7BC,gBAAiB1T,EACjB2C,MAAO1Q,OAAO8Q,OAAO,CAAA,EAAI9M,EAAGyC,GAAQsH,EAAME,GAAGvL,MAAOqL,EAAME,GAAGxG,QAErE,CAMWia,CAA4B1d,EADrB2Y,GADAhJ,GAAajD,EAAOC,GACP9G,EAAM+S,GAErC;sECx3CO,SAAS+E,GAAYC,EAAUC,GAClC,MAAM9Z,EAAU8B,GAAS0X,GAAY,IAAKK,EAAU/X,KAAMA,IAC1D,MAAO,IAAK9B,EAAO8Z,GAAU9Z,SACjC;sECDA,MAAM+Z,GAAa,CACfxZ,EAAG1L,OAAO,sEACV0B,EAAG1B,OAAO,sEACVkX,EAAGlX,OAAO,GACV2E,EAAG3E,OAAO,sEACV4E,EAAG5E,OAAO,sEACVwZ,GAAIxZ,OAAO,sEACXyZ,GAAIzZ,OAAO,uEAGTmlB,GAAa,CACfzZ,EAAG1L,OAAO,sGACV0B,EAAG1B,OAAO,sGACVkX,EAAGlX,OAAO,GACV2E,EAAG3E,OAAO,sGACV4E,EAAG5E,OAAO,sGACVwZ,GAAIxZ,OAAO,sGACXyZ,GAAIzZ,OAAO,uGAGTolB,GAAa,CACf1Z,EAAG1L,OAAO,yIACV0B,EAAG1B,OAAO,0IACVkX,EAAGlX,OAAO,GACV2E,EAAG3E,OAAO,yIACV4E,EAAG5E,OAAO,0IACVwZ,GAAIxZ,OAAO,0IACXyZ,GAAIzZ,OAAO,2IAETqlB,GAAQve,GAAMoe,GAAWxZ,GACzB4Z,GAAQxe,GAAMqe,GAAWzZ,GACzB6Z,GAAQze,GAAMse,GAAW1Z,GCpClB8Z,GD0COT,GAAY,IAAKG,GAAY1f,GAAI6f,GAAOxQ,MAAM,GAAS4Q,GE1C9DC,GFmEOX,GAAY,IAAKI,GAAY3f,GAAI8f,GAAOzQ,MAAM,GAAS8Q,GGnE9DC,GH6FOb,GAAY,IAAKK,GAAY5f,GAAI+f,GAAO1Q,MAAM,EAAO2P,yBAA0B,CAAC,IAAK,IAAK,MAAQqB,GIzFhH9lB,GAAMC,OAAO,GAAIC,GAAMD,OAAO,GAAIkE,GAAMlE,OAAO,GAAIuE,GAAMvE,OAAO,GAQ/D,SAAS8lB,GAAQ7R,EAAQ+C,EAAY,IACxC,MAAMC,EAAYrD,GAAmB,UAAWK,EAAQ+C,EAAWA,EAAUhD,SACvExO,GAAEA,EAAE6L,GAAEA,GAAO4F,EACnB,IAAInD,EAAQmD,EAAUnD,MACtB,MAAQoD,EAAGC,GAAarD,EACxBpR,EAAgBsU,EAAW,CAAA,EAAI,CAAE+O,QAAS,aAK1C,MAAM7a,EAAOhH,IAAQlE,OAAkB,EAAXqR,EAAGvG,OAAa7K,GACtC+lB,EAAQtkB,GAAM8D,EAAG2F,OAAOzJ,GAExBqkB,EAAU/O,EAAU+O,SAC9B,EAAU3gB,EAAG5B,KACD,IACI,MAAO,CAAE4H,SAAS,EAAMjL,MAAOqF,EAAGmF,KAAKnF,EAAGqG,IAAIzG,EAAG5B,IACrD,CACA,MAAOvB,GACH,MAAO,CAAEmJ,SAAS,EAAOjL,MAAOJ,GACpC,CACH,GAGL,IA/BJ,SAAqByF,EAAIsO,EAAO/O,EAAGmT,GAC/B,MAAMkB,EAAK5T,EAAGG,IAAIZ,GACZiU,EAAKxT,EAAGG,IAAIuS,GACZoB,EAAO9T,EAAGiG,IAAIjG,EAAGW,IAAI2N,EAAMnP,EAAGyU,GAAKJ,GACnCO,EAAQ/T,EAAGiG,IAAIjG,EAAGe,IAAKf,EAAGW,IAAI2N,EAAMnI,EAAGnG,EAAGW,IAAIiT,EAAIJ,KACxD,OAAOxT,EAAGE,IAAI4T,EAAMC,EACxB,CAyBS0M,CAAYzgB,EAAIsO,EAAOA,EAAM0F,GAAI1F,EAAM2F,IACxC,MAAUpZ,MAAM,qCAKpB,SAASuZ,EAAOxZ,EAAOsB,EAAGmY,GAAU,GAGhC,OADAzX,EAAS,cAAgBhC,EAAOsB,EADpBmY,EAAU5Z,GAAMF,GACYmL,GACjCxJ,CACX,CACA,SAASwkB,EAAUnM,GACf,KAAMA,aAAiB5I,GACnB,MAAU9Q,MAAM,yBACxB,CAGA,MAAMua,EAAenX,GAAS,CAACiI,EAAGmP,KAC9B,MAAMC,EAAEA,EAACC,EAAEA,EAACnU,EAAEA,GAAM8E,EACdxE,EAAMwE,EAAExE,MACJ,MAAN2T,IACAA,EAAK3T,EAAM3C,GAAMiB,EAAG8D,IAAI1C,IAC5B,MAAM7B,EAAIihB,EAAKlL,EAAID,GACb3C,EAAI8N,EAAKjL,EAAIF,GACbG,EAAKxV,EAAGW,IAAIS,EAAGiU,GACrB,GAAI3T,EACA,MAAO,CAAEnC,EAAGhF,GAAKmY,EAAGjY,IACxB,GAAI+a,IAAO/a,GACP,MAAUI,MAAM,oBACpB,MAAO,CAAE0E,IAAGmT,IAAG,IAEb+C,EAAkBxX,GAAUiI,IAC9B,MAAM/G,EAAEA,EAACgH,EAAEA,GAAMmI,EACjB,GAAIpI,EAAExE,MACF,MAAU7G,MAAM,mBAGpB,MAAMya,EAAEA,EAACC,EAAEA,EAACnU,EAAEA,EAACuf,EAAEA,GAAMza,EACjBsQ,EAAKgK,EAAKlL,EAAIA,GACdmB,EAAK+J,EAAKjL,EAAIA,GACdmB,EAAK8J,EAAKpf,EAAIA,GACdwf,EAAKJ,EAAK9J,EAAKA,GACfmK,EAAML,EAAKhK,EAAKrX,GAGtB,GAFaqhB,EAAK9J,EAAK8J,EAAKK,EAAMpK,MACpB+J,EAAKI,EAAKJ,EAAKra,EAAIqa,EAAKhK,EAAKC,KAEvC,MAAU5b,MAAM,yCAIpB,GAFW2lB,EAAKlL,EAAIC,KACTiL,EAAKpf,EAAIuf,GAEhB,MAAU9lB,MAAM,yCACpB,OAAO,CAAI,IAIf,MAAM8Q,EACF,WAAAnE,CAAY8N,EAAGC,EAAGnU,EAAGuf,GACjB/Y,KAAK0N,EAAIlB,EAAO,IAAKkB,GACrB1N,KAAK2N,EAAInB,EAAO,IAAKmB,GACrB3N,KAAKxG,EAAIgT,EAAO,IAAKhT,GAAG,GACxBwG,KAAK+Y,EAAIvM,EAAO,IAAKuM,GACrB/iB,OAAO6H,OAAOmC,KAClB,CACA,YAAO0G,GACH,OAAOA,CACX,CACA,iBAAO1E,CAAW1D,GACd,GAAIA,aAAayF,EACb,MAAU9Q,MAAM,8BACpB,MAAM0E,EAAEA,EAACmT,EAAEA,GAAMxM,GAAK,CAAA,EAGtB,OAFAkO,EAAO,IAAK7U,GACZ6U,EAAO,IAAK1B,GACL,IAAI/G,EAAMpM,EAAGmT,EAAGjY,GAAK+lB,EAAKjhB,EAAImT,GACzC,CAEA,gBAAO/L,CAAU3L,EAAO8lB,GAAS,GAC7B,MAAM5lB,EAAM8E,EAAGsF,OACTnG,EAAEA,EAACgH,EAAEA,GAAMmI,EACjBtT,EAAQ0B,EAAUmM,EAAO7N,EAAOE,EAAK,UACrCkU,EAAM0R,EAAQ,UACd,MAAMC,EAASrkB,EAAU1B,GACnBgmB,EAAWhmB,EAAME,EAAM,GAC7B6lB,EAAO7lB,EAAM,IAAgB,IAAX8lB,EAClB,MAAMtO,EAAI9W,EAAgBmlB,GAKpBjkB,EAAMgkB,EAASpb,EAAO1F,EAAGM,MAC/B1D,EAAS,UAAW8V,EAAGnY,GAAKuC,GAG5B,MAAM0W,EAAKgN,EAAK9N,EAAIA,GACd9S,EAAI4gB,EAAKhN,EAAK/Y,IACduD,EAAIwiB,EAAKra,EAAIqN,EAAKrU,GACxB,IAAIyG,QAAEA,EAASjL,MAAO4E,GAAMghB,EAAQ3gB,EAAG5B,GACvC,IAAK4H,EACD,MAAU/K,MAAM,mCACpB,MAAMomB,GAAU1hB,EAAI9E,MAASA,GACvBymB,KAA4B,IAAXF,GACvB,IAAKF,GAAUvhB,IAAMhF,IAAO2mB,EAExB,MAAUrmB,MAAM,4BAGpB,OAFIqmB,IAAkBD,IAClB1hB,EAAIihB,GAAMjhB,IACPoM,EAAM/B,WAAW,CAAErK,IAAGmT,KACjC,CACA,cAAOqD,CAAQ/a,EAAO8lB,GAAS,GAC3B,OAAOnV,EAAMhF,UAAUrK,EAAY,QAAStB,GAAQ8lB,EACxD,CACA,KAAIvhB,GACA,OAAOqI,KAAKiC,WAAWtK,CAC3B,CACA,KAAImT,GACA,OAAO9K,KAAKiC,WAAW6I,CAC3B,CACA,UAAAsD,CAAWzL,EAAa,EAAG0L,GAAS,GAIhC,OAHAC,EAAKpJ,YAAYlF,KAAM2C,GAClB0L,GACDrO,KAAKuO,SAASzX,IACXkJ,IACX,CAEA,cAAAkO,GACIL,EAAgB7N,KACpB,CAEA,MAAAwO,CAAO7B,GACHmM,EAAUnM,GACV,MAAQe,EAAGe,EAAId,EAAGe,EAAIlV,EAAGmV,GAAO3O,MACxB0N,EAAGkB,EAAIjB,EAAGkB,EAAIrV,EAAGsV,GAAOnC,EAC1B4M,EAAOX,EAAKnK,EAAKK,GACjB0K,EAAOZ,EAAKhK,EAAKD,GACjB8K,EAAOb,EAAKlK,EAAKI,GACjB4K,EAAOd,EAAK/J,EAAKF,GACvB,OAAO4K,IAASC,GAAQC,IAASC,CACrC,CACA,GAAA5f,GACI,OAAOkG,KAAKwO,OAAOzK,EAAM5J,KAC7B,CACA,MAAAyH,GAEI,OAAO,IAAImC,EAAM6U,GAAM5Y,KAAK0N,GAAI1N,KAAK2N,EAAG3N,KAAKxG,EAAGof,GAAM5Y,KAAK+Y,GAC/D,CAIA,MAAA3U,GACI,MAAM7M,EAAEA,GAAMmP,GACNgH,EAAGe,EAAId,EAAGe,EAAIlV,EAAGmV,GAAO3O,KAC1B2Z,EAAIf,EAAKnK,EAAKA,GACdmL,EAAIhB,EAAKlK,EAAKA,GACdmL,EAAIjB,EAAK9hB,GAAM8hB,EAAKjK,EAAKA,IACzBmL,EAAIlB,EAAKrhB,EAAIoiB,GACbI,EAAOtL,EAAKC,EACZzG,EAAI2Q,EAAKA,EAAKmB,EAAOA,GAAQJ,EAAIC,GACjCI,EAAIF,EAAIF,EACRK,EAAID,EAAIH,EACRK,EAAIJ,EAAIF,EACR1K,EAAK0J,EAAK3Q,EAAIgS,GACd9K,EAAKyJ,EAAKoB,EAAIE,GACdC,EAAKvB,EAAK3Q,EAAIiS,GACd9K,EAAKwJ,EAAKqB,EAAID,GACpB,OAAO,IAAIjW,EAAMmL,EAAIC,EAAIC,EAAI+K,EACjC,CAIA,GAAA9b,CAAIsO,GACAmM,EAAUnM,GACV,MAAMpV,EAAEA,EAACgH,EAAEA,GAAMmI,GACTgH,EAAGe,EAAId,EAAGe,EAAIlV,EAAGmV,EAAIoK,EAAGqB,GAAOpa,MAC/B0N,EAAGkB,EAAIjB,EAAGkB,EAAIrV,EAAGsV,EAAIiK,EAAGsB,GAAO1N,EACjCgN,EAAIf,EAAKnK,EAAKG,GACdgL,EAAIhB,EAAKlK,EAAKG,GACdgL,EAAIjB,EAAKwB,EAAK7b,EAAI8b,GAClBP,EAAIlB,EAAKjK,EAAKG,GACd7G,EAAI2Q,GAAMnK,EAAKC,IAAOE,EAAKC,GAAM8K,EAAIC,GACrCK,EAAIH,EAAID,EACRG,EAAIF,EAAID,EACRK,EAAItB,EAAKgB,EAAIriB,EAAIoiB,GACjBzK,EAAK0J,EAAK3Q,EAAIgS,GACd9K,EAAKyJ,EAAKoB,EAAIE,GACdC,EAAKvB,EAAK3Q,EAAIiS,GACd9K,EAAKwJ,EAAKqB,EAAID,GACpB,OAAO,IAAIjW,EAAMmL,EAAIC,EAAIC,EAAI+K,EACjC,CACA,QAAAxK,CAAShD,GACL,OAAO3M,KAAK3B,IAAIsO,EAAM/K,SAC1B,CAEA,QAAA2M,CAASpP,GAEL,IAAK8E,EAAGhG,YAAYkB,GAChB,MAAUlM,MAAM,8CACpB,MAAMqL,EAAEA,EAACV,GAAQ0Q,EAAKvJ,OAAO/E,KAAMb,GAASb,GAAMuD,GAAWkC,EAAOzF,KACpE,OAAOuD,GAAWkC,EAAO,CAACzF,EAAGV,IAAI,EACrC,CAMA,cAAAmS,CAAe5Q,EAAQnD,EAAM+H,EAAM5J,MAE/B,IAAK8J,EAAGjG,QAAQmB,GACZ,MAAUlM,MAAM,8CACpB,OAAIkM,IAAWxM,GACJoR,EAAM5J,KACb6F,KAAKlG,OAASqF,IAAWtM,GAClBmN,KACJsO,EAAKtJ,OAAOhF,KAAMb,GAASb,GAAMuD,GAAWkC,EAAOzF,IAAItC,EAClE,CAKA,YAAAsU,GACI,OAAOtQ,KAAK+P,eAAehG,GAAUjQ,KACzC,CAGA,aAAAqQ,GACI,OAAOmE,EAAKtJ,OAAOhF,KAAM0G,EAAMpS,GAAGwF,KACtC,CAGA,QAAAmI,CAASoO,GACL,OAAO7C,EAAaxN,KAAMqQ,EAC9B,CACA,aAAAnG,GACI,OAAIH,IAAalX,GACNmN,KACJA,KAAK+P,eAAehG,EAC/B,CACA,OAAAjL,GACI,MAAMnH,EAAEA,EAACmT,EAAEA,GAAM9K,KAAKiC,WAEhB7O,EAAQgF,EAAG0G,QAAQgM,GAIzB,OADA1X,EAAMA,EAAMD,OAAS,IAAMwE,EAAI9E,GAAM,IAAO,EACrCO,CACX,CACA,KAAAmd,GACI,OAAOC,EAAWxQ,KAAKlB,UAC3B,CACA,QAAAlL,GACI,MAAO,UAAUoM,KAAKlG,MAAQ,OAASkG,KAAKuQ,UAChD,CAEA,MAAI+J,GACA,OAAOta,KAAK0N,CAChB,CACA,MAAI6M,GACA,OAAOva,KAAK2N,CAChB,CACA,MAAI6M,GACA,OAAOxa,KAAKxG,CAChB,CACA,MAAIihB,GACA,OAAOza,KAAK+Y,CAChB,CACA,iBAAOlX,CAAWC,GACd,OAAOD,GAAWkC,EAAOjC,EAC7B,CACA,UAAOgP,CAAIhP