@happyvertical/smrt-profiles 0.54.1 → 0.54.3

package/dist/chunks/{NostrIdentity-n70E0vck.js.map → NostrIdentity-AC8fAdxe.js.map}

@@ -1 +1 @@
-{"version":3,"file":"NostrIdentity-n70E0vck.js","names":["isBytes","atitle","anumber","abytes","aobject","bytesToHex","hexToBytes","concatBytes","randomBytes","abytes_","anumber_","bytesToHex_","concatBytes_","hexToBytes_","isBytes_","randomBytes","randomBytes_","_0n","_1n","_0n","_1n","_2n","_3n","_4n","gcd","_0n","_1n","_4n","_0n","_2n","_0n","wcRandomBytes","hmac","nobleHmac","randomBytes"],"sources":["../../../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/_u64.js","../../../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/utils.js","../../../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/_md.js","../../../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/sha2.js","../../../../node_modules/.pnpm/@noble+curves@2.4.0/node_modules/@noble/curves/utils.js","../../../../node_modules/.pnpm/@noble+curves@2.4.0/node_modules/@noble/curves/abstract/modular.js","../../../../node_modules/.pnpm/@noble+curves@2.4.0/node_modules/@noble/curves/abstract/curve.js","../../../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/hmac.js","../../../../node_modules/.pnpm/@noble+curves@2.4.0/node_modules/@noble/curves/abstract/der.js","../../../../node_modules/.pnpm/@noble+curves@2.4.0/node_modules/@noble/curves/abstract/weierstrass.js","../../../../node_modules/.pnpm/@noble+curves@2.4.0/node_modules/@noble/curves/secp256k1.js","../../../../node_modules/.pnpm/bech32@2.0.0/node_modules/bech32/dist/index.js","../../src/auth/nostrCrypto.ts","../../src/models/NostrIdentity.ts"],"sourcesContent":["const U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();\nconst _32n = /* @__PURE__ */ BigInt(32);\n// Split bigint into two 32-bit halves. With `le=true`, returned fields become `{ h: low, l: high\n// }` to match little-endian word order rather than the property names.\nfunction fromBig(n, le = false) {\n    if (le)\n        return { h: Number(n & U32_MASK64), l: Number((n >> _32n) & U32_MASK64) };\n    return { h: Number((n >> _32n) & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };\n}\n// Split bigint list into `[highWords, lowWords]` when `le=false`; with `le=true`, the first array\n// holds the low halves because `fromBig(...)` swaps the semantic meaning of `h` and `l`.\nfunction split(lst, le = false) {\n    const len = lst.length;\n    let Ah = new Uint32Array(len);\n    let Al = new Uint32Array(len);\n    for (let i = 0; i < len; i++) {\n        const { h, l } = fromBig(lst[i], le);\n        [Ah[i], Al[i]] = [h, l];\n    }\n    return [Ah, Al];\n}\n// Combine explicit `(high, low)` 32-bit halves into a bigint; `>>> 0` normalizes signed JS\n// bitwise results back to uint32 first, and little-endian callers must swap.\nconst toBig = (h, l) => (BigInt(h >>> 0) << _32n) | BigInt(l >>> 0);\n// Split a JS number into u32 halves without a BigInt allocation. Exact only for integers\n// `0 <= n < 2**53`; callers use it on byte / bit counters, which JS length math caps far below\n// that (an ArrayBuffer cannot exceed 2**53 - 1 bytes).\nconst fromNumH = (n) => (n / 2 ** 32) | 0;\nconst fromNumL = (n) => n >>> 0;\n// Drop-in replacement for `view.setBigUint64(byteOffset, BigInt(n), isLE)` without the per-call\n// BigInt allocation. Same `n < 2**53` precondition as `fromNumH`/`fromNumL`.\nfunction setU64FromNum(view, byteOffset, n, isLE) {\n    const h = fromNumH(n);\n    const l = fromNumL(n);\n    view.setUint32(byteOffset, isLE ? l : h, isLE);\n    view.setUint32(byteOffset + 4, isLE ? h : l, isLE);\n}\n// High 32-bit half of a 64-bit logical right shift for `s` in `0..31`.\nconst shrSH = (h, _l, s) => h >>> s;\n// Low 32-bit half of a 64-bit logical right shift, valid for `s` in `1..31`.\nconst shrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);\n// High 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.\nconst rotrSH = (h, l, s) => (h >>> s) | (l << (32 - s));\n// Low 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.\nconst rotrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);\n// High 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.\nconst rotrBH = (h, l, s) => (h << (64 - s)) | (l >>> (s - 32));\n// Low 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.\nconst rotrBL = (h, l, s) => (h >>> (s - 32)) | (l << (64 - s));\n// High 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped low half.\nconst rotr32H = (_h, l) => l;\n// Low 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped high half.\nconst rotr32L = (h, _l) => h;\n// 64-bit left rotates (rotl*) are not defined here: sha3.ts, their only consumer, keeps\n// local copies so V8 inlines them into keccakP.\n// Add two split 64-bit words and return the split `{ h, l }` sum.\n// JS uses 32-bit signed integers for bitwise operations, so we cannot simply shift the carry out\n// of the low sum and instead use division.\nfunction add(Ah, Al, Bh, Bl) {\n    const l = (Al >>> 0) + (Bl >>> 0);\n    return { h: (Ah + Bh + ((l / 2 ** 32) | 0)) | 0, l: l | 0 };\n}\n// Addition with more than 2 elements\n// Unmasked low-word accumulator for 3-way addition; pass the raw result into `add3H(...)`.\nconst add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);\n// High-word finalize step for 3-way addition; `low` must be the untruncated output of `add3L(...)`.\nconst add3H = (low, Ah, Bh, Ch) => (Ah + Bh + Ch + ((low / 2 ** 32) | 0)) | 0;\n// Unmasked low-word accumulator for 4-way addition; pass the raw result into `add4H(...)`.\nconst add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);\n// High-word finalize step for 4-way addition; `low` must be the untruncated output of `add4L(...)`.\nconst add4H = (low, Ah, Bh, Ch, Dh) => (Ah + Bh + Ch + Dh + ((low / 2 ** 32) | 0)) | 0;\n// Unmasked low-word accumulator for 5-way addition; pass the raw result into `add5H(...)`.\nconst add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);\n// High-word finalize step for 5-way addition; `low` must be the untruncated output of `add5L(...)`.\nconst add5H = (low, Ah, Bh, Ch, Dh, Eh) => (Ah + Bh + Ch + Dh + Eh + ((low / 2 ** 32) | 0)) | 0;\n// prettier-ignore\nexport { add, add3H, add3L, add4H, add4L, add5H, add5L, fromBig, fromNumH, fromNumL, rotr32H, rotr32L, rotrBH, rotrBL, rotrSH, rotrSL, setU64FromNum, shrSH, shrSL, split, toBig };\n","/**\n * Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.\n * @param a - value to test\n * @returns `true` when the value is a Uint8Array-compatible view.\n * @example\n * Check whether a value is a Uint8Array-compatible view.\n * ```ts\n * isBytes(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport function isBytes(a) {\n    // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases.\n    // The fallback still requires a real ArrayBuffer view, so plain\n    // JSON-deserialized `{ constructor: ... }` spoofing is rejected, and\n    // `BYTES_PER_ELEMENT === 1` keeps the fallback on byte-oriented views.\n    return (a instanceof Uint8Array ||\n        (ArrayBuffer.isView(a) &&\n            a.constructor.name === 'Uint8Array' &&\n            'BYTES_PER_ELEMENT' in a &&\n            a.BYTES_PER_ELEMENT === 1));\n}\n// Shared error-message prefix builder. Only called on throw paths, so assert\n// success paths never pay for the string concatenation.\nconst atitle = (title) => (title ? `\"${title}\" ` : '');\n/**\n * Asserts something is a non-negative integer.\n * @param n - number to validate\n * @param title - label included in thrown errors\n * @returns The validated number.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validate a non-negative integer option.\n * ```ts\n * anumber(32, 'length');\n * ```\n */\nexport function anumber(n, title = '') {\n    if (typeof n !== 'number')\n        throw new TypeError(atitle(title) + 'expected number, got ' + typeof n);\n    if (!Number.isSafeInteger(n) || n < 0)\n        throw new RangeError(atitle(title) + 'expected integer >= 0, got ' + n);\n    return n;\n}\n/**\n * Asserts something is a boolean.\n * @param value - value to validate\n * @param title - label included in thrown errors\n * @returns The validated boolean.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Validate a boolean option.\n * ```ts\n * abool(true, 'enableXOF');\n * ```\n */\nexport function abool(value, title = '') {\n    if (typeof value !== 'boolean')\n        throw new TypeError(atitle(title) + 'expected boolean, got type=' + typeof value);\n    return value;\n}\n/**\n * Asserts something is Uint8Array.\n * @param value - value to validate\n * @param length - optional exact length constraint\n * @param title - label included in thrown errors\n * @returns The validated byte array.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validate that a value is a byte array.\n * ```ts\n * abytes(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport function abytes(value, length, title = '') {\n    // Success path first: this runs at the start of every update() / digestInto(), and the\n    // common `abytes(data)` form must not pay for length handling it does not use.\n    if (isBytes(value) && (length === undefined || value.length === length))\n        return value;\n    // Error path: recompute freely to build the exact message.\n    if (length !== undefined)\n        anumber(length, 'length');\n    const bytes = isBytes(value);\n    const ofLen = length !== undefined ? ` of length ${length}` : '';\n    const got = bytes ? `length=${value.length}` : `type=${typeof value}`;\n    const message = atitle(title) + 'expected Uint8Array' + ofLen + ', got ' + got;\n    if (!bytes)\n        throw new TypeError(message);\n    throw new RangeError(message);\n}\n/**\n * Copies bytes into a fresh Uint8Array.\n * Buffer-style slices can alias the same backing store, so callers that need ownership should copy.\n * @param bytes - source bytes to clone\n * @returns Freshly allocated copy of `bytes`.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Clone a byte array before mutating it.\n * ```ts\n * const copy = copyBytes(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport function copyBytes(bytes) {\n    // `Uint8Array.from(...)` would also accept arrays / other typed arrays. Keep this helper strict\n    // because callers use it at byte-validation boundaries before mutating the detached copy.\n    return Uint8Array.from(abytes(bytes));\n}\n/**\n * Asserts something is a wrapped hash constructor.\n * @param h - hash constructor to validate\n * @throws On wrong argument types or invalid hash wrapper shape. {@link TypeError}\n * @throws On invalid hash metadata ranges or values. {@link RangeError}\n * @throws If the hash metadata allows empty outputs or block sizes. {@link Error}\n * @example\n * Validate a callable hash wrapper.\n * ```ts\n * import { ahash } from '@noble/hashes/utils.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * ahash(sha256);\n * ```\n */\nexport function ahash(h) {\n    if (typeof h !== 'function' || typeof h.create !== 'function')\n        throw new TypeError('expected hash wrapped by utils.createHasher');\n    anumber(h.outputLen);\n    anumber(h.blockLen);\n    // HMAC and KDF callers treat these as real byte lengths; allowing zero lets fake wrappers pass\n    // validation and can produce empty outputs instead of failing fast.\n    if (h.outputLen < 1 || h.blockLen < 1)\n        throw new Error('hash blockLen / outputLen must be >= 1');\n}\nconst aobject = (value, label) => {\n    if (value === null || typeof value !== 'object' || Array.isArray(value))\n        throw new TypeError((label === 'object' ? '' : `\"${label}\" `) + 'expected object, got type=' + typeof value);\n};\nconst aopts = (value, label) => {\n    aobject(value, label);\n    const proto = Object.getPrototypeOf(value);\n    if (proto !== Object.prototype && proto !== null)\n        throw new TypeError(`\"${label}\" expected plain object`);\n    // Object.assign() treats an own \"__proto__\" source key as a write to the target's legacy\n    // prototype setter. Reject it before merging so inherited option values cannot be injected.\n    if (Object.hasOwn(value, '__proto__'))\n        throw new TypeError(`\"${label}.__proto__\" is not allowed`);\n};\n/**\n * Asserts a hash instance has not been destroyed or finished.\n * @param instance - hash instance to validate\n * @param checkFinished - whether to reject finalized instances\n * @throws If the hash instance has already been destroyed or finalized. {@link Error}\n * @example\n * Validate that a hash instance is still usable.\n * ```ts\n * import { aexists } from '@noble/hashes/utils.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const hash = sha256.create();\n * aexists(hash);\n * ```\n */\nexport function aexists(instance, checkFinished = true) {\n    // Runs on every update()/digestInto(); the flags are library-owned booleans, so only their\n    // truthiness is checked - re-validating their type per call was pure hot-path overhead.\n    if (instance.destroyed)\n        throw new Error('hash was destroyed');\n    if (checkFinished && instance.finished)\n        throw new Error('digest() was already called');\n}\n/**\n * Asserts output is a sufficiently-sized byte array.\n * @param out - destination buffer\n * @param instance - hash instance providing output length\n * Oversized buffers are allowed; downstream code only promises to fill the first `outputLen` bytes.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validate a caller-provided digest buffer.\n * ```ts\n * import { aoutput } from '@noble/hashes/utils.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const hash = sha256.create();\n * aoutput(new Uint8Array(hash.outputLen), hash);\n * ```\n */\nexport function aoutput(out, instance) {\n    abytes(out, undefined, 'output');\n    // `outputLen` is a library-owned readonly number; the negated comparison keeps failing fast\n    // when it is missing/NaN (comparisons with undefined/NaN are false) without an anumber() call.\n    const min = instance.outputLen;\n    if (!(out.length >= min)) {\n        throw new RangeError('\"output\" expected length >= ' + min);\n    }\n}\n/**\n * Casts a typed array view to Uint8Array.\n * @param arr - source typed array\n * @returns Uint8Array view over the same buffer.\n * @example\n * Reinterpret a typed array as bytes.\n * ```ts\n * u8(new Uint32Array([1, 2]));\n * ```\n */\nexport function u8(arr) {\n    return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/**\n * Casts a typed array view to Uint32Array.\n * `arr.byteOffset` must already be 4-byte aligned or the platform\n * Uint32Array constructor will throw.\n * @param arr - source typed array\n * @returns Uint32Array view over the same buffer.\n * @example\n * Reinterpret a byte array as 32-bit words.\n * ```ts\n * u32(new Uint8Array(8));\n * ```\n */\nexport function u32(arr) {\n    return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));\n}\n/**\n * Zeroizes typed arrays in place. Warning: JS provides no guarantees.\n * @param arrays - arrays to overwrite with zeros\n * @example\n * Zeroize sensitive buffers in place.\n * ```ts\n * clean(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport function clean(...arrays) {\n    for (let i = 0; i < arrays.length; i++) {\n        arrays[i].fill(0);\n    }\n}\n/**\n * Creates a DataView for byte-level manipulation.\n * @param arr - source typed array\n * @returns DataView over the same buffer region.\n * @example\n * Create a DataView over an existing buffer.\n * ```ts\n * createView(new Uint8Array(4));\n * ```\n */\nexport function createView(arr) {\n    return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/**\n * Rotate-right operation for uint32 values.\n * @param word - source word\n * @param shift - shift amount in bits\n * @returns Rotated word.\n * @example\n * Rotate a 32-bit word to the right.\n * ```ts\n * rotr(0x12345678, 8);\n * ```\n */\nexport function rotr(word, shift) {\n    return (word << (32 - shift)) | (word >>> shift);\n}\n/**\n * Rotate-left operation for uint32 values.\n * @param word - source word\n * @param shift - shift amount in bits\n * @returns Rotated word.\n * @example\n * Rotate a 32-bit word to the left.\n * ```ts\n * rotl(0x12345678, 8);\n * ```\n */\nexport function rotl(word, shift) {\n    return (word << shift) | ((word >>> (32 - shift)) >>> 0);\n}\n/** Whether the current platform is little-endian. */\nexport const isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44)();\n/**\n * Byte-swap operation for uint32 values.\n * @param word - source word\n * @returns Word with reversed byte order.\n * @example\n * Reverse the byte order of a 32-bit word.\n * ```ts\n * byteSwap(0x11223344);\n * ```\n */\nexport function byteSwap(word) {\n    return (((word << 24) & 0xff000000) |\n        ((word << 8) & 0xff0000) |\n        ((word >>> 8) & 0xff00) |\n        ((word >>> 24) & 0xff));\n}\n/**\n * Conditionally byte-swaps one 32-bit word on big-endian platforms.\n * @param n - source word\n * @returns Original or byte-swapped word depending on platform endianness.\n * @example\n * Normalize a 32-bit word for host endianness.\n * ```ts\n * swap8IfBE(0x11223344);\n * ```\n */\nexport const swap8IfBE = isLE\n    ? (n) => n\n    : (n) => byteSwap(n) >>> 0;\n/**\n * Byte-swaps every word of a Uint32Array in place.\n * @param arr - array to mutate\n * @returns The same array after mutation; callers pass live state arrays here.\n * @example\n * Reverse the byte order of every word in place.\n * ```ts\n * byteSwap32(new Uint32Array([0x11223344]));\n * ```\n */\nexport function byteSwap32(arr) {\n    for (let i = 0; i < arr.length; i++) {\n        arr[i] = byteSwap(arr[i]);\n    }\n    return arr;\n}\n/**\n * Conditionally byte-swaps a Uint32Array on big-endian platforms.\n * @param u - array to normalize for host endianness\n * @returns Original or byte-swapped array depending on platform endianness.\n *   On big-endian runtimes this mutates `u` in place via `byteSwap32(...)`.\n * @example\n * Normalize a word array for host endianness.\n * ```ts\n * swap32IfBE(new Uint32Array([0x11223344]));\n * ```\n */\nexport const swap32IfBE = isLE\n    ? (u) => u\n    : byteSwap32;\n// Built-in hex conversion https://caniuse.com/mdn-javascript_builtins_uint8array_fromhex\nconst hasHexBuiltin = /* @__PURE__ */ (() => \n// @ts-ignore\ntypeof Uint8Array.from([]).toHex === 'function' && typeof Uint8Array.fromHex === 'function')();\n// Array where index 0xf0 (240) is mapped to string 'f0'\nconst hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));\n/**\n * Convert byte array to hex string.\n * Uses the built-in function when available and assumes it matches the tested\n * fallback semantics.\n * @param bytes - bytes to encode\n * @returns Lowercase hexadecimal string.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Convert bytes to lowercase hexadecimal.\n * ```ts\n * bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])); // 'cafe0123'\n * ```\n */\nexport function bytesToHex(bytes) {\n    abytes(bytes);\n    // @ts-ignore\n    if (hasHexBuiltin)\n        return bytes.toHex();\n    // pre-caching improves the speed 6x\n    let hex = '';\n    for (let i = 0; i < bytes.length; i++) {\n        hex += hexes[bytes[i]];\n    }\n    return hex;\n}\n// Strict ASCII nibble parser: non-ASCII hex lookalikes are rejected as undefined.\n// ASCII codes: '0'..'9' = 48..57, 'A'..'F' = 65..70, 'a'..'f' = 97..102.\n// prettier-ignore\nfunction asciiToBase16(ch) {\n    return ch >= 48 && ch <= 57 ? ch - 48 // '2' => 50-48\n        : ch >= 65 && ch <= 70 ? ch - (65 - 10) // 'B' => 66-(65-10)\n            : ch >= 97 && ch <= 102 ? ch - (97 - 10) // 'b' => 98-(97-10)\n                : undefined;\n}\n/**\n * Convert hex string to byte array. Uses built-in function, when available.\n * @param hex - hexadecimal string to decode\n * @returns Decoded bytes.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Decode lowercase hexadecimal into bytes.\n * ```ts\n * hexToBytes('cafe0123'); // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])\n * ```\n */\nexport function hexToBytes(hex) {\n    if (typeof hex !== 'string')\n        throw new TypeError('hex string expected, got ' + typeof hex);\n    if (hasHexBuiltin) {\n        try {\n            return Uint8Array.fromHex(hex);\n        }\n        catch (error) {\n            if (error instanceof SyntaxError)\n                throw new RangeError(error.message);\n            throw error;\n        }\n    }\n    const hl = hex.length;\n    const al = hl / 2;\n    if (hl % 2)\n        throw new RangeError('hex string expected, got unpadded hex of length ' + hl);\n    const array = new Uint8Array(al);\n    for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {\n        const n1 = asciiToBase16(hex.charCodeAt(hi)); // parse first char, multiply it by 16\n        const n2 = asciiToBase16(hex.charCodeAt(hi + 1)); // parse second char\n        if (n1 === undefined || n2 === undefined) {\n            const char = hex[hi] + hex[hi + 1];\n            throw new RangeError('hex string expected, got non-hex character \"' + char + '\" at index ' + hi);\n        }\n        array[ai] = n1 * 16 + n2; // example: 'A9' => 10*16 + 9\n    }\n    return array;\n}\n/**\n * Yields to the host task scheduler so timers, I/O, and rendering can make progress.\n * Uses the Web Scheduling API when available or `setTimeout` as a cross-platform fallback.\n * Host-task yields are much slower than microtasks (roughly 1ms with the timer fallback), so\n * async loops should use `asyncTick >= 10` to amortize scheduling overhead to about 10% while\n * still allowing other event-loop work to proceed.\n * @param onReject - optional cleanup invoked only if the host yield fails\n * @example\n * Yield to the next scheduler tick.\n * ```ts\n * await nextTick();\n * ```\n */\nexport function nextTick(onReject) {\n    const host = globalThis;\n    if (typeof host.scheduler?.yield === 'function') {\n        const promise = host.scheduler.yield();\n        // Keep the original scheduler rejection; this handler exists only for cleanup.\n        if (onReject)\n            promise.catch(onReject);\n        return promise;\n    }\n    return new Promise((resolve) => host.setTimeout(resolve, 0));\n}\n/**\n * Returns control to the host event loop every `tick` milliseconds to avoid blocking long loops.\n * @param iters - number of loop iterations to run\n * @param tick - maximum time slice in milliseconds\n * @param cb - callback executed on each iteration\n * @param onReject - optional cleanup invoked only if a host yield fails\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Run a loop that periodically yields back to the event loop.\n * ```ts\n * await asyncLoop(2, 0, () => {});\n * ```\n */\nexport async function asyncLoop(iters, tick, cb, onReject) {\n    anumber(iters, 'iters');\n    anumber(tick, 'tick');\n    if (typeof cb !== 'function')\n        throw new TypeError('callback must be a function');\n    // Callback is synchronous by contract; asyncLoop only yields between sync work windows.\n    let ts = Date.now();\n    for (let i = 0; i < iters; i++) {\n        cb(i);\n        // Date.now() is not monotonic, so in case if clock goes backwards we return return control too\n        const diff = Date.now() - ts;\n        if (diff >= 0 && diff < tick)\n            continue;\n        await nextTick(onReject);\n        // Track only synchronous work time; scheduler delay after yielding is outside our budget.\n        ts = Date.now();\n    }\n}\n/**\n * Converts string to bytes using UTF8 encoding.\n * Built-in doesn't validate input to be string: we do the check.\n * Non-ASCII details are delegated to the platform `TextEncoder`.\n * @param str - string to encode\n * @returns UTF-8 encoded bytes.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Encode a string as UTF-8 bytes.\n * ```ts\n * utf8ToBytes('abc'); // Uint8Array.from([97, 98, 99])\n * ```\n */\nexport function utf8ToBytes(str) {\n    if (typeof str !== 'string')\n        throw new TypeError('string expected');\n    const encoded = new TextEncoder().encode(str);\n    try {\n        // Copy into the current realm for Firefox extension contexts. Callers that own the returned\n        // buffer can then wipe it independently of TextEncoder's temporary result.\n        return new Uint8Array(encoded); // https://bugzil.la/1681809\n    }\n    finally {\n        clean(encoded);\n    }\n}\n/**\n * Helper for KDFs: consumes Uint8Array or string.\n * String inputs are UTF-8 encoded; byte-array inputs stay aliased to the caller buffer.\n * @param data - user-provided KDF input\n * @param errorTitle - label included in thrown errors\n * @returns Byte representation of the input.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Normalize KDF input to bytes.\n * ```ts\n * kdfInputToBytes('password');\n * ```\n */\nexport function kdfInputToBytes(data, errorTitle = '') {\n    if (typeof data === 'string')\n        return utf8ToBytes(data);\n    return abytes(data, undefined, errorTitle);\n}\n/**\n * Copies several Uint8Arrays into one.\n * @param arrays - arrays to concatenate\n * @returns Concatenated byte array.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Concatenate multiple byte arrays.\n * ```ts\n * concatBytes(new Uint8Array([1]), new Uint8Array([2]));\n * ```\n */\nexport function concatBytes(...arrays) {\n    let sum = 0;\n    for (let i = 0; i < arrays.length; i++) {\n        const a = arrays[i];\n        abytes(a);\n        sum += a.length;\n    }\n    const res = new Uint8Array(sum);\n    for (let i = 0, pad = 0; i < arrays.length; i++) {\n        const a = arrays[i];\n        res.set(a, pad);\n        pad += a.length;\n    }\n    return res;\n}\n/**\n * Validates declared required and optional field types on a plain object.\n * This walks field schemas and formats detailed errors, so avoid it on hot paths; use direct\n * one-line guards such as `abytes()`, `abool()`, or `anumber()` instead.\n * @param object - object to validate\n * @param fields - map of required field names to expected types\n * @param optFields - map of optional field names to expected types\n * @param title - label included in thrown errors\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Validate required and optional option fields.\n * ```ts\n * validateObject({ N: 1024, dkLen: 32 }, { N: 'number' }, { dkLen: 'number' });\n * ```\n */\nexport const validateObject = (object, fields = {}, optFields = {}, title = 'object') => {\n    aobject(object, title);\n    aobject(fields, 'fields');\n    aobject(optFields, 'optFields');\n    function checkField(fieldName, expectedType, isOpt) {\n        const label = title === 'object' ? `param \"${String(fieldName)}\"` : `\"${title}.${String(fieldName)}\"`;\n        // Config fields must be explicit own properties. Optional inherited values are rejected too\n        // because callers keep reading the same options object after validation.\n        const val = object[fieldName];\n        // Runtime objects such as Field instances intentionally satisfy required method slots\n        // via their shared prototype.\n        if (!Object.hasOwn(object, fieldName) &&\n            (isOpt ? val !== undefined : expectedType !== 'function')) {\n            throw new TypeError(`${label} is invalid: expected own property`);\n        }\n        if (isOpt && val === undefined)\n            return;\n        const current = typeof val;\n        if (current !== expectedType || val === null)\n            throw new TypeError(`${label} is invalid: expected ${expectedType}, got ${current}`);\n    }\n    const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));\n    iter(fields, false);\n    iter(optFields, true);\n};\n/**\n * Merges default options and passed options.\n * @param defaults - base option object\n * @param opts - user overrides\n * @param title - label included in thrown override errors\n * @returns Fresh merged option object with a null prototype.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Merge user overrides onto default options.\n * ```ts\n * checkOpts({ dkLen: 32 }, { asyncTick: 10 });\n * ```\n */\nexport function checkOpts(defaults, opts, title = 'opts') {\n    aopts(defaults, 'defaults');\n    if (opts !== undefined)\n        aopts(opts, title);\n    // Callers read optional fields directly, so omitted values must not fall through to ambient\n    // Object.prototype pollution (for example a forged `dkLen` changing SHAKE's default output).\n    const merged = Object.assign(Object.create(null), defaults, opts);\n    return merged;\n}\n/**\n * Creates a callable hash function from a stateful class constructor.\n * @param hashCons - hash constructor or factory\n * @param info - optional metadata such as DER OID\n * @returns Frozen callable hash wrapper with `.create()`.\n *   Wrapper construction eagerly calls `hashCons(undefined)` once to read\n *   `outputLen` / `blockLen`, so constructor side effects happen at module\n *   init time.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Wrap a stateful hash constructor into a callable helper.\n * ```ts\n * import { createHasher } from '@noble/hashes/utils.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const wrapped = createHasher(sha256.create, { oid: sha256.oid });\n * wrapped(new Uint8Array([1]));\n * ```\n */\nexport function createHasher(hashCons, info = {}) {\n    if (typeof hashCons !== 'function')\n        throw new TypeError('\"hashCons\" expected function, got type=' + typeof hashCons);\n    info = checkOpts({}, info, 'info');\n    const hashC = (msg, opts) => hashCons(opts)\n        .update(msg)\n        .digest();\n    const tmp = hashCons(undefined);\n    hashC.outputLen = tmp.outputLen;\n    hashC.blockLen = tmp.blockLen;\n    hashC.canXOF = tmp.canXOF;\n    hashC.create = (opts) => hashCons(opts);\n    Object.assign(hashC, info);\n    return Object.freeze(hashC);\n}\n/**\n * Cryptographically secure PRNG backed by `crypto.getRandomValues`.\n * @param bytesLength - number of random bytes to generate\n * @returns Random bytes.\n * The platform `getRandomValues()` implementation still defines any\n * single-call length cap, and this helper rejects oversize requests\n * with a stable library `RangeError` instead of host-specific errors.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @throws If the current runtime does not provide `crypto.getRandomValues`. {@link Error}\n * @example\n * Generate a fresh random key or nonce.\n * ```ts\n * const key = randomBytes(16);\n * ```\n */\nexport function randomBytes(bytesLength = 32) {\n    // Match the repo's other length-taking helpers instead of relying on Uint8Array coercion.\n    anumber(bytesLength, 'bytesLength');\n    const cr = typeof globalThis === 'object' ? globalThis.crypto : null;\n    if (typeof cr?.getRandomValues !== 'function')\n        throw new Error('crypto.getRandomValues must be defined');\n    // Web Cryptography API Level 2 §10.1.1:\n    // if `byteLength > 65536`, throw `QuotaExceededError`.\n    // Keep the guard explicit so callers can see the quota in code\n    // instead of discovering it by reading the spec or host errors.\n    // This wrapper surfaces the same quota as a stable library RangeError.\n    if (bytesLength > 65536)\n        throw new RangeError(`\"bytesLength\" expected <= 65536, got ${bytesLength}`);\n    return cr.getRandomValues(new Uint8Array(bytesLength));\n}\n/**\n * Creates OID metadata for NIST hashes with prefix `06 09 60 86 48 01 65 03 04 02`.\n * @param suffix - final OID byte for the selected hash.\n *   The helper accepts any byte even though only the documented NIST hash\n *   suffixes are meaningful downstream.\n * @returns Object containing the DER-encoded OID.\n * @example\n * Build OID metadata for a NIST hash.\n * ```ts\n * oidNist(0x01);\n * ```\n */\nexport const oidNist = (suffix) => ({\n    // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.\n    // Larger suffix values would need base-128 OID encoding and a different length byte.\n    oid: Uint8Array.from([0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, suffix]),\n});\n","/**\n * Internal Merkle-Damgard hash utils.\n * @module\n */\nimport { setU64FromNum } from \"./_u64.js\";\nimport { abytes, aexists, aoutput, createView } from \"./utils.js\";\n/**\n * Shared 32-bit conditional boolean primitive reused by SHA-256, SHA-1, and MD5 `F`.\n * Returns bits from `b` when `a` is set, otherwise from `c`.\n * The XOR form is equivalent to MD5's `F(X,Y,Z) = XY v not(X)Z` because the masked terms never\n * set the same bit.\n * @param a - selector word\n * @param b - word chosen when selector bit is set\n * @param c - word chosen when selector bit is clear\n * @returns Mixed 32-bit word.\n * @example\n * Combine three words with the shared 32-bit choice primitive.\n * ```ts\n * Chi(0xffffffff, 0x12345678, 0x87654321);\n * ```\n */\nexport function Chi(a, b, c) {\n    return (a & b) ^ (~a & c);\n}\n/**\n * Shared 32-bit majority primitive reused by SHA-256 and SHA-1.\n * Returns bits shared by at least two inputs.\n * @param a - first input word\n * @param b - second input word\n * @param c - third input word\n * @returns Mixed 32-bit word.\n * @example\n * Combine three words with the shared 32-bit majority primitive.\n * ```ts\n * Maj(0xffffffff, 0x12345678, 0x87654321);\n * ```\n */\nexport function Maj(a, b, c) {\n    return (a & b) ^ (a & c) ^ (b & c);\n}\n/**\n * Merkle-Damgard hash construction base class.\n * Could be used to create MD5, RIPEMD, SHA1, SHA2.\n * Accepts only byte-aligned `Uint8Array` input, even when the underlying spec describes bit\n * strings with partial-byte tails.\n * @param blockLen - internal block size in bytes\n * @param outputLen - digest size in bytes\n * @param padOffset - trailing length field size in bytes\n * @param isLE - whether length and state words are encoded in little-endian\n * @example\n * Use a concrete subclass to get the shared Merkle-Damgard update/digest flow.\n * ```ts\n * import { _SHA1 } from '@noble/hashes/legacy.js';\n * const hash = new _SHA1();\n * hash.update(new Uint8Array([97, 98, 99]));\n * hash.digest();\n * ```\n */\nexport class HashMD {\n    blockLen;\n    outputLen;\n    canXOF = false;\n    padOffset;\n    isLE;\n    // For partial updates less than block size\n    buffer;\n    view;\n    finished = false;\n    length = 0;\n    pos = 0;\n    destroyed = false;\n    constructor(blockLen, outputLen, padOffset, isLE) {\n        this.blockLen = blockLen;\n        this.outputLen = outputLen;\n        this.padOffset = padOffset;\n        this.isLE = isLE;\n        this.buffer = new Uint8Array(blockLen);\n        this.view = createView(this.buffer);\n    }\n    update(data) {\n        aexists(this);\n        abytes(data);\n        const { view, buffer, blockLen } = this;\n        const len = data.length;\n        let processed = false;\n        for (let pos = 0; pos < len;) {\n            const take = Math.min(blockLen - this.pos, len - pos);\n            // Fast path only when there is no buffered partial block: `take === blockLen` implies\n            // `this.pos === 0`, so we can process full blocks directly from the input view.\n            if (take === blockLen) {\n                const dataView = createView(data);\n                for (; blockLen <= len - pos; pos += blockLen)\n                    this.process(dataView, pos);\n                processed = true;\n                continue;\n            }\n            // When the whole input is buffered in one go (common for short messages), passing `data`\n            // directly avoids allocating a subarray view.\n            buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);\n            this.pos += take;\n            pos += take;\n            if (this.pos === blockLen) {\n                this.process(view, 0);\n                this.pos = 0;\n                processed = true;\n            }\n        }\n        this.length += data.length;\n        // Shared schedule buffers only pick up input-derived words inside process(); if everything\n        // was buffered without processing, there is nothing to zero.\n        if (processed)\n            this.roundClean();\n        return this;\n    }\n    digestInto(out) {\n        aexists(this);\n        aoutput(out, this);\n        this.finished = true;\n        // Padding\n        // We can avoid allocation of buffer for padding completely if it\n        // was previously not allocated here. But it won't change performance.\n        const { buffer, view, blockLen, isLE } = this;\n        let { pos } = this;\n        // append the bit '1' to the message, then zero-pad the rest of the block\n        buffer[pos++] = 0b10000000;\n        buffer.fill(0, pos);\n        // we have less than padOffset left in buffer, so we cannot put length in\n        // current block, need process it and pad again\n        if (this.padOffset > blockLen - pos) {\n            this.process(view, 0);\n            buffer.fill(0);\n        }\n        // `padOffset` reserves the whole length field. For SHA-384/512 the high 64 bits stay zero from\n        // the padding fill above, and JS will overflow before user input can make that half non-zero.\n        // So we only need to write the low 64 bits here (`length * 8` only scales the exponent of an\n        // integer below 2**53, so the split inside the helper stays exact).\n        setU64FromNum(view, blockLen - 8, this.length * 8, isLE);\n        this.process(view, 0);\n        // The final block above is processed outside update(), so the shared message-schedule\n        // buffers (e.g. SHA256_W) would otherwise retain input-derived words after digest().\n        this.roundClean();\n        // digest() passes our own `buffer` as `out`; reuse its cached view instead of allocating one.\n        const oview = out === buffer ? view : createView(out);\n        const len = this.outputLen;\n        // NOTE: we do division by 4 later, which must be fused in single op with modulo by JIT\n        const outLen = len / 4;\n        const state = this.get();\n        // Subclass-misconfiguration invariant: outputLen must be 32-bit aligned and fit the state.\n        if (len % 4 || outLen > state.length)\n            throw new Error('invalid outputLen');\n        for (let i = 0; i < outLen; i++)\n            oview.setUint32(4 * i, state[i], isLE);\n    }\n    digest() {\n        const { buffer, outputLen } = this;\n        this.digestInto(buffer);\n        // Copy before destroy(): subclasses wipe `buffer` during cleanup, but `digest()` must return\n        // fresh bytes to the caller.\n        const res = buffer.slice(0, outputLen);\n        this.destroy();\n        return res;\n    }\n    _cloneIntoMeta(to) {\n        const { buffer, length, finished, destroyed, pos } = this;\n        to.destroyed = destroyed;\n        to.finished = finished;\n        to.length = length;\n        to.pos = pos;\n        // Only partial-block bytes need copying: when `length % blockLen === 0`, `pos === 0` and\n        // later `update()` / `digestInto()` overwrite `to.buffer` from the start before reading it.\n        if (pos)\n            to.buffer.set(buffer); // Avoid a hot modulo guard.\n        return to;\n    }\n    clone() {\n        return this._cloneInto();\n    }\n}\n/**\n * Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.\n * Check out `test/misc/sha2-gen-iv.js` for recomputation guide.\n */\n/** Initial SHA256 state from RFC 6234 §6.1: the first 32 bits of the fractional parts of the\n * square roots of the first eight prime numbers. Exported as a shared table; callers must treat\n * it as read-only because constructors copy words from it by index. */\nexport const SHA256_IV = /* @__PURE__ */ Uint32Array.from([\n    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,\n]);\n/** Initial SHA224 state `H(0)` from RFC 6234 §6.1. Exported as a shared table; callers must\n * treat it as read-only because constructors copy words from it by index. */\nexport const SHA224_IV = /* @__PURE__ */ Uint32Array.from([\n    0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939, 0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4,\n]);\n/** Initial SHA384 state from RFC 6234 §6.3: eight RFC 64-bit `H(0)` words stored as sixteen\n * big-endian 32-bit halves. Derived from the fractional parts of the square roots of the ninth\n * through sixteenth prime numbers. Exported as a shared table; callers must treat it as read-only\n * because constructors copy halves from it by index. */\nexport const SHA384_IV = /* @__PURE__ */ Uint32Array.from([\n    0xcbbb9d5d, 0xc1059ed8, 0x629a292a, 0x367cd507, 0x9159015a, 0x3070dd17, 0x152fecd8, 0xf70e5939,\n    0x67332667, 0xffc00b31, 0x8eb44a87, 0x68581511, 0xdb0c2e0d, 0x64f98fa7, 0x47b5481d, 0xbefa4fa4,\n]);\n/** Initial SHA512 state from RFC 6234 §6.3: eight RFC 64-bit `H(0)` words stored as sixteen\n * big-endian 32-bit halves. Derived from the fractional parts of the square roots of the first\n * eight prime numbers. Exported as a shared table; callers must treat it as read-only because\n * constructors copy halves from it by index. */\nexport const SHA512_IV = /* @__PURE__ */ Uint32Array.from([\n    0x6a09e667, 0xf3bcc908, 0xbb67ae85, 0x84caa73b, 0x3c6ef372, 0xfe94f82b, 0xa54ff53a, 0x5f1d36f1,\n    0x510e527f, 0xade682d1, 0x9b05688c, 0x2b3e6c1f, 0x1f83d9ab, 0xfb41bd6b, 0x5be0cd19, 0x137e2179,\n]);\n","/**\n * SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.\n * SHA256 is the fastest hash implementable in JS, even faster than Blake3.\n * Check out {@link https://www.rfc-editor.org/rfc/rfc4634 | RFC 4634} and\n * {@link https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf | FIPS 180-4}.\n * @module\n */\nimport { Chi, HashMD, Maj, SHA224_IV, SHA256_IV, SHA384_IV, SHA512_IV } from \"./_md.js\";\nimport * as u64 from \"./_u64.js\";\nimport { clean, createHasher, oidNist, rotr } from \"./utils.js\";\n/**\n * SHA-224 / SHA-256 round constants from RFC 6234 §5.1: the first 32 bits\n * of the cube roots of the first 64 primes (2..311).\n */\n// prettier-ignore\nconst SHA256_K = /* @__PURE__ */ Uint32Array.from([\n    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,\n    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,\n    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,\n    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,\n    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,\n    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,\n    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,\n    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2\n]);\n/** Reusable SHA-224 / SHA-256 message schedule buffer `W_t` from RFC 6234 §6.2 step 1. */\nconst SHA256_W = /* @__PURE__ */ new Uint32Array(64);\n/** Internal SHA-224 / SHA-256 compression engine from RFC 6234 §6.2. */\nclass SHA2_32B extends HashMD {\n    // We cannot use array here since array allows indexing by variable\n    // which means optimizer/compiler cannot use registers.\n    // Numeric initializers matter: starting the fields as `undefined` changes\n    // V8's field representation and makes sha256 3x slower (measured).\n    A = 0;\n    B = 0;\n    C = 0;\n    D = 0;\n    E = 0;\n    F = 0;\n    G = 0;\n    H = 0;\n    constructor(outputLen, IV) {\n        super(64, outputLen, 8, false);\n        this.A = IV[0] | 0;\n        this.B = IV[1] | 0;\n        this.C = IV[2] | 0;\n        this.D = IV[3] | 0;\n        this.E = IV[4] | 0;\n        this.F = IV[5] | 0;\n        this.G = IV[6] | 0;\n        this.H = IV[7] | 0;\n    }\n    get() {\n        const { A, B, C, D, E, F, G, H } = this;\n        return [A, B, C, D, E, F, G, H];\n    }\n    // prettier-ignore\n    set(A, B, C, D, E, F, G, H) {\n        this.A = A | 0;\n        this.B = B | 0;\n        this.C = C | 0;\n        this.D = D | 0;\n        this.E = E | 0;\n        this.F = F | 0;\n        this.G = G | 0;\n        this.H = H | 0;\n    }\n    _cloneInto(to) {\n        (to ||= new this.constructor()).set(...this.get());\n        return this._cloneIntoMeta(to);\n    }\n    process(view, offset) {\n        // Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array\n        for (let i = 0; i < 16; i++, offset += 4)\n            SHA256_W[i] = view.getUint32(offset, false);\n        for (let i = 16; i < 64; i++) {\n            const W15 = SHA256_W[i - 15];\n            const W2 = SHA256_W[i - 2];\n            const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ (W15 >>> 3);\n            const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ (W2 >>> 10);\n            SHA256_W[i] = (s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16]) | 0;\n        }\n        // Compression function main loop, 64 rounds\n        let { A, B, C, D, E, F, G, H } = this;\n        for (let i = 0; i < 64; i++) {\n            const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);\n            const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n            const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);\n            const T2 = (sigma0 + Maj(A, B, C)) | 0;\n            H = G;\n            G = F;\n            F = E;\n            E = (D + T1) | 0;\n            D = C;\n            C = B;\n            B = A;\n            A = (T1 + T2) | 0;\n        }\n        // Add the compressed chunk to the current hash value\n        A = (A + this.A) | 0;\n        B = (B + this.B) | 0;\n        C = (C + this.C) | 0;\n        D = (D + this.D) | 0;\n        E = (E + this.E) | 0;\n        F = (F + this.F) | 0;\n        G = (G + this.G) | 0;\n        H = (H + this.H) | 0;\n        this.set(A, B, C, D, E, F, G, H);\n    }\n    roundClean() {\n        clean(SHA256_W);\n    }\n    destroy() {\n        // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves\n        // update()/digest() callable on reused instances.\n        this.destroyed = true;\n        this.set(0, 0, 0, 0, 0, 0, 0, 0);\n        clean(this.buffer);\n    }\n}\n/** Internal SHA-256 hash class grounded in RFC 6234 §6.2. */\nexport class _SHA256 extends SHA2_32B {\n    constructor() {\n        super(32, SHA256_IV);\n    }\n}\n/** Internal SHA-224 hash class grounded in RFC 6234 §6.2 and §8.5. */\nexport class _SHA224 extends SHA2_32B {\n    constructor() {\n        super(28, SHA224_IV);\n    }\n}\n// SHA2-512 is slower than sha256 in js because u64 operations are slow.\n// SHA-384 / SHA-512 round constants from RFC 6234 §5.2:\n// 80 full 64-bit words split into high/low halves.\n// prettier-ignore\nconst K512 = /* @__PURE__ */ (() => u64.split([\n    '0x428a2f98d728ae22', '0x7137449123ef65cd', '0xb5c0fbcfec4d3b2f', '0xe9b5dba58189dbbc',\n    '0x3956c25bf348b538', '0x59f111f1b605d019', '0x923f82a4af194f9b', '0xab1c5ed5da6d8118',\n    '0xd807aa98a3030242', '0x12835b0145706fbe', '0x243185be4ee4b28c', '0x550c7dc3d5ffb4e2',\n    '0x72be5d74f27b896f', '0x80deb1fe3b1696b1', '0x9bdc06a725c71235', '0xc19bf174cf692694',\n    '0xe49b69c19ef14ad2', '0xefbe4786384f25e3', '0x0fc19dc68b8cd5b5', '0x240ca1cc77ac9c65',\n    '0x2de92c6f592b0275', '0x4a7484aa6ea6e483', '0x5cb0a9dcbd41fbd4', '0x76f988da831153b5',\n    '0x983e5152ee66dfab', '0xa831c66d2db43210', '0xb00327c898fb213f', '0xbf597fc7beef0ee4',\n    '0xc6e00bf33da88fc2', '0xd5a79147930aa725', '0x06ca6351e003826f', '0x142929670a0e6e70',\n    '0x27b70a8546d22ffc', '0x2e1b21385c26c926', '0x4d2c6dfc5ac42aed', '0x53380d139d95b3df',\n    '0x650a73548baf63de', '0x766a0abb3c77b2a8', '0x81c2c92e47edaee6', '0x92722c851482353b',\n    '0xa2bfe8a14cf10364', '0xa81a664bbc423001', '0xc24b8b70d0f89791', '0xc76c51a30654be30',\n    '0xd192e819d6ef5218', '0xd69906245565a910', '0xf40e35855771202a', '0x106aa07032bbd1b8',\n    '0x19a4c116b8d2d0c8', '0x1e376c085141ab53', '0x2748774cdf8eeb99', '0x34b0bcb5e19b48a8',\n    '0x391c0cb3c5c95a63', '0x4ed8aa4ae3418acb', '0x5b9cca4f7763e373', '0x682e6ff3d6b2b8a3',\n    '0x748f82ee5defb2fc', '0x78a5636f43172f60', '0x84c87814a1f0ab72', '0x8cc702081a6439ec',\n    '0x90befffa23631e28', '0xa4506cebde82bde9', '0xbef9a3f7b2c67915', '0xc67178f2e372532b',\n    '0xca273eceea26619c', '0xd186b8c721c0c207', '0xeada7dd6cde0eb1e', '0xf57d4f7fee6ed178',\n    '0x06f067aa72176fba', '0x0a637dc5a2c898a6', '0x113f9804bef90dae', '0x1b710b35131c471b',\n    '0x28db77f523047d84', '0x32caab7b40c72493', '0x3c9ebe0a15c9bebc', '0x431d67c49c100d4c',\n    '0x4cc5d4becb3e42b6', '0x597f299cfc657e2a', '0x5fcb6fab3ad6faec', '0x6c44198c4a475817'\n].map(n => BigInt(n))))();\nconst SHA512_Kh = /* @__PURE__ */ (() => K512[0])();\nconst SHA512_Kl = /* @__PURE__ */ (() => K512[1])();\n// Reusable high-half schedule buffer for the RFC 6234 §6.4 64-bit `W_t` words.\nconst SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);\n// Reusable low-half schedule buffer for the RFC 6234 §6.4 64-bit `W_t` words.\nconst SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);\n/** Internal SHA-384 / SHA-512 compression engine from RFC 6234 §6.4. */\nclass SHA2_64B extends HashMD {\n    // We cannot use array here since array allows indexing by variable\n    // which means optimizer/compiler cannot use registers.\n    // h -- high 32 bits, l -- low 32 bits\n    // Numeric initializers matter: starting the fields as `undefined` changes\n    // V8's field representation and slows hashing down (measured on sha256).\n    Ah = 0;\n    Al = 0;\n    Bh = 0;\n    Bl = 0;\n    Ch = 0;\n    Cl = 0;\n    Dh = 0;\n    Dl = 0;\n    Eh = 0;\n    El = 0;\n    Fh = 0;\n    Fl = 0;\n    Gh = 0;\n    Gl = 0;\n    Hh = 0;\n    Hl = 0;\n    constructor(outputLen, IV) {\n        super(128, outputLen, 16, false);\n        this.Ah = IV[0] | 0;\n        this.Al = IV[1] | 0;\n        this.Bh = IV[2] | 0;\n        this.Bl = IV[3] | 0;\n        this.Ch = IV[4] | 0;\n        this.Cl = IV[5] | 0;\n        this.Dh = IV[6] | 0;\n        this.Dl = IV[7] | 0;\n        this.Eh = IV[8] | 0;\n        this.El = IV[9] | 0;\n        this.Fh = IV[10] | 0;\n        this.Fl = IV[11] | 0;\n        this.Gh = IV[12] | 0;\n        this.Gl = IV[13] | 0;\n        this.Hh = IV[14] | 0;\n        this.Hl = IV[15] | 0;\n    }\n    // prettier-ignore\n    get() {\n        const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n        return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];\n    }\n    // prettier-ignore\n    set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {\n        this.Ah = Ah | 0;\n        this.Al = Al | 0;\n        this.Bh = Bh | 0;\n        this.Bl = Bl | 0;\n        this.Ch = Ch | 0;\n        this.Cl = Cl | 0;\n        this.Dh = Dh | 0;\n        this.Dl = Dl | 0;\n        this.Eh = Eh | 0;\n        this.El = El | 0;\n        this.Fh = Fh | 0;\n        this.Fl = Fl | 0;\n        this.Gh = Gh | 0;\n        this.Gl = Gl | 0;\n        this.Hh = Hh | 0;\n        this.Hl = Hl | 0;\n    }\n    _cloneInto(to) {\n        (to ||= new this.constructor()).set(...this.get());\n        return this._cloneIntoMeta(to);\n    }\n    process(view, offset) {\n        // Extend the first 16 words into the remaining 64 words w[16..79] of the message schedule array\n        for (let i = 0; i < 16; i++, offset += 4) {\n            SHA512_W_H[i] = view.getUint32(offset);\n            SHA512_W_L[i] = view.getUint32((offset += 4));\n        }\n        for (let i = 16; i < 80; i++) {\n            // s0 := (w[i-15] rightrotate 1) xor (w[i-15] rightrotate 8) xor (w[i-15] rightshift 7)\n            const W15h = SHA512_W_H[i - 15] | 0;\n            const W15l = SHA512_W_L[i - 15] | 0;\n            const s0h = u64.rotrSH(W15h, W15l, 1) ^ u64.rotrSH(W15h, W15l, 8) ^ u64.shrSH(W15h, W15l, 7);\n            const s0l = u64.rotrSL(W15h, W15l, 1) ^ u64.rotrSL(W15h, W15l, 8) ^ u64.shrSL(W15h, W15l, 7);\n            // s1 := (w[i-2] rightrotate 19) xor (w[i-2] rightrotate 61) xor (w[i-2] rightshift 6)\n            const W2h = SHA512_W_H[i - 2] | 0;\n            const W2l = SHA512_W_L[i - 2] | 0;\n            const s1h = u64.rotrSH(W2h, W2l, 19) ^ u64.rotrBH(W2h, W2l, 61) ^ u64.shrSH(W2h, W2l, 6);\n            const s1l = u64.rotrSL(W2h, W2l, 19) ^ u64.rotrBL(W2h, W2l, 61) ^ u64.shrSL(W2h, W2l, 6);\n            // SHA512_W[i] = s0 + s1 + SHA512_W[i - 7] + SHA512_W[i - 16];\n            const SUMl = u64.add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);\n            const SUMh = u64.add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);\n            SHA512_W_H[i] = SUMh | 0;\n            SHA512_W_L[i] = SUMl | 0;\n        }\n        let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n        // Compression function main loop, 80 rounds\n        for (let i = 0; i < 80; i++) {\n            // S1 := (e rightrotate 14) xor (e rightrotate 18) xor (e rightrotate 41)\n            const sigma1h = u64.rotrSH(Eh, El, 14) ^ u64.rotrSH(Eh, El, 18) ^ u64.rotrBH(Eh, El, 41);\n            const sigma1l = u64.rotrSL(Eh, El, 14) ^ u64.rotrSL(Eh, El, 18) ^ u64.rotrBL(Eh, El, 41);\n            //const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n            const CHIh = (Eh & Fh) ^ (~Eh & Gh);\n            const CHIl = (El & Fl) ^ (~El & Gl);\n            // T1 = H + sigma1 + Chi(E, F, G) + SHA512_K[i] + SHA512_W[i]\n            // prettier-ignore\n            const T1ll = u64.add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);\n            const T1h = u64.add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);\n            const T1l = T1ll | 0;\n            // S0 := (a rightrotate 28) xor (a rightrotate 34) xor (a rightrotate 39)\n            const sigma0h = u64.rotrSH(Ah, Al, 28) ^ u64.rotrBH(Ah, Al, 34) ^ u64.rotrBH(Ah, Al, 39);\n            const sigma0l = u64.rotrSL(Ah, Al, 28) ^ u64.rotrBL(Ah, Al, 34) ^ u64.rotrBL(Ah, Al, 39);\n            const MAJh = (Ah & Bh) ^ (Ah & Ch) ^ (Bh & Ch);\n            const MAJl = (Al & Bl) ^ (Al & Cl) ^ (Bl & Cl);\n            Hh = Gh | 0;\n            Hl = Gl | 0;\n            Gh = Fh | 0;\n            Gl = Fl | 0;\n            Fh = Eh | 0;\n            Fl = El | 0;\n            ({ h: Eh, l: El } = u64.add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));\n            Dh = Ch | 0;\n            Dl = Cl | 0;\n            Ch = Bh | 0;\n            Cl = Bl | 0;\n            Bh = Ah | 0;\n            Bl = Al | 0;\n            const All = u64.add3L(T1l, sigma0l, MAJl);\n            Ah = u64.add3H(All, T1h, sigma0h, MAJh);\n            Al = All | 0;\n        }\n        // Add the compressed chunk to the current hash value\n        ({ h: Ah, l: Al } = u64.add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));\n        ({ h: Bh, l: Bl } = u64.add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));\n        ({ h: Ch, l: Cl } = u64.add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));\n        ({ h: Dh, l: Dl } = u64.add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));\n        ({ h: Eh, l: El } = u64.add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));\n        ({ h: Fh, l: Fl } = u64.add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));\n        ({ h: Gh, l: Gl } = u64.add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));\n        ({ h: Hh, l: Hl } = u64.add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));\n        this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);\n    }\n    roundClean() {\n        clean(SHA512_W_H, SHA512_W_L);\n    }\n    destroy() {\n        // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves\n        // update()/digest() callable on reused instances.\n        this.destroyed = true;\n        clean(this.buffer);\n        this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);\n    }\n}\n/** Internal SHA-512 hash class grounded in RFC 6234 §6.3 and §6.4. */\nexport class _SHA512 extends SHA2_64B {\n    constructor() {\n        super(64, SHA512_IV);\n    }\n}\n/** Internal SHA-384 hash class grounded in RFC 6234 §6.3 and §6.4. */\nexport class _SHA384 extends SHA2_64B {\n    constructor() {\n        super(48, SHA384_IV);\n    }\n}\n/**\n * Truncated SHA512/256 and SHA512/224.\n * SHA512_IV is XORed with 0xa5a5a5a5a5a5a5a5, then used as \"intermediary\" IV of SHA512/t.\n * Then t hashes string to produce result IV.\n * See the repo-side derivation recipe in `test/misc/sha2-gen-iv.js`.\n * These IV literals are checked against that script rather than a dedicated\n * local RFC section.\n */\n/** SHA-512/224 IV derived by the SHA-512/t recipe in `test/misc/sha2-gen-iv.js` and\n * stored as sixteen big-endian 32-bit halves. */\nconst T224_IV = /* @__PURE__ */ Uint32Array.from([\n    0x8c3d37c8, 0x19544da2, 0x73e19966, 0x89dcd4d6, 0x1dfab7ae, 0x32ff9c82, 0x679dd514, 0x582f9fcf,\n    0x0f6d2b69, 0x7bd44da8, 0x77e36f73, 0x04c48942, 0x3f9d85a8, 0x6a1d36c8, 0x1112e6ad, 0x91d692a1,\n]);\n/** SHA-512/256 IV derived by the SHA-512/t recipe in `test/misc/sha2-gen-iv.js` and\n * stored as sixteen big-endian 32-bit halves. */\nconst T256_IV = /* @__PURE__ */ Uint32Array.from([\n    0x22312194, 0xfc2bf72c, 0x9f555fa3, 0xc84c64c2, 0x2393b86b, 0x6f53b151, 0x96387719, 0x5940eabd,\n    0x96283ee2, 0xa88effe3, 0xbe5e1e25, 0x53863992, 0x2b0199fc, 0x2c85b8aa, 0x0eb72ddc, 0x81c52ca2,\n]);\n/** Internal SHA-512/224 hash class using the derived `T224_IV` and the shared\n * RFC 6234 §6.4 compression engine. */\nexport class _SHA512_224 extends SHA2_64B {\n    constructor() {\n        super(28, T224_IV);\n    }\n}\n/** Internal SHA-512/256 hash class using the derived `T256_IV` and the shared\n * RFC 6234 §6.4 compression engine. */\nexport class _SHA512_256 extends SHA2_64B {\n    constructor() {\n        super(32, T256_IV);\n    }\n}\n/**\n * SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info:\n *\n * - Trying 2^128 hashes would get 50% chance of collision, using birthday attack.\n * - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.\n * - Each sha256 hash is executing 2^18 bit operations.\n * - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-256.\n * ```ts\n * sha256(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), \n/* @__PURE__ */ oidNist(0x01));\n/**\n * SHA2-224 hash function from RFC 4634.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-224.\n * ```ts\n * sha224(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha224 = /* @__PURE__ */ createHasher(() => new _SHA224(), \n/* @__PURE__ */ oidNist(0x04));\n/**\n * SHA2-512 hash function from RFC 4634.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-512.\n * ```ts\n * sha512(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha512 = /* @__PURE__ */ createHasher(() => new _SHA512(), \n/* @__PURE__ */ oidNist(0x03));\n/**\n * SHA2-384 hash function from RFC 4634.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-384.\n * ```ts\n * sha384(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha384 = /* @__PURE__ */ createHasher(() => new _SHA384(), \n/* @__PURE__ */ oidNist(0x02));\n/**\n * SHA2-512/256 \"truncated\" hash function, with improved resistance to length extension attacks.\n * See the paper on {@link https://eprint.iacr.org/2010/548.pdf | truncated SHA512}.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-512/256.\n * ```ts\n * sha512_256(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha512_256 = /* @__PURE__ */ createHasher(() => new _SHA512_256(), \n/* @__PURE__ */ oidNist(0x06));\n/**\n * SHA2-512/224 \"truncated\" hash function, with improved resistance to length extension attacks.\n * See the paper on {@link https://eprint.iacr.org/2010/548.pdf | truncated SHA512}.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-512/224.\n * ```ts\n * sha512_224(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha512_224 = /* @__PURE__ */ createHasher(() => new _SHA512_224(), \n/* @__PURE__ */ oidNist(0x05));\n","/**\n * Hex, bytes and number utilities.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { abytes as abytes_, anumber as anumber_, bytesToHex as bytesToHex_, concatBytes as concatBytes_, hexToBytes as hexToBytes_, isBytes as isBytes_, randomBytes as randomBytes_, } from '@noble/hashes/utils.js';\n/**\n * Validates that a value is an array, optionally validating each element.\n * @param item - Value to validate.\n * @param title - Label included in thrown errors.\n * @param inner - Optional per-element validator, called with the element and its label.\n * @returns The validated array.\n * @example\n * Validate an array of points before batch processing.\n *\n * ```ts\n * aarray([1n, 2n], 'scalars');\n * ```\n */\nexport function aarray(item, title, inner = () => { }) {\n    if (!Array.isArray(item))\n        throw new TypeError(`\"${title}\" expected array, got type=${typeof item}`);\n    for (let i = 0; i < item.length; i++)\n        inner(item[i], `${title}[${i}]`);\n    return item;\n}\n/**\n * Validates that a value is a byte array.\n * @param value - Value to validate.\n * @param length - Optional exact byte length.\n * @param title - Optional field name.\n * @returns Original byte array.\n * @example\n * Reject non-byte input before passing data into curve code.\n *\n * ```ts\n * abytes(new Uint8Array(1));\n * ```\n */\nexport const abytes = (value, length, title) => abytes_(value, length, title);\n/**\n * Validates that a value is a non-negative safe integer.\n * @param n - Value to validate.\n * @param title - Optional field name.\n * @returns The validated number.\n * @example\n * Validate a numeric length before allocating buffers.\n *\n * ```ts\n * anumber(1);\n * ```\n */\nexport const anumber = anumber_;\n/**\n * Asserts something is a string.\n * @param value - Value to validate.\n * @param title - Label included in thrown errors.\n * @returns The validated string.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Validate a label string.\n *\n * ```ts\n * astring('example', 'label');\n * ```\n */\nexport function astring(value, title = '') {\n    if (typeof value !== 'string') {\n        const prefix = title && `\"${title}\" `;\n        throw new TypeError(prefix + 'expected string, got type=' + typeof value);\n    }\n    return value;\n}\n/**\n * Asserts something is a plain object-ish value, not null or array.\n * @param value - Value to validate.\n * @param title - Label included in thrown errors.\n * @returns The validated object.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Validate an options object before checking fields.\n *\n * ```ts\n * aobject({ flag: true });\n * ```\n */\nexport function aobject(value, title = 'object') {\n    if (value === null || typeof value !== 'object' || Array.isArray(value))\n        throw new TypeError(title === 'object'\n            ? 'expected valid options object'\n            : `\"${title}\" expected object, got type=${typeof value}`);\n    return value;\n}\n/**\n * Asserts something is a function.\n * @param value - Value to validate.\n * @param title - Label included in thrown errors.\n * @returns The validated function.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Validate a required method before calling it.\n *\n * ```ts\n * afunction(() => true, 'predicate');\n * ```\n */\nexport function afunction(value, title) {\n    if (typeof value !== 'function')\n        throw new TypeError(`\"${title}\" is invalid: expected function, got ${typeof value}`);\n    return value;\n}\n/**\n * Encodes bytes as lowercase hex.\n * @param bytes - Bytes to encode.\n * @returns Lowercase hex string.\n * @example\n * Serialize bytes as hex for logging or fixtures.\n *\n * ```ts\n * bytesToHex(Uint8Array.of(1, 2, 3));\n * ```\n */\nexport const bytesToHex = bytesToHex_;\n/**\n * Concatenates byte arrays.\n * @param arrays - Byte arrays to join.\n * @returns Concatenated bytes.\n * @example\n * Join domain-separated chunks into one buffer.\n *\n * ```ts\n * concatBytes(Uint8Array.of(1), Uint8Array.of(2));\n * ```\n */\nexport const concatBytes = (...arrays) => concatBytes_(...arrays);\n/**\n * Decodes lowercase or uppercase hex into bytes.\n * @param hex - Hex string to decode.\n * @returns Decoded bytes.\n * @example\n * Parse fixture hex into bytes before hashing.\n *\n * ```ts\n * hexToBytes('0102');\n * ```\n */\nexport const hexToBytes = (hex) => hexToBytes_(hex);\n/**\n * Checks whether a value is a Uint8Array.\n * @param a - Value to inspect.\n * @returns `true` when `a` is a Uint8Array.\n * @example\n * Branch on byte input before decoding it.