,EAAQyD,GACf,OAAOF,GAAUtB,EAAOE,EAAInC,EAAQyD,EACxC,CACA,cAAAsL,CAAelO,GACX3C,KAAKoO,WAAWzL,EACpB,CACA,UAAAiO,GACI,OAAO5Q,KAAKlB,SAChB,EAGJiF,EAAMC,KAAO,IAAID,EAAM2C,EAAM0F,GAAI1F,EAAM2F,GAAIxZ,GAAK+lB,EAAKlS,EAAM0F,GAAK1F,EAAM2F,KAEtEtI,EAAM5J,KAAO,IAAI4J,EAAMpR,GAAKE,GAAKA,GAAKF,IAEtCoR,EAAM3L,GAAKA,EAEX2L,EAAME,GAAKA,EACX,MAAMqK,EAAO,IAAIxK,GAAKC,EAAOE,EAAGxG,MAEhC,OADAsG,EAAMC,KAAKoK,WAAW,GACfrK,CACX,CA6EO,SAAS2W,GAAM3W,EAAO4W,EAAOC,EAAY,CAAA,GAC5C,GAAqB,mBAAVD,EACP,MAAU1nB,MAAM,qCACpBqC,EAAgBslB,EAAW,GAAI,CAC3BC,kBAAmB,WACnBtJ,YAAa,WACbuJ,OAAQ,WACRpT,QAAS,WACTqT,WAAY,aAEhB,MAAMrT,QAAEA,GAAYkT,GACd5W,KAAEA,EAAI5L,GAAEA,EAAE6L,GAAEA,GAAOF,EACnBwN,EAAcqJ,EAAUrJ,aAAeC,EACvCqJ,EAAoBD,EAAUC,mBAAiB,CAAMznB,GAAUA,GAC/D0nB,EAASF,EAAUE,QAC7B,EAAU9S,EAAMgT,EAAKC,KAET,GADAzT,EAAMyT,EAAQ,UACVD,EAAI7nB,QAAU8nB,EACd,MAAUhoB,MAAM,uCACpB,OAAO+U,CACV,GAEL,SAASkT,EAAQrb,GACb,OAAOoE,EAAGlG,OAAO/J,EAAgB6L,GACrC,CAcA,SAASsb,EAAqBlK,GAC1B,MAAMzF,KAAEA,EAAI4P,OAAEA,EAAMjc,OAAEA,GAb1B,SAA0BiB,GACtB,MAAM9M,EAAMkX,EAAQyG,UACpB7Q,EAAM1L,EAAY,cAAe0L,EAAK9M,GAGtC,MAAM+nB,EAAS3mB,EAAY,qBAAsBimB,EAAMva,GAAM,EAAI9M,GAC3DkY,EAAOqP,EAAkBQ,EAAO/E,MAAM,EAAGhjB,IAG/C,MAAO,CAAEkY,OAAM4P,OAFAC,EAAO/E,MAAMhjB,EAAK,EAAIA,GAEd6L,OADR+b,EAAQ1P,GAE3B,CAGqC8P,CAAiBrK,GAC5C3M,EAAQN,EAAKuK,SAASpP,GACtBoc,EAAajX,EAAMxF,UACzB,MAAO,CAAE0M,OAAM4P,SAAQjc,SAAQmF,QAAOiX,aAC1C,CAEA,SAASvJ,EAAaf,GAClB,OAAOkK,EAAqBlK,GAAWsK,UAC3C,CAEA,SAASC,EAAmBC,EAAUvnB,WAAWiX,QAAS4H,GACtD,MAAM2I,EAAMzQ,KAAe8H,GAC3B,OAAOmI,EAAQP,EAAMG,EAAOY,EAAKhnB,EAAY,UAAW+mB,KAAY/T,IACxE,CAiBA,MAAMiU,EAAa,CAAEzC,QAAQ,GAsC7B,MAAM0C,EAAQxjB,EAAGsF,MACX8M,EAAU,CACZyG,UAAW2K,EACXvQ,UAAWuQ,EACXzK,UAAW,EAAIyK,EACfnK,KAAMmK,GAEV,SAASjK,EAAgBF,EAAOF,EAAY/G,EAAQiH,OAChD,OAAOxQ,EAAOwQ,EAAMjH,EAAQiH,KAAM,OACtC,CAgBA,MAAMS,EAAQ,CACViJ,uBACAxJ,kBACAD,iBAdJ,SAA0BtR,GACtB,OAAO0W,EAAQ1W,IAAQA,EAAIjN,SAAW8Q,EAAGvG,KAC7C,EAaIyU,iBAZJ,SAA0B/R,EAAK8Y,GAC3B,IACI,QAASnV,EAAMhF,UAAUqB,EAAK8Y,EAClC,CACA,MAAOxP,GACH,OAAO,CACX,CACJ,EAeI,YAAAmS,CAAaxQ,GACT,MAAMP,EAAEA,GAAM/G,EAAMhF,UAAUsM,GACxBqI,EAAOlJ,EAAQa,UACfyQ,EAAmB,KAATpI,EAChB,IAAKoI,GAAoB,KAATpI,EACZ,MAAUzgB,MAAM,kCACpB,MAAM+E,EAAI8jB,EAAU1jB,EAAGqG,IAAI5L,GAAMiY,EAAGjY,GAAMiY,GAAK1S,EAAGqG,IAAIqM,EAAIjY,GAAKiY,EAAIjY,IACnE,OAAOuF,EAAG0G,QAAQ9G,EACtB,EACA,kBAAA+jB,CAAmB9K,GACf,MAAMyC,EAAOlJ,EAAQyG,UACrBhQ,EAAOgQ,EAAWyC,GAClB,MAAM2H,EAASV,EAAM1J,EAAUzI,SAAS,EAAGkL,IAC3C,OAAOmH,EAAkBQ,GAAQ7S,SAAS,EAAGkL,EACjD,EAEArB,iBAAkBV,EAElBvD,WAAU,CAACzL,EAAa,EAAG2B,EAAQP,EAAMC,OAC9BM,EAAM8J,WAAWzL,GAAY,IAG5C,OAAO3M,OAAO6H,OAAO,CACjB6U,OApDJ,SAAgBjB,GACZ,MAAMR,EAAYiB,EAAMP,gBAAgBF,GACxC,MAAO,CAAER,YAAW5F,UAAW2G,EAAaf,GAChD,EAkDIe,eACAkD,KArHJ,SAAcwG,EAAKzK,EAAW+K,EAAU,CAAA,GACpCN,EAAMhnB,EAAY,UAAWgnB,GACzBhU,IACAgU,EAAMhU,EAAQgU,IAClB,MAAMN,OAAEA,EAAMjc,OAAEA,EAAMoc,WAAEA,GAAeJ,EAAqBlK,GACtDhZ,EAAIujB,EAAmBQ,EAAQP,QAASL,EAAQM,GAChDxhB,EAAI8J,EAAKuK,SAAStW,GAAG6G,UACrB3I,EAAIqlB,EAAmBQ,EAAQP,QAASvhB,EAAGqhB,EAAYG,GACvD/V,EAAI1B,EAAGlG,OAAO9F,EAAI9B,EAAIgJ,GAC5B,IAAK8E,EAAGjG,QAAQ2H,GACZ,MAAU1S,MAAM,0BAEpB,OAAOgO,EADIgK,EAAY/Q,EAAG+J,EAAGnF,QAAQ6G,IACnB6E,EAAQ2G,UAAW,SACzC,EAyGIwF,OAlGJ,SAAgBrN,EAAKoS,EAAKrQ,EAAW2Q,EAAUL,GAC3C,MAAMF,QAAEA,EAAOvC,OAAEA,GAAW8C,EACtB1oB,EAAMkX,EAAQ2G,UACpB7H,EAAM5U,EAAY,YAAa4U,EAAKhW,GACpCooB,EAAMhnB,EAAY,UAAWgnB,GAC7BrQ,EAAY3W,EAAY,YAAa2W,EAAWb,EAAQa,gBACzC7X,IAAX0lB,GACA1R,EAAM0R,EAAQ,UACdxR,IACAgU,EAAMhU,EAAQgU,IAClB,MAAMO,EAAM3oB,EAAM,EACZ2E,EAAIqR,EAAId,SAAS,EAAGyT,GACpBtW,EAAI3R,EAAgBsV,EAAId,SAASyT,EAAK3oB,IAC5C,IAAIqmB,EAAGzf,EAAGgiB,EACV,IAIIvC,EAAI5V,EAAMhF,UAAUsM,EAAW6N,GAC/Bhf,EAAI6J,EAAMhF,UAAU9G,EAAGihB,GACvBgD,EAAKlY,EAAK+L,eAAepK,EAC7B,CACA,MAAO+D,GACH,OAAO,CACX,CACA,IAAKwP,GAAUS,EAAErJ,eACb,OAAO,EACX,MAAMna,EAAIqlB,EAAmBC,EAASvhB,EAAE4E,UAAW6a,EAAE7a,UAAW4c,GAIhE,OAHYxhB,EAAEmE,IAAIsb,EAAE5J,eAAe5Z,IAGxBwZ,SAASuM,GAAIhS,gBAAgBpQ,KAC5C,EAmEIoY,QACAnO,QACAyG,WAER;;ACjkBA,MAAM7X,GAAMC,OAAO,GACbC,GAAMD,OAAO,GACbkE,GAAMlE,OAAO,GAQZ,SAASupB,GAAWvE,GACvB,MAAMlR,GAPNpR,EADkB8mB,EAQSxE,EAPJ,CACnBiD,kBAAmB,WACnBwB,WAAY,aAETrmB,OAAO6H,OAAO,IAAKue,KAL9B,IAAsBA,EASlB,MAAM/iB,EAAEA,EAACoN,KAAEA,EAAIoU,kBAAEA,EAAiBwB,WAAEA,EAAY9K,YAAa+K,GAAS5V,EAChEoV,EAAmB,WAATrV,EAChB,IAAKqV,GAAoB,SAATrV,EACZ,MAAUxT,MAAM,gBACpB,MAAMqe,EAAegL,GAAQ/K,EACvBgL,EAAiBT,EAAU,IAAM,IACjClK,EAAWkK,EAAU,GAAK,GAC1BU,EAAKV,EAAUlpB,OAAO,GAAKA,OAAO,GAKlC6pB,EAAMX,EAAUlpB,OAAO,QAAUA,OAAO,OAIxC8pB,EAAYZ,EAAUhlB,IAAOlE,OAAO,KAAOkE,IAAOlE,OAAO,KACzD+pB,EAAWb,EACXlpB,OAAO,GAAKkE,IAAOlE,OAAO,KAAOC,GACjCD,OAAO,GAAKkE,IAAOlE,OAAO,KAAOC,GACjC+pB,EAAYF,EAAYC,EAAW9pB,GACnC+lB,EAAQtkB,GAAMgD,EAAIhD,EAAG+E,GACrBwjB,EAAUC,EAAQN,GACxB,SAASM,EAAQ9kB,GACb,OAAOvD,EAAgBmkB,EAAK5gB,GAAI4Z,EACpC,CAgBA,SAASmL,EAAW5d,EAAQnH,GACxB,MAAMglB,EA4BV,SAA0BhlB,EAAGmH,GACzBnK,EAAS,IAAKgD,EAAGrF,GAAK0G,GACtBrE,EAAS,SAAUmK,EAAQud,EAAWE,GACtC,MAAMzmB,EAAIgJ,EACJ8d,EAAMjlB,EACZ,IAAIklB,EAAMrqB,GACNsqB