\n *\n * ```ts\n * isBytes(new Uint8Array(1));\n * ```\n */\nexport const isBytes = isBytes_;\n/**\n * Reads random bytes from the platform CSPRNG.\n * @param bytesLength - Number of random bytes to read.\n * @returns Fresh random bytes.\n * @example\n * Generate a random seed for a keypair.\n *\n * ```ts\n * randomBytes(2);\n * ```\n */\nexport const randomBytes = (bytesLength) => randomBytes_(bytesLength);\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\n// Shared error-message prefix builder. Only called on throw paths, so assert\n// success paths never pay for the string concatenation.\nconst atitle = (title) => (title ? `\"${title}\" ` : '');\n/**\n * Validates that a flag is boolean.\n * @param value - Value to validate.\n * @param title - Optional field name.\n * @returns Original value.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Reject non-boolean option flags early.\n *\n * ```ts\n * abool(true);\n * ```\n */\nexport function abool(value, title = '') {\n    if (typeof value !== 'boolean')\n        throw new TypeError(atitle(title) + 'expected boolean, got type=' + typeof value);\n    return value;\n}\n/**\n * Validates that a value is a non-negative bigint or safe integer.\n * @param n - Value to validate.\n * @returns The same validated value.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validate one integer-like value before serializing it.\n *\n * ```ts\n * abignumber(1n);\n * ```\n */\nexport function abignumber(n) {\n    if (typeof n === 'bigint') {\n        if (!isPosBig(n))\n            throw new RangeError('positive bigint expected, got ' + n);\n    }\n    else\n        anumber(n);\n    return n;\n}\n/**\n * Validates that a value is a safe integer.\n * @param value - Integer to validate.\n * @param title - Optional field name.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validate a window size before scalar arithmetic uses it.\n *\n * ```ts\n * asafenumber(1);\n * ```\n */\nexport function asafenumber(value, title = '') {\n    if (typeof value !== 'number') {\n        const prefix = title && `\"${title}\" `;\n        throw new TypeError(prefix + 'expected number, got type=' + typeof value);\n    }\n    if (!Number.isSafeInteger(value)) {\n        const prefix = title && `\"${title}\" `;\n        throw new RangeError(prefix + 'expected safe integer, got ' + value);\n    }\n}\n/**\n * Encodes a bigint into even-length big-endian hex.\n * The historical \"unpadded\" name only means \"no fixed-width field padding\"; odd-length hex still\n * gets one leading zero nibble so the result always represents whole bytes.\n * @param num - Number to encode.\n * @returns Big-endian hex string.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Encode a scalar into hex without a `0x` prefix.\n *\n * ```ts\n * numberToHexUnpadded(255n);\n * ```\n */\nexport function numberToHexUnpadded(num) {\n    const hex = abignumber(num).toString(16);\n    return hex.length & 1 ? '0' + hex : hex;\n}\n/**\n * Parses a big-endian hex string into bigint.\n * Accepts odd-length hex through the native `BigInt('0x' + hex)` parser and currently surfaces the\n * same native `SyntaxError` for malformed hex instead of wrapping it in a library-specific error.\n * @param hex - Hex string without `0x`.\n * @returns Parsed bigint value.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Parse a scalar from fixture hex.\n *\n * ```ts\n * hexToNumber('ff');\n * ```\n */\nexport function hexToNumber(hex) {\n    if (typeof hex !== 'string')\n        throw new TypeError('hex string expected, got ' + typeof hex);\n    return hex === '' ? _0n : BigInt('0x' + hex); // Big Endian\n}\n// BE: Big Endian, LE: Little Endian\n/**\n * Parses big-endian bytes into bigint.\n * @param bytes - Bytes in big-endian order.\n * @returns Parsed bigint value.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Read a scalar encoded in network byte order.\n *\n * ```ts\n * bytesToNumberBE(Uint8Array.of(1, 0));\n * ```\n */\nexport function bytesToNumberBE(bytes) {\n    return hexToNumber(bytesToHex_(bytes));\n}\n/**\n * Parses little-endian bytes into bigint.\n * @param bytes - Bytes in little-endian order.\n * @returns Parsed bigint value.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Read a scalar encoded in little-endian form.\n *\n * ```ts\n * bytesToNumberLE(Uint8Array.of(1, 0));\n * ```\n */\nexport function bytesToNumberLE(bytes) {\n    return hexToNumber(bytesToHex_(copyBytes(abytes_(bytes)).reverse()));\n}\n/**\n * Encodes a bigint into fixed-length big-endian bytes.\n * @param n - Number to encode.\n * @param len - Output length in bytes. Must be greater than zero.\n * @returns Big-endian byte array.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @throws If a documented runtime validation or state check fails. {@link Error}\n * @example\n * Serialize a scalar into a 32-byte field element.\n *\n * ```ts\n * numberToBytesBE(255n, 2);\n * ```\n */\nexport function numberToBytesBE(n, len) {\n    anumber_(len);\n    if (len === 0)\n        throw new Error('zero output length is invalid');\n    n = abignumber(n);\n    const expectedLen = len * 2;\n    const hex = n.toString(16);\n    // Detect overflow before hex parsing so oversized values don't leak the shared odd-hex error.\n    if (hex.length > expectedLen)\n        throw new RangeError('number is too large');\n    return hexToBytes_(hex.padStart(expectedLen, '0'));\n}\n/**\n * Encodes a bigint into fixed-length little-endian bytes.\n * @param n - Number to encode.\n * @param len - Output length in bytes.\n * @returns Little-endian byte array.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @throws If a documented runtime validation or state check fails. {@link Error}\n * @example\n * Serialize a scalar for little-endian protocols.\n *\n * ```ts\n * numberToBytesLE(255n, 2);\n * ```\n */\nexport function numberToBytesLE(n, len) {\n    return numberToBytesBE(n, len).reverse();\n}\n// Unpadded, rarely used\n/**\n * Encodes a bigint into variable-length big-endian bytes.\n * @param n - Number to encode.\n * @returns Variable-length big-endian bytes.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Serialize a bigint without fixed-width padding.\n *\n * ```ts\n * numberToVarBytesBE(255n);\n * ```\n */\nexport function numberToVarBytesBE(n) {\n    return hexToBytes_(numberToHexUnpadded(abignumber(n)));\n}\n// Compares 2 u8a-s in kinda constant time\n/**\n * Compares two byte arrays in constant-ish time.\n * @param a - Left byte array.\n * @param b - Right byte array.\n * @returns `true` when bytes match.\n * @example\n * Compare two encoded points without early exit.\n *\n * ```ts\n * equalBytes(Uint8Array.of(1), Uint8Array.of(1));\n * ```\n */\nexport function equalBytes(a, b) {\n    a = abytes(a);\n    b = abytes(b);\n    if (a.length !== b.length)\n        return false;\n    let diff = 0;\n    for (let i = 0; i < a.length; i++)\n        diff |= a[i] ^ b[i];\n    return diff === 0;\n}\n/**\n * Copies Uint8Array. We can't use u8a.slice(), because u8a can be Buffer,\n * and Buffer#slice creates mutable copy. Never use Buffers!\n * @param bytes - Bytes to copy.\n * @returns Detached copy.\n * @example\n * Make an isolated copy before mutating serialized bytes.\n *\n * ```ts\n * copyBytes(Uint8Array.of(1, 2, 3));\n * ```\n */\nexport function copyBytes(bytes) {\n    // `Uint8Array.from(...)` would also accept arrays / other typed arrays. Keep this helper strict\n    // because callers use it at byte-validation boundaries before mutating the detached copy.\n    return Uint8Array.from(abytes(bytes));\n}\n/**\n * Decodes 7-bit ASCII string to Uint8Array, throws on non-ascii symbols\n * Should be safe to use for things expected to be ASCII.\n * Returns exact same result as `TextEncoder` for ASCII or throws.\n * @param ascii - ASCII input text.\n * @returns Encoded bytes.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Encode an ASCII domain-separation tag.\n *\n * ```ts\n * asciiToBytes('ABC');\n * ```\n */\nexport function asciiToBytes(ascii) {\n    if (typeof ascii !== 'string')\n        throw new TypeError('ascii string expected, got ' + typeof ascii);\n    return Uint8Array.from(ascii, (c, i) => {\n        const charCode = c.charCodeAt(0);\n        if (c.length !== 1 || charCode > 127) {\n            throw new RangeError(`string contains non-ASCII character \"${ascii[i]}\" with code ${charCode} at position ${i}`);\n        }\n        return charCode;\n    });\n}\n/**\n * Checks whether n is non-negative bigint. Historical name.\n * @param n - candidate value\n * @returns `true` when the value is bigint and 0 or larger\n * @example\n * Check a candidate scalar before range validation.\n *\n * ```ts\n * isPosBig(2n);\n * ```\n */\nexport function isPosBig(n) {\n    return typeof n === 'bigint' && _0n <= n;\n}\n/**\n * Checks whether a bigint lies inside a half-open range.\n * @param n - Candidate value.\n * @param min - Inclusive lower bound.\n * @param max - Exclusive upper bound.\n * @returns `true` when the value is inside the range.\n * @example\n * Check whether a candidate scalar fits the field order.\n *\n * ```ts\n * inRange(2n, 1n, 3n);\n * ```\n */\nexport function inRange(n, min, max) {\n    return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;\n}\n/**\n * Asserts `min <= n < max`. NOTE: upper bound is exclusive.\n * @param title - Value label for error messages.\n * @param n - Candidate value.\n * @param min - Inclusive lower bound.\n * @param max - Exclusive upper bound.\n * Wrong-type inputs are not separated from out-of-range values here: they still flow through the\n * shared `RangeError` path because this is only a throwing wrapper around `inRange(...)`.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Assert that a bigint stays within one half-open range.\n *\n * ```ts\n * aInRange('x', 2n, 1n, 256n);\n * ```\n */\nexport function aInRange(title, n, min, max) {\n    // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)?\n    // consider P=256n, min=0n, max=P\n    // - a for min=0 would require -1:          `inRange('x', x, -1n, P)`\n    // - b would commonly require subtraction:  `inRange('x', x, 0n, P - 1n)`\n    // - our way is the cleanest:               `inRange('x', x, 0n, P)\n    if (!inRange(n, min, max))\n        throw new RangeError('expected valid ' + title + ': ' + min + ' <= n < ' + max + ', got ' + n);\n}\n// Bit operations\n/**\n * Calculates amount of bits in a bigint.\n * Same as `n.toString(2).length`\n * TODO: merge with nLength in modular\n * @param n - Value to inspect.\n * @returns Bit length.\n * @throws If the value is negative. {@link Error}\n * @example\n * Measure the bit length of a scalar before serialization.\n *\n * ```ts\n * bitLen(8n);\n * ```\n */\nexport function bitLen(n) {\n    // Size callers in this repo only use non-negative orders / scalars, so negative inputs are a\n    // contract bug and must not silently collapse to zero bits.\n    if (n < _0n)\n        throw new Error('expected non-negative bigint, got ' + n);\n    // Native radix conversion beats a shift loop at every size, and the loop is quadratic in bits.\n    return n === _0n ? 0 : n.toString(2).length;\n}\n/**\n * Gets single bit at position.\n * NOTE: first bit position is 0 (same as arrays)\n * Same as `!!+Array.from(n.toString(2)).reverse()[pos]`\n * @param n - Source value.\n * @param pos - Bit position. Negative positions are passed through to raw\n *   bigint shift semantics; because the mask is built as `1n << pos`,\n *   they currently collapse to `0n` and make the helper a no-op.\n * @returns Bit as bigint.\n * @example\n * Gets single bit at position.\n *\n * ```ts\n * bitGet(5n, 0);\n * ```\n */\nexport function bitGet(n, pos) {\n    if (typeof n !== 'bigint')\n        throw new TypeError('\"n\" expected bigint, got type=' + typeof n);\n    asafenumber(pos, 'pos');\n    return (n >> BigInt(pos)) & _1n;\n}\n/**\n * Sets single bit at position.\n * @param n - Source value.\n * @param pos - Bit position. Negative positions are passed through to raw bigint shift semantics,\n *   so they currently behave like left shifts.\n * @param value - Whether the bit should be set.\n * @returns Updated bigint.\n * @example\n * Sets single bit at position.\n *\n * ```ts\n * bitSet(0n, 1, true);\n * ```\n */\nexport function bitSet(n, pos, value) {\n    if (typeof n !== 'bigint')\n        throw new TypeError('\"n\" expected bigint, got type=' + typeof n);\n    asafenumber(pos, 'pos');\n    abool(value, 'value');\n    const mask = _1n << BigInt(pos);\n    // Clearing needs AND-not here; OR with zero leaves an already-set bit untouched.\n    return value ? n | mask : n & ~mask;\n}\n/**\n * Calculate mask for N bits. Not using ** operator with bigints because of old engines.\n * Same as BigInt(`0b${Array(i).fill('1').join('')}`)\n * @param n - Number of bits. Negative widths are currently passed through to raw bigint shift\n *   semantics and therefore produce `-1n`.\n * @returns Bitmask value.\n * @example\n * Calculate mask for N bits.\n *\n * ```ts\n * bitMask(4);\n * ```\n */\nexport const bitMask = (n) => {\n    asafenumber(n, 'n');\n    return (_1n << BigInt(n)) - _1n;\n};\n/**\n * Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n * @param hashLen - Hash output size in bytes. Callers are expected to pass a positive length; `0`\n *   is not rejected here and would make the internal generate loop non-progressing.\n * @param qByteLen - Requested output size in bytes. Callers are expected to pass a positive length.\n * @param hmacFn - HMAC implementation.\n * @returns Function that will call DRBG until the predicate returns anything\n *   other than `undefined`.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Build a deterministic nonce generator for RFC6979-style signing.\n *\n * ```ts\n * import { createHmacDrbg } from '@noble/curves/utils.js';\n * import { hmac } from '@noble/hashes/hmac.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const hmacFn = (key: Uint8Array, msg: Uint8Array) => hmac(sha256, key, msg);\n * const drbg = createHmacDrbg(32, 32, hmacFn);\n * const seed = new Uint8Array(32);\n * drbg(seed, (bytes) => bytes);\n * ```\n */\nexport function createHmacDrbg(hashLen, qByteLen, hmacFn) {\n    anumber_(hashLen, 'hashLen');\n    anumber_(qByteLen, 'qByteLen');\n    if (typeof hmacFn !== 'function')\n        throw new TypeError('hmacFn must be a function');\n    // creates Uint8Array\n    const u8n = (len) => new Uint8Array(len);\n    const NULL = Uint8Array.of();\n    const byte0 = Uint8Array.of(0x00);\n    const byte1 = Uint8Array.of(0x01);\n    const _maxDrbgIters = 1000;\n    // Step B, Step C: set hashLen to 8*ceil(hlen/8).\n    // Minimal non-full-spec HMAC-DRBG from NIST 800-90 for RFC6979 signatures.\n    let v = u8n(hashLen);\n    // Steps B and C of RFC6979 3.2.\n    let k = u8n(hashLen);\n    let i = 0; // Iterations counter, will throw when over 1000\n    const reset = () => {\n        v.fill(1);\n        k.fill(0);\n        i = 0;\n    };\n    // hmac(k)(v, ...values)\n    const h = (...msgs) => hmacFn(k, concatBytes(v, ...msgs));\n    const reseed = (seed = NULL) => {\n        // HMAC-DRBG reseed() function. Steps D-G\n        k = h(byte0, seed); // k = hmac(k || v || 0x00 || seed)\n        v = h(); // v = hmac(k || v)\n        if (seed.length === 0)\n            return;\n        k = h(byte1, seed); // k = hmac(k || v || 0x01 || seed)\n        v = h(); // v = hmac(k || v)\n    };\n    const gen = () => {\n        // HMAC-DRBG generate() function\n        if (i++ >= _maxDrbgIters)\n            throw new Error('drbg: tried max amount of iterations');\n        let len = 0;\n        const out = [];\n        while (len < qByteLen) {\n            v = h();\n            const sl = v.slice();\n            out.push(sl);\n            len += v.length;\n        }\n        return concatBytes(...out);\n    };\n    const genUntil = (seed, pred) => {\n        reset();\n        reseed(seed); // Steps D-G\n        let res = undefined; // Step H: grind until the predicate accepts a candidate.\n        // Falsy values like 0 are valid outputs.\n        while ((res = pred(gen())) === undefined)\n            reseed();\n        reset();\n        return res;\n    };\n    return genUntil;\n}\n/**\n * Validates declared required and optional field types on a plain object.\n * Extra keys are intentionally ignored because many callers validate only the subset they use from\n * richer option bags or runtime objects.\n * This walks field schemas and formats detailed errors, so avoid it on hot paths; use direct\n * one-line guards such as `aobject()`, `afunction()`, `abool()`, or `asafenumber()` instead.\n * @param object - Object to validate.\n * @param fields - Required field types.\n * @param optFields - Optional field types.\n * @param title - Object label included in thrown errors.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Check user options before building a curve helper.\n *\n * ```ts\n * validateObject({ flag: true }, { flag: 'boolean' });\n * ```\n */\nexport function validateObject(object, fields = {}, optFields = {}, title = 'object') {\n    aobject(object, title);\n    aobject(fields, 'fields');\n    aobject(optFields, 'optFields');\n    function checkField(fieldName, expectedType, isOpt) {\n        const label = title === 'object' ? `param \"${String(fieldName)}\"` : `\"${title}.${String(fieldName)}\"`;\n        // Config fields must be explicit own properties. Optional inherited values are rejected too\n        // because callers keep reading the same options object after validation.\n        const val = object[fieldName];\n        // Runtime objects such as Field instances intentionally satisfy required method slots\n        // via their shared prototype.\n        if (!Object.hasOwn(object, fieldName) &&\n            (isOpt ? val !== undefined : expectedType !== 'function')) {\n            throw new TypeError(`${label} is invalid: expected own property`);\n        }\n        if (isOpt && val === undefined)\n            return;\n        const current = typeof val;\n        if (current !== expectedType || val === null)\n            throw new TypeError(`${label} is invalid: expected ${expectedType}, got ${current}`);\n    }\n    const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));\n    iter(fields, false);\n    iter(optFields, true);\n}\n/**\n * Throws not implemented error.\n * @returns Never returns.\n * @throws If the unfinished code path is reached. {@link Error}\n * @example\n * Surface the placeholder error from an unfinished code path.\n *\n * ```ts\n * try {\n *   notImplemented();\n * } catch {}\n * ```\n */\nexport const notImplemented = () => {\n    throw new Error('not implemented');\n};\n","/**\n * Utils for modular division and fields.\n * Field over 11 is a finite (Galois) field is integer number operations `mod 11`.\n * There is no division: it is replaced by modular multiplicative inverse.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { aarray, abool, abytes, afunction, anumber, aobject, asafenumber, bitLen, bytesToNumberBE, bytesToNumberLE, numberToBytesBE, numberToBytesLE, } from \"../utils.js\";\n// Numbers aren't used in x25519 / x448 builds\n// prettier-ignore\nconst _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2);\n// prettier-ignore\nconst _3n = /* @__PURE__ */ BigInt(3), _4n = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5);\n// prettier-ignore\nconst _7n = /* @__PURE__ */ BigInt(7), _8n = /* @__PURE__ */ BigInt(8), _9n = /* @__PURE__ */ BigInt(9);\nconst _15n = /* @__PURE__ */ BigInt(15), _16n = /* @__PURE__ */ BigInt(16);\n// 2^64: exponents below this use plain square-and-multiply in pow()/FpPow(); the windowed path's\n// table build (14 multiplications) only pays off for longer exponents (break-even ~50 bits).\nconst POW_WINDOWED_MIN = /* @__PURE__ */ BigInt('0x10000000000000000');\n/**\n * @param a - Dividend value.\n * @param b - Positive modulus.\n * @returns Reduced value in `[0, b)` only when `b` is positive.\n * @throws If the modulus is not positive. {@link Error}\n * @example\n * Normalize a bigint into one field residue.\n *\n * ```ts\n * mod(-1n, 5n);\n * ```\n */\nexport function mod(a, b) {\n    if (b <= _0n)\n        throw new Error('mod: expected positive modulus, got ' + b);\n    const result = a % b;\n    return result >= _0n ? result : b + result;\n}\n/**\n * Efficiently raise num to a power with modular reduction.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * Low-level helper: callers that need canonical residues must pass a valid `num` for the chosen\n * modulus instead of relying on the `power===0/1` fast paths to normalize it.\n * @param num - Base value.\n * @param power - Exponent value.\n * @param modulo - Reduction modulus.\n * @returns Modular exponentiation result.\n * @throws If the modulus or exponent is invalid. {@link Error}\n * @example\n * Raise one bigint to a modular power.\n *\n * ```ts\n * pow(2n, 6n, 11n) // 64n % 11n == 9n\n * ```\n */\nexport function pow(num, power, modulo) {\n    if (modulo <= _1n)\n        throw new Error('pow: expected modulus > 1, got ' + modulo);\n    // Non-bigint exponents coerce every comparison below to false and would silently return 1.\n    if (typeof power !== 'bigint')\n        throw new TypeError('invalid exponent: expected bigint, got ' + typeof power);\n    if (power < _0n)\n        throw new Error('invalid exponent, negatives unsupported');\n    if (power === _0n)\n        return _1n;\n    if (power === _1n)\n        return num;\n    let d = num % modulo;\n    if (d < _0n)\n        d += modulo;\n    // Control flow in both branches below depends only on the exponent, never on `num` — invertCt()\n    // relies on that for its (public-exponent) secret-independence guarantee.\n    if (power < POW_WINDOWED_MIN) {\n        // Square-and-multiply: cheaper than the windowed path for short exponents.\n        let p = _1n;\n        while (power > _0n) {\n            if (power & _1n)\n                p = (p * d) % modulo;\n            d = (d * d) % modulo;\n            power >>= _1n;\n        }\n        return p;\n    }\n    // Fixed 4-bit windows, MSB-first: a 14-multiplication table drops per-window cost to <1\n    // multiplication (vs ~2 per window for square-and-multiply), ~25-30% faster for the dense\n    // 256-bit exponents of sqrt / Legendre / invertCt.\n    const digits = [];\n    while (power > _0n) {\n        digits.push(Number(power & _15n));\n        power >>= _4n;\n    }\n    const table = new Array(16);\n    table[0] = _1n;\n    table[1] = d;\n    for (let i = 2; i < 16; i++)\n        table[i] = (table[i - 1] * d) % modulo;\n    let p = table[digits[digits.length - 1]]; // top digit is nonzero: the loop above stops on 0\n    for (let w = digits.length - 2; w >= 0; w--) {\n        p = (p * p) % modulo;\n        p = (p * p) % modulo;\n        p = (p * p) % modulo;\n        p = (p * p) % modulo;\n        const digit = digits[w];\n        if (digit !== 0)\n            p = (p * table[digit]) % modulo;\n    }\n    return p;\n}\n/**\n * Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)`.\n * Low-level helper: callers that need canonical residues must pass a valid `x` for the chosen\n * modulus; the `power===0` fast path intentionally returns the input unchanged.\n * @param x - Base value.\n * @param power - Number of squarings.\n * @param modulo - Reduction modulus.\n * @returns Repeated-squaring result.\n * @throws If the exponent is negative. {@link Error}\n * @example\n * Apply repeated squaring inside one field.\n *\n * ```ts\n * pow2(3n, 2n, 11n);\n * ```\n */\nexport function pow2(x, power, modulo) {\n    if (modulo <= _1n)\n        throw new Error('pow2: expected modulus > 1, got ' + modulo);\n    if (power < _0n)\n        throw new Error('pow2: expected non-negative exponent, got ' + power);\n    let res = x;\n    while (power-- > _0n) {\n        res *= res;\n        res %= modulo;\n    }\n    return res;\n}\n/**\n * Inverses number over modulo.\n * Implemented using the {@link https://brilliant.org/wiki/extended-euclidean-algorithm/ | extended Euclidean algorithm}.\n * @param number - Value to invert.\n * @param modulo - Modulus greater than 1.\n * @returns Multiplicative inverse.\n * @throws If the modulus is invalid or the inverse does not exist. {@link Error}\n * @example\n * Compute one modular inverse with the extended Euclidean algorithm.\n *\n * ```ts\n * invert(3n, 11n);\n * ```\n */\nexport function invert(number, modulo) {\n    if (number === _0n)\n        throw new Error('invert: expected non-zero number');\n    // modulo = 1 is the zero ring: gcd(x, 1) = 1 makes the loop below \"succeed\" and return the\n    // useless inverse 0. Reject it like pow() and invertCt() do.\n    if (modulo <= _1n)\n        throw new Error('invert: expected modulus > 1, got ' + modulo);\n    // This is variable-time: the loop count depends on `number`. For a secret-independent\n    // (Fermat) alternative over a prime modulus, see {@link invertCt} (~4x slower).\n    let a = mod(number, modulo);\n    let b = modulo;\n    // Only the Bézout coefficient of `number` (x/u chain) is tracked; the coefficient of `modulo`\n    // never affects the output, so it is not computed.\n    // prettier-ignore\n    let x = _0n, u = _1n;\n    while (a !== _0n) {\n        const q = b / a;\n        const r = b - a * q;\n        const m = x - u * q;\n        // prettier-ignore\n        b = a, a = r, x = u, u = m;\n    }\n    const gcd = b;\n    if (gcd !== _1n)\n        throw new Error('invert: does not exist');\n    return mod(x, modulo);\n}\n/**\n * Inverses number over modulo using Fermat's little theorem: `a^(p-2) ≡ a⁻¹ (mod p)`.\n *\n * Unlike {@link invert} (extended Euclidean), the exponent `p-2` is a public constant, so the\n * underlying square-and-multiply has the same control flow for every secret `a`: there is no\n * data-dependent branching or loop count that could leak `a` through timing (e.g. Minerva-style\n * ECDSA nonce-inversion attacks). This is only \"algorithmically\" constant-time — JS bigint\n * multiplication/reduction is still value-dependent — and it is roughly 4x slower than\n * {@link invert}.\n *\n * REQUIRES a prime modulus; Fermat's theorem does not hold otherwise. The result is verified to be\n * a real inverse, so a non-prime modulus (or a non-invertible input) fails closed with an error\n * instead of returning a wrong value.\n * @param a - Value to invert.\n * @param prime - Prime modulus.\n * @returns Multiplicative inverse in `[1, prime)`.\n * @throws If the modulus is below 2, the input reduces to zero, or the inverse does not exist.\n *   {@link Error}\n * @example\n * Compute one modular inverse without secret-dependent branching.\n *\n * ```ts\n * invertCt(3n, 11n); // 4n, since 3 * 4 = 12 ≡ 1 (mod 11)\n * ```\n */\nexport function invertCt(a, prime) {\n    if (prime <= _1n)\n        throw new Error('invertCt: expected prime modulus > 1, got ' + prime);\n    const an = mod(a, prime);\n    if (an === _0n)\n        throw new Error('invertCt: expected non-zero number');\n    // Exponent (prime - 2) is public, so FpPow's square-and-multiply is secret-independent.\n    const inverse = pow(an, prime - _2n, prime);\n    // O(1) safety net: verifies the inverse and rejects composite moduli where a^(p-2) is not one.\n    if (mod(an * inverse, prime) !== _1n)\n        throw new Error('invertCt: does not exist');\n    return inverse;\n}\nfunction assertIsSquare(Fp, root, n) {\n    const F = Fp;\n    if (!F.eql(F.sqr(root), n))\n        throw new Error('Cannot find square root');\n}\n// The Legendre symbol and every sqrt variant here are only defined over an odd (prime) modulus.\n// An even ORDER makes their integer divisions — (p-1)/2, (p+1)/4, (p-5)/8, (p+7)/16 — truncate and\n// silently return a wrong result, so reject it explicitly at the entry points instead. This is a\n// cheap necessary-condition check, not a primality test (composite odd moduli are caught later by\n// the Legendre-result / assertIsSquare checks).\nfunction aoddModulus(order, fnName) {\n    if ((order & _1n) === _0n)\n        throw new Error(fnName + ': expected odd modulus, got ' + order);\n}\n// Not all roots are possible! Example which will throw:\n// const NUM =\n// n = 72057594037927816n;\n// Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'));\nfunction sqrt3mod4(Fp, n) {\n    const F = Fp;\n    const p1div4 = (F.ORDER + _1n) / _4n;\n    const root = F.pow(n, p1div4);\n    assertIsSquare(F, root, n);\n    return root;\n}\n// Equivalent `q = 5 (mod 8)` square-root formula (Atkin-style), not the RFC Appendix I.2 CMOV\n// pseudocode verbatim.\nfunction sqrt5mod8(Fp, n) {\n    const F = Fp;\n    const p5div8 = (F.ORDER - _5n) / _8n;\n    const n2 = F.mul(n, _2n);\n    const v = F.pow(n2, p5div8);\n    const nv = F.mul(n, v);\n    const i = F.mul(F.mul(nv, _2n), v);\n    const root = F.mul(nv, F.sub(i, F.ONE));\n    assertIsSquare(F, root, n);\n    return root;\n}\n// Based on RFC9380, Kong algorithm\n// prettier-ignore\nfunction sqrt9mod16(P) {\n    const Fp_ = Field(P);\n    const tn = tonelliShanks(P);\n    const c1 = tn(Fp_, Fp_.neg(Fp_.ONE)); //  1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F\n    const c2 = tn(Fp_, c1); //  2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F\n    const c3 = tn(Fp_, Fp_.neg(c1)); //  3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F\n    const c4 = (P + _7n) / _16n; //  4. c4 = (q + 7) / 16        # Integer arithmetic\n    return ((Fp, n) => {\n        const F = Fp;\n        let tv1 = F.pow(n, c4); //  1. tv1 = x^c4\n        let tv2 = F.mul(tv1, c1); //  2. tv2 = c1 * tv1\n        const tv3 = F.mul(tv1, c2); //  3. tv3 = c2 * tv1\n        const tv4 = F.mul(tv1, c3); //  4. tv4 = c3 * tv1\n        const e1 = F.eql(F.sqr(tv2), n); //  5.  e1 = (tv2^2) == x\n        const e2 = F.eql(F.sqr(tv3), n); //  6.  e2 = (tv3^2) == x\n        tv1 = F.cmov(tv1, tv2, e1); //  7. tv1 = CMOV(tv1, tv2, e1)  # Select tv2 if (tv2^2) == x\n        tv2 = F.cmov(tv4, tv3, e2); //  8. tv2 = CMOV(tv4, tv3, e2)  # Select tv3 if (tv3^2) == x\n        const e3 = F.eql(F.sqr(tv2), n); //  9.  e3 = (tv2^2) == x\n        const root = F.cmov(tv1, tv2, e3); // 10.  z = CMOV(tv1, tv2, e3)   # Select sqrt from tv1 & tv2\n        assertIsSquare(F, root, n);\n        return root;\n    });\n}\n/**\n * Tonelli-Shanks square root search algorithm.\n * This implementation is variable-time: it searches data-dependently for the first non-residue `Z`\n * and for the smallest `i` in the main loop, unlike RFC 9380 Appendix I.4's constant-time shape.\n * 1. {@link https://eprint.iacr.org/2012/685.pdf | eprint 2012/685}, page 12\n * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks\n * @param P - field order\n * @returns function that takes field Fp (created from P) and number n\n * @throws If the field is too small, non-prime, or the square root does not exist. {@link Error}\n * @example\n * Construct a square-root helper for primes that need Tonelli-Shanks.\n *\n * ```ts\n * import { Field, tonelliShanks } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const sqrt = tonelliShanks(17n)(Fp, 4n);\n * ```\n */\nexport function tonelliShanks(P) {\n    // Initialization (precomputation).\n    // Caching initialization could boost perf by 7%.\n    if (P < _3n)\n        throw new Error('sqrt is not defined for small field');\n    aoddModulus(P, 'tonelliShanks');\n    // Factor P - 1 = Q * 2^S, where Q is odd\n    let Q = P - _1n;\n    let S = 0;\n    while (Q % _2n === _0n) {\n        Q /= _2n;\n        S++;\n    }\n    // Find the first quadratic non-residue Z >= 2\n    let Z = _2n;\n    const _Fp = Field(P);\n    while (FpLegendre(_Fp, Z) === 1) {\n        // Basic primality test for P. After x iterations, chance of\n        // not finding quadratic non-residue is 2^x, so 2^1000.\n        if (Z++ > 1000)\n            throw new Error('Cannot find square root: probably non-prime P');\n    }\n    // Fast-path; usually done before Z, but we do \"primality test\".\n    if (S === 1)\n        return sqrt3mod4;\n    // Slow-path\n    // TODO: test on Fp2 and others\n    let cc = _Fp.pow(Z, Q); // c = z^Q\n    const Q1div2 = (Q + _1n) / _2n;\n    return function tonelliSlow(Fp, n) {\n        const F = Fp;\n        if (F.is0(n))\n            return n;\n        // Check if n is a quadratic residue using Legendre symbol\n        if (FpLegendre(F, n) !== 1)\n            throw new Error('Cannot find square root');\n        // Initialize variables for the main loop\n        let M = S;\n        let c = F.mul(F.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp\n        let t = F.pow(n, Q); // t = n^Q, first guess at the fudge factor\n        let R = F.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root\n        // Main loop\n        // while t != 1\n        while (!F.eql(t, F.ONE)) {\n            // Unreachable over a genuine field (no zero divisors; n=0 already returned above). A zero t\n            // means composite ORDER, where a fabricated root would be wrong: fail closed instead.\n            if (F.is0(t))\n                throw new Error('Cannot find square root: probably non-prime P');\n            let i = 1;\n            // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P)\n            let t_tmp = F.sqr(t); // t^(2^1)\n            while (!F.eql(t_tmp, F.ONE)) {\n                i++;\n                t_tmp = F.sqr(t_tmp); // t^(2^2)...\n                if (i === M)\n                    throw new Error('Cannot find square root');\n            }\n            // Calculate the exponent for b: 2^(M - i - 1)\n            const exponent = _1n << BigInt(M - i - 1); // bigint is important\n            const b = F.pow(c, exponent); // b = 2^(M - i - 1)\n            // Update variables\n            M = i;\n            c = F.sqr(b); // c = b^2\n            t = F.mul(t, c); // t = (t * b^2)\n            R = F.mul(R, b); // R = R*b\n        }\n        return R;\n    };\n}\n/**\n * Square root for a finite field. Will try optimized versions first:\n *\n * 1. P ≡ 3 (mod 4)\n * 2. P ≡ 5 (mod 8)\n * 3. P ≡ 9 (mod 16)\n * 4. Tonelli-Shanks algorithm\n *\n * Different algorithms can give different roots, it is up to user to decide which one they want.\n * For example there is FpSqrtOdd/FpSqrtEven to choose a root by oddness\n * (used for hash-to-curve).\n * @param P - Field order.\n * @returns Square-root helper. The generic fallback inherits Tonelli-Shanks' variable-time\n *   behavior and this selector assumes prime-field-style integer moduli.\n * @throws If the field is unsupported or the square root does not exist. {@link Error}\n * @example\n * Choose the square-root helper appropriate for one field modulus.\n *\n * ```ts\n * import { Field, FpSqrt } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const sqrt = FpSqrt(17n)(Fp, 4n);\n * ```\n */\nexport function FpSqrt(P) {\n    aoddModulus(P, 'Fp.sqrt');\n    // P ≡ 3 (mod 4) => √n = n^((P+1)/4)\n    if (P % _4n === _3n)\n        return sqrt3mod4;\n    // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf\n    if (P % _8n === _5n)\n        return sqrt5mod8;\n    // P ≡ 9 (mod 16) => Kong algorithm, page 11 of https://eprint.iacr.org/2012/685.pdf (algorithm 4)\n    if (P % _16n === _9n)\n        return sqrt9mod16(P);\n    // Tonelli-Shanks algorithm\n    return tonelliShanks(P);\n}\n/**\n * @param num - Value to inspect.\n * @param modulo - Field modulus.\n * @returns `true` when the least-significant little-endian bit is set.\n * @throws If the modulus is invalid for `mod(...)`. {@link Error}\n * @example\n * Inspect the low bit used by little-endian sign conventions.\n *\n * ```ts\n * isNegativeLE(3n, 11n);\n * ```\n */\nexport const isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n) === _1n;\n// prettier-ignore\n// Arithmetic-only subset checked by validateField(). This is intentionally not the full runtime\n// IField contract: helpers like `isValidNot0`, `invertBatch`, `toBytes`, `fromBytes`, `cmov`, and\n// field-specific extras like `isOdd` are left to the callers that actually need them.\nconst FIELD_FIELDS = [\n    'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',\n    'eql', 'add', 'sub', 'mul', 'pow', 'div',\n    'addN', 'subN', 'mulN', 'sqrN'\n];\n/**\n * @param field - Field implementation.\n * @returns Validated field. This only checks the arithmetic subset needed by generic helpers; it\n *   does not guarantee full runtime-method coverage for serialization, batching, `cmov`, or\n *   field-specific extras beyond positive `BYTES` / `BITS`.\n * @throws If the field shape or numeric metadata are invalid. {@link Error}\n * @example\n * Check that a field implementation exposes the operations curve code expects.\n *\n * ```ts\n * import { Field, validateField } from '@noble/curves/abstract/modular.js';\n * const Fp = validateField(Field(17n));\n * ```\n */\nexport function validateField(field) {\n    aobject(field, 'field');\n    if (typeof field.ORDER !== 'bigint')\n        throw new TypeError('param \"ORDER\" is invalid: expected bigint, got ' + typeof field.ORDER);\n    // Runtime field implementations must expose real integer byte/bit sizes; fractional / NaN /\n    // infinite metadata breaks encoders and caches.\n    asafenumber(field.BYTES, 'BYTES');\n    asafenumber(field.BITS, 'BITS');\n    for (const name of FIELD_FIELDS)\n        afunction(field[name], 'field.' + name);\n    // Runtime field implementations must expose positive byte/bit sizes; zero leaks through the\n    // numeric shape checks above but still breaks encoding helpers and cached-length assumptions.\n    if (field.BYTES < 1 || field.BITS < 1)\n        throw new Error('invalid field: expected BYTES/BITS > 0');\n    if (field.ORDER <= _1n)\n        throw new Error('invalid field: expected ORDER > 1, got ' + field.ORDER);\n    return field;\n}\n// Generic field functions\n/**\n * Same as `pow` but for Fp: non-constant-time.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * @param Fp - Field implementation.\n * @param num - Base value.\n * @param power - Exponent value.\n * @returns Powered field element.\n * @throws If the exponent is negative. {@link Error}\n * @example\n * Raise one field element to a public exponent.\n *\n * ```ts\n * import { Field, FpPow } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const x = FpPow(Fp, 3n, 5n);\n * ```\n */\nexport function FpPow(Fp, num, power) {\n    validateField(Fp);\n    const F = Fp;\n    // Non-bigint exponents (e.g. an accidental field element) coerce every comparison below to\n    // false and would silently return ONE.\n    if (typeof power !== 'bigint')\n        throw new TypeError('invalid exponent: expected bigint, got ' + typeof power);\n    if (power < _0n)\n        throw new Error('invalid exponent, negatives unsupported');\n    if (power === _0n)\n        return F.ONE;\n    if (power === _1n)\n        return num;\n    if (power < POW_WINDOWED_MIN) {\n        // Square-and-multiply: cheaper than the windowed path for short exponents (e.g. poseidon\n        // sbox x^5), which would waste the 14-multiplication table build.\n        let p = F.ONE;\n        let d = num;\n        while (power > _0n) {\n            if (power & _1n)\n                p = F.mul(p, d);\n            d = F.sqr(d);\n            power >>= _1n;\n        }\n        return p;\n    }\n    // Fixed 4-bit windows, MSB-first — same shape as pow() above, over generic field ops.\n    // Speeds up dense long exponents (extension-field sqrt / Legendre, e.g. Fp2 decompression).\n    const digits = [];\n    while (power > _0n) {\n        digits.push(Number(power & _15n));\n        power >>= _4n;\n    }\n    const table = new Array(16);\n    table[0] = F.ONE;\n    table[1] = num;\n    for (let i = 2; i < 16; i++)\n        table[i] = F.mul(table[i - 1], num);\n    let p = table[digits[digits.length - 1]]; // top digit is nonzero: the loop above stops on 0\n    for (let w = digits.length - 2; w >= 0; w--) {\n        p = F.sqr(F.sqr(F.sqr(F.sqr(p))));\n        const digit = digits[w];\n        if (digit !== 0)\n            p = F.mul(p, table[digit]);\n    }\n    return p;\n}\nexport function FpInvertBatch(Fp, nums, passZero = false) {\n    validateField(Fp);\n    aarray(nums, 'nums');\n    abool(passZero, 'passZero');\n    const F = Fp;\n    const inverted = new Array(nums.length).fill(passZero ? F.ZERO : undefined);\n    // Walk from first to last, multiply them by each other MOD p\n    const multipliedAcc = nums.reduce((acc, num, i) => {\n        if (F.is0(num))\n            return acc;\n        inverted[i] = acc;\n        return F.mul(acc, num);\n    }, F.ONE);\n    // Invert last element\n    const invertedAcc = F.inv(multipliedAcc);\n    // Walk from last to first, multiply them by inverted each other MOD p\n    nums.reduceRight((acc, num, i) => {\n        if (F.is0(num))\n            return acc;\n        // Non-zero `num` means the forward pass already stored a defined prefix product at index i.\n        inverted[i] = F.mul(acc, inverted[i]);\n        return F.mul(acc, num);\n    }, invertedAcc);\n    return inverted;\n}\n/**\n * @param Fp - Field implementation.\n * @param lhs - Dividend value.\n * @param rhs - Divisor value.\n * @returns Division result.\n * @throws If the divisor is non-invertible. {@link Error}\n * @example\n * Divide one field element by another.\n *\n * ```ts\n * import { Field, FpDiv } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const x = FpDiv(Fp, 6n, 3n);\n * ```\n */\nexport function FpDiv(Fp, lhs, rhs) {\n    validateField(Fp);\n    const F = Fp;\n    return F.mul(lhs, typeof rhs === 'bigint' ? invert(rhs, F.ORDER) : F.inv(rhs));\n}\n/**\n * Legendre symbol.\n * Legendre constant is used to calculate Legendre symbol (a | p)\n * which denotes the value of a^((p-1)/2) (mod p).\n *\n * * (a | p) ≡ 1    if a is a square (mod p), quadratic residue\n * * (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue\n * * (a | p) ≡ 0    if a ≡ 0 (mod p)\n * @param Fp - Field implementation.\n * @param n - Value to inspect.\n * @returns Legendre symbol.\n * @throws If the powered value does not match a valid Legendre symbol. {@link Error}\n * @example\n * Compute the Legendre symbol of one field element.\n *\n * ```ts\n * import { Field, FpLegendre } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const symbol = FpLegendre(Fp, 4n);\n * ```\n */\nexport function FpLegendre(Fp, n) {\n    validateField(Fp);\n    const F = Fp;\n    aoddModulus(F.ORDER, 'FpLegendre');\n    // We can use 3rd argument as optional cache of this value\n    // but seems unneeded for now. The operation is very fast.\n    const p1mod2 = (F.ORDER - _1n) / _2n;\n    const powered = F.pow(n, p1mod2);\n    const yes = F.eql(powered, F.ONE);\n    const zero = F.eql(powered, F.ZERO);\n    const no = F.eql(powered, F.neg(F.ONE));\n    if (!yes && !zero && !no)\n        throw new Error('invalid Legendre symbol result');\n    return yes ? 1 : zero ? 0 : -1;\n}\n/**\n * @param Fp - Field implementation.\n * @param n - Value to inspect.\n * @returns `true` when `Fp.sqrt(n)` exists. This includes `0`, even though strict \"quadratic\n *   residue\" terminology often reserves that name for the non-zero square class.\n * @throws If the field returns an invalid Legendre symbol value. {@link Error}\n * @example\n * Check whether one field element has a square root in the field.\n *\n * ```ts\n * import { Field, FpIsSquare } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const isSquare = FpIsSquare(Fp, 4n);\n * ```\n */\nexport function FpIsSquare(Fp, n) {\n    const l = FpLegendre(Fp, n);\n    // Zero is a square too: 0 = 0^2, and Fp.sqrt(0) already returns 0.\n    return l !== -1;\n}\n/**\n * @param n - Curve order. Callers are expected to pass a positive order.\n * @param nBitLength - Optional cached bit length. Callers are expected to pass a positive cached\n *   value when overriding the derived bit length.\n * @returns Byte and bit lengths.\n * @throws If the order or cached bit length is invalid. {@link Error}\n * @example\n * Measure the encoding sizes needed for one modulus.\n *\n * ```ts\n * nLength(255n);\n * ```\n */\nexport function nLength(n, nBitLength) {\n    // Bit size, byte size of CURVE.n\n    if (nBitLength !== undefined)\n        anumber(nBitLength);\n    if (n <= _0n)\n        throw new Error('invalid n length: expected positive n, got ' + n);\n    if (nBitLength !== undefined && nBitLength < 1)\n        throw new Error('invalid n length: expected positive bit length, got ' + nBitLength);\n    const bits = bitLen(n);\n    // Cached bit lengths smaller than ORDER would truncate serialized scalars/elements and poison\n    // any math that relies on the derived field metadata.\n    if (nBitLength !== undefined && nBitLength < bits)\n        throw new Error(`invalid n length: expected nBitLength (${nBitLength}) >= bitLen(n) (${bits})`);\n    const _nBitLength = nBitLength !== undefined ? nBitLength : bits;\n    const nByteLength = Math.ceil(_nBitLength / 8);\n    return { nBitLength: _nBitLength, nByteLength };\n}\n// Keep the lazy sqrt cache off-instance so Field(...) can return a frozen object. Otherwise the\n// cached helper write would keep the field surface externally mutable.\nconst FIELD_SQRT = new WeakMap();\nclass _Field {\n    ORDER;\n    BITS;\n    BYTES;\n    isLE;\n    ZERO = _0n;\n    ONE = _1n;\n    _lengths;\n    _mod;\n    constructor(ORDER, opts = {}) {\n        // ORDER <= 1 is degenerate: ONE would not be a valid field element and helpers like pow/inv\n        // would stop modeling field arithmetic.\n        if (ORDER <= _1n)\n            throw new Error('invalid field: expected ORDER > 1, got ' + ORDER);\n        let _nbitLength = undefined;\n        this.isLE = false;\n        if (opts != null && typeof opts === 'object') {\n            // Cached bit lengths are trusted here and should already be positive / consistent with ORDER.\n            if (typeof opts.BITS === 'number')\n                _nbitLength = opts.BITS;\n            if (typeof opts.sqrt === 'function')\n                // `_Field.prototype` is frozen below, so custom sqrt hooks must become own properties\n                // explicitly instead of relying on writable prototype shadowing via assignment.\n                Object.defineProperty(this, 'sqrt', { value: opts.sqrt, enumerable: true });\n            if (typeof opts.isLE === 'boolean')\n                this.isLE = opts.isLE;\n            if (opts.allowedLengths)\n                this._lengths = Object.freeze(opts.allowedLengths.slice());\n            if (typeof opts.modFromBytes === 'boolean')\n                this._mod = opts.modFromBytes;\n        }\n        const { nBitLength, nByteLength } = nLength(ORDER, _nbitLength);\n        if (nByteLength > 2048)\n            throw new Error('invalid field: expected ORDER of <= 2048 bytes');\n        this.ORDER = ORDER;\n        this.BITS = nBitLength;\n        this.BYTES = nByteLength;\n        Object.freeze(this);\n    }\n    create(num) {\n        return mod(num, this.ORDER);\n    }\n    isValid(num) {\n        if (typeof num !== 'bigint')\n            throw new TypeError('invalid field element: expected bigint, got ' + typeof num);\n        return _0n <= num && num < this.ORDER; // 0 is valid element, but it's not invertible\n    }\n    is0(num) {\n        return num === _0n;\n    }\n    // is valid and invertible\n    isValidNot0(num) {\n        return !this.is0(num) && this.isValid(num);\n    }\n    isOdd(num) {\n        return (num & _1n) === _1n;\n    }\n    neg(num) {\n        return mod(-num, this.ORDER);\n    }\n    eql(lhs, rhs) {\n        return lhs === rhs;\n    }\n    sqr(num) {\n        return mod(num * num, this.ORDER);\n    }\n    add(lhs, rhs) {\n        return mod(lhs + rhs, this.ORDER);\n    }\n    sub(lhs, rhs) {\n        return mod(lhs - rhs, this.ORDER);\n    }\n    mul(lhs, rhs) {\n        return mod(lhs * rhs, this.ORDER);\n    }\n    pow(num, power) {\n        return pow(num, power, this.ORDER);\n    }\n    div(lhs, rhs) {\n        return mod(lhs * invert(rhs, this.ORDER), this.ORDER);\n    }\n    // Same as above, but doesn't normalize\n    sqrN(num) {\n        return num * num;\n    }\n    addN(lhs, rhs) {\n        return lhs + rhs;\n    }\n    subN(lhs, rhs) {\n        return lhs - rhs;\n    }\n    mulN(lhs, rhs) {\n        return lhs * rhs;\n    }\n    inv(num) {\n        return invert(num, this.ORDER);\n    }\n    sqrt(num) {\n        // Caching sqrt helpers speeds up sqrt9mod16 by 5x and Tonelli-Shanks by about 10% without keeping\n        // the field instance itself mutable.\n        let sqrt = FIELD_SQRT.get(this);\n        if (!sqrt)\n            FIELD_SQRT.set(this, (sqrt = FpSqrt(this.ORDER)));\n        return sqrt(this, num);\n    }\n    toBytes(num) {\n        // Serialize fixed-width limbs without re-validating the field range. Callers that need a\n        // canonical encoding must pass a valid element; some protocols intentionally serialize raw\n        // residues here and reduce or validate them elsewhere.\n        return this.isLE ? numberToBytesLE(num, this.BYTES) : numberToBytesBE(num, this.BYTES);\n    }\n    fromBytes(bytes, skipValidation = false) {\n        abytes(bytes);\n        const { _lengths: allowedLengths, BYTES, isLE, ORDER, _mod: modFromBytes } = this;\n        if (allowedLengths) {\n            // `allowedLengths` must list real positive byte lengths; otherwise empty input would get\n            // padded into zero and silently decode as a field element.\n            if (bytes.length < 1 || !allowedLengths.includes(bytes.length) || bytes.length > BYTES) {\n                throw new Error('Field.fromBytes: expected ' + allowedLengths + ' bytes, got ' + bytes.length);\n            }\n            const padded = new Uint8Array(BYTES);\n            // isLE add 0 to right, !isLE to the left.\n            padded.set(bytes, isLE ? 0 : padded.length - bytes.length);\n            bytes = padded;\n        }\n        if (bytes.length !== BYTES)\n            throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);\n        let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n        if (modFromBytes)\n            scalar = mod(scalar, ORDER);\n        if (!skipValidation)\n            if (!this.isValid(scalar))\n                throw new Error('invalid field element: outside of range 0..ORDER');\n        // Range validation is optional here because some protocols intentionally decode raw residues\n        // and reduce or validate them elsewhere.\n        return scalar;\n    }\n    // TODO: we don't need it here, move out to separate fn\n    invertBatch(lst) {\n        // `passZero` keeps the `bigint[]` contract honest: zero inputs map to `0` instead of leaking\n        // `undefined` into a `bigint[]`. Callers that must distinguish non-invertible inputs should use\n        // `FpInvertBatch` directly, whose default omits `passZero` and returns `(bigint | undefined)[]`.\n        return FpInvertBatch(this, lst, true);\n    }\n    // We can't move this out because Fp6, Fp12 implement it\n    // and it's unclear what to return in there.\n    cmov(a, b, condition) {\n        // Field elements have `isValid(...)`; the CMOV branch bit is a direct runtime input, so reject\n        // non-boolean selectors here instead of letting JS truthiness silently change arithmetic.\n        abool(condition, 'condition');\n        return condition ? b : a;\n    }\n}\n/**\n * Creates a finite field. Major performance optimizations:\n * * 1. Denormalized operations like mulN instead of mul.\n * * 2. Identical object shape: never add or remove keys.\n * * 3. Frozen stable object shape; the lazy sqrt cache lives in a module-level `WeakMap`.\n * Fragile: always run a benchmark on a change.\n * Security note: operations and low-level serializers like `toBytes` don't check `isValid` for\n * all elements for performance and protocol-flexibility reasons; callers are responsible for\n * supplying valid elements when they need canonical field behavior.\n * This is low-level code, please make sure you know what you're doing.\n *\n * Note about field properties:\n * * CHARACTERISTIC p = prime number, number of elements in main subgroup.\n * * ORDER q = similar to cofactor in curves, may be composite `q = p^m`.\n *\n * @param ORDER - field order, probably prime, or could be composite\n * @param opts - Field options such as bit length or endianness. See {@link FieldOpts}.\n * @returns Frozen field instance with a stable object shape. This wrapper forwards `opts` straight\n *   into `_Field`, so it inherits `_Field`'s assumptions about cached sizes and `allowedLengths`.\n * @example\n * Construct one prime field with optional overrides.\n *\n * ```ts\n * Field(11n);\n * ```\n */\nexport function Field(ORDER, opts = {}) {\n    // Freeze the shared method surface before any instance is reachable; otherwise callers can\n    // poison every Field instance by monkey-patching `_Field.prototype` even if each instance is\n    // frozen. Freezing here instead of module scope keeps `_Field` tree-shakeable for importers\n    // that never construct a field; the call is idempotent and cheap.\n    Object.freeze(_Field.prototype);\n    return new _Field(ORDER, opts);\n}\n/**\n * @param Fp - Field implementation.\n * @param elm - Value to square-root.\n * @returns Odd square root when two roots exist. The special case `elm = 0` still returns `0`,\n *   which is the only square root but is not odd.\n * @throws If the field lacks oddness checks or the square root does not exist. {@link Error}\n * @example\n * Select the odd square root when two roots exist.\n *\n * ```ts\n * import { Field, FpSqrtOdd } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const root = FpSqrtOdd(Fp, 4n);\n * ```\n */\nexport function FpSqrtOdd(Fp, elm) {\n    validateField(Fp);\n    const F = Fp;\n    if (!F.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = F.sqrt(elm);\n    return F.isOdd(root) ? root : F.neg(root);\n}\n/**\n * @param Fp - Field implementation.\n * @param elm - Value to square-root.\n * @returns Even square root.\n * @throws If the field lacks oddness checks or the square root does not exist. {@link Error}\n * @example\n * Select the even square root when two roots exist.\n *\n * ```ts\n * import { Field, FpSqrtEven } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const root = FpSqrtEven(Fp, 4n);\n * ```\n */\nexport function FpSqrtEven(Fp, elm) {\n    validateField(Fp);\n    const F = Fp;\n    if (!F.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = F.sqrt(elm);\n    return F.isOdd(root) ? F.neg(root) : root;\n}\n/**\n * Returns total number of bytes consumed by the field element.\n * For example, 32 bytes for usual 256-bit weierstrass curve.\n * @param fieldOrder - number of field elements, usually CURVE.n. Callers are expected to pass an\n *   order greater than 1.\n * @returns byte length of field\n * @throws If the field order is not a bigint. {@link Error}\n * @example\n * Read the fixed-width byte length of one field.\n *\n * ```ts\n * getFieldBytesLength(255n);\n * ```\n */\nexport function getFieldBytesLength(fieldOrder) {\n    if (typeof fieldOrder !== 'bigint')\n        throw new Error('field order must be bigint');\n    // Valid field elements are in 0..ORDER-1, so ORDER <= 1 would make the encoded range degenerate.\n    if (fieldOrder <= _1n)\n        throw new Error('field order must be greater than 1');\n    // Valid field elements are < ORDER, so the maximal encoded element is ORDER - 1.\n    const bitLength = bitLen(fieldOrder - _1n);\n    return Math.ceil(bitLength / 8);\n}\n/**\n * Returns minimal amount of bytes that can be safely reduced\n * by field order.\n * Should be 2^-128 for 128-bit curve such as P256.\n * This is the reduction / modulo-bias lower bound; higher-level helpers may still impose a larger\n * absolute floor for policy reasons.\n * @param fieldOrder - number of field elements greater than 1, usually CURVE.n.\n * @returns byte length of target hash\n * @throws If the field order is invalid. {@link Error}\n * @example\n * Compute the minimum hash length needed for field reduction.\n *\n * ```ts\n * getMinHashLength(255n);\n * ```\n */\nexport function getMinHashLength(fieldOrder) {\n    const length = getFieldBytesLength(fieldOrder);\n    return length + Math.ceil(length / 2);\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF\n * and convert them into private scalar, with the modulo bias being negligible.\n * Needs at least 48 bytes of input for 32-byte private key. The implementation also keeps a hard\n * 16-byte minimum even when `getMinHashLength(...)` is smaller, so toy-small inputs do not look\n * accidentally acceptable for real scalar derivation.\n * See {@link https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/ | Kudelski's modulo-bias guide},\n * {@link https://csrc.nist.gov/publications/detail/fips/186/5/final | FIPS 186-5 appendix A.2}, and\n * {@link https://www.rfc-editor.org/rfc/rfc9380#section-5 | RFC 9380 section 5}. Unlike RFC 9380\n * `hash_to_field`, this helper intentionally maps into the non-zero private-scalar range `1..n-1`.\n * @param key - Uniform input bytes.\n * @param fieldOrder - Size of subgroup.\n * @param isLE - interpret hash bytes as LE num\n * @returns valid private scalar\n * @throws If the hash length or field order is invalid for scalar reduction. {@link Error}\n * @example\n * Map hash output into a private scalar range.\n *\n * ```ts\n * mapHashToField(new Uint8Array(48).fill(1), 255n);\n * ```\n */\nexport function mapHashToField(key, fieldOrder, isLE = false) {\n    abytes(key);\n    const len = key.length;\n    const fieldLen = getFieldBytesLength(fieldOrder);\n    const minLen = Math.max(getMinHashLength(fieldOrder), 16);\n    // No toy-small inputs: the helper is for real scalar derivation, not tiny test curves. No huge\n    // inputs: easier to reason about JS timing / allocation behavior.\n    if (len < minLen || len > 1024)\n        throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);\n    const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);\n    // Map into the non-zero scalar range [1, fieldOrder-1]: reduce mod (fieldOrder-1) to land in\n    // [0, fieldOrder-2], then add 1. This shifts the range off zero; it is NOT equal to\n    // `mod(num, fieldOrder)` (which spans [0, fieldOrder-1] and can be 0). A residual modulo bias\n    // remains but is negligible (~2^-(nBits/2), e.g. ~2^-128 for a 256-bit order) because `key` is\n    // required to be at least `getMinHashLength(fieldOrder)` (~1.5x field size) bytes of input.\n    const reduced = mod(num, fieldOrder - _1n) + _1n;\n    return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);\n}\n","/**\n * Methods for elliptic curve multiplication by scalars.\n * Contains wNAF-based ScalarMultiplier, pippenger.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { aarray, abool, afunction, aobject, bitLen, bitMask, bytesToNumberBE, inRange, isBytes, isPosBig, validateObject, } from \"../utils.js\";\nimport { Field, FpInvertBatch, validateField } from \"./modular.js\";\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\nconst _4n = /* @__PURE__ */ BigInt(4);\nconst BLIND_BYTES = 16;\nconst BLIND_BITS = 128;\n// Fixed-window width for the constant-time multiply of un-precomputed points (W===1).\n// A flat 2^FW_WINDOW table has a small, scalar-independent build cost that amortizes over a single\n// multiply, unlike the larger per-point wNAF tables that only pay off when cached.\nconst FW_WINDOW = 5;\n// Precompute tables are capped at ~2 GiB of estimated heap. Rejecting larger windows up front\n// turns a typo'd window size into an immediate error instead of a multi-GB allocation (or an\n// effective hang) when the lazy table is built on first multiply.\nconst TABLE_BYTES_MAX = /* @__PURE__ */ (() => 2 ** 31)();\n/**\n * Validates the static surface of a point constructor.\n * This is only a cheap sanity check for the constructor hooks and fields consumed by generic\n * factories; it does not certify `BASE`/`ZERO` semantics or prove the curve implementation itself.\n * @param Point - Runtime point constructor.\n * @throws On missing constructor hooks or malformed field metadata. {@link TypeError}\n * @example\n * Check that one point constructor exposes the static hooks generic helpers need.\n *\n * ```ts\n * import { ed25519 } from '@noble/curves/ed25519.js';\n * import { validatePointCons } from '@noble/curves/abstract/curve.js';\n * validatePointCons(ed25519.Point);\n * ```\n */\nexport function validatePointCons(Point) {\n    const pc = Point;\n    if (typeof pc !== 'function')\n        throw new TypeError('\"Point\" expected constructor, got type=' + typeof Point);\n    afunction(pc.fromAffine, 'Point.fromAffine');\n    afunction(pc.fromBytes, 'Point.fromBytes');\n    afunction(pc.fromHex, 'Point.fromHex');\n    // Generic helpers (ScalarMultiplier, normalizeZ, MSM) dereference BASE / ZERO:\n    // fail here with a typed error instead of an `undefined` access later.\n    aobject(pc.BASE, 'Point.BASE');\n    aobject(pc.ZERO, 'Point.ZERO');\n    validateField(pc.Fp);\n    validateField(pc.Fn);\n}\n/**\n * Takes a bunch of Projective Points but executes only one\n * inversion on all of them. Inversion is very slow operation,\n * so this improves performance massively.\n * Optimization: converts a list of projective points to a list of identical points with Z=1.\n * Input points are left unchanged; the normalized points are returned as fresh instances.\n * @param c - Point constructor.\n * @param points - Projective points.\n * @returns Fresh projective points reconstructed from normalized affine coordinates.\n * @example\n * Batch-normalize projective points with a single shared inversion.\n *\n * ```ts\n * import { normalizeZ } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const points = normalizeZ(p256.Point, [p256.Point.BASE, p256.Point.BASE.double()]);\n * ```\n */\nexport function normalizeZ(c, points) {\n    // Match MSM helpers: reject malformed public inputs before reading projective internals.\n    validatePointCons(c);\n    validateMSMPoints(points, c);\n    // Identity points (Z=0) rely on an implicit contract: FpInvertBatch without `passZero`\n    // yields `undefined` for zero inputs, and `toAffine(undefined)` falls back to its internal\n    // is0 handling instead of using the batch inverse.\n    const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));\n    return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));\n}\nfunction validateW(W, bits, min = 1) {\n    if (!Number.isSafeInteger(W) || W < min || W > bits)\n        throw new Error('invalid window size, expected [' + min + '..' + bits + '], got W=' + W);\n}\n// Rough per-point heap estimate for the {@link TABLE_BYTES_MAX} cap: up to 4 projective/extended\n// coordinates of Fp.BYTES each, plus bigint/object overhead. Callers pass the point count of the\n// largest table the checked parameters can produce.\nfunction validateTableBytes(numPoints, fpBytes) {\n    const bytes = numPoints * (4 * fpBytes + 128);\n    if (bytes > TABLE_BYTES_MAX)\n        throw new Error('invalid window size: table would need ~' +\n            Math.ceil(bytes / 2 ** 20) +\n            ' MiB, max ' +\n            TABLE_BYTES_MAX / 2 ** 20 +\n            ' MiB');\n}\n/**\n * Probes an RNG once, at construction time: returns `undefined` when it is unavailable —\n * throws or returns malformed bytes — so callers can downgrade to their unblinded /\n * deterministic constant-time fallback. Blinding is defense-in-depth (DPA/template\n * hardening), not a correctness or key-secrecy requirement, so availability-based\n * downgrade is acceptable.\n *\n * The downgrade decision is deliberately static. After a successful probe the RNG becomes\n * part of the trusted contract: later misbehavior must fail closed in per-call validation\n * (throw), never downgrade — a dynamic fallback would let a tampered RNG silently strip\n * blinding on demand. A probe can only ever classify broken environments, not adversarial\n * RNGs: a stateful RNG can always behave while probed and misbehave later.\n * @param randomBytes - RNG to probe, or `undefined` when the environment provides none.\n * @param length - Byte length requested from the probe call.\n * @returns The RNG when the probe produced `length` valid bytes; `undefined` otherwise.\n * @example\n * Probe an RNG once before enabling scalar blinding.\n *\n * ```ts\n * import { probeRandomBytes } from '@noble/curves/abstract/curve.js';\n * import { randomBytes } from '@noble/hashes/utils.js';\n * const rng = probeRandomBytes(randomBytes, 16);\n * ```\n */\nexport function probeRandomBytes(randomBytes, length) {\n    if (randomBytes === undefined)\n        return undefined;\n    afunction(randomBytes, 'randomBytes');\n    try {\n        const probe = randomBytes(length);\n        if (!isBytes(probe) || probe.length !== length)\n            return undefined;\n    }\n    catch {\n        return undefined;\n    }\n    return randomBytes;\n}\nfunction validateMSMPoints(points, c) {\n    aarray(points, 'points');\n    points.forEach((p, i) => {\n        if (!(p instanceof c))\n            throw new Error('invalid point at index ' + i);\n    });\n}\n// Default bound is field membership (0 <= s < field.ORDER); a `maxScalar` override widens it\n// to 0 <= s < maxScalar for callers that accept oversized scalars.\nfunction validateMSMScalars(scalars, field, maxScalar) {\n    if (!Array.isArray(scalars))\n        throw new Error('array of scalars expected');\n    scalars.forEach((s, i) => {\n        const ok = maxScalar === undefined ? field.isValid(s) : isPosBig(s) && s < maxScalar;\n        if (!ok)\n            throw new Error('invalid scalar at index ' + i);\n    });\n}\nconst pointWindowSizes = new WeakMap();\nfunction getWindowSize(P) {\n    // `1` is the uncached sentinel: use the non-precomputed (wNAF / fixed-window) path.\n    return pointWindowSizes.get(P) || 1;\n}\n/** Table of odd multiples [1P, 3P, ..., (2⋅size−1)P]; width-W wNAF uses size = 2^(W−2). */\nfunction oddMultiples(p, size) {\n    const dbl = p.double();\n    const t = [p];\n    for (let j = 1; j < size; j++)\n        t.push(t[j - 1].add(dbl));\n    return t;\n}\n/**\n * Width-W wNAF signed-digit recoding (W >= 2), LSB-first: digits are 0 or odd with\n * |digit| < 2^(W−1); nonzero density ~1/(W+1) (a nonzero digit is followed by W−1 zeros).\n */\nfunction wnafDigits(n, W) {\n    const size = 2 ** W;\n    const half = size / 2;\n    const mask = BigInt(size - 1);\n    const d = [];\n    while (n > _0n) {\n        let w = 0;\n        if (n & _1n) {\n            w = Number(n & mask); // n mod 2^W, odd\n            if (w >= half)\n                w -= size; // signed residue\n            n -= BigInt(w); // n - w ≡ 0 mod 2^W: next W−1 digits are zero\n        }\n        d.push(w);\n        n >>= _1n;\n    }\n    return d;\n}\n/**\n * Fixed-position signed-window recoding for precomputed wNAF: `n = Σ digits[w]⋅2^(w⋅W)` with\n * digits in `[−2^(W−1)+1, 2^(W−1)]`. Digit count is fixed by `windows` (callers reserve one\n * extra window for the final carry), so recoding length does not depend on the scalar.\n */\nfunction signedWindowDigits(n, W, windows) {\n    const size = 2 ** W;\n    const half = size / 2;\n    const mask = BigInt(size - 1);\n    const shiftBy = BigInt(W);\n    const d = [];\n    for (let w = 0; w < windows; w++) {\n        let v = Number(n & mask);\n        n >>= shiftBy;\n        if (v > half) {\n            v -= size; // negative digit, carry into the next window\n            n += _1n;\n        }\n        d.push(v);\n    }\n    // Internal invariant: leftover bits mean the window count did not cover the scalar.\n    if (n !== _0n)\n        throw new Error('invalid wnaf');\n    return d;\n}\n/**\n * Shared vartime walk over per-scalar wNAF digit streams: one doubling of a single shared\n * accumulator per bit position of the longest recoding, one signed table addition per\n * nonzero digit. `tables[i]` must hold the odd multiples of the i-th point.\n */\nfunction wnafWalk(zero, tables, digits) {\n    let max = 0;\n    for (const d of digits)\n        max = Math.max(max, d.length);\n    let acc = zero;\n    for (let bit = max - 1; bit >= 0; bit--) {\n        if (bit !== max - 1)\n            acc = acc.double();\n        for (let i = 0; i < digits.length; i++) {\n            const w = digits[i][bit]; // reads past shorter recodings yield undefined, skipped below\n            if (w) {\n                const item = tables[i][(Math.abs(w) - 1) >> 1];\n                acc = acc.add(w < 0 ? item.negate() : item);\n            }\n        }\n    }\n    return acc;\n}\n/**\n * Elliptic curve multiplication of Point by scalar.\n * Routes between cached-table, fixed-window, and one-shot wNAF paths; entry points validate\n * their own scalars (`mulCT`/`mulCTBlinded`: `1 <= s < Fn.ORDER`; `mulUnsafe`: up to the\n * `Fn.ORDER^4` DoS cap via {@link mulAddUnsafe}).\n * Table generation is expensive and happens on first call of `multiply()`\n * (or eagerly via `precompute(W, false)`). By default, `BASE` point is precomputed.\n *\n * Cached algorithm is signed fixed-window wNAF:\n * - table stores, for every window w, the multiples `[1..2^(W−1)]⋅2^(w⋅W)⋅P` — all doublings\n *   are baked in, so a multiplication is exactly one table addition per window\n * - window count is fixed (`ceil(bits/W) + 1`), so the point-operation count is scalar-independent\n *   (basis of the constant-time path)\n * - for a 256-bit curve and W=6: 44⋅32 = 1408 table points, 44 additions per multiply\n * - secret scalars are additionally blinded (see {@link ScalarMultiplier.mulCTBlinded}), which\n *   widens tables by 128 bits\n * @param Point - Point constructor.\n * @param randomBytes - RNG used for scalar blinding; required by the blinded secret path.\n * @example\n * Elliptic curve multiplication of Point by scalar.\n *\n * ```ts\n * import { ScalarMultiplier } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const mul = new ScalarMultiplier(p256.Point);\n * ```\n */\nexport class ScalarMultiplier {\n    Point;\n    BASE;\n    ZERO;\n    randomBytes;\n    wnafPrecomputes = new WeakMap();\n    baseCanBeBlinded;\n    bits;\n    // Parametrized with a given Point class (not individual point)\n    constructor(Point, randomBytes) {\n        validatePointCons(Point);\n        // Probe the RNG once (see {@link probeRandomBytes}): in environments without working\n        // randomness (e.g. no WebCrypto), shouldBlind() then routes secret multiplication to the\n        // unblinded constant-time path instead of throwing on every multiply(). The shape of\n        // returned bytes is still validated on every blinded call, where breakage fails closed.\n        this.randomBytes = probeRandomBytes(randomBytes, BLIND_BYTES);\n        this.Point = Point;\n        this.BASE = Point.BASE;\n        this.ZERO = Point.ZERO;\n        this.bits = Point.Fn.BITS;\n    }\n    /**\n     * Creates a signed fixed-window wNAF precomputation table: for every window w, the\n     * multiples `[1..2^(W−1)]⋅2^(w⋅W)⋅P`, flattened. All doublings are baked into the table,\n     * so cached multiplication is additions-only. `windows = ceil(bits/W) + 1`: the extra\n     * window absorbs the final carry of signed-digit recoding.\n     * For a 256-bit curve and W=6, the table is 44⋅32 = 1408 points.\n     * @param point - Point instance\n     * @param W - window size\n     * @param bits - scalar bitlength the table must cover\n     */\n    buildWnafTable(point, W, bits) {\n        // W needs no re-validation: its only source is setWindowSize(), which enforces\n        // 1 <= W <= Fn.BITS <= bits (the blinded path only ever widens bits) and caps the\n        // resulting table at ~2 GiB (sized against the wider blinded layout).\n        const windows = Math.ceil(bits / W) + 1;\n        const half = 2 ** (W - 1);\n        const comp = [];\n        let base = point;\n        for (let w = 0; w < windows; w++) {\n            let acc = base;\n            for (let i = 0; i < half; i++) {\n                comp.push(acc);\n                acc = acc.add(base);\n            }\n            base = comp[comp.length - 1].double(); // 2⋅(2^(W−1)⋅base) = next window's base\n        }\n        return { W, bits, windows, comp };\n    }\n    /**\n     * Implements ec multiplication using precomputed signed fixed-window wNAF tables.\n     * Constant-time: fixed window count with one table addition per window — zero digits feed\n     * the fake accumulator — and no doublings; the lookup scans the whole window slice.\n     * Scalar bounds are validated by the public entry points ({@link ScalarMultiplier.mulCT},\n     * {@link ScalarMultiplier.mulCTBlinded}, {@link ScalarMultiplier.mulUnsafe});\n     * signedWindowDigits throws if `n` exceeds the table.\n     * @returns real and fake (for const-time) points\n     */\n    wnafCachedCT(precomputes, n) {\n        const { W, windows, comp } = precomputes;\n        const half = 2 ** (W - 1);\n        const digits = signedWindowDigits(n, W, windows);\n        let p = this.ZERO;\n        let f = this.BASE;\n        for (let w = 0; w < windows; w++) {\n            const digit = digits[w];\n            const start = w * half;\n            // Data-oblivious select: touch every entry of the window before the digit branch.\n            const idx = Math.abs(digit) - 1; // -1 for zero digits: matches nothing, `sel` unused\n            let sel = comp[start];\n            for (let i = 1; i < half; i++)\n                sel = i === idx ? comp[start + i] : sel;\n            const neg = sel.negate(); // compute both signs; the digit only picks one\n            if (digit === 0)\n                f = f.add(comp[start]);\n            else\n                p = p.add(digit < 0 ? neg : sel);\n        }\n        return { p, f };\n    }\n    // Cache key is point identity plus (W, bits); at most two entries exist per point (public-width\n    // `Fn.BITS` and blinded `Fn.BITS + BLIND_BITS`). Callers must not reuse the same point with\n    // incompatible `transform(...)` layouts and expect a separate cache entry.\n    getWnafPrecomputes(W, point, bits, transform) {\n        let entries = this.wnafPrecomputes.get(point);\n        let comp = entries?.find((entry) => entry.W === W && entry.bits === bits);\n        if (!comp) {\n            comp = this.buildWnafTable(point, W, bits);\n            if (typeof transform === 'function')\n                comp = { ...comp, comp: transform(comp.comp) };\n            if (!entries) {\n                entries = [];\n                this.wnafPrecomputes.set(point, entries);\n            }\n            entries.push(comp);\n        }\n        return comp;\n    }\n    assertPoint(point) {\n        if (!(point instanceof this.Point))\n            throw new TypeError('\"point\" expected Point instance, got type=' + typeof point);\n    }\n    // Shared prologue of the constant-time entry points. Rejects scalar 0: in key/signature-style\n    // callers a zero scalar means broken upstream plumbing, and concrete Points already reject it.\n    // Uses inRange instead of Fn.isValidNot0: validateField() only certifies the arithmetic subset.\n    validateMulInput(point, scalar) {\n        this.assertPoint(point);\n        if (!inRange(scalar, _1n, this.Point.Fn.ORDER))\n            throw new Error('invalid scalar');\n    }\n    // Constant-time dispatch shared by mulCT / mulCTBlinded. Un-precomputed points (W===1, e.g.\n    // ECDH peer keys) skip building a throwaway cached table in favor of a small fixed-window\n    // multiply. `n` must be < 2^bits.\n    runCT(point, n, bits, transform) {\n        const W = getWindowSize(point);\n        if (W === 1)\n            return this.fixedWindowCT(point, n, bits);\n        return this.wnafCachedCT(this.getWnafPrecomputes(W, point, bits, transform), n);\n    }\n    mulCT(point, scalar, transform) {\n        this.validateMulInput(point, scalar);\n        return this.runCT(point, scalar, this.bits, transform);\n    }\n    mulCTBlinded(point, scalar, transform) {\n        this.validateMulInput(point, scalar);\n        // Blinding computes n = scalar + blind*Fn.ORDER, then n*P via a constant-time multiply. This\n        // equals scalar*P only when Fn.ORDER*P == O; callers guarantee that via shouldBlind() (always\n        // for cofactor-1 curves; for cofactored curves only BASE, and only after checking BASE*n == O).\n        // Fail before building the (large) precompute table if randomness is unavailable.\n        if (this.randomBytes === undefined)\n            throw new Error('randomBytes is required for scalar blinding');\n        const bits = this.Point.Fn.BITS + BLIND_BITS;\n        const blind = this.randomBytes(BLIND_BYTES);\n        if (!isBytes(blind) || blind.length !== BLIND_BYTES)\n            throw new Error('randomBytes returned invalid byte array');\n        // Force the top two bits of the 128-bit blind to 10xxxxxx, so blind is in [2^127, 1.5*2^127):\n        // * `| 0x80` (bit 127 = 1) is the load-bearing part: it guarantees blind >= 2^127, so the blind\n        //   is always a full-width, nonzero factor and the scalar is masked even with a degenerate RNG.\n        // * `& 0x3f` (bit 126 = 0) is a safety margin: it caps blind < 1.5*2^127, keeping\n        //   blind*Fn.ORDER + scalar < 0.75*2^(nBits+128), i.e. ~half a window below the 2^(nBits+128)\n        //   ceiling. Not strictly required for the bound (see below), but it reserves headroom so the\n        //   guarantee does not rest on the tight `Fn.ORDER < 2^Fn.BITS` fact and the final carry window\n        //   only ever holds a small carry, never a full digit.\n        blind[0] = (blind[0] & 0x3f) | 0x80;\n        // Even at the extreme (blind < 2^128, scalar < Fn.ORDER < 2^nBits): n <= 2^128*Fn.ORDER - 1 <\n        // 2^(nBits+128), so n stays below 2^bits and within the blinded table's\n        // window count. Both cached CT kernels run a fixed number of windows/rows with one point-add\n        // each, so the add count is independent of scalar (constant-time).\n        const n = scalar + bytesToNumberBE(blind) * this.Point.Fn.ORDER;\n        return this.runCT(point, n, bits, transform);\n    }\n    /**\n     * Constant-time multiplication `n*point` for an un-precomputed point, via a small fixed window.\n     * A cached wNAF table only pays off when reused; a flat 2^FW_WINDOW table (`size-1` adds) is\n     * far cheaper to build for a single use. The point-operation sequence is independent of `n`:\n     * build the table, then per window exactly FW_WINDOW doublings, a data-oblivious scan over\n     * every table entry, and one addition (adds the identity when the window digit is 0 — never\n     * skipped).\n     *\n     * `n` must be `< 2^bits`. Assumes complete addition (adding the identity costs the same as any\n     * add), which holds for the Weierstrass/Edwards point types used here. The table is left in\n     * projective form (no normalizeZ): normalizing this small a table costs more than the\n     * mixed-add savings it would buy for a single multiply.\n     * @returns real point `p`; `f` duplicates it only to match {@link wnafCachedCT}'s return shape\n     * (this path needs no fake accumulator — its op-count is already scalar-independent).\n     */\n    fixedWindowCT(point, n, bits) {\n        const W = FW_WINDOW;\n        const size = 1 << W;\n        const mask = bitMask(W);\n        // Flat table [O, point, 2*point, ..., (size-1)*point].\n        const table = new Array(size);\n        table[0] = this.ZERO;\n        for (let i = 1; i < size; i++)\n            table[i] = table[i - 1].add(point);\n        // Horner MSB->LSB. windows*W >= bits and n < 2^bits, so every bit of n is consumed.\n        const windows = Math.ceil(bits / W);\n        let acc = this.ZERO;\n        for (let window = windows - 1; window >= 0; window--) {\n            // W doublings per window; skipped for the first (topmost) window, where acc is still the\n            // identity. The skip is scalar-independent: it depends only on the loop index.\n            if (window !== windows - 1)\n                for (let d = 0; d < W; d++)\n                    acc = acc.double();\n            const digit = Number((n >> BigInt(window * W)) & mask);\n            // Data-oblivious select: touch every entry, same as wnafCachedCT.\n            let sel = table[0];\n            for (let i = 1; i < size; i++)\n                sel = i === digit ? table[i] : sel;\n            acc = acc.add(sel); // one add per window, even for digit 0\n        }\n        return { p: acc, f: acc };\n    }\n    shouldBlind(point, cofactor) {\n        // No usable RNG (probed in the constructor): blinding is impossible, use the plain CT path.\n        if (this.randomBytes === undefined)\n            return false;\n        if (cofactor === _1n)\n            return true;\n        if (point !== this.BASE)\n            return false;\n        if (this.baseCanBeBlinded === undefined)\n            this.baseCanBeBlinded = this.mulUnsafe(this.BASE, this.Point.Fn.ORDER).is0();\n        return this.baseCanBeBlinded;\n    }\n    mulSecret(point, scalar, cofactor, transform) {\n        return this.shouldBlind(point, cofactor)\n            ? this.mulCTBlinded(point, scalar, transform)\n            : this.mulCT(point, scalar, transform);\n    }\n    mulUnsafe(point, scalar, transform) {\n        this.assertPoint(point);\n        if (!isPosBig(scalar))\n            throw new Error('invalid scalar');\n        const W = getWindowSize(point);\n        // W === 1 (un-precomputed): one-shot width-4 wNAF via {@link mulAddUnsafe} with L=1 —\n        // a cached table would be thrown away after one use. `allowOversized` swaps the\n        // `s < Fn.ORDER` check for mulAddUnsafe's `Fn.ORDER^4` DoS cap.\n        //\n        // Oversized scalar could happen when:\n        // a) user passes large scalar on their own (rare)\n        // b) `assertValidity()` calls `isTorsionFree()`, which multiplies point by `Fn.ORDER`\n        if (W === 1 || scalar >= this.Point.Fn.ORDER)\n            return mulAddUnsafe(this.Point, [point], [scalar], true);\n        // Precomputed points reuse the CT kernel (fake accumulator discarded): with W=6 only\n        // ~1/64 of window-adds are skippable, so a dedicated vartime kernel saved just ~6% on\n        // this path while doubling the cached-table code surface.\n        const precomputes = this.getWnafPrecomputes(W, point, this.bits, transform);\n        return this.wnafCachedCT(precomputes, scalar).p;\n    }\n    // Remembers the window size used for precomputed wNAF multiplication of the given point\n    // and drops any previously built tables. Usually only the base point is precomputed.\n    // W=1 resets the point to the un-precomputed (table-less) paths.\n    // W is additionally capped so tables stay under ~2 GiB ({@link TABLE_BYTES_MAX}).\n    setWindowSize(point, W) {\n        this.assertPoint(point);\n        validateW(W, this.bits);\n        // Size against the widest table this W can produce: the blinded path adds BLIND_BITS.\n        const windows = Math.ceil((this.bits + BLIND_BITS) / W) + 1;\n        validateTableBytes(windows * 2 ** (W - 1), this.Point.Fp.BYTES);\n        pointWindowSizes.set(point, W);\n        this.wnafPrecomputes.delete(point);\n    }\n    // True when a window size is set: tables themselves are built lazily on first multiply.\n    hasWindowSize(point) {\n        return getWindowSize(point) !== 1;\n    }\n}\n/**\n * Combined multi-scalar multiplication `Σ scalars[i]⋅points[i]` via interleaved width-4 wNAF\n * (Strauss–Shamir). Every input gets its own table of odd multiples `[1P, 3P, 5P, 7P]` and\n * signed-digit recoding, but all walks share one doubling chain, so total cost is\n * `~bits` doublings + `L⋅bits/5` additions instead of `L⋅bits` doublings for separate\n * multiplications. Intended for the 2-4 point shapes of signature verification\n * (`R = u1⋅G + u2⋅P`); use {@link pippenger} for larger batches.\n *\n * Not constant-time: only for public inputs. Scalars must satisfy `0 <= s < Fn.ORDER`;\n * fold negative signs into the points before calling.\n * @param c - Point constructor.\n * @param points - Array of curve points.\n * @param scalars - Array of non-negative scalars, same length as points.\n * @param allowOversized - Replace the `s < Fn.ORDER` scalar check with a `Fn.ORDER^4` DoS cap.\n *   Off by default. For scalars that must NOT be reduced mod ORDER: torsion checks\n *   (`Fn.ORDER⋅P ≟ O`) and cofactor-clearing multiples. Walk length grows with `bitLen(s)`.\n * @returns Combined multiplication result; identity for empty input.\n * @throws If the point set or scalar set is invalid. {@link Error}\n * @example\n * Combined multi-scalar multiplication via Strauss–Shamir.\n *\n * ```ts\n * import { mulAddUnsafe } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const G = p256.Point.BASE;\n * const R = mulAddUnsafe(p256.Point, [G, G.double()], [2n, 3n]); // 2⋅G + 3⋅(2⋅G)\n * ```\n */\nexport function mulAddUnsafe(c, points, scalars, allowOversized = false) {\n    validatePointCons(c);\n    validateMSMPoints(points, c);\n    abool(allowOversized, 'allowOversized');\n    // Oversized cap is ORDER^4: hard bound to mitigate DoS, walk length grows with bitLen(s).\n    validateMSMScalars(scalars, c.Fn, allowOversized ? c.Fn.ORDER ** _4n : undefined);\n    if (points.length !== scalars.length)\n        throw new Error('arrays of points and scalars must have equal length');\n    const tables = points.map((p) => oddMultiples(p, 4));\n    const digits = scalars.map((n) => wnafDigits(n, 4));\n    return wnafWalk(c.ZERO, tables, digits);\n}\n/**\n * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * 30x faster vs naive addition on L=4096, 10x faster than precomputes.\n * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.\n * Point-operation count is scalar-independent (for same L), even when 1 point + scalar, or when\n * scalar = 0 — but bucket indices are scalar windows, so the memory-access pattern is\n * scalar-dependent: do not rely on this for secret scalars.\n *\n * A repaired LFG bucket-set variant from ePrint 2024/750 was benchmarked on BLS12-381 G1\n * against this implementation: ~1.4x faster at 2048 points and ~1.1-1.25x faster at\n * 4096-32768 points, at the cost of extra recoding and multiplier-table complexity.\n * @param c - Curve Point constructor\n * @param points - array of L curve points\n * @param scalars - array of L scalars (aka secret keys / bigints)\n * @returns MSM result point. Empty input is accepted and returns the identity.\n * @throws If the point set, scalar set, or MSM sizing is invalid. {@link Error}\n * @example\n * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n *\n * ```ts\n * import { pippenger } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const point = pippenger(p256.Point, [p256.Point.BASE, p256.Point.BASE.double()], [2n, 3n]);\n * ```\n */\nexport function pippenger(c, points, scalars) {\n    // 0 is accepted in scalars\n    validatePointCons(c);\n    const fieldN = c.Fn;\n    validateMSMPoints(points, c);\n    validateMSMScalars(scalars, fieldN);\n    const plength = points.length;\n    const slength = scalars.length;\n    if (plength !== slength)\n        throw new Error('arrays of points and scalars must have equal length');\n    const zero = c.ZERO;\n    // Without this, the window loop below would still run ~Fn.BITS doublings of ZERO.\n    if (plength === 0)\n        return zero;\n    const wbits = bitLen(BigInt(plength));\n    let windowSize = 1; // bits\n    if (wbits > 12)\n        windowSize = wbits - 3;\n    else if (wbits > 4)\n        windowSize = wbits - 2;\n    else if (wbits > 0)\n        windowSize = 2;\n    const MASK = bitMask(windowSize);\n    const buckets = new Array(Number(MASK) + 1).fill(zero); // +1 for zero array\n    const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;\n    let sum = zero;\n    for (let i = lastBits; i >= 0; i -= windowSize) {\n        buckets.fill(zero);\n        for (let j = 0; j < slength; j++) {\n            const scalar = scalars[j];\n            const wbits = Number((scalar >> BigInt(i)) & MASK);\n            buckets[wbits] = buckets[wbits].add(points[j]);\n        }\n        let resI = zero; // not using this will do small speed-up, but will lose ct\n        // Skip first bucket, because it is zero\n        for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {\n            sumI = sumI.add(buckets[j]);\n            resI = resI.add(sumI);\n        }\n        sum = sum.add(resI);\n        if (i !== 0)\n            for (let j = 0; j < windowSize; j++)\n                sum = sum.double();\n    }\n    return sum;\n}\n/**\n * Interleaved wNAF multi-scalar multiplication (MSM, Pa + Qb + Rc + ...) over a FIXED set\n * of points: each point gets a one-time table of odd multiples\n * `[1P, 3P, ..., (2^(W−1)−1)P]`, and the returned closure evaluates MSMs against those\n * tables. All scalars share one doubling chain (Straus 1964) — one doubling per scalar bit\n * plus one signed table addition per nonzero width-W wNAF digit (density ~1/(W+1)) — the\n * \"interleaving\" method of Möller, \"Algorithms for multi-exponentiation\" (SAC 2001).\n *\n * Table memory is `L⋅2^(W−2)` points, capped at ~2 GiB. Prefer this over {@link pippenger}\n * when the same points are reused across many MSMs (fixed-base commitments etc.) and up to a\n * few hundred points; prefer pippenger for one-shot MSMs or thousands of points, where\n * bucketing beats per-point tables.\n *\n * Not constant-time (zero digits are skipped): public inputs only.\n * @param c - Curve Point constructor\n * @param points - array of L curve points, captured by the returned closure\n * @param windowSize - window width W in bits, from 2 to Fn.BITS; also capped so the\n *   per-closure tables stay under ~2 GiB\n * @returns Function which multiplies points with scalars. The closure accepts at most\n *   `points.length` scalars, and omitted trailing scalars are treated as zero.\n * @throws If the point set or precompute window is invalid. {@link Error}\n * @example\n * Interleaved wNAF multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n *\n * ```ts\n * import { interleavedMSMUnsafe } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const msm = interleavedMSMUnsafe(p256.Point, [p256.Point.BASE], 4);\n * const point = msm([3n]);\n * ```\n */\nexport function interleavedMSMUnsafe(c, points, windowSize) {\n    validatePointCons(c);\n    const fieldN = c.Fn;\n    // Signed odd digits need at least width 2 (W=2 is plain NAF with a single-entry table).\n    validateW(windowSize, fieldN.BITS, 2);\n    validateMSMPoints(points, c);\n    validateTableBytes(points.length * 2 ** (windowSize - 2), c.Fp.BYTES);\n    const tables = points.map((p) => oddMultiples(p, 2 ** (windowSize - 2)));\n    return (scalars) => {\n        validateMSMScalars(scalars, fieldN);\n        if (scalars.length > points.length)\n            throw new Error('array of scalars must not be larger than array of points');\n        return wnafWalk(c.ZERO, tables, scalars.map((n) => wnafDigits(n, windowSize)));\n    };\n}\nfunction createField(order, field, isLE) {\n    if (field) {\n        // Reuse supplied field overrides as-is; `isLE` only affects freshly constructed fallback\n        // fields, and validateField() below only checks the arithmetic subset, not full byte/cmov\n        // behavior.\n        if (field.ORDER !== order)\n            throw new Error('Field.ORDER must match order: Fp == p, Fn == n');\n        validateField(field);\n        return field;\n    }\n    else {\n        return Field(order, { isLE });\n    }\n}\n/**\n * Validates basic CURVE shape and field membership, then creates fields.\n * This does not prove that the generator is on-curve, that subgroup/order data are consistent, or\n * that the curve equation itself is otherwise sane.\n * @param type - Curve family.\n * @param CURVE - Curve parameters.\n * @param curveOpts - Optional field overrides. See {@link FpFn}:\n *   - `Fp` (optional): Optional base-field override.\n *   - `Fn` (optional): Optional scalar-field override.\n * @param FpFnLE - Whether field encoding is little-endian.\n * @returns Frozen curve parameters and fields.\n * @throws If the curve parameters or field overrides are invalid. {@link Error}\n * @example\n * Build curve fields from raw constants before constructing a curve instance.\n *\n * ```ts\n * const curve = createCurveFields('weierstrass', {\n *   p: 17n,\n *   n: 19n,\n *   h: 1n,\n *   a: 2n,\n *   b: 2n,\n *   Gx: 5n,\n *   Gy: 1n,\n * });\n * ```\n */\nexport function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {\n    if (type !== 'weierstrass' && type !== 'edwards')\n        throw new Error('expected curve type \"weierstrass\" or \"edwards\"');\n    if (FpFnLE === undefined)\n        FpFnLE = type === 'edwards';\n    if (!CURVE || typeof CURVE !== 'object')\n        throw new Error(`expected valid ${type} CURVE object`);\n    // Validate before reading Fp/Fn so explicit null fails with an options-object error.\n    validateObject(curveOpts);\n    for (const p of ['p', 'n', 'h']) {\n        const val = CURVE[p];\n        if (!(isPosBig(val) && val !== _0n))\n            throw new Error(`CURVE.${p} must be positive bigint`);\n    }\n    const Fp = createField(CURVE.p, curveOpts.Fp, FpFnLE);\n    const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);\n    const _b = type === 'weierstrass' ? 'b' : 'd';\n    const params = ['Gx', 'Gy', 'a', _b];\n    for (const p of params) {\n        // @ts-ignore\n        if (!Fp.isValid(CURVE[p]))\n            throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);\n    }\n    CURVE = Object.freeze(Object.assign({}, CURVE));\n    return { CURVE, Fp, Fn };\n}\n/**\n * @param randomSecretKey - Secret-key generator.\n * @param getPublicKey - Public-key derivation helper.\n * @returns Keypair generator.\n * @example\n * Build a `keygen()` helper from existing secret-key and public-key primitives.\n *\n * ```ts\n * import { createKeygen } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const keygen = createKeygen(p256.utils.randomSecretKey, p256.getPublicKey);\n * const pair = keygen();\n * ```\n */\nexport function createKeygen(randomSecretKey, getPublicKey) {\n    return function keygen(seed) {\n        const secretKey = randomSecretKey(seed);\n        return { secretKey, publicKey: getPublicKey(secretKey) };\n    };\n}\n","/**\n * HMAC: RFC2104 message authentication code.\n * @module\n */\nimport { abytes, aexists, ahash, aoutput, clean, } from \"./utils.js\";\n/**\n * Internal class for HMAC.\n * Accepts any byte key, although RFC 2104 §3 recommends keys at least\n * `HashLen` bytes long.\n */\nexport class _HMAC {\n    oHash;\n    iHash;\n    blockLen;\n    outputLen;\n    canXOF = false;\n    finished = false;\n    destroyed = false;\n    constructor(hash, key) {\n        ahash(hash);\n        abytes(key, undefined, 'key');\n        this.iHash = hash.create();\n        if (typeof this.iHash.update !== 'function')\n            throw new Error('expected Hash instance');\n        this.blockLen = this.iHash.blockLen;\n        this.outputLen = this.iHash.outputLen;\n        const blockLen = this.blockLen;\n        const pad = new Uint8Array(blockLen);\n        // blockLen can be bigger than outputLen\n        pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36;\n        this.iHash.update(pad);\n        // By doing update (processing of the first block) of the outer hash here,\n        // we can re-use it between multiple calls via clone.\n        this.oHash = hash.create();\n        // Undo internal XOR && apply outer XOR\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36 ^ 0x5c;\n        this.oHash.update(pad);\n        clean(pad);\n    }\n    update(buf) {\n        aexists(this);\n        this.iHash.update(buf);\n        return this;\n    }\n    digestInto(out) {\n        aexists(this);\n        aoutput(out, this);\n        this.finished = true;\n        const buf = out.subarray(0, this.outputLen);\n        // Reuse the first outputLen bytes for the inner digest; the outer hash consumes them before\n        // overwriting that same prefix with the final tag, leaving any oversized tail untouched.\n        this.iHash.digestInto(buf);\n        this.oHash.update(buf);\n        this.oHash.digestInto(buf);\n        this.destroy();\n    }\n    digest() {\n        const out = new Uint8Array(this.oHash.outputLen);\n        this.digestInto(out);\n        return out;\n    }\n    _cloneInto(to) {\n        // Create new instance without calling constructor since the key\n        // is already in state and we don't know it.\n        to ||= Object.create(Object.getPrototypeOf(this), {});\n        const { oHash, iHash, finished, destroyed, blockLen, outputLen, canXOF } = this;\n        to = to;\n        to.finished = finished;\n        to.destroyed = destroyed;\n        to.blockLen = blockLen;\n        to.outputLen = outputLen;\n        to.canXOF = canXOF;\n        to.oHash = oHash._cloneInto(to.oHash);\n        to.iHash = iHash._cloneInto(to.iHash);\n        return to;\n    }\n    clone() {\n        return this._cloneInto();\n    }\n    destroy() {\n        this.destroyed = true;\n        this.oHash.destroy();\n        this.iHash.destroy();\n    }\n}\nexport const hmac = /* @__PURE__ */ (() => {\n    const hmac_ = ((hash, key, message) => new _HMAC(hash, key).update(message).digest());\n    hmac_.create = (hash, key) => new _HMAC(hash, key);\n    return hmac_;\n})();\n","/**\n * ASN.1 DER (Distinguished Encoding Rules) helpers for ECDSA signatures.\n * Only implements the tiny subset needed for `SEQUENCE(INTEGER r, INTEGER s)`.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { abignumber, abytes, asafenumber, astring, bytesToNumberBE, numberToHexUnpadded, validateObject, } from \"../utils.js\";\nconst _0n = /* @__PURE__ */ BigInt(0);\n/**\n * @param m - Error message.\n * @example\n * Throw a DER-specific error when signature parsing encounters invalid bytes.\n *\n * ```ts\n * new DERErr('bad der');\n * ```\n */\nexport class DERErr extends Error {\n    constructor(m = '') {\n        super(m);\n    }\n}\n// Plain const so the freezes can live inside the pure initializer of the `DER` export below:\n// bare top-level `Object.freeze(...)` calls would defeat tree-shaking for every importer.\nconst _DER = {\n    // asn.1 DER encoding utils\n    Err: DERErr,\n    // Basic building block is TLV (Tag-Length-Value)\n    _tlv: {\n        encode: (tag, data) => {\n            const { Err: E } = _DER;\n            asafenumber(tag, 'tag');\n            if (tag < 0 || tag > 255)\n                throw new E('tlv.encode: wrong tag');\n            astring(data, 'data');\n            // Internal helper: callers hand this already-validated hex payload, so we only enforce\n            // byte alignment here instead of re-validating every nibble.\n            if (data.length & 1)\n                throw new E('tlv.encode: unpadded data');\n            const dataLen = data.length / 2;\n            const len = numberToHexUnpadded(dataLen);\n            if ((len.length / 2) & 0b1000_0000)\n                throw new E('tlv.encode: long form length too big');\n            // length of length with long form flag\n            const lenLen = dataLen > 127 ? numberToHexUnpadded((len.length / 2) | 0b1000_0000) : '';\n            const t = numberToHexUnpadded(tag);\n            return t + lenLen + len + data;\n        },\n        // v - value, l - left bytes (unparsed)\n        decode(tag, data) {\n            const { Err: E } = _DER;\n            data = abytes(data, undefined, 'DER data');\n            let pos = 0;\n            if (tag < 0 || tag > 255)\n                throw new E('tlv.decode: wrong tag');\n            if (data.length < 2 || data[pos++] !== tag)\n                throw new E('tlv.decode: wrong tlv');\n            const first = data[pos++];\n            // First bit of first length byte is the short/long form flag.\n            const isLong = !!(first & 0b1000_0000);\n            let length = 0;\n            if (!isLong)\n                length = first;\n            else {\n                // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]\n                const lenLen = first & 0b0111_1111;\n                if (!lenLen)\n                    throw new E('tlv.decode(long): indefinite length not supported');\n                // This would overflow u32 in JS.\n                if (lenLen > 4)\n                    throw new E('tlv.decode(long): byte length is too big');\n                const lengthBytes = data.subarray(pos, pos + lenLen);\n                if (lengthBytes.length !== lenLen)\n                    throw new E('tlv.decode: length bytes not complete');\n                if (lengthBytes[0] === 0)\n                    throw new E('tlv.decode(long): zero leftmost byte');\n                for (const b of lengthBytes)\n                    length = (length << 8) | b;\n                pos += lenLen;\n                if (length < 128)\n                    throw new E('tlv.decode(long): not minimal encoding');\n            }\n            const v = data.subarray(pos, pos + length);\n            if (v.length !== length)\n                throw new E('tlv.decode: wrong value length');\n            return { v, l: data.subarray(pos + length) };\n        },\n    },\n    // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,\n    // since we always use positive integers here. It must always be empty:\n    // - add zero byte if exists\n    // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)\n    _int: {\n        encode(num) {\n            const { Err: E } = _DER;\n            abignumber(num);\n            if (num < _0n)\n                throw new E('integer: negative integers are not allowed');\n            let hex = numberToHexUnpadded(num);\n            // Pad with zero byte if negative flag is present\n            if (Number.parseInt(hex[0], 16) & 0b1000)\n                hex = '00' + hex;\n            if (hex.length & 1)\n                throw new E('unexpected DER parsing assertion: unpadded hex');\n            return hex;\n        },\n        decode(data) {\n            const { Err: E } = _DER;\n            if (data.length < 1)\n                throw new E('invalid signature integer: empty');\n            if (data[0] & 0b1000_0000)\n                throw new E('invalid signature integer: negative');\n            // Single-byte zero `00` is the canonical DER INTEGER encoding for zero.\n            if (data.length > 1 && data[0] === 0x00 && !(data[1] & 0b1000_0000))\n                throw new E('invalid signature integer: unnecessary leading zero');\n            return bytesToNumberBE(data);\n        },\n    },\n    toSig(bytes, maxScalarBytes) {\n        // parse DER signature\n        const { Err: E, _int: int, _tlv: tlv } = _DER;\n        if (maxScalarBytes !== undefined) {\n            asafenumber(maxScalarBytes, 'maxScalarBytes');\n            if (maxScalarBytes < 1)\n                throw new E('invalid signature: maxScalarBytes must be positive');\n        }\n        const data = abytes(bytes, undefined, 'signature');\n        const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);\n        if (seqLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        const { v: rBytes, l: rLeftBytes } = tlv.decode(0x02, seqBytes);\n        const { v: sBytes, l: sLeftBytes } = tlv.decode(0x02, rLeftBytes);\n        if (sLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        // Enforce curve-provided bounds before bytes-to-hex-to-BigInt conversion can amplify memory.\n        if (maxScalarBytes !== undefined &&\n            (rBytes.length > maxScalarBytes || sBytes.length > maxScalarBytes))\n            throw new E('invalid signature: integer too large');\n        return { r: int.decode(rBytes), s: int.decode(sBytes) };\n    },\n    hexFromSig(sig) {\n        const { _tlv: tlv, _int: int } = _DER;\n        validateObject(sig, { r: 'bigint', s: 'bigint' }, {}, 'sig');\n        const rs = tlv.encode(0x02, int.encode(sig.r));\n        const ss = tlv.encode(0x02, int.encode(sig.s));\n        const seq = rs + ss;\n        return tlv.encode(0x30, seq);\n    },\n};\n/**\n * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:\n *\n *     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]\n *\n * Docs: {@link https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/ | Let's Encrypt ASN.1 guide} and\n * {@link https://luca.ntop.org/Teaching/Appunti/asn1.html | Luca Deri's ASN.1 notes}.\n * @example\n * ASN.1 DER encoding utilities.\n *\n * ```ts\n * const der = DER.hexFromSig({ r: 1n, s: 2n });\n * ```\n */\nexport const DER = /* @__PURE__ */ (() => {\n    Object.freeze(_DER._tlv);\n    Object.freeze(_DER._int);\n    return Object.freeze(_DER);\n})();\n","/**\n * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.\n *\n * ### Design rationale for types\n *\n * * Interaction between classes from different curves should fail:\n *   `k256.Point.BASE.add(p256.Point.BASE)`\n * * For this purpose we want to use `instanceof` operator, which is fast and works during runtime\n * * Different calls of `curve()` would return different classes -\n *   `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,\n *   it won't affect others\n *\n * TypeScript can't infer types for classes created inside a function. Classes is one instance\n * of nominative types in TypeScript and interfaces only check for shape, so it's hard to create\n * unique type for every function call.\n *\n * We can use generic types via some param, like curve opts, but that would:\n *     1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)\n *     which is hard to debug.\n *     2. Params can be generic and we can't enforce them to be constant value:\n *     if somebody creates curve from non-constant params,\n *     it would be allowed to interact with other curves with non-constant params\n *\n * @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { hmac as nobleHmac } from '@noble/hashes/hmac.js';\nimport { ahash } from '@noble/hashes/utils.js';\nimport { abool, abytes, aInRange, bitLen, bitMask, bytesToHex, bytesToNumberBE, concatBytes, createHmacDrbg, hexToBytes, isBytes, validateObject, randomBytes as wcRandomBytes, } from \"../utils.js\";\nimport { createCurveFields, createKeygen, mulAddUnsafe, normalizeZ, probeRandomBytes, ScalarMultiplier, validatePointCons, } from \"./curve.js\";\nimport { DER } from \"./der.js\";\nimport { getMinHashLength, invertCt, mapHashToField } from \"./modular.js\";\n// DER codec lives in der.ts; re-exported here because ECDSA signatures are its main consumer.\nexport { DER, DERErr } from \"./der.js\";\n// We construct the basis so `den` is always positive and equals `n`,\n// but the `num` sign depends on the basis, not on the secret value.\n// Exact half-way cases round away from zero, which keeps the split symmetric\n// around the reduced-basis boundaries used by endomorphism decomposition.\nconst divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n) / den;\n/** Splits scalar for GLV endomorphism. */\nexport function _splitEndoScalar(k, basis, n) {\n    // Split scalar into two such that part is ~half bits: `abs(part) < sqrt(N)`\n    // Since part can be negative, we need to do this on point.\n    // Callers must provide a reduced GLV basis whose vectors satisfy\n    // `a + b * lambda ≡ 0 (mod n)`; this helper only sees the basis and `n`.\n    // Reject unreduced scalars instead of silently treating them mod n.\n    aInRange('scalar', k, _0n, n);\n    // TODO: verifyScalar function which consumes lambda\n    const [[a1, b1], [a2, b2]] = basis;\n    const c1 = divNearest(b2 * k, n);\n    const c2 = divNearest(-b1 * k, n);\n    // |k1|/|k2| is < sqrt(N), but can be negative.\n    // If we do `k1 mod N`, we'll get big scalar (`> sqrt(N)`): so, we do cheaper negation instead.\n    let k1 = k - c1 * a1 - c2 * a2;\n    let k2 = -c1 * b1 - c2 * b2;\n    const k1neg = k1 < _0n;\n    const k2neg = k2 < _0n;\n    if (k1neg)\n        k1 = -k1;\n    if (k2neg)\n        k2 = -k2;\n    // Double check that resulting scalar is less than half bits of N: the wNAF pair walk\n    // relies on the halves being short. This should only happen on wrong bases.\n    // Also, the math inside is complex enough that this guard is worth keeping.\n    const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n; // Half bits of N\n    if (k1 < _0n || k1 >= MAX_NUM || k2 < _0n || k2 >= MAX_NUM) {\n        throw new Error('splitScalar (endomorphism): failed for k');\n    }\n    return { k1neg, k1, k2neg, k2 };\n}\nfunction validateSigFormat(format) {\n    if (!['compact', 'recovered', 'der'].includes(format))\n        throw new Error('Signature format must be \"compact\", \"recovered\", or \"der\"');\n    return format;\n}\nfunction validateSigOpts(opts, def) {\n    validateObject(opts);\n    const optsn = {};\n    // Normalize only the declared option subset from `def`; unknown keys are\n    // intentionally ignored so shared / superset option bags stay valid here too.\n    // `extraEntropy` stays an opaque payload until the signing path consumes it.\n    for (let optName of Object.keys(def)) {\n        // @ts-ignore\n        optsn[optName] = opts[optName] === undefined ? def[optName] : opts[optName];\n    }\n    abool(optsn.lowS, 'lowS');\n    abool(optsn.prehash, 'prehash');\n    if (optsn.format !== undefined)\n        validateSigFormat(optsn.format);\n    return optsn;\n}\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _3n = /* @__PURE__ */ BigInt(3), _4n = /* @__PURE__ */ BigInt(4);\n/**\n * Creates weierstrass Point constructor, based on specified curve options.\n *\n * See {@link WeierstrassOpts}.\n * @param params - Curve parameters. See {@link WeierstrassOpts}.\n * @param extraOpts - Optional helpers and overrides. See {@link WeierstrassExtraOpts}.\n * @returns Weierstrass point constructor.\n * @throws If the curve parameters, overrides, or point codecs are invalid. {@link Error}\n *\n * @example\n * Construct a point type from explicit Weierstrass curve parameters.\n *\n * ```js\n * const opts = {\n *   p: 0xfffffffffffffffffffffffffffffffeffffac73n,\n *   n: 0x100000000000000000001b8fa16dfab9aca16b6b3n,\n *   h: 1n,\n *   a: 0n,\n *   b: 7n,\n *   Gx: 0x3b4c382ce37aa192a4019e763036f4f5dd4d7ebbn,\n *   Gy: 0x938cf935318fdced6bc28286531733c3f03c4feen,\n * };\n * const secp160k1_Point = weierstrass(opts);\n * ```\n */\nexport function weierstrass(params, extraOpts = {}) {\n    const validated = createCurveFields('weierstrass', params, extraOpts);\n    const Fp = validated.Fp;\n    const Fn = validated.Fn;\n    let CURVE = validated.CURVE;\n    const { h: cofactor, n: CURVE_ORDER } = CURVE;\n    validateObject(extraOpts, {}, {\n        allowInfinityPoint: 'boolean',\n        clearCofactor: 'function',\n        isTorsionFree: 'function',\n        fromBytes: 'function',\n        toBytes: 'function',\n        endo: 'object',\n        randomBytes: 'function',\n    });\n    // Snapshot every hook and take an owned copy of nested GLV configuration. Later mutations of\n    // the caller's options must not change arithmetic, subgroup, or codec policy.\n    const { endo: endoOpts, allowInfinityPoint, clearCofactor, isTorsionFree, fromBytes, toBytes, } = extraOpts;\n    const randomBytes = extraOpts.randomBytes === undefined ? wcRandomBytes : extraOpts.randomBytes;\n    if (endoOpts) {\n        if (!Fp.is0(CURVE.a) || typeof endoOpts.beta !== 'bigint' || !Array.isArray(endoOpts.basises)) {\n            throw new Error('invalid endo: expected \"beta\": bigint and \"basises\": array');\n        }\n    }\n    const endo = endoOpts\n        ? {\n            beta: endoOpts.beta,\n            basises: endoOpts.basises.map((basis) => [...basis]),\n        }\n        : undefined;\n    const lengths = getWLengths(Fp, Fn);\n    function assertCompressionIsSupported() {\n        if (!Fp.isOdd)\n            throw new Error('compression is not supported: Field does not have .isOdd()');\n    }\n    // Implements IEEE P1363 point encoding\n    function pointToBytes(_c, point, isCompressed) {\n        // Handle infinity before toAffine(), which maps ZERO to (0, 0) silently: without this the\n        // encoder would emit an all-zero byte string that decodes back as a different point. Only\n        // curves that opt into infinity as a public point value get the SEC 1 byte form.\n        if (point.is0()) {\n            if (!allowInfinityPoint)\n                throw new Error('bad point: ZERO');\n            return Uint8Array.of(0); // SEC 1 v2.0 §2.3.3\n        }\n        const { x, y } = point.toAffine();\n        const bx = Fp.toBytes(x);\n        abool(isCompressed, 'isCompressed');\n        if (isCompressed) {\n            assertCompressionIsSupported();\n            const hasEvenY = !Fp.isOdd(y);\n            return concatBytes(pprefix(hasEvenY), bx);\n        }\n        else {\n            return concatBytes(Uint8Array.of(0x04), bx, Fp.toBytes(y));\n        }\n    }\n    function pointFromBytes(bytes) {\n        abytes(bytes, undefined, 'Point');\n        const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths; // e.g. for 32-byte: 33, 65\n        const length = bytes.length;\n        const head = bytes[0];\n        const tail = bytes.subarray(1);\n        // SEC 1 v2.0 §2.3.4 decodes 0x00 as infinity, but §3.2.2 rejects infinity as a public key.\n        // Leaving 0x00 undecodable by default makes that rejection structural rather than a check:\n        // callers reuse this parser as the strict key boundary, and infinity is simply not\n        // expressible. Curves where infinity is a real wire value opt into the codec instead.\n        // secp256k1 crosstests show OpenSSL raw point codecs accept 0x00 too.\n        if (allowInfinityPoint && length === 1 && head === 0x00)\n            return { x: Fp.ZERO, y: Fp.ZERO };\n        // No actual validation is done here: use .assertValidity()\n        if (length === comp && (head === 0x02 || head === 0x03)) {\n            const x = Fp.fromBytes(tail);\n            if (!Fp.isValid(x))\n                throw new Error('bad point: is not on curve, wrong x');\n            const y2 = weierstrassEquation(x); // y² = x³ + ax + b\n            let y;\n            try {\n                y = Fp.sqrt(y2); // y = y² ^ (p+1)/4\n            }\n            catch (sqrtError) {\n                const err = sqrtError instanceof Error ? ': ' + sqrtError.message : '';\n                throw new Error('bad point: is not on curve, sqrt error' + err);\n            }\n            assertCompressionIsSupported();\n            const evenY = Fp.isOdd(y);\n            const evenH = (head & 1) === 1; // ECDSA-specific\n            if (evenH !== evenY)\n                y = Fp.neg(y);\n            return { x, y };\n        }\n        else if (length === uncomp && head === 0x04) {\n            // TODO: more checks\n            const L = Fp.BYTES;\n            const x = Fp.fromBytes(tail.subarray(0, L));\n            const y = Fp.fromBytes(tail.subarray(L, L * 2));\n            if (!isValidXY(x, y))\n                throw new Error('bad point: is not on curve');\n            return { x, y };\n        }\n        else {\n            throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);\n        }\n    }\n    const encodePoint = toBytes === undefined ? pointToBytes : toBytes;\n    const decodePoint = fromBytes === undefined ? pointFromBytes : fromBytes;\n    // Hoisted from double() / add(): curve params never change after construction.\n    // Koblitz curves (a=0, e.g. secp256k1) skip the three a-multiplications per operation;\n    // the selection depends only on public curve constants.\n    const b3 = Fp.mul(CURVE.b, _3n);\n    const mulA = Fp.is0(CURVE.a) ? (_) => Fp.ZERO : (x) => Fp.mul(CURVE.a, x);\n    function weierstrassEquation(x) {\n        const x2 = Fp.sqr(x);\n        const x3 = Fp.mul(x2, x);\n        return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b); // x³ + a * x + b\n    }\n    // TODO: move top-level\n    /** Checks whether equation holds for given x, y: y² == x³ + ax + b */\n    function isValidXY(x, y) {\n        const left = Fp.sqr(y);\n        const right = weierstrassEquation(x); // x³ + ax + b\n        return Fp.eql(left, right);\n    }\n    // Keep constructor-time generator validation cheap: callers are responsible for supplying the\n    // correct prime-order base point, while eager subgroup checks here would slow heavy module imports.\n    // Test 1: equation y² = x³ + ax + b should work for generator point.\n    if (!isValidXY(CURVE.Gx, CURVE.Gy))\n        throw new Error('bad curve params: generator point');\n    // Test 2: discriminant Δ part should be non-zero: 4a³ + 27b² != 0.\n    // Guarantees curve is genus-1, smooth (non-singular).\n    const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);\n    const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));\n    if (Fp.is0(Fp.add(_4a3, _27b2)))\n        throw new Error('bad curve params: a or b');\n    /** Asserts coordinate is valid: 0 <= n < Fp.ORDER. */\n    function acoord(title, n, banZero = false) {\n        if (!Fp.isValid(n) || (banZero && Fp.is0(n)))\n            throw new Error(`bad point coordinate ${title}`);\n        // Extension-field elements are objects. Keep point coordinates detached from caller-owned\n        // objects so their mutation cannot invalidate cached on-curve / subgroup checks. Primitive\n        // field elements (bigints in shipped prime fields) are already immutable values.\n        return typeof n === 'object' && n !== null ? Fp.create(n) : n;\n    }\n    function aprjpoint(other) {\n        if (!(other instanceof Point))\n            throw new Error('Weierstrass Point expected');\n    }\n    function splitEndoScalarN(k) {\n        if (!endo || !endo.basises)\n            throw new Error('no endo');\n        return _splitEndoScalar(k, endo.basises, Fn.ORDER);\n    }\n    /**\n     * Appends a (point, scalar) pair to the inputs of a vartime wNAF walk\n     * ({@link mulAddUnsafe}). With GLV endomorphism the scalar is split into two half-width\n     * pairs against P and ψ(P) = (β⋅x, y), halving the walk's shared doubling chain;\n     * split signs fold into the points.\n     */\n    function pushWnafPair(points, scalars, p, k) {\n        if (!Fn.isValid(k))\n            throw new RangeError('invalid scalar: out of range'); // 0 is valid\n        if (endo) {\n            const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(k);\n            const psi = new Point(Fp.mul(p.X, endo.beta), p.Y, p.Z);\n            points.push(k1neg ? p.negate() : p, k2neg ? psi.negate() : psi);\n            scalars.push(k1, k2);\n        }\n        else {\n            points.push(p);\n            scalars.push(k);\n        }\n    }\n    // Successful assertValidity() results are cached: Point instances are frozen at construction,\n    // so on-curve + subgroup facts cannot change afterwards. Only success is cached — invalid\n    // points re-throw on every call. This matters most for pairing curves, where subgroup checks\n    // cost a scalar multiplication and the same instance is re-validated across layers\n    // (signature fromBytes, pairingBatch) or across repeated verifies with a cached public key.\n    const validityCache = new WeakSet();\n    /**\n     * Projective Point works in 3d / projective (homogeneous) coordinates:(X, Y, Z) ∋ (x=X/Z, y=Y/Z).\n     * Default Point works in 2d / affine coordinates: (x, y).\n     * We're doing calculations in projective, because its operations don't require costly inversion.\n     */\n    class Point {\n        static BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);\n        static ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO);\n        static Fp = Fp;\n        static Fn = Fn;\n        X;\n        Y;\n        Z;\n        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n        constructor(X, Y, Z) {\n            this.X = acoord('x', X);\n            // This is not just about ZERO / infinity: ambient curves can have real\n            // finite points with y=0. Those points are 2-torsion, so they cannot lie\n            // in the odd prime-order subgroups this point type is meant to represent.\n            this.Y = acoord('y', Y, true);\n            this.Z = acoord('z', Z);\n            Object.freeze(this);\n        }\n        static CURVE() {\n            return CURVE;\n        }\n        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n        static fromAffine(p) {\n            const { x, y } = p || {};\n            if (!p || !Fp.isValid(x) || !Fp.isValid(y))\n                throw new Error('invalid affine point');\n            if (p instanceof Point)\n                throw new Error('projective point not allowed');\n            // (0, 0) would've produced (0, 0, 1) - instead, we need (0, 1, 0)\n            if (Fp.is0(x) && Fp.is0(y))\n                return Point.ZERO;\n            return new Point(x, y, Fp.ONE);\n        }\n        static fromBytes(bytes) {\n            const P = Point.fromAffine(decodePoint(abytes(bytes, undefined, 'point')));\n            P.assertValidity();\n            return P;\n        }\n        static fromHex(hex) {\n            return Point.fromBytes(hexToBytes(hex));\n        }\n        get x() {\n            return this.toAffine().x;\n        }\n        get y() {\n            return this.toAffine().y;\n        }\n        /**\n         * @param isLazy - true will defer table computation until the first multiplication\n         */\n        precompute(windowSize = 6, isLazy = true) {\n            wnaf.setWindowSize(this, windowSize);\n            if (!isLazy)\n                this.multiply(_3n); // random number\n            return this;\n        }\n        // TODO: return `this`\n        /** A point on curve is valid if it conforms to equation. */\n        assertValidity() {\n            const p = this;\n            if (p.is0()) {\n                // (0, 1, 0) aka ZERO is invalid in most contexts.\n                // In BLS, ZERO can be serialized, so we allow it.\n                // Keep the accepted infinity encoding canonical: projective-equivalent (X, Y, 0) points\n                // like (1, 1, 0) compare equal to ZERO, but only (0, 1, 0) should pass this guard.\n                if (allowInfinityPoint && Fp.is0(p.X) && Fp.eql(p.Y, Fp.ONE) && Fp.is0(p.Z))\n                    return;\n                throw new Error('bad point: ZERO');\n            }\n            if (validityCache.has(p))\n                return;\n            // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`\n            const { x, y } = p.toAffine();\n            if (!Fp.isValid(x) || !Fp.isValid(y))\n                throw new Error('bad point: x or y not field elements');\n            if (!isValidXY(x, y))\n                throw new Error('bad point: equation left != right');\n            if (!p.isTorsionFree())\n                throw new Error('bad point: not in prime-order subgroup');\n            validityCache.add(p);\n        }\n        hasEvenY() {\n            const { y } = this.toAffine();\n            if (!Fp.isOdd)\n                throw new Error(\"Field doesn't support isOdd\");\n            return !Fp.isOdd(y);\n        }\n        /** Compare one point to another. */\n        equals(other) {\n            aprjpoint(other);\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            const { X: X2, Y: Y2, Z: Z2 } = other;\n            const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));\n            const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));\n            return U1 && U2;\n        }\n        /** Flips point to one corresponding to (x, -y) in Affine coordinates. */\n        negate() {\n            return new Point(this.X, Fp.neg(this.Y), this.Z);\n        }\n        // Renes-Costello-Batina exception-free doubling formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 3\n        // Cost: 8M + 3S + 3*a + 2*b3 + 15add.\n        double() {\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            let t0 = Fp.mul(X1, X1); // step 1\n            let t1 = Fp.mul(Y1, Y1);\n            let t2 = Fp.mul(Z1, Z1);\n            let t3 = Fp.mul(X1, Y1);\n            t3 = Fp.add(t3, t3); // step 5\n            Z3 = Fp.mul(X1, Z1);\n            Z3 = Fp.add(Z3, Z3);\n            X3 = mulA(Z3);\n            Y3 = Fp.mul(b3, t2);\n            Y3 = Fp.add(X3, Y3); // step 10\n            X3 = Fp.sub(t1, Y3);\n            Y3 = Fp.add(t1, Y3);\n            Y3 = Fp.mul(X3, Y3);\n            X3 = Fp.mul(t3, X3);\n            Z3 = Fp.mul(b3, Z3); // step 15\n            t2 = mulA(t2);\n            t3 = Fp.sub(t0, t2);\n            t3 = mulA(t3);\n            t3 = Fp.add(t3, Z3);\n            Z3 = Fp.add(t0, t0); // step 20\n            t0 = Fp.add(Z3, t0);\n            t0 = Fp.add(t0, t2);\n            t0 = Fp.mul(t0, t3);\n            Y3 = Fp.add(Y3, t0);\n            t2 = Fp.mul(Y1, Z1); // step 25\n            t2 = Fp.add(t2, t2);\n            t0 = Fp.mul(t2, t3);\n            X3 = Fp.sub(X3, t0);\n            Z3 = Fp.mul(t2, t1);\n            Z3 = Fp.add(Z3, Z3); // step 30\n            Z3 = Fp.add(Z3, Z3);\n            return new Point(X3, Y3, Z3);\n        }\n        // Renes-Costello-Batina exception-free addition formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 1\n        // Cost: 12M + 0S + 3*a + 3*b3 + 23add.\n        add(other) {\n            aprjpoint(other);\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            const { X: X2, Y: Y2, Z: Z2 } = other;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            let t0 = Fp.mul(X1, X2); // step 1\n            let t1 = Fp.mul(Y1, Y2);\n            let t2 = Fp.mul(Z1, Z2);\n            let t3 = Fp.add(X1, Y1);\n            let t4 = Fp.add(X2, Y2); // step 5\n            t3 = Fp.mul(t3, t4);\n            t4 = Fp.add(t0, t1);\n            t3 = Fp.sub(t3, t4);\n            t4 = Fp.add(X1, Z1);\n            let t5 = Fp.add(X2, Z2); // step 10\n            t4 = Fp.mul(t4, t5);\n            t5 = Fp.add(t0, t2);\n            t4 = Fp.sub(t4, t5);\n            t5 = Fp.add(Y1, Z1);\n            X3 = Fp.add(Y2, Z2); // step 15\n            t5 = Fp.mul(t5, X3);\n            X3 = Fp.add(t1, t2);\n            t5 = Fp.sub(t5, X3);\n            Z3 = mulA(t4);\n            X3 = Fp.mul(b3, t2); // step 20\n            Z3 = Fp.add(X3, Z3);\n            X3 = Fp.sub(t1, Z3);\n            Z3 = Fp.add(t1, Z3);\n            Y3 = Fp.mul(X3, Z3);\n            t1 = Fp.add(t0, t0); // step 25\n            t1 = Fp.add(t1, t0);\n            t2 = mulA(t2);\n            t4 = Fp.mul(b3, t4);\n            t1 = Fp.add(t1, t2);\n            t2 = Fp.sub(t0, t2); // step 30\n            t2 = mulA(t2);\n            t4 = Fp.add(t4, t2);\n            t0 = Fp.mul(t1, t4);\n            Y3 = Fp.add(Y3, t0);\n            t0 = Fp.mul(t5, t4); // step 35\n            X3 = Fp.mul(t3, X3);\n            X3 = Fp.sub(X3, t0);\n            t0 = Fp.mul(t3, t1);\n            Z3 = Fp.mul(t5, Z3);\n            Z3 = Fp.add(Z3, t0); // step 40\n            return new Point(X3, Y3, Z3);\n        }\n        subtract(other) {\n            // Validate before calling `negate()` so wrong inputs fail with the point guard\n            // instead of leaking a foreign `negate()` error.\n            aprjpoint(other);\n            return this.add(other.negate());\n        }\n        is0() {\n            return this.equals(Point.ZERO);\n        }\n        /**\n         * Constant time multiplication.\n         * Uses precomputed tables (signed fixed-window wNAF) when available.\n         * Uses scalar blinding and avoids endomorphism splitting in the secret-scalar path.\n         * @param scalar - by which the point would be multiplied\n         * @returns New point\n         */\n        multiply(scalar) {\n            // Keep the subgroup-scalar contract strict instead of reducing 0 / n to ZERO.\n            // In key/signature-style callers, those values usually mean broken hash/scalar plumbing,\n            // and failing closed is safer than silently producing the identity point.\n            if (!Fn.isValidNot0(scalar))\n                throw new RangeError('invalid scalar: out of range'); // 0 is invalid\n            const { p, f } = wnaf.mulSecret(this, scalar, cofactor, normalize);\n            return normalize([p, f])[0];\n        }\n        /**\n         * Non-constant-time multiplication. Uses width-4 wNAF with GLV endomorphism splitting\n         * when available (two half-width scalars sharing one halved doubling chain).