,EAAMxqB,GACNyqB,EAAMplB,EACNqlB,EAAMxqB,GACNyqB,EAAO3qB,GACX,IAAK,IAAIsH,EAAIrH,OAAO2pB,EAAiB,GAAItiB,GAAKtH,GAAKsH,IAAK,CACpD,MAAMsjB,EAAOpnB,GAAK8D,EAAKpH,GACvByqB,GAAQC,IACLL,MAAKE,OAAQI,EAAMF,EAAMJ,EAAKE,MAC9BF,IAAKC,EAAKC,IAAKC,GAAQG,EAAMF,EAAMH,EAAKE,IAC3CC,EAAOC,EACP,MAAM5D,EAAIuD,EAAMC,EACVM,EAAK7E,EAAKe,EAAIA,GACdC,EAAIsD,EAAMC,EACVO,EAAK9E,EAAKgB,EAAIA,GACd3R,EAAIwV,EAAKC,EACT7D,EAAIuD,EAAMC,EAEVM,EAAK/E,GADDwE,EAAMC,GACI1D,GACdiE,EAAKhF,EAAKiB,EAAID,GACdiE,EAAOF,EAAKC,EACZE,EAAQH,EAAKC,EACnBR,EAAMxE,EAAKiF,EAAOA,GAClBR,EAAMzE,EAAKqE,EAAMrE,EAAKkF,EAAQA,IAC9BZ,EAAMtE,EAAK6E,EAAKC,GAChBP,EAAMvE,EAAK3Q,GAAKwV,EAAK7E,EAAK6D,EAAMxU,IACpC,GACGiV,MAAKE,OAAQI,EAAMF,EAAMJ,EAAKE,MAC9BF,IAAKC,EAAKC,IAAKC,GAAQG,EAAMF,EAAMH,EAAKE,IAC3C,MAAMU,EAAK1B,EAAWc,GACtB,OAAOvE,EAAKsE,EAAMa,EACtB,CAhEeC,CAhBf,SAAiBhmB,GACb,MAAMimB,EAAKvpB,EAAY,eAAgBsD,EAAG4Z,GAS1C,OANIkK,IACAmC,EAAG,KAAO,KAKPrF,EAAK5kB,EAAgBiqB,GAChC,CAKgCC,CAAQlmB,GAJxC,SAAsBmH,GAClB,OAAOnL,EAAgB6mB,EAAkBnmB,EAAY,SAAUyK,EAAQyS,IAC3E,CAE4CuM,CAAahf,IAIrD,GAAI6d,IAAOrqB,GACP,MAAUM,MAAM,0CACpB,OAAO6pB,EAAQE,EACnB,CAEA,SAASoB,EAAejf,GACpB,OAAO4d,EAAW5d,EAAQ0d,EAC9B,CAEA,SAASW,EAAMF,EAAMJ,EAAKE,GAItB,MAAMiB,EAAQzF,EAAK0E,GAAQJ,EAAME,IAGjC,MAAO,CAAEF,IAFTA,EAAMtE,EAAKsE,EAAMmB,GAEHjB,IADdA,EAAMxE,EAAKwE,EAAMiB,GAErB,CA4CA,MAAM7T,EAAU,CACZyG,UAAWW,EACXvG,UAAWuG,EACXH,KAAMG,GAEJD,EAAkB,CAACF,EAAOH,EAAaM,MACzC3Q,EAAOwQ,EAAMjH,EAAQiH,MACdA,GAUX,MAAO,CACHiB,OATJ,SAAgBjB,GACZ,MAAMR,EAAYU,EAAgBF,GAClC,MAAO,CAAER,YAAW5F,UAAW+S,EAAenN,GAClD,EAOIsB,gBAAiB,CAACtB,EAAW5F,IAAc0R,EAAW9L,EAAW5F,GACjE2G,aAAef,GAAcmN,EAAenN,GAC5C8L,aACAqB,iBACAlM,MAVU,CACVP,kBACAU,iBAAkBV,GASlBkL,QAASA,EAAQvG,QACjB9L,UAER;sECpIA,MAAM8T,GAAc,CAChBhgB,EAAG1L,OAAO,sHACV0B,EAAG1B,OAAO,sHACVkX,EAAGlX,OAAO,GACV2E,EAAG3E,OAAO,GACV2L,EAAG3L,OAAO,sHACVwZ,GAAIxZ,OAAO,sHACXyZ,GAAIzZ,OAAO,uHAKT2rB,GAAavoB,OAAO8Q,OAAO,CAAA,EAAIwX,GAAa,CAC9C/f,EAAG3L,OAAO,sHACVwZ,GAAIxZ,OAAO,sHACXyZ,GAAIzZ,OAAO,wHAET4rB,kBAA+BC,GAAgB,IAAMC,EAAS3gB,OAAO,CAAE4gB,MAAO,QAG9E9rB,GAAMD,OAAO,GAAIkE,GAAMlE,OAAO,GAAImE,GAAMnE,OAAO,GAAUA,OAAO,GAAG,MAACgsB,GAAOhsB,OAAO,IAElFisB,GAAOjsB,OAAO,IAAKksB,GAAOlsB,OAAO,IAAKmsB,GAAOnsB,OAAO,IAAKosB,GAAQpsB,OAAO,KAI9E,SAASqsB,GAAsBtnB,GAC3B,MAAM0B,EAAIilB,GAAYhgB,EAChB2O,EAAMtV,EAAIA,EAAIA,EAAK0B,EACnB4V,EAAMhC,EAAKA,EAAKtV,EAAK0B,EACrB6lB,EAAMxnB,EAAKuX,EAAIlY,GAAKsC,GAAK4V,EAAM5V,EAC/B8lB,EAAMznB,EAAKwnB,EAAInoB,GAAKsC,GAAK4V,EAAM5V,EAC/