\n         * It's faster, but should only be used when you don't care about\n         * an exposed secret key e.g. sig verification, which works over *public* keys.\n         */\n        multiplyUnsafe(scalar) {\n            const p = this;\n            const sc = scalar;\n            // Public-scalar callers may need 0, but n and larger values stay rejected here too.\n            // Reducing them mod n would turn bad caller input into an accidental identity point.\n            if (!Fn.isValid(sc))\n                throw new RangeError('invalid scalar: out of range'); // 0 is valid\n            if (sc === _0n || p.is0())\n                return Point.ZERO;\n            if (sc === _1n)\n                return p;\n            if (wnaf.hasWindowSize(this))\n                return wnaf.mulUnsafe(p, sc, normalize); // precomputes\n            const points = [];\n            const scalars = [];\n            pushWnafPair(points, scalars, p, sc);\n            return mulAddUnsafe(Point, points, scalars);\n        }\n        /**\n         * Non-constant-time double-scalar multiplication `a⋅this + b⋅other` (Strauss–Shamir).\n         * Both walks share one doubling chain via {@link mulAddUnsafe}, and GLV endomorphism\n         * (when available) halves the chain again by splitting each scalar into two half-width\n         * parts. Used by ECDSA verification and public-key recovery for `R = u1⋅G + u2⋅P`.\n         * Only for public scalars.\n         */\n        mulAddUnsafe(a, other, b) {\n            aprjpoint(other);\n            const points = [];\n            const scalars = [];\n            pushWnafPair(points, scalars, this, a);\n            pushWnafPair(points, scalars, other, b);\n            return mulAddUnsafe(Point, points, scalars);\n        }\n        /**\n         * Converts Projective point to affine (x, y) coordinates.\n         * (X, Y, Z) ∋ (x=X/Z, y=Y/Z).\n         * @param invertedZ - Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch\n         */\n        toAffine(invertedZ) {\n            const p = this;\n            let iz = invertedZ;\n            if (iz != null && !Fp.isValid(iz))\n                throw new RangeError('\"invertedZ\" expected valid field element');\n            const { X, Y, Z } = p;\n            // Fast-path for normalized points\n            if (Fp.eql(Z, Fp.ONE))\n                return { x: X, y: Y };\n            const is0 = p.is0();\n            // If invZ was 0, we return zero point. However we still want to execute\n            // all operations, so we replace invZ with a random number, 1.\n            if (iz == null)\n                iz = is0 ? Fp.ONE : Fp.inv(Z);\n            const x = Fp.mul(X, iz);\n            const y = Fp.mul(Y, iz);\n            const zz = Fp.mul(Z, iz);\n            if (is0)\n                return { x: Fp.ZERO, y: Fp.ZERO };\n            if (!Fp.eql(zz, Fp.ONE))\n                throw new Error('invZ was invalid');\n            return { x, y };\n        }\n        /**\n         * Checks whether Point is free of torsion elements (is in prime subgroup).\n         * Always torsion-free for cofactor=1 curves.\n         */\n        isTorsionFree() {\n            if (cofactor === _1n)\n                return true;\n            if (isTorsionFree)\n                return isTorsionFree(Point, this);\n            // unsafe() will use the uncached wNAF path internally, since CURVE_ORDER >= Fn.ORDER\n            return wnaf.mulUnsafe(this, CURVE_ORDER).is0();\n        }\n        clearCofactor() {\n            if (cofactor === _1n)\n                return this; // Fast-path\n            if (clearCofactor)\n                return clearCofactor(Point, this);\n            // Default fallback assumes the cofactor fits the usual subgroup-scalar\n            // multiplyUnsafe() contract. Curves with larger / structured cofactors\n            // should define a clearCofactor override anyway (e.g. psi/Frobenius maps).\n            return this.multiplyUnsafe(cofactor);\n        }\n        isSmallOrder() {\n            if (cofactor === _1n)\n                return this.is0(); // Fast-path\n            return this.clearCofactor().is0();\n        }\n        toBytes(isCompressed = true) {\n            abool(isCompressed, 'isCompressed');\n            // assertValidity() covers on-curve and subgroup membership. The encoder below repeats the\n            // infinity check rather than relying on this call, so it stays correct for any caller.\n            this.assertValidity();\n            return encodePoint(Point, this, isCompressed);\n        }\n        toHex(isCompressed = true) {\n            return bytesToHex(this.toBytes(isCompressed));\n        }\n        toString() {\n            return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;\n        }\n    }\n    const normalize = (points) => normalizeZ(Point, points);\n    const wnaf = new ScalarMultiplier(Point, randomBytes);\n    // Enable W=6 wNAF precomputes. Slows down first publicKey computation.\n    // Disable for tiny toy curves, with scalar fields < 6 bits.\n    if (wnaf.bits >= 6)\n        Point.BASE.precompute(6);\n    Object.freeze(Point.prototype);\n    Object.freeze(Point);\n    return Point;\n}\n// Points start with byte 0x02 when y is even; otherwise 0x03\nfunction pprefix(hasEvenY) {\n    return Uint8Array.of(hasEvenY ? 0x02 : 0x03);\n}\nfunction getWLengths(Fp, Fn) {\n    return {\n        secretKey: Fn.BYTES,\n        publicKey: 1 + Fp.BYTES,\n        publicKeyUncompressed: 1 + 2 * Fp.BYTES,\n        publicKeyHasPrefix: true,\n        // Raw compact `(r || s)` signature width; DER and recovered signatures use\n        // different lengths outside this helper.\n        signature: 2 * Fn.BYTES,\n    };\n}\n/**\n * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.\n * This helper ensures no signature functionality is present. Less code, smaller bundle size.\n * @param Point - Weierstrass point constructor.\n * @param ecdhOpts - Optional randomness helpers:\n *   - `randomBytes` (optional): Optional RNG override.\n * @returns ECDH helper namespace.\n * @example\n * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.\n *\n * ```ts\n * import { ecdh } from '@noble/curves/abstract/weierstrass.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const dh = ecdh(p256.Point);\n * const alice = dh.keygen();\n * const shared = dh.getSharedSecret(alice.secretKey, alice.publicKey);\n * ```\n */\nexport function ecdh(Point, ecdhOpts = {}) {\n    validatePointCons(Point);\n    const { Fn } = Point;\n    const randomBytes_ = ecdhOpts.randomBytes === undefined ? wcRandomBytes : ecdhOpts.randomBytes;\n    // Keep the advertised seed length aligned with mapHashToField(), which keeps a hard 16-byte\n    // minimum even on toy curves.\n    const lengths = Object.assign(getWLengths(Point.Fp, Fn), {\n        seed: Math.max(getMinHashLength(Fn.ORDER), 16),\n    });\n    function isValidSecretKey(secretKey) {\n        try {\n            const num = Fn.fromBytes(secretKey);\n            return Fn.isValidNot0(num);\n        }\n        catch (error) {\n            return false;\n        }\n    }\n    function isValidPublicKey(publicKey, isCompressed) {\n        const { publicKey: comp, publicKeyUncompressed } = lengths;\n        try {\n            const l = publicKey.length;\n            if (isCompressed === true && l !== comp)\n                return false;\n            if (isCompressed === false && l !== publicKeyUncompressed)\n                return false;\n            // SEC 1 §3.2.2: the identity is never a valid public key, even on curves whose codec\n            // can decode it.\n            return !Point.fromBytes(publicKey).is0();\n        }\n        catch (error) {\n            return false;\n        }\n    }\n    /**\n     * Produces cryptographically secure secret key from random of size\n     * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.\n     */\n    function randomSecretKey(seed) {\n        seed = seed === undefined ? randomBytes_(lengths.seed) : seed;\n        return mapHashToField(abytes(seed, lengths.seed, 'seed'), Fn.ORDER);\n    }\n    /**\n     * Computes public key for a secret key. Checks for validity of the secret key.\n     * @param isCompressed - whether to return compact (default), or full key\n     * @returns Public key, full when isCompressed=false; short when isCompressed=true\n     */\n    function getPublicKey(secretKey, isCompressed = true) {\n        return Point.BASE.multiply(Fn.fromBytes(secretKey)).toBytes(isCompressed);\n    }\n    /**\n     * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.\n     */\n    function isProbPub(item) {\n        const { secretKey, publicKey, publicKeyUncompressed } = lengths;\n        const allowedLengths = Fn._lengths;\n        if (!isBytes(item))\n            return undefined;\n        const l = abytes(item, undefined, 'key').length;\n        const isPub = l === publicKey || l === publicKeyUncompressed;\n        const isSec = l === secretKey || !!allowedLengths?.includes(l);\n        // P-521 accepts both 65- and 66-byte secret keys, so overlapping lengths stay ambiguous.\n        if (isPub && isSec)\n            return undefined;\n        return isPub;\n    }\n    /**\n     * ECDH (Elliptic Curve Diffie Hellman).\n     * Computes encoded shared point from secret key A and public key B.\n     * Checks: 1) secret key validity 2) shared key is on-curve.\n     * Does NOT hash the result or expose the SEC 1 x-coordinate-only `z`.\n     * Returns the encoded shared point on purpose: callers that need `x_P`\n     * can derive it from the encoded point, but `x_P` alone cannot recover the\n     * point/parity back.\n     * This helper only exposes the fully validated public-key path, not cofactor DH.\n     * @param isCompressed - whether to return compact (default), or full key\n     * @returns shared point encoding\n     */\n    function getSharedSecret(secretKeyA, publicKeyB, isCompressed = true) {\n        if (isProbPub(secretKeyA) === true)\n            throw new Error('first arg must be private key');\n        if (isProbPub(publicKeyB) === false)\n            throw new Error('second arg must be public key');\n        const s = Fn.fromBytes(secretKeyA);\n        const b = Point.fromBytes(publicKeyB); // checks for being on-curve\n        if (b.is0())\n            throw new Error('invalid public key: point at infinity');\n        return b.multiply(s).toBytes(isCompressed);\n    }\n    const utils = {\n        isValidSecretKey,\n        isValidPublicKey,\n        randomSecretKey,\n    };\n    const keygen = createKeygen(randomSecretKey, getPublicKey);\n    Object.freeze(utils);\n    Object.freeze(lengths);\n    return Object.freeze({ getPublicKey, getSharedSecret, keygen, Point, utils, lengths });\n}\n/**\n * Creates ECDSA signing interface for given elliptic curve `Point` and `hash` function.\n *\n * @param Point - created using {@link weierstrass} function\n * @param hash - used for 1) message prehash-ing 2) k generation in `sign`, using hmac_drbg(hash)\n * @param ecdsaOpts - rarely needed, see {@link ECDSAOpts}:\n *   - `lowS`: Default low-S policy.\n *   - `hmac`: HMAC implementation used by RFC6979 DRBG.\n *   - `randomBytes`: Optional RNG override.\n *   - `bits2int`: Optional hash-to-int conversion override.\n *   - `bits2int_modN`: Optional hash-to-int-mod-n conversion override.\n *\n * @returns ECDSA helper namespace.\n * @example\n * Create an ECDSA signer/verifier bundle for one curve implementation.\n *\n * ```ts\n * import { ecdsa } from '@noble/curves/abstract/weierstrass.js';\n * import { p256 } from '@noble/curves/nist.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const p256ecdsa = ecdsa(p256.Point, sha256);\n * const { secretKey, publicKey } = p256ecdsa.keygen();\n * const msg = new TextEncoder().encode('hello noble');\n * const sig = p256ecdsa.sign(msg, secretKey);\n * const isValid = p256ecdsa.verify(sig, msg, publicKey);\n * ```\n */\nexport function ecdsa(Point, hash, ecdsaOpts = {}) {\n    validatePointCons(Point);\n    // Custom hash / bits2int hooks are treated as pure functions over validated caller-owned bytes.\n    const hash_ = hash;\n    ahash(hash_);\n    validateObject(ecdsaOpts, {}, {\n        hmac: 'function',\n        lowS: 'boolean',\n        randomBytes: 'function',\n        bits2int: 'function',\n        bits2int_modN: 'function',\n    });\n    const opts = Object.assign({}, ecdsaOpts);\n    const randomBytes = opts.randomBytes === undefined ? wcRandomBytes : opts.randomBytes;\n    const hmac = opts.hmac === undefined\n        ? (key, msg) => nobleHmac(hash_, key, msg)\n        : opts.hmac;\n    const { Fp, Fn } = Point;\n    const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;\n    // Nonce-inversion blinding in k2sig draws `getMinHashLength(n)` bytes per sign. Probe the RNG\n    // once (see {@link probeRandomBytes}, shared with ScalarMultiplier): in environments without\n    // working randomness, signing downgrades to Fermat inversion (invertCt) instead of throwing on\n    // every sign(). The shape of returned bytes is still validated (by mapHashToField) on every\n    // blinded call, where breakage fails closed.\n    const blindLength = getMinHashLength(CURVE_ORDER);\n    const csprng = probeRandomBytes(randomBytes, blindLength);\n    const { keygen, getPublicKey, getSharedSecret, utils, lengths } = ecdh(Point, opts);\n    const defaultSigOpts = {\n        prehash: true,\n        lowS: typeof opts.lowS === 'boolean' ? opts.lowS : true,\n        format: 'compact',\n        extraEntropy: false,\n    };\n    // SEC 1 4.1.6 public-key recovery tries x = r + jn for j = 0..h. Our recovered-signature\n    // format only stores one overflow bit, so it can only distinguish q.x = r from q.x = r + n.\n    // A third lift would have the form q.x = r + 2n. Since valid ECDSA r is in 1..n-1, the\n    // smallest such lift is 1 + 2n, not 2n.\n    const hasLargeRecoveryLifts = CURVE_ORDER * _2n + _1n < Fp.ORDER;\n    function isBiggerThanHalfOrder(number) {\n        const HALF = CURVE_ORDER >> _1n;\n        return number > HALF;\n    }\n    function validateRS(title, num) {\n        if (!Fn.isValidNot0(num))\n            throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);\n        return num;\n    }\n    function assertFieldSignIsSupported() {\n        if (!Fp.isOdd)\n            throw new Error(\"Field doesn't support isOdd\");\n    }\n    // Recovery id of an affine point (x, y) whose x reduces to signature `r` mod n:\n    // bit 0 = y parity, bit 1 = x overflowed the group order (x = r + n).\n    function getRecoveryBit(x, y, r) {\n        assertFieldSignIsSupported();\n        return (x === r ? 0 : 2) | Number(Fp.isOdd(y));\n    }\n    function assertRecoverableCurve() {\n        // ECDSA recovery only supports curves where the current recovery id can distinguish\n        // q.x = r and q.x = r + n; larger lifts may need additional `r + n*i` branches.\n        // SEC 1 4.1.6 recovers candidates via x = r + jn, but this format only encodes j = 0 or 1.\n        // The next possible candidate is q.x = r + 2n, and its smallest valid value is 1 + 2n.\n        // To easily get i, we either need to:\n        // a. increase amount of valid recid values (4, 5...); OR\n        // b. prohibit recovered signatures for those curves.\n        if (hasLargeRecoveryLifts)\n            throw new Error('\"recovered\" sig type is not supported for cofactor >2 curves');\n    }\n    function validateSigLength(bytes, format) {\n        validateSigFormat(format);\n        const size = lengths.signature;\n        const sizer = format === 'compact' ? size : format === 'recovered' ? size + 1 : undefined;\n        return abytes(bytes, sizer);\n    }\n    /**\n     * ECDSA signature with its (r, s) properties. Supports compact, recovered & DER representations.\n     */\n    class Signature {\n        r;\n        s;\n        recovery;\n        constructor(r, s, recovery) {\n            this.r = validateRS('r', r); // r in [1..N-1];\n            this.s = validateRS('s', s); // s in [1..N-1];\n            if (recovery != null) {\n                assertRecoverableCurve();\n                if (![0, 1, 2, 3].includes(recovery))\n                    throw new Error('invalid recovery id');\n                this.recovery = recovery;\n            }\n            Object.freeze(this);\n        }\n        static fromBytes(bytes, format = defaultSigOpts.format) {\n            validateSigLength(bytes, format);\n            let recid;\n            if (format === 'der') {\n                // Valid scalar INTEGERs use at most Fn.BYTES plus one DER sign-padding byte. Keep the\n                // total bound conservative so malformed inputs are rejected before parsing any INTEGER.\n                if (bytes.length > 2 * Fn.BYTES + 16)\n                    throw new DER.Err('invalid signature: DER signature too long');\n                const { r, s } = DER.toSig(abytes(bytes), Fn.BYTES + 1);\n                return new Signature(r, s);\n            }\n            if (format === 'recovered') {\n                recid = bytes[0];\n                format = 'compact';\n                bytes = bytes.subarray(1);\n            }\n            const L = lengths.signature / 2;\n            const r = bytes.subarray(0, L);\n            const s = bytes.subarray(L, L * 2);\n            return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);\n        }\n        static fromHex(hex, format) {\n            return this.fromBytes(hexToBytes(hex), format);\n        }\n        assertRecovery() {\n            const { recovery } = this;\n            if (recovery == null)\n                throw new Error('invalid recovery id: must be present');\n            return recovery;\n        }\n        addRecoveryBit(recovery) {\n            return new Signature(this.r, this.s, recovery);\n        }\n        // Unlike the top-level helper below, this method expects a digest that has\n        // already been hashed to the curve's message representative.\n        recoverPublicKey(messageHash) {\n            const { r, s } = this;\n            const recovery = this.assertRecovery();\n            const radj = recovery === 2 || recovery === 3 ? r + CURVE_ORDER : r;\n            if (!Fp.isValid(radj))\n                throw new Error('invalid recovery id: sig.r+curve.n != R.x');\n            const x = Fp.toBytes(radj);\n            const R = Point.fromBytes(concatBytes(pprefix((recovery & 1) === 0), x));\n            const ir = Fn.inv(radj); // r^-1\n            const h = bits2int_modN(abytes(messageHash, undefined, 'msgHash')); // Truncate hash\n            const u1 = Fn.create(-h * ir); // -hr^-1\n            const u2 = Fn.create(s * ir); // sr^-1\n            // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1). unsafe is fine: there is no private data.\n            const Q = Point.BASE.mulAddUnsafe(u1, R, u2);\n            if (Q.is0())\n                throw new Error('invalid recovery: point at infinify');\n            Q.assertValidity();\n            return Q;\n        }\n        // Signatures should be low-s, to prevent malleability.\n        hasHighS() {\n            return isBiggerThanHalfOrder(this.s);\n        }\n        toBytes(format = defaultSigOpts.format) {\n            validateSigFormat(format);\n            if (format === 'der')\n                return hexToBytes(DER.hexFromSig(this));\n            const { r, s } = this;\n            const rb = Fn.toBytes(r);\n            const sb = Fn.toBytes(s);\n            if (format === 'recovered') {\n                assertRecoverableCurve();\n                return concatBytes(Uint8Array.of(this.assertRecovery()), rb, sb);\n            }\n            return concatBytes(rb, sb);\n        }\n        toHex(format) {\n            return bytesToHex(this.toBytes(format));\n        }\n    }\n    Object.freeze(Signature.prototype);\n    Object.freeze(Signature);\n    // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.\n    // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.\n    // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.\n    // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors\n    const bits2int = opts.bits2int === undefined\n        ? function bits2int_def(bytes) {\n            // Our custom check \"just in case\", for protection against DoS\n            if (bytes.length > 8192)\n                throw new Error('input is too large');\n            // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)\n            // for some cases, since bytes.length * 8 is not actual bitLength.\n            const num = bytesToNumberBE(bytes); // check for == u8 done here\n            const delta = bytes.length * 8 - fnBits; // truncate to nBitLength leftmost bits\n            return delta > 0 ? num >> BigInt(delta) : num;\n        }\n        : opts.bits2int;\n    const bits2int_modN = opts.bits2int_modN === undefined\n        ? function bits2int_modN_def(bytes) {\n            return Fn.create(bits2int(bytes)); // can't use bytesToNumberBE here\n        }\n        : opts.bits2int_modN;\n    const ORDER_MASK = bitMask(fnBits);\n    // Pads output with zero as per spec.\n    /** Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`. */\n    function int2octets(num) {\n        aInRange('num < 2^' + fnBits, num, _0n, ORDER_MASK);\n        return Fn.toBytes(num);\n    }\n    function validateMsgAndHash(message, prehash) {\n        abytes(message, undefined, 'message');\n        return (prehash ? abytes(hash_(message), undefined, 'prehashed message') : message);\n    }\n    /**\n     * Steps A, D of RFC6979 3.2.\n     * Creates RFC6979 seed; converts msg/privKey to numbers.\n     * Used only in sign, not in verify.\n     *\n     * Warning: we cannot assume here that message has same amount of bytes as curve order,\n     * this will be invalid at least for P521. Also it can be bigger for P224 + SHA256.\n     */\n    function prepSig(message, secretKey, opts) {\n        const { lowS, prehash, extraEntropy } = validateSigOpts(opts, defaultSigOpts);\n        message = validateMsgAndHash(message, prehash); // RFC6979 3.2 A: h1 = H(m)\n        // We can't later call bits2octets, since nested bits2int is broken for curves\n        // with fnBits % 8 !== 0. Because of that, we unwrap it here as int2octets call.\n        // const bits2octets = (bits) => int2octets(bits2int_modN(bits))\n        const h1int = bits2int_modN(message);\n        const d = Fn.fromBytes(secretKey); // validate secret key, convert to bigint\n        if (!Fn.isValidNot0(d))\n            throw new Error('invalid private key');\n        const seedArgs = [int2octets(d), int2octets(h1int)];\n        // extraEntropy. RFC6979 3.6: additional k' (optional).\n        if (extraEntropy != null && extraEntropy !== false) {\n            // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')\n            // gen random bytes OR pass as-is\n            const e = extraEntropy === true ? randomBytes(lengths.secretKey) : extraEntropy;\n            seedArgs.push(abytes(e, undefined, 'extraEntropy')); // check for being bytes\n        }\n        const seed = concatBytes(...seedArgs); // Step D of RFC6979 3.2\n        const m = h1int; // no need to call bits2int second time here, it is inside truncateHash!\n        // Converts signature params into point w r/s, checks result for validity.\n        // To transform k => Signature:\n        // q = k⋅G\n        // r = q.x mod n\n        // s = k^-1(m + rd) mod n\n        // The nonce inversion is blinded: with random b ∈ [1,n−1], s = (bk)^-1(bm + bdr) per\n        // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. Fn.inv()'s extended-Euclidean\n        // loop count depends on its input (cf. Minerva), but here it only ever sees b·k — uniformly\n        // random, independent of k — so its timing reveals nothing about the nonce; b also masks d in\n        // the products. Without a CSPRNG (probed in ecdsa()) we fall back to Fermat inversion\n        // (invertCt), whose control flow is data-independent, at ~4x the inversion cost.\n        function k2sig(kBytes) {\n            // RFC 6979 Section 3.2, step 3: k = bits2int(T)\n            // Important: all mod() calls here must be done over N\n            const k = bits2int(kBytes); // Cannot use fields methods, since it is group element\n            if (!Fn.isValidNot0(k))\n                return; // Valid scalars (including k) must be in 1..N-1\n            const q = Point.BASE.multiply(k).toAffine(); // q = k⋅G\n            const r = Fn.create(q.x); // r = q.x mod n\n            if (r === _0n)\n                return;\n            let s;\n            if (csprng !== undefined) {\n                // mapHashToField maps 1.5x-order-length uniform bytes into [1, n-1], negligible bias.\n                const b = bytesToNumberBE(mapHashToField(csprng(blindLength), CURVE_ORDER));\n                const ibk = Fn.inv(Fn.mul(b, k)); // (bk)^-1: inversion input is decorrelated from k\n                const bm = Fn.mul(b, m);\n                const bd = Fn.mul(b, d);\n                s = Fn.create(ibk * Fn.create(bm + bd * r)); // s = (bk)^-1(bm + bdr) = k^-1(m + rd) mod n\n            }\n            else {\n                const ik = invertCt(k, CURVE_ORDER); // k^-1 mod n with data-independent control flow\n                s = Fn.create(ik * Fn.create(m + r * d)); // s = k^-1(m + rd) mod n\n            }\n            if (s === _0n)\n                return;\n            let recovery = getRecoveryBit(q.x, q.y, r); // recovery bit (2 or 3 when q.x>n)\n            let normS = s;\n            if (lowS && isBiggerThanHalfOrder(s)) {\n                normS = Fn.neg(s); // if lowS was passed, ensure s is always in the bottom half of N\n                recovery ^= 1;\n            }\n            return new Signature(r, normS, hasLargeRecoveryLifts ? undefined : recovery);\n        }\n        return { seed, k2sig };\n    }\n    /**\n     * Signs a message or message hash with a secret key.\n     * With the default `prehash: true`, raw message bytes are hashed internally;\n     * only `{ prehash: false }` expects a caller-supplied digest.\n     *\n     * ```\n     * sign(m, d) where\n     *   k = rfc6979_hmac_drbg(m, d)\n     *   (x, y) = G × k\n     *   r = x mod n\n     *   s = (m + dr) / k mod n\n     * ```\n     */\n    function sign(message, secretKey, opts = {}) {\n        const { seed, k2sig } = prepSig(message, secretKey, opts); // Steps A, D of RFC6979 3.2.\n        const drbg = createHmacDrbg(hash_.outputLen, Fn.BYTES, hmac);\n        const sig = drbg(seed, k2sig); // Steps B, C, D, E, F, G\n        return sig.toBytes(opts.format);\n    }\n    /**\n     * Verifies a signature against message and public key.\n     * Rejects lowS signatures by default: see {@link ECDSAVerifyOpts}.\n     * Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:\n     *\n     * ```\n     * verify(r, s, h, P) where\n     *   u1 = hs^-1 mod n\n     *   u2 = rs^-1 mod n\n     *   R = u1⋅G + u2⋅P\n     *   mod(R.x, n) == r\n     * ```\n     */\n    function verify(signature, message, publicKey, opts = {}) {\n        const { lowS, prehash, format } = validateSigOpts(opts, defaultSigOpts);\n        publicKey = abytes(publicKey, undefined, 'publicKey');\n        message = validateMsgAndHash(message, prehash);\n        if (!isBytes(signature)) {\n            const end = signature instanceof Signature ? ', use sig.toBytes()' : '';\n            throw new Error('verify expects Uint8Array signature' + end);\n        }\n        validateSigLength(signature, format); // execute this twice because we want loud error\n        try {\n            const sig = Signature.fromBytes(signature, format);\n            const P = Point.fromBytes(publicKey);\n            // SEC 1 verification keys must not be the identity, even when the generic point decoder\n            // permits infinity for another protocol (for example, a pairing curve).\n            if (P.is0())\n                return false;\n            if (lowS && sig.hasHighS())\n                return false;\n            const { r, s } = sig;\n            const h = bits2int_modN(message); // mod n, not mod p\n            const is = Fn.inv(s); // s^-1 mod n\n            const u1 = Fn.create(h * is); // u1 = hs^-1 mod n\n            const u2 = Fn.create(r * is); // u2 = rs^-1 mod n\n            const R = Point.BASE.mulAddUnsafe(u1, P, u2); // u1⋅G + u2⋅P, joint Strauss–Shamir\n            if (R.is0())\n                return false;\n            const q = R.toAffine();\n            const v = Fn.create(q.x); // v = R.x mod n\n            if (v !== r)\n                return false;\n            // R is the exact point `recoverPublicKey(r, recid)` reconstructs (sR = hG + rP),\n            // so binding the signature to its recovery id only needs R's parity/overflow bits.\n            if (format === 'recovered' && sig.recovery !== getRecoveryBit(q.x, q.y, r))\n                return false;\n            return true;\n        }\n        catch (e) {\n            return false;\n        }\n    }\n    function recoverPublicKey(signature, message, opts = {}) {\n        // Top-level recovery mirrors `sign()` / `verify()`: it hashes raw message\n        // bytes first unless the caller passes `{ prehash: false }`.\n        const { prehash } = validateSigOpts(opts, defaultSigOpts);\n        message = validateMsgAndHash(message, prehash);\n        return Signature.fromBytes(signature, 'recovered').recoverPublicKey(message).toBytes();\n    }\n    // utils.isValidPublicKey() already rejects the identity, so ECDSA needs no shadow copy.\n    return Object.freeze({\n        keygen,\n        getPublicKey,\n        getSharedSecret,\n        utils,\n        lengths,\n        Point,\n        sign,\n        verify,\n        recoverPublicKey,\n        Signature,\n        hash: hash_,\n    });\n}\n","/**\n * SECG secp256k1. See [pdf](https://www.secg.org/sec2-v2.pdf).\n *\n * Belongs to Koblitz curves: it has efficiently-computable GLV endomorphism ψ,\n * check out {@link EndomorphismOpts}. Seems to be rigid (not backdoored).\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha256 } from '@noble/hashes/sha2.js';\nimport { randomBytes } from '@noble/hashes/utils.js';\nimport { createKeygen } from \"./abstract/curve.js\";\nimport { createFROST, } from \"./abstract/frost.js\";\nimport { createHasher, isogenyMap, mapToCurveSimpleSWU, } from \"./abstract/hash-to-curve.js\";\nimport { Field, mapHashToField, pow2 } from \"./abstract/modular.js\";\nimport { ecdsa, weierstrass, } from \"./abstract/weierstrass.js\";\nimport { abytes, asciiToBytes, bytesToNumberBE, concatBytes, copyBytes, } from \"./utils.js\";\n// Seems like generator was produced from some seed:\n// `Pointk1.BASE.multiply(Pointk1.Fn.inv(2n, N)).toAffine().x`\n// // gives short x 0x3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63n\nconst secp256k1_CURVE = {\n    p: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f'),\n    n: BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141'),\n    h: BigInt(1),\n    a: BigInt(0),\n    b: BigInt(7),\n    Gx: BigInt('0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798'),\n    Gy: BigInt('0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8'),\n};\nconst secp256k1_ENDO = {\n    beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),\n    basises: [\n        [BigInt('0x3086d221a7d46bcde86c90e49284eb15'), -BigInt('0xe4437ed6010e88286f547fa90abfe4c3')],\n        [BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8'), BigInt('0x3086d221a7d46bcde86c90e49284eb15')],\n    ],\n};\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _2n = /* @__PURE__ */ BigInt(2);\n/**\n * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.\n * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]\n */\nfunction sqrtMod(y) {\n    const P = secp256k1_CURVE.p;\n    // prettier-ignore\n    const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);\n    // prettier-ignore\n    const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);\n    const b2 = (y * y * y) % P; // x^3, 11\n    const b3 = (b2 * b2 * y) % P; // x^7\n    const b6 = (pow2(b3, _3n, P) * b3) % P;\n    const b9 = (pow2(b6, _3n, P) * b3) % P;\n    const b11 = (pow2(b9, _2n, P) * b2) % P;\n    const b22 = (pow2(b11, _11n, P) * b11) % P;\n    const b44 = (pow2(b22, _22n, P) * b22) % P;\n    const b88 = (pow2(b44, _44n, P) * b44) % P;\n    const b176 = (pow2(b88, _88n, P) * b88) % P;\n    const b220 = (pow2(b176, _44n, P) * b44) % P;\n    const b223 = (pow2(b220, _3n, P) * b3) % P;\n    const t1 = (pow2(b223, _23n, P) * b22) % P;\n    const t2 = (pow2(t1, _6n, P) * b2) % P;\n    const root = pow2(t2, _2n, P);\n    if (!Fpk1.eql(Fpk1.sqr(root), y))\n        throw new Error('Cannot find square root');\n    return root;\n}\nconst Fpk1 = /* @__PURE__ */ Field(secp256k1_CURVE.p, { sqrt: sqrtMod });\nconst Pointk1 = /* @__PURE__ */ weierstrass(secp256k1_CURVE, {\n    Fp: Fpk1,\n    endo: secp256k1_ENDO,\n});\n/**\n * secp256k1 curve: ECDSA and ECDH methods.\n *\n * Uses sha256 to hash messages. To use a different hash,\n * pass `{ prehash: false }` to sign / verify.\n *\n * @example\n * Generate one secp256k1 keypair, sign a message, and verify it.\n *\n * ```js\n * import { secp256k1 } from '@noble/curves/secp256k1.js';\n * const { secretKey, publicKey } = secp256k1.keygen();\n * // const publicKey = secp256k1.getPublicKey(secretKey);\n * const msg = new TextEncoder().encode('hello noble');\n * const sig = secp256k1.sign(msg, secretKey);\n * const isValid = secp256k1.verify(sig, msg, publicKey);\n * // const sigKeccak = secp256k1.sign(keccak256(msg), secretKey, { prehash: false });\n * ```\n */\nexport const secp256k1 = /* @__PURE__ */ ecdsa(Pointk1, sha256);\n// Schnorr signatures are superior to ECDSA from above. Below is Schnorr-specific BIP0340 code.\n// https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\n/** An object mapping tags to their tagged hash prefix of [SHA256(tag) | SHA256(tag)] */\nconst TAGGED_HASH_PREFIXES = Object.create(null);\n// BIP-340 phrases tags as UTF-8, but all current standardized names here are 7-bit ASCII.\nfunction taggedHash(tag, ...messages) {\n    let tagP = TAGGED_HASH_PREFIXES[tag];\n    if (tagP === undefined) {\n        const tagH = sha256(asciiToBytes(tag));\n        tagP = concatBytes(tagH, tagH);\n        TAGGED_HASH_PREFIXES[tag] = tagP;\n    }\n    return sha256(concatBytes(tagP, ...messages));\n}\n// ECDSA compact points are 33-byte. Schnorr is 32: we strip first byte 0x02 or 0x03\nconst pointToBytes = (point) => point.toBytes(true).slice(1);\nconst affineXToBytes = ({ x }) => Fpk1.toBytes(x);\nconst hasEven = (y) => !Fpk1.isOdd(y);\n// Calculate point, scalar and bytes\nfunction schnorrGetExtPubKey(priv) {\n    const { Fn, BASE } = Pointk1;\n    const d_ = Fn.fromBytes(abytes(priv, 32, 'secretKey'));\n    const p = BASE.multiply(d_); // P = d'⋅G; 0 < d' < n check is done inside\n    const affine = p.toAffine();\n    const scalar = hasEven(affine.y) ? d_ : Fn.neg(d_);\n    return { scalar, bytes: affineXToBytes(affine) };\n}\n/**\n * lift_x from BIP340. Convert 32-byte x coordinate to elliptic curve point.\n * @returns valid point checked for being on-curve\n */\nfunction lift_x(x) {\n    const Fp = Fpk1;\n    if (!Fp.isValidNot0(x))\n        throw new Error('invalid x: Fail if x ≥ p');\n    const xx = Fp.sqr(x);\n    const c = Fp.add(Fp.mulN(xx, x), BigInt(7)); // Let c = x³ + 7 mod p.\n    let y = Fp.sqrt(c); // Let y = c^(p+1)/4 mod p. Same as sqrt().\n    // Return the unique point P such that x(P) = x and\n    // y(P) = y if y mod 2 = 0 or y(P) = p-y otherwise.\n    if (!hasEven(y))\n        y = Fp.neg(y);\n    const p = Pointk1.fromAffine({ x, y });\n    p.assertValidity();\n    return p;\n}\n// BIP-340 callers still need to supply canonical 32-byte inputs where required; this alias only\n// parses big-endian bytes and does not enforce the fixed-width contract itself.\nconst num = bytesToNumberBE;\n/** Create tagged hash, convert it to bigint, reduce modulo-n. */\nfunction challenge(...args) {\n    return Pointk1.Fn.create(num(taggedHash('BIP0340/challenge', ...args)));\n}\n/** Schnorr public key is just `x` coordinate of Point as per BIP340. */\nfunction schnorrGetPublicKey(secretKey) {\n    return schnorrGetExtPubKey(secretKey).bytes; // d'=int(sk). Fail if d'=0 or d'≥n. Ret bytes(d'⋅G)\n}\n/**\n * Creates Schnorr signature as per BIP340. Verifies itself before returning anything.\n * `auxRand` is optional and is not the sole source of `k` generation: bad CSPRNG output will not\n * be catastrophic, but BIP-340 still recommends fresh auxiliary randomness when available to harden\n * deterministic signing against side-channel and fault-injection attacks.\n */\nfunction schnorrSign(message, secretKey, auxRand = randomBytes(32)) {\n    const { Fn, BASE } = Pointk1;\n    // Snapshot once: nonce, challenge, and self-verification must use one transcript.\n    const m = copyBytes(abytes(message, undefined, 'message'));\n    const { bytes: px, scalar: d } = schnorrGetExtPubKey(secretKey); // checks for isWithinCurveOrder\n    const a = abytes(auxRand, 32, 'auxRand'); // Auxiliary random data a: a 32-byte array\n    // Let t be the byte-wise xor of bytes(d) and hash/aux(a).\n    const t = Fn.toBytes(d ^ num(taggedHash('BIP0340/aux', a)));\n    const rand = taggedHash('BIP0340/nonce', t, px, m); // Let rand = hash/nonce(t || bytes(P) || m)\n    // BIP340 defines k' = int(rand) mod n. We can't reuse schnorrGetExtPubKey(rand)\n    // here: that helper parses canonical secret keys and rejects rand >= n instead\n    // of reducing the nonce hash modulo the group order.\n    const k_ = Fn.create(num(rand));\n    // BIP-340: \"Let k' = int(rand) mod n. Fail if k' = 0. Let R = k'⋅G.\"\n    if (k_ === _0n)\n        throw new Error('sign failed: k is zero');\n    const p = BASE.multiply(k_); // Rejects zero; only the raw nonce hash needs reduction.\n    const affine = p.toAffine();\n    const k = hasEven(affine.y) ? k_ : Fn.neg(k_);\n    const rx = affineXToBytes(affine);\n    const e = challenge(rx, px, m); // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.\n    const sig = new Uint8Array(64); // Let sig = bytes(R) || bytes((k + ed) mod n).\n    sig.set(rx, 0);\n    sig.set(Fn.toBytes(Fn.create(k + e * d)), 32);\n    // If Verify(bytes(P), m, sig) (see below) returns failure, abort\n    if (!schnorrVerify(sig, m, px))\n        throw new Error('sign: Invalid signature produced');\n    return sig;\n}\n/**\n * Verifies Schnorr signature.\n * Will swallow errors & return false except for initial type validation of arguments.\n */\nfunction schnorrVerify(signature, message, publicKey) {\n    const { Fp, Fn, BASE } = Pointk1;\n    const sig = abytes(signature, 64, 'signature');\n    const m = abytes(message, undefined, 'message');\n    const pub = abytes(publicKey, 32, 'publicKey');\n    try {\n        const P = lift_x(num(pub)); // P = lift_x(int(pk)); fail if that fails\n        const rBytes = sig.subarray(0, 32);\n        const r = num(rBytes); // Let r = int(sig[0:32]); fail if r ≥ p.\n        if (!Fp.isValidNot0(r))\n            return false;\n        const s = num(sig.subarray(32, 64)); // Let s = int(sig[32:64]); fail if s ≥ n.\n        // Stricter than BIP-340/libsecp256k1, which only reject s >= n. Honest signing reaches\n        // s = 0 only with negligible probability (k + e*d ≡ 0 mod n), so treat zero-s inputs as\n        // crafted edge cases and fail closed instead of carrying that extra verification surface.\n        if (!Fn.isValidNot0(s))\n            return false;\n        // int(challenge(bytes(r) || bytes(P) || m)) % n\n        const e = challenge(rBytes, pointToBytes(P), m);\n        // R = s⋅G - e⋅P, where -eP == (n-e)P\n        const R = BASE.mulAddUnsafe(s, P, Fn.neg(e)); // s⋅G + (-e)⋅P, joint Strauss–Shamir\n        const { x, y } = R.toAffine();\n        // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.\n        if (R.is0() || !hasEven(y) || !Fp.eql(x, r))\n            return false;\n        return true;\n    }\n    catch (error) {\n        return false;\n    }\n}\nexport const __TEST = /* @__PURE__ */ Object.freeze({ lift_x, frostTweakPublic, frostTweakSecret });\n/**\n * Schnorr signatures over secp256k1.\n * See {@link https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki | BIP 340}.\n * @example\n * Generate one BIP340 Schnorr keypair, sign a message, and verify it.\n *\n * ```js\n * import { schnorr } from '@noble/curves/secp256k1.js';\n * const { secretKey, publicKey } = schnorr.keygen();\n * // const publicKey = schnorr.getPublicKey(secretKey);\n * const msg = new TextEncoder().encode('hello');\n * const sig = schnorr.sign(msg, secretKey);\n * const isValid = schnorr.verify(sig, msg, publicKey);\n * ```\n */\nexport const schnorr = /* @__PURE__ */ (() => {\n    const size = 32;\n    const seedLength = 48;\n    const randomSecretKey = (seed) => {\n        seed = seed === undefined ? randomBytes(seedLength) : seed;\n        return mapHashToField(abytes(seed, seedLength, 'seed'), secp256k1_CURVE.n);\n    };\n    return Object.freeze({\n        keygen: createKeygen(randomSecretKey, schnorrGetPublicKey),\n        getPublicKey: schnorrGetPublicKey,\n        sign: schnorrSign,\n        verify: schnorrVerify,\n        Point: Pointk1,\n        utils: Object.freeze({\n            randomSecretKey,\n            taggedHash,\n            lift_x,\n            pointToBytes,\n        }),\n        lengths: Object.freeze({\n            secretKey: size,\n            publicKey: size,\n            publicKeyHasPrefix: false,\n            signature: size * 2,\n            seed: seedLength,\n        }),\n    });\n})();\n// RFC 9380 Appendix E.1 3-isogeny coefficients for secp256k1, stored in ascending degree order.\n// The final `1` in each denominator array is the explicit monic leading term.\nconst isoMap = /* @__PURE__ */ (() => isogenyMap(Fpk1, [\n    // xNum\n    [\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7',\n        '0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581',\n        '0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262',\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c',\n    ],\n    // xDen\n    [\n        '0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b',\n        '0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n    // yNum\n    [\n        '0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c',\n        '0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3',\n        '0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931',\n        '0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84',\n    ],\n    // yDen\n    [\n        '0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b',\n        '0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573',\n        '0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n].map((i) => i.map((j) => BigInt(j)))))();\n// RFC 9380 §8.7 secp256k1 E' parameters for the SWU-to-isogeny pipeline below.\nlet mapSWU;\nconst getMapSWU = () => mapSWU ||\n    (mapSWU = mapToCurveSimpleSWU(Fpk1, {\n        // Building the SWU sqrt-ratio helper eagerly adds noticeable `secp256k1.js` import cost, so\n        // defer it to first use; after that the cached mapper is reused directly.\n        A: BigInt('0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533'),\n        B: BigInt('1771'),\n        Z: Fpk1.create(BigInt('-11')),\n    }));\n/**\n * Hashing / encoding to secp256k1 points / field. RFC 9380 methods.\n * @example\n * Hash one message onto secp256k1.\n *\n * ```ts\n * const point = secp256k1_hasher.hashToCurve(new TextEncoder().encode('hello noble'));\n * ```\n */\nexport const secp256k1_hasher = /* @__PURE__ */ (() => createHasher(Pointk1, (scalars) => {\n    const { x, y } = getMapSWU()(Fpk1.create(scalars[0]));\n    return isoMap(x, y);\n}, {\n    DST: 'secp256k1_XMD:SHA-256_SSWU_RO_',\n    encodeDST: 'secp256k1_XMD:SHA-256_SSWU_NU_',\n    p: Fpk1.ORDER,\n    m: 1,\n    k: 128,\n    expand: 'xmd',\n    hash: sha256,\n}))();\n/**\n * FROST threshold signatures over secp256k1. RFC 9591.\n * @example\n * Create one trusted-dealer package for 2-of-3 secp256k1 signing.\n *\n * ```ts\n * const alice = secp256k1_FROST.Identifier.derive('alice@example.com');\n * const bob = secp256k1_FROST.Identifier.derive('bob@example.com');\n * const carol = secp256k1_FROST.Identifier.derive('carol@example.com');\n * const deal = secp256k1_FROST.trustedDealer({ min: 2, max: 3 }, [alice, bob, carol]);\n * ```\n */\nexport const secp256k1_FROST = /* @__PURE__ */ (() => createFROST({\n    name: 'FROST-secp256k1-SHA256-v1',\n    Point: Pointk1,\n    hashToScalar: secp256k1_hasher.hashToScalar,\n    hash: sha256,\n}))();\n// Taproot utils\n// `undefined` means \"disable TapTweak entirely\"; callers that want the BIP-341/BIP-386 empty\n// merkle root must pass `new Uint8Array(0)` explicitly.\nfunction tweak(point, merkleRoot) {\n    if (merkleRoot === undefined)\n        return _0n;\n    const x = pointToBytes(point);\n    const t = bytesToNumberBE(taggedHash('TapTweak', x, merkleRoot));\n    // BIP-341 taproot_tweak_pubkey/taproot_tweak_seckey: \"if t >= SECP256K1_ORDER:\n    // raise ValueError\". TapTweak must reject overflow instead of reducing modulo n.\n    if (!Pointk1.Fn.isValid(t))\n        throw new Error('invalid TapTweak hash');\n    return t;\n}\nfunction frostPubToEvenY(pub) {\n    const VK = Pointk1.fromBytes(pub.commitments[0]);\n    // Keep aliasing on the already-even path so wrapper callers can skip unnecessary cloning.\n    if (hasEven(VK.y))\n        return pub;\n    return {\n        signers: { min: pub.signers.min, max: pub.signers.max },\n        commitments: pub.commitments.map((i) => Pointk1.fromBytes(i).negate().toBytes()),\n        verifyingShares: Object.fromEntries(Object.entries(pub.verifyingShares).map(([k, v]) => [\n            k,\n            Pointk1.fromBytes(v).negate().toBytes(),\n        ])),\n    };\n}\nfunction frostSecretToEvenY(s, pub) {\n    const VK = Pointk1.fromBytes(pub.commitments[0]);\n    // Keep aliasing on the already-even path so wrapper callers can preserve package identity.\n    if (hasEven(VK.y))\n        return s;\n    const Fn = Pointk1.Fn;\n    return {\n        ...s,\n        signingShare: Fn.toBytes(Fn.neg(Fn.fromBytes(s.signingShare))),\n    };\n}\nfunction frostNoncesToEvenY(groupCommitment, nonces) {\n    if (hasEven(groupCommitment.y))\n        return nonces;\n    const Fn = Pointk1.Fn;\n    return {\n        binding: Fn.toBytes(Fn.neg(Fn.fromBytes(nonces.binding))),\n        hiding: Fn.toBytes(Fn.neg(Fn.fromBytes(nonces.hiding))),\n    };\n}\nfunction frostTweakSecret(s, pub, merkleRoot) {\n    const Fn = Pointk1.Fn;\n    const keyPackage = frostSecretToEvenY(s, pub);\n    const evenPub = frostPubToEvenY(pub);\n    const t = tweak(Pointk1.fromBytes(evenPub.commitments[0]), merkleRoot);\n    const signingShare = Fn.toBytes(Fn.add(Fn.fromBytes(keyPackage.signingShare), t));\n    return {\n        identifier: keyPackage.identifier,\n        signingShare,\n    };\n}\nfunction frostTweakPublic(pub, merkleRoot) {\n    const PKPackage = frostPubToEvenY(pub);\n    const t = tweak(Pointk1.fromBytes(PKPackage.commitments[0]), merkleRoot);\n    // Disabled TapTweak (t=0): return the even-Y-normalized package as-is. multiply() rejects\n    // zero scalars, and adding [0]G would be a no-op anyway.\n    if (t === _0n)\n        return PKPackage;\n    const tp = Pointk1.BASE.multiply(t);\n    const commitments = PKPackage.commitments.map((c, i) => (i === 0 ? Pointk1.fromBytes(c).add(tp) : Pointk1.fromBytes(c)).toBytes());\n    const verifyingShares = {};\n    for (const k in PKPackage.verifyingShares) {\n        verifyingShares[k] = Pointk1.fromBytes(PKPackage.verifyingShares[k]).add(tp).toBytes();\n    }\n    return {\n        signers: { min: PKPackage.signers.min, max: PKPackage.signers.max },\n        commitments,\n        verifyingShares,\n    };\n}\n/**\n * FROST threshold signatures over secp256k1-schnorr-taproot. RFC 9591.\n * DKG outputs are auto-tweaked with the empty Taproot merkle root for compatibility, while\n * `trustedDealer()` outputs stay untweaked unless callers apply the Taproot tweak themselves.\n * @example\n * Create one trusted-dealer package for Taproot-compatible FROST signing.\n *\n * ```ts\n * const alice = schnorr_FROST.Identifier.derive('alice@example.com');\n * const bob = schnorr_FROST.Identifier.derive('bob@example.com');\n * const carol = schnorr_FROST.Identifier.derive('carol@example.com');\n * const deal = schnorr_FROST.trustedDealer({ min: 2, max: 3 }, [alice, bob, carol]);\n * ```\n */\nexport const schnorr_FROST = /* @__PURE__ */ (() => createFROST({\n    name: 'FROST-secp256k1-SHA256-TR-v1',\n    Point: Pointk1,\n    hashToScalar: secp256k1_hasher.hashToScalar,\n    hash: sha256,\n    // Taproot related hacks\n    parsePublicKey(publicKey) {\n        // External Taproot keys are x-only, but local key packages still use compressed points.\n        if (publicKey.length === 32)\n            return lift_x(bytesToNumberBE(publicKey));\n        if (publicKey.length === 33)\n            return Pointk1.fromBytes(publicKey);\n        throw new Error(`expected x-only or compressed public key, got length=${publicKey.length}`);\n    },\n    adjustScalar(n) {\n        const PK = Pointk1.BASE.multiply(n);\n        return hasEven(PK.y) ? n : Pointk1.Fn.neg(n);\n    },\n    adjustPoint: (p) => (hasEven(p.y) ? p : p.negate()),\n    challenge(R, PK, msg) {\n        return challenge(pointToBytes(R), pointToBytes(PK), msg);\n    },\n    adjustNonces: frostNoncesToEvenY,\n    adjustGroupCommitmentShare: (GC, GCShare) => (!hasEven(GC.y) ? GCShare.negate() : GCShare),\n    adjustPublic: frostPubToEvenY,\n    adjustSecret: frostSecretToEvenY,\n    adjustTx: {\n        // Compat with official implementation\n        encode: (tx) => tx.subarray(1),\n        decode: (tx) => concatBytes(Uint8Array.of(0x02), tx),\n    },\n    adjustDKG: (k) => {\n        // Compatibility with frost-secp256k1-tr: DKG output is auto-tweaked with the\n        // empty Taproot merkle root, while dealer-generated keys stay untweaked.\n        const merkleRoot = new Uint8Array(0);\n        return {\n            public: frostTweakPublic(k.public, merkleRoot),\n            secret: frostTweakSecret(k.secret, k.public, merkleRoot),\n        };\n    },\n}))();\n","'use strict';\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.bech32m = exports.bech32 = void 0;\nconst ALPHABET = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';\nconst ALPHABET_MAP = {};\nfor (let z = 0; z < ALPHABET.length; z++) {\n    const x = ALPHABET.charAt(z);\n    ALPHABET_MAP[x] = z;\n}\nfunction polymodStep(pre) {\n    const b = pre >> 25;\n    return (((pre & 0x1ffffff) << 5) ^\n        (-((b >> 0) & 1) & 0x3b6a57b2) ^\n        (-((b >> 1) & 1) & 0x26508e6d) ^\n        (-((b >> 2) & 1) & 0x1ea119fa) ^\n        (-((b >> 3) & 1) & 0x3d4233dd) ^\n        (-((b >> 4) & 1) & 0x2a1462b3));\n}\nfunction prefixChk(prefix) {\n    let chk = 1;\n    for (let i = 0; i < prefix.length; ++i) {\n        const c = prefix.charCodeAt(i);\n        if (c < 33 || c > 126)\n            return 'Invalid prefix (' + prefix + ')';\n        chk = polymodStep(chk) ^ (c >> 5);\n    }\n    chk = polymodStep(chk);\n    for (let i = 0; i < prefix.length; ++i) {\n        const v = prefix.charCodeAt(i);\n        chk = polymodStep(chk) ^ (v & 0x1f);\n    }\n    return chk;\n}\nfunction convert(data, inBits, outBits, pad) {\n    let value = 0;\n    let bits = 0;\n    const maxV = (1 << outBits) - 1;\n    const result = [];\n    for (let i = 0; i < data.length; ++i) {\n        value = (value << inBits) | data[i];\n        bits += inBits;\n        while (bits >= outBits) {\n            bits -= outBits;\n            result.push((value >> bits) & maxV);\n        }\n    }\n    if (pad) {\n        if (bits > 0) {\n            result.push((value << (outBits - bits)) & maxV);\n        }\n    }\n    else {\n        if (bits >= inBits)\n            return 'Excess padding';\n        if ((value << (outBits - bits)) & maxV)\n            return 'Non-zero padding';\n    }\n    return result;\n}\nfunction toWords(bytes) {\n    return convert(bytes, 8, 5, true);\n}\nfunction fromWordsUnsafe(words) {\n    const res = convert(words, 5, 8, false);\n    if (Array.isArray(res))\n        return res;\n}\nfunction fromWords(words) {\n    const res = convert(words, 5, 8, false);\n    if (Array.isArray(res))\n        return res;\n    throw new Error(res);\n}\nfunction getLibraryFromEncoding(encoding) {\n    let ENCODING_CONST;\n    if (encoding === 'bech32') {\n        ENCODING_CONST = 1;\n    }\n    else {\n        ENCODING_CONST = 0x2bc830a3;\n    }\n    function encode(prefix, words, LIMIT) {\n        LIMIT = LIMIT || 90;\n        if (prefix.length + 7 + words.length > LIMIT)\n            throw new TypeError('Exceeds length limit');\n        prefix = prefix.toLowerCase();\n        // determine chk mod\n        let chk = prefixChk(prefix);\n        if (typeof chk === 'string')\n            throw new Error(chk);\n        let result = prefix + '1';\n        for (let i = 0; i < words.length; ++i) {\n            const x = words[i];\n            if (x >> 5 !== 0)\n                throw new Error('Non 5-bit word');\n            chk = polymodStep(chk) ^ x;\n            result += ALPHABET.charAt(x);\n        }\n        for (let i = 0; i < 6; ++i) {\n            chk = polymodStep(chk);\n        }\n        chk ^= ENCODING_CONST;\n        for (let i = 0; i < 6; ++i) {\n            const v = (chk >> ((5 - i) * 5)) & 0x1f;\n            result += ALPHABET.charAt(v);\n        }\n        return result;\n    }\n    function __decode(str, LIMIT) {\n        LIMIT = LIMIT || 90;\n        if (str.length < 8)\n            return str + ' too short';\n        if (str.length > LIMIT)\n            return 'Exceeds length limit';\n        // don't allow mixed case\n        const lowered = str.toLowerCase();\n        const uppered = str.toUpperCase();\n        if (str !== lowered && str !== uppered)\n            return 'Mixed-case string ' + str;\n        str = lowered;\n        const split = str.lastIndexOf('1');\n        if (split === -1)\n            return 'No separator character for ' + str;\n        if (split === 0)\n            return 'Missing prefix for ' + str;\n        const prefix = str.slice(0, split);\n        const wordChars = str.slice(split + 1);\n        if (wordChars.length < 6)\n            return 'Data too short';\n        let chk = prefixChk(prefix);\n        if (typeof chk === 'string')\n            return chk;\n        const words = [];\n        for (let i = 0; i < wordChars.length; ++i) {\n            const c = wordChars.charAt(i);\n            const v = ALPHABET_MAP[c];\n            if (v === undefined)\n                return 'Unknown character ' + c;\n            chk = polymodStep(chk) ^ v;\n            // not in the checksum?\n            if (i + 6 >= wordChars.length)\n                continue;\n            words.push(v);\n        }\n        if (chk !== ENCODING_CONST)\n            return 'Invalid checksum for ' + str;\n        return { prefix, words };\n    }\n    function decodeUnsafe(str, LIMIT) {\n        const res = __decode(str, LIMIT);\n        if (typeof res === 'object')\n            return res;\n    }\n    function decode(str, LIMIT) {\n        const res = __decode(str, LIMIT);\n        if (typeof res === 'object')\n            return res;\n        throw new Error(res);\n    }\n    return {\n        decodeUnsafe,\n        decode,\n        encode,\n        toWords,\n        fromWordsUnsafe,\n        fromWords,\n    };\n}\nexports.bech32 = getLibraryFromEncoding('bech32');\nexports.bech32m = getLibraryFromEncoding('bech32m');\n","/**\n * Nostr cryptographic utilities\n *\n * Handles keypair generation, encryption/decryption of private keys,\n * signature verification, and bech32 encoding for Nostr authentication.\n */\n\nimport {\n  createCipheriv,\n  createDecipheriv,\n  createHash,\n  hkdfSync,\n  randomBytes,\n} from 'node:crypto';\nimport { schnorr, secp256k1 } from '@noble/curves/secp256k1.js';\nimport { bech32 } from 'bech32';\n\nexport interface NostrKeypair {\n  /** Hex-encoded public key (64 characters) */\n  pubkey: string;\n  /** Hex-encoded private key (64 characters) */\n  privkey: string;\n}\n\nexport interface EncryptedKey {\n  /** Base64-encoded ciphertext */\n  ciphertext: string;\n  /** Base64-encoded initialization vector */\n  iv: string;\n  /** Base64-encoded authentication tag */\n  tag: string;\n}\n\nexport interface NostrEvent {\n  id?: string;\n  pubkey: string;\n  created_at: number;\n  kind: number;\n  tags: string[][];\n  content: string;\n  sig?: string;\n}\n\n/**\n * Generate a new Nostr keypair (secp256k1)\n */\nexport function generateNostrKeypair(): NostrKeypair {\n  // Generate 32 random bytes for private key\n  const privkeyBytes = randomBytes(32);\n  const privkey = Buffer.from(privkeyBytes).toString('hex');\n\n  // Derive public key from private key\n  const pubkeyBytes = secp256k1.getPublicKey(privkeyBytes, true);\n  // Remove the prefix byte (02 or 03) for compressed public key\n  const pubkey = Buffer.from(pubkeyBytes.slice(1)).toString('hex');\n\n  return { pubkey, privkey };\n}\n\n/**\n * Derive an encryption key from the master secret using HKDF\n * @param masterSecret - Server master secret\n */\nexport function deriveEncryptionKey(masterSecret: string): Buffer {\n  const salt = Buffer.from('nostr-privkey-encryption', 'utf8');\n  const info = Buffer.from('aes-256-gcm', 'utf8');\n  const keyMaterial = Buffer.from(masterSecret, 'utf8');\n\n  return Buffer.from(hkdfSync('sha256', keyMaterial, salt, info, 32));\n}\n\n/**\n * Encrypt a private key using AES-256-GCM\n * @param privkey - Hex-encoded private key\n * @param masterSecret - Server master secret (from env)\n */\nexport function encryptPrivkey(\n  privkey: string,\n  masterSecret: string,\n): EncryptedKey {\n  const key = deriveEncryptionKey(masterSecret);\n  const iv = randomBytes(12); // 96-bit IV for GCM\n\n  const cipher = createCipheriv('aes-256-gcm', key, iv);\n  const encrypted = Buffer.concat([\n    cipher.update(privkey, 'utf8'),\n    cipher.final(),\n  ]);\n  const tag = cipher.getAuthTag();\n\n  return {\n    ciphertext: encrypted.toString('base64'),\n    iv: iv.toString('base64'),\n    tag: tag.toString('base64'),\n  };\n}\n\n/**\n * Decrypt a private key using AES-256-GCM\n * @param encrypted - Encrypted key data\n * @param masterSecret - Server master secret (from env)\n */\nexport function decryptPrivkey(\n  encrypted: EncryptedKey,\n  masterSecret: string,\n): string {\n  const key = deriveEncryptionKey(masterSecret);\n  const iv = Buffer.from(encrypted.iv, 'base64');\n  const tag = Buffer.from(encrypted.tag, 'base64');\n  const ciphertext = Buffer.from(encrypted.ciphertext, 'base64');\n\n  const decipher = createDecipheriv('aes-256-gcm', key, iv);\n  decipher.setAuthTag(tag);\n\n  const decrypted = Buffer.concat([\n    decipher.update(ciphertext),\n    decipher.final(),\n  ]);\n\n  return decrypted.toString('utf8');\n}\n\n/**\n * Compute the event ID (SHA-256 hash of serialized event)\n */\nexport function computeEventId(event: NostrEvent): string {\n  const serialized = JSON.stringify([\n    0,\n    event.pubkey,\n    event.created_at,\n    event.kind,\n    event.tags,\n    event.content,\n  ]);\n\n  return createHash('sha256').update(serialized).digest('hex');\n}\n\n/**\n * Sign a Nostr event using Schnorr signatures (BIP-340)\n * @param event - Event to sign (without id and sig)\n * @param privkey - Hex-encoded private key\n */\nexport function signEvent(\n  event: Omit<NostrEvent, 'id' | 'sig'>,\n  privkey: string,\n): NostrEvent {\n  const id = computeEventId(event as NostrEvent);\n  const privkeyBytes = Buffer.from(privkey, 'hex');\n  const idBytes = Buffer.from(id, 'hex');\n\n  // Use Schnorr signature (BIP-340) for Nostr\n  const sig = schnorr.sign(idBytes, privkeyBytes);\n  const sigHex = Buffer.from(sig).toString('hex');\n\n  return {\n    ...event,\n    id,\n    sig: sigHex,\n  };\n}\n\n/**\n * Verify a Nostr event Schnorr signature (BIP-340)\n * @param event - Nostr event object with sig field\n */\nexport function verifyNostrSignature(event: NostrEvent): boolean {\n  if (!event.id || !event.sig) {\n    return false;\n  }\n\n  // Verify the event ID\n  const computedId = computeEventId(event);\n  if (computedId !== event.id) {\n    return false;\n  }\n\n  try {\n    const sigBytes = Buffer.from(event.sig, 'hex');\n    const idBytes = Buffer.from(event.id, 'hex');\n    // Nostr public keys are x-only (32 bytes) - use directly with Schnorr\n    const pubkeyBytes = Buffer.from(event.pubkey, 'hex');\n\n    return schnorr.verify(sigBytes, idBytes, pubkeyBytes);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Create a Nostr event for authentication (NIP-42 style)\n * @param privkey - Private key to sign with\n * @param challenge - Server challenge string\n * @param relay - Relay URL (optional)\n */\nexport function createAuthEvent(\n  privkey: string,\n  challenge: string,\n  relay?: string,\n): NostrEvent {\n  const privkeyBytes = Buffer.from(privkey, 'hex');\n  const pubkeyBytes = secp256k1.getPublicKey(privkeyBytes, true);\n  const pubkey = Buffer.from(pubkeyBytes.slice(1)).toString('hex');\n\n  const tags: string[][] = [['challenge', challenge]];\n  if (relay) {\n    tags.push(['relay', relay]);\n  }\n\n  const event: Omit<NostrEvent, 'id' | 'sig'> = {\n    pubkey,\n    created_at: Math.floor(Date.now() / 1000),\n    kind: 22242, // NIP-42 AUTH event kind\n    tags,\n    content: '',\n  };\n\n  return signEvent(event, privkey);\n}\n\n/**\n * Verify an authentication event\n * @param event - Auth event to verify\n * @param expectedChallenge - Expected challenge string\n * @param maxAgeSeconds - Maximum age of the event in seconds (default: 300 = 5 minutes)\n */\nexport function verifyAuthEvent(\n  event: NostrEvent,\n  expectedChallenge: string,\n  maxAgeSeconds: number = 300,\n): { valid: boolean; error?: string } {\n  // Check event kind\n  if (event.kind !== 22242) {\n    return { valid: false, error: 'Invalid event kind' };\n  }\n\n  // Check timestamp\n  const now = Math.floor(Date.now() / 1000);\n  const age = now - event.created_at;\n  if (age > maxAgeSeconds || age < -60) {\n    // Allow 60s clock skew in the future\n    return { valid: false, error: 'Event expired or too far in future' };\n  }\n\n  // Check challenge\n  const challengeTag = event.tags.find((t) => t[0] === 'challenge');\n  if (!challengeTag || challengeTag[1] !== expectedChallenge) {\n    return { valid: false, error: 'Challenge mismatch' };\n  }\n\n  // Verify signature\n  if (!verifyNostrSignature(event)) {\n    return { valid: false, error: 'Invalid signature' };\n  }\n\n  return { valid: true };\n}\n\n/**\n * Convert hex public key to npub (bech32)\n */\nexport function pubkeyToNpub(pubkey: string): string {\n  const words = bech32.toWords(Buffer.from(pubkey, 'hex'));\n  return bech32.encode('npub', words, 1000);\n}\n\n/**\n * Convert npub (bech32) to hex public key\n */\nexport function npubToPubkey(npub: string): string {\n  const { prefix, words } = bech32.decode(npub, 1000);\n  if (prefix !== 'npub') {\n    throw new Error('Invalid npub prefix');\n  }\n  return Buffer.from(bech32.fromWords(words)).toString('hex');\n}\n\n/**\n * Convert hex private key to nsec (bech32)\n */\nexport function privkeyToNsec(privkey: string): string {\n  const words = bech32.toWords(Buffer.from(privkey, 'hex'));\n  return bech32.encode('nsec', words, 1000);\n}\n\n/**\n * Convert nsec (bech32) to hex private key\n */\nexport function nsecToPrivkey(nsec: string): string {\n  const { prefix, words } = bech32.decode(nsec, 1000);\n  if (prefix !== 'nsec') {\n    throw new Error('Invalid nsec prefix');\n  }\n  return Buffer.from(bech32.fromWords(words)).toString('hex');\n}\n\n/**\n * Get public key from private key\n */\nexport function getPublicKey(privkey: string): string {\n  const privkeyBytes = Buffer.from(privkey, 'hex');\n  const pubkeyBytes = secp256k1.getPublicKey(privkeyBytes, true);\n  return Buffer.from(pubkeyBytes.slice(1)).toString('hex');\n}\n\n/**\n * Validate a hex-encoded public key\n */\nexport function isValidPubkey(pubkey: string): boolean {\n  if (!