B+lB,EAAO1nB,EAAKynB,EAAIroB,GAAKuC,GAAK4T,EAAM5T,EAChCgmB,EAAO3nB,EAAK0nB,EAAKR,GAAMvlB,GAAK+lB,EAAO/lB,EACnCimB,EAAO5nB,EAAK2nB,EAAKR,GAAMxlB,GAAKgmB,EAAOhmB,EACnCkmB,EAAO7nB,EAAK4nB,EAAKR,GAAMzlB,GAAKimB,EAAOjmB,EACnCmmB,EAAQ9nB,EAAK6nB,EAAKR,GAAM1lB,GAAKkmB,EAAOlmB,EACpComB,EAAQ/nB,EAAK8nB,EAAMV,GAAMzlB,GAAKimB,EAAOjmB,EACrCqmB,EAAQhoB,EAAK+nB,EAAM3oB,GAAKuC,GAAK4T,EAAM5T,EACnCsmB,EAAQjoB,EAAKgoB,EAAM7sB,GAAKwG,GAAK1B,EAAK0B,EACxC,OAAQ3B,EAAKioB,EAAMX,GAAO3lB,GAAKqmB,EAAQrmB,CAC3C,CACA,SAASwhB,GAAkBznB,GAOvB,OALAA,EAAM,IAAM,IAEZA,EAAM,KAAO,IAEbA,EAAM,IAAM,EACLA,CACX,CAGA,SAASulB,GAAQ3gB,EAAG5B,GAChB,MAAMiD,EAAIilB,GAAYhgB,EAOhBshB,EAAMtoB,EAAIU,EAAIA,EAAI5B,EAAGiD,GACrBwmB,EAAMvoB,EAAIsoB,EAAM5nB,EAAGqB,GACnBymB,EAAOxoB,EAAIuoB,EAAMD,EAAMxpB,EAAGiD,GAE1B1B,EAAIL,EAAIuoB,EADDZ,GAAsBa,GACTzmB,GAEpB2S,EAAK1U,EAAIK,EAAIA,EAAG0B,GAGtB,MAAO,CAAE2E,QAAS1G,EAAI0U,EAAK5V,EAAGiD,KAAOrB,EAAGjF,MAAO4E,EACnD,CAKA,MAAMS,kBAAqB,KAAOsB,GAAM4kB,GAAYhgB,EAAG,CAAEb,KAAM,IAAKR,MAAM,IAA/C,GACrBgH,kBAAqB,KAAOvK,GAAM4kB,GAAYhqB,EAAG,CAAEmJ,KAAM,IAAKR,MAAM,IAA/C,GAK3B,SAAS8iB,GAAK/X,EAAMgT,EAAKC,GACrB,GAAID,EAAI7nB,OAAS,IACb,MAAUF,MAAM,0CAA4C+nB,EAAI7nB,QACpE,OAAO8X,GZQkB+U,EYRO,WZSzB9rB,WAAWC,KAAK6rB,GAAO,CAAChmB,EAAGf,KAC9B,MAAMgnB,EAAWjmB,EAAEkmB,WAAW,GAC9B,GAAiB,IAAblmB,EAAE7G,QAAgB8sB,EAAW,IAC7B,MAAUhtB,MAAM,wCAAwC+sB,EAAM/mB,iBAAiBgnB,iBAAwBhnB,KAE3G,OAAOgnB,CAAQ,KYd0B,IAAI/rB,WAAW,CAAC+mB,EAAS,EAAI,EAAGD,EAAI7nB,SAAU6nB,EAAKhT,GZQ7F,IAAsBgY,CYP7B,CAGA,MAmBaG,GFyeN,SAAwBnmB,GAC3B,MAAM0M,MAAEA,EAAKC,UAAEA,EAAS9G,KAAEA,EAAI+a,UAAEA,GAlCpC,SAAmC5gB,GAC/B,MAAM0M,EAAQ,CACVnP,EAAGyC,EAAEzC,EACLgH,EAAGvE,EAAEuE,EACLD,EAAGtE,EAAE5B,GAAGM,MACRpE,EAAG0F,EAAE1F,EACLwV,EAAG9P,EAAE8P,EACLsC,GAAIpS,EAAEoS,GACNC,GAAIrS,EAAEqS,IAIJ1F,EAAY,CAAEvO,GAFT4B,EAAE5B,GAEW6L,GADbvK,GAAMgN,EAAMpS,EAAG0F,EAAE0C,YAAY,GACZic,QAAS3e,EAAE2e,SACjCiC,EAAY,CACdrJ,YAAavX,EAAEuX,YACfsJ,kBAAmB7gB,EAAE6gB,kBACrBC,OAAQ9gB,EAAE8gB,OACVpT,QAAS1N,EAAE0N,QACXqT,WAAY/gB,EAAE+gB,YAElB,MAAO,CAAErU,QAAOC,YAAW9G,KAAM7F,EAAE6F,KAAM+a,YAC7C,CAakDwF,CAA0BpmB,GAGxE,OAfJ,SAAqCA,EAAG0gB,GACpC,MAAM3W,EAAQ2W,EAAM3W,MAOpB,OANe/N,OAAO8Q,OAAO,CAAA,EAAI4T,EAAO,CACpC2F,cAAetc,EACf2C,MAAO1M,EACP0C,WAAYqH,EAAME,GAAGxG,KACrBZ,YAAakH,EAAME,GAAGvG,OAG9B,CAMW4iB,CAA4BtmB,EADrB0gB,GADAhC,GAAQhS,EAAOC,GACF9G,EAAM+a,GAErC,CE9eqB2F,gBAnBa,MAAC,IAC5BjC,GACPlmB,GAAIA,GACA6L,MACAvH,WAAYuH,GAAGxG,KACfoC,KAAM2e,GACN3D,qBACAC,OAAQiF,GACRpH,aAR8B