/^[0-9a-f]{64}$/i.test(pubkey)) {\n    return false;\n  }\n  try {\n    // Try to use it in a point multiplication\n    const fullPubkey = Buffer.from(`02${pubkey}`, 'hex');\n    secp256k1.Point.fromBytes(fullPubkey);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Validate a hex-encoded private key\n */\nexport function isValidPrivkey(privkey: string): boolean {\n  if (!/^[0-9a-f]{64}$/i.test(privkey)) {\n    return false;\n  }\n  try {\n    const privkeyBytes = Buffer.from(privkey, 'hex');\n    // Check if it's a valid scalar for secp256k1\n    secp256k1.getPublicKey(privkeyBytes);\n    return true;\n  } catch {\n    return false;\n  }\n}\n","/**\n * NostrIdentity - Links Nostr identity to Profile\n *\n * Stores the Nostr keypair with encrypted private key for custodial auth.\n * The private key is encrypted using AES-256-GCM with the SERVER_MASTER_SECRET.\n * The public key serves as the unique identifier for NIP-05 verification.\n */\n\nimport {\n  field,\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport {\n  decryptPrivkey,\n  type EncryptedKey,\n  privkeyToNsec,\n  pubkeyToNpub,\n} from '../auth/nostrCrypto';\nimport type { Profile } from './Profile';\n\nexport interface NostrIdentityOptions extends SmrtObjectOptions {\n  profileId?: string;\n  pubkey?: string;\n  encryptedPrivkey?: string;\n  encryptionIv?: string;\n  encryptionTag?: string;\n  email?: string;\n  nip05Username?: string;\n  lastUsedAt?: Date | null;\n  verifiedAt?: Date | null;\n}\n\n@smrt({\n  tableName: 'nostr_identities',\n  // Holds custodial private-key material (AES-256-GCM ciphertext, IV, auth\n  // tag). Never in the change feed (#2937).\n  sensitive: true,\n  api: { include: ['list', 'get'] }, // No create/update via API - only internal\n  mcp: { include: ['list', 'get'] },\n  cli: { include: ['list', 'get'] },\n})\nexport class NostrIdentity extends SmrtObject {\n  /**\n   * Link to the Profile (Person, Organization, Bot)\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * Hex-encoded secp256k1 public key (64 characters).\n   *\n   * Indexed: `findByPubkey()` looks identities up by this column (#2364,\n   * epic #2382 finding A3).\n   */\n  @field({ indexed: true })\n  pubkey: string = '';\n\n  /**\n   * AES-256-GCM encrypted private key (base64-encoded ciphertext)\n   */\n  encryptedPrivkey: string = '';\n\n  /**\n   * Initialization vector for AES-GCM decryption (base64)\n   */\n  encryptionIv: string = '';\n\n  /**\n   * Authentication tag from AES-GCM (base64)\n   */\n  encryptionTag: string = '';\n\n  /**\n   * Email address associated with this identity\n   */\n  email: string = '';\n\n  /**\n   * Username for NIP-05 verification (e.g., \"alice\" for alice@domain.com)\n   */\n  nip05Username: string = '';\n\n  /**\n   * Last time this identity was used for authentication\n   */\n  lastUsedAt: Date | null = null;\n\n  /**\n   * When this identity was verified via magic link\n   */\n  verifiedAt: Date | null = null;\n\n  constructor(options: NostrIdentityOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.pubkey) this.pubkey = options.pubkey;\n    if (options.encryptedPrivkey)\n      this.encryptedPrivkey = options.encryptedPrivkey;\n    if (options.encryptionIv) this.encryptionIv = options.encryptionIv;\n    if (options.encryptionTag) this.encryptionTag = options.encryptionTag;\n    if (options.email) this.email = options.email;\n    if (options.nip05Username) this.nip05Username = options.nip05Username;\n    if (options.lastUsedAt !== undefined) this.lastUsedAt = options.lastUsedAt;\n    if (options.verifiedAt !== undefined) this.verifiedAt = options.verifiedAt;\n  }\n\n  /**\n   * Get the linked Profile\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Find identity by public key\n   */\n  static async findByPubkey(\n    pubkey: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<NostrIdentity | null> {\n    const { NostrIdentityCollection } = await import(\n      '../collections/NostrIdentityCollection'\n    );\n    const collection = await NostrIdentityCollection.create(options);\n    return await collection.findOne({\n      where: { pubkey },\n    });\n  }\n\n  /**\n   * Find identity by email\n   */\n  static async findByEmail(\n    email: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<NostrIdentity | null> {\n    const { NostrIdentityCollection } = await import(\n      '../collections/NostrIdentityCollection'\n    );\n    const collection = await NostrIdentityCollection.create(options);\n    return await collection.findOne({\n      where: { email: email.toLowerCase() },\n    });\n  }\n\n  /**\n   * Find identity by NIP-05 username\n   */\n  static async findByNip05(\n    username: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<NostrIdentity | null> {\n    const { NostrIdentityCollection } = await import(\n      '../collections/NostrIdentityCollection'\n    );\n    const collection = await NostrIdentityCollection.create(options);\n    return await collection.findOne({\n      where: { nip05Username: username.toLowerCase() },\n    });\n  }\n\n  /**\n   * Decrypt the private key using the server master secret\n   * @param masterSecret - SERVER_MASTER_SECRET from environment\n   * @returns Hex-encoded private key\n   */\n  decryptPrivkey(masterSecret: string): string {\n    const encrypted: EncryptedKey = {\n      ciphertext: this.encryptedPrivkey,\n      iv: this.encryptionIv,\n      tag: this.encryptionTag,\n    };\n    return decryptPrivkey(encrypted, masterSecret);\n  }\n\n  /**\n   * Get the full keypair (requires master secret)\n   * @param masterSecret - SERVER_MASTER_SECRET from environment\n   */\n  getKeypair(masterSecret: string): {\n    pubkey: string;\n    privkey: string;\n    npub: string;\n    nsec: string;\n  } {\n    const privkey = this.decryptPrivkey(masterSecret);\n    return {\n      pubkey: this.pubkey,\n      privkey,\n      npub: pubkeyToNpub(this.pubkey),\n      nsec: privkeyToNsec(privkey),\n    };\n  }\n\n  /**\n   * Record usage of this identity\n   */\n  async recordUsage(): Promise<void> {\n    for (let attempt = 0; attempt < 4; attempt += 1) {\n      if (this.isPersisted) await this.loadFromId();\n      this.lastUsedAt = new Date();\n      try {\n        await this.save();\n        return;\n      } catch (error) {\n        if (\n          attempt === 3 ||\n          !(\n            error instanceof Error &&\n            'code' in error &&\n            error.code === 'RUNTIME_REVISION_CONFLICT'\n          )\n        ) {\n          throw error;\n        }\n      }\n    }\n  }\n\n  /**\n   * Mark this identity as verified\n   */\n  async markVerified(): Promise<void> {\n    this.verifiedAt = new Date();\n    this.lastUsedAt = new Date();\n    await this.save();\n  }\n\n  /**\n   * Check if this identity is verified\n   */\n  isVerified(): boolean {\n    return this.verifiedAt !== null;\n  }\n\n  /**\n   * Get the NIP-05 identifier (username@domain)\n   * Note: Domain must be provided by the application\n   */\n  getNip05Identifier(domain: string): string {\n    const username = this.nip05Username || this.email.split('@')[0];\n    return `${username}@${domain}`;\n  }\n}\n"],"x_google_ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11],"mappings":";;;;;;;;;;;;;;;;AA2BA,IAAM,YAAY,MAAO,IAAI,KAAK,KAAM;AACxC,IAAM,YAAY,MAAM,MAAM;AAG9B,SAAS,cAAc,MAAM,YAAY,GAAG,MAAM;CAC9C,MAAM,IAAI,SAAS,CAAC;CACpB,MAAM,IAAI,SAAS,CAAC;CACpB,KAAK,UAAU,YAAY,OAAO,IAAI,GAAG,IAAI;CAC7C,KAAK,UAAU,aAAa,GAAG,OAAO,IAAI,GAAG,IAAI;AACrD;;;;;;;;;;;;;AC1BA,SAAgBA,UAAQ,GAAG;CAKvB,OAAQ,aAAa,cAChB,YAAY,OAAO,CAAC,KACjB,EAAE,YAAY,SAAS,gBACvB,uBAAuB,KACvB,EAAE,sBAAsB;AACpC;AAGA,IAAMC,YAAU,UAAW,QAAQ,IAAI,MAAM,MAAM;;;;;;;;;;;;;;AAcnD,SAAgBC,UAAQ,GAAG,QAAQ,IAAI;CACnC,IAAI,OAAO,MAAM,UACb,MAAM,IAAI,UAAUD,SAAO,KAAK,IAAI,0BAA0B,OAAO,CAAC;CAC1E,IAAI,CAAC,OAAO,cAAc,CAAC,KAAK,IAAI,GAChC,MAAM,IAAI,WAAWA,SAAO,KAAK,IAAI,gCAAgC,CAAC;CAC1E,OAAO;AACX;;;;;;;;;;;;;;;AAgCA,SAAgBE,SAAO,OAAO,QAAQ,QAAQ,IAAI;CAG9C,IAAIH,UAAQ,KAAK,MAAM,WAAW,KAAA,KAAa,MAAM,WAAW,SAC5D,OAAO;CAEX,IAAI,WAAW,KAAA,GACX,UAAQ,QAAQ,QAAQ;CAC5B,MAAM,QAAQA,UAAQ,KAAK;CAC3B,MAAM,QAAQ,WAAW,KAAA,IAAY,cAAc,WAAW;CAC9D,MAAM,MAAM,QAAQ,UAAU,MAAM,WAAW,QAAQ,OAAO;CAC9D,MAAM,UAAUC,SAAO,KAAK,IAAI,wBAAwB,QAAQ,WAAW;CAC3E,IAAI,CAAC,OACD,MAAM,IAAI,UAAU,OAAO;CAC/B,MAAM,IAAI,WAAW,OAAO;AAChC;;;;;;;;;;;;;;;AAgCA,SAAgB,MAAM,GAAG;CACrB,IAAI,OAAO,MAAM,cAAc,OAAO,EAAE,WAAW,YAC/C,MAAM,IAAI,UAAU,6CAA6C;CACrE,UAAQ,EAAE,SAAS;CACnB,UAAQ,EAAE,QAAQ;CAGlB,IAAI,EAAE,YAAY,KAAK,EAAE,WAAW,GAChC,MAAM,IAAI,MAAM,wCAAwC;AAChE;AACA,IAAMG,aAAW,OAAO,UAAU;CAC9B,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAClE,MAAM,IAAI,WAAW,UAAU,WAAW,KAAK,IAAI,MAAM,OAAO,+BAA+B,OAAO,KAAK;AACnH;AACA,IAAM,SAAS,OAAO,UAAU;CAC5B,UAAQ,OAAO,KAAK;CACpB,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,IAAI,UAAU,OAAO,aAAa,UAAU,MACxC,MAAM,IAAI,UAAU,IAAI,MAAM,wBAAwB;CAG1D,IAAI,OAAO,OAAO,OAAO,WAAW,GAChC,MAAM,IAAI,UAAU,IAAI,MAAM,2BAA2B;AACjE;;;;;;;;;;;;;;;AAeA,SAAgB,QAAQ,UAAU,gBAAgB,MAAM;CAGpD,IAAI,SAAS,WACT,MAAM,IAAI,MAAM,oBAAoB;CACxC,IAAI,iBAAiB,SAAS,UAC1B,MAAM,IAAI,MAAM,6BAA6B;AACrD;;;;;;;;;;;;;;;;;AAiBA,SAAgB,QAAQ,KAAK,UAAU;CACnC,SAAO,KAAK,KAAA,GAAW,QAAQ;CAG/B,MAAM,MAAM,SAAS;CACrB,IAAI,EAAE,IAAI,UAAU,MAChB,MAAM,IAAI,WAAW,mCAAiC,GAAG;AAEjE;;;;;;;;;;AAsCA,SAAgB,MAAM,GAAG,QAAQ;CAC7B,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAC/B,OAAO,EAAE,CAAC,KAAK,CAAC;AAExB;;;;;;;;;;;AAWA,SAAgB,WAAW,KAAK;CAC5B,OAAO,IAAI,SAAS,IAAI,QAAQ,IAAI,YAAY,IAAI,UAAU;AAClE;;;;;;;;;;;;AAYA,SAAgB,KAAK,MAAM,OAAO;CAC9B,OAAQ,QAAS,KAAK,QAAW,SAAS;AAC9C;AA6EA,IAAM,gBAAgC,uBAEtC,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,cAAc,OAAO,WAAW,YAAY,WAAA,CAAY;AAE7F,IAAM,QAAwB,sBAAM,KAAK,EAAE,QAAQ,IAAI,IAAI,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;;;;;;;;;;;;;;AAcnG,SAAgBC,aAAW,OAAO;CAC9B,SAAO,KAAK;CAEZ,IAAI,eACA,OAAO,MAAM,MAAM;CAEvB,IAAI,MAAM;CACV,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAC9B,OAAO,MAAM,MAAM;CAEvB,OAAO;AACX;AAIA,SAAS,cAAc,IAAI;CACvB,OAAO,MAAM,MAAM,MAAM,KAAK,KAAK,KAC7B,MAAM,MAAM,MAAM,KAAK,KAAM,KACzB,MAAM,MAAM,MAAM,MAAM,KAAM,KAC1B,KAAA;AAClB;;;;;;;;;;;;;AAaA,SAAgBC,aAAW,KAAK;CAC5B,IAAI,OAAO,QAAQ,UACf,MAAM,IAAI,UAAU,8BAA8B,OAAO,GAAG;CAChE,IAAI,eACA,IAAI;EACA,OAAO,WAAW,QAAQ,GAAG;CACjC,SACO,OAAO;EACV,IAAI,iBAAiB,aACjB,MAAM,IAAI,WAAW,MAAM,OAAO;EACtC,MAAM;CACV;CAEJ,MAAM,KAAK,IAAI;CACf,MAAM,KAAK,KAAK;CAChB,IAAI,KAAK,GACL,MAAM,IAAI,WAAW,qDAAqD,EAAE;CAChF,MAAM,QAAQ,IAAI,WAAW,EAAE;CAC/B,KAAK,IAAI,KAAK,GAAG,KAAK,GAAG,KAAK,IAAI,MAAM,MAAM,GAAG;EAC7C,MAAM,KAAK,cAAc,IAAI,WAAW,EAAE,CAAC;EAC3C,MAAM,KAAK,cAAc,IAAI,WAAW,KAAK,CAAC,CAAC;EAC/C,IAAI,OAAO,KAAA,KAAa,OAAO,KAAA,GAAW;GACtC,MAAM,OAAO,IAAI,MAAM,IAAI,KAAK;GAChC,MAAM,IAAI,WAAW,kDAAiD,OAAO,iBAAgB,EAAE;EACnG;EACA,MAAM,MAAM,KAAK,KAAK;CAC1B;CACA,OAAO;AACX;;;;;;;;;;;;AAgHA,SAAgBC,cAAY,GAAG,QAAQ;CACnC,IAAI,MAAM;CACV,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;EACpC,MAAM,IAAI,OAAO;EACjB,SAAO,CAAC;EACR,OAAO,EAAE;CACb;CACA,MAAM,MAAM,IAAI,WAAW,GAAG;CAC9B,KAAK,IAAI,IAAI,GAAG,MAAM,GAAG,IAAI,OAAO,QAAQ,KAAK;EAC7C,MAAM,IAAI,OAAO;EACjB,IAAI,IAAI,GAAG,GAAG;EACd,OAAO,EAAE;CACb;CACA,OAAO;AACX;;;;;;;;;;;;;;AAsDA,SAAgB,UAAU,UAAU,MAAM,QAAQ,QAAQ;CACtD,MAAM,UAAU,UAAU;CAC1B,IAAI,SAAS,KAAA,GACT,MAAM,MAAM,KAAK;CAIrB,OADe,OAAO,OAAO,OAAO,OAAO,IAAI,GAAG,UAAU,IAChD;AAChB;;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,aAAa,UAAU,OAAO,CAAC,GAAG;CAC9C,IAAI,OAAO,aAAa,YACpB,MAAM,IAAI,UAAU,8CAA4C,OAAO,QAAQ;CACnF,OAAO,UAAU,CAAC,GAAG,MAAM,MAAM;CACjC,MAAM,SAAS,KAAK,SAAS,SAAS,IAAI,CAAC,CACtC,OAAO,GAAG,CAAC,CACX,OAAO;CACZ,MAAM,MAAM,SAAS,KAAA,CAAS;CAC9B,MAAM,YAAY,IAAI;CACtB,MAAM,WAAW,IAAI;CACrB,MAAM,SAAS,IAAI;CACnB,MAAM,UAAU,SAAS,SAAS,IAAI;CACtC,OAAO,OAAO,OAAO,IAAI;CACzB,OAAO,OAAO,OAAO,KAAK;AAC9B;;;;;;;;;;;;;;;;;AAiBA,SAAgBC,cAAY,cAAc,IAAI;CAE1C,UAAQ,aAAa,aAAa;CAClC,MAAM,KAAK,OAAO,eAAe,WAAW,WAAW,SAAS;CAChE,IAAI,OAAO,IAAI,oBAAoB,YAC/B,MAAM,IAAI,MAAM,wCAAwC;CAM5D,IAAI,cAAc,OACd,MAAM,IAAI,WAAW,wCAAwC,aAAa;CAC9E,OAAO,GAAG,gBAAgB,IAAI,WAAW,WAAW,CAAC;AACzD;;;;;;;;;;;;;AAaA,IAAa,WAAW,YAAY,EAGhC,KAAK,WAAW,KAAK;CAAC;CAAM;CAAM;CAAM;CAAM;CAAM;CAAM;CAAM;CAAM;CAAM;CAAM;AAAM,CAAC,EAC7F;;;;;;;;;;;;;;;;;;;;;;ACzpBA,SAAgB,IAAI,GAAG,GAAG,GAAG;CACzB,OAAQ,IAAI,IAAM,CAAC,IAAI;AAC3B;;;;;;;;;;;;;;AAcA,SAAgB,IAAI,GAAG,GAAG,GAAG;CACzB,OAAQ,IAAI,IAAM,IAAI,IAAM,IAAI;AACpC;;;;;;;;;;;;;;;;;;;AAmBA,IAAa,SAAb,MAAoB;CAChB;CACA;CACA,SAAS;CACT;CACA;CAEA;CACA;CACA,WAAW;CACX,SAAS;CACT,MAAM;CACN,YAAY;CACZ,YAAY,UAAU,WAAW,WAAW,MAAM;EAC9C,KAAK,WAAW;EAChB,KAAK,YAAY;EACjB,KAAK,YAAY;EACjB,KAAK,OAAO;EACZ,KAAK,SAAS,IAAI,WAAW,QAAQ;EACrC,KAAK,OAAO,WAAW,KAAK,MAAM;CACtC;CACA,OAAO,MAAM;EACT,QAAQ,IAAI;EACZ,SAAO,IAAI;EACX,MAAM,EAAE,MAAM,QAAQ,aAAa;EACnC,MAAM,MAAM,KAAK;EACjB,IAAI,YAAY;EAChB,KAAK,IAAI,MAAM,GAAG,MAAM,MAAM;GAC1B,MAAM,OAAO,KAAK,IAAI,WAAW,KAAK,KAAK,MAAM,GAAG;GAGpD,IAAI,SAAS,UAAU;IACnB,MAAM,WAAW,WAAW,IAAI;IAChC,OAAO,YAAY,MAAM,KAAK,OAAO,UACjC,KAAK,QAAQ,UAAU,GAAG;IAC9B,YAAY;IACZ;GACJ;GAGA,OAAO,IAAI,QAAQ,KAAK,SAAS,MAAM,OAAO,KAAK,SAAS,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG;GACtF,KAAK,OAAO;GACZ,OAAO;GACP,IAAI,KAAK,QAAQ,UAAU;IACvB,KAAK,QAAQ,MAAM,CAAC;IACpB,KAAK,MAAM;IACX,YAAY;GAChB;EACJ;EACA,KAAK,UAAU,KAAK;EAGpB,IAAI,WACA,KAAK,WAAW;EACpB,OAAO;CACX;CACA,WAAW,KAAK;EACZ,QAAQ,IAAI;EACZ,QAAQ,KAAK,IAAI;EACjB,KAAK,WAAW;EAIhB,MAAM,EAAE,QAAQ,MAAM,UAAU,SAAS;EACzC,IAAI,EAAE,QAAQ;EAEd,OAAO,SAAS;EAChB,OAAO,KAAK,GAAG,GAAG;EAGlB,IAAI,KAAK,YAAY,WAAW,KAAK;GACjC,KAAK,QAAQ,MAAM,CAAC;GACpB,OAAO,KAAK,CAAC;EACjB;EAKA,cAAc,MAAM,WAAW,GAAG,KAAK,SAAS,GAAG,IAAI;EACvD,KAAK,QAAQ,MAAM,CAAC;EAGpB,KAAK,WAAW;EAEhB,MAAM,QAAQ,QAAQ,SAAS,OAAO,WAAW,GAAG;EACpD,MAAM,MAAM,KAAK;EAEjB,MAAM,SAAS,MAAM;EACrB,MAAM,QAAQ,KAAK,IAAI;EAEvB,IAAI,MAAM,KAAK,SAAS,MAAM,QAC1B,MAAM,IAAI,MAAM,mBAAmB;EACvC,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,KACxB,MAAM,UAAU,IAAI,GAAG,MAAM,IAAI,IAAI;CAC7C;CACA,SAAS;EACL,MAAM,EAAE,QAAQ,cAAc;EAC9B,KAAK,WAAW,MAAM;EAGtB,MAAM,MAAM,OAAO,MAAM,GAAG,SAAS;EACrC,KAAK,QAAQ;EACb,OAAO;CACX;CACA,eAAe,IAAI;EACf,MAAM,EAAE,QAAQ,QAAQ,UAAU,WAAW,QAAQ;EACrD,GAAG,YAAY;EACf,GAAG,WAAW;EACd,GAAG,SAAS;EACZ,GAAG,MAAM;EAGT,IAAI,KACA,GAAG,OAAO,IAAI,MAAM;EACxB,OAAO;CACX;CACA,QAAQ;EACJ,OAAO,KAAK,WAAW;CAC3B;AACJ;;;;;;;;AAQA,IAAa,YAA4B,4BAAY,KAAK;CACtD;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;AACxF,CAAC;;;;;;;;;;;;;;AC5KD,IAAM,WAA2B,4BAAY,KAAK;CAC9C;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;AACxF,CAAC;;AAED,IAAM,2BAA2B,IAAI,YAAY,EAAE;;AAEnD,IAAM,WAAN,cAAuB,OAAO;CAK1B,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,YAAY,WAAW,IAAI;EACvB,MAAM,IAAI,WAAW,GAAG,KAAK;EAC7B,KAAK,IAAI,GAAG,KAAK;EACjB,KAAK,IAAI,GAAG,KAAK;EACjB,KAAK,IAAI,GAAG,KAAK;EACjB,KAAK,IAAI,GAAG,KAAK;EACjB,KAAK,IAAI,GAAG,KAAK;EACjB,KAAK,IAAI,GAAG,KAAK;EACjB,KAAK,IAAI,GAAG,KAAK;EACjB,KAAK,IAAI,GAAG,KAAK;CACrB;CACA,MAAM;EACF,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,MAAM;EACnC,OAAO;GAAC;GAAG;GAAG;GAAG;GAAG;GAAG;GAAG;GAAG;EAAC;CAClC;CAEA,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG;EACxB,KAAK,IAAI,IAAI;EACb,KAAK,IAAI,IAAI;EACb,KAAK,IAAI,IAAI;EACb,KAAK,IAAI,IAAI;EACb,KAAK,IAAI,IAAI;EACb,KAAK,IAAI,IAAI;EACb,KAAK,IAAI,IAAI;EACb,KAAK,IAAI,IAAI;CACjB;CACA,WAAW,IAAI;EACX,CAAC,OAAO,IAAI,KAAK,YAAY,EAAA,CAAG,IAAI,GAAG,KAAK,IAAI,CAAC;EACjD,OAAO,KAAK,eAAe,EAAE;CACjC;CACA,QAAQ,MAAM,QAAQ;EAElB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,UAAU,GACnC,SAAS,KAAK,KAAK,UAAU,QAAQ,KAAK;EAC9C,KAAK,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK;GAC1B,MAAM,MAAM,SAAS,IAAI;GACzB,MAAM,KAAK,SAAS,IAAI;GACxB,MAAM,KAAK,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,IAAK,QAAQ;GAEnD,SAAS,MADE,KAAK,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,IAAK,OAAO,MAC7B,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,MAAO;EACnE;EAEA,IAAI,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,MAAM;EACjC,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;GACzB,MAAM,SAAS,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE;GACpD,MAAM,KAAM,IAAI,SAAS,IAAI,GAAG,GAAG,CAAC,IAAI,SAAS,KAAK,SAAS,KAAM;GAErE,MAAM,MADS,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE,KAC/B,IAAI,GAAG,GAAG,CAAC,IAAK;GACrC,IAAI;GACJ,IAAI;GACJ,IAAI;GACJ,IAAK,IAAI,KAAM;GACf,IAAI;GACJ,IAAI;GACJ,IAAI;GACJ,IAAK,KAAK,KAAM;EACpB;EAEA,IAAK,IAAI,KAAK,IAAK;EACnB,IAAK,IAAI,KAAK,IAAK;EACnB,IAAK,IAAI,KAAK,IAAK;EACnB,IAAK,IAAI,KAAK,IAAK;EACnB,IAAK,IAAI,KAAK,IAAK;EACnB,IAAK,IAAI,KAAK,IAAK;EACnB,IAAK,IAAI,KAAK,IAAK;EACnB,IAAK,IAAI,KAAK,IAAK;EACnB,KAAK,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;CACnC;CACA,aAAa;EACT,MAAM,QAAQ;CAClB;CACA,UAAU;EAGN,KAAK,YAAY;EACjB,KAAK,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;EAC/B,MAAM,KAAK,MAAM;CACrB;AACJ;;AAEA,IAAa,UAAb,cAA6B,SAAS;CAClC,cAAc;EACV,MAAM,IAAI,SAAS;CACvB;AACJ;;;;;;;;;;;;;;;;;AA4PA,IAAa,SAAyB,mCAAmB,IAAI,QAAQ,GACrD,wBAAQ,CAAI,CAAC;;;;;;;;;;;;;;;;;;;;;ACvW7B,SAAgB,OAAO,MAAM,OAAO,cAAc,CAAE,GAAG;CACnD,IAAI,CAAC,MAAM,QAAQ,IAAI,GACnB,MAAM,IAAI,UAAU,IAAI,MAAM,6BAA6B,OAAO,MAAM;CAC5E,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAC7B,MAAM,KAAK,IAAI,GAAG,MAAM,GAAG,EAAE,EAAE;CACnC,OAAO;AACX;;;;;;;;;;;;;;AAcA,IAAa,UAAU,OAAO,QAAQ,UAAUC,SAAQ,OAAO,QAAQ,KAAK;;;;;;;;;;;;;AAa5E,IAAa,UAAUC;;;;;;;;;;;;;;AAcvB,SAAgB,QAAQ,OAAO,QAAQ,IAAI;CACvC,IAAI,OAAO,UAAU,UAAU;EAC3B,MAAM,SAAS,SAAS,IAAI,MAAM;EAClC,MAAM,IAAI,UAAU,SAAS,+BAA+B,OAAO,KAAK;CAC5E;CACA,OAAO;AACX;;;;;;;;;;;;;;AAcA,SAAgB,QAAQ,OAAO,QAAQ,UAAU;CAC7C,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAClE,MAAM,IAAI,UAAU,UAAU,WACxB,kCACA,IAAI,MAAM,8BAA8B,OAAO,OAAO;CAChE,OAAO;AACX;;;;;;;;;;;;;;AAcA,SAAgB,UAAU,OAAO,OAAO;CACpC,IAAI,OAAO,UAAU,YACjB,MAAM,IAAI,UAAU,IAAI,MAAM,uCAAuC,OAAO,OAAO;CACvF,OAAO;AACX;;;;;;;;;;;;AAYA,IAAa,aAAaC;;;;;;;;;;;;AAY1B,IAAa,eAAe,GAAG,WAAWC,cAAa,GAAG,MAAM;;;;;;;;;;;;AAYhE,IAAa,cAAc,QAAQC,aAAY,GAAG;;;;;;;;;;;;AAYlD,IAAa,UAAUC;;;;;;;;;;;;AAYvB,IAAaC,iBAAe,gBAAgBC,cAAa,WAAW;AACpE,IAAMC,QAAsB,uBAAO,CAAC;AACpC,IAAMC,QAAsB,uBAAO,CAAC;AAGpC,IAAM,UAAU,UAAW,QAAQ,IAAI,MAAM,MAAM;;;;;;;;;;;;;;AAcnD,SAAgB,MAAM,OAAO,QAAQ,IAAI;CACrC,IAAI,OAAO,UAAU,WACjB,MAAM,IAAI,UAAU,OAAO,KAAK,IAAI,gCAAgC,OAAO,KAAK;CACpF,OAAO;AACX;;;;;;;;;;;;;AAaA,SAAgB,WAAW,GAAG;CAC1B,IAAI,OAAO,MAAM;MACT,CAAC,SAAS,CAAC,GACX,MAAM,IAAI,WAAW,mCAAmC,CAAC;CAAA,OAG7D,QAAQ,CAAC;CACb,OAAO;AACX;;;;;;;;;;;;;;AAcA,SAAgB,YAAY,OAAO,QAAQ,IAAI;CAC3C,IAAI,OAAO,UAAU,UAAU;EAC3B,MAAM,SAAS,SAAS,IAAI,MAAM;EAClC,MAAM,IAAI,UAAU,SAAS,+BAA+B,OAAO,KAAK;CAC5E;CACA,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG;EAC9B,MAAM,SAAS,SAAS,IAAI,MAAM;EAClC,MAAM,IAAI,WAAW,SAAS,gCAAgC,KAAK;CACvE;AACJ;;;;;;;;;;;;;;;AAeA,SAAgB,oBAAoB,KAAK;CACrC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,SAAS,EAAE;CACvC,OAAO,IAAI,SAAS,IAAI,MAAM,MAAM;AACxC;;;;;;;;;;;;;;;AAeA,SAAgB,YAAY,KAAK;CAC7B,IAAI,OAAO,QAAQ,UACf,MAAM,IAAI,UAAU,8BAA8B,OAAO,GAAG;CAChE,OAAO,QAAQ,KAAKD,QAAM,OAAO,OAAO,GAAG;AAC/C;;;;;;;;;;;;;AAcA,SAAgB,gBAAgB,OAAO;CACnC,OAAO,YAAYN,aAAY,KAAK,CAAC;AACzC;;;;;;;;;;;;;AAaA,SAAgB,gBAAgB,OAAO;CACnC,OAAO,YAAYA,aAAY,UAAUF,SAAQ,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACvE;;;;;;;;;;;;;;;AAeA,SAAgB,gBAAgB,GAAG,KAAK;CACpC,UAAS,GAAG;CACZ,IAAI,QAAQ,GACR,MAAM,IAAI,MAAM,+BAA+B;CACnD,IAAI,WAAW,CAAC;CAChB,MAAM,cAAc,MAAM;CAC1B,MAAM,MAAM,EAAE,SAAS,EAAE;CAEzB,IAAI,IAAI,SAAS,aACb,MAAM,IAAI,WAAW,qBAAqB;CAC9C,OAAOI,aAAY,IAAI,SAAS,aAAa,GAAG,CAAC;AACrD;;;;;;;;;;;;;;;AAeA,SAAgB,gBAAgB,GAAG,KAAK;CACpC,OAAO,gBAAgB,GAAG,GAAG,CAAC,CAAC,QAAQ;AAC3C;;;;;;;;;;;;;AAoDA,SAAgB,UAAU,OAAO;CAG7B,OAAO,WAAW,KAAK,OAAO,KAAK,CAAC;AACxC;;;;;;;;;;;;;;;AAeA,SAAgB,aAAa,OAAO;CAChC,IAAI,OAAO,UAAU,UACjB,MAAM,IAAI,UAAU,gCAAgC,OAAO,KAAK;CACpE,OAAO,WAAW,KAAK,QAAQ,GAAG,MAAM;EACpC,MAAM,WAAW,EAAE,WAAW,CAAC;EAC/B,IAAI,EAAE,WAAW,KAAK,WAAW,KAC7B,MAAM,IAAI,WAAW,wCAAwC,MAAM,GAAG,cAAc,SAAS,eAAe,GAAG;EAEnH,OAAO;CACX,CAAC;AACL;;;;;;;;;;;;AAYA,SAAgB,SAAS,GAAG;CACxB,OAAO,OAAO,MAAM,YAAYI,SAAO;AAC3C;;;;;;;;;;;;;;AAcA,SAAgB,QAAQ,GAAG,KAAK,KAAK;CACjC,OAAO,SAAS,CAAC,KAAK,SAAS,GAAG,KAAK,SAAS,GAAG,KAAK,OAAO,KAAK,IAAI;AAC5E;;;;;;;;;;;;;;;;;AAiBA,SAAgB,SAAS,OAAO,GAAG,KAAK,KAAK;CAMzC,IAAI,CAAC,QAAQ,GAAG,KAAK,GAAG,GACpB,MAAM,IAAI,WAAW,oBAAoB,QAAQ,OAAO,MAAM,aAAa,MAAM,WAAW,CAAC;AACrG;;;;;;;;;;;;;;;AAgBA,SAAgB,OAAO,GAAG;CAGtB,IAAI,IAAIA,OACJ,MAAM,IAAI,MAAM,uCAAuC,CAAC;CAE5D,OAAO,MAAMA,QAAM,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AACzC;;;;;;;;;;;;;;AA2DA,IAAa,WAAW,MAAM;CAC1B,YAAY,GAAG,GAAG;CAClB,QAAQC,SAAO,OAAO,CAAC,KAAKA;AAChC;;;;;;;;;;;;;;;;;;;;;;;AAuBA,SAAgB,eAAe,SAAS,UAAU,QAAQ;CACtD,UAAS,SAAS,SAAS;CAC3B,UAAS,UAAU,UAAU;CAC7B,IAAI,OAAO,WAAW,YAClB,MAAM,IAAI,UAAU,2BAA2B;CAEnD,MAAM,OAAO,QAAQ,IAAI,WAAW,GAAG;CACvC,MAAM,OAAO,WAAW,GAAG;CAC3B,MAAM,QAAQ,WAAW,GAAG,CAAI;CAChC,MAAM,QAAQ,WAAW,GAAG,CAAI;CAChC,MAAM,gBAAgB;CAGtB,IAAI,IAAI,IAAI,OAAO;CAEnB,IAAI,IAAI,IAAI,OAAO;CACnB,IAAI,IAAI;CACR,MAAM,cAAc;EAChB,EAAE,KAAK,CAAC;EACR,EAAE,KAAK,CAAC;EACR,IAAI;CACR;CAEA,MAAM,KAAK,GAAG,SAAS,OAAO,GAAG,YAAY,GAAG,GAAG,IAAI,CAAC;CACxD,MAAM,UAAU,OAAO,SAAS;EAE5B,IAAI,EAAE,OAAO,IAAI;EACjB,IAAI,EAAE;EACN,IAAI,KAAK,WAAW,GAChB;EACJ,IAAI,EAAE,OAAO,IAAI;EACjB,IAAI,EAAE;CACV;CACA,MAAM,YAAY;EAEd,IAAI,OAAO,eACP,MAAM,IAAI,MAAM,sCAAsC;EAC1D,IAAI,MAAM;EACV,MAAM,MAAM,CAAC;EACb,OAAO,MAAM,UAAU;GACnB,IAAI,EAAE;GACN,MAAM,KAAK,EAAE,MAAM;GACnB,IAAI,KAAK,EAAE;GACX,OAAO,EAAE;EACb;EACA,OAAO,YAAY,GAAG,GAAG;CAC7B;CACA,MAAM,YAAY,MAAM,SAAS;EAC7B,MAAM;EACN,OAAO,IAAI;EACX,IAAI,MAAM,KAAA;EAEV,QAAQ,MAAM,KAAK,IAAI,CAAC,OAAO,KAAA,GAC3B,OAAO;EACX,MAAM;EACN,OAAO;CACX;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,eAAe,QAAQ,SAAS,CAAC,GAAG,YAAY,CAAC,GAAG,QAAQ,UAAU;CAClF,QAAQ,QAAQ,KAAK;CACrB,QAAQ,QAAQ,QAAQ;CACxB,QAAQ,WAAW,WAAW;CAC9B,SAAS,WAAW,WAAW,cAAc,OAAO;EAChD,MAAM,QAAQ,UAAU,WAAW,UAAU,OAAO,SAAS,EAAE,KAAK,IAAI,MAAM,GAAG,OAAO,SAAS,EAAE;EAGnG,MAAM,MAAM,OAAO;EAGnB,IAAI,CAAC,OAAO,OAAO,QAAQ,SAAS,MAC/B,QAAQ,QAAQ,KAAA,IAAY,iBAAiB,aAC9C,MAAM,IAAI,UAAU,GAAG,MAAM,mCAAmC;EAEpE,IAAI,SAAS,QAAQ,KAAA,GACjB;EACJ,MAAM,UAAU,OAAO;EACvB,IAAI,YAAY,gBAAgB,QAAQ,MACpC,MAAM,IAAI,UAAU,GAAG,MAAM,wBAAwB,aAAa,QAAQ,SAAS;CAC3F;CACA,MAAM,QAAQ,GAAG,UAAU,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,OAAO,WAAW,GAAG,GAAG,KAAK,CAAC;CACxF,KAAK,QAAQ,KAAK;CAClB,KAAK,WAAW,IAAI;AACxB;;;;;;;;;;AC3qBA,IAAMC,QAAsB,uBAAO,CAAC,GAAGC,QAAsB,uBAAO,CAAC,GAAGC,QAAsB,uBAAO,CAAC;AAEtG,IAAMC,QAAsB,uBAAO,CAAC,GAAGC,QAAsB,uBAAO,CAAC,GAAG,MAAsB,uBAAO,CAAC;AAEtG,IAAM,MAAsB,uBAAO,CAAC,GAAG,MAAsB,uBAAO,CAAC,GAAG,MAAsB,uBAAO,CAAC;AACtG,IAAM,OAAuB,uBAAO,EAAE,GAAG,OAAuB,uBAAO,EAAE;AAGzE,IAAM,mBAAmC,uBAAO,qBAAqB;;;;;;;;;;;;;AAarE,SAAgB,IAAI,GAAG,GAAG;CACtB,IAAI,KAAKJ,OACL,MAAM,IAAI,MAAM,yCAAyC,CAAC;CAC9D,MAAM,SAAS,IAAI;CACnB,OAAO,UAAUA,QAAM,SAAS,IAAI;AACxC;;;;;;;;;;;;;;;;;;AAkBA,SAAgB,IAAI,KAAK,OAAO,QAAQ;CACpC,IAAI,UAAUC,OACV,MAAM,IAAI,MAAM,oCAAoC,MAAM;CAE9D,IAAI,OAAO,UAAU,UACjB,MAAM,IAAI,UAAU,4CAA4C,OAAO,KAAK;CAChF,IAAI,QAAQD,OACR,MAAM,IAAI,MAAM,yCAAyC;CAC7D,IAAI,UAAUA,OACV,OAAOC;CACX,IAAI,UAAUA,OACV,OAAO;CACX,IAAI,IAAI,MAAM;CACd,IAAI,IAAID,OACJ,KAAK;CAGT,IAAI,QAAQ,kBAAkB;EAE1B,IAAI,IAAIC;EACR,OAAO,QAAQD,OAAK;GAChB,IAAI,QAAQC,OACR,IAAK,IAAI,IAAK;GAClB,IAAK,IAAI,IAAK;GACd,UAAUA;EACd;EACA,OAAO;CACX;CAIA,MAAM,SAAS,CAAC;CAChB,OAAO,QAAQD,OAAK;EAChB,OAAO,KAAK,OAAO,QAAQ,IAAI,CAAC;EAChC,UAAUI;CACd;CACA,MAAM,QAAQ,IAAI,MAAM,EAAE;CAC1B,MAAM,KAAKH;CACX,MAAM,KAAK;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KACpB,MAAM,KAAM,MAAM,IAAI,KAAK,IAAK;CACpC,IAAI,IAAI,MAAM,OAAO,OAAO,SAAS;CACrC,KAAK,IAAI,IAAI,OAAO,SAAS,GAAG,KAAK,GAAG,KAAK;EACzC,IAAK,IAAI,IAAK;EACd,IAAK,IAAI,IAAK;EACd,IAAK,IAAI,IAAK;EACd,IAAK,IAAI,IAAK;EACd,MAAM,QAAQ,OAAO;EACrB,IAAI,UAAU,GACV,IAAK,IAAI,MAAM,SAAU;CACjC;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;AAiBA,SAAgB,KAAK,GAAG,OAAO,QAAQ;CACnC,IAAI,UAAUA,OACV,MAAM,IAAI,MAAM,qCAAqC,MAAM;CAC/D,IAAI,QAAQD,OACR,MAAM,IAAI,MAAM,+CAA+C,KAAK;CACxE,IAAI,MAAM;CACV,OAAO,UAAUA,OAAK;EAClB,OAAO;EACP,OAAO;CACX;CACA,OAAO;AACX;;;;;;;;;;;;;;;AAeA,SAAgB,OAAO,QAAQ,QAAQ;CACnC,IAAI,WAAWA,OACX,MAAM,IAAI,MAAM,kCAAkC;CAGtD,IAAI,UAAUC,OACV,MAAM,IAAI,MAAM,uCAAuC,MAAM;CAGjE,IAAI,IAAI,IAAI,QAAQ,MAAM;CAC1B,IAAI,IAAI;CAIR,IAAI,IAAID,OAAK,IAAIC;CACjB,OAAO,MAAMD,OAAK;EACd,MAAM,IAAI,IAAI;EACd,MAAM,IAAI,IAAI,IAAI;EAClB,MAAM,IAAI,IAAI,IAAI;EAElB,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI;CAC7B;CAEA,IAAIK,MAAQJ,OACR,MAAM,IAAI,MAAM,wBAAwB;CAC5C,OAAO,IAAI,GAAG,MAAM;AACxB;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,SAAgB,SAAS,GAAG,OAAO;CAC/B,IAAI,SAASA,OACT,MAAM,IAAI,MAAM,+CAA+C,KAAK;CACxE,MAAM,KAAK,IAAI,GAAG,KAAK;CACvB,IAAI,OAAOD,OACP,MAAM,IAAI,MAAM,oCAAoC;CAExD,MAAM,UAAU,IAAI,IAAI,QAAQE,OAAK,KAAK;CAE1C,IAAI,IAAI,KAAK,SAAS,KAAK,MAAMD,OAC7B,MAAM,IAAI,MAAM,0BAA0B;CAC9C,OAAO;AACX;AACA,SAAS,eAAe,IAAI,MAAM,GAAG;CACjC,MAAM,IAAI;CACV,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,GACrB,MAAM,IAAI,MAAM,yBAAyB;AACjD;AAMA,SAAS,YAAY,OAAO,QAAQ;CAChC,KAAK,QAAQA,WAASD,OAClB,MAAM,IAAI,MAAM,SAAS,iCAAiC,KAAK;AACvE;AAKA,SAAS,UAAU,IAAI,GAAG;CACtB,MAAM,IAAI;CACV,MAAM,UAAU,EAAE,QAAQC,SAAOG;CACjC,MAAM,OAAO,EAAE,IAAI,GAAG,MAAM;CAC5B,eAAe,GAAG,MAAM,CAAC;CACzB,OAAO;AACX;AAGA,SAAS,UAAU,IAAI,GAAG;CACtB,MAAM,IAAI;CACV,MAAM,UAAU,EAAE,QAAQ,OAAO;CACjC,MAAM,KAAK,EAAE,IAAI,GAAGF,KAAG;CACvB,MAAM,IAAI,EAAE,IAAI,IAAI,MAAM;CAC1B,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC;CACrB,MAAM,IAAI,EAAE,IAAI,EAAE,IAAI,IAAIA,KAAG,GAAG,CAAC;CACjC,MAAM,OAAO,EAAE,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE,GAAG,CAAC;CACtC,eAAe,GAAG,MAAM,CAAC;CACzB,OAAO;AACX;AAGA,SAAS,WAAW,GAAG;CACnB,MAAM,MAAM,MAAM,CAAC;CACnB,MAAM,KAAK,cAAc,CAAC;CAC1B,MAAM,KAAK,GAAG,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC;CACnC,MAAM,KAAK,GAAG,KAAK,EAAE;CACrB,MAAM,KAAK,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC;CAC9B,MAAM,MAAM,IAAI,OAAO;CACvB,SAAS,IAAI,MAAM;EACf,MAAM,IAAI;EACV,IAAI,MAAM,EAAE,IAAI,GAAG,EAAE;EACrB,IAAI,MAAM,EAAE,IAAI,KAAK,EAAE;EACvB,MAAM,MAAM,EAAE,IAAI,KAAK,EAAE;EACzB,MAAM,MAAM,EAAE,IAAI,KAAK,EAAE;EACzB,MAAM,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,GAAG,CAAC;EAC9B,MAAM,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,GAAG,CAAC;EAC9B,MAAM,EAAE,KAAK,KAAK,KAAK,EAAE;EACzB,MAAM,EAAE,KAAK,KAAK,KAAK,EAAE;EACzB,MAAM,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,GAAG,CAAC;EAC9B,MAAM,OAAO,EAAE,KAAK,KAAK,KAAK,EAAE;EAChC,eAAe,GAAG,MAAM,CAAC;EACzB,OAAO;CACX;AACJ;;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,cAAc,GAAG;CAG7B,IAAI,IAAIC,OACJ,MAAM,IAAI,MAAM,qCAAqC;CACzD,YAAY,GAAG,eAAe;CAE9B,IAAI,IAAI,IAAIF;CACZ,IAAI,IAAI;CACR,OAAO,IAAIC,UAAQF,OAAK;EACpB,KAAKE;EACL;CACJ;CAEA,IAAI,IAAIA;CACR,MAAM,MAAM,MAAM,CAAC;CACnB,OAAO,WAAW,KAAK,CAAC,MAAM,GAG1B,IAAI,MAAM,KACN,MAAM,IAAI,MAAM,+CAA+C;CAGvE,IAAI,MAAM,GACN,OAAO;CAGX,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC;CACrB,MAAM,UAAU,IAAID,SAAOC;CAC3B,OAAO,SAAS,YAAY,IAAI,GAAG;EAC/B,MAAM,IAAI;EACV,IAAI,EAAE,IAAI,CAAC,GACP,OAAO;EAEX,IAAI,WAAW,GAAG,CAAC,MAAM,GACrB,MAAM,IAAI,MAAM,yBAAyB;EAE7C,IAAI,IAAI;EACR,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;EACvB,IAAI,IAAI,EAAE,IAAI,GAAG,CAAC;EAClB,IAAI,IAAI,EAAE,IAAI,GAAG,MAAM;EAGvB,OAAO,CAAC,EAAE,IAAI,GAAG,EAAE,GAAG,GAAG;GAGrB,IAAI,EAAE,IAAI,CAAC,GACP,MAAM,IAAI,MAAM,+CAA+C;GACnE,IAAI,IAAI;GAER,IAAI,QAAQ,EAAE,IAAI,CAAC;GACnB,OAAO,CAAC,EAAE,IAAI,OAAO,EAAE,GAAG,GAAG;IACzB;IACA,QAAQ,EAAE,IAAI,KAAK;IACnB,IAAI,MAAM,GACN,MAAM,IAAI,MAAM,yBAAyB;GACjD;GAEA,MAAM,WAAWD,SAAO,OAAO,IAAI,IAAI,CAAC;GACxC,MAAM,IAAI,EAAE,IAAI,GAAG,QAAQ;GAE3B,IAAI;GACJ,IAAI,EAAE,IAAI,CAAC;GACX,IAAI,EAAE,IAAI,GAAG,CAAC;GACd,IAAI,EAAE,IAAI,GAAG,CAAC;EAClB;EACA,OAAO;CACX;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,OAAO,GAAG;CACtB,YAAY,GAAG,SAAS;CAExB,IAAI,IAAIG,UAAQD,OACZ,OAAO;CAEX,IAAI,IAAI,QAAQ,KACZ,OAAO;CAEX,IAAI,IAAI,SAAS,KACb,OAAO,WAAW,CAAC;CAEvB,OAAO,cAAc,CAAC;AAC1B;AAkBA,IAAM,eAAe;CACjB;CAAU;CAAW;CAAO;CAAO;CAAO;CAAQ;CAClD;CAAO;CAAO;CAAO;CAAO;CAAO;CACnC;CAAQ;CAAQ;CAAQ;AAC5B;;;;;;;;;;;;;;;AAeA,SAAgB,cAAc,OAAO;CACjC,QAAQ,OAAO,OAAO;CACtB,IAAI,OAAO,MAAM,UAAU,UACvB,MAAM,IAAI,UAAU,sDAAoD,OAAO,MAAM,KAAK;CAG9F,YAAY,MAAM,OAAO,OAAO;CAChC,YAAY,MAAM,MAAM,MAAM;CAC9B,KAAK,MAAM,QAAQ,cACf,UAAU,MAAM,OAAO,WAAW,IAAI;CAG1C,IAAI,MAAM,QAAQ,KAAK,MAAM,OAAO,GAChC,MAAM,IAAI,MAAM,wCAAwC;CAC5D,IAAI,MAAM,SAASF,OACf,MAAM,IAAI,MAAM,4CAA4C,MAAM,KAAK;CAC3E,OAAO;AACX;AAkEA,SAAgB,cAAc,IAAI,MAAM,WAAW,OAAO;CACtD,cAAc,EAAE;CAChB,OAAO,MAAM,MAAM;CACnB,MAAM,UAAU,UAAU;CAC1B,MAAM,IAAI;CACV,MAAM,WAAW,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,KAAK,WAAW,EAAE,OAAO,KAAA,CAAS;CAE1E,MAAM,gBAAgB,KAAK,QAAQ,KAAK,KAAK,MAAM;EAC/C,IAAI,EAAE,IAAI,GAAG,GACT,OAAO;EACX,SAAS,KAAK;EACd,OAAO,EAAE,IAAI,KAAK,GAAG;CACzB,GAAG,EAAE,GAAG;CAER,MAAM,cAAc,EAAE,IAAI,aAAa;CAEvC,KAAK,aAAa,KAAK,KAAK,MAAM;EAC9B,IAAI,EAAE,IAAI,GAAG,GACT,OAAO;EAEX,SAAS,KAAK,EAAE,IAAI,KAAK,SAAS,EAAE;EACpC,OAAO,EAAE,IAAI,KAAK,GAAG;CACzB,GAAG,WAAW;CACd,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;AA0CA,SAAgB,WAAW,IAAI,GAAG;CAC9B,cAAc,EAAE;CAChB,MAAM,IAAI;CACV,YAAY,EAAE,OAAO,YAAY;CAGjC,MAAM,UAAU,EAAE,QAAQA,SAAOC;CACjC,MAAM,UAAU,EAAE,IAAI,GAAG,MAAM;CAC/B,MAAM,MAAM,EAAE,IAAI,SAAS,EAAE,GAAG;CAChC,MAAM,OAAO,EAAE,IAAI,SAAS,EAAE,IAAI;CAClC,MAAM,KAAK,EAAE,IAAI,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC;CACtC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAClB,MAAM,IAAI,MAAM,gCAAgC;CACpD,OAAO,MAAM,IAAI,OAAO,IAAI;AAChC;;;;;;;;;;;;;;AAkCA,SAAgB,QAAQ,GAAG,YAAY;CAEnC,IAAI,eAAe,KAAA,GACf,QAAQ,UAAU;CACtB,IAAI,KAAKF,OACL,MAAM,IAAI,MAAM,gDAAgD,CAAC;CACrE,IAAI,eAAe,KAAA,KAAa,aAAa,GACzC,MAAM,IAAI,MAAM,yDAAyD,UAAU;CACvF,MAAM,OAAO,OAAO,CAAC;CAGrB,IAAI,eAAe,KAAA,KAAa,aAAa,MACzC,MAAM,IAAI,MAAM,0CAA0C,WAAW,kBAAkB,KAAK,EAAE;CAClG,MAAM,cAAc,eAAe,KAAA,IAAY,aAAa;CAE5D,OAAO;EAAE,YAAY;EAAa,aADd,KAAK,KAAK,cAAc,CACA;CAAE;AAClD;AAGA,IAAM,6BAAa,IAAI,QAAQ;AAC/B,IAAM,SAAN,MAAa;CACT;CACA;CACA;CACA;CACA,OAAOA;CACP,MAAMC;CACN;CACA;CACA,YAAY,OAAO,OAAO,CAAC,GAAG;EAG1B,IAAI,SAASA,OACT,MAAM,IAAI,MAAM,4CAA4C,KAAK;EACrE,IAAI,cAAc,KAAA;EAClB,KAAK,OAAO;EACZ,IAAI,QAAQ,QAAQ,OAAO,SAAS,UAAU;GAE1C,IAAI,OAAO,KAAK,SAAS,UACrB,cAAc,KAAK;GACvB,IAAI,OAAO,KAAK,SAAS,YAGrB,OAAO,eAAe,MAAM,QAAQ;IAAE,OAAO,KAAK;IAAM,YAAY;GAAK,CAAC;GAC9E,IAAI,OAAO,KAAK,SAAS,WACrB,KAAK,OAAO,KAAK;GACrB,IAAI,KAAK,gBACL,KAAK,WAAW,OAAO,OAAO,KAAK,eAAe,MAAM,CAAC;GAC7D,IAAI,OAAO,KAAK,iBAAiB,WAC7B,KAAK,OAAO,KAAK;EACzB;EACA,MAAM,EAAE,YAAY,gBAAgB,QAAQ,OAAO,WAAW;EAC9D,IAAI,cAAc,MACd,MAAM,IAAI,MAAM,gDAAgD;EACpE,KAAK,QAAQ;EACb,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,OAAO,OAAO,IAAI;CACtB;CACA,OAAO,KAAK;EACR,OAAO,IAAI,KAAK,KAAK,KAAK;CAC9B;CACA,QAAQ,KAAK;EACT,IAAI,OAAO,QAAQ,UACf,MAAM,IAAI,UAAU,iDAAiD,OAAO,GAAG;EACnF,OAAOD,SAAO,OAAO,MAAM,KAAK;CACpC;CACA,IAAI,KAAK;EACL,OAAO,QAAQA;CACnB;CAEA,YAAY,KAAK;EACb,OAAO,CAAC,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,GAAG;CAC7C;CACA,MAAM,KAAK;EACP,QAAQ,MAAMC,WAASA;CAC3B;CACA,IAAI,KAAK;EACL,OAAO,IAAI,CAAC,KAAK,KAAK,KAAK;CAC/B;CACA,IAAI,KAAK,KAAK;EACV,OAAO,QAAQ;CACnB;CACA,IAAI,KAAK;EACL,OAAO,IAAI,MAAM,KAAK,KAAK,KAAK;CACpC;CACA,IAAI,KAAK,KAAK;EACV,OAAO,IAAI,MAAM,KAAK,KAAK,KAAK;CACpC;CACA,IAAI,KAAK,KAAK;EACV,OAAO,IAAI,MAAM,KAAK,KAAK,KAAK;CACpC;CACA,IAAI,KAAK,KAAK;EACV,OAAO,IAAI,MAAM,KAAK,KAAK,KAAK;CACpC;CACA,IAAI,KAAK,OAAO;EACZ,OAAO,IAAI,KAAK,OAAO,KAAK,KAAK;CACrC;CACA,IAAI,KAAK,KAAK;EACV,OAAO,IAAI,MAAM,OAAO,KAAK,KAAK,KAAK,GAAG,KAAK,KAAK;CACxD;CAEA,KAAK,KAAK;EACN,OAAO,MAAM;CACjB;CACA,KAAK,KAAK,KAAK;EACX,OAAO,MAAM;CACjB;CACA,KAAK,KAAK,KAAK;EACX,OAAO,MAAM;CACjB;CACA,KAAK,KAAK,KAAK;EACX,OAAO,MAAM;CACjB;CACA,IAAI,KAAK;EACL,OAAO,OAAO,KAAK,KAAK,KAAK;CACjC;CACA,KAAK,KAAK;EAGN,IAAI,OAAO,WAAW,IAAI,IAAI;EAC9B,IAAI,CAAC,MACD,WAAW,IAAI,MAAO,OAAO,OAAO,KAAK,KAAK,CAAE;EACpD,OAAO,KAAK,MAAM,GAAG;CACzB;CACA,QAAQ,KAAK;EAIT,OAAO,KAAK,OAAO,gBAAgB,KAAK,KAAK,KAAK,IAAI,gBAAgB,KAAK,KAAK,KAAK;CACzF;CACA,UAAU,OAAO,iBAAiB,OAAO;EACrC,OAAO,KAAK;EACZ,MAAM,EAAE,UAAU,gBAAgB,OAAO,MAAM,OAAO,MAAM,iBAAiB;EAC7E,IAAI,gBAAgB;GAGhB,IAAI,MAAM,SAAS,KAAK,CAAC,eAAe,SAAS,MAAM,MAAM,KAAK,MAAM,SAAS,OAC7E,MAAM,IAAI,MAAM,+BAA+B,iBAAiB,iBAAiB,MAAM,MAAM;GAEjG,MAAM,SAAS,IAAI,WAAW,KAAK;GAEnC,OAAO,IAAI,OAAO,OAAO,IAAI,OAAO,SAAS,MAAM,MAAM;GACzD,QAAQ;EACZ;EACA,IAAI,MAAM,WAAW,OACjB,MAAM,IAAI,MAAM,+BAA+B,QAAQ,iBAAiB,MAAM,MAAM;EACxF,IAAI,SAAS,OAAO,gBAAgB,KAAK,IAAI,gBAAgB,KAAK;EAClE,IAAI,cACA,SAAS,IAAI,QAAQ,KAAK;EAC9B,IAAI,CAAC;OACG,CAAC,KAAK,QAAQ,MAAM,GACpB,MAAM,IAAI,MAAM,kDAAkD;EAAA;EAG1E,OAAO;CACX;CAEA,YAAY,KAAK;EAIb,OAAO,cAAc,MAAM,KAAK,IAAI;CACxC;CAGA,KAAK,GAAG,GAAG,WAAW;EAGlB,MAAM,WAAW,WAAW;EAC5B,OAAO,YAAY,IAAI;CAC3B;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAgB,MAAM,OAAO,OAAO,CAAC,GAAG;CAKpC,OAAO,OAAO,OAAO,SAAS;CAC9B,OAAO,IAAI,OAAO,OAAO,IAAI;AACjC;;;;;;;;;;;;;;;AA4DA,SAAgB,oBAAoB,YAAY;CAC5C,IAAI,OAAO,eAAe,UACtB,MAAM,IAAI,MAAM,4BAA4B;CAEhD,IAAI,cAAcA,OACd,MAAM,IAAI,MAAM,oCAAoC;CAExD,MAAM,YAAY,OAAO,aAAaA,KAAG;CACzC,OAAO,KAAK,KAAK,YAAY,CAAC;AAClC;;;;;;;;;;;;;;;;;AAiBA,SAAgB,iBAAiB,YAAY;CACzC,MAAM,SAAS,oBAAoB,UAAU;CAC7C,OAAO,SAAS,KAAK,KAAK,SAAS,CAAC;AACxC;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,eAAe,KAAK,YAAY,OAAO,OAAO;CAC1D,OAAO,GAAG;CACV,MAAM,MAAM,IAAI;CAChB,MAAM,WAAW,oBAAoB,UAAU;CAC/C,MAAM,SAAS,KAAK,IAAI,iBAAiB,UAAU,GAAG,EAAE;CAGxD,IAAI,MAAM,UAAU,MAAM,MACtB,MAAM,IAAI,MAAM,cAAc,SAAS,+BAA+B,GAAG;CAO7E,MAAM,UAAU,IANJ,OAAO,gBAAgB,GAAG,IAAI,gBAAgB,GAAG,GAMpC,aAAaA,KAAG,IAAIA;CAC7C,OAAO,OAAO,gBAAgB,SAAS,QAAQ,IAAI,gBAAgB,SAAS,QAAQ;AACxF;;;;;;;;;ACn8BA,IAAMK,QAAsB,uBAAO,CAAC;AACpC,IAAMC,QAAsB,uBAAO,CAAC;AACpC,IAAMC,QAAsB,uBAAO,CAAC;AACpC,IAAM,cAAc;AACpB,IAAM,aAAa;AAInB,IAAM,YAAY;AAIlB,IAAM,kBAAkC,uBAAO,KAAK,GAAA,CAAI;;;;;;;;;;;;;;;;AAgBxD,SAAgB,kBAAkB,OAAO;CACrC,MAAM,KAAK;CACX,IAAI,OAAO,OAAO,YACd,MAAM,IAAI,UAAU,8CAA4C,OAAO,KAAK;CAChF,UAAU,GAAG,YAAY,kBAAkB;CAC3C,UAAU,GAAG,WAAW,iBAAiB;CACzC,UAAU,GAAG,SAAS,eAAe;CAGrC,QAAQ,GAAG,MAAM,YAAY;CAC7B,QAAQ,GAAG,MAAM,YAAY;CAC7B,cAAc,GAAG,EAAE;CACnB,cAAc,GAAG,EAAE;AACvB;;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,WAAW,GAAG,QAAQ;CAElC,kBAAkB,CAAC;CACnB,kBAAkB,QAAQ,CAAC;CAI3B,MAAM,aAAa,cAAc,EAAE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;CAC7D,OAAO,OAAO,KAAK,GAAG,MAAM,EAAE,WAAW,EAAE,SAAS,WAAW,EAAE,CAAC,CAAC;AACvE;AACA,SAAS,UAAU,GAAG,MAAM,MAAM,GAAG;CACjC,IAAI,CAAC,OAAO,cAAc,CAAC,KAAK,IAAI,OAAO,IAAI,MAC3C,MAAM,IAAI,MAAM,oCAAoC,MAAM,OAAO,OAAO,cAAc,CAAC;AAC/F;AAIA,SAAS,mBAAmB,WAAW,SAAS;CAC5C,MAAM,QAAQ,aAAa,IAAI,UAAU;CACzC,IAAI,QAAQ,iBACR,MAAM,IAAI,MAAM,4CACZ,KAAK,KAAK,QAAQ,KAAK,EAAE,IACzB,eACA,kBAAkB,KAAK,KACvB,MAAM;AAClB;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,iBAAiB,aAAa,QAAQ;CAClD,IAAI,gBAAgB,KAAA,GAChB,OAAO,KAAA;CACX,UAAU,aAAa,aAAa;CACpC,IAAI;EACA,MAAM,QAAQ,YAAY,MAAM;EAChC,IAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,WAAW,QACpC,OAAO,KAAA;CACf,QACM;EACF;CACJ;CACA,OAAO;AACX;AACA,SAAS,kBAAkB,QAAQ,GAAG;CAClC,OAAO,QAAQ,QAAQ;CACvB,OAAO,SAAS,GAAG,MAAM;EACrB,IAAI,EAAE,aAAa,IACf,MAAM,IAAI,MAAM,4BAA4B,CAAC;CACrD,CAAC;AACL;AAGA,SAAS,mBAAmB,SAAS,OAAO,WAAW;CACnD,IAAI,CAAC,MAAM,QAAQ,OAAO,GACtB,MAAM,IAAI,MAAM,2BAA2B;CAC/C,QAAQ,SAAS,GAAG,MAAM;EAEtB,IAAI,EADO,cAAc,KAAA,IAAY,MAAM,QAAQ,CAAC,IAAI,SAAS,CAAC,KAAK,IAAI,YAEvE,MAAM,IAAI,MAAM,6BAA6B,CAAC;CACtD,CAAC;AACL;AACA,IAAM,mCAAmB,IAAI,QAAQ;AACrC,SAAS,cAAc,GAAG;CAEtB,OAAO,iBAAiB,IAAI,CAAC,KAAK;AACtC;;AAEA,SAAS,aAAa,GAAG,MAAM;CAC3B,MAAM,MAAM,EAAE,OAAO;CACrB,MAAM,IAAI,CAAC,CAAC;CACZ,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KACtB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC;CAC5B,OAAO;AACX;;;;;AAKA,SAAS,WAAW,GAAG,GAAG;CACtB,MAAM,OAAO,KAAK;CAClB,MAAM,OAAO,OAAO;CACpB,MAAM,OAAO,OAAO,OAAO,CAAC;CAC5B,MAAM,IAAI,CAAC;CACX,OAAO,IAAIF,OAAK;EACZ,IAAI,IAAI;EACR,IAAI,IAAIC,OAAK;GACT,IAAI,OAAO,IAAI,IAAI;GACnB,IAAI,KAAK,MACL,KAAK;GACT,KAAK,OAAO,CAAC;EACjB;EACA,EAAE,KAAK,CAAC;EACR,MAAMA;CACV;CACA,OAAO;AACX;;;;;;AAMA,SAAS,mBAAmB,GAAG,GAAG,SAAS;CACvC,MAAM,OAAO,KAAK;CAClB,MAAM,OAAO,OAAO;CACpB,MAAM,OAAO,OAAO,OAAO,CAAC;CAC5B,MAAM,UAAU,OAAO,CAAC;CACxB,MAAM,IAAI,CAAC;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK;EAC9B,IAAI,IAAI,OAAO,IAAI,IAAI;EACvB,MAAM;EACN,IAAI,IAAI,MAAM;GACV,KAAK;GACL,KAAKA;EACT;EACA,EAAE,KAAK,CAAC;CACZ;CAEA,IAAI,MAAMD,OACN,MAAM,IAAI,MAAM,cAAc;CAClC,OAAO;AACX;;;;;;AAMA,SAAS,SAAS,MAAM,QAAQ,QAAQ;CACpC,IAAI,MAAM;CACV,KAAK,MAAM,KAAK,QACZ,MAAM,KAAK,IAAI,KAAK,EAAE,MAAM;CAChC,IAAI,MAAM;CACV,KAAK,IAAI,MAAM,MAAM,GAAG,OAAO,GAAG,OAAO;EACrC,IAAI,QAAQ,MAAM,GACd,MAAM,IAAI,OAAO;EACrB,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;GACpC,MAAM,IAAI,OAAO,EAAE,CAAC;GACpB,IAAI,GAAG;IACH,MAAM,OAAO,OAAO,EAAE,CAAE,KAAK,IAAI,CAAC,IAAI,KAAM;IAC5C,MAAM,IAAI,IAAI,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI;GAC9C;EACJ;CACJ;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,IAAa,mBAAb,MAA8B;CAC1B;CACA;CACA;CACA;CACA,kCAAkB,IAAI,QAAQ;CAC9B;CACA;CAEA,YAAY,OAAO,aAAa;EAC5B,kBAAkB,KAAK;EAKvB,KAAK,cAAc,iBAAiB,aAAa,WAAW;EAC5D,KAAK,QAAQ;EACb,KAAK,OAAO,MAAM;EAClB,KAAK,OAAO,MAAM;EAClB,KAAK,OAAO,MAAM,GAAG;CACzB;;;;;;;;;;;CAWA,eAAe,OAAO,GAAG,MAAM;EAI3B,MAAM,UAAU,KAAK,KAAK,OAAO,CAAC,IAAI;EACtC,MAAM,OAAO,MAAM,IAAI;EACvB,MAAM,OAAO,CAAC;EACd,IAAI,OAAO;EACX,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK;GAC9B,IAAI,MAAM;GACV,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KAAK;IAC3B,KAAK,KAAK,GAAG;IACb,MAAM,IAAI,IAAI,IAAI;GACtB;GACA,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC,OAAO;EACxC;EACA,OAAO;GAAE;GAAG;GAAM;GAAS;EAAK;CACpC;;;;;;;;;;CAUA,aAAa,aAAa,GAAG;EACzB,MAAM,EAAE,GAAG,SAAS,SAAS;EAC7B,MAAM,OAAO,MAAM,IAAI;EACvB,MAAM,SAAS,mBAAmB,GAAG,GAAG,OAAO;EAC/C,IAAI,IAAI,KAAK;EACb,IAAI,IAAI,KAAK;EACb,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK;GAC9B,MAAM,QAAQ,OAAO;GACrB,MAAM,QAAQ,IAAI;GAElB,MAAM,MAAM,KAAK,IAAI,KAAK,IAAI;GAC9B,IAAI,MAAM,KAAK;GACf,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KACtB,MAAM,MAAM,MAAM,KAAK,QAAQ,KAAK;GACxC,MAAM,MAAM,IAAI,OAAO;GACvB,IAAI,UAAU,GACV,IAAI,EAAE,IAAI,KAAK,MAAM;QAErB,IAAI,EAAE,IAAI,QAAQ,IAAI,MAAM,GAAG;EACvC;EACA,OAAO;GAAE;GAAG;EAAE;CAClB;CAIA,mBAAmB,GAAG,OAAO,MAAM,WAAW;EAC1C,IAAI,UAAU,KAAK,gBAAgB,IAAI,KAAK;EAC5C,IAAI,OAAO,SAAS,MAAM,UAAU,MAAM,MAAM,KAAK,MAAM,SAAS,IAAI;EACxE,IAAI,CAAC,MAAM;GACP,OAAO,KAAK,eAAe,OAAO,GAAG,IAAI;GACzC,IAAI,OAAO,cAAc,YACrB,OAAO;IAAE,GAAG;IAAM,MAAM,UAAU,KAAK,IAAI;GAAE;GACjD,IAAI,CAAC,SAAS;IACV,UAAU,CAAC;IACX,KAAK,gBAAgB,IAAI,OAAO,OAAO;GAC3C;GACA,QAAQ,KAAK,IAAI;EACrB;EACA,OAAO;CACX;CACA,YAAY,OAAO;EACf,IAAI,EAAE,iBAAiB,KAAK,QACxB,MAAM,IAAI,UAAU,iDAA+C,OAAO,KAAK;CACvF;CAIA,iBAAiB,OAAO,QAAQ;EAC5B,KAAK,YAAY,KAAK;EACtB,IAAI,CAAC,QAAQ,QAAQC,OAAK,KAAK,MAAM,GAAG,KAAK,GACzC,MAAM,IAAI,MAAM,gBAAgB;CACxC;CAIA,MAAM,OAAO,GAAG,MAAM,WAAW;EAC7B,MAAM,IAAI,cAAc,KAAK;EAC7B,IAAI,MAAM,GACN,OAAO,KAAK,cAAc,OAAO,GAAG,IAAI;EAC5C,OAAO,KAAK,aAAa,KAAK,mBAAmB,GAAG,OAAO,MAAM,SAAS,GAAG,CAAC;CAClF;CACA,MAAM,OAAO,QAAQ,WAAW;EAC5B,KAAK,iBAAiB,OAAO,MAAM;EACnC,OAAO,KAAK,MAAM,OAAO,QAAQ,KAAK,MAAM,SAAS;CACzD;CACA,aAAa,OAAO,QAAQ,WAAW;EACnC,KAAK,iBAAiB,OAAO,MAAM;EAKnC,IAAI,KAAK,gBAAgB,KAAA,GACrB,MAAM,IAAI,MAAM,6CAA6C;EACjE,MAAM,OAAO,KAAK,MAAM,GAAG,OAAO;EAClC,MAAM,QAAQ,KAAK,YAAY,WAAW;EAC1C,IAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,WAAW,aACpC,MAAM,IAAI,MAAM,yCAAyC;EAS7D,MAAM,KAAM,MAAM,KAAK,KAAQ;EAK/B,MAAM,IAAI,SAAS,gBAAgB,KAAK,IAAI,KAAK,MAAM,GAAG;EAC1D,OAAO,KAAK,MAAM,OAAO,GAAG,MAAM,SAAS;CAC/C;;;;;;;;;;;;;;;;CAgBA,cAAc,OAAO,GAAG,MAAM;EAC1B,MAAM,IAAI;EACV,MAAM,OAAO,KAAK;EAClB,MAAM,OAAO,QAAQ,CAAC;EAEtB,MAAM,QAAQ,IAAI,MAAM,IAAI;EAC5B,MAAM,KAAK,KAAK;EAChB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KACtB,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC,IAAI,KAAK;EAErC,MAAM,UAAU,KAAK,KAAK,OAAO,CAAC;EAClC,IAAI,MAAM,KAAK;EACf,KAAK,IAAI,SAAS,UAAU,GAAG,UAAU,GAAG,UAAU;GAGlD,IAAI,WAAW,UAAU,GACrB,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KACnB,MAAM,IAAI,OAAO;GACzB,MAAM,QAAQ,OAAQ,KAAK,OAAO,SAAS,CAAC,IAAK,IAAI;GAErD,IAAI,MAAM,MAAM;GAChB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KACtB,MAAM,MAAM,QAAQ,MAAM,KAAK;GACnC,MAAM,IAAI,IAAI,GAAG;EACrB;EACA,OAAO;GAAE,GAAG;GAAK,GAAG;EAAI;CAC5B;CACA,YAAY,OAAO,UAAU;EAEzB,IAAI,KAAK,gBAAgB,KAAA,GACrB,OAAO;EACX,IAAI,aAAaA,OACb,OAAO;EACX,IAAI,UAAU,KAAK,MACf,OAAO;EACX,IAAI,KAAK,qBAAqB,KAAA,GAC1B,KAAK,mBAAmB,KAAK,UAAU,KAAK,MAAM,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI;EAC/E,OAAO,KAAK;CAChB;CACA,UAAU,OAAO,QAAQ,UAAU,WAAW;EAC1C,OAAO,KAAK,YAAY,OAAO,QAAQ,IACjC,KAAK,aAAa,OAAO,QAAQ,SAAS,IAC1C,KAAK,MAAM,OAAO,QAAQ,SAAS;CAC7C;CACA,UAAU,OAAO,QAAQ,WAAW;EAChC,KAAK,YAAY,KAAK;EACtB,IAAI,CAAC,SAAS,MAAM,GAChB,MAAM,IAAI,MAAM,gBAAgB;EACpC,MAAM,IAAI,cAAc,KAAK;EAQ7B,IAAI,MAAM,KAAK,UAAU,KAAK,MAAM,GAAG,OACnC,OAAO,aAAa,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,IAAI;EAI3D,MAAM,cAAc,KAAK,mBAAmB,GAAG,OAAO,KAAK,MAAM,SAAS;EAC1E,OAAO,KAAK,aAAa,aAAa,MAAM,CAAC,CAAC;CAClD;CAKA,cAAc,OAAO,GAAG;EACpB,KAAK,YAAY,KAAK;EACtB,UAAU,GAAG,KAAK,IAAI;EAGtB,oBADgB,KAAK,MAAM,KAAK,OAAO,cAAc,CAAC,IAAI,KAC7B,MAAM,IAAI,IAAI,KAAK,MAAM,GAAG,KAAK;EAC9D,iBAAiB,IAAI,OAAO,CAAC;EAC7B,KAAK,gBAAgB,OAAO,KAAK;CACrC;CAEA,cAAc,OAAO;EACjB,OAAO,cAAc,KAAK,MAAM;CACpC;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAgB,aAAa,GAAG,QAAQ,SAAS,iBAAiB,OAAO;CACrE,kBAAkB,CAAC;CACnB,kBAAkB,QAAQ,CAAC;CAC3B,MAAM,gBAAgB,gBAAgB;CAEtC,mBAAmB,SAAS,EAAE,IAAI,iBAAiB,EAAE,GAAG,SAASC,QAAM,KAAA,CAAS;CAChF,IAAI,OAAO,WAAW,QAAQ,QAC1B,MAAM,IAAI,MAAM,qDAAqD;CACzE,MAAM,SAAS,OAAO,KAAK,MAAM,aAAa,GAAG,CAAC,CAAC;CACnD,MAAM,SAAS,QAAQ,KAAK,MAAM,WAAW,GAAG,CAAC,CAAC;CAClD,OAAO,SAAS,EAAE,MAAM,QAAQ,MAAM;AAC1C;AAsHA,SAAS,YAAY,OAAO,OAAO,MAAM;CACrC,IAAI,OAAO;EAIP,IAAI,MAAM,UAAU,OAChB,MAAM,IAAI,MAAM,gDAAgD;EACpE,cAAc,KAAK;EACnB,OAAO;CACX,OAEI,OAAO,MAAM,OAAO,EAAE,KAAK,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAgB,kBAAkB,MAAM,OAAO,YAAY,CAAC,GAAG,QAAQ;CACnE,IAAI,SAAS,iBAAiB,SAAS,WACnC,MAAM,IAAI,MAAM,oDAAgD;CACpE,IAAI,WAAW,KAAA,GACX,SAAS,SAAS;CACtB,IAAI,CAAC,SAAS,OAAO,UAAU,UAC3B,MAAM,IAAI,MAAM,kBAAkB,KAAK,cAAc;CAEzD,eAAe,SAAS;CACxB,KAAK,MAAM,KAAK;EAAC;EAAK;EAAK;CAAG,GAAG;EAC7B,MAAM,MAAM,MAAM;EAClB,IAAI,EAAE,SAAS,GAAG,KAAK,QAAQF,QAC3B,MAAM,IAAI,MAAM,SAAS,EAAE,yBAAyB;CAC5D;CACA,MAAM,KAAK,YAAY,MAAM,GAAG,UAAU,IAAI,MAAM;CACpD,MAAM,KAAK,YAAY,MAAM,GAAG,UAAU,IAAI,MAAM;CAEpD,MAAM,SAAS;EAAC;EAAM;EAAM;EADjB,SAAS,gBAAgB,MAAM;CACP;CACnC,KAAK,MAAM,KAAK,QAEZ,IAAI,CAAC,GAAG,QAAQ,MAAM,EAAE,GACpB,MAAM,IAAI,MAAM,SAAS,EAAE,yCAAyC;CAE5E,QAAQ,OAAO,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC;CAC9C,OAAO;EAAE;EAAO;EAAI;CAAG;AAC3B;;;;;;;;;;;;;;;AAeA,SAAgB,aAAa,iBAAiB,cAAc;CACxD,OAAO,SAAS,OAAO,MAAM;EACzB,MAAM,YAAY,gBAAgB,IAAI;EACtC,OAAO;GAAE;GAAW,WAAW,aAAa,SAAS;EAAE;CAC3D;AACJ;;;;;;;;;;;;ACruBA,IAAa,QAAb,MAAmB;CACf;CACA;CACA;CACA;CACA,SAAS;CACT,WAAW;CACX,YAAY;CACZ,YAAY,MAAM,KAAK;EACnB,MAAM,IAAI;EACV,SAAO,KAAK,KAAA,GAAW,KAAK;EAC5B,KAAK,QAAQ,KAAK,OAAO;EACzB,IAAI,OAAO,KAAK,MAAM,WAAW,YAC7B,MAAM,IAAI,MAAM,wBAAwB;EAC5C,KAAK,WAAW,KAAK,MAAM;EAC3B,KAAK,YAAY,KAAK,MAAM;EAC5B,MAAM,WAAW,KAAK;EACtB,MAAM,MAAM,IAAI,WAAW,QAAQ;EAEnC,IAAI,IAAI,IAAI,SAAS,WAAW,KAAK,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,GAAG;EACxE,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAC5B,IAAI,MAAM;EACd,KAAK,MAAM,OAAO,GAAG;EAGrB,KAAK,QAAQ,KAAK,OAAO;EAEzB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAC5B,IAAI,MAAM;EACd,KAAK,MAAM,OAAO,GAAG;EACrB,MAAM,GAAG;CACb;CACA,OAAO,KAAK;EACR,QAAQ,IAAI;EACZ,KAAK,MAAM,OAAO,GAAG;EACrB,OAAO;CACX;CACA,WAAW,KAAK;EACZ,QAAQ,IAAI;EACZ,QAAQ,KAAK,IAAI;EACjB,KAAK,WAAW;EAChB,MAAM,MAAM,IAAI,SAAS,GAAG,KAAK,SAAS;EAG1C,KAAK,MAAM,WAAW,GAAG;EACzB,KAAK,MAAM,OAAO,GAAG;EACrB,KAAK,MAAM,WAAW,GAAG;EACzB,KAAK,QAAQ;CACjB;CACA,SAAS;EACL,MAAM,MAAM,IAAI,WAAW,KAAK,MAAM,SAAS;EAC/C,KAAK,WAAW,GAAG;EACnB,OAAO;CACX;CACA,WAAW,IAAI;EAGX,OAAO,OAAO,OAAO,OAAO,eAAe,IAAI,GAAG,CAAC,CAAC;EACpD,MAAM,EAAE,OAAO,OAAO,UAAU,WAAW,UAAU,WAAW,WAAW;EAC3E,KAAK;EACL,GAAG,WAAW;EACd,GAAG,YAAY;EACf,GAAG,WAAW;EACd,GAAG,YAAY;EACf,GAAG,SAAS;EACZ,GAAG,QAAQ,MAAM,WAAW,GAAG,KAAK;EACpC,GAAG,QAAQ,MAAM,WAAW,GAAG,KAAK;EACpC,OAAO;CACX;CACA,QAAQ;EACJ,OAAO,KAAK,WAAW;CAC3B;CACA,UAAU;EACN,KAAK,YAAY;EACjB,KAAK,MAAM,QAAQ;EACnB,KAAK,MAAM,QAAQ;CACvB;AACJ;AACA,IAAa,OAAuB,uBAAO;CACvC,MAAM,UAAU,MAAM,KAAK,YAAY,IAAI,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO;CACnF,MAAM,UAAU,MAAM,QAAQ,IAAI,MAAM,MAAM,GAAG;CACjD,OAAO;AACX,EAAA,CAAG;;;;;;;;;ACrFH,IAAMG,QAAsB,uBAAO,CAAC;;;;;;;;;;AAUpC,IAAa,SAAb,cAA4B,MAAM;CAC9B,YAAY,IAAI,IAAI;EAChB,MAAM,CAAC;CACX;AACJ;AAGA,IAAM,OAAO;CAET,KAAK;CAEL,MAAM;EACF,SAAS,KAAK,SAAS;GACnB,MAAM,EAAE,KAAK,MAAM;GACnB,YAAY,KAAK,KAAK;GACtB,IAAI,MAAM,KAAK,MAAM,KACjB,MAAM,IAAI,EAAE,uBAAuB;GACvC,QAAQ,MAAM,MAAM;GAGpB,IAAI,KAAK,SAAS,GACd,MAAM,IAAI,EAAE,2BAA2B;GAC3C,MAAM,UAAU,KAAK,SAAS;GAC9B,MAAM,MAAM,oBAAoB,OAAO;GACvC,IAAK,IAAI,SAAS,IAAK,KACnB,MAAM,IAAI,EAAE,sCAAsC;GAEtD,MAAM,SAAS,UAAU,MAAM,oBAAqB,IAAI,SAAS,IAAK,GAAW,IAAI;GAErF,OADU,oBAAoB,GACvB,IAAI,SAAS,MAAM;EAC9B;EAEA,OAAO,KAAK,MAAM;GACd,MAAM,EAAE,KAAK,MAAM;GACnB,OAAO,OAAO,MAAM,KAAA,GAAW,UAAU;GACzC,IAAI,MAAM;GACV,IAAI,MAAM,KAAK,MAAM,KACjB,MAAM,IAAI,EAAE,uBAAuB;GACvC,IAAI,KAAK,SAAS,KAAK,KAAK,WAAW,KACnC,MAAM,IAAI,EAAE,uBAAuB;GACvC,MAAM,QAAQ,KAAK;GAEnB,MAAM,SAAS,CAAC,EAAE,QAAQ;GAC1B,IAAI,SAAS;GACb,IAAI,CAAC,QACD,SAAS;QACR;IAED,MAAM,SAAS,QAAQ;IACvB,IAAI,CAAC,QACD,MAAM,IAAI,EAAE,mDAAmD;IAEnE,IAAI,SAAS,GACT,MAAM,IAAI,EAAE,0CAA0C;IAC1D,MAAM,cAAc,KAAK,SAAS,KAAK,MAAM,MAAM;IACnD,IAAI,YAAY,WAAW,QACvB,MAAM,IAAI,EAAE,uCAAuC;IACvD,IAAI,YAAY,OAAO,GACnB,MAAM,IAAI,EAAE,sCAAsC;IACtD,KAAK,MAAM,KAAK,aACZ,SAAU,UAAU,IAAK;IAC7B,OAAO;IACP,IAAI,SAAS,KACT,MAAM,IAAI,EAAE,wCAAwC;GAC5D;GACA,MAAM,IAAI,KAAK,SAAS,KAAK,MAAM,MAAM;GACzC,IAAI,EAAE,WAAW,QACb,MAAM,IAAI,EAAE,gCAAgC;GAChD,OAAO;IAAE;IAAG,GAAG,KAAK,SAAS,MAAM,MAAM;GAAE;EAC/C;CACJ;CAKA,MAAM;EACF,OAAO,KAAK;GACR,MAAM,EAAE,KAAK,MAAM;GACnB,WAAW,GAAG;GACd,IAAI,MAAMA,OACN,MAAM,IAAI,EAAE,4CAA4C;GAC5D,IAAI,MAAM,oBAAoB,GAAG;GAEjC,IAAI,OAAO,SAAS,IAAI,IAAI,EAAE,IAAI,GAC9B,MAAM,OAAO;GACjB,IAAI,IAAI,SAAS,GACb,MAAM,IAAI,EAAE,gDAAgD;GAChE,OAAO;EACX;EACA,OAAO,MAAM;GACT,MAAM,EAAE,KAAK,MAAM;GACnB,IAAI,KAAK,SAAS,GACd,MAAM,IAAI,EAAE,kCAAkC;GAClD,IAAI,KAAK,KAAK,KACV,MAAM,IAAI,EAAE,qCAAqC;GAErD,IAAI,KAAK,SAAS,KAAK,KAAK,OAAO,KAAQ,EAAE,KAAK,KAAK,MACnD,MAAM,IAAI,EAAE,qDAAqD;GACrE,OAAO,gBAAgB,IAAI;EAC/B;CACJ;CACA,MAAM,OAAO,gBAAgB;EAEzB,MAAM,EAAE,KAAK,GAAG,MAAM,KAAK,MAAM,QAAQ;EACzC,IAAI,mBAAmB,KAAA,GAAW;GAC9B,YAAY,gBAAgB,gBAAgB;GAC5C,IAAI,iBAAiB,GACjB,MAAM,IAAI,EAAE,oDAAoD;EACxE;EACA,MAAM,OAAO,OAAO,OAAO,KAAA,GAAW,WAAW;EACjD,MAAM,EAAE,GAAG,UAAU,GAAG,iBAAiB,IAAI,OAAO,IAAM,IAAI;EAC9D,IAAI,aAAa,QACb,MAAM,IAAI,EAAE,6CAA6C;EAC7D,MAAM,EAAE,GAAG,QAAQ,GAAG,eAAe,IAAI,OAAO,GAAM,QAAQ;EAC9D,MAAM,EAAE,GAAG,QAAQ,GAAG,eAAe,IAAI,OAAO,GAAM,UAAU;EAChE,IAAI,WAAW,QACX,MAAM,IAAI,EAAE,6CAA6C;EAE7D,IAAI,mBAAmB,KAAA,MAClB,OAAO,SAAS,kBAAkB,OAAO,SAAS,iBACnD,MAAM,IAAI,EAAE,sCAAsC;EACtD,OAAO;GAAE,GAAG,IAAI,OAAO,MAAM;GAAG,GAAG,IAAI,OAAO,MAAM;EAAE;CAC1D;CACA,WAAW,KAAK;EACZ,MAAM,EAAE,MAAM,KAAK,MAAM,QAAQ;EACjC,eAAe,KAAK;GAAE,GAAG;GAAU,GAAG;EAAS,GAAG,CAAC,GAAG,KAAK;EAG3D,MAAM,MAFK,IAAI,OAAO,GAAM,IAAI,OAAO,IAAI,CAAC,CAE/B,IADF,IAAI,OAAO,GAAM,IAAI,OAAO,IAAI,CAAC,CAC1B;EAClB,OAAO,IAAI,OAAO,IAAM,GAAG;CAC/B;AACJ;;;;;;;;;;;;;;;AAeA,IAAa,MAAsB,uBAAO;CACtC,OAAO,OAAO,KAAK,IAAI;CACvB,OAAO,OAAO,KAAK,IAAI;CACvB,OAAO,OAAO,OAAO,IAAI;AAC7B,EAAA,CAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AChIH,IAAM,cAAc,KAAK,SAAS,OAAO,OAAO,IAAI,MAAM,CAAC,OAAOC,SAAO;;AAEzE,SAAgB,iBAAiB,GAAG,OAAO,GAAG;CAM1C,SAAS,UAAU,GAAGC,OAAK,CAAC;CAE5B,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO;CAC7B,MAAM,KAAK,WAAW,KAAK,GAAG,CAAC;CAC/B,MAAM,KAAK,WAAW,CAAC,KAAK,GAAG,CAAC;CAGhC,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK;CAC5B,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;CACzB,MAAM,QAAQ,KAAKA;CACnB,MAAM,QAAQ,KAAKA;CACnB,IAAI,OACA,KAAK,CAAC;CACV,IAAI,OACA,KAAK,CAAC;CAIV,MAAM,UAAU,QAAQ,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI;CACpD,IAAI,KAAKA,SAAO,MAAM,WAAW,KAAKA,SAAO,MAAM,SAC/C,MAAM,IAAI,MAAM,0CAA0C;CAE9D,OAAO;EAAE;EAAO;EAAI;EAAO;CAAG;AAClC;AACA,SAAS,kBAAkB,QAAQ;CAC/B,IAAI,CAAC;EAAC;EAAW;EAAa;CAAK,CAAC,CAAC,SAAS,MAAM,GAChD,MAAM,IAAI,MAAM,iEAA2D;CAC/E,OAAO;AACX;AACA,SAAS,gBAAgB,MAAM,KAAK;CAChC,eAAe,IAAI;CACnB,MAAM,QAAQ,CAAC;CAIf,KAAK,IAAI,WAAW,OAAO,KAAK,GAAG,GAE/B,MAAM,WAAW,KAAK,aAAa,KAAA,IAAY,IAAI,WAAW,KAAK;CAEvE,MAAM,MAAM,MAAM,MAAM;CACxB,MAAM,MAAM,SAAS,SAAS;CAC9B,IAAI,MAAM,WAAW,KAAA,GACjB,kBAAkB,MAAM,MAAM;CAClC,OAAO;AACX;AAGA,IAAMA,QAAsB,uBAAO,CAAC,GAAG,MAAsB,uBAAO,CAAC,GAAGD,QAAsB,uBAAO,CAAC,GAAG,MAAsB,uBAAO,CAAC,GAAG,MAAsB,uBAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BxK,SAAgB,YAAY,QAAQ,YAAY,CAAC,GAAG;CAChD,MAAM,YAAY,kBAAkB,eAAe,QAAQ,SAAS;CACpE,MAAM,KAAK,UAAU;CACrB,MAAM,KAAK,UAAU;CACrB,IAAI,QAAQ,UAAU;CACtB,MAAM,EAAE,GAAG,UAAU,GAAG,gBAAgB;CACxC,eAAe,WAAW,CAAC,GAAG;EAC1B,oBAAoB;EACpB,eAAe;EACf,eAAe;EACf,WAAW;EACX,SAAS;EACT,MAAM;EACN,aAAa;CACjB,CAAC;CAGD,MAAM,EAAE,MAAM,UAAU,oBAAoB,eAAe,eAAe,WAAW,YAAa;CAClG,MAAM,cAAc,UAAU,gBAAgB,KAAA,IAAYE,gBAAgB,UAAU;CACpF,IAAI;MACI,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,OAAO,SAAS,SAAS,YAAY,CAAC,MAAM,QAAQ,SAAS,OAAO,GACxF,MAAM,IAAI,MAAM,gEAA4D;CAAA;CAGpF,MAAM,OAAO,WACP;EACE,MAAM,SAAS;EACf,SAAS,SAAS,QAAQ,KAAK,UAAU,CAAC,GAAG,KAAK,CAAC;CACvD,IACE,KAAA;CACN,MAAM,UAAU,YAAY,IAAI,EAAE;CAClC,SAAS,+BAA+B;EACpC,IAAI,CAAC,GAAG,OACJ,MAAM,IAAI,MAAM,4DAA4D;CACpF;CAEA,SAAS,aAAa,IAAI,OAAO,cAAc;EAI3C,IAAI,MAAM,IAAI,GAAG;GACb,IAAI,CAAC,oBACD,MAAM,IAAI,MAAM,iBAAiB;GACrC,OAAO,WAAW,GAAG,CAAC;EAC1B;EACA,MAAM,EAAE,GAAG,MAAM,MAAM,SAAS;EAChC,MAAM,KAAK,GAAG,QAAQ,CAAC;EACvB,MAAM,cAAc,cAAc;EAClC,IAAI,cAAc;GACd,6BAA6B;GAE7B,OAAO,YAAY,QAAQ,CADT,GAAG,MAAM,CAAC,CACO,GAAG,EAAE;EAC5C,OAEI,OAAO,YAAY,WAAW,GAAG,CAAI,GAAG,IAAI,GAAG,QAAQ,CAAC,CAAC;CAEjE;CACA,SAAS,eAAe,OAAO;EAC3B,OAAO,OAAO,KAAA,GAAW,OAAO;EAChC,MAAM,EAAE,WAAW,MAAM,uBAAuB,WAAW;EAC3D,MAAM,SAAS,MAAM;EACrB,MAAM,OAAO,MAAM;EACnB,MAAM,OAAO,MAAM,SAAS,CAAC;EAM7B,IAAI,sBAAsB,WAAW,KAAK,SAAS,GAC/C,OAAO;GAAE,GAAG,GAAG;GAAM,GAAG,GAAG;EAAK;EAEpC,IAAI,WAAW,SAAS,SAAS,KAAQ,SAAS,IAAO;GACrD,MAAM,IAAI,GAAG,UAAU,IAAI;GAC3B,IAAI,CAAC,GAAG,QAAQ,CAAC,GACb,MAAM,IAAI,MAAM,qCAAqC;GACzD,MAAM,KAAK,oBAAoB,CAAC;GAChC,IAAI;GACJ,IAAI;IACA,IAAI,GAAG,KAAK,EAAE;GAClB,SACO,WAAW;IACd,MAAM,MAAM,qBAAqB,QAAQ,OAAO,UAAU,UAAU;IACpE,MAAM,IAAI,MAAM,2CAA2C,GAAG;GAClE;GACA,6BAA6B;GAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC;GAExB,KADe,OAAO,OAAO,MACf,OACV,IAAI,GAAG,IAAI,CAAC;GAChB,OAAO;IAAE;IAAG;GAAE;EAClB,OACK,IAAI,WAAW,UAAU,SAAS,GAAM;GAEzC,MAAM,IAAI,GAAG;GACb,MAAM,IAAI,GAAG,UAAU,KAAK,SAAS,GAAG,CAAC,CAAC;GAC1C,MAAM,IAAI,GAAG,UAAU,KAAK,SAAS,GAAG,IAAI,CAAC,CAAC;GAC9C,IAAI,CAAC,UAAU,GAAG,CAAC,GACf,MAAM,IAAI,MAAM,4BAA4B;GAChD,OAAO;IAAE;IAAG;GAAE;EAClB,OAEI,MAAM,IAAI,MAAM,yBAAyB,OAAO,wBAAwB,KAAK,mBAAmB,QAAQ;CAEhH;CACA,MAAM,cAAc,YAAY,KAAA,IAAY,eAAe;CAC3D,MAAM,cAAc,cAAc,KAAA,IAAY,iBAAiB;CAI/D,MAAM,KAAK,GAAG,IAAI,MAAM,GAAG,GAAG;CAC9B,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,KAAK,MAAM,GAAG,QAAQ,MAAM,GAAG,IAAI,MAAM,GAAG,CAAC;CACxE,SAAS,oBAAoB,GAAG;EAC5B,MAAM,KAAK,GAAG,IAAI,CAAC;EACnB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC;EACvB,OAAO,GAAG,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC;CACzD;;CAGA,SAAS,UAAU,GAAG,GAAG;EACrB,MAAM,OAAO,GAAG,IAAI,CAAC;EACrB,MAAM,QAAQ,oBAAoB,CAAC;EACnC,OAAO,GAAG,IAAI,MAAM,KAAK;CAC7B;CAIA,IAAI,CAAC,UAAU,MAAM,IAAI,MAAM,EAAE,GAC7B,MAAM,IAAI,MAAM,mCAAmC;CAGvD,MAAM,OAAO,GAAG,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,GAAG,GAAG;CAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;CAChD,IAAI,GAAG,IAAI,GAAG,IAAI,MAAM,KAAK,CAAC,GAC1B,MAAM,IAAI,MAAM,0BAA0B;;CAE9C,SAAS,OAAO,OAAO,GAAG,UAAU,OAAO;EACvC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAM,WAAW,GAAG,IAAI,CAAC,GACtC,MAAM,IAAI,MAAM,wBAAwB,OAAO;EAInD,OAAO,OAAO,MAAM,YAAY,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI;CAChE;CACA,SAAS,UAAU,OAAO;EACtB,IAAI,EAAE,iBAAiB,QACnB,MAAM,IAAI,MAAM,4BAA4B;CACpD;CACA,SAAS,iBAAiB,GAAG;EACzB,IAAI,CAAC,QAAQ,CAAC,KAAK,SACf,MAAM,IAAI,MAAM,SAAS;EAC7B,OAAO,iBAAiB,GAAG,KAAK,SAAS,GAAG,KAAK;CACrD;;;;;;;CAOA,SAAS,aAAa,QAAQ,SAAS,GAAG,GAAG;EACzC,IAAI,CAAC,GAAG,QAAQ,CAAC,GACb,MAAM,IAAI,WAAW,8BAA8B;EACvD,IAAI,MAAM;GACN,MAAM,EAAE,OAAO,IAAI,OAAO,OAAO,iBAAiB,CAAC;GACnD,MAAM,MAAM,IAAI,MAAM,GAAG,IAAI,EAAE,GAAG,KAAK,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC;GACtD,OAAO,KAAK,QAAQ,EAAE,OAAO,IAAI,GAAG,QAAQ,IAAI,OAAO,IAAI,GAAG;GAC9D,QAAQ,KAAK,IAAI,EAAE;EACvB,OACK;GACD,OAAO,KAAK,CAAC;GACb,QAAQ,KAAK,CAAC;EAClB;CACJ;CAMA,MAAM,gCAAgB,IAAI,QAAQ;;;;;;CAMlC,MAAM,MAAM;EACR,OAAO,OAAO,IAAI,MAAM,MAAM,IAAI,MAAM,IAAI,GAAG,GAAG;EAClD,OAAO,OAAO,IAAI,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,IAAI;EAChD,OAAO,KAAK;EACZ,OAAO,KAAK;EACZ;EACA;EACA;;EAEA,YAAY,GAAG,GAAG,GAAG;GACjB,KAAK,IAAI,OAAO,KAAK,CAAC;GAItB,KAAK,IAAI,OAAO,KAAK,GAAG,IAAI;GAC5B,KAAK,IAAI,OAAO,KAAK,CAAC;GACtB,OAAO,OAAO,IAAI;EACtB;EACA,OAAO,QAAQ;GACX,OAAO;EACX;;EAEA,OAAO,WAAW,GAAG;GACjB,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC;GACvB,IAAI,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,GACrC,MAAM,IAAI,MAAM,sBAAsB;GAC1C,IAAI,aAAa,OACb,MAAM,IAAI,MAAM,8BAA8B;GAElD,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GACrB,OAAO,MAAM;GACjB,OAAO,IAAI,MAAM,GAAG,GAAG,GAAG,GAAG;EACjC;EACA,OAAO,UAAU,OAAO;GACpB,MAAM,IAAI,MAAM,WAAW,YAAY,OAAO,OAAO,KAAA,GAAW,OAAO,CAAC,CAAC;GACzE,EAAE,eAAe;GACjB,OAAO;EACX;EACA,OAAO,QAAQ,KAAK;GAChB,OAAO,MAAM,UAAU,WAAW,GAAG,CAAC;EAC1C;EACA,IAAI,IAAI;GACJ,OAAO,KAAK,SAAS,CAAC,CAAC;EAC3B;EACA,IAAI,IAAI;GACJ,OAAO,KAAK,SAAS,CAAC,CAAC;EAC3B;;;;EAIA,WAAW,aAAa,GAAG,SAAS,MAAM;GACtC,KAAK,cAAc,MAAM,UAAU;GACnC,IAAI,CAAC,QACD,KAAK,SAAS,GAAG;GACrB,OAAO;EACX;;EAGA,iBAAiB;GACb,MAAM,IAAI;GACV,IAAI,EAAE,IAAI,GAAG;IAKT,IAAI,sBAAsB,GAAG,IAAI,EAAE,CAAC,KAAK,GAAG,IAAI,EAAE,GAAG,GAAG,GAAG,KAAK,GAAG,IAAI,EAAE,CAAC,GACtE;IACJ,MAAM,IAAI,MAAM,iBAAiB;GACrC;GACA,IAAI,cAAc,IAAI,CAAC,GACnB;GAEJ,MAAM,EAAE,GAAG,MAAM,EAAE,SAAS;GAC5B,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,GAC/B,MAAM,IAAI,MAAM,sCAAsC;GAC1D,IAAI,CAAC,UAAU,GAAG,CAAC,GACf,MAAM,IAAI,MAAM,mCAAmC;GACvD,IAAI,CAAC,EAAE,cAAc,GACjB,MAAM,IAAI,MAAM,wCAAwC;GAC5D,cAAc,IAAI,CAAC;EACvB;EACA,WAAW;GACP,MAAM,EAAE,MAAM,KAAK,SAAS;GAC5B,IAAI,CAAC,GAAG,OACJ,MAAM,IAAI,MAAM,6BAA6B;GACjD,OAAO,CAAC,GAAG,MAAM,CAAC;EACtB;;EAEA,OAAO,OAAO;GACV,UAAU,KAAK;GACf,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO;GAChC,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO;GAChC,MAAM,KAAK,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;GAChD,MAAM,KAAK,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;GAChD,OAAO,MAAM;EACjB;;EAEA,SAAS;GACL,OAAO,IAAI,MAAM,KAAK,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC;EACnD;EAKA,SAAS;GACL,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO;GAChC,IAAI,KAAK,GAAG,MAAM,KAAK,GAAG,MAAM,KAAK,GAAG;GACxC,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,KAAK,EAAE;GACZ,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,KAAK,EAAE;GACZ,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,KAAK,EAAE;GACZ,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,OAAO,IAAI,MAAM,IAAI,IAAI,EAAE;EAC/B;EAKA,IAAI,OAAO;GACP,UAAU,KAAK;GACf,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO;GAChC,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO;GAChC,IAAI,KAAK,GAAG,MAAM,KAAK,GAAG,MAAM,KAAK,GAAG;GACxC,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,KAAK,EAAE;GACZ,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,KAAK,EAAE;GACZ,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,KAAK,EAAE;GACZ,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,OAAO,IAAI,MAAM,IAAI,IAAI,EAAE;EAC/B;EACA,SAAS,OAAO;GAGZ,UAAU,KAAK;GACf,OAAO,KAAK,IAAI,MAAM,OAAO,CAAC;EAClC;EACA,MAAM;GACF,OAAO,KAAK,OAAO,MAAM,IAAI;EACjC;;;;;;;;EAQA,SAAS,QAAQ;GAIb,IAAI,CAAC,GAAG,YAAY,MAAM,GACtB,MAAM,IAAI,WAAW,8BAA8B;GACvD,MAAM,EAAE,GAAG,MAAM,KAAK,UAAU,MAAM,QAAQ,UAAU,SAAS;GACjE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;EAC7B;;;;;;;EAOA,eAAe,QAAQ;GACnB,MAAM,IAAI;GACV,MAAM,KAAK;GAGX,IAAI,CAAC,GAAG,QAAQ,EAAE,GACd,MAAM,IAAI,WAAW,8BAA8B;GACvD,IAAI,OAAOD,SAAO,EAAE,IAAI,GACpB,OAAO,MAAM;GACjB,IAAI,OAAO,KACP,OAAO;GACX,IAAI,KAAK,cAAc,IAAI,GACvB,OAAO,KAAK,UAAU,GAAG,IAAI,SAAS;GAC1C,MAAM,SAAS,CAAC;GAChB,MAAM,UAAU,CAAC;GACjB,aAAa,QAAQ,SAAS,GAAG,EAAE;GACnC,OAAO,aAAa,OAAO,QAAQ,OAAO;EAC9C;;;;;;;;EAQA,aAAa,GAAG,OAAO,GAAG;GACtB,UAAU,KAAK;GACf,MAAM,SAAS,CAAC;GAChB,MAAM,UAAU,CAAC;GACjB,aAAa,QAAQ,SAAS,MAAM,CAAC;GACrC,aAAa,QAAQ,SAAS,OAAO,CAAC;GACtC,OAAO,aAAa,OAAO,QAAQ,OAAO;EAC9C;;;;;;EAMA,SAAS,WAAW;GAChB,MAAM,IAAI;GACV,IAAI,KAAK;GACT,IAAI,MAAM,QAAQ,CAAC,GAAG,QAAQ,EAAE,GAC5B,MAAM,IAAI,WAAW,4CAA0C;GACnE,MAAM,EAAE,GAAG,GAAG,MAAM;GAEpB,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,GAChB,OAAO;IAAE,GAAG;IAAG,GAAG;GAAE;GACxB,MAAM,MAAM,EAAE,IAAI;GAGlB,IAAI,MAAM,MACN,KAAK,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;GAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAE;GACtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAE;GACtB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE;GACvB,IAAI,KACA,OAAO;IAAE,GAAG,GAAG;IAAM,GAAG,GAAG;GAAK;GACpC,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,GAClB,MAAM,IAAI,MAAM,kBAAkB;GACtC,OAAO;IAAE;IAAG;GAAE;EAClB;;;;;EAKA,gBAAgB;GACZ,IAAI,aAAa,KACb,OAAO;GACX,IAAI,eACA,OAAO,cAAc,OAAO,IAAI;GAEpC,OAAO,KAAK,UAAU,MAAM,WAAW,CAAC,CAAC,IAAI;EACjD;EACA,gBAAgB;GACZ,IAAI,aAAa,KACb,OAAO;GACX,IAAI,eACA,OAAO,cAAc,OAAO,IAAI;GAIpC,OAAO,KAAK,eAAe,QAAQ;EACvC;EACA,eAAe;GACX,IAAI,aAAa,KACb,OAAO,KAAK,IAAI;GACpB,OAAO,KAAK,cAAc,CAAC,CAAC,IAAI;EACpC;EACA,QAAQ,eAAe,MAAM;GACzB,MAAM,cAAc,cAAc;GAGlC,KAAK,eAAe;GACpB,OAAO,YAAY,OAAO,MAAM,YAAY;EAChD;EACA,MAAM,eAAe,MAAM;GACvB,OAAO,WAAW,KAAK,QAAQ,YAAY,CAAC;EAChD;EACA,WAAW;GACP,OAAO,UAAU,KAAK,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE;EACxD;CACJ;CACA,MAAM,aAAa,WAAW,WAAW,OAAO,MAAM;CACtD,MAAM,OAAO,IAAI,iBAAiB,OAAO,WAAW;CAGpD,IAAI,KAAK,QAAQ,GACb,MAAM,KAAK,WAAW,CAAC;CAC3B,OAAO,OAAO,MAAM,SAAS;CAC7B,OAAO,OAAO,KAAK;CACnB,OAAO;AACX;AAEA,SAAS,QAAQ,UAAU;CACvB,OAAO,WAAW,GAAG,WAAW,IAAO,CAAI;AAC/C;AACA,SAAS,YAAY,IAAI,IAAI;CACzB,OAAO;EACH,WAAW,GAAG;EACd,WAAW,IAAI,GAAG;EAClB,uBAAuB,IAAI,IAAI,GAAG;EAClC,oBAAoB;EAGpB,WAAW,IAAI,GAAG;CACtB;AACJ;;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,KAAK,OAAO,WAAW,CAAC,GAAG;CACvC,kBAAkB,KAAK;CACvB,MAAM,EAAE,OAAO;CACf,MAAM,eAAe,SAAS,gBAAgB,KAAA,IAAYC,gBAAgB,SAAS;CAGnF,MAAM,UAAU,OAAO,OAAO,YAAY,MAAM,IAAI,EAAE,GAAG,EACrD,MAAM,KAAK,IAAI,iBAAiB,GAAG,KAAK,GAAG,EAAE,EACjD,CAAC;CACD,SAAS,iBAAiB,WAAW;EACjC,IAAI;GACA,MAAM,MAAM,GAAG,UAAU,SAAS;GAClC,OAAO,GAAG,YAAY,GAAG;EAC7B,SACO,OAAO;GACV,OAAO;EACX;CACJ;CACA,SAAS,iBAAiB,WAAW,cAAc;EAC/C,MAAM,EAAE,WAAW,MAAM,0BAA0B;EACnD,IAAI;GACA,MAAM,IAAI,UAAU;GACpB,IAAI,iBAAiB,QAAQ,MAAM,MAC/B,OAAO;GACX,IAAI,iBAAiB,SAAS,MAAM,uBAChC,OAAO;GAGX,OAAO,CAAC,MAAM,UAAU,SAAS,CAAC,CAAC,IAAI;EAC3C,SACO,OAAO;GACV,OAAO;EACX;CACJ;;;;;CAKA,SAAS,gBAAgB,MAAM;EAC3B,OAAO,SAAS,KAAA,IAAY,aAAa,QAAQ,IAAI,IAAI;EACzD,OAAO,eAAe,OAAO,MAAM,QAAQ,MAAM,MAAM,GAAG,GAAG,KAAK;CACtE;;;;;;CAMA,SAAS,aAAa,WAAW,eAAe,MAAM;EAClD,OAAO,MAAM,KAAK,SAAS,GAAG,UAAU,SAAS,CAAC,CAAC,CAAC,QAAQ,YAAY;CAC5E;;;;CAIA,SAAS,UAAU,MAAM;EACrB,MAAM,EAAE,WAAW,WAAW,0BAA0B;EACxD,MAAM,iBAAiB,GAAG;EAC1B,IAAI,CAAC,QAAQ,IAAI,GACb,OAAO,KAAA;EACX,MAAM,IAAI,OAAO,MAAM,KAAA,GAAW,KAAK,CAAC,CAAC;EACzC,MAAM,QAAQ,MAAM,aAAa,MAAM;EACvC,MAAM,QAAQ,MAAM,aAAa,CAAC,CAAC,gBAAgB,SAAS,CAAC;EAE7D,IAAI,SAAS,OACT,OAAO,KAAA;EACX,OAAO;CACX;;;;;;;;;;;;;CAaA,SAAS,gBAAgB,YAAY,YAAY,eAAe,MAAM;EAClE,IAAI,UAAU,UAAU,MAAM,MAC1B,MAAM,IAAI,MAAM,+BAA+B;EACnD,IAAI,UAAU,UAAU,MAAM,OAC1B,MAAM,IAAI,MAAM,+BAA+B;EACnD,MAAM,IAAI,GAAG,UAAU,UAAU;EACjC,MAAM,IAAI,MAAM,UAAU,UAAU;EACpC,IAAI,EAAE,IAAI,GACN,MAAM,IAAI,MAAM,uCAAuC;EAC3D,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,YAAY;CAC7C;CACA,MAAM,QAAQ;EACV;EACA;EACA;CACJ;CACA,MAAM,SAAS,aAAa,iBAAiB,YAAY;CACzD,OAAO,OAAO,KAAK;CACnB,OAAO,OAAO,OAAO;CACrB,OAAO,OAAO,OAAO;EAAE;EAAc;EAAiB;EAAQ;EAAO;EAAO;CAAQ,CAAC;AACzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAgB,MAAM,OAAO,MAAM,YAAY,CAAC,GAAG;CAC/C,kBAAkB,KAAK;CAEvB,MAAM,QAAQ;CACd,MAAM,KAAK;CACX,eAAe,WAAW,CAAC,GAAG;EAC1B,MAAM;EACN,MAAM;EACN,aAAa;EACb,UAAU;EACV,eAAe;CACnB,CAAC;CACD,MAAM,OAAO,OAAO,OAAO,CAAC,GAAG,SAAS;CACxC,MAAM,cAAc,KAAK,gBAAgB,KAAA,IAAYA,gBAAgB,KAAK;CAC1E,MAAMC,SAAO,KAAK,SAAS,KAAA,KACpB,KAAK,QAAQC,KAAU,OAAO,KAAK,GAAG,IACvC,KAAK;CACX,MAAM,EAAE,IAAI,OAAO;CACnB,MAAM,EAAE,OAAO,aAAa,MAAM,WAAW;CAM7C,MAAM,cAAc,iBAAiB,WAAW;CAChD,MAAM,SAAS,iBAAiB,aAAa,WAAW;CACxD,MAAM,EAAE,QAAQ,cAAc,iBAAiB,OAAO,YAAY,KAAK,OAAO,IAAI;CAClF,MAAM,iBAAiB;EACnB,SAAS;EACT,MAAM,OAAO,KAAK,SAAS,YAAY,KAAK,OAAO;EACnD,QAAQ;EACR,cAAc;CAClB;CAKA,MAAM,wBAAwB,cAAcJ,QAAM,MAAM,GAAG;CAC3D,SAAS,sBAAsB,QAAQ;EAEnC,OAAO,SADM,eAAe;CAEhC;CACA,SAAS,WAAW,OAAO,KAAK;EAC5B,IAAI,CAAC,GAAG,YAAY,GAAG,GACnB,MAAM,IAAI,MAAM,qBAAqB,MAAM,iCAAiC;EAChF,OAAO;CACX;CACA,SAAS,6BAA6B;EAClC,IAAI,CAAC,GAAG,OACJ,MAAM,IAAI,MAAM,6BAA6B;CACrD;CAGA,SAAS,eAAe,GAAG,GAAG,GAAG;EAC7B,2BAA2B;EAC3B,QAAQ,MAAM,IAAI,IAAI,KAAK,OAAO,GAAG,MAAM,CAAC,CAAC;CACjD;CACA,SAAS,yBAAyB;EAQ9B,IAAI,uBACA,MAAM,IAAI,MAAM,gEAA8D;CACtF;CACA,SAAS,kBAAkB,OAAO,QAAQ;EACtC,kBAAkB,MAAM;EACxB,MAAM,OAAO,QAAQ;EAErB,OAAO,OAAO,OADA,WAAW,YAAY,OAAO,WAAW,cAAc,OAAO,IAAI,KAAA,CACtD;CAC9B;;;;CAIA,MAAM,UAAU;EACZ;EACA;EACA;EACA,YAAY,GAAG,GAAG,UAAU;GACxB,KAAK,IAAI,WAAW,KAAK,CAAC;GAC1B,KAAK,IAAI,WAAW,KAAK,CAAC;GAC1B,IAAI,YAAY,MAAM;IAClB,uBAAuB;IACvB,IAAI,CAAC;KAAC;KAAG;KAAG;KAAG;IAAC,CAAC,CAAC,SAAS,QAAQ,GAC/B,MAAM,IAAI,MAAM,qBAAqB;IACzC,KAAK,WAAW;GACpB;GACA,OAAO,OAAO,IAAI;EACtB;EACA,OAAO,UAAU,OAAO,SAAS,eAAe,QAAQ;GACpD,kBAAkB,OAAO,MAAM;GAC/B,IAAI;GACJ,IAAI,WAAW,OAAO;IAGlB,IAAI,MAAM,SAAS,IAAI,GAAG,QAAQ,IAC9B,MAAM,IAAI,IAAI,IAAI,2CAA2C;IACjE,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,OAAO,KAAK,GAAG,GAAG,QAAQ,CAAC;IACtD,OAAO,IAAI,UAAU,GAAG,CAAC;GAC7B;GACA,IAAI,WAAW,aAAa;IACxB,QAAQ,MAAM;IACd,SAAS;IACT,QAAQ,MAAM,SAAS,CAAC;GAC5B;GACA,MAAM,IAAI,QAAQ,YAAY;GAC9B,MAAM,IAAI,MAAM,SAAS,GAAG,CAAC;GAC7B,MAAM,IAAI,MAAM,SAAS,GAAG,IAAI,CAAC;GACjC,OAAO,IAAI,UAAU,GAAG,UAAU,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,KAAK;EAChE;EACA,OAAO,QAAQ,KAAK,QAAQ;GACxB,OAAO,KAAK,UAAU,WAAW,GAAG,GAAG,MAAM;EACjD;EACA,iBAAiB;GACb,MAAM,EAAE,aAAa;GACrB,IAAI,YAAY,MACZ,MAAM,IAAI,MAAM,sCAAsC;GAC1D,OAAO;EACX;EACA,eAAe,UAAU;GACrB,OAAO,IAAI,UAAU,KAAK,GAAG,KAAK,GAAG,QAAQ;EACjD;EAGA,iBAAiB,aAAa;GAC1B,MAAM,EAAE,GAAG,MAAM;GACjB,MAAM,WAAW,KAAK,eAAe;GACrC,MAAM,OAAO,aAAa,KAAK,aAAa,IAAI,IAAI,cAAc;GAClE,IAAI,CAAC,GAAG,QAAQ,IAAI,GAChB,MAAM,IAAI,MAAM,2CAA2C;GAC/D,MAAM,IAAI,GAAG,QAAQ,IAAI;GACzB,MAAM,IAAI,MAAM,UAAU,YAAY,SAAS,WAAW,OAAO,CAAC,GAAG,CAAC,CAAC;GACvE,MAAM,KAAK,GAAG,IAAI,IAAI;GACtB,MAAM,IAAI,cAAc,OAAO,aAAa,KAAA,GAAW,SAAS,CAAC;GACjE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE;GAC5B,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE;GAE3B,MAAM,IAAI,MAAM,KAAK,aAAa,IAAI,GAAG,EAAE;GAC3C,IAAI,EAAE,IAAI,GACN,MAAM,IAAI,MAAM,qCAAqC;GACzD,EAAE,eAAe;GACjB,OAAO;EACX;EAEA,WAAW;GACP,OAAO,sBAAsB,KAAK,CAAC;EACvC;EACA,QAAQ,SAAS,eAAe,QAAQ;GACpC,kBAAkB,MAAM;GACxB,IAAI,WAAW,OACX,OAAO,WAAW,IAAI,WAAW,IAAI,CAAC;GAC1C,MAAM,EAAE,GAAG,MAAM;GACjB,MAAM,KAAK,GAAG,QAAQ,CAAC;GACvB,MAAM,KAAK,GAAG,QAAQ,CAAC;GACvB,IAAI,WAAW,aAAa;IACxB,uBAAuB;IACvB,OAAO,YAAY,WAAW,GAAG,KAAK,eAAe,CAAC,GAAG,IAAI,EAAE;GACnE;GACA,OAAO,YAAY,IAAI,EAAE;EAC7B;EACA,MAAM,QAAQ;GACV,OAAO,WAAW,KAAK,QAAQ,MAAM,CAAC;EAC1C;CACJ;CACA,OAAO,OAAO,UAAU,SAAS;CACjC,OAAO,OAAO,SAAS;CAKvB,MAAM,WAAW,KAAK,aAAa,KAAA,IAC7B,SAAS,aAAa,OAAO;EAE3B,IAAI,MAAM,SAAS,MACf,MAAM,IAAI,MAAM,oBAAoB;EAGxC,MAAM,MAAM,gBAAgB,KAAK;EACjC,MAAM,QAAQ,MAAM,SAAS,IAAI;EACjC,OAAO,QAAQ,IAAI,OAAO,OAAO,KAAK,IAAI;CAC9C,IACE,KAAK;CACX,MAAM,gBAAgB,KAAK,kBAAkB,KAAA,IACvC,SAAS,kBAAkB,OAAO;EAChC,OAAO,GAAG,OAAO,SAAS,KAAK,CAAC;CACpC,IACE,KAAK;CACX,MAAM,aAAa,QAAQ,MAAM;;CAGjC,SAAS,WAAW,KAAK;EACrB,SAAS,aAAa,QAAQ,KAAKC,OAAK,UAAU;EAClD,OAAO,GAAG,QAAQ,GAAG;CACzB;CACA,SAAS,mBAAmB,SAAS,SAAS;EAC1C,OAAO,SAAS,KAAA,GAAW,SAAS;EACpC,OAAQ,UAAU,OAAO,MAAM,OAAO,GAAG,KAAA,GAAW,mBAAmB,IAAI;CAC/E;;;;;;;;;CASA,SAAS,QAAQ,SAAS,WAAW,MAAM;EACvC,MAAM,EAAE,MAAM,SAAS,iBAAiB,gBAAgB,MAAM,cAAc;EAC5E,UAAU,mBAAmB,SAAS,OAAO;EAI7C,MAAM,QAAQ,cAAc,OAAO;EACnC,MAAM,IAAI,GAAG,UAAU,SAAS;EAChC,IAAI,CAAC,GAAG,YAAY,CAAC,GACjB,MAAM,IAAI,MAAM,qBAAqB;EACzC,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,WAAW,KAAK,CAAC;EAElD,IAAI,gBAAgB,QAAQ,iBAAiB,OAAO;GAGhD,MAAM,IAAI,iBAAiB,OAAO,YAAY,QAAQ,SAAS,IAAI;GACnE,SAAS,KAAK,OAAO,GAAG,KAAA,GAAW,cAAc,CAAC;EACtD;EACA,MAAM,OAAO,YAAY,GAAG,QAAQ;EACpC,MAAM,IAAI;EAYV,SAAS,MAAM,QAAQ;GAGnB,MAAM,IAAI,SAAS,MAAM;GACzB,IAAI,CAAC,GAAG,YAAY,CAAC,GACjB;GACJ,MAAM,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;GAC1C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;GACvB,IAAI,MAAMA,OACN;GACJ,IAAI;GACJ,IAAI,WAAW,KAAA,GAAW;IAEtB,MAAM,IAAI,gBAAgB,eAAe,OAAO,WAAW,GAAG,WAAW,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;IACtB,IAAI,GAAG,OAAO,MAAM,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC;GAC9C,OACK;IACD,MAAM,KAAK,SAAS,GAAG,WAAW;IAClC,IAAI,GAAG,OAAO,KAAK,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC;GAC3C;GACA,IAAI,MAAMA,OACN;GACJ,IAAI,WAAW,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC;GACzC,IAAI,QAAQ;GACZ,IAAI,QAAQ,sBAAsB,CAAC,GAAG;IAClC,QAAQ,GAAG,IAAI,CAAC;IAChB,YAAY;GAChB;GACA,OAAO,IAAI,UAAU,GAAG,OAAO,wBAAwB,KAAA,IAAY,QAAQ;EAC/E;EACA,OAAO;GAAE;GAAM;EAAM;CACzB;;;;;;;;;;;;;;CAcA,SAAS,KAAK,SAAS,WAAW,OAAO,CAAC,GAAG;EACzC,MAAM,EAAE,MAAM,UAAU,QAAQ,SAAS,WAAW,IAAI;EAGxD,OAFa,eAAe,MAAM,WAAW,GAAG,OAAOE,MACxC,CAAC,CAAC,MAAM,KACd,CAAC,CAAC,QAAQ,KAAK,MAAM;CAClC;;;;;;;;;;;;;;CAcA,SAAS,OAAO,WAAW,SAAS,WAAW,OAAO,CAAC,GAAG;EACtD,MAAM,EAAE,MAAM,SAAS,WAAW,gBAAgB,MAAM,cAAc;EACtE,YAAY,OAAO,WAAW,KAAA,GAAW,WAAW;EACpD,UAAU,mBAAmB,SAAS,OAAO;EAC7C,IAAI,CAAC,QAAQ,SAAS,GAAG;GACrB,MAAM,MAAM,qBAAqB,YAAY,wBAAwB;GACrE,MAAM,IAAI,MAAM,wCAAwC,GAAG;EAC/D;EACA,kBAAkB,WAAW,MAAM;EACnC,IAAI;GACA,MAAM,MAAM,UAAU,UAAU,WAAW,MAAM;GACjD,MAAM,IAAI,MAAM,UAAU,SAAS;GAGnC,IAAI,EAAE,IAAI,GACN,OAAO;GACX,IAAI,QAAQ,IAAI,SAAS,GACrB,OAAO;GACX,MAAM,EAAE,GAAG,MAAM;GACjB,MAAM,IAAI,cAAc,OAAO;GAC/B,MAAM,KAAK,GAAG,IAAI,CAAC;GACnB,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE;GAC3B,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE;GAC3B,MAAM,IAAI,MAAM,KAAK,aAAa,IAAI,GAAG,EAAE;GAC3C,IAAI,EAAE,IAAI,GACN,OAAO;GACX,MAAM,IAAI,EAAE,SAAS;GAErB,IADU,GAAG,OAAO,EAAE,CAClB,MAAM,GACN,OAAO;GAGX,IAAI,WAAW,eAAe,IAAI,aAAa,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,GACrE,OAAO;GACX,OAAO;EACX,SACO,GAAG;GACN,OAAO;EACX;CACJ;CACA,SAAS,iBAAiB,WAAW,SAAS,OAAO,CAAC,GAAG;EAGrD,MAAM,EAAE,YAAY,gBAAgB,MAAM,cAAc;EACxD,UAAU,mBAAmB,SAAS,OAAO;EAC7C,OAAO,UAAU,UAAU,WAAW,WAAW,CAAC,CAAC,iBAAiB,OAAO,CAAC,CAAC,QAAQ;CACzF;CAEA,OAAO,OAAO,OAAO;EACjB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,MAAM;CACV,CAAC;AACL;;;;;;;;;;;ACznCA,IAAM,kBAAkB;CACpB,GAAG,OAAO,oEAAoE;CAC9E,GAAG,OAAO,oEAAoE;CAC9E,GAAG,OAAO,CAAC;CACX,GAAG,OAAO,CAAC;CACX,GAAG,OAAO,CAAC;CACX,IAAI,OAAO,oEAAoE;CAC/E,IAAI,OAAO,oEAAoE;AACnF;AACA,IAAM,iBAAiB;CACnB,MAAM,OAAO,oEAAoE;CACjF,SAAS,CACL,CAAC,OAAO,oCAAoC,GAAG,CAAC,OAAO,oCAAoC,CAAC,GAC5F,CAAC,OAAO,qCAAqC,GAAG,OAAO,oCAAoC,CAAC,CAChG;AACJ;AACA,IAAM,MAAsB,uBAAO,CAAC;AACpC,IAAM,MAAsB,uBAAO,CAAC;;;;;AAKpC,SAAS,QAAQ,GAAG;CAChB,MAAM,IAAI,gBAAgB;CAE1B,MAAM,MAAM,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,OAAO,EAAE,GAAG,OAAO,OAAO,EAAE;CAE3E,MAAM,OAAO,OAAO,EAAE,GAAG,OAAO,OAAO,EAAE,GAAG,OAAO,OAAO,EAAE;CAC5D,MAAM,KAAM,IAAI,IAAI,IAAK;CACzB,MAAM,KAAM,KAAK,KAAK,IAAK;CAG3B,MAAM,MAAO,KADD,KADA,KAAK,IAAI,KAAK,CAAC,IAAI,KAAM,GAChB,KAAK,CAAC,IAAI,KAAM,GACf,KAAK,CAAC,IAAI,KAAM;CACtC,MAAM,MAAO,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO;CACzC,MAAM,MAAO,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO;CACzC,MAAM,MAAO,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO;CAMzC,MAAM,OAAO,KADD,KADA,KADE,KADA,KADA,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO,GACjB,MAAM,CAAC,IAAI,MAAO,GAClB,KAAK,CAAC,IAAI,KAAM,GAClB,MAAM,CAAC,IAAI,MAAO,GACpB,KAAK,CAAC,IAAI,KAAM,GACf,KAAK,CAAC;CAC5B,IAAI,CAAC,KAAK,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,GAC3B,MAAM,IAAI,MAAM,yBAAyB;CAC7C,OAAO;AACX;AACA,IAAM,OAAuB,sBAAM,gBAAgB,GAAG,EAAE,MAAM,QAAQ,CAAC;AACvE,IAAM,UAA0B,4BAAY,iBAAiB;CACzD,IAAI;CACJ,MAAM;AACV,CAAC;;;;;;;;;;;;;;;;;;;;AAoBD,IAAa,YAA4B,sBAAM,SAAS,MAAM;;AAI9D,IAAM,uBAAuB,OAAO,OAAO,IAAI;AAE/C,SAAS,WAAW,KAAK,GAAG,UAAU;CAClC,IAAI,OAAO,qBAAqB;CAChC,IAAI,SAAS,KAAA,GAAW;EACpB,MAAM,OAAO,OAAO,aAAa,GAAG,CAAC;EACrC,OAAO,YAAY,MAAM,IAAI;EAC7B,qBAAqB,OAAO;CAChC;CACA,OAAO,OAAO,YAAY,MAAM,GAAG,QAAQ,CAAC;AAChD;AAEA,IAAM,gBAAgB,UAAU,MAAM,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC;AAC3D,IAAM,kBAAkB,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAChD,IAAM,WAAW,MAAM,CAAC,KAAK,MAAM,CAAC;AAEpC,SAAS,oBAAoB,MAAM;CAC/B,MAAM,EAAE,IAAI,SAAS;CACrB,MAAM,KAAK,GAAG,UAAU,OAAO,MAAM,IAAI,WAAW,CAAC;CAErD,MAAM,SADI,KAAK,SAAS,EACT,CAAC,CAAC,SAAS;CAE1B,OAAO;EAAE,QADM,QAAQ,OAAO,CAAC,IAAI,KAAK,GAAG,IAAI,EAAE;EAChC,OAAO,eAAe,MAAM;CAAE;AACnD;;;;;AAKA,SAAS,OAAO,GAAG;CACf,MAAM,KAAK;CACX,IAAI,CAAC,GAAG,YAAY,CAAC,GACjB,MAAM,IAAI,MAAM,0BAA0B;CAC9C,MAAM,KAAK,GAAG,IAAI,CAAC;CACnB,MAAM,IAAI,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;CAC1C,IAAI,IAAI,GAAG,KAAK,CAAC;CAGjB,IAAI,CAAC,QAAQ,CAAC,GACV,IAAI,GAAG,IAAI,CAAC;CAChB,MAAM,IAAI,QAAQ,WAAW;EAAE;EAAG;CAAE,CAAC;CACrC,EAAE,eAAe;CACjB,OAAO;AACX;AAGA,IAAM,MAAM;;AAEZ,SAAS,UAAU,GAAG,MAAM;CACxB,OAAO,QAAQ,GAAG,OAAO,IAAI,WAAW,qBAAqB,GAAG,IAAI,CAAC,CAAC;AAC1E;;AAEA,SAAS,oBAAoB,WAAW;CACpC,OAAO,oBAAoB,SAAS,CAAC,CAAC;AAC1C;;;;;;;AAOA,SAAS,YAAY,SAAS,WAAW,UAAUE,cAAY,EAAE,GAAG;CAChE,MAAM,EAAE,IAAI,SAAS;CAErB,MAAM,IAAI,UAAU,OAAO,SAAS,KAAA,GAAW,SAAS,CAAC;CACzD,MAAM,EAAE,OAAO,IAAI,QAAQ,MAAM,oBAAoB,SAAS;CAC9D,MAAM,IAAI,OAAO,SAAS,IAAI,SAAS;CAGvC,MAAM,OAAO,WAAW,iBADd,GAAG,QAAQ,IAAI,IAAI,WAAW,eAAe,CAAC,CAAC,CAChB,GAAG,IAAI,CAAC;CAIjD,MAAM,KAAK,GAAG,OAAO,IAAI,IAAI,CAAC;CAE9B,IAAI,OAAO,KACP,MAAM,IAAI,MAAM,wBAAwB;CAE5C,MAAM,SADI,KAAK,SAAS,EACT,CAAC,CAAC,SAAS;CAC1B,MAAM,IAAI,QAAQ,OAAO,CAAC,IAAI,KAAK,GAAG,IAAI,EAAE;CAC5C,MAAM,KAAK,eAAe,MAAM;CAChC,MAAM,IAAI,UAAU,IAAI,IAAI,CAAC;CAC7B,MAAM,sBAAM,IAAI,WAAW,EAAE;CAC7B,IAAI,IAAI,IAAI,CAAC;CACb,IAAI,IAAI,GAAG,QAAQ,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE;CAE5C,IAAI,CAAC,cAAc,KAAK,GAAG,EAAE,GACzB,MAAM,IAAI,MAAM,kCAAkC;CACtD,OAAO;AACX;;;;;AAKA,SAAS,cAAc,WAAW,SAAS,WAAW;CAClD,MAAM,EAAE,IAAI,IAAI,SAAS;CACzB,MAAM,MAAM,OAAO,WAAW,IAAI,WAAW;CAC7C,MAAM,IAAI,OAAO,SAAS,KAAA,GAAW,SAAS;CAC9C,MAAM,MAAM,OAAO,WAAW,IAAI,WAAW;CAC7C,IAAI;EACA,MAAM,IAAI,OAAO,IAAI,GAAG,CAAC;EACzB,MAAM,SAAS,IAAI,SAAS,GAAG,EAAE;EACjC,MAAM,IAAI,IAAI,MAAM;EACpB,IAAI,CAAC,GAAG,YAAY,CAAC,GACjB,OAAO;EACX,MAAM,IAAI,IAAI,IAAI,SAAS,IAAI,EAAE,CAAC;EAIlC,IAAI,CAAC,GAAG,YAAY,CAAC,GACjB,OAAO;EAEX,MAAM,IAAI,UAAU,QAAQ,aAAa,CAAC,GAAG,CAAC;EAE9C,MAAM,IAAI,KAAK,aAAa,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;EAC3C,MAAM,EAAE,GAAG,MAAM,EAAE,SAAS;EAE5B,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,GACtC,OAAO;EACX,OAAO;CACX,SACO,OAAO;EACV,OAAO;CACX;AACJ;;;;;;;;;;;;;;;;AAiBA,IAAa,UAA0B,uBAAO;CAC1C,MAAM,OAAO;CACb,MAAM,aAAa;CACnB,MAAM,mBAAmB,SAAS;EAC9B,OAAO,SAAS,KAAA,IAAYA,cAAY,UAAU,IAAI;EACtD,OAAO,eAAe,OAAO,MAAM,YAAY,MAAM,GAAG,gBAAgB,CAAC;CAC7E;CACA,OAAO,OAAO,OAAO;EACjB,QAAQ,aAAa,iBAAiB,mBAAmB;EACzD,cAAc;EACd,MAAM;EACN,QAAQ;EACR,OAAO;EACP,OAAO,OAAO,OAAO;GACjB;GACA;GACA;GACA;EACJ,CAAC;EACD,SAAS,OAAO,OAAO;GACnB,WAAW;GACX,WAAW;GACX,oBAAoB;GACpB,WAAW,OAAO;GAClB,MAAM;EACV,CAAC;CACL,CAAC;AACL,EAAA,CAAG;;;;CCnQH,OAAO,eAAe,SAAS,cAAc,EAAE,OAAO,KAAK,CAAC;CAC5D,QAAQ,UAAU,QAAQ,SAAS,KAAK;CACxC,IAAM,WAAW;CACjB,IAAM,eAAe,CAAC;CACtB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAiB,KAAK;EACtC,MAAM,IAAI,SAAS,OAAO,CAAC;EAC3B,aAAa,KAAK;CACtB;CACA,SAAS,YAAY,KAAK;EACtB,MAAM,IAAI,OAAO;EACjB,QAAU,MAAM,aAAc,IACzB,EAAG,KAAK,IAAK,KAAK,YAClB,EAAG,KAAK,IAAK,KAAK,YAClB,EAAG,KAAK,IAAK,KAAK,YAClB,EAAG,KAAK,IAAK,KAAK,aAClB,EAAG,KAAK,IAAK,KAAK;CAC3B;CACA,SAAS,UAAU,QAAQ;EACvB,IAAI,MAAM;EACV,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,EAAE,GAAG;GACpC,MAAM,IAAI,OAAO,WAAW,CAAC;GAC7B,IAAI,IAAI,MAAM,IAAI,KACd,OAAO,qBAAqB,SAAS;GACzC,MAAM,YAAY,GAAG,IAAK,KAAK;EACnC;EACA,MAAM,YAAY,GAAG;EACrB,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,EAAE,GAAG;GACpC,MAAM,IAAI,OAAO,WAAW,CAAC;GAC7B,MAAM,YAAY,GAAG,IAAK,IAAI;EAClC;EACA,OAAO;CACX;CACA,SAAS,QAAQ,MAAM,QAAQ,SAAS,KAAK;EACzC,IAAI,QAAQ;EACZ,IAAI,OAAO;EACX,MAAM,QAAQ,KAAK,WAAW;EAC9B,MAAM,SAAS,CAAC;EAChB,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,EAAE,GAAG;GAClC,QAAS,SAAS,SAAU,KAAK;GACjC,QAAQ;GACR,OAAO,QAAQ,SAAS;IACpB,QAAQ;IACR,OAAO,KAAM,SAAS,OAAQ,IAAI;GACtC;EACJ;EACA,IAAI;OACI,OAAO,GACP,OAAO,KAAM,SAAU,UAAU,OAAS,IAAI;EAAA,OAGjD;GACD,IAAI,QAAQ,QACR,OAAO;GACX,IAAK,SAAU,UAAU,OAAS,MAC9B,OAAO;EACf;EACA,OAAO;CACX;CACA,SAAS,QAAQ,OAAO;EACpB,OAAO,QAAQ,OAAO,GAAG,GAAG,IAAI;CACpC;CACA,SAAS,gBAAgB,OAAO;EAC5B,MAAM,MAAM,QAAQ,OAAO,GAAG,GAAG,KAAK;EACtC,IAAI,MAAM,QAAQ,GAAG,GACjB,OAAO;CACf;CACA,SAAS,UAAU,OAAO;EACtB,MAAM,MAAM,QAAQ,OAAO,GAAG,GAAG,KAAK;EACtC,IAAI,MAAM,QAAQ,GAAG,GACjB,OAAO;EACX,MAAM,IAAI,MAAM,GAAG;CACvB;CACA,SAAS,uBAAuB,UAAU;EACtC,IAAI;EACJ,IAAI,aAAa,UACb,iBAAiB;OAGjB,iBAAiB;EAErB,SAAS,OAAO,QAAQ,OAAO,OAAO;GAClC,QAAQ,SAAS;GACjB,IAAI,OAAO,SAAS,IAAI,MAAM,SAAS,OACnC,MAAM,IAAI,UAAU,sBAAsB;GAC9C,SAAS,OAAO,YAAY;GAE5B,IAAI,MAAM,UAAU,MAAM;GAC1B,IAAI,OAAO,QAAQ,UACf,MAAM,IAAI,MAAM,GAAG;GACvB,IAAI,SAAS,SAAS;GACtB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,EAAE,GAAG;IACnC,MAAM,IAAI,MAAM;IAChB,IAAI,KAAK,MAAM,GACX,MAAM,IAAI,MAAM,gBAAgB;IACpC,MAAM,YAAY,GAAG,IAAI;IACzB,UAAU,SAAS,OAAO,CAAC;GAC/B;GACA,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,EAAE,GACrB,MAAM,YAAY,GAAG;GAEzB,OAAO;GACP,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,EAAE,GAAG;IACxB,MAAM,IAAK,QAAS,IAAI,KAAK,IAAM;IACnC,UAAU,SAAS,OAAO,CAAC;GAC/B;GACA,OAAO;EACX;EACA,SAAS,SAAS,KAAK,OAAO;GAC1B,QAAQ,SAAS;GACjB,IAAI,IAAI,SAAS,GACb,OAAO,MAAM;GACjB,IAAI,IAAI,SAAS,OACb,OAAO;GAEX,MAAM,UAAU,IAAI,YAAY;GAChC,MAAM,UAAU,IAAI,YAAY;GAChC,IAAI,QAAQ,WAAW,QAAQ,SAC3B,OAAO,uBAAuB;GAClC,MAAM;GACN,MAAM,QAAQ,IAAI,YAAY,GAAG;GACjC,IAAI,UAAU,IACV,OAAO,gCAAgC;GAC3C,IAAI,UAAU,GACV,OAAO,wBAAwB;GACnC,MAAM,SAAS,IAAI,MAAM,GAAG,KAAK;GACjC,MAAM,YAAY,IAAI,MAAM,QAAQ,CAAC;GACrC,IAAI,UAAU,SAAS,GACnB,OAAO;GACX,IAAI,MAAM,UAAU,MAAM;GAC1B,IAAI,OAAO,QAAQ,UACf,OAAO;GACX,MAAM,QAAQ,CAAC;GACf,KAAK,IAAI,IAAI,GAAG,IAAI,UAAU,QAAQ,EAAE,GAAG;IACvC,MAAM,IAAI,UAAU,OAAO,CAAC;IAC5B,MAAM,IAAI,aAAa;IACvB,IAAI,MAAM,KAAA,GACN,OAAO,uBAAuB;IAClC,MAAM,YAAY,GAAG,IAAI;IAEzB,IAAI,IAAI,KAAK,UAAU,QACnB;IACJ,MAAM,KAAK,CAAC;GAChB;GACA,IAAI,QAAQ,gBACR,OAAO,0BAA0B;GACrC,OAAO;IAAE;IAAQ;GAAM;EAC3B;EACA,SAAS,aAAa,KAAK,OAAO;GAC9B,MAAM,MAAM,SAAS,KAAK,KAAK;GAC/B,IAAI,OAAO,QAAQ,UACf,OAAO;EACf;EACA,SAAS,OAAO,KAAK,OAAO;GACxB,MAAM,MAAM,SAAS,KAAK,KAAK;GAC/B,IAAI,OAAO,QAAQ,UACf,OAAO;GACX,MAAM,IAAI,MAAM,GAAG;EACvB;EACA,OAAO;GACH;GACA;GACA;GACA;GACA;GACA;EACJ;CACJ;CACA,QAAQ,SAAS,uBAAuB,QAAQ;CAChD,QAAQ,UAAU,uBAAuB,SAAS;;AC3H3C,SAAS,uBAAqC;CAEnD,MAAM,eAAe,YAAY,EAAE;CACnC,MAAM,UAAU,OAAO,KAAK,YAAY,CAAA,CAAE,SAAS,KAAK;CAGxD,MAAM,cAAc,UAAU,aAAa,cAAc,IAAI;CAI7D,OAAO;EAAE,QAFM,OAAO,KAAK,YAAY,MAAM,CAAC,CAAC,CAAA,CAAE,SAAS,KAEjD;EAAQ;CAAQ;AAC3B;AAMO,SAAS,oBAAoB,cAA8B;CAChE,MAAM,OAAO,OAAO,KAAK,4BAA4B,MAAM;CAC3D,MAAM,OAAO,OAAO,KAAK,eAAe,MAAM;CAC9C,MAAM,cAAc,OAAO,KAAK,cAAc,MAAM;CAEpD,OAAO,OAAO,KAAK,SAAS,UAAU,aAAa,MAAM,MAAM,EAAE,CAAC;AACpE;AAOO,SAAS,eACd,SACA,cACc;CACd,MAAM,MAAM,oBAAoB,YAAY;CAC5C,MAAM,KAAK,YAAY,EAAE;CAEzB,MAAM,SAAS,eAAe,eAAe,KAAK,EAAE;CACpD,MAAM,YAAY,OAAO,OAAO,CAC9B,OAAO,OAAO,SAAS,MAAM,GAC7B,OAAO,MAAM,CACf,CAAC;CACD,MAAM,MAAM,OAAO,WAAW;CAE9B,OAAO;EACL,YAAY,UAAU,SAAS,QAAQ;EACvC,IAAI,GAAG,SAAS,QAAQ;EACxB,KAAK,IAAI,SAAS,QAAQ;CAC5B;AACF;AAOO,SAAS,eACd,WACA,cACQ;CACR,MAAM,MAAM,oBAAoB,YAAY;CAC5C,MAAM,KAAK,OAAO,KAAK,UAAU,IAAI,QAAQ;CAC7C,MAAM,MAAM,OAAO,KAAK,UAAU,KAAK,QAAQ;CAC/C,MAAM,aAAa,OAAO,KAAK,UAAU,YAAY,QAAQ;CAE7D,MAAM,WAAW,iBAAiB,eAAe,KAAK,EAAE;CACxD,SAAS,WAAW,GAAG;CAOvB,OALkB,OAAO,OAAO,CAC9B,SAAS,OAAO,UAAU,GAC1B,SAAS,MAAM,CACjB,CAEO,CAAA,CAAU,SAAS,MAAM;AAClC;AAKO,SAAS,eAAe,OAA2B;CACxD,MAAM,aAAa,KAAK,UAAU;EAChC;EACA,MAAM;EACN,MAAM;EACN,MAAM;EACN,MAAM;EACN,MAAM;CACR,CAAC;CAED,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,UAAU,CAAA,CAAE,OAAO,KAAK;AAC7D;AAOO,SAAS,UACd,OACA,SACY;CACZ,MAAM,KAAK,eAAe,KAAmB;CAC7C,MAAM,eAAe,OAAO,KAAK,SAAS,KAAK;CAC/C,MAAM,UAAU,OAAO,KAAK,IAAI,KAAK;CAGrC,MAAM,MAAM,QAAQ,KAAK,SAAS,YAAY;CAC9C,MAAM,SAAS,OAAO,KAAK,GAAG,CAAA,CAAE,SAAS,KAAK;CAE9C,OAAO;EACL,GAAG;EACH;EACA,KAAK;CACP;AACF;AAMO,SAAS,qBAAqB,OAA4B;CAC/D,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,KACtB,OAAO;CAKT,IADmB,eAAe,KAC9B,MAAe,MAAM,IACvB,OAAO;CAGT,IAAI;EACF,MAAM,WAAW,OAAO,KAAK,MAAM,KAAK,KAAK;EAC7C,MAAM,UAAU,OAAO,KAAK,MAAM,IAAI,KAAK;EAE3C,MAAM,cAAc,OAAO,KAAK,MAAM,QAAQ,KAAK;EAEnD,OAAO,QAAQ,OAAO,UAAU,SAAS,WAAW;CACtD,QAAQ;EACN,OAAO;CACT;AACF;AAQO,SAAS,gBACd,SACA,WACA,OACY;CACZ,MAAM,eAAe,OAAO,KAAK,SAAS,KAAK;CAC/C,MAAM,cAAc,UAAU,aAAa,cAAc,IAAI;CAC7D,MAAM,SAAS,OAAO,KAAK,YAAY,MAAM,CAAC,CAAC,CAAA,CAAE,SAAS,KAAK;CAE/D,MAAM,OAAmB,CAAC,CAAC,aAAa,SAAS,CAAC;CAClD,IAAI,OACF,KAAK,KAAK,CAAC,SAAS,KAAK,CAAC;CAW5B,OAAO,UAAU;EAPf;EACA,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM;EACN;EACA,SAAS;CAGM,GAAO,OAAO;AACjC;AAQO,SAAS,gBACd,OACA,mBACA,gBAAwB,KACY;CAEpC,IAAI,MAAM,SAAS,OACjB,OAAO;EAAE,OAAO;EAAO,OAAO;CAAqB;CAKrD,MAAM,MADM,KAAK,MAAM,KAAK,IAAI,IAAI,GACxB,IAAM,MAAM;CACxB,IAAI,MAAM,iBAAiB,MAAM,KAE/B,OAAO;EAAE,OAAO;EAAO,OAAO;CAAqC;CAIrE,MAAM,eAAe,MAAM,KAAK,MAAM,MAAM,EAAE,OAAO,WAAW;CAChE,IAAI,CAAC,gBAAgB,aAAa,OAAO,mBACvC,OAAO;EAAE,OAAO;EAAO,OAAO;CAAqB;CAIrD,IAAI,CAAC,qBAAqB,KAAK,GAC7B,OAAO;EAAE,OAAO;EAAO,OAAO;CAAoB;CAGpD,OAAO,EAAE,OAAO,KAAK;AACvB;AAKO,SAAS,aAAa,QAAwB;CACnD,MAAM,QAAQ,YAAA,OAAO,QAAQ,OAAO,KAAK,QAAQ,KAAK,CAAC;CACvD,OAAO,YAAA,OAAO,OAAO,QAAQ,OAAO,GAAI;AAC1C;AAKO,SAAS,aAAa,MAAsB;CACjD,MAAM,EAAE,QAAQ,UAAU,YAAA,OAAO,OAAO,MAAM,GAAI;CAClD,IAAI,WAAW,QACb,MAAM,IAAI,MAAM,qBAAqB;CAEvC,OAAO,OAAO,KAAK,YAAA,OAAO,UAAU,KAAK,CAAC,CAAA,CAAE,SAAS,KAAK;AAC5D;AAKO,SAAS,cAAc,SAAyB;CACrD,MAAM,QAAQ,YAAA,OAAO,QAAQ,OAAO,KAAK,SAAS,KAAK,CAAC;CACxD,OAAO,YAAA,OAAO,OAAO,QAAQ,OAAO,GAAI;AAC1C;AAKO,SAAS,cAAc,MAAsB;CAClD,MAAM,EAAE,QAAQ,UAAU,YAAA,OAAO,OAAO,MAAM,GAAI;CAClD,IAAI,WAAW,QACb,MAAM,IAAI,MAAM,qBAAqB;CAEvC,OAAO,OAAO,KAAK,YAAA,OAAO,UAAU,KAAK,CAAC,CAAA,CAAE,SAAS,KAAK;AAC5D;AAKO,SAAS,aAAa,SAAyB;CACpD,MAAM,eAAe,OAAO,KAAK,SAAS,KAAK;CAC/C,MAAM,cAAc,UAAU,aAAa,cAAc,IAAI;CAC7D,OAAO,OAAO,KAAK,YAAY,MAAM,CAAC,CAAC,CAAA,CAAE,SAAS,KAAK;AACzD;AAKO,SAAS,cAAc,QAAyB;CACrD,IAAI,CAAC,kBAAkB,KAAK,MAAM,GAChC,OAAO;CAET,IAAI;EAEF,MAAM,aAAa,OAAO,KAAK,KAAK,UAAU,KAAK;EACnD,UAAU,MAAM,UAAU,UAAU;EACpC,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;AAKO,SAAS,eAAe,SAA0B;CACvD,IAAI,CAAC,kBAAkB,KAAK,OAAO,GACjC,OAAO;CAET,IAAI;EACF,MAAM,eAAe,OAAO,KAAK,SAAS,KAAK;EAE/C,UAAU,aAAa,YAAY;EACnC,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;;ACrSO,IAAM,gBAAN,cAA4B,WAAW;CAK5C;CASA,SAAiB;;;;CAKjB,mBAA2B;;;;CAK3B,eAAuB;;;;CAKvB,gBAAwB;;;;CAKxB,QAAgB;;;;CAKhB,gBAAwB;;;;CAKxB,aAA0B;;;;CAK1B,aAA0B;CAE1B,YAAY,UAAgC,CAAC,GAAG;EAC9C,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,kBACV,KAAK,mBAAmB,QAAQ;EAClC,IAAI,QAAQ,cAAc,KAAK,eAAe,QAAQ;EACtD,IAAI,QAAQ,eAAe,KAAK,gBAAgB,QAAQ;EACxD,IAAI,QAAQ,OAAO,KAAK,QAAQ,QAAQ;EACxC,IAAI,QAAQ,eAAe,KAAK,gBAAgB,QAAQ;EACxD,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;EAChE,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;CAClE;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,aAAa,aACX,QACA,UAA6B,CAAC,GACC;EAC/B,MAAM,EAAE,4BAA4B,MAAM,OACxC,wCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAGF,OAAO,OAAM,MADY,wBAAwB,OAAO,OAAO,EAAA,CACvC,QAAQ,EAC9B,OAAO,EAAE,OAAO,EAClB,CAAC;CACH;;;;CAKA,aAAa,YACX,OACA,UAA6B,CAAC,GACC;EAC/B,MAAM,EAAE,4BAA4B,MAAM,OACxC,wCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAGF,OAAO,OAAM,MADY,wBAAwB,OAAO,OAAO,EAAA,CACvC,QAAQ,EAC9B,OAAO,EAAE,OAAO,MAAM,YAAY,EAAE,EACtC,CAAC;CACH;;;;CAKA,aAAa,YACX,UACA,UAA6B,CAAC,GACC;EAC/B,MAAM,EAAE,4BAA4B,MAAM,OACxC,wCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAGF,OAAO,OAAM,MADY,wBAAwB,OAAO,OAAO,EAAA,CACvC,QAAQ,EAC9B,OAAO,EAAE,eAAe,SAAS,YAAY,EAAE,EACjD,CAAC;CACH;;;;;;CAOA,eAAe,cAA8B;EAM3C,OAAO,eAAe;GAJpB,YAAY,KAAK;GACjB,IAAI,KAAK;GACT,KAAK,KAAK;EAEU,GAAW,YAAY;CAC/C;;;;;CAMA,WAAW,cAKT;EACA,MAAM,UAAU,KAAK,eAAe,YAAY;EAChD,OAAO;GACL,QAAQ,KAAK;GACb;GACA,MAAM,aAAa,KAAK,MAAM;GAC9B,MAAM,cAAc,OAAO;EAC7B;CACF;;;;CAKA,MAAM,cAA6B;EACjC,KAAA,IAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;GAC/C,IAAI,KAAK,aAAa,MAAM,KAAK,WAAW;GAC5C,KAAK,6BAAa,IAAI,KAAK;GAC3B,IAAI;IACF,MAAM,KAAK,KAAK;IAChB;GACF,SAAS,OAAO;IACd,IACE,YAAY,KACZ,EACE,iBAAiB,SACjB,UAAU,SACV,MAAM,SAAS,8BAGjB,MAAM;GAEV;EACF;CACF;;;;CAKA,MAAM,eAA8B;EAClC,KAAK,6BAAa,IAAI,KAAK;EAC3B,KAAK,6BAAa,IAAI,KAAK;EAC3B,MAAM,KAAK,KAAK;CAClB;;;;CAKA,aAAsB;EACpB,OAAO,KAAK,eAAe;CAC7B;;;;;CAMA,mBAAmB,QAAwB;EAEzC,OAAO,GADU,KAAK,iBAAiB,KAAK,MAAM,MAAM,GAAG,CAAA,CAAE,GAC3C,GAAI;CACxB;AACF;AArME,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,cAKX,WAAA,aAAA,CAAA;AASA,gBAAA,CADC,MAAM,EAAE,SAAS,KAAK,CAAC,CAAA,GAbb,cAcX,WAAA,UAAA,CAAA;AAdW,gBAAN,gBAAA,CATN,KAAK;CACJ,WAAW;CAGX,WAAW;CACX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;AAClC,CAAC,CAAA,GACY,aAAA"}
+{"version":3,"file":"NostrIdentity-AC8fAdxe.js","names":["isBytes","atitle","anumber","abytes","aobject","bytesToHex","hexToBytes","concatBytes","randomBytes","abytes_","anumber_","bytesToHex_","concatBytes_","hexToBytes_","isBytes_","randomBytes","randomBytes_","_0n","_1n","_0n","_1n","_2n","_3n","_4n","gcd","_0n","_1n","_4n","_0n","_2n","_0n","wcRandomBytes","hmac","nobleHmac","randomBytes"],"sources":["../../../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/_u64.js","../../../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/utils.js","../../../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/_md.js","../../../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/sha2.js","../../../../node_modules/.pnpm/@noble+curves@2.4.0/node_modules/@noble/curves/utils.js","../../../../node_modules/.pnpm/@noble+curves@2.4.0/node_modules/@noble/curves/abstract/modular.js","../../../../node_modules/.pnpm/@noble+curves@2.4.0/node_modules/@noble/curves/abstract/curve.js","../../../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/hmac.js","../../../../node_modules/.pnpm/@noble+curves@2.4.0/node_modules/@noble/curves/abstract/der.js","../../../../node_modules/.pnpm/@noble+curves@2.4.0/node_modules/@noble/curves/abstract/weierstrass.js","../../../../node_modules/.pnpm/@noble+curves@2.4.0/node_modules/@noble/curves/secp256k1.js","../../../../node_modules/.pnpm/bech32@2.0.0/node_modules/bech32/dist/index.js","../../src/auth/nostrCrypto.ts","../../src/models/NostrIdentity.ts"],"sourcesContent":["const U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();\nconst _32n = /* @__PURE__ */ BigInt(32);\n// Split bigint into two 32-bit halves. With `le=true`, returned fields become `{ h: low, l: high\n// }` to match little-endian word order rather than the property names.\nfunction fromBig(n, le = false) {\n    if (le)\n        return { h: Number(n & U32_MASK64), l: Number((n >> _32n) & U32_MASK64) };\n    return { h: Number((n >> _32n) & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };\n}\n// Split bigint list into `[highWords, lowWords]` when `le=false`; with `le=true`, the first array\n// holds the low halves because `fromBig(...)` swaps the semantic meaning of `h` and `l`.\nfunction split(lst, le = false) {\n    const len = lst.length;\n    let Ah = new Uint32Array(len);\n    let Al = new Uint32Array(len);\n    for (let i = 0; i < len; i++) {\n        const { h, l } = fromBig(lst[i], le);\n        [Ah[i], Al[i]] = [h, l];\n    }\n    return [Ah, Al];\n}\n// Combine explicit `(high, low)` 32-bit halves into a bigint; `>>> 0` normalizes signed JS\n// bitwise results back to uint32 first, and little-endian callers must swap.\nconst toBig = (h, l) => (BigInt(h >>> 0) << _32n) | BigInt(l >>> 0);\n// Split a JS number into u32 halves without a BigInt allocation. Exact only for integers\n// `0 <= n < 2**53`; callers use it on byte / bit counters, which JS length math caps far below\n// that (an ArrayBuffer cannot exceed 2**53 - 1 bytes).\nconst fromNumH = (n) => (n / 2 ** 32) | 0;\nconst fromNumL = (n) => n >>> 0;\n// Drop-in replacement for `view.setBigUint64(byteOffset, BigInt(n), isLE)` without the per-call\n// BigInt allocation. Same `n < 2**53` precondition as `fromNumH`/`fromNumL`.\nfunction setU64FromNum(view, byteOffset, n, isLE) {\n    const h = fromNumH(n);\n    const l = fromNumL(n);\n    view.setUint32(byteOffset, isLE ? l : h, isLE);\n    view.setUint32(byteOffset + 4, isLE ? h : l, isLE);\n}\n// High 32-bit half of a 64-bit logical right shift for `s` in `0..31`.\nconst shrSH = (h, _l, s) => h >>> s;\n// Low 32-bit half of a 64-bit logical right shift, valid for `s` in `1..31`.\nconst shrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);\n// High 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.\nconst rotrSH = (h, l, s) => (h >>> s) | (l << (32 - s));\n// Low 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.\nconst rotrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);\n// High 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.\nconst rotrBH = (h, l, s) => (h << (64 - s)) | (l >>> (s - 32));\n// Low 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.\nconst rotrBL = (h, l, s) => (h >>> (s - 32)) | (l << (64 - s));\n// High 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped low half.\nconst rotr32H = (_h, l) => l;\n// Low 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped high half.\nconst rotr32L = (h, _l) => h;\n// 64-bit left rotates (rotl*) are not defined here: sha3.ts, their only consumer, keeps\n// local copies so V8 inlines them into keccakP.\n// Add two split 64-bit words and return the split `{ h, l }` sum.\n// JS uses 32-bit signed integers for bitwise operations, so we cannot simply shift the carry out\n// of the low sum and instead use division.\nfunction add(Ah, Al, Bh, Bl) {\n    const l = (Al >>> 0) + (Bl >>> 0);\n    return { h: (Ah + Bh + ((l / 2 ** 32) | 0)) | 0, l: l | 0 };\n}\n// Addition with more than 2 elements\n// Unmasked low-word accumulator for 3-way addition; pass the raw result into `add3H(...)`.\nconst add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);\n// High-word finalize step for 3-way addition; `low` must be the untruncated output of `add3L(...)`.\nconst add3H = (low, Ah, Bh, Ch) => (Ah + Bh + Ch + ((low / 2 ** 32) | 0)) | 0;\n// Unmasked low-word accumulator for 4-way addition; pass the raw result into `add4H(...)`.\nconst add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);\n// High-word finalize step for 4-way addition; `low` must be the untruncated output of `add4L(...)`.\nconst add4H = (low, Ah, Bh, Ch, Dh) => (Ah + Bh + Ch + Dh + ((low / 2 ** 32) | 0)) | 0;\n// Unmasked low-word accumulator for 5-way addition; pass the raw result into `add5H(...)`.\nconst add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);\n// High-word finalize step for 5-way addition; `low` must be the untruncated output of `add5L(...)`.\nconst add5H = (low, Ah, Bh, Ch, Dh, Eh) => (Ah + Bh + Ch + Dh + Eh + ((low / 2 ** 32) | 0)) | 0;\n// prettier-ignore\nexport { add, add3H, add3L, add4H, add4L, add5H, add5L, fromBig, fromNumH, fromNumL, rotr32H, rotr32L, rotrBH, rotrBL, rotrSH, rotrSL, setU64FromNum, shrSH, shrSL, split, toBig };\n","/**\n * Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.\n * @param a - value to test\n * @returns `true` when the value is a Uint8Array-compatible view.\n * @example\n * Check whether a value is a Uint8Array-compatible view.\n * ```ts\n * isBytes(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport function isBytes(a) {\n    // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases.\n    // The fallback still requires a real ArrayBuffer view, so plain\n    // JSON-deserialized `{ constructor: ... }` spoofing is rejected, and\n    // `BYTES_PER_ELEMENT === 1` keeps the fallback on byte-oriented views.\n    return (a instanceof Uint8Array ||\n        (ArrayBuffer.isView(a) &&\n            a.constructor.name === 'Uint8Array' &&\n            'BYTES_PER_ELEMENT' in a &&\n            a.BYTES_PER_ELEMENT === 1));\n}\n// Shared error-message prefix builder. Only called on throw paths, so assert\n// success paths never pay for the string concatenation.\nconst atitle = (title) => (title ? `\"${title}\" ` : '');\n/**\n * Asserts something is a non-negative integer.\n * @param n - number to validate\n * @param title - label included in thrown errors\n * @returns The validated number.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validate a non-negative integer option.\n * ```ts\n * anumber(32, 'length');\n * ```\n */\nexport function anumber(n, title = '') {\n    if (typeof n !== 'number')\n        throw new TypeError(atitle(title) + 'expected number, got ' + typeof n);\n    if (!Number.isSafeInteger(n) || n < 0)\n        throw new RangeError(atitle(title) + 'expected integer >= 0, got ' + n);\n    return n;\n}\n/**\n * Asserts something is a boolean.\n * @param value - value to validate\n * @param title - label included in thrown errors\n * @returns The validated boolean.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Validate a boolean option.\n * ```ts\n * abool(true, 'enableXOF');\n * ```\n */\nexport function abool(value, title = '') {\n    if (typeof value !== 'boolean')\n        throw new TypeError(atitle(title) + 'expected boolean, got type=' + typeof value);\n    return value;\n}\n/**\n * Asserts something is Uint8Array.\n * @param value - value to validate\n * @param length - optional exact length constraint\n * @param title - label included in thrown errors\n * @returns The validated byte array.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validate that a value is a byte array.\n * ```ts\n * abytes(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport function abytes(value, length, title = '') {\n    // Success path first: this runs at the start of every update() / digestInto(), and the\n    // common `abytes(data)` form must not pay for length handling it does not use.\n    if (isBytes(value) && (length === undefined || value.length === length))\n        return value;\n    // Error path: recompute freely to build the exact message.\n    if (length !== undefined)\n        anumber(length, 'length');\n    const bytes = isBytes(value);\n    const ofLen = length !== undefined ? ` of length ${length}` : '';\n    const got = bytes ? `length=${value.length}` : `type=${typeof value}`;\n    const message = atitle(title) + 'expected Uint8Array' + ofLen + ', got ' + got;\n    if (!bytes)\n        throw new TypeError(message);\n    throw new RangeError(message);\n}\n/**\n * Copies bytes into a fresh Uint8Array.\n * Buffer-style slices can alias the same backing store, so callers that need ownership should copy.\n * @param bytes - source bytes to clone\n * @returns Freshly allocated copy of `bytes`.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Clone a byte array before mutating it.\n * ```ts\n * const copy = copyBytes(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport function copyBytes(bytes) {\n    // `Uint8Array.from(...)` would also accept arrays / other typed arrays. Keep this helper strict\n    // because callers use it at byte-validation boundaries before mutating the detached copy.\n    return Uint8Array.from(abytes(bytes));\n}\n/**\n * Asserts something is a wrapped hash constructor.\n * @param h - hash constructor to validate\n * @throws On wrong argument types or invalid hash wrapper shape. {@link TypeError}\n * @throws On invalid hash metadata ranges or values. {@link RangeError}\n * @throws If the hash metadata allows empty outputs or block sizes. {@link Error}\n * @example\n * Validate a callable hash wrapper.\n * ```ts\n * import { ahash } from '@noble/hashes/utils.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * ahash(sha256);\n * ```\n */\nexport function ahash(h) {\n    if (typeof h !== 'function' || typeof h.create !== 'function')\n        throw new TypeError('expected hash wrapped by utils.createHasher');\n    anumber(h.outputLen);\n    anumber(h.blockLen);\n    // HMAC and KDF callers treat these as real byte lengths; allowing zero lets fake wrappers pass\n    // validation and can produce empty outputs instead of failing fast.\n    if (h.outputLen < 1 || h.blockLen < 1)\n        throw new Error('hash blockLen / outputLen must be >= 1');\n}\nconst aobject = (value, label) => {\n    if (value === null || typeof value !== 'object' || Array.isArray(value))\n        throw new TypeError((label === 'object' ? '' : `\"${label}\" `) + 'expected object, got type=' + typeof value);\n};\nconst aopts = (value, label) => {\n    aobject(value, label);\n    const proto = Object.getPrototypeOf(value);\n    if (proto !== Object.prototype && proto !== null)\n        throw new TypeError(`\"${label}\" expected plain object`);\n    // Object.assign() treats an own \"__proto__\" source key as a write to the target's legacy\n    // prototype setter. Reject it before merging so inherited option values cannot be injected.\n    if (Object.hasOwn(value, '__proto__'))\n        throw new TypeError(`\"${label}.__proto__\" is not allowed`);\n};\n/**\n * Asserts a hash instance has not been destroyed or finished.\n * @param instance - hash instance to validate\n * @param checkFinished - whether to reject finalized instances\n * @throws If the hash instance has already been destroyed or finalized. {@link Error}\n * @example\n * Validate that a hash instance is still usable.\n * ```ts\n * import { aexists } from '@noble/hashes/utils.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const hash = sha256.create();\n * aexists(hash);\n * ```\n */\nexport function aexists(instance, checkFinished = true) {\n    // Runs on every update()/digestInto(); the flags are library-owned booleans, so only their\n    // truthiness is checked - re-validating their type per call was pure hot-path overhead.\n    if (instance.destroyed)\n        throw new Error('hash was destroyed');\n    if (checkFinished && instance.finished)\n        throw new Error('digest() was already called');\n}\n/**\n * Asserts output is a sufficiently-sized byte array.\n * @param out - destination buffer\n * @param instance - hash instance providing output length\n * Oversized buffers are allowed; downstream code only promises to fill the first `outputLen` bytes.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validate a caller-provided digest buffer.\n * ```ts\n * import { aoutput } from '@noble/hashes/utils.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const hash = sha256.create();\n * aoutput(new Uint8Array(hash.outputLen), hash);\n * ```\n */\nexport function aoutput(out, instance) {\n    abytes(out, undefined, 'output');\n    // `outputLen` is a library-owned readonly number; the negated comparison keeps failing fast\n    // when it is missing/NaN (comparisons with undefined/NaN are false) without an anumber() call.\n    const min = instance.outputLen;\n    if (!(out.length >= min)) {\n        throw new RangeError('\"output\" expected length >= ' + min);\n    }\n}\n/**\n * Casts a typed array view to Uint8Array.\n * @param arr - source typed array\n * @returns Uint8Array view over the same buffer.\n * @example\n * Reinterpret a typed array as bytes.\n * ```ts\n * u8(new Uint32Array([1, 2]));\n * ```\n */\nexport function u8(arr) {\n    return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/**\n * Casts a typed array view to Uint32Array.\n * `arr.byteOffset` must already be 4-byte aligned or the platform\n * Uint32Array constructor will throw.\n * @param arr - source typed array\n * @returns Uint32Array view over the same buffer.\n * @example\n * Reinterpret a byte array as 32-bit words.\n * ```ts\n * u32(new Uint8Array(8));\n * ```\n */\nexport function u32(arr) {\n    return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));\n}\n/**\n * Zeroizes typed arrays in place. Warning: JS provides no guarantees.\n * @param arrays - arrays to overwrite with zeros\n * @example\n * Zeroize sensitive buffers in place.\n * ```ts\n * clean(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport function clean(...arrays) {\n    for (let i = 0; i < arrays.length; i++) {\n        arrays[i].fill(0);\n    }\n}\n/**\n * Creates a DataView for byte-level manipulation.\n * @param arr - source typed array\n * @returns DataView over the same buffer region.\n * @example\n * Create a DataView over an existing buffer.\n * ```ts\n * createView(new Uint8Array(4));\n * ```\n */\nexport function createView(arr) {\n    return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/**\n * Rotate-right operation for uint32 values.\n * @param word - source word\n * @param shift - shift amount in bits\n * @returns Rotated word.\n * @example\n * Rotate a 32-bit word to the right.\n * ```ts\n * rotr(0x12345678, 8);\n * ```\n */\nexport function rotr(word, shift) {\n    return (word << (32 - shift)) | (word >>> shift);\n}\n/**\n * Rotate-left operation for uint32 values.\n * @param word - source word\n * @param shift - shift amount in bits\n * @returns Rotated word.\n * @example\n * Rotate a 32-bit word to the left.\n * ```ts\n * rotl(0x12345678, 8);\n * ```\n */\nexport function rotl(word, shift) {\n    return (word << shift) | ((word >>> (32 - shift)) >>> 0);\n}\n/** Whether the current platform is little-endian. */\nexport const isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44)();\n/**\n * Byte-swap operation for uint32 values.\n * @param word - source word\n * @returns Word with reversed byte order.\n * @example\n * Reverse the byte order of a 32-bit word.\n * ```ts\n * byteSwap(0x11223344);\n * ```\n */\nexport function byteSwap(word) {\n    return (((word << 24) & 0xff000000) |\n        ((word << 8) & 0xff0000) |\n        ((word >>> 8) & 0xff00) |\n        ((word >>> 24) & 0xff));\n}\n/**\n * Conditionally byte-swaps one 32-bit word on big-endian platforms.\n * @param n - source word\n * @returns Original or byte-swapped word depending on platform endianness.\n * @example\n * Normalize a 32-bit word for host endianness.\n * ```ts\n * swap8IfBE(0x11223344);\n * ```\n */\nexport const swap8IfBE = isLE\n    ? (n) => n\n    : (n) => byteSwap(n) >>> 0;\n/**\n * Byte-swaps every word of a Uint32Array in place.\n * @param arr - array to mutate\n * @returns The same array after mutation; callers pass live state arrays here.\n * @example\n * Reverse the byte order of every word in place.\n * ```ts\n * byteSwap32(new Uint32Array([0x11223344]));\n * ```\n */\nexport function byteSwap32(arr) {\n    for (let i = 0; i < arr.length; i++) {\n        arr[i] = byteSwap(arr[i]);\n    }\n    return arr;\n}\n/**\n * Conditionally byte-swaps a Uint32Array on big-endian platforms.\n * @param u - array to normalize for host endianness\n * @returns Original or byte-swapped array depending on platform endianness.\n *   On big-endian runtimes this mutates `u` in place via `byteSwap32(...)`.\n * @example\n * Normalize a word array for host endianness.\n * ```ts\n * swap32IfBE(new Uint32Array([0x11223344]));\n * ```\n */\nexport const swap32IfBE = isLE\n    ? (u) => u\n    : byteSwap32;\n// Built-in hex conversion https://caniuse.com/mdn-javascript_builtins_uint8array_fromhex\nconst hasHexBuiltin = /* @__PURE__ */ (() => \n// @ts-ignore\ntypeof Uint8Array.from([]).toHex === 'function' && typeof Uint8Array.fromHex === 'function')();\n// Array where index 0xf0 (240) is mapped to string 'f0'\nconst hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));\n/**\n * Convert byte array to hex string.\n * Uses the built-in function when available and assumes it matches the tested\n * fallback semantics.\n * @param bytes - bytes to encode\n * @returns Lowercase hexadecimal string.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Convert bytes to lowercase hexadecimal.\n * ```ts\n * bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])); // 'cafe0123'\n * ```\n */\nexport function bytesToHex(bytes) {\n    abytes(bytes);\n    // @ts-ignore\n    if (hasHexBuiltin)\n        return bytes.toHex();\n    // pre-caching improves the speed 6x\n    let hex = '';\n    for (let i = 0; i < bytes.length; i++) {\n        hex += hexes[bytes[i]];\n    }\n    return hex;\n}\n// Strict ASCII nibble parser: non-ASCII hex lookalikes are rejected as undefined.\n// ASCII codes: '0'..'9' = 48..57, 'A'..'F' = 65..70, 'a'..'f' = 97..102.\n// prettier-ignore\nfunction asciiToBase16(ch) {\n    return ch >= 48 && ch <= 57 ? ch - 48 // '2' => 50-48\n        : ch >= 65 && ch <= 70 ? ch - (65 - 10) // 'B' => 66-(65-10)\n            : ch >= 97 && ch <= 102 ? ch - (97 - 10) // 'b' => 98-(97-10)\n                : undefined;\n}\n/**\n * Convert hex string to byte array. Uses built-in function, when available.\n * @param hex - hexadecimal string to decode\n * @returns Decoded bytes.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Decode lowercase hexadecimal into bytes.\n * ```ts\n * hexToBytes('cafe0123'); // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])\n * ```\n */\nexport function hexToBytes(hex) {\n    if (typeof hex !== 'string')\n        throw new TypeError('hex string expected, got ' + typeof hex);\n    if (hasHexBuiltin) {\n        try {\n            return Uint8Array.fromHex(hex);\n        }\n        catch (error) {\n            if (error instanceof SyntaxError)\n                throw new RangeError(error.message);\n            throw error;\n        }\n    }\n    const hl = hex.length;\n    const al = hl / 2;\n    if (hl % 2)\n        throw new RangeError('hex string expected, got unpadded hex of length ' + hl);\n    const array = new Uint8Array(al);\n    for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {\n        const n1 = asciiToBase16(hex.charCodeAt(hi)); // parse first char, multiply it by 16\n        const n2 = asciiToBase16(hex.charCodeAt(hi + 1)); // parse second char\n        if (n1 === undefined || n2 === undefined) {\n            const char = hex[hi] + hex[hi + 1];\n            throw new RangeError('hex string expected, got non-hex character \"' + char + '\" at index ' + hi);\n        }\n        array[ai] = n1 * 16 + n2; // example: 'A9' => 10*16 + 9\n    }\n    return array;\n}\n/**\n * Yields to the host task scheduler so timers, I/O, and rendering can make progress.\n * Uses the Web Scheduling API when available or `setTimeout` as a cross-platform fallback.\n * Host-task yields are much slower than microtasks (roughly 1ms with the timer fallback), so\n * async loops should use `asyncTick >= 10` to amortize scheduling overhead to about 10% while\n * still allowing other event-loop work to proceed.\n * @param onReject - optional cleanup invoked only if the host yield fails\n * @example\n * Yield to the next scheduler tick.\n * ```ts\n * await nextTick();\n * ```\n */\nexport function nextTick(onReject) {\n    const host = globalThis;\n    if (typeof host.scheduler?.yield === 'function') {\n        const promise = host.scheduler.yield();\n        // Keep the original scheduler rejection; this handler exists only for cleanup.\n        if (onReject)\n            promise.catch(onReject);\n        return promise;\n    }\n    return new Promise((resolve) => host.setTimeout(resolve, 0));\n}\n/**\n * Returns control to the host event loop every `tick` milliseconds to avoid blocking long loops.\n * @param iters - number of loop iterations to run\n * @param tick - maximum time slice in milliseconds\n * @param cb - callback executed on each iteration\n * @param onReject - optional cleanup invoked only if a host yield fails\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Run a loop that periodically yields back to the event loop.\n * ```ts\n * await asyncLoop(2, 0, () => {});\n * ```\n */\nexport async function asyncLoop(iters, tick, cb, onReject) {\n    anumber(iters, 'iters');\n    anumber(tick, 'tick');\n    if (typeof cb !== 'function')\n        throw new TypeError('callback must be a function');\n    // Callback is synchronous by contract; asyncLoop only yields between sync work windows.\n    let ts = Date.now();\n    for (let i = 0; i < iters; i++) {\n        cb(i);\n        // Date.now() is not monotonic, so in case if clock goes backwards we return return control too\n        const diff = Date.now() - ts;\n        if (diff >= 0 && diff < tick)\n            continue;\n        await nextTick(onReject);\n        // Track only synchronous work time; scheduler delay after yielding is outside our budget.\n        ts = Date.now();\n    }\n}\n/**\n * Converts string to bytes using UTF8 encoding.\n * Built-in doesn't validate input to be string: we do the check.\n * Non-ASCII details are delegated to the platform `TextEncoder`.\n * @param str - string to encode\n * @returns UTF-8 encoded bytes.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Encode a string as UTF-8 bytes.\n * ```ts\n * utf8ToBytes('abc'); // Uint8Array.from([97, 98, 99])\n * ```\n */\nexport function utf8ToBytes(str) {\n    if (typeof str !== 'string')\n        throw new TypeError('string expected');\n    const encoded = new TextEncoder().encode(str);\n    try {\n        // Copy into the current realm for Firefox extension contexts. Callers that own the returned\n        // buffer can then wipe it independently of TextEncoder's temporary result.\n        return new Uint8Array(encoded); // https://bugzil.la/1681809\n    }\n    finally {\n        clean(encoded);\n    }\n}\n/**\n * Helper for KDFs: consumes Uint8Array or string.\n * String inputs are UTF-8 encoded; byte-array inputs stay aliased to the caller buffer.\n * @param data - user-provided KDF input\n * @param errorTitle - label included in thrown errors\n * @returns Byte representation of the input.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Normalize KDF input to bytes.\n * ```ts\n * kdfInputToBytes('password');\n * ```\n */\nexport function kdfInputToBytes(data, errorTitle = '') {\n    if (typeof data === 'string')\n        return utf8ToBytes(data);\n    return abytes(data, undefined, errorTitle);\n}\n/**\n * Copies several Uint8Arrays into one.\n * @param arrays - arrays to concatenate\n * @returns Concatenated byte array.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Concatenate multiple byte arrays.\n * ```ts\n * concatBytes(new Uint8Array([1]), new Uint8Array([2]));\n * ```\n */\nexport function concatBytes(...arrays) {\n    let sum = 0;\n    for (let i = 0; i < arrays.length; i++) {\n        const a = arrays[i];\n        abytes(a);\n        sum += a.length;\n    }\n    const res = new Uint8Array(sum);\n    for (let i = 0, pad = 0; i < arrays.length; i++) {\n        const a = arrays[i];\n        res.set(a, pad);\n        pad += a.length;\n    }\n    return res;\n}\n/**\n * Validates declared required and optional field types on a plain object.\n * This walks field schemas and formats detailed errors, so avoid it on hot paths; use direct\n * one-line guards such as `abytes()`, `abool()`, or `anumber()` instead.\n * @param object - object to validate\n * @param fields - map of required field names to expected types\n * @param optFields - map of optional field names to expected types\n * @param title - label included in thrown errors\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Validate required and optional option fields.\n * ```ts\n * validateObject({ N: 1024, dkLen: 32 }, { N: 'number' }, { dkLen: 'number' });\n * ```\n */\nexport const validateObject = (object, fields = {}, optFields = {}, title = 'object') => {\n    aobject(object, title);\n    aobject(fields, 'fields');\n    aobject(optFields, 'optFields');\n    function checkField(fieldName, expectedType, isOpt) {\n        const label = title === 'object' ? `param \"${String(fieldName)}\"` : `\"${title}.${String(fieldName)}\"`;\n        // Config fields must be explicit own properties. Optional inherited values are rejected too\n        // because callers keep reading the same options object after validation.\n        const val = object[fieldName];\n        // Runtime objects such as Field instances intentionally satisfy required method slots\n        // via their shared prototype.\n        if (!Object.hasOwn(object, fieldName) &&\n            (isOpt ? val !== undefined : expectedType !== 'function')) {\n            throw new TypeError(`${label} is invalid: expected own property`);\n        }\n        if (isOpt && val === undefined)\n            return;\n        const current = typeof val;\n        if (current !== expectedType || val === null)\n            throw new TypeError(`${label} is invalid: expected ${expectedType}, got ${current}`);\n    }\n    const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));\n    iter(fields, false);\n    iter(optFields, true);\n};\n/**\n * Merges default options and passed options.\n * @param defaults - base option object\n * @param opts - user overrides\n * @param title - label included in thrown override errors\n * @returns Fresh merged option object with a null prototype.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Merge user overrides onto default options.\n * ```ts\n * checkOpts({ dkLen: 32 }, { asyncTick: 10 });\n * ```\n */\nexport function checkOpts(defaults, opts, title = 'opts') {\n    aopts(defaults, 'defaults');\n    if (opts !== undefined)\n        aopts(opts, title);\n    // Callers read optional fields directly, so omitted values must not fall through to ambient\n    // Object.prototype pollution (for example a forged `dkLen` changing SHAKE's default output).\n    const merged = Object.assign(Object.create(null), defaults, opts);\n    return merged;\n}\n/**\n * Creates a callable hash function from a stateful class constructor.\n * @param hashCons - hash constructor or factory\n * @param info - optional metadata such as DER OID\n * @returns Frozen callable hash wrapper with `.create()`.\n *   Wrapper construction eagerly calls `hashCons(undefined)` once to read\n *   `outputLen` / `blockLen`, so constructor side effects happen at module\n *   init time.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Wrap a stateful hash constructor into a callable helper.\n * ```ts\n * import { createHasher } from '@noble/hashes/utils.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const wrapped = createHasher(sha256.create, { oid: sha256.oid });\n * wrapped(new Uint8Array([1]));\n * ```\n */\nexport function createHasher(hashCons, info = {}) {\n    if (typeof hashCons !== 'function')\n        throw new TypeError('\"hashCons\" expected function, got type=' + typeof hashCons);\n    info = checkOpts({}, info, 'info');\n    const hashC = (msg, opts) => hashCons(opts)\n        .update(msg)\n        .digest();\n    const tmp = hashCons(undefined);\n    hashC.outputLen = tmp.outputLen;\n    hashC.blockLen = tmp.blockLen;\n    hashC.canXOF = tmp.canXOF;\n    hashC.create = (opts) => hashCons(opts);\n    Object.assign(hashC, info);\n    return Object.freeze(hashC);\n}\n/**\n * Cryptographically secure PRNG backed by `crypto.getRandomValues`.\n * @param bytesLength - number of random bytes to generate\n * @returns Random bytes.\n * The platform `getRandomValues()` implementation still defines any\n * single-call length cap, and this helper rejects oversize requests\n * with a stable library `RangeError` instead of host-specific errors.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @throws If the current runtime does not provide `crypto.getRandomValues`. {@link Error}\n * @example\n * Generate a fresh random key or nonce.\n * ```ts\n * const key = randomBytes(16);\n * ```\n */\nexport function randomBytes(bytesLength = 32) {\n    // Match the repo's other length-taking helpers instead of relying on Uint8Array coercion.\n    anumber(bytesLength, 'bytesLength');\n    const cr = typeof globalThis === 'object' ? globalThis.crypto : null;\n    if (typeof cr?.getRandomValues !== 'function')\n        throw new Error('crypto.getRandomValues must be defined');\n    // Web Cryptography API Level 2 §10.1.1:\n    // if `byteLength > 65536`, throw `QuotaExceededError`.\n    // Keep the guard explicit so callers can see the quota in code\n    // instead of discovering it by reading the spec or host errors.\n    // This wrapper surfaces the same quota as a stable library RangeError.\n    if (bytesLength > 65536)\n        throw new RangeError(`\"bytesLength\" expected <= 65536, got ${bytesLength}`);\n    return cr.getRandomValues(new Uint8Array(bytesLength));\n}\n/**\n * Creates OID metadata for NIST hashes with prefix `06 09 60 86 48 01 65 03 04 02`.\n * @param suffix - final OID byte for the selected hash.\n *   The helper accepts any byte even though only the documented NIST hash\n *   suffixes are meaningful downstream.\n * @returns Object containing the DER-encoded OID.\n * @example\n * Build OID metadata for a NIST hash.\n * ```ts\n * oidNist(0x01);\n * ```\n */\nexport const oidNist = (suffix) => ({\n    // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.\n    // Larger suffix values would need base-128 OID encoding and a different length byte.\n    oid: Uint8Array.from([0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, suffix]),\n});\n","/**\n * Internal Merkle-Damgard hash utils.\n * @module\n */\nimport { setU64FromNum } from \"./_u64.js\";\nimport { abytes, aexists, aoutput, createView } from \"./utils.js\";\n/**\n * Shared 32-bit conditional boolean primitive reused by SHA-256, SHA-1, and MD5 `F`.\n * Returns bits from `b` when `a` is set, otherwise from `c`.\n * The XOR form is equivalent to MD5's `F(X,Y,Z) = XY v not(X)Z` because the masked terms never\n * set the same bit.\n * @param a - selector word\n * @param b - word chosen when selector bit is set\n * @param c - word chosen when selector bit is clear\n * @returns Mixed 32-bit word.\n * @example\n * Combine three words with the shared 32-bit choice primitive.\n * ```ts\n * Chi(0xffffffff, 0x12345678, 0x87654321);\n * ```\n */\nexport function Chi(a, b, c) {\n    return (a & b) ^ (~a & c);\n}\n/**\n * Shared 32-bit majority primitive reused by SHA-256 and SHA-1.\n * Returns bits shared by at least two inputs.\n * @param a - first input word\n * @param b - second input word\n * @param c - third input word\n * @returns Mixed 32-bit word.\n * @example\n * Combine three words with the shared 32-bit majority primitive.\n * ```ts\n * Maj(0xffffffff, 0x12345678, 0x87654321);\n * ```\n */\nexport function Maj(a, b, c) {\n    return (a & b) ^ (a & c) ^ (b & c);\n}\n/**\n * Merkle-Damgard hash construction base class.\n * Could be used to create MD5, RIPEMD, SHA1, SHA2.\n * Accepts only byte-aligned `Uint8Array` input, even when the underlying spec describes bit\n * strings with partial-byte tails.\n * @param blockLen - internal block size in bytes\n * @param outputLen - digest size in bytes\n * @param padOffset - trailing length field size in bytes\n * @param isLE - whether length and state words are encoded in little-endian\n * @example\n * Use a concrete subclass to get the shared Merkle-Damgard update/digest flow.\n * ```ts\n * import { _SHA1 } from '@noble/hashes/legacy.js';\n * const hash = new _SHA1();\n * hash.update(new Uint8Array([97, 98, 99]));\n * hash.digest();\n * ```\n */\nexport class HashMD {\n    blockLen;\n    outputLen;\n    canXOF = false;\n    padOffset;\n    isLE;\n    // For partial updates less than block size\n    buffer;\n    view;\n    finished = false;\n    length = 0;\n    pos = 0;\n    destroyed = false;\n    constructor(blockLen, outputLen, padOffset, isLE) {\n        this.blockLen = blockLen;\n        this.outputLen = outputLen;\n        this.padOffset = padOffset;\n        this.isLE = isLE;\n        this.buffer = new Uint8Array(blockLen);\n        this.view = createView(this.buffer);\n    }\n    update(data) {\n        aexists(this);\n        abytes(data);\n        const { view, buffer, blockLen } = this;\n        const len = data.length;\n        let processed = false;\n        for (let pos = 0; pos < len;) {\n            const take = Math.min(blockLen - this.pos, len - pos);\n            // Fast path only when there is no buffered partial block: `take === blockLen` implies\n            // `this.pos === 0`, so we can process full blocks directly from the input view.\n            if (take === blockLen) {\n                const dataView = createView(data);\n                for (; blockLen <= len - pos; pos += blockLen)\n                    this.process(dataView, pos);\n                processed = true;\n                continue;\n            }\n            // When the whole input is buffered in one go (common for short messages), passing `data`\n            // directly avoids allocating a subarray view.\n            buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);\n            this.pos += take;\n            pos += take;\n            if (this.pos === blockLen) {\n                this.process(view, 0);\n                this.pos = 0;\n                processed = true;\n            }\n        }\n        this.length += data.length;\n        // Shared schedule buffers only pick up input-derived words inside process(); if everything\n        // was buffered without processing, there is nothing to zero.\n        if (processed)\n            this.roundClean();\n        return this;\n    }\n    digestInto(out) {\n        aexists(this);\n        aoutput(out, this);\n        this.finished = true;\n        // Padding\n        // We can avoid allocation of buffer for padding completely if it\n        // was previously not allocated here. But it won't change performance.\n        const { buffer, view, blockLen, isLE } = this;\n        let { pos } = this;\n        // append the bit '1' to the message, then zero-pad the rest of the block\n        buffer[pos++] = 0b10000000;\n        buffer.fill(0, pos);\n        // we have less than padOffset left in buffer, so we cannot put length in\n        // current block, need process it and pad again\n        if (this.padOffset > blockLen - pos) {\n            this.process(view, 0);\n            buffer.fill(0);\n        }\n        // `padOffset` reserves the whole length field. For SHA-384/512 the high 64 bits stay zero from\n        // the padding fill above, and JS will overflow before user input can make that half non-zero.\n        // So we only need to write the low 64 bits here (`length * 8` only scales the exponent of an\n        // integer below 2**53, so the split inside the helper stays exact).\n        setU64FromNum(view, blockLen - 8, this.length * 8, isLE);\n        this.process(view, 0);\n        // The final block above is processed outside update(), so the shared message-schedule\n        // buffers (e.g. SHA256_W) would otherwise retain input-derived words after digest().\n        this.roundClean();\n        // digest() passes our own `buffer` as `out`; reuse its cached view instead of allocating one.\n        const oview = out === buffer ? view : createView(out);\n        const len = this.outputLen;\n        // NOTE: we do division by 4 later, which must be fused in single op with modulo by JIT\n        const outLen = len / 4;\n        const state = this.get();\n        // Subclass-misconfiguration invariant: outputLen must be 32-bit aligned and fit the state.\n        if (len % 4 || outLen > state.length)\n            throw new Error('invalid outputLen');\n        for (let i = 0; i < outLen; i++)\n            oview.setUint32(4 * i, state[i], isLE);\n    }\n    digest() {\n        const { buffer, outputLen } = this;\n        this.digestInto(buffer);\n        // Copy before destroy(): subclasses wipe `buffer` during cleanup, but `digest()` must return\n        // fresh bytes to the caller.\n        const res = buffer.slice(0, outputLen);\n        this.destroy();\n        return res;\n    }\n    _cloneIntoMeta(to) {\n        const { buffer, length, finished, destroyed, pos } = this;\n        to.destroyed = destroyed;\n        to.finished = finished;\n        to.length = length;\n        to.pos = pos;\n        // Only partial-block bytes need copying: when `length % blockLen === 0`, `pos === 0` and\n        // later `update()` / `digestInto()` overwrite `to.buffer` from the start before reading it.\n        if (pos)\n            to.buffer.set(buffer); // Avoid a hot modulo guard.\n        return to;\n    }\n    clone() {\n        return this._cloneInto();\n    }\n}\n/**\n * Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.\n * Check out `test/misc/sha2-gen-iv.js` for recomputation guide.\n */\n/** Initial SHA256 state from RFC 6234 §6.1: the first 32 bits of the fractional parts of the\n * square roots of the first eight prime numbers. Exported as a shared table; callers must treat\n * it as read-only because constructors copy words from it by index. */\nexport const SHA256_IV = /* @__PURE__ */ Uint32Array.from([\n    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,\n]);\n/** Initial SHA224 state `H(0)` from RFC 6234 §6.1. Exported as a shared table; callers must\n * treat it as read-only because constructors copy words from it by index. */\nexport const SHA224_IV = /* @__PURE__ */ Uint32Array.from([\n    0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939, 0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4,\n]);\n/** Initial SHA384 state from RFC 6234 §6.3: eight RFC 64-bit `H(0)` words stored as sixteen\n * big-endian 32-bit halves. Derived from the fractional parts of the square roots of the ninth\n * through sixteenth prime numbers. Exported as a shared table; callers must treat it as read-only\n * because constructors copy halves from it by index. */\nexport const SHA384_IV = /* @__PURE__ */ Uint32Array.from([\n    0xcbbb9d5d, 0xc1059ed8, 0x629a292a, 0x367cd507, 0x9159015a, 0x3070dd17, 0x152fecd8, 0xf70e5939,\n    0x67332667, 0xffc00b31, 0x8eb44a87, 0x68581511, 0xdb0c2e0d, 0x64f98fa7, 0x47b5481d, 0xbefa4fa4,\n]);\n/** Initial SHA512 state from RFC 6234 §6.3: eight RFC 64-bit `H(0)` words stored as sixteen\n * big-endian 32-bit halves. Derived from the fractional parts of the square roots of the first\n * eight prime numbers. Exported as a shared table; callers must treat it as read-only because\n * constructors copy halves from it by index. */\nexport const SHA512_IV = /* @__PURE__ */ Uint32Array.from([\n    0x6a09e667, 0xf3bcc908, 0xbb67ae85, 0x84caa73b, 0x3c6ef372, 0xfe94f82b, 0xa54ff53a, 0x5f1d36f1,\n    0x510e527f, 0xade682d1, 0x9b05688c, 0x2b3e6c1f, 0x1f83d9ab, 0xfb41bd6b, 0x5be0cd19, 0x137e2179,\n]);\n","/**\n * SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.\n * SHA256 is the fastest hash implementable in JS, even faster than Blake3.\n * Check out {@link https://www.rfc-editor.org/rfc/rfc4634 | RFC 4634} and\n * {@link https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf | FIPS 180-4}.\n * @module\n */\nimport { Chi, HashMD, Maj, SHA224_IV, SHA256_IV, SHA384_IV, SHA512_IV } from \"./_md.js\";\nimport * as u64 from \"./_u64.js\";\nimport { clean, createHasher, oidNist, rotr } from \"./utils.js\";\n/**\n * SHA-224 / SHA-256 round constants from RFC 6234 §5.1: the first 32 bits\n * of the cube roots of the first 64 primes (2..311).\n */\n// prettier-ignore\nconst SHA256_K = /* @__PURE__ */ Uint32Array.from([\n    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,\n    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,\n    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,\n    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,\n    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,\n    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,\n    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,\n    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2\n]);\n/** Reusable SHA-224 / SHA-256 message schedule buffer `W_t` from RFC 6234 §6.2 step 1. */\nconst SHA256_W = /* @__PURE__ */ new Uint32Array(64);\n/** Internal SHA-224 / SHA-256 compression engine from RFC 6234 §6.2. */\nclass SHA2_32B extends HashMD {\n    // We cannot use array here since array allows indexing by variable\n    // which means optimizer/compiler cannot use registers.\n    // Numeric initializers matter: starting the fields as `undefined` changes\n    // V8's field representation and makes sha256 3x slower (measured).\n    A = 0;\n    B = 0;\n    C = 0;\n    D = 0;\n    E = 0;\n    F = 0;\n    G = 0;\n    H = 0;\n    constructor(outputLen, IV) {\n        super(64, outputLen, 8, false);\n        this.A = IV[0] | 0;\n        this.B = IV[1] | 0;\n        this.C = IV[2] | 0;\n        this.D = IV[3] | 0;\n        this.E = IV[4] | 0;\n        this.F = IV[5] | 0;\n        this.G = IV[6] | 0;\n        this.H = IV[7] | 0;\n    }\n    get() {\n        const { A, B, C, D, E, F, G, H } = this;\n        return [A, B, C, D, E, F, G, H];\n    }\n    // prettier-ignore\n    set(A, B, C, D, E, F, G, H) {\n        this.A = A | 0;\n        this.B = B | 0;\n        this.C = C | 0;\n        this.D = D | 0;\n        this.E = E | 0;\n        this.F = F | 0;\n        this.G = G | 0;\n        this.H = H | 0;\n    }\n    _cloneInto(to) {\n        (to ||= new this.constructor()).set(...this.get());\n        return this._cloneIntoMeta(to);\n    }\n    process(view, offset) {\n        // Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array\n        for (let i = 0; i < 16; i++, offset += 4)\n            SHA256_W[i] = view.getUint32(offset, false);\n        for (let i = 16; i < 64; i++) {\n            const W15 = SHA256_W[i - 15];\n            const W2 = SHA256_W[i - 2];\n            const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ (W15 >>> 3);\n            const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ (W2 >>> 10);\n            SHA256_W[i] = (s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16]) | 0;\n        }\n        // Compression function main loop, 64 rounds\n        let { A, B, C, D, E, F, G, H } = this;\n        for (let i = 0; i < 64; i++) {\n            const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);\n            const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n            const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);\n            const T2 = (sigma0 + Maj(A, B, C)) | 0;\n            H = G;\n            G = F;\n            F = E;\n            E = (D + T1) | 0;\n            D = C;\n            C = B;\n            B = A;\n            A = (T1 + T2) | 0;\n        }\n        // Add the compressed chunk to the current hash value\n        A = (A + this.A) | 0;\n        B = (B + this.B) | 0;\n        C = (C + this.C) | 0;\n        D = (D + this.D) | 0;\n        E = (E + this.E) | 0;\n        F = (F + this.F) | 0;\n        G = (G + this.G) | 0;\n        H = (H + this.H) | 0;\n        this.set(A, B, C, D, E, F, G, H);\n    }\n    roundClean() {\n        clean(SHA256_W);\n    }\n    destroy() {\n        // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves\n        // update()/digest() callable on reused instances.\n        this.destroyed = true;\n        this.set(0, 0, 0, 0, 0, 0, 0, 0);\n        clean(this.buffer);\n    }\n}\n/** Internal SHA-256 hash class grounded in RFC 6234 §6.2. */\nexport class _SHA256 extends SHA2_32B {\n    constructor() {\n        super(32, SHA256_IV);\n    }\n}\n/** Internal SHA-224 hash class grounded in RFC 6234 §6.2 and §8.5. */\nexport class _SHA224 extends SHA2_32B {\n    constructor() {\n        super(28, SHA224_IV);\n    }\n}\n// SHA2-512 is slower than sha256 in js because u64 operations are slow.\n// SHA-384 / SHA-512 round constants from RFC 6234 §5.2:\n// 80 full 64-bit words split into high/low halves.\n// prettier-ignore\nconst K512 = /* @__PURE__ */ (() => u64.split([\n    '0x428a2f98d728ae22', '0x7137449123ef65cd', '0xb5c0fbcfec4d3b2f', '0xe9b5dba58189dbbc',\n    '0x3956c25bf348b538', '0x59f111f1b605d019', '0x923f82a4af194f9b', '0xab1c5ed5da6d8118',\n    '0xd807aa98a3030242', '0x12835b0145706fbe', '0x243185be4ee4b28c', '0x550c7dc3d5ffb4e2',\n    '0x72be5d74f27b896f', '0x80deb1fe3b1696b1', '0x9bdc06a725c71235', '0xc19bf174cf692694',\n    '0xe49b69c19ef14ad2', '0xefbe4786384f25e3', '0x0fc19dc68b8cd5b5', '0x240ca1cc77ac9c65',\n    '0x2de92c6f592b0275', '0x4a7484aa6ea6e483', '0x5cb0a9dcbd41fbd4', '0x76f988da831153b5',\n    '0x983e5152ee66dfab', '0xa831c66d2db43210', '0xb00327c898fb213f', '0xbf597fc7beef0ee4',\n    '0xc6e00bf33da88fc2', '0xd5a79147930aa725', '0x06ca6351e003826f', '0x142929670a0e6e70',\n    '0x27b70a8546d22ffc', '0x2e1b21385c26c926', '0x4d2c6dfc5ac42aed', '0x53380d139d95b3df',\n    '0x650a73548baf63de', '0x766a0abb3c77b2a8', '0x81c2c92e47edaee6', '0x92722c851482353b',\n    '0xa2bfe8a14cf10364', '0xa81a664bbc423001', '0xc24b8b70d0f89791', '0xc76c51a30654be30',\n    '0xd192e819d6ef5218', '0xd69906245565a910', '0xf40e35855771202a', '0x106aa07032bbd1b8',\n    '0x19a4c116b8d2d0c8', '0x1e376c085141ab53', '0x2748774cdf8eeb99', '0x34b0bcb5e19b48a8',\n    '0x391c0cb3c5c95a63', '0x4ed8aa4ae3418acb', '0x5b9cca4f7763e373', '0x682e6ff3d6b2b8a3',\n    '0x748f82ee5defb2fc', '0x78a5636f43172f60', '0x84c87814a1f0ab72', '0x8cc702081a6439ec',\n    '0x90befffa23631e28', '0xa4506cebde82bde9', '0xbef9a3f7b2c67915', '0xc67178f2e372532b',\n    '0xca273eceea26619c', '0xd186b8c721c0c207', '0xeada7dd6cde0eb1e', '0xf57d4f7fee6ed178',\n    '0x06f067aa72176fba', '0x0a637dc5a2c898a6', '0x113f9804bef90dae', '0x1b710b35131c471b',\n    '0x28db77f523047d84', '0x32caab7b40c72493', '0x3c9ebe0a15c9bebc', '0x431d67c49c100d4c',\n    '0x4cc5d4becb3e42b6', '0x597f299cfc657e2a', '0x5fcb6fab3ad6faec', '0x6c44198c4a475817'\n].map(n => BigInt(n))))();\nconst SHA512_Kh = /* @__PURE__ */ (() => K512[0])();\nconst SHA512_Kl = /* @__PURE__ */ (() => K512[1])();\n// Reusable high-half schedule buffer for the RFC 6234 §6.4 64-bit `W_t` words.\nconst SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);\n// Reusable low-half schedule buffer for the RFC 6234 §6.4 64-bit `W_t` words.\nconst SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);\n/** Internal SHA-384 / SHA-512 compression engine from RFC 6234 §6.4. */\nclass SHA2_64B extends HashMD {\n    // We cannot use array here since array allows indexing by variable\n    // which means optimizer/compiler cannot use registers.\n    // h -- high 32 bits, l -- low 32 bits\n    // Numeric initializers matter: starting the fields as `undefined` changes\n    // V8's field representation and slows hashing down (measured on sha256).