,IA+BdD,GAAQ6F,IAMrB,MAAMiC,kBAAuB,MAChC,MAAMnnB,EAAIilB,GAAYhgB,EACtB,OAAO6d,GAAW,CACd9iB,IACAoN,KAAM,OACN4V,WAAa1kB,GAGFL,EADSI,EADIunB,GAAsBtnB,GACRb,GAAKuC,GAClB1B,EAAG0B,GAE5BwhB,sBAEP,EAZmC,GCnI9B4F,GAAkB,CACpBniB,EAAG1L,OAAO,sEACV0B,EAAG1B,OAAO,sEACVkX,EAAGlX,OAAO,GACV2E,EAAG3E,OAAO,GACV4E,EAAG5E,OAAO,GACVwZ,GAAIxZ,OAAO,sEACXyZ,GAAIzZ,OAAO,uEAET8tB,GAAiB,CACnBpW,KAAM1X,OAAO,sEACb2X,QAAS,CACL,CAAC3X,OAAO,uCAAwCA,OAAO,uCACvD,CAACA,OAAO,uCAAwCA,OAAO,yCAKzDkE,kBAAsBlE,OAAO;sEA6BnC,MAAM+tB,GAAOjnB,GAAM+mB,GAAgBniB,EAAG,CAAEf,KAxBxC,SAAiBuN,GACb,MAAMzR,EAAIonB,GAAgBniB,EAEpBvH,EAAMnE,OAAO,GAAIguB,EAAMhuB,OAAO,GAAIgsB,EAAOhsB,OAAO,IAAKisB,EAAOjsB,OAAO,IAEnEiuB,EAAOjuB,OAAO,IAAKksB,EAAOlsB,OAAO,IAAKmsB,EAAOnsB,OAAO,IACpDqa,EAAMnC,EAAIA,EAAIA,EAAKzR,EACnB4V,EAAMhC,EAAKA,EAAKnC,EAAKzR,EACrB6lB,EAAMxnB,EAAKuX,EAAIlY,EAAKsC,GAAK4V,EAAM5V,EAC/B8lB,EAAMznB,EAAKwnB,EAAInoB,EAAKsC,GAAK4V,EAAM5V,EAC/B+lB,EAAO1nB,EAAKynB,EAAIroB,GAAKuC,GAAK4T,EAAM5T,EAChCgmB,EAAO3nB,EAAK0nB,EAAKR,EAAMvlB,GAAK+lB,EAAO/lB,EACnCimB,EAAO5nB,EAAK2nB,EAAKR,EAAMxlB,GAAKgmB,EAAOhmB,EACnCkmB,EAAO7nB,EAAK4nB,EAAKR,EAAMzlB,GAAKimB,EAAOjmB,EACnCmmB,EAAQ9nB,EAAK6nB,EAAKR,EAAM1lB,GAAKkmB,EAAOlmB,EACpComB,EAAQ/nB,EAAK8nB,EAAMV,EAAMzlB,GAAKimB,EAAOjmB,EACrCsmB,EAAQjoB,EAAK+nB,EAAM1oB,EAAKsC,GAAK4V,EAAM5V,EACnCiW,EAAM5X,EAAKioB,EAAMkB,EAAMxnB,GAAKgmB,EAAOhmB,EACnCkW,EAAM7X,EAAK4X,EAAIsR,EAAKvnB,GAAK4T,EAAM5T,EAC/BhB,EAAOX,EAAK6X,EAAIzY,GAAKuC,GAC3B,IAAKsnB,GAAKroB,IAAIqoB,GAAKpoB,IAAIF,GAAOyS,GAC1B,MAAU7X,MAAM,2BACpB,OAAOoF,CACX,IAgBayoB,GAAYnJ,GAAY,IAAK8I,GAAiBroB,GAAIuoB,GAAMlZ,MAAM,EAAM2C,KAAMsW,IAAkBrI,GCzEnGjgB,GAAKsB,GAAM9G,OAAO,uEAKXmuB,GAAkBpJ,GAAY,CACzCpgB,EALca,GAAG2F,OAAOnL,OAAO,uEAM/B4E,EALc5E,OAAO,yEAMrBwF,GAEA9D,EAAG1B,OAAO,sEAEVwZ,GAAIxZ,OAAO,sEACXyZ,GAAIzZ,OAAO,sEACXkX,EAAGlX,OAAO,GACV6U,MAAM,GACI4Q,GChBNjgB,GAAKsB,GAAM9G,OAAO,uGAKXouB,GAAkBrJ,GAAY,CACzCpgB,EALca,GAAG2F,OAAOnL,OAAO,uGAM/B4E,EALc5E,OAAO,yGAMrBwF,GAEA9D,EAAG1B,OAAO,sGAEVwZ,GAAIxZ,OAAO,sGACXyZ,GAAIzZ,OAAO,sGACXkX,EAAGlX,OAAO,GACV6U,MAAM,GACI8Q,GChBNngB,GAAKsB,GAAM9G,OAAO,uIAKXquB,GAAkBtJ,GAAY,CACzCpgB,EALca,GAAG2F,OAAOnL,OAAO,uIAM/B4E,EALc5E,OAAO,sIAMrBwF,MAEA9D,EAAG1B,OAAO,sIAEVwZ,GAAIxZ,OAAO,sIACXyZ,GAAIzZ,OAAO,sIACXkX,EAAGlX,OAAO,GACV6U,MAAM,GACIgR,GCPCyI,GAAc,IAAIC,IAAInrB,OAAOC,QAAQ,UAChDmrB,YACAC,YACAC,GACAP,mBACAC,mBACAC,mBACAH,aACAN,QACAL","x_google_ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11,12,13]}