\n    Ah = 0;\n    Al = 0;\n    Bh = 0;\n    Bl = 0;\n    Ch = 0;\n    Cl = 0;\n    Dh = 0;\n    Dl = 0;\n    Eh = 0;\n    El = 0;\n    Fh = 0;\n    Fl = 0;\n    Gh = 0;\n    Gl = 0;\n    Hh = 0;\n    Hl = 0;\n    constructor(outputLen, IV) {\n        super(128, outputLen, 16, false);\n        this.Ah = IV[0] | 0;\n        this.Al = IV[1] | 0;\n        this.Bh = IV[2] | 0;\n        this.Bl = IV[3] | 0;\n        this.Ch = IV[4] | 0;\n        this.Cl = IV[5] | 0;\n        this.Dh = IV[6] | 0;\n        this.Dl = IV[7] | 0;\n        this.Eh = IV[8] | 0;\n        this.El = IV[9] | 0;\n        this.Fh = IV[10] | 0;\n        this.Fl = IV[11] | 0;\n        this.Gh = IV[12] | 0;\n        this.Gl = IV[13] | 0;\n        this.Hh = IV[14] | 0;\n        this.Hl = IV[15] | 0;\n    }\n    // prettier-ignore\n    get() {\n        const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n        return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];\n    }\n    // prettier-ignore\n    set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {\n        this.Ah = Ah | 0;\n        this.Al = Al | 0;\n        this.Bh = Bh | 0;\n        this.Bl = Bl | 0;\n        this.Ch = Ch | 0;\n        this.Cl = Cl | 0;\n        this.Dh = Dh | 0;\n        this.Dl = Dl | 0;\n        this.Eh = Eh | 0;\n        this.El = El | 0;\n        this.Fh = Fh | 0;\n        this.Fl = Fl | 0;\n        this.Gh = Gh | 0;\n        this.Gl = Gl | 0;\n        this.Hh = Hh | 0;\n        this.Hl = Hl | 0;\n    }\n    _cloneInto(to) {\n        (to ||= new this.constructor()).set(...this.get());\n        return this._cloneIntoMeta(to);\n    }\n    process(view, offset) {\n        // Extend the first 16 words into the remaining 64 words w[16..79] of the message schedule array\n        for (let i = 0; i < 16; i++, offset += 4) {\n            SHA512_W_H[i] = view.getUint32(offset);\n            SHA512_W_L[i] = view.getUint32((offset += 4));\n        }\n        for (let i = 16; i < 80; i++) {\n            // s0 := (w[i-15] rightrotate 1) xor (w[i-15] rightrotate 8) xor (w[i-15] rightshift 7)\n            const W15h = SHA512_W_H[i - 15] | 0;\n            const W15l = SHA512_W_L[i - 15] | 0;\n            const s0h = u64.rotrSH(W15h, W15l, 1) ^ u64.rotrSH(W15h, W15l, 8) ^ u64.shrSH(W15h, W15l, 7);\n            const s0l = u64.rotrSL(W15h, W15l, 1) ^ u64.rotrSL(W15h, W15l, 8) ^ u64.shrSL(W15h, W15l, 7);\n            // s1 := (w[i-2] rightrotate 19) xor (w[i-2] rightrotate 61) xor (w[i-2] rightshift 6)\n            const W2h = SHA512_W_H[i - 2] | 0;\n            const W2l = SHA512_W_L[i - 2] | 0;\n            const s1h = u64.rotrSH(W2h, W2l, 19) ^ u64.rotrBH(W2h, W2l, 61) ^ u64.shrSH(W2h, W2l, 6);\n            const s1l = u64.rotrSL(W2h, W2l, 19) ^ u64.rotrBL(W2h, W2l, 61) ^ u64.shrSL(W2h, W2l, 6);\n            // SHA512_W[i] = s0 + s1 + SHA512_W[i - 7] + SHA512_W[i - 16];\n            const SUMl = u64.add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);\n            const SUMh = u64.add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);\n            SHA512_W_H[i] = SUMh | 0;\n            SHA512_W_L[i] = SUMl | 0;\n        }\n        let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n        // Compression function main loop, 80 rounds\n        for (let i = 0; i < 80; i++) {\n            // S1 := (e rightrotate 14) xor (e rightrotate 18) xor (e rightrotate 41)\n            const sigma1h = u64.rotrSH(Eh, El, 14) ^ u64.rotrSH(Eh, El, 18) ^ u64.rotrBH(Eh, El, 41);\n            const sigma1l = u64.rotrSL(Eh, El, 14) ^ u64.rotrSL(Eh, El, 18) ^ u64.rotrBL(Eh, El, 41);\n            //const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n            const CHIh = (Eh & Fh) ^ (~Eh & Gh);\n            const CHIl = (El & Fl) ^ (~El & Gl);\n            // T1 = H + sigma1 + Chi(E, F, G) + SHA512_K[i] + SHA512_W[i]\n            // prettier-ignore\n            const T1ll = u64.add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);\n            const T1h = u64.add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);\n            const T1l = T1ll | 0;\n            // S0 := (a rightrotate 28) xor (a rightrotate 34) xor (a rightrotate 39)\n            const sigma0h = u64.rotrSH(Ah, Al, 28) ^ u64.rotrBH(Ah, Al, 34) ^ u64.rotrBH(Ah, Al, 39);\n            const sigma0l = u64.rotrSL(Ah, Al, 28) ^ u64.rotrBL(Ah, Al, 34) ^ u64.rotrBL(Ah, Al, 39);\n            const MAJh = (Ah & Bh) ^ (Ah & Ch) ^ (Bh & Ch);\n            const MAJl = (Al & Bl) ^ (Al & Cl) ^ (Bl & Cl);\n            Hh = Gh | 0;\n            Hl = Gl | 0;\n            Gh = Fh | 0;\n            Gl = Fl | 0;\n            Fh = Eh | 0;\n            Fl = El | 0;\n            ({ h: Eh, l: El } = u64.add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));\n            Dh = Ch | 0;\n            Dl = Cl | 0;\n            Ch = Bh | 0;\n            Cl = Bl | 0;\n            Bh = Ah | 0;\n            Bl = Al | 0;\n            const All = u64.add3L(T1l, sigma0l, MAJl);\n            Ah = u64.add3H(All, T1h, sigma0h, MAJh);\n            Al = All | 0;\n        }\n        // Add the compressed chunk to the current hash value\n        ({ h: Ah, l: Al } = u64.add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));\n        ({ h: Bh, l: Bl } = u64.add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));\n        ({ h: Ch, l: Cl } = u64.add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));\n        ({ h: Dh, l: Dl } = u64.add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));\n        ({ h: Eh, l: El } = u64.add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));\n        ({ h: Fh, l: Fl } = u64.add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));\n        ({ h: Gh, l: Gl } = u64.add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));\n        ({ h: Hh, l: Hl } = u64.add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));\n        this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);\n    }\n    roundClean() {\n        clean(SHA512_W_H, SHA512_W_L);\n    }\n    destroy() {\n        // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves\n        // update()/digest() callable on reused instances.\n        this.destroyed = true;\n        clean(this.buffer);\n        this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);\n    }\n}\n/** Internal SHA-512 hash class grounded in RFC 6234 §6.3 and §6.4. */\nexport class _SHA512 extends SHA2_64B {\n    constructor() {\n        super(64, SHA512_IV);\n    }\n}\n/** Internal SHA-384 hash class grounded in RFC 6234 §6.3 and §6.4. */\nexport class _SHA384 extends SHA2_64B {\n    constructor() {\n        super(48, SHA384_IV);\n    }\n}\n/**\n * Truncated SHA512/256 and SHA512/224.\n * SHA512_IV is XORed with 0xa5a5a5a5a5a5a5a5, then used as \"intermediary\" IV of SHA512/t.\n * Then t hashes string to produce result IV.\n * See the repo-side derivation recipe in `test/misc/sha2-gen-iv.js`.\n * These IV literals are checked against that script rather than a dedicated\n * local RFC section.\n */\n/** SHA-512/224 IV derived by the SHA-512/t recipe in `test/misc/sha2-gen-iv.js` and\n * stored as sixteen big-endian 32-bit halves. */\nconst T224_IV = /* @__PURE__ */ Uint32Array.from([\n    0x8c3d37c8, 0x19544da2, 0x73e19966, 0x89dcd4d6, 0x1dfab7ae, 0x32ff9c82, 0x679dd514, 0x582f9fcf,\n    0x0f6d2b69, 0x7bd44da8, 0x77e36f73, 0x04c48942, 0x3f9d85a8, 0x6a1d36c8, 0x1112e6ad, 0x91d692a1,\n]);\n/** SHA-512/256 IV derived by the SHA-512/t recipe in `test/misc/sha2-gen-iv.js` and\n * stored as sixteen big-endian 32-bit halves. */\nconst T256_IV = /* @__PURE__ */ Uint32Array.from([\n    0x22312194, 0xfc2bf72c, 0x9f555fa3, 0xc84c64c2, 0x2393b86b, 0x6f53b151, 0x96387719, 0x5940eabd,\n    0x96283ee2, 0xa88effe3, 0xbe5e1e25, 0x53863992, 0x2b0199fc, 0x2c85b8aa, 0x0eb72ddc, 0x81c52ca2,\n]);\n/** Internal SHA-512/224 hash class using the derived `T224_IV` and the shared\n * RFC 6234 §6.4 compression engine. */\nexport class _SHA512_224 extends SHA2_64B {\n    constructor() {\n        super(28, T224_IV);\n    }\n}\n/** Internal SHA-512/256 hash class using the derived `T256_IV` and the shared\n * RFC 6234 §6.4 compression engine. */\nexport class _SHA512_256 extends SHA2_64B {\n    constructor() {\n        super(32, T256_IV);\n    }\n}\n/**\n * SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info:\n *\n * - Trying 2^128 hashes would get 50% chance of collision, using birthday attack.\n * - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.\n * - Each sha256 hash is executing 2^18 bit operations.\n * - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-256.\n * ```ts\n * sha256(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), \n/* @__PURE__ */ oidNist(0x01));\n/**\n * SHA2-224 hash function from RFC 4634.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-224.\n * ```ts\n * sha224(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha224 = /* @__PURE__ */ createHasher(() => new _SHA224(), \n/* @__PURE__ */ oidNist(0x04));\n/**\n * SHA2-512 hash function from RFC 4634.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-512.\n * ```ts\n * sha512(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha512 = /* @__PURE__ */ createHasher(() => new _SHA512(), \n/* @__PURE__ */ oidNist(0x03));\n/**\n * SHA2-384 hash function from RFC 4634.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-384.\n * ```ts\n * sha384(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha384 = /* @__PURE__ */ createHasher(() => new _SHA384(), \n/* @__PURE__ */ oidNist(0x02));\n/**\n * SHA2-512/256 \"truncated\" hash function, with improved resistance to length extension attacks.\n * See the paper on {@link https://eprint.iacr.org/2010/548.pdf | truncated SHA512}.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-512/256.\n * ```ts\n * sha512_256(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha512_256 = /* @__PURE__ */ createHasher(() => new _SHA512_256(), \n/* @__PURE__ */ oidNist(0x06));\n/**\n * SHA2-512/224 \"truncated\" hash function, with improved resistance to length extension attacks.\n * See the paper on {@link https://eprint.iacr.org/2010/548.pdf | truncated SHA512}.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-512/224.\n * ```ts\n * sha512_224(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha512_224 = /* @__PURE__ */ createHasher(() => new _SHA512_224(), \n/* @__PURE__ */ oidNist(0x05));\n","/**\n * Hex, bytes and number utilities.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { abytes as abytes_, anumber as anumber_, bytesToHex as bytesToHex_, concatBytes as concatBytes_, hexToBytes as hexToBytes_, isBytes as isBytes_, randomBytes as randomBytes_, } from '@noble/hashes/utils.js';\n/**\n * Validates that a value is an array, optionally validating each element.\n * @param item - Value to validate.\n * @param title - Label included in thrown errors.\n * @param inner - Optional per-element validator, called with the element and its label.\n * @returns The validated array.\n * @example\n * Validate an array of points before batch processing.\n *\n * ```ts\n * aarray([1n, 2n], 'scalars');\n * ```\n */\nexport function aarray(item, title, inner = () => { }) {\n    if (!Array.isArray(item))\n        throw new TypeError(`\"${title}\" expected array, got type=${typeof item}`);\n    for (let i = 0; i < item.length; i++)\n        inner(item[i], `${title}[${i}]`);\n    return item;\n}\n/**\n * Validates that a value is a byte array.\n * @param value - Value to validate.\n * @param length - Optional exact byte length.\n * @param title - Optional field name.\n * @returns Original byte array.\n * @example\n * Reject non-byte input before passing data into curve code.\n *\n * ```ts\n * abytes(new Uint8Array(1));\n * ```\n */\nexport const abytes = (value, length, title) => abytes_(value, length, title);\n/**\n * Validates that a value is a non-negative safe integer.\n * @param n - Value to validate.\n * @param title - Optional field name.\n * @returns The validated number.\n * @example\n * Validate a numeric length before allocating buffers.\n *\n * ```ts\n * anumber(1);\n * ```\n */\nexport const anumber = anumber_;\n/**\n * Asserts something is a string.\n * @param value - Value to validate.\n * @param title - Label included in thrown errors.\n * @returns The validated string.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Validate a label string.\n *\n * ```ts\n * astring('example', 'label');\n * ```\n */\nexport function astring(value, title = '') {\n    if (typeof value !== 'string') {\n        const prefix = title && `\"${title}\" `;\n        throw new TypeError(prefix + 'expected string, got type=' + typeof value);\n    }\n    return value;\n}\n/**\n * Asserts something is a plain object-ish value, not null or array.\n * @param value - Value to validate.\n * @param title - Label included in thrown errors.\n * @returns The validated object.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Validate an options object before checking fields.\n *\n * ```ts\n * aobject({ flag: true });\n * ```\n */\nexport function aobject(value, title = 'object') {\n    if (value === null || typeof value !== 'object' || Array.isArray(value))\n        throw new TypeError(title === 'object'\n            ? 'expected valid options object'\n            : `\"${title}\" expected object, got type=${typeof value}`);\n    return value;\n}\n/**\n * Asserts something is a function.\n * @param value - Value to validate.\n * @param title - Label included in thrown errors.\n * @returns The validated function.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Validate a required method before calling it.\n *\n * ```ts\n * afunction(() => true, 'predicate');\n * ```\n */\nexport function afunction(value, title) {\n    if (typeof value !== 'function')\n        throw new TypeError(`\"${title}\" is invalid: expected function, got ${typeof value}`);\n    return value;\n}\n/**\n * Encodes bytes as lowercase hex.\n * @param bytes - Bytes to encode.\n * @returns Lowercase hex string.\n * @example\n * Serialize bytes as hex for logging or fixtures.\n *\n * ```ts\n * bytesToHex(Uint8Array.of(1, 2, 3));\n * ```\n */\nexport const bytesToHex = bytesToHex_;\n/**\n * Concatenates byte arrays.\n * @param arrays - Byte arrays to join.\n * @returns Concatenated bytes.\n * @example\n * Join domain-separated chunks into one buffer.\n *\n * ```ts\n * concatBytes(Uint8Array.of(1), Uint8Array.of(2));\n * ```\n */\nexport const concatBytes = (...arrays) => concatBytes_(...arrays);\n/**\n * Decodes lowercase or uppercase hex into bytes.\n * @param hex - Hex string to decode.\n * @returns Decoded bytes.\n * @example\n * Parse fixture hex into bytes before hashing.\n *\n * ```ts\n * hexToBytes('0102');\n * ```\n */\nexport const hexToBytes = (hex) => hexToBytes_(hex);\n/**\n * Checks whether a value is a Uint8Array.\n * @param a - Value to inspect.\n * @returns `true` when `a` is a Uint8Array.\n * @example\n * Branch on byte input before decoding it.\n *\n * ```ts\n * isBytes(new Uint8Array(1));\n * ```\n */\nexport const isBytes = isBytes_;\n/**\n * Reads random bytes from the platform CSPRNG.\n * @param bytesLength - Number of random bytes to read.\n * @returns Fresh random bytes.\n * @example\n * Generate a random seed for a keypair.\n *\n * ```ts\n * randomBytes(2);\n * ```\n */\nexport const randomBytes = (bytesLength) => randomBytes_(bytesLength);\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\n// Shared error-message prefix builder. Only called on throw paths, so assert\n// success paths never pay for the string concatenation.\nconst atitle = (title) => (title ? `\"${title}\" ` : '');\n/**\n * Validates that a flag is boolean.\n * @param value - Value to validate.\n * @param title - Optional field name.\n * @returns Original value.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Reject non-boolean option flags early.\n *\n * ```ts\n * abool(true);\n * ```\n */\nexport function abool(value, title = '') {\n    if (typeof value !== 'boolean')\n        throw new TypeError(atitle(title) + 'expected boolean, got type=' + typeof value);\n    return value;\n}\n/**\n * Validates that a value is a non-negative bigint or safe integer.\n * @param n - Value to validate.\n * @returns The same validated value.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validate one integer-like value before serializing it.\n *\n * ```ts\n * abignumber(1n);\n * ```\n */\nexport function abignumber(n) {\n    if (typeof n === 'bigint') {\n        if (!isPosBig(n))\n            throw new RangeError('positive bigint expected, got ' + n);\n    }\n    else\n        anumber(n);\n    return n;\n}\n/**\n * Validates that a value is a safe integer.\n * @param value - Integer to validate.\n * @param title - Optional field name.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validate a window size before scalar arithmetic uses it.\n *\n * ```ts\n * asafenumber(1);\n * ```\n */\nexport function asafenumber(value, title = '') {\n    if (typeof value !== 'number') {\n        const prefix = title && `\"${title}\" `;\n        throw new TypeError(prefix + 'expected number, got type=' + typeof value);\n    }\n    if (!Number.isSafeInteger(value)) {\n        const prefix = title && `\"${title}\" `;\n        throw new RangeError(prefix + 'expected safe integer, got ' + value);\n    }\n}\n/**\n * Encodes a bigint into even-length big-endian hex.\n * The historical \"unpadded\" name only means \"no fixed-width field padding\"; odd-length hex still\n * gets one leading zero nibble so the result always represents whole bytes.\n * @param num - Number to encode.\n * @returns Big-endian hex string.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Encode a scalar into hex without a `0x` prefix.\n *\n * ```ts\n * numberToHexUnpadded(255n);\n * ```\n */\nexport function numberToHexUnpadded(num) {\n    const hex = abignumber(num).toString(16);\n    return hex.length & 1 ? '0' + hex : hex;\n}\n/**\n * Parses a big-endian hex string into bigint.\n * Accepts odd-length hex through the native `BigInt('0x' + hex)` parser and currently surfaces the\n * same native `SyntaxError` for malformed hex instead of wrapping it in a library-specific error.\n * @param hex - Hex string without `0x`.\n * @returns Parsed bigint value.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Parse a scalar from fixture hex.\n *\n * ```ts\n * hexToNumber('ff');\n * ```\n */\nexport function hexToNumber(hex) {\n    if (typeof hex !== 'string')\n        throw new TypeError('hex string expected, got ' + typeof hex);\n    return hex === '' ? _0n : BigInt('0x' + hex); // Big Endian\n}\n// BE: Big Endian, LE: Little Endian\n/**\n * Parses big-endian bytes into bigint.\n * @param bytes - Bytes in big-endian order.\n * @returns Parsed bigint value.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Read a scalar encoded in network byte order.\n *\n * ```ts\n * bytesToNumberBE(Uint8Array.of(1, 0));\n * ```\n */\nexport function bytesToNumberBE(bytes) {\n    return hexToNumber(bytesToHex_(bytes));\n}\n/**\n * Parses little-endian bytes into bigint.\n * @param bytes - Bytes in little-endian order.\n * @returns Parsed bigint value.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Read a scalar encoded in little-endian form.\n *\n * ```ts\n * bytesToNumberLE(Uint8Array.of(1, 0));\n * ```\n */\nexport function bytesToNumberLE(bytes) {\n    return hexToNumber(bytesToHex_(copyBytes(abytes_(bytes)).reverse()));\n}\n/**\n * Encodes a bigint into fixed-length big-endian bytes.\n * @param n - Number to encode.\n * @param len - Output length in bytes. Must be greater than zero.\n * @returns Big-endian byte array.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @throws If a documented runtime validation or state check fails. {@link Error}\n * @example\n * Serialize a scalar into a 32-byte field element.\n *\n * ```ts\n * numberToBytesBE(255n, 2);\n * ```\n */\nexport function numberToBytesBE(n, len) {\n    anumber_(len);\n    if (len === 0)\n        throw new Error('zero output length is invalid');\n    n = abignumber(n);\n    const expectedLen = len * 2;\n    const hex = n.toString(16);\n    // Detect overflow before hex parsing so oversized values don't leak the shared odd-hex error.\n    if (hex.length > expectedLen)\n        throw new RangeError('number is too large');\n    return hexToBytes_(hex.padStart(expectedLen, '0'));\n}\n/**\n * Encodes a bigint into fixed-length little-endian bytes.\n * @param n - Number to encode.\n * @param len - Output length in bytes.\n * @returns Little-endian byte array.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @throws If a documented runtime validation or state check fails. {@link Error}\n * @example\n * Serialize a scalar for little-endian protocols.\n *\n * ```ts\n * numberToBytesLE(255n, 2);\n * ```\n */\nexport function numberToBytesLE(n, len) {\n    return numberToBytesBE(n, len).reverse();\n}\n// Unpadded, rarely used\n/**\n * Encodes a bigint into variable-length big-endian bytes.\n * @param n - Number to encode.\n * @returns Variable-length big-endian bytes.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Serialize a bigint without fixed-width padding.\n *\n * ```ts\n * numberToVarBytesBE(255n);\n * ```\n */\nexport function numberToVarBytesBE(n) {\n    return hexToBytes_(numberToHexUnpadded(abignumber(n)));\n}\n// Compares 2 u8a-s in kinda constant time\n/**\n * Compares two byte arrays in constant-ish time.\n * @param a - Left byte array.\n * @param b - Right byte array.\n * @returns `true` when bytes match.\n * @example\n * Compare two encoded points without early exit.\n *\n * ```ts\n * equalBytes(Uint8Array.of(1), Uint8Array.of(1));\n * ```\n */\nexport function equalBytes(a, b) {\n    a = abytes(a);\n    b = abytes(b);\n    if (a.length !== b.length)\n        return false;\n    let diff = 0;\n    for (let i = 0; i < a.length; i++)\n        diff |= a[i] ^ b[i];\n    return diff === 0;\n}\n/**\n * Copies Uint8Array. We can't use u8a.slice(), because u8a can be Buffer,\n * and Buffer#slice creates mutable copy. Never use Buffers!\n * @param bytes - Bytes to copy.\n * @returns Detached copy.\n * @example\n * Make an isolated copy before mutating serialized bytes.\n *\n * ```ts\n * copyBytes(Uint8Array.of(1, 2, 3));\n * ```\n */\nexport function copyBytes(bytes) {\n    // `Uint8Array.from(...)` would also accept arrays / other typed arrays. Keep this helper strict\n    // because callers use it at byte-validation boundaries before mutating the detached copy.\n    return Uint8Array.from(abytes(bytes));\n}\n/**\n * Decodes 7-bit ASCII string to Uint8Array, throws on non-ascii symbols\n * Should be safe to use for things expected to be ASCII.\n * Returns exact same result as `TextEncoder` for ASCII or throws.\n * @param ascii - ASCII input text.\n * @returns Encoded bytes.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Encode an ASCII domain-separation tag.\n *\n * ```ts\n * asciiToBytes('ABC');\n * ```\n */\nexport function asciiToBytes(ascii) {\n    if (typeof ascii !== 'string')\n        throw new TypeError('ascii string expected, got ' + typeof ascii);\n    return Uint8Array.from(ascii, (c, i) => {\n        const charCode = c.charCodeAt(0);\n        if (c.length !== 1 || charCode > 127) {\n            throw new RangeError(`string contains non-ASCII character \"${ascii[i]}\" with code ${charCode} at position ${i}`);\n        }\n        return charCode;\n    });\n}\n/**\n * Checks whether n is non-negative bigint. Historical name.\n * @param n - candidate value\n * @returns `true` when the value is bigint and 0 or larger\n * @example\n * Check a candidate scalar before range validation.\n *\n * ```ts\n * isPosBig(2n);\n * ```\n */\nexport function isPosBig(n) {\n    return typeof n === 'bigint' && _0n <= n;\n}\n/**\n * Checks whether a bigint lies inside a half-open range.\n * @param n - Candidate value.\n * @param min - Inclusive lower bound.\n * @param max - Exclusive upper bound.\n * @returns `true` when the value is inside the range.\n * @example\n * Check whether a candidate scalar fits the field order.\n *\n * ```ts\n * inRange(2n, 1n, 3n);\n * ```\n */\nexport function inRange(n, min, max) {\n    return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;\n}\n/**\n * Asserts `min <= n < max`. NOTE: upper bound is exclusive.\n * @param title - Value label for error messages.\n * @param n - Candidate value.\n * @param min - Inclusive lower bound.\n * @param max - Exclusive upper bound.\n * Wrong-type inputs are not separated from out-of-range values here: they still flow through the\n * shared `RangeError` path because this is only a throwing wrapper around `inRange(...)`.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Assert that a bigint stays within one half-open range.\n *\n * ```ts\n * aInRange('x', 2n, 1n, 256n);\n * ```\n */\nexport function aInRange(title, n, min, max) {\n    // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)?\n    // consider P=256n, min=0n, max=P\n    // - a for min=0 would require -1:          `inRange('x', x, -1n, P)`\n    // - b would commonly require subtraction:  `inRange('x', x, 0n, P - 1n)`\n    // - our way is the cleanest:               `inRange('x', x, 0n, P)\n    if (!inRange(n, min, max))\n        throw new RangeError('expected valid ' + title + ': ' + min + ' <= n < ' + max + ', got ' + n);\n}\n// Bit operations\n/**\n * Calculates amount of bits in a bigint.\n * Same as `n.toString(2).length`\n * TODO: merge with nLength in modular\n * @param n - Value to inspect.\n * @returns Bit length.\n * @throws If the value is negative. {@link Error}\n * @example\n * Measure the bit length of a scalar before serialization.\n *\n * ```ts\n * bitLen(8n);\n * ```\n */\nexport function bitLen(n) {\n    // Size callers in this repo only use non-negative orders / scalars, so negative inputs are a\n    // contract bug and must not silently collapse to zero bits.\n    if (n < _0n)\n        throw new Error('expected non-negative bigint, got ' + n);\n    // Native radix conversion beats a shift loop at every size, and the loop is quadratic in bits.\n    return n === _0n ? 0 : n.toString(2).length;\n}\n/**\n * Gets single bit at position.\n * NOTE: first bit position is 0 (same as arrays)\n * Same as `!!+Array.from(n.toString(2)).reverse()[pos]`\n * @param n - Source value.\n * @param pos - Bit position. Negative positions are passed through to raw\n *   bigint shift semantics; because the mask is built as `1n << pos`,\n *   they currently collapse to `0n` and make the helper a no-op.\n * @returns Bit as bigint.\n * @example\n * Gets single bit at position.\n *\n * ```ts\n * bitGet(5n, 0);\n * ```\n */\nexport function bitGet(n, pos) {\n    if (typeof n !== 'bigint')\n        throw new TypeError('\"n\" expected bigint, got type=' + typeof n);\n    asafenumber(pos, 'pos');\n    return (n >> BigInt(pos)) & _1n;\n}\n/**\n * Sets single bit at position.\n * @param n - Source value.\n * @param pos - Bit position. Negative positions are passed through to raw bigint shift semantics,\n *   so they currently behave like left shifts.\n * @param value - Whether the bit should be set.\n * @returns Updated bigint.\n * @example\n * Sets single bit at position.\n *\n * ```ts\n * bitSet(0n, 1, true);\n * ```\n */\nexport function bitSet(n, pos, value) {\n    if (typeof n !== 'bigint')\n        throw new TypeError('\"n\" expected bigint, got type=' + typeof n);\n    asafenumber(pos, 'pos');\n    abool(value, 'value');\n    const mask = _1n << BigInt(pos);\n    // Clearing needs AND-not here; OR with zero leaves an already-set bit untouched.\n    return value ? n | mask : n & ~mask;\n}\n/**\n * Calculate mask for N bits. Not using ** operator with bigints because of old engines.\n * Same as BigInt(`0b${Array(i).fill('1').join('')}`)\n * @param n - Number of bits. Negative widths are currently passed through to raw bigint shift\n *   semantics and therefore produce `-1n`.\n * @returns Bitmask value.\n * @example\n * Calculate mask for N bits.\n *\n * ```ts\n * bitMask(4);\n * ```\n */\nexport const bitMask = (n) => {\n    asafenumber(n, 'n');\n    return (_1n << BigInt(n)) - _1n;\n};\n/**\n * Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n * @param hashLen - Hash output size in bytes. Callers are expected to pass a positive length; `0`\n *   is not rejected here and would make the internal generate loop non-progressing.\n * @param qByteLen - Requested output size in bytes. Callers are expected to pass a positive length.\n * @param hmacFn - HMAC implementation.\n * @returns Function that will call DRBG until the predicate returns anything\n *   other than `undefined`.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Build a deterministic nonce generator for RFC6979-style signing.\n *\n * ```ts\n * import { createHmacDrbg } from '@noble/curves/utils.js';\n * import { hmac } from '@noble/hashes/hmac.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const hmacFn = (key: Uint8Array, msg: Uint8Array) => hmac(sha256, key, msg);\n * const drbg = createHmacDrbg(32, 32, hmacFn);\n * const seed = new Uint8Array(32);\n * drbg(seed, (bytes) => bytes);\n * ```\n */\nexport function createHmacDrbg(hashLen, qByteLen, hmacFn) {\n    anumber_(hashLen, 'hashLen');\n    anumber_(qByteLen, 'qByteLen');\n    if (typeof hmacFn !== 'function')\n        throw new TypeError('hmacFn must be a function');\n    // creates Uint8Array\n    const u8n = (len) => new Uint8Array(len);\n    const NULL = Uint8Array.of();\n    const byte0 = Uint8Array.of(0x00);\n    const byte1 = Uint8Array.of(0x01);\n    const _maxDrbgIters = 1000;\n    // Step B, Step C: set hashLen to 8*ceil(hlen/8).\n    // Minimal non-full-spec HMAC-DRBG from NIST 800-90 for RFC6979 signatures.\n    let v = u8n(hashLen);\n    // Steps B and C of RFC6979 3.2.\n    let k = u8n(hashLen);\n    let i = 0; // Iterations counter, will throw when over 1000\n    const reset = () => {\n        v.fill(1);\n        k.fill(0);\n        i = 0;\n    };\n    // hmac(k)(v, ...values)\n    const h = (...msgs) => hmacFn(k, concatBytes(v, ...msgs));\n    const reseed = (seed = NULL) => {\n        // HMAC-DRBG reseed() function. Steps D-G\n        k = h(byte0, seed); // k = hmac(k || v || 0x00 || seed)\n        v = h(); // v = hmac(k || v)\n        if (seed.length === 0)\n            return;\n        k = h(byte1, seed); // k = hmac(k || v || 0x01 || seed)\n        v = h(); // v = hmac(k || v)\n    };\n    const gen = () => {\n        // HMAC-DRBG generate() function\n        if (i++ >= _maxDrbgIters)\n            throw new Error('drbg: tried max amount of iterations');\n        let len = 0;\n        const out = [];\n        while (len < qByteLen) {\n            v = h();\n            const sl = v.slice();\n            out.push(sl);\n            len += v.length;\n        }\n        return concatBytes(...out);\n    };\n    const genUntil = (seed, pred) => {\n        reset();\n        reseed(seed); // Steps D-G\n        let res = undefined; // Step H: grind until the predicate accepts a candidate.\n        // Falsy values like 0 are valid outputs.\n        while ((res = pred(gen())) === undefined)\n            reseed();\n        reset();\n        return res;\n    };\n    return genUntil;\n}\n/**\n * Validates declared required and optional field types on a plain object.\n * Extra keys are intentionally ignored because many callers validate only the subset they use from\n * richer option bags or runtime objects.\n * This walks field schemas and formats detailed errors, so avoid it on hot paths; use direct\n * one-line guards such as `aobject()`, `afunction()`, `abool()`, or `asafenumber()` instead.\n * @param object - Object to validate.\n * @param fields - Required field types.\n * @param optFields - Optional field types.\n * @param title - Object label included in thrown errors.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Check user options before building a curve helper.\n *\n * ```ts\n * validateObject({ flag: true }, { flag: 'boolean' });\n * ```\n */\nexport function validateObject(object, fields = {}, optFields = {}, title = 'object') {\n    aobject(object, title);\n    aobject(fields, 'fields');\n    aobject(optFields, 'optFields');\n    function checkField(fieldName, expectedType, isOpt) {\n        const label = title === 'object' ? `param \"${String(fieldName)}\"` : `\"${title}.${String(fieldName)}\"`;\n        // Config fields must be explicit own properties. Optional inherited values are rejected too\n        // because callers keep reading the same options object after validation.\n        const val = object[fieldName];\n        // Runtime objects such as Field instances intentionally satisfy required method slots\n        // via their shared prototype.\n        if (!Object.hasOwn(object, fieldName) &&\n            (isOpt ? val !== undefined : expectedType !== 'function')) {\n            throw new TypeError(`${label} is invalid: expected own property`);\n        }\n        if (isOpt && val === undefined)\n            return;\n        const current = typeof val;\n        if (current !== expectedType || val === null)\n            throw new TypeError(`${label} is invalid: expected ${expectedType}, got ${current}`);\n    }\n    const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));\n    iter(fields, false);\n    iter(optFields, true);\n}\n/**\n * Throws not implemented error.\n * @returns Never returns.\n * @throws If the unfinished code path is reached. {@link Error}\n * @example\n * Surface the placeholder error from an unfinished code path.\n *\n * ```ts\n * try {\n *   notImplemented();\n * } catch {}\n * ```\n */\nexport const notImplemented = () => {\n    throw new Error('not implemented');\n};\n","/**\n * Utils for modular division and fields.\n * Field over 11 is a finite (Galois) field is integer number operations `mod 11`.\n * There is no division: it is replaced by modular multiplicative inverse.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { aarray, abool, abytes, afunction, anumber, aobject, asafenumber, bitLen, bytesToNumberBE, bytesToNumberLE, numberToBytesBE, numberToBytesLE, } from \"../utils.js\";\n// Numbers aren't used in x25519 / x448 builds\n// prettier-ignore\nconst _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2);\n// prettier-ignore\nconst _3n = /* @__PURE__ */ BigInt(3), _4n = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5);\n// prettier-ignore\nconst _7n = /* @__PURE__ */ BigInt(7), _8n = /* @__PURE__ */ BigInt(8), _9n = /* @__PURE__ */ BigInt(9);\nconst _15n = /* @__PURE__ */ BigInt(15), _16n = /* @__PURE__ */ BigInt(16);\n// 2^64: exponents below this use plain square-and-multiply in pow()/FpPow(); the windowed path's\n// table build (14 multiplications) only pays off for longer exponents (break-even ~50 bits).\nconst POW_WINDOWED_MIN = /* @__PURE__ */ BigInt('0x10000000000000000');\n/**\n * @param a - Dividend value.\n * @param b - Positive modulus.\n * @returns Reduced value in `[0, b)` only when `b` is positive.\n * @throws If the modulus is not positive. {@link Error}\n * @example\n * Normalize a bigint into one field residue.\n *\n * ```ts\n * mod(-1n, 5n);\n * ```\n */\nexport function mod(a, b) {\n    if (b <= _0n)\n        throw new Error('mod: expected positive modulus, got ' + b);\n    const result = a % b;\n    return result >= _0n ? result : b + result;\n}\n/**\n * Efficiently raise num to a power with modular reduction.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * Low-level helper: callers that need canonical residues must pass a valid `num` for the chosen\n * modulus instead of relying on the `power===0/1` fast paths to normalize it.\n * @param num - Base value.\n * @param power - Exponent value.\n * @param modulo - Reduction modulus.\n * @returns Modular exponentiation result.\n * @throws If the modulus or exponent is invalid. {@link Error}\n * @example\n * Raise one bigint to a modular power.\n *\n * ```ts\n * pow(2n, 6n, 11n) // 64n % 11n == 9n\n * ```\n */\nexport function pow(num, power, modulo) {\n    if (modulo <= _1n)\n        throw new Error('pow: expected modulus > 1, got ' + modulo);\n    // Non-bigint exponents coerce every comparison below to false and would silently return 1.\n    if (typeof power !== 'bigint')\n        throw new TypeError('invalid exponent: expected bigint, got ' + typeof power);\n    if (power < _0n)\n        throw new Error('invalid exponent, negatives unsupported');\n    if (power === _0n)\n        return _1n;\n    if (power === _1n)\n        return num;\n    let d = num % modulo;\n    if (d < _0n)\n        d += modulo;\n    // Control flow in both branches below depends only on the exponent, never on `num` — invertCt()\n    // relies on that for its (public-exponent) secret-independence guarantee.\n    if (power < POW_WINDOWED_MIN) {\n        // Square-and-multiply: cheaper than the windowed path for short exponents.\n        let p = _1n;\n        while (power > _0n) {\n            if (power & _1n)\n                p = (p * d) % modulo;\n            d = (d * d) % modulo;\n            power >>= _1n;\n        }\n        return p;\n    }\n    // Fixed 4-bit windows, MSB-first: a 14-multiplication table drops per-window cost to <1\n    // multiplication (vs ~2 per window for square-and-multiply), ~25-30% faster for the dense\n    // 256-bit exponents of sqrt / Legendre / invertCt.\n    const digits = [];\n    while (power > _0n) {\n        digits.push(Number(power & _15n));\n        power >>= _4n;\n    }\n    const table = new Array(16);\n    table[0] = _1n;\n    table[1] = d;\n    for (let i = 2; i < 16; i++)\n        table[i] = (table[i - 1] * d) % modulo;\n    let p = table[digits[digits.length - 1]]; // top digit is nonzero: the loop above stops on 0\n    for (let w = digits.length - 2; w >= 0; w--) {\n        p = (p * p) % modulo;\n        p = (p * p) % modulo;\n        p = (p * p) % modulo;\n        p = (p * p) % modulo;\n        const digit = digits[w];\n        if (digit !== 0)\n            p = (p * table[digit]) % modulo;\n    }\n    return p;\n}\n/**\n * Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)`.\n * Low-level helper: callers that need canonical residues must pass a valid `x` for the chosen\n * modulus; the `power===0` fast path intentionally returns the input unchanged.\n * @param x - Base value.\n * @param power - Number of squarings.\n * @param modulo - Reduction modulus.\n * @returns Repeated-squaring result.\n * @throws If the exponent is negative. {@link Error}\n * @example\n * Apply repeated squaring inside one field.\n *\n * ```ts\n * pow2(3n, 2n, 11n);\n * ```\n */\nexport function pow2(x, power, modulo) {\n    if (modulo <= _1n)\n        throw new Error('pow2: expected modulus > 1, got ' + modulo);\n    if (power < _0n)\n        throw new Error('pow2: expected non-negative exponent, got ' + power);\n    let res = x;\n    while (power-- > _0n) {\n        res *= res;\n        res %= modulo;\n    }\n    return res;\n}\n/**\n * Inverses number over modulo.\n * Implemented using the {@link https://brilliant.org/wiki/extended-euclidean-algorithm/ | extended Euclidean algorithm}.\n * @param number - Value to invert.\n * @param modulo - Modulus greater than 1.\n * @returns Multiplicative inverse.\n * @throws If the modulus is invalid or the inverse does not exist. {@link Error}\n * @example\n * Compute one modular inverse with the extended Euclidean algorithm.\n *\n * ```ts\n * invert(3n, 11n);\n * ```\n */\nexport function invert(number, modulo) {\n    if (number === _0n)\n        throw new Error('invert: expected non-zero number');\n    // modulo = 1 is the zero ring: gcd(x, 1) = 1 makes the loop below \"succeed\" and return the\n    // useless inverse 0. Reject it like pow() and invertCt() do.\n    if (modulo <= _1n)\n        throw new Error('invert: expected modulus > 1, got ' + modulo);\n    // This is variable-time: the loop count depends on `number`. For a secret-independent\n    // (Fermat) alternative over a prime modulus, see {@link invertCt} (~4x slower).\n    let a = mod(number, modulo);\n    let b = modulo;\n    // Only the Bézout coefficient of `number` (x/u chain) is tracked; the coefficient of `modulo`\n    // never affects the output, so it is not computed.\n    // prettier-ignore\n    let x = _0n, u = _1n;\n    while (a !== _0n) {\n        const q = b / a;\n        const r = b - a * q;\n        const m = x - u * q;\n        // prettier-ignore\n        b = a, a = r, x = u, u = m;\n    }\n    const gcd = b;\n    if (gcd !== _1n)\n        throw new Error('invert: does not exist');\n    return mod(x, modulo);\n}\n/**\n * Inverses number over modulo using Fermat's little theorem: `a^(p-2) ≡ a⁻¹ (mod p)`.\n *\n * Unlike {@link invert} (extended Euclidean), the exponent `p-2` is a public constant, so the\n * underlying square-and-multiply has the same control flow for every secret `a`: there is no\n * data-dependent branching or loop count that could leak `a` through timing (e.g. Minerva-style\n * ECDSA nonce-inversion attacks). This is only \"algorithmically\" constant-time — JS bigint\n * multiplication/reduction is still value-dependent — and it is roughly 4x slower than\n * {@link invert}.\n *\n * REQUIRES a prime modulus; Fermat's theorem does not hold otherwise. The result is verified to be\n * a real inverse, so a non-prime modulus (or a non-invertible input) fails closed with an error\n * instead of returning a wrong value.\n * @param a - Value to invert.\n * @param prime - Prime modulus.\n * @returns Multiplicative inverse in `[1, prime)`.\n * @throws If the modulus is below 2, the input reduces to zero, or the inverse does not exist.\n *   {@link Error}\n * @example\n * Compute one modular inverse without secret-dependent branching.\n *\n * ```ts\n * invertCt(3n, 11n); // 4n, since 3 * 4 = 12 ≡ 1 (mod 11)\n * ```\n */\nexport function invertCt(a, prime) {\n    if (prime <= _1n)\n        throw new Error('invertCt: expected prime modulus > 1, got ' + prime);\n    const an = mod(a, prime);\n    if (an === _0n)\n        throw new Error('invertCt: expected non-zero number');\n    // Exponent (prime - 2) is public, so FpPow's square-and-multiply is secret-independent.\n    const inverse = pow(an, prime - _2n, prime);\n    // O(1) safety net: verifies the inverse and rejects composite moduli where a^(p-2) is not one.\n    if (mod(an * inverse, prime) !== _1n)\n        throw new Error('invertCt: does not exist');\n    return inverse;\n}\nfunction assertIsSquare(Fp, root, n) {\n    const F = Fp;\n    if (!F.eql(F.sqr(root), n))\n        throw new Error('Cannot find square root');\n}\n// The Legendre symbol and every sqrt variant here are only defined over an odd (prime) modulus.\n// An even ORDER makes their integer divisions — (p-1)/2, (p+1)/4, (p-5)/8, (p+7)/16 — truncate and\n// silently return a wrong result, so reject it explicitly at the entry points instead. This is a\n// cheap necessary-condition check, not a primality test (composite odd moduli are caught later by\n// the Legendre-result / assertIsSquare checks).\nfunction aoddModulus(order, fnName) {\n    if ((order & _1n) === _0n)\n        throw new Error(fnName + ': expected odd modulus, got ' + order);\n}\n// Not all roots are possible! Example which will throw:\n// const NUM =\n// n = 72057594037927816n;\n// Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'));\nfunction sqrt3mod4(Fp, n) {\n    const F = Fp;\n    const p1div4 = (F.ORDER + _1n) / _4n;\n    const root = F.pow(n, p1div4);\n    assertIsSquare(F, root, n);\n    return root;\n}\n// Equivalent `q = 5 (mod 8)` square-root formula (Atkin-style), not the RFC Appendix I.2 CMOV\n// pseudocode verbatim.\nfunction sqrt5mod8(Fp, n) {\n    const F = Fp;\n    const p5div8 = (F.ORDER - _5n) / _8n;\n    const n2 = F.mul(n, _2n);\n    const v = F.pow(n2, p5div8);\n    const nv = F.mul(n, v);\n    const i = F.mul(F.mul(nv, _2n), v);\n    const root = F.mul(nv, F.sub(i, F.ONE));\n    assertIsSquare(F, root, n);\n    return root;\n}\n// Based on RFC9380, Kong algorithm\n// prettier-ignore\nfunction sqrt9mod16(P) {\n    const Fp_ = Field(P);\n    const tn = tonelliShanks(P);\n    const c1 = tn(Fp_, Fp_.neg(Fp_.ONE)); //  1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F\n    const c2 = tn(Fp_, c1); //  2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F\n    const c3 = tn(Fp_, Fp_.neg(c1)); //  3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F\n    const c4 = (P + _7n) / _16n; //  4. c4 = (q + 7) / 16        # Integer arithmetic\n    return ((Fp, n) => {\n        const F = Fp;\n        let tv1 = F.pow(n, c4); //  1. tv1 = x^c4\n        let tv2 = F.mul(tv1, c1); //  2. tv2 = c1 * tv1\n        const tv3 = F.mul(tv1, c2); //  3. tv3 = c2 * tv1\n        const tv4 = F.mul(tv1, c3); //  4. tv4 = c3 * tv1\n        const e1 = F.eql(F.sqr(tv2), n); //  5.  e1 = (tv2^2) == x\n        const e2 = F.eql(F.sqr(tv3), n); //  6.  e2 = (tv3^2) == x\n        tv1 = F.cmov(tv1, tv2, e1); //  7. tv1 = CMOV(tv1, tv2, e1)  # Select tv2 if (tv2^2) == x\n        tv2 = F.cmov(tv4, tv3, e2); //  8. tv2 = CMOV(tv4, tv3, e2)  # Select tv3 if (tv3^2) == x\n        const e3 = F.eql(F.sqr(tv2), n); //  9.  e3 = (tv2^2) == x\n        const root = F.cmov(tv1, tv2, e3); // 10.  z = CMOV(tv1, tv2, e3)   # Select sqrt from tv1 & tv2\n        assertIsSquare(F, root, n);\n        return root;\n    });\n}\n/**\n * Tonelli-Shanks square root search algorithm.\n * This implementation is variable-time: it searches data-dependently for the first non-residue `Z`\n * and for the smallest `i` in the main loop, unlike RFC 9380 Appendix I.4's constant-time shape.\n * 1. {@link https://eprint.iacr.org/2012/685.pdf | eprint 2012/685}, page 12\n * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks\n * @param P - field order\n * @returns function that takes field Fp (created from P) and number n\n * @throws If the field is too small, non-prime, or the square root does not exist. {@link Error}\n * @example\n * Construct a square-root helper for primes that need Tonelli-Shanks.\n *\n * ```ts\n * import { Field, tonelliShanks } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const sqrt = tonelliShanks(17n)(Fp, 4n);\n * ```\n */\nexport function tonelliShanks(P) {\n    // Initialization (precomputation).\n    // Caching initialization could boost perf by 7%.\n    if (P < _3n)\n        throw new Error('sqrt is not defined for small field');\n    aoddModulus(P, 'tonelliShanks');\n    // Factor P - 1 = Q * 2^S, where Q is odd\n    let Q = P - _1n;\n    let S = 0;\n    while (Q % _2n === _0n) {\n        Q /= _2n;\n        S++;\n    }\n    // Find the first quadratic non-residue Z >= 2\n    let Z = _2n;\n    const _Fp = Field(P);\n    while (FpLegendre(_Fp, Z) === 1) {\n        // Basic primality test for P. After x iterations, chance of\n        // not finding quadratic non-residue is 2^x, so 2^1000.\n        if (Z++ > 1000)\n            throw new Error('Cannot find square root: probably non-prime P');\n    }\n    // Fast-path; usually done before Z, but we do \"primality test\".\n    if (S === 1)\n        return sqrt3mod4;\n    // Slow-path\n    // TODO: test on Fp2 and others\n    let cc = _Fp.pow(Z, Q); // c = z^Q\n    const Q1div2 = (Q + _1n) / _2n;\n    return function tonelliSlow(Fp, n) {\n        const F = Fp;\n        if (F.is0(n))\n            return n;\n        // Check if n is a quadratic residue using Legendre symbol\n        if (FpLegendre(F, n) !== 1)\n            throw new Error('Cannot find square root');\n        // Initialize variables for the main loop\n        let M = S;\n        let c = F.mul(F.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp\n        let t = F.pow(n, Q); // t = n^Q, first guess at the fudge factor\n        let R = F.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root\n        // Main loop\n        // while t != 1\n        while (!F.eql(t, F.ONE)) {\n            // Unreachable over a genuine field (no zero divisors; n=0 already returned above). A zero t\n            // means composite ORDER, where a fabricated root would be wrong: fail closed instead.\n            if (F.is0(t))\n                throw new Error('Cannot find square root: probably non-prime P');\n            let i = 1;\n            // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P)\n            let t_tmp = F.sqr(t); // t^(2^1)\n            while (!F.eql(t_tmp, F.ONE)) {\n                i++;\n                t_tmp = F.sqr(t_tmp); // t^(2^2)...\n                if (i === M)\n                    throw new Error('Cannot find square root');\n            }\n            // Calculate the exponent for b: 2^(M - i - 1)\n            const exponent = _1n << BigInt(M - i - 1); // bigint is important\n            const b = F.pow(c, exponent); // b = 2^(M - i - 1)\n            // Update variables\n            M = i;\n            c = F.sqr(b); // c = b^2\n            t = F.mul(t, c); // t = (t * b^2)\n            R = F.mul(R, b); // R = R*b\n        }\n        return R;\n    };\n}\n/**\n * Square root for a finite field. Will try optimized versions first:\n *\n * 1. P ≡ 3 (mod 4)\n * 2. P ≡ 5 (mod 8)\n * 3. P ≡ 9 (mod 16)\n * 4. Tonelli-Shanks algorithm\n *\n * Different algorithms can give different roots, it is up to user to decide which one they want.\n * For example there is FpSqrtOdd/FpSqrtEven to choose a root by oddness\n * (used for hash-to-curve).\n * @param P - Field order.\n * @returns Square-root helper. The generic fallback inherits Tonelli-Shanks' variable-time\n *   behavior and this selector assumes prime-field-style integer moduli.\n * @throws If the field is unsupported or the square root does not exist. {@link Error}\n * @example\n * Choose the square-root helper appropriate for one field modulus.\n *\n * ```ts\n * import { Field, FpSqrt } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const sqrt = FpSqrt(17n)(Fp, 4n);\n * ```\n */\nexport function FpSqrt(P) {\n    aoddModulus(P, 'Fp.sqrt');\n    // P ≡ 3 (mod 4) => √n = n^((P+1)/4)\n    if (P % _4n === _3n)\n        return sqrt3mod4;\n    // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf\n    if (P % _8n === _5n)\n        return sqrt5mod8;\n    // P ≡ 9 (mod 16) => Kong algorithm, page 11 of https://eprint.iacr.org/2012/685.pdf (algorithm 4)\n    if (P % _16n === _9n)\n        return sqrt9mod16(P);\n    // Tonelli-Shanks algorithm\n    return tonelliShanks(P);\n}\n/**\n * @param num - Value to inspect.\n * @param modulo - Field modulus.\n * @returns `true` when the least-significant little-endian bit is set.\n * @throws If the modulus is invalid for `mod(...)`. {@link Error}\n * @example\n * Inspect the low bit used by little-endian sign conventions.\n *\n * ```ts\n * isNegativeLE(3n, 11n);\n * ```\n */\nexport const isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n) === _1n;\n// prettier-ignore\n// Arithmetic-only subset checked by validateField(). This is intentionally not the full runtime\n// IField contract: helpers like `isValidNot0`, `invertBatch`, `toBytes`, `fromBytes`, `cmov`, and\n// field-specific extras like `isOdd` are left to the callers that actually need them.\nconst FIELD_FIELDS = [\n    'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',\n    'eql', 'add', 'sub', 'mul', 'pow', 'div',\n    'addN', 'subN', 'mulN', 'sqrN'\n];\n/**\n * @param field - Field implementation.\n * @returns Validated field. This only checks the arithmetic subset needed by generic helpers; it\n *   does not guarantee full runtime-method coverage for serialization, batching, `cmov`, or\n *   field-specific extras beyond positive `BYTES` / `BITS`.\n * @throws If the field shape or numeric metadata are invalid. {@link Error}\n * @example\n * Check that a field implementation exposes the operations curve code expects.\n *\n * ```ts\n * import { Field, validateField } from '@noble/curves/abstract/modular.js';\n * const Fp = validateField(Field(17n));\n * ```\n */\nexport function validateField(field) {\n    aobject(field, 'field');\n    if (typeof field.ORDER !== 'bigint')\n        throw new TypeError('param \"ORDER\" is invalid: expected bigint, got ' + typeof field.ORDER);\n    // Runtime field implementations must expose real integer byte/bit sizes; fractional / NaN /\n    // infinite metadata breaks encoders and caches.\n    asafenumber(field.BYTES, 'BYTES');\n    asafenumber(field.BITS, 'BITS');\n    for (const name of FIELD_FIELDS)\n        afunction(field[name], 'field.' + name);\n    // Runtime field implementations must expose positive byte/bit sizes; zero leaks through the\n    // numeric shape checks above but still breaks encoding helpers and cached-length assumptions.\n    if (field.BYTES < 1 || field.BITS < 1)\n        throw new Error('invalid field: expected BYTES/BITS > 0');\n    if (field.ORDER <= _1n)\n        throw new Error('invalid field: expected ORDER > 1, got ' + field.ORDER);\n    return field;\n}\n// Generic field functions\n/**\n * Same as `pow` but for Fp: non-constant-time.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * @param Fp - Field implementation.\n * @param num - Base value.\n * @param power - Exponent value.\n * @returns Powered field element.\n * @throws If the exponent is negative. {@link Error}\n * @example\n * Raise one field element to a public exponent.\n *\n * ```ts\n * import { Field, FpPow } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const x = FpPow(Fp, 3n, 5n);\n * ```\n */\nexport function FpPow(Fp, num, power) {\n    validateField(Fp);\n    const F = Fp;\n    // Non-bigint exponents (e.g. an accidental field element) coerce every comparison below to\n    // false and would silently return ONE.\n    if (typeof power !== 'bigint')\n        throw new TypeError('invalid exponent: expected bigint, got ' + typeof power);\n    if (power < _0n)\n        throw new Error('invalid exponent, negatives unsupported');\n    if (power === _0n)\n        return F.ONE;\n    if (power === _1n)\n        return num;\n    if (power < POW_WINDOWED_MIN) {\n        // Square-and-multiply: cheaper than the windowed path for short exponents (e.g. poseidon\n        // sbox x^5), which would waste the 14-multiplication table build.\n        let p = F.ONE;\n        let d = num;\n        while (power > _0n) {\n            if (power & _1n)\n                p = F.mul(p, d);\n            d = F.sqr(d);\n            power >>= _1n;\n        }\n        return p;\n    }\n    // Fixed 4-bit windows, MSB-first — same shape as pow() above, over generic field ops.\n    // Speeds up dense long exponents (extension-field sqrt / Legendre, e.g. Fp2 decompression).\n    const digits = [];\n    while (power > _0n) {\n        digits.push(Number(power & _15n));\n        power >>= _4n;\n    }\n    const table = new Array(16);\n    table[0] = F.ONE;\n    table[1] = num;\n    for (let i = 2; i < 16; i++)\n        table[i] = F.mul(table[i - 1], num);\n    let p = table[digits[digits.length - 1]]; // top digit is nonzero: the loop above stops on 0\n    for (let w = digits.length - 2; w >= 0; w--) {\n        p = F.sqr(F.sqr(F.sqr(F.sqr(p))));\n        const digit = digits[w];\n        if (digit !== 0)\n            p = F.mul(p, table[digit]);\n    }\n    return p;\n}\nexport function FpInvertBatch(Fp, nums, passZero = false) {\n    validateField(Fp);\n    aarray(nums, 'nums');\n    abool(passZero, 'passZero');\n    const F = Fp;\n    const inverted = new Array(nums.length).fill(passZero ? F.ZERO : undefined);\n    // Walk from first to last, multiply them by each other MOD p\n    const multipliedAcc = nums.reduce((acc, num, i) => {\n        if (F.is0(num))\n            return acc;\n        inverted[i] = acc;\n        return F.mul(acc, num);\n    }, F.ONE);\n    // Invert last element\n    const invertedAcc = F.inv(multipliedAcc);\n    // Walk from last to first, multiply them by inverted each other MOD p\n    nums.reduceRight((acc, num, i) => {\n        if (F.is0(num))\n            return acc;\n        // Non-zero `num` means the forward pass already stored a defined prefix product at index i.\n        inverted[i] = F.mul(acc, inverted[i]);\n        return F.mul(acc, num);\n    }, invertedAcc);\n    return inverted;\n}\n/**\n * @param Fp - Field implementation.\n * @param lhs - Dividend value.\n * @param rhs - Divisor value.\n * @returns Division result.\n * @throws If the divisor is non-invertible. {@link Error}\n * @example\n * Divide one field element by another.\n *\n * ```ts\n * import { Field, FpDiv } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const x = FpDiv(Fp, 6n, 3n);\n * ```\n */\nexport function FpDiv(Fp, lhs, rhs) {\n    validateField(Fp);\n    const F = Fp;\n    return F.mul(lhs, typeof rhs === 'bigint' ? invert(rhs, F.ORDER) : F.inv(rhs));\n}\n/**\n * Legendre symbol.\n * Legendre constant is used to calculate Legendre symbol (a | p)\n * which denotes the value of a^((p-1)/2) (mod p).\n *\n * * (a | p) ≡ 1    if a is a square (mod p), quadratic residue\n * * (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue\n * * (a | p) ≡ 0    if a ≡ 0 (mod p)\n * @param Fp - Field implementation.\n * @param n - Value to inspect.\n * @returns Legendre symbol.\n * @throws If the powered value does not match a valid Legendre symbol. {@link Error}\n * @example\n * Compute the Legendre symbol of one field element.\n *\n * ```ts\n * import { Field, FpLegendre } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const symbol = FpLegendre(Fp, 4n);\n * ```\n */\nexport function FpLegendre(Fp, n) {\n    validateField(Fp);\n    const F = Fp;\n    aoddModulus(F.ORDER, 'FpLegendre');\n    // We can use 3rd argument as optional cache of this value\n    // but seems unneeded for now. The operation is very fast.\n    const p1mod2 = (F.ORDER - _1n) / _2n;\n    const powered = F.pow(n, p1mod2);\n    const yes = F.eql(powered, F.ONE);\n    const zero = F.eql(powered, F.ZERO);\n    const no = F.eql(powered, F.neg(F.ONE));\n    if (!yes && !zero && !no)\n        throw new Error('invalid Legendre symbol result');\n    return yes ? 1 : zero ? 0 : -1;\n}\n/**\n * @param Fp - Field implementation.\n * @param n - Value to inspect.\n * @returns `true` when `Fp.sqrt(n)` exists. This includes `0`, even though strict \"quadratic\n *   residue\" terminology often reserves that name for the non-zero square class.\n * @throws If the field returns an invalid Legendre symbol value. {@link Error}\n * @example\n * Check whether one field element has a square root in the field.\n *\n * ```ts\n * import { Field, FpIsSquare } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const isSquare = FpIsSquare(Fp, 4n);\n * ```\n */\nexport function FpIsSquare(Fp, n) {\n    const l = FpLegendre(Fp, n);\n    // Zero is a square too: 0 = 0^2, and Fp.sqrt(0) already returns 0.\n    return l !== -1;\n}\n/**\n * @param n - Curve order. Callers are expected to pass a positive order.\n * @param nBitLength - Optional cached bit length. Callers are expected to pass a positive cached\n *   value when overriding the derived bit length.\n * @returns Byte and bit lengths.\n * @throws If the order or cached bit length is invalid. {@link Error}\n * @example\n * Measure the encoding sizes needed for one modulus.\n *\n * ```ts\n * nLength(255n);\n * ```\n */\nexport function nLength(n, nBitLength) {\n    // Bit size, byte size of CURVE.n\n    if (nBitLength !== undefined)\n        anumber(nBitLength);\n    if (n <= _0n)\n        throw new Error('invalid n length: expected positive n, got ' + n);\n    if (nBitLength !== undefined && nBitLength < 1)\n        throw new Error('invalid n length: expected positive bit length, got ' + nBitLength);\n    const bits = bitLen(n);\n    // Cached bit lengths smaller than ORDER would truncate serialized scalars/elements and poison\n    // any math that relies on the derived field metadata.\n    if (nBitLength !== undefined && nBitLength < bits)\n        throw new Error(`invalid n length: expected nBitLength (${nBitLength}) >= bitLen(n) (${bits})`);\n    const _nBitLength = nBitLength !== undefined ? nBitLength : bits;\n    const nByteLength = Math.ceil(_nBitLength / 8);\n    return { nBitLength: _nBitLength, nByteLength };\n}\n// Keep the lazy sqrt cache off-instance so Field(...) can return a frozen object. Otherwise the\n// cached helper write would keep the field surface externally mutable.\nconst FIELD_SQRT = new WeakMap();\nclass _Field {\n    ORDER;\n    BITS;\n    BYTES;\n    isLE;\n    ZERO = _0n;\n    ONE = _1n;\n    _lengths;\n    _mod;\n    constructor(ORDER, opts = {}) {\n        // ORDER <= 1 is degenerate: ONE would not be a valid field element and helpers like pow/inv\n        // would stop modeling field arithmetic.\n        if (ORDER <= _1n)\n            throw new Error('invalid field: expected ORDER > 1, got ' + ORDER);\n        let _nbitLength = undefined;\n        this.isLE = false;\n        if (opts != null && typeof opts === 'object') {\n            // Cached bit lengths are trusted here and should already be positive / consistent with ORDER.\n            if (typeof opts.BITS === 'number')\n                _nbitLength = opts.BITS;\n            if (typeof opts.sqrt === 'function')\n                // `_Field.prototype` is frozen below, so custom sqrt hooks must become own properties\n                // explicitly instead of relying on writable prototype shadowing via assignment.\n                Object.defineProperty(this, 'sqrt', { value: opts.sqrt, enumerable: true });\n            if (typeof opts.isLE === 'boolean')\n                this.isLE = opts.isLE;\n            if (opts.allowedLengths)\n                this._lengths = Object.freeze(opts.allowedLengths.slice());\n            if (typeof opts.modFromBytes === 'boolean')\n                this._mod = opts.modFromBytes;\n        }\n        const { nBitLength, nByteLength } = nLength(ORDER, _nbitLength);\n        if (nByteLength > 2048)\n            throw new Error('invalid field: expected ORDER of <= 2048 bytes');\n        this.ORDER = ORDER;\n        this.BITS = nBitLength;\n        this.BYTES = nByteLength;\n        Object.freeze(this);\n    }\n    create(num) {\n        return mod(num, this.ORDER);\n    }\n    isValid(num) {\n        if (typeof num !== 'bigint')\n            throw new TypeError('invalid field element: expected bigint, got ' + typeof num);\n        return _0n <= num && num < this.ORDER; // 0 is valid element, but it's not invertible\n    }\n    is0(num) {\n        return num === _0n;\n    }\n    // is valid and invertible\n    isValidNot0(num) {\n        return !this.is0(num) && this.isValid(num);\n    }\n    isOdd(num) {\n        return (num & _1n) === _1n;\n    }\n    neg(num) {\n        return mod(-num, this.ORDER);\n    }\n    eql(lhs, rhs) {\n        return lhs === rhs;\n    }\n    sqr(num) {\n        return mod(num * num, this.ORDER);\n    }\n    add(lhs, rhs) {\n        return mod(lhs + rhs, this.ORDER);\n    }\n    sub(lhs, rhs) {\n        return mod(lhs - rhs, this.ORDER);\n    }\n    mul(lhs, rhs) {\n        return mod(lhs * rhs, this.ORDER);\n    }\n    pow(num, power) {\n        return pow(num, power, this.ORDER);\n    }\n    div(lhs, rhs) {\n        return mod(lhs * invert(rhs, this.ORDER), this.ORDER);\n    }\n    // Same as above, but doesn't normalize\n    sqrN(num) {\n        return num * num;\n    }\n    addN(lhs, rhs) {\n        return lhs + rhs;\n    }\n    subN(lhs, rhs) {\n        return lhs - rhs;\n    }\n    mulN(lhs, rhs) {\n        return lhs * rhs;\n    }\n    inv(num) {\n        return invert(num, this.ORDER);\n    }\n    sqrt(num) {\n        // Caching sqrt helpers speeds up sqrt9mod16 by 5x and Tonelli-Shanks by about 10% without keeping\n        // the field instance itself mutable.\n        let sqrt = FIELD_SQRT.get(this);\n        if (!sqrt)\n            FIELD_SQRT.set(this, (sqrt = FpSqrt(this.ORDER)));\n        return sqrt(this, num);\n    }\n    toBytes(num) {\n        // Serialize fixed-width limbs without re-validating the field range. Callers that need a\n        // canonical encoding must pass a valid element; some protocols intentionally serialize raw\n        // residues here and reduce or validate them elsewhere.\n        return this.isLE ? numberToBytesLE(num, this.BYTES) : numberToBytesBE(num, this.BYTES);\n    }\n    fromBytes(bytes, skipValidation = false) {\n        abytes(bytes);\n        const { _lengths: allowedLengths, BYTES, isLE, ORDER, _mod: modFromBytes } = this;\n        if (allowedLengths) {\n            // `allowedLengths` must list real positive byte lengths; otherwise empty input would get\n            // padded into zero and silently decode as a field element.\n            if (bytes.length < 1 || !allowedLengths.includes(bytes.length) || bytes.length > BYTES) {\n                throw new Error('Field.fromBytes: expected ' + allowedLengths + ' bytes, got ' + bytes.length);\n            }\n            const padded = new Uint8Array(BYTES);\n            // isLE add 0 to right, !isLE to the left.\n            padded.set(bytes, isLE ? 0 : padded.length - bytes.length);\n            bytes = padded;\n        }\n        if (bytes.length !== BYTES)\n            throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);\n        let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n        if (modFromBytes)\n            scalar = mod(scalar, ORDER);\n        if (!skipValidation)\n            if (!this.isValid(scalar))\n                throw new Error('invalid field element: outside of range 0..ORDER');\n        // Range validation is optional here because some protocols intentionally decode raw residues\n        // and reduce or validate them elsewhere.\n        return scalar;\n    }\n    // TODO: we don't need it here, move out to separate fn\n    invertBatch(lst) {\n        // `passZero` keeps the `bigint[]` contract honest: zero inputs map to `0` instead of leaking\n        // `undefined` into a `bigint[]`. Callers that must distinguish non-invertible inputs should use\n        // `FpInvertBatch` directly, whose default omits `passZero` and returns `(bigint | undefined)[]`.\n        return FpInvertBatch(this, lst, true);\n    }\n    // We can't move this out because Fp6, Fp12 implement it\n    // and it's unclear what to return in there.\n    cmov(a, b, condition) {\n        // Field elements have `isValid(...)`; the CMOV branch bit is a direct runtime input, so reject\n        // non-boolean selectors here instead of letting JS truthiness silently change arithmetic.\n        abool(condition, 'condition');\n        return condition ? b : a;\n    }\n}\n/**\n * Creates a finite field. Major performance optimizations:\n * * 1. Denormalized operations like mulN instead of mul.\n * * 2. Identical object shape: never add or remove keys.\n * * 3. Frozen stable object shape; the lazy sqrt cache lives in a module-level `WeakMap`.\n * Fragile: always run a benchmark on a change.\n * Security note: operations and low-level serializers like `toBytes` don't check `isValid` for\n * all elements for performance and protocol-flexibility reasons; callers are responsible for\n * supplying valid elements when they need canonical field behavior.\n * This is low-level code, please make sure you know what you're doing.\n *\n * Note about field properties:\n * * CHARACTERISTIC p = prime number, number of elements in main subgroup.\n * * ORDER q = similar to cofactor in curves, may be composite `q = p^m`.\n *\n * @param ORDER - field order, probably prime, or could be composite\n * @param opts - Field options such as bit length or endianness. See {@link FieldOpts}.\n * @returns Frozen field instance with a stable object shape. This wrapper forwards `opts` straight\n *   into `_Field`, so it inherits `_Field`'s assumptions about cached sizes and `allowedLengths`.\n * @example\n * Construct one prime field with optional overrides.\n *\n * ```ts\n * Field(11n);\n * ```\n */\nexport function Field(ORDER, opts = {}) {\n    // Freeze the shared method surface before any instance is reachable; otherwise callers can\n    // poison every Field instance by monkey-patching `_Field.prototype` even if each instance is\n    // frozen. Freezing here instead of module scope keeps `_Field` tree-shakeable for importers\n    // that never construct a field; the call is idempotent and cheap.\n    Object.freeze(_Field.prototype);\n    return new _Field(ORDER, opts);\n}\n/**\n * @param Fp - Field implementation.\n * @param elm - Value to square-root.\n * @returns Odd square root when two roots exist. The special case `elm = 0` still returns `0`,\n *   which is the only square root but is not odd.\n * @throws If the field lacks oddness checks or the square root does not exist. {@link Error}\n * @example\n * Select the odd square root when two roots exist.\n *\n * ```ts\n * import { Field, FpSqrtOdd } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const root = FpSqrtOdd(Fp, 4n);\n * ```\n */\nexport function FpSqrtOdd(Fp, elm) {\n    validateField(Fp);\n    const F = Fp;\n    if (!F.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = F.sqrt(elm);\n    return F.isOdd(root) ? root : F.neg(root);\n}\n/**\n * @param Fp - Field implementation.\n * @param elm - Value to square-root.\n * @returns Even square root.\n * @throws If the field lacks oddness checks or the square root does not exist. {@link Error}\n * @example\n * Select the even square root when two roots exist.\n *\n * ```ts\n * import { Field, FpSqrtEven } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const root = FpSqrtEven(Fp, 4n);\n * ```\n */\nexport function FpSqrtEven(Fp, elm) {\n    validateField(Fp);\n    const F = Fp;\n    if (!F.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = F.sqrt(elm);\n    return F.isOdd(root) ? F.neg(root) : root;\n}\n/**\n * Returns total number of bytes consumed by the field element.\n * For example, 32 bytes for usual 256-bit weierstrass curve.\n * @param fieldOrder - number of field elements, usually CURVE.n. Callers are expected to pass an\n *   order greater than 1.\n * @returns byte length of field\n * @throws If the field order is not a bigint. {@link Error}\n * @example\n * Read the fixed-width byte length of one field.\n *\n * ```ts\n * getFieldBytesLength(255n);\n * ```\n */\nexport function getFieldBytesLength(fieldOrder) {\n    if (typeof fieldOrder !== 'bigint')\n        throw new Error('field order must be bigint');\n    // Valid field elements are in 0..ORDER-1, so ORDER <= 1 would make the encoded range degenerate.\n    if (fieldOrder <= _1n)\n        throw new Error('field order must be greater than 1');\n    // Valid field elements are < ORDER, so the maximal encoded element is ORDER - 1.\n    const bitLength = bitLen(fieldOrder - _1n);\n    return Math.ceil(bitLength / 8);\n}\n/**\n * Returns minimal amount of bytes that can be safely reduced\n * by field order.\n * Should be 2^-128 for 128-bit curve such as P256.\n * This is the reduction / modulo-bias lower bound; higher-level helpers may still impose a larger\n * absolute floor for policy reasons.\n * @param fieldOrder - number of field elements greater than 1, usually CURVE.n.\n * @returns byte length of target hash\n * @throws If the field order is invalid. {@link Error}\n * @example\n * Compute the minimum hash length needed for field reduction.\n *\n * ```ts\n * getMinHashLength(255n);\n * ```\n */\nexport function getMinHashLength(fieldOrder) {\n    const length = getFieldBytesLength(fieldOrder);\n    return length + Math.ceil(length / 2);\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF\n * and convert them into private scalar, with the modulo bias being negligible.\n * Needs at least 48 bytes of input for 32-byte private key. The implementation also keeps a hard\n * 16-byte minimum even when `getMinHashLength(...)` is smaller, so toy-small inputs do not look\n * accidentally acceptable for real scalar derivation.\n * See {@link https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/ | Kudelski's modulo-bias guide},\n * {@link https://csrc.nist.gov/publications/detail/fips/186/5/final | FIPS 186-5 appendix A.2}, and\n * {@link https://www.rfc-editor.org/rfc/rfc9380#section-5 | RFC 9380 section 5}. Unlike RFC 9380\n * `hash_to_field`, this helper intentionally maps into the non-zero private-scalar range `1..n-1`.\n * @param key - Uniform input bytes.\n * @param fieldOrder - Size of subgroup.\n * @param isLE - interpret hash bytes as LE num\n * @returns valid private scalar\n * @throws If the hash length or field order is invalid for scalar reduction. {@link Error}\n * @example\n * Map hash output into a private scalar range.\n *\n * ```ts\n * mapHashToField(new Uint8Array(48).fill(1), 255n);\n * ```\n */\nexport function mapHashToField(key, fieldOrder, isLE = false) {\n    abytes(key);\n    const len = key.length;\n    const fieldLen = getFieldBytesLength(fieldOrder);\n    const minLen = Math.max(getMinHashLength(fieldOrder), 16);\n    // No toy-small inputs: the helper is for real scalar derivation, not tiny test curves. No huge\n    // inputs: easier to reason about JS timing / allocation behavior.\n    if (len < minLen || len > 1024)\n        throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);\n    const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);\n    // Map into the non-zero scalar range [1, fieldOrder-1]: reduce mod (fieldOrder-1) to land in\n    // [0, fieldOrder-2], then add 1. This shifts the range off zero; it is NOT equal to\n    // `mod(num, fieldOrder)` (which spans [0, fieldOrder-1] and can be 0). A residual modulo bias\n    // remains but is negligible (~2^-(nBits/2), e.g. ~2^-128 for a 256-bit order) because `key` is\n    // required to be at least `getMinHashLength(fieldOrder)` (~1.5x field size) bytes of input.\n    const reduced = mod(num, fieldOrder - _1n) + _1n;\n    return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);\n}\n","/**\n * Methods for elliptic curve multiplication by scalars.\n * Contains wNAF-based ScalarMultiplier, pippenger.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { aarray, abool, afunction, aobject, bitLen, bitMask, bytesToNumberBE, inRange, isBytes, isPosBig, validateObject, } from \"../utils.js\";\nimport { Field, FpInvertBatch, validateField } from \"./modular.js\";\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\nconst _4n = /* @__PURE__ */ BigInt(4);\nconst BLIND_BYTES = 16;\nconst BLIND_BITS = 128;\n// Fixed-window width for the constant-time multiply of un-precomputed points (W===1).\n// A flat 2^FW_WINDOW table has a small, scalar-independent build cost that amortizes over a single\n// multiply, unlike the larger per-point wNAF tables that only pay off when cached.\nconst FW_WINDOW = 5;\n// Precompute tables are capped at ~2 GiB of estimated heap. Rejecting larger windows up front\n// turns a typo'd window size into an immediate error instead of a multi-GB allocation (or an\n// effective hang) when the lazy table is built on first multiply.\nconst TABLE_BYTES_MAX = /* @__PURE__ */ (() => 2 ** 31)();\n/**\n * Validates the static surface of a point constructor.\n * This is only a cheap sanity check for the constructor hooks and fields consumed by generic\n * factories; it does not certify `BASE`/`ZERO` semantics or prove the curve implementation itself.\n * @param Point - Runtime point constructor.\n * @throws On missing constructor hooks or malformed field metadata. {@link TypeError}\n * @example\n * Check that one point constructor exposes the static hooks generic helpers need.\n *\n * ```ts\n * import { ed25519 } from '@noble/curves/ed25519.js';\n * import { validatePointCons } from '@noble/curves/abstract/curve.js';\n * validatePointCons(ed25519.Point);\n * ```\n */\nexport function validatePointCons(Point) {\n    const pc = Point;\n    if (typeof pc !== 'function')\n        throw new TypeError('\"Point\" expected constructor, got type=' + typeof Point);\n    afunction(pc.fromAffine, 'Point.fromAffine');\n    afunction(pc.fromBytes, 'Point.fromBytes');\n    afunction(pc.fromHex, 'Point.fromHex');\n    // Generic helpers (ScalarMultiplier, normalizeZ, MSM) dereference BASE / ZERO:\n    // fail here with a typed error instead of an `undefined` access later.\n    aobject(pc.BASE, 'Point.BASE');\n    aobject(pc.ZERO, 'Point.ZERO');\n    validateField(pc.Fp);\n    validateField(pc.Fn);\n}\n/**\n * Takes a bunch of Projective Points but executes only one\n * inversion on all of them. Inversion is very slow operation,\n * so this improves performance massively.\n * Optimization: converts a list of projective points to a list of identical points with Z=1.\n * Input points are left unchanged; the normalized points are returned as fresh instances.\n * @param c - Point constructor.\n * @param points - Projective points.\n * @returns Fresh projective points reconstructed from normalized affine coordinates.\n * @example\n * Batch-normalize projective points with a single shared inversion.\n *\n * ```ts\n * import { normalizeZ } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const points = normalizeZ(p256.Point, [p256.Point.BASE, p256.Point.BASE.double()]);\n * ```\n */\nexport function normalizeZ(c, points) {\n    // Match MSM helpers: reject malformed public inputs before reading projective internals.\n    validatePointCons(c);\n    validateMSMPoints(points, c);\n    // Identity points (Z=0) rely on an implicit contract: FpInvertBatch without `passZero`\n    // yields `undefined` for zero inputs, and `toAffine(undefined)` falls back to its internal\n    // is0 handling instead of using the batch inverse.\n    const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));\n    return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));\n}\nfunction validateW(W, bits, min = 1) {\n    if (!Number.isSafeInteger(W) || W < min || W > bits)\n        throw new Error('invalid window size, expected [' + min + '..' + bits + '], got W=' + W);\n}\n// Rough per-point heap estimate for the {@link TABLE_BYTES_MAX} cap: up to 4 projective/extended\n// coordinates of Fp.BYTES each, plus bigint/object overhead. Callers pass the point count of the\n// largest table the checked parameters can produce.\nfunction validateTableBytes(numPoints, fpBytes) {\n    const bytes = numPoints * (4 * fpBytes + 128);\n    if (bytes > TABLE_BYTES_MAX)\n        throw new Error('invalid window size: table would need ~' +\n            Math.ceil(bytes / 2 ** 20) +\n            ' MiB, max ' +\n            TABLE_BYTES_MAX / 2 ** 20 +\n            ' MiB');\n}\n/**\n * Probes an RNG once, at construction time: returns `undefined` when it is unavailable —\n * throws or returns malformed bytes — so callers can downgrade to their unblinded /\n * deterministic constant-time fallback. Blinding is defense-in-depth (DPA/template\n * hardening), not a correctness or key-secrecy requirement, so availability-based\n * downgrade is acceptable.\n *\n * The downgrade decision is deliberately static. After a successful probe the RNG becomes\n * part of the trusted contract: later misbehavior must fail closed in per-call validation\n * (throw), never downgrade — a dynamic fallback would let a tampered RNG silently strip\n * blinding on demand. A probe can only ever classify broken environments, not adversarial\n * RNGs: a stateful RNG can always behave while probed and misbehave later.\n * @param randomBytes - RNG to probe, or `undefined` when the environment provides none.\n * @param length - Byte length requested from the probe call.\n * @returns The RNG when the probe produced `length` valid bytes; `undefined` otherwise.\n * @example\n * Probe an RNG once before enabling scalar blinding.\n *\n * ```ts\n * import { probeRandomBytes } from '@noble/curves/abstract/curve.js';\n * import { randomBytes } from '@noble/hashes/utils.js';\n * const rng = probeRandomBytes(randomBytes, 16);\n * ```\n */\nexport function probeRandomBytes(randomBytes, length) {\n    if (randomBytes === undefined)\n        return undefined;\n    afunction(randomBytes, 'randomBytes');\n    try {\n        const probe = randomBytes(length);\n        if (!isBytes(probe) || probe.length !== length)\n            return undefined;\n    }\n    catch {\n        return undefined;\n    }\n    return randomBytes;\n}\nfunction validateMSMPoints(points, c) {\n    aarray(points, 'points');\n    points.forEach((p, i) => {\n        if (!(p instanceof c))\n            throw new Error('invalid point at index ' + i);\n    });\n}\n// Default bound is field membership (0 <= s < field.ORDER); a `maxScalar` override widens it\n// to 0 <= s < maxScalar for callers that accept oversized scalars.\nfunction validateMSMScalars(scalars, field, maxScalar) {\n    if (!Array.isArray(scalars))\n        throw new Error('array of scalars expected');\n    scalars.forEach((s, i) => {\n        const ok = maxScalar === undefined ? field.isValid(s) : isPosBig(s) && s < maxScalar;\n        if (!ok)\n            throw new Error('invalid scalar at index ' + i);\n    });\n}\nconst pointWindowSizes = new WeakMap();\nfunction getWindowSize(P) {\n    // `1` is the uncached sentinel: use the non-precomputed (wNAF / fixed-window) path.\n    return pointWindowSizes.get(P) || 1;\n}\n/** Table of odd multiples [1P, 3P, ..., (2⋅size−1)P]; width-W wNAF uses size = 2^(W−2). */\nfunction oddMultiples(p, size) {\n    const dbl = p.double();\n    const t = [p];\n    for (let j = 1; j < size; j++)\n        t.push(t[j - 1].add(dbl));\n    return t;\n}\n/**\n * Width-W wNAF signed-digit recoding (W >= 2), LSB-first: digits are 0 or odd with\n * |digit| < 2^(W−1); nonzero density ~1/(W+1) (a nonzero digit is followed by W−1 zeros).\n */\nfunction wnafDigits(n, W) {\n    const size = 2 ** W;\n    const half = size / 2;\n    const mask = BigInt(size - 1);\n    const d = [];\n    while (n > _0n) {\n        let w = 0;\n        if (n & _1n) {\n            w = Number(n & mask); // n mod 2^W, odd\n            if (w >= half)\n                w -= size; // signed residue\n            n -= BigInt(w); // n - w ≡ 0 mod 2^W: next W−1 digits are zero\n        }\n        d.push(w);\n        n >>= _1n;\n    }\n    return d;\n}\n/**\n * Fixed-position signed-window recoding for precomputed wNAF: `n = Σ digits[w]⋅2^(w⋅W)` with\n * digits in `[−2^(W−1)+1, 2^(W−1)]`. Digit count is fixed by `windows` (callers reserve one\n * extra window for the final carry), so recoding length does not depend on the scalar.\n */\nfunction signedWindowDigits(n, W, windows) {\n    const size = 2 ** W;\n    const half = size / 2;\n    const mask = BigInt(size - 1);\n    const shiftBy = BigInt(W);\n    const d = [];\n    for (let w = 0; w < windows; w++) {\n        let v = Number(n & mask);\n        n >>= shiftBy;\n        if (v > half) {\n            v -= size; // negative digit, carry into the next window\n            n += _1n;\n        }\n        d.push(v);\n    }\n    // Internal invariant: leftover bits mean the window count did not cover the scalar.\n    if (n !== _0n)\n        throw new Error('invalid wnaf');\n    return d;\n}\n/**\n * Shared vartime walk over per-scalar wNAF digit streams: one doubling of a single shared\n * accumulator per bit position of the longest recoding, one signed table addition per\n * nonzero digit. `tables[i]` must hold the odd multiples of the i-th point.\n */\nfunction wnafWalk(zero, tables, digits) {\n    let max = 0;\n    for (const d of digits)\n        max = Math.max(max, d.length);\n    let acc = zero;\n    for (let bit = max - 1; bit >= 0; bit--) {\n        if (bit !== max - 1)\n            acc = acc.double();\n        for (let i = 0; i < digits.length; i++) {\n            const w = digits[i][bit]; // reads past shorter recodings yield undefined, skipped below\n            if (w) {\n                const item = tables[i][(Math.abs(w) - 1) >> 1];\n                acc = acc.add(w < 0 ? item.negate() : item);\n            }\n        }\n    }\n    return acc;\n}\n/**\n * Elliptic curve multiplication of Point by scalar.\n * Routes between cached-table, fixed-window, and one-shot wNAF paths; entry points validate\n * their own scalars (`mulCT`/`mulCTBlinded`: `1 <= s < Fn.ORDER`; `mulUnsafe`: up to the\n * `Fn.ORDER^4` DoS cap via {@link mulAddUnsafe}).\n * Table generation is expensive and happens on first call of `multiply()`\n * (or eagerly via `precompute(W, false)`). By default, `BASE` point is precomputed.\n *\n * Cached algorithm is signed fixed-window wNAF:\n * - table stores, for every window w, the multiples `[1..2^(W−1)]⋅2^(w⋅W)⋅P` — all doublings\n *   are baked in, so a multiplication is exactly one table addition per window\n * - window count is fixed (`ceil(bits/W) + 1`), so the point-operation count is scalar-independent\n *   (basis of the constant-time path)\n * - for a 256-bit curve and W=6: 44⋅32 = 1408 table points, 44 additions per multiply\n * - secret scalars are additionally blinded (see {@link ScalarMultiplier.mulCTBlinded}), which\n *   widens tables by 128 bits\n * @param Point - Point constructor.\n * @param randomBytes - RNG used for scalar blinding; required by the blinded secret path.\n * @example\n * Elliptic curve multiplication of Point by scalar.\n *\n * ```ts\n * import { ScalarMultiplier } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const mul = new ScalarMultiplier(p256.Point);\n * ```\n */\nexport class ScalarMultiplier {\n    Point;\n    BASE;\n    ZERO;\n    randomBytes;\n    wnafPrecomputes = new WeakMap();\n    baseCanBeBlinded;\n    bits;\n    // Parametrized with a given Point class (not individual point)\n    constructor(Point, randomBytes) {\n        validatePointCons(Point);\n        // Probe the RNG once (see {@link probeRandomBytes}): in environments without working\n        // randomness (e.g. no WebCrypto), shouldBlind() then routes secret multiplication to the\n        // unblinded constant-time path instead of throwing on every multiply(). The shape of\n        // returned bytes is still validated on every blinded call, where breakage fails closed.\n        this.randomBytes = probeRandomBytes(randomBytes, BLIND_BYTES);\n        this.Point = Point;\n        this.BASE = Point.BASE;\n        this.ZERO = Point.ZERO;\n        this.bits = Point.Fn.BITS;\n    }\n    /**\n     * Creates a signed fixed-window wNAF precomputation table: for every window w, the\n     * multiples `[1..2^(W−1)]⋅2^(w⋅W)⋅P`, flattened. All doublings are baked into the table,\n     * so cached multiplication is additions-only. `windows = ceil(bits/W) + 1`: the extra\n     * window absorbs the final carry of signed-digit recoding.\n     * For a 256-bit curve and W=6, the table is 44⋅32 = 1408 points.\n     * @param point - Point instance\n     * @param W - window size\n     * @param bits - scalar bitlength the table must cover\n     */\n    buildWnafTable(point, W, bits) {\n        // W needs no re-validation: its only source is setWindowSize(), which enforces\n        // 1 <= W <= Fn.BITS <= bits (the blinded path only ever widens bits) and caps the\n        // resulting table at ~2 GiB (sized against the wider blinded layout).\n        const windows = Math.ceil(bits / W) + 1;\n        const half = 2 ** (W - 1);\n        const comp = [];\n        let base = point;\n        for (let w = 0; w < windows; w++) {\n            let acc = base;\n            for (let i = 0; i < half; i++) {\n                comp.push(acc);\n                acc = acc.add(base);\n            }\n            base = comp[comp.length - 1].double(); // 2⋅(2^(W−1)⋅base) = next window's base\n        }\n        return { W, bits, windows, comp };\n    }\n    /**\n     * Implements ec multiplication using precomputed signed fixed-window wNAF tables.\n     * Constant-time: fixed window count with one table addition per window — zero digits feed\n     * the fake accumulator — and no doublings; the lookup scans the whole window slice.\n     * Scalar bounds are validated by the public entry points ({@link ScalarMultiplier.mulCT},\n     * {@link ScalarMultiplier.mulCTBlinded}, {@link ScalarMultiplier.mulUnsafe});\n     * signedWindowDigits throws if `n` exceeds the table.\n     * @returns real and fake (for const-time) points\n     */\n    wnafCachedCT(precomputes, n) {\n        const { W, windows, comp } = precomputes;\n        const half = 2 ** (W - 1);\n        const digits = signedWindowDigits(n, W, windows);\n        let p = this.ZERO;\n        let f = this.BASE;\n        for (let w = 0; w < windows; w++) {\n            const digit = digits[w];\n            const start = w * half;\n            // Data-oblivious select: touch every entry of the window before the digit branch.\n            const idx = Math.abs(digit) - 1; // -1 for zero digits: matches nothing, `sel` unused\n            let sel = comp[start];\n            for (let i = 1; i < half; i++)\n                sel = i === idx ? comp[start + i] : sel;\n            const neg = sel.negate(); // compute both signs; the digit only picks one\n            if (digit === 0)\n                f = f.add(comp[start]);\n            else\n                p = p.add(digit < 0 ? neg : sel);\n        }\n        return { p, f };\n    }\n    // Cache key is point identity plus (W, bits); at most two entries exist per point (public-width\n    // `Fn.BITS` and blinded `Fn.BITS + BLIND_BITS`). Callers must not reuse the same point with\n    // incompatible `transform(...)` layouts and expect a separate cache entry.\n    getWnafPrecomputes(W, point, bits, transform) {\n        let entries = this.wnafPrecomputes.get(point);\n        let comp = entries?.find((entry) => entry.W === W && entry.bits === bits);\n        if (!comp) {\n            comp = this.buildWnafTable(point, W, bits);\n            if (typeof transform === 'function')\n                comp = { ...comp, comp: transform(comp.comp) };\n            if (!entries) {\n                entries = [];\n                this.wnafPrecomputes.set(point, entries);\n            }\n            entries.push(comp);\n        }\n        return comp;\n    }\n    assertPoint(point) {\n        if (!(point instanceof this.Point))\n            throw new TypeError('\"point\" expected Point instance, got type=' + typeof point);\n    }\n    // Shared prologue of the constant-time entry points. Rejects scalar 0: in key/signature-style\n    // callers a zero scalar means broken upstream plumbing, and concrete Points already reject it.\n    // Uses inRange instead of Fn.isValidNot0: validateField() only certifies the arithmetic subset.\n    validateMulInput(point, scalar) {\n        this.assertPoint(point);\n        if (!inRange(scalar, _1n, this.Point.Fn.ORDER))\n            throw new Error('invalid scalar');\n    }\n    // Constant-time dispatch shared by mulCT / mulCTBlinded. Un-precomputed points (W===1, e.g.\n    // ECDH peer keys) skip building a throwaway cached table in favor of a small fixed-window\n    // multiply. `n` must be < 2^bits.\n    runCT(point, n, bits, transform) {\n        const W = getWindowSize(point);\n        if (W === 1)\n            return this.fixedWindowCT(point, n, bits);\n        return this.wnafCachedCT(this.getWnafPrecomputes(W, point, bits, transform), n);\n    }\n    mulCT(point, scalar, transform) {\n        this.validateMulInput(point, scalar);\n        return this.runCT(point, scalar, this.bits, transform);\n    }\n    mulCTBlinded(point, scalar, transform) {\n        this.validateMulInput(point, scalar);\n        // Blinding computes n = scalar + blind*Fn.ORDER, then n*P via a constant-time multiply. This\n        // equals scalar*P only when Fn.ORDER*P == O; callers guarantee that via shouldBlind() (always\n        // for cofactor-1 curves; for cofactored curves only BASE, and only after checking BASE*n == O).\n        // Fail before building the (large) precompute table if randomness is unavailable.\n        if (this.randomBytes === undefined)\n            throw new Error('randomBytes is required for scalar blinding');\n        const bits = this.Point.Fn.BITS + BLIND_BITS;\n        const blind = this.randomBytes(BLIND_BYTES);\n        if (!isBytes(blind) || blind.length !== BLIND_BYTES)\n            throw new Error('randomBytes returned invalid byte array');\n        // Force the top two bits of the 128-bit blind to 10xxxxxx, so blind is in [2^127, 1.5*2^127):\n        // * `| 0x80` (bit 127 = 1) is the load-bearing part: it guarantees blind >= 2^127, so the blind\n        //   is always a full-width, nonzero factor and the scalar is masked even with a degenerate RNG.\n        // * `& 0x3f` (bit 126 = 0) is a safety margin: it caps blind < 1.5*2^127, keeping\n        //   blind*Fn.ORDER + scalar < 0.75*2^(nBits+128), i.e. ~half a window below the 2^(nBits+128)\n        //   ceiling. Not strictly required for the bound (see below), but it reserves headroom so the\n        //   guarantee does not rest on the tight `Fn.ORDER < 2^Fn.BITS` fact and the final carry window\n        //   only ever holds a small carry, never a full digit.\n        blind[0] = (blind[0] & 0x3f) | 0x80;\n        // Even at the extreme (blind < 2^128, scalar < Fn.ORDER < 2^nBits): n <= 2^128*Fn.ORDER - 1 <\n        // 2^(nBits+128), so n stays below 2^bits and within the blinded table's\n        // window count. Both cached CT kernels run a fixed number of windows/rows with one point-add\n        // each, so the add count is independent of scalar (constant-time).\n        const n = scalar + bytesToNumberBE(blind) * this.Point.Fn.ORDER;\n        return this.runCT(point, n, bits, transform);\n    }\n    /**\n     * Constant-time multiplication `n*point` for an un-precomputed point, via a small fixed window.\n     * A cached wNAF table only pays off when reused; a flat 2^FW_WINDOW table (`size-1` adds) is\n     * far cheaper to build for a single use. The point-operation sequence is independent of `n`:\n     * build the table, then per window exactly FW_WINDOW doublings, a data-oblivious scan over\n     * every table entry, and one addition (adds the identity when the window digit is 0 — never\n     * skipped).\n     *\n     * `n` must be `< 2^bits`. Assumes complete addition (adding the identity costs the same as any\n     * add), which holds for the Weierstrass/Edwards point types used here. The table is left in\n     * projective form (no normalizeZ): normalizing this small a table costs more than the\n     * mixed-add savings it would buy for a single multiply.\n     * @returns real point `p`; `f` duplicates it only to match {@link wnafCachedCT}'s return shape\n     * (this path needs no fake accumulator — its op-count is already scalar-independent).\n     */\n    fixedWindowCT(point, n, bits) {\n        const W = FW_WINDOW;\n        const size = 1 << W;\n        const mask = bitMask(W);\n        // Flat table [O, point, 2*point, ..., (size-1)*point].\n        const table = new Array(size);\n        table[0] = this.ZERO;\n        for (let i = 1; i < size; i++)\n            table[i] = table[i - 1].add(point);\n        // Horner MSB->LSB. windows*W >= bits and n < 2^bits, so every bit of n is consumed.\n        const windows = Math.ceil(bits / W);\n        let acc = this.ZERO;\n        for (let window = windows - 1; window >= 0; window--) {\n            // W doublings per window; skipped for the first (topmost) window, where acc is still the\n            // identity. The skip is scalar-independent: it depends only on the loop index.\n            if (window !== windows - 1)\n                for (let d = 0; d < W; d++)\n                    acc = acc.double();\n            const digit = Number((n >> BigInt(window * W)) & mask);\n            // Data-oblivious select: touch every entry, same as wnafCachedCT.\n            let sel = table[0];\n            for (let i = 1; i < size; i++)\n                sel = i === digit ? table[i] : sel;\n            acc = acc.add(sel); // one add per window, even for digit 0\n        }\n        return { p: acc, f: acc };\n    }\n    shouldBlind(point, cofactor) {\n        // No usable RNG (probed in the constructor): blinding is impossible, use the plain CT path.\n        if (this.randomBytes === undefined)\n            return false;\n        if (cofactor === _1n)\n            return true;\n        if (point !== this.BASE)\n            return false;\n        if (this.baseCanBeBlinded === undefined)\n            this.baseCanBeBlinded = this.mulUnsafe(this.BASE, this.Point.Fn.ORDER).is0();\n        return this.baseCanBeBlinded;\n    }\n    mulSecret(point, scalar, cofactor, transform) {\n        return this.shouldBlind(point, cofactor)\n            ? this.mulCTBlinded(point, scalar, transform)\n            : this.mulCT(point, scalar, transform);\n    }\n    mulUnsafe(point, scalar, transform) {\n        this.assertPoint(point);\n        if (!isPosBig(scalar))\n            throw new Error('invalid scalar');\n        const W = getWindowSize(point);\n        // W === 1 (un-precomputed): one-shot width-4 wNAF via {@link mulAddUnsafe} with L=1 —\n        // a cached table would be thrown away after one use. `allowOversized` swaps the\n        // `s < Fn.ORDER` check for mulAddUnsafe's `Fn.ORDER^4` DoS cap.\n        //\n        // Oversized scalar could happen when:\n        // a) user passes large scalar on their own (rare)\n        // b) `assertValidity()` calls `isTorsionFree()`, which multiplies point by `Fn.ORDER`\n        if (W === 1 || scalar >= this.Point.Fn.ORDER)\n            return mulAddUnsafe(this.Point, [point], [scalar], true);\n        // Precomputed points reuse the CT kernel (fake accumulator discarded): with W=6 only\n        // ~1/64 of window-adds are skippable, so a dedicated vartime kernel saved just ~6% on\n        // this path while doubling the cached-table code surface.\n        const precomputes = this.getWnafPrecomputes(W, point, this.bits, transform);\n        return this.wnafCachedCT(precomputes, scalar).p;\n    }\n    // Remembers the window size used for precomputed wNAF multiplication of the given point\n    // and drops any previously built tables. Usually only the base point is precomputed.\n    // W=1 resets the point to the un-precomputed (table-less) paths.\n    // W is additionally capped so tables stay under ~2 GiB ({@link TABLE_BYTES_MAX}).\n    setWindowSize(point, W) {\n        this.assertPoint(point);\n        validateW(W, this.bits);\n        // Size against the widest table this W can produce: the blinded path adds BLIND_BITS.\n        const windows = Math.ceil((this.bits + BLIND_BITS) / W) + 1;\n        validateTableBytes(windows * 2 ** (W - 1), this.Point.Fp.BYTES);\n        pointWindowSizes.set(point, W);\n        this.wnafPrecomputes.delete(point);\n    }\n    // True when a window size is set: tables themselves are built lazily on first multiply.\n    hasWindowSize(point) {\n        return getWindowSize(point) !== 1;\n    }\n}\n/**\n * Combined multi-scalar multiplication `Σ scalars[i]⋅points[i]` via interleaved width-4 wNAF\n * (Strauss–Shamir). Every input gets its own table of odd multiples `[1P, 3P, 5P, 7P]` and\n * signed-digit recoding, but all walks share one doubling chain, so total cost is\n * `~bits` doublings + `L⋅bits/5` additions instead of `L⋅bits` doublings for separate\n * multiplications. Intended for the 2-4 point shapes of signature verification\n * (`R = u1⋅G + u2⋅P`); use {@link pippenger} for larger batches.\n *\n * Not constant-time: only for public inputs. Scalars must satisfy `0 <= s < Fn.ORDER`;\n * fold negative signs into the points before calling.\n * @param c - Point constructor.\n * @param points - Array of curve points.\n * @param scalars - Array of non-negative scalars, same length as points.\n * @param allowOversized - Replace the `s < Fn.ORDER` scalar check with a `Fn.ORDER^4` DoS cap.\n *   Off by default. For scalars that must NOT be reduced mod ORDER: torsion checks\n *   (`Fn.ORDER⋅P ≟ O`) and cofactor-clearing multiples. Walk length grows with `bitLen(s)`.\n * @returns Combined multiplication result; identity for empty input.\n * @throws If the point set or scalar set is invalid. {@link Error}\n * @example\n * Combined multi-scalar multiplication via Strauss–Shamir.\n *\n * ```ts\n * import { mulAddUnsafe } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const G = p256.Point.BASE;\n * const R = mulAddUnsafe(p256.Point, [G, G.double()], [2n, 3n]); // 2⋅G + 3⋅(2⋅G)\n * ```\n */\nexport function mulAddUnsafe(c, points, scalars, allowOversized = false) {\n    validatePointCons(c);\n    validateMSMPoints(points, c);\n    abool(allowOversized, 'allowOversized');\n    // Oversized cap is ORDER^4: hard bound to mitigate DoS, walk length grows with bitLen(s).\n    validateMSMScalars(scalars, c.Fn, allowOversized ? c.Fn.ORDER ** _4n : undefined);\n    if (points.length !== scalars.length)\n        throw new Error('arrays of points and scalars must have equal length');\n    const tables = points.map((p) => oddMultiples(p, 4));\n    const digits = scalars.map((n) => wnafDigits(n, 4));\n    return wnafWalk(c.ZERO, tables, digits);\n}\n/**\n * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * 30x faster vs naive addition on L=4096, 10x faster than precomputes.\n * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.\n * Point-operation count is scalar-independent (for same L), even when 1 point + scalar, or when\n * scalar = 0 — but bucket indices are scalar windows, so the memory-access pattern is\n * scalar-dependent: do not rely on this for secret scalars.\n *\n * A repaired LFG bucket-set variant from ePrint 2024/750 was benchmarked on BLS12-381 G1\n * against this implementation: ~1.4x faster at 2048 points and ~1.1-1.25x faster at\n * 4096-32768 points, at the cost of extra recoding and multiplier-table complexity.\n * @param c - Curve Point constructor\n * @param points - array of L curve points\n * @param scalars - array of L scalars (aka secret keys / bigints)\n * @returns MSM result point. Empty input is accepted and returns the identity.\n * @throws If the point set, scalar set, or MSM sizing is invalid. {@link Error}\n * @example\n * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n *\n * ```ts\n * import { pippenger } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const point = pippenger(p256.Point, [p256.Point.BASE, p256.Point.BASE.double()], [2n, 3n]);\n * ```\n */\nexport function pippenger(c, points, scalars) {\n    // 0 is accepted in scalars\n    validatePointCons(c);\n    const fieldN = c.Fn;\n    validateMSMPoints(points, c);\n    validateMSMScalars(scalars, fieldN);\n    const plength = points.length;\n    const slength = scalars.length;\n    if (plength !== slength)\n        throw new Error('arrays of points and scalars must have equal length');\n    const zero = c.ZERO;\n    // Without this, the window loop below would still run ~Fn.BITS doublings of ZERO.\n    if (plength === 0)\n        return zero;\n    const wbits = bitLen(BigInt(plength));\n    let windowSize = 1; // bits\n    if (wbits > 12)\n        windowSize = wbits - 3;\n    else if (wbits > 4)\n        windowSize = wbits - 2;\n    else if (wbits > 0)\n        windowSize = 2;\n    const MASK = bitMask(windowSize);\n    const buckets = new Array(Number(MASK) + 1).fill(zero); // +1 for zero array\n    const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;\n    let sum = zero;\n    for (let i = lastBits; i >= 0; i -= windowSize) {\n        buckets.fill(zero);\n        for (let j = 0; j < slength; j++) {\n            const scalar = scalars[j];\n            const wbits = Number((scalar >> BigInt(i)) & MASK);\n            buckets[wbits] = buckets[wbits].add(points[j]);\n        }\n        let resI = zero; // not using this will do small speed-up, but will lose ct\n        // Skip first bucket, because it is zero\n        for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {\n            sumI = sumI.add(buckets[j]);\n            resI = resI.add(sumI);\n        }\n        sum = sum.add(resI);\n        if (i !== 0)\n            for (let j = 0; j < windowSize; j++)\n                sum = sum.double();\n    }\n    return sum;\n}\n/**\n * Interleaved wNAF multi-scalar multiplication (MSM, Pa + Qb + Rc + ...) over a FIXED set\n * of points: each point gets a one-time table of odd multiples\n * `[1P, 3P, ..., (2^(W−1)−1)P]`, and the returned closure evaluates MSMs against those\n * tables. All scalars share one doubling chain (Straus 1964) — one doubling per scalar bit\n * plus one signed table addition per nonzero width-W wNAF digit (density ~1/(W+1)) — the\n * \"interleaving\" method of Möller, \"Algorithms for multi-exponentiation\" (SAC 2001).\n *\n * Table memory is `L⋅2^(W−2)` points, capped at ~2 GiB. Prefer this over {@link pippenger}\n * when the same points are reused across many MSMs (fixed-base commitments etc.) and up to a\n * few hundred points; prefer pippenger for one-shot MSMs or thousands of points, where\n * bucketing beats per-point tables.\n *\n * Not constant-time (zero digits are skipped): public inputs only.\n * @param c - Curve Point constructor\n * @param points - array of L curve points, captured by the returned closure\n * @param windowSize - window width W in bits, from 2 to Fn.BITS; also capped so the\n *   per-closure tables stay under ~2 GiB\n * @returns Function which multiplies points with scalars. The closure accepts at most\n *   `points.length` scalars, and omitted trailing scalars are treated as zero.\n * @throws If the point set or precompute window is invalid. {@link Error}\n * @example\n * Interleaved wNAF multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n *\n * ```ts\n * import { interleavedMSMUnsafe } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const msm = interleavedMSMUnsafe(p256.Point, [p256.Point.BASE], 4);\n * const point = msm([3n]);\n * ```\n */\nexport function interleavedMSMUnsafe(c, points, windowSize) {\n    validatePointCons(c);\n    const fieldN = c.Fn;\n    // Signed odd digits need at least width 2 (W=2 is plain NAF with a single-entry table).\n    validateW(windowSize, fieldN.BITS, 2);\n    validateMSMPoints(points, c);\n    validateTableBytes(points.length * 2 ** (windowSize - 2), c.Fp.BYTES);\n    const tables = points.map((p) => oddMultiples(p, 2 ** (windowSize - 2)));\n    return (scalars) => {\n        validateMSMScalars(scalars, fieldN);\n        if (scalars.length > points.length)\n            throw new Error('array of scalars must not be larger than array of points');\n        return wnafWalk(c.ZERO, tables, scalars.map((n) => wnafDigits(n, windowSize)));\n    };\n}\nfunction createField(order, field, isLE) {\n    if (field) {\n        // Reuse supplied field overrides as-is; `isLE` only affects freshly constructed fallback\n        // fields, and validateField() below only checks the arithmetic subset, not full byte/cmov\n        // behavior.\n        if (field.ORDER !== order)\n            throw new Error('Field.ORDER must match order: Fp == p, Fn == n');\n        validateField(field);\n        return field;\n    }\n    else {\n        return Field(order, { isLE });\n    }\n}\n/**\n * Validates basic CURVE shape and field membership, then creates fields.\n * This does not prove that the generator is on-curve, that subgroup/order data are consistent, or\n * that the curve equation itself is otherwise sane.\n * @param type - Curve family.\n * @param CURVE - Curve parameters.\n * @param curveOpts - Optional field overrides. See {@link FpFn}:\n *   - `Fp` (optional): Optional base-field override.\n *   - `Fn` (optional): Optional scalar-field override.\n * @param FpFnLE - Whether field encoding is little-endian.\n * @returns Frozen curve parameters and fields.\n * @throws If the curve parameters or field overrides are invalid. {@link Error}\n * @example\n * Build curve fields from raw constants before constructing a curve instance.\n *\n * ```ts\n * const curve = createCurveFields('weierstrass', {\n *   p: 17n,\n *   n: 19n,\n *   h: 1n,\n *   a: 2n,\n *   b: 2n,\n *   Gx: 5n,\n *   Gy: 1n,\n * });\n * ```\n */\nexport function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {\n    if (type !== 'weierstrass' && type !== 'edwards')\n        throw new Error('expected curve type \"weierstrass\" or \"edwards\"');\n    if (FpFnLE === undefined)\n        FpFnLE = type === 'edwards';\n    if (!CURVE || typeof CURVE !== 'object')\n        throw new Error(`expected valid ${type} CURVE object`);\n    // Validate before reading Fp/Fn so explicit null fails with an options-object error.\n    validateObject(curveOpts);\n    for (const p of ['p', 'n', 'h']) {\n        const val = CURVE[p];\n        if (!(isPosBig(val) && val !== _0n))\n            throw new Error(`CURVE.${p} must be positive bigint`);\n    }\n    const Fp = createField(CURVE.p, curveOpts.Fp, FpFnLE);\n    const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);\n    const _b = type === 'weierstrass' ? 'b' : 'd';\n    const params = ['Gx', 'Gy', 'a', _b];\n    for (const p of params) {\n        // @ts-ignore\n        if (!Fp.isValid(CURVE[p]))\n            throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);\n    }\n    CURVE = Object.freeze(Object.assign({}, CURVE));\n    return { CURVE, Fp, Fn };\n}\n/**\n * @param randomSecretKey - Secret-key generator.\n * @param getPublicKey - Public-key derivation helper.\n * @returns Keypair generator.\n * @example\n * Build a `keygen()` helper from existing secret-key and public-key primitives.\n *\n * ```ts\n * import { createKeygen } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const keygen = createKeygen(p256.utils.randomSecretKey, p256.getPublicKey);\n * const pair = keygen();\n * ```\n */\nexport function createKeygen(randomSecretKey, getPublicKey) {\n    return function keygen(seed) {\n        const secretKey = randomSecretKey(seed);\n        return { secretKey, publicKey: getPublicKey(secretKey) };\n    };\n}\n","/**\n * HMAC: RFC2104 message authentication code.\n * @module\n */\nimport { abytes, aexists, ahash, aoutput, clean, } from \"./utils.js\";\n/**\n * Internal class for HMAC.\n * Accepts any byte key, although RFC 2104 §3 recommends keys at least\n * `HashLen` bytes long.\n */\nexport class _HMAC {\n    oHash;\n    iHash;\n    blockLen;\n    outputLen;\n    canXOF = false;\n    finished = false;\n    destroyed = false;\n    constructor(hash, key) {\n        ahash(hash);\n        abytes(key, undefined, 'key');\n        this.iHash = hash.create();\n        if (typeof this.iHash.update !== 'function')\n            throw new Error('expected Hash instance');\n        this.blockLen = this.iHash.blockLen;\n        this.outputLen = this.iHash.outputLen;\n        const blockLen = this.blockLen;\n        const pad = new Uint8Array(blockLen);\n        // blockLen can be bigger than outputLen\n        pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36;\n        this.iHash.update(pad);\n        // By doing update (processing of the first block) of the outer hash here,\n        // we can re-use it between multiple calls via clone.\n        this.oHash = hash.create();\n        // Undo internal XOR && apply outer XOR\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36 ^ 0x5c;\n        this.oHash.update(pad);\n        clean(pad);\n    }\n    update(buf) {\n        aexists(this);\n        this.iHash.update(buf);\n        return this;\n    }\n    digestInto(out) {\n        aexists(this);\n        aoutput(out, this);\n        this.finished = true;\n        const buf = out.subarray(0, this.outputLen);\n        // Reuse the first outputLen bytes for the inner digest; the outer hash consumes them before\n        // overwriting that same prefix with the final tag, leaving any oversized tail untouched.\n        this.iHash.digestInto(buf);\n        this.oHash.update(buf);\n        this.oHash.digestInto(buf);\n        this.destroy();\n    }\n    digest() {\n        const out = new Uint8Array(this.oHash.outputLen);\n        this.digestInto(out);\n        return out;\n    }\n    _cloneInto(to) {\n        // Create new instance without calling constructor since the key\n        // is already in state and we don't know it.\n        to ||= Object.create(Object.getPrototypeOf(this), {});\n        const { oHash, iHash, finished, destroyed, blockLen, outputLen, canXOF } = this;\n        to = to;\n        to.finished = finished;\n        to.destroyed = destroyed;\n        to.blockLen = blockLen;\n        to.outputLen = outputLen;\n        to.canXOF = canXOF;\n        to.oHash = oHash._cloneInto(to.oHash);\n        to.iHash = iHash._cloneInto(to.iHash);\n        return to;\n    }\n    clone() {\n        return this._cloneInto();\n    }\n    destroy() {\n        this.destroyed = true;\n        this.oHash.destroy();\n        this.iHash.destroy();\n    }\n}\nexport const hmac = /* @__PURE__ */ (() => {\n    const hmac_ = ((hash, key, message) => new _HMAC(hash, key).update(message).digest());\n    hmac_.create = (hash, key) => new _HMAC(hash, key);\n    return hmac_;\n})();\n","/**\n * ASN.1 DER (Distinguished Encoding Rules) helpers for ECDSA signatures.\n * Only implements the tiny subset needed for `SEQUENCE(INTEGER r, INTEGER s)`.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { abignumber, abytes, asafenumber, astring, bytesToNumberBE, numberToHexUnpadded, validateObject, } from \"../utils.js\";\nconst _0n = /* @__PURE__ */ BigInt(0);\n/**\n * @param m - Error message.\n * @example\n * Throw a DER-specific error when signature parsing encounters invalid bytes.\n *\n * ```ts\n * new DERErr('bad der');\n * ```\n */\nexport class DERErr extends Error {\n    constructor(m = '') {\n        super(m);\n    }\n}\n// Plain const so the freezes can live inside the pure initializer of the `DER` export below:\n// bare top-level `Object.freeze(...)` calls would defeat tree-shaking for every importer.\nconst _DER = {\n    // asn.1 DER encoding utils\n    Err: DERErr,\n    // Basic building block is TLV (Tag-Length-Value)\n    _tlv: {\n        encode: (tag, data) => {\n            const { Err: E } = _DER;\n            asafenumber(tag, 'tag');\n            if (tag < 0 || tag > 255)\n                throw new E('tlv.encode: wrong tag');\n            astring(data, 'data');\n            // Internal helper: callers hand this already-validated hex payload, so we only enforce\n            // byte alignment here instead of re-validating every nibble.\n            if (data.length & 1)\n                throw new E('tlv.encode: unpadded data');\n            const dataLen = data.length / 2;\n            const len = numberToHexUnpadded(dataLen);\n            if ((len.length / 2) & 0b1000_0000)\n                throw new E('tlv.encode: long form length too big');\n            // length of length with long form flag\n            const lenLen = dataLen > 127 ? numberToHexUnpadded((len.length / 2) | 0b1000_0000) : '';\n            const t = numberToHexUnpadded(tag);\n            return t + lenLen + len + data;\n        },\n        // v - value, l - left bytes (unparsed)\n        decode(tag, data) {\n            const { Err: E } = _DER;\n            data = abytes(data, undefined, 'DER data');\n            let pos = 0;\n            if (tag < 0 || tag > 255)\n                throw new E('tlv.decode: wrong tag');\n            if (data.length < 2 || data[pos++] !== tag)\n                throw new E('tlv.decode: wrong tlv');\n            const first = data[pos++];\n            // First bit of first length byte is the short/long form flag.\n            const isLong = !!(first & 0b1000_0000);\n            let length = 0;\n            if (!isLong)\n                length = first;\n            else {\n                // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]\n                const lenLen = first & 0b0111_1111;\n                if (!lenLen)\n                    throw new E('tlv.decode(long): indefinite length not supported');\n                // This would overflow u32 in JS.\n                if (lenLen > 4)\n                    throw new E('tlv.decode(long): byte length is too big');\n                const lengthBytes = data.subarray(pos, pos + lenLen);\n                if (lengthBytes.length !== lenLen)\n                    throw new E('tlv.decode: length bytes not complete');\n                if (lengthBytes[0] === 0)\n                    throw new E('tlv.decode(long): zero leftmost byte');\n                for (const b of lengthBytes)\n                    length = (length << 8) | b;\n                pos += lenLen;\n                if (length < 128)\n                    throw new E('tlv.decode(long): not minimal encoding');\n            }\n            const v = data.subarray(pos, pos + length);\n            if (v.length !== length)\n                throw new E('tlv.decode: wrong value length');\n            return { v, l: data.subarray(pos + length) };\n        },\n    },\n    // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,\n    // since we always use positive integers here. It must always be empty:\n    // - add zero byte if exists\n    // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)\n    _int: {\n        encode(num) {\n            const { Err: E } = _DER;\n            abignumber(num);\n            if (num < _0n)\n                throw new E('integer: negative integers are not allowed');\n            let hex = numberToHexUnpadded(num);\n            // Pad with zero byte if negative flag is present\n            if (Number.parseInt(hex[0], 16) & 0b1000)\n                hex = '00' + hex;\n            if (hex.length & 1)\n                throw new E('unexpected DER parsing assertion: unpadded hex');\n            return hex;\n        },\n        decode(data) {\n            const { Err: E } = _DER;\n            if (data.length < 1)\n                throw new E('invalid signature integer: empty');\n            if (data[0] & 0b1000_0000)\n                throw new E('invalid signature integer: negative');\n            // Single-byte zero `00` is the canonical DER INTEGER encoding for zero.\n            if (data.length > 1 && data[0] === 0x00 && !(data[1] & 0b1000_0000))\n                throw new E('invalid signature integer: unnecessary leading zero');\n            return bytesToNumberBE(data);\n        },\n    },\n    toSig(bytes, maxScalarBytes) {\n        // parse DER signature\n        const { Err: E, _int: int, _tlv: tlv } = _DER;\n        if (maxScalarBytes !== undefined) {\n            asafenumber(maxScalarBytes, 'maxScalarBytes');\n            if (maxScalarBytes < 1)\n                throw new E('invalid signature: maxScalarBytes must be positive');\n        }\n        const data = abytes(bytes, undefined, 'signature');\n        const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);\n        if (seqLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        const { v: rBytes, l: rLeftBytes } = tlv.decode(0x02, seqBytes);\n        const { v: sBytes, l: sLeftBytes } = tlv.decode(0x02, rLeftBytes);\n        if (sLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        // Enforce curve-provided bounds before bytes-to-hex-to-BigInt conversion can amplify memory.\n        if (maxScalarBytes !== undefined &&\n            (rBytes.length > maxScalarBytes || sBytes.length > maxScalarBytes))\n            throw new E('invalid signature: integer too large');\n        return { r: int.decode(rBytes), s: int.decode(sBytes) };\n    },\n    hexFromSig(sig) {\n        const { _tlv: tlv, _int: int } = _DER;\n        validateObject(sig, { r: 'bigint', s: 'bigint' }, {}, 'sig');\n        const rs = tlv.encode(0x02, int.encode(sig.r));\n        const ss = tlv.encode(0x02, int.encode(sig.s));\n        const seq = rs + ss;\n        return tlv.encode(0x30, seq);\n    },\n};\n/**\n * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:\n *\n *     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]\n *\n * Docs: {@link https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/ | Let's Encrypt ASN.1 guide} and\n * {@link https://luca.ntop.org/Teaching/Appunti/asn1.html | Luca Deri's ASN.1 notes}.\n * @example\n * ASN.1 DER encoding utilities.\n *\n * ```ts\n * const der = DER.hexFromSig({ r: 1n, s: 2n });\n * ```\n */\nexport const DER = /* @__PURE__ */ (() => {\n    Object.freeze(_DER._tlv);\n    Object.freeze(_DER._int);\n    return Object.freeze(_DER);\n})();\n","/**\n * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.\n *\n * ### Design rationale for types\n *\n * * Interaction between classes from different curves should fail:\n *   `k256.Point.BASE.add(p256.Point.BASE)`\n * * For this purpose we want to use `instanceof` operator, which is fast and works during runtime\n * * Different calls of `curve()` would return different classes -\n *   `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,\n *   it won't affect others\n *\n * TypeScript can't infer types for classes created inside a function. Classes is one instance\n * of nominative types in TypeScript and interfaces only check for shape, so it's hard to create\n * unique type for every function call.\n *\n * We can use generic types via some param, like curve opts, but that would:\n *     1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)\n *     which is hard to debug.\n *     2. Params can be generic and we can't enforce them to be constant value:\n *     if somebody creates curve from non-constant params,\n *     it would be allowed to interact with other curves with non-constant params\n *\n * @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { hmac as nobleHmac } from '@noble/hashes/hmac.js';\nimport { ahash } from '@noble/hashes/utils.js';\nimport { abool, abytes, aInRange, bitLen, bitMask, bytesToHex, bytesToNumberBE, concatBytes, createHmacDrbg, hexToBytes, isBytes, validateObject, randomBytes as wcRandomBytes, } from \"../utils.js\";\nimport { createCurveFields, createKeygen, mulAddUnsafe, normalizeZ, probeRandomBytes, ScalarMultiplier, validatePointCons, } from \"./curve.js\";\nimport { DER } from \"./der.js\";\nimport { getMinHashLength, invertCt, mapHashToField } from \"./modular.js\";\n// DER codec lives in der.ts; re-exported here because ECDSA signatures are its main consumer.\nexport { DER, DERErr } from \"./der.js\";\n// We construct the basis so `den` is always positive and equals `n`,\n// but the `num` sign depends on the basis, not on the secret value.\n// Exact half-way cases round away from zero, which keeps the split symmetric\n// around the reduced-basis boundaries used by endomorphism decomposition.\nconst divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n) / den;\n/** Splits scalar for GLV endomorphism. */\nexport function _splitEndoScalar(k, basis, n) {\n    // Split scalar into two such that part is ~half bits: `abs(part) < sqrt(N)`\n    // Since part can be negative, we need to do this on point.\n    // Callers must provide a reduced GLV basis whose vectors satisfy\n    // `a + b * lambda ≡ 0 (mod n)`; this helper only sees the basis and `n`.\n    // Reject unreduced scalars instead of silently treating them mod n.\n    aInRange('scalar', k, _0n, n);\n    // TODO: verifyScalar function which consumes lambda\n    const [[a1, b1], [a2, b2]] = basis;\n    const c1 = divNearest(b2 * k, n);\n    const c2 = divNearest(-b1 * k, n);\n    // |k1|/|k2| is < sqrt(N), but can be negative.\n    // If we do `k1 mod N`, we'll get big scalar (`> sqrt(N)`): so, we do cheaper negation instead.\n    let k1 = k - c1 * a1 - c2 * a2;\n    let k2 = -c1 * b1 - c2 * b2;\n    const k1neg = k1 < _0n;\n    const k2neg = k2 < _0n;\n    if (k1neg)\n        k1 = -k1;\n    if (k2neg)\n        k2 = -k2;\n    // Double check that resulting scalar is less than half bits of N: the wNAF pair walk\n    // relies on the halves being short. This should only happen on wrong bases.\n    // Also, the math inside is complex enough that this guard is worth keeping.\n    const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n; // Half bits of N\n    if (k1 < _0n || k1 >= MAX_NUM || k2 < _0n || k2 >= MAX_NUM) {\n        throw new Error('splitScalar (endomorphism): failed for k');\n    }\n    return { k1neg, k1, k2neg, k2 };\n}\nfunction validateSigFormat(format) {\n    if (!['compact', 'recovered', 'der'].includes(format))\n        throw new Error('Signature format must be \"compact\", \"recovered\", or \"der\"');\n    return format;\n}\nfunction validateSigOpts(opts, def) {\n    validateObject(opts);\n    const optsn = {};\n    // Normalize only the declared option subset from `def`; unknown keys are\n    // intentionally ignored so shared / superset option bags stay valid here too.\n    // `extraEntropy` stays an opaque payload until the signing path consumes it.\n    for (let optName of Object.keys(def)) {\n        // @ts-ignore\n        optsn[optName] = opts[optName] === undefined ? def[optName] : opts[optName];\n    }\n    abool(optsn.lowS, 'lowS');\n    abool(optsn.prehash, 'prehash');\n    if (optsn.format !== undefined)\n        validateSigFormat(optsn.format);\n    return optsn;\n}\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _3n = /* @__PURE__ */ BigInt(3), _4n = /* @__PURE__ */ BigInt(4);\n/**\n * Creates weierstrass Point constructor, based on specified curve options.\n *\n * See {@link WeierstrassOpts}.\n * @param params - Curve parameters. See {@link WeierstrassOpts}.\n * @param extraOpts - Optional helpers and overrides. See {@link WeierstrassExtraOpts}.\n * @returns Weierstrass point constructor.\n * @throws If the curve parameters, overrides, or point codecs are invalid. {@link Error}\n *\n * @example\n * Construct a point type from explicit Weierstrass curve parameters.\n *\n * ```js\n * const opts = {\n *   p: 0xfffffffffffffffffffffffffffffffeffffac73n,\n *   n: 0x100000000000000000001b8fa16dfab9aca16b6b3n,\n *   h: 1n,\n *   a: 0n,\n *   b: 7n,\n *   Gx: 0x3b4c382ce37aa192a4019e763036f4f5dd4d7ebbn,\n *   Gy: 0x938cf935318fdced6bc28286531733c3f03c4feen,\n * };\n * const secp160k1_Point = weierstrass(opts);\n * ```\n */\nexport function weierstrass(params, extraOpts = {}) {\n    const validated = createCurveFields('weierstrass', params, extraOpts);\n    const Fp = validated.Fp;\n    const Fn = validated.Fn;\n    let CURVE = validated.CURVE;\n    const { h: cofactor, n: CURVE_ORDER } = CURVE;\n    validateObject(extraOpts, {}, {\n        allowInfinityPoint: 'boolean',\n        clearCofactor: 'function',\n        isTorsionFree: 'function',\n        fromBytes: 'function',\n        toBytes: 'function',\n        endo: 'object',\n        randomBytes: 'function',\n    });\n    // Snapshot every hook and take an owned copy of nested GLV configuration. Later mutations of\n    // the caller's options must not change arithmetic, subgroup, or codec policy.\n    const { endo: endoOpts, allowInfinityPoint, clearCofactor, isTorsionFree, fromBytes, toBytes, } = extraOpts;\n    const randomBytes = extraOpts.randomBytes === undefined ? wcRandomBytes : extraOpts.randomBytes;\n    if (endoOpts) {\n        if (!Fp.is0(CURVE.a) || typeof endoOpts.beta !== 'bigint' || !Array.isArray(endoOpts.basises)) {\n            throw new Error('invalid endo: expected \"beta\": bigint and \"basises\": array');\n        }\n    }\n    const endo = endoOpts\n        ? {\n            beta: endoOpts.beta,\n            basises: endoOpts.basises.map((basis) => [...basis]),\n        }\n        : undefined;\n    const lengths = getWLengths(Fp, Fn);\n    function assertCompressionIsSupported() {\n        if (!Fp.isOdd)\n            throw new Error('compression is not supported: Field does not have .isOdd()');\n    }\n    // Implements IEEE P1363 point encoding\n    function pointToBytes(_c, point, isCompressed) {\n        // Handle infinity before toAffine(), which maps ZERO to (0, 0) silently: without this the\n        // encoder would emit an all-zero byte string that decodes back as a different point. Only\n        // curves that opt into infinity as a public point value get the SEC 1 byte form.\n        if (point.is0()) {\n            if (!allowInfinityPoint)\n                throw new Error('bad point: ZERO');\n            return Uint8Array.of(0); // SEC 1 v2.0 §2.3.3\n        }\n        const { x, y } = point.toAffine();\n        const bx = Fp.toBytes(x);\n        abool(isCompressed, 'isCompressed');\n        if (isCompressed) {\n            assertCompressionIsSupported();\n            const hasEvenY = !Fp.isOdd(y);\n            return concatBytes(pprefix(hasEvenY), bx);\n        }\n        else {\n            return concatBytes(Uint8Array.of(0x04), bx, Fp.toBytes(y));\n        }\n    }\n    function pointFromBytes(bytes) {\n        abytes(bytes, undefined, 'Point');\n        const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths; // e.g. for 32-byte: 33, 65\n        const length = bytes.length;\n        const head = bytes[0];\n        const tail = bytes.subarray(1);\n        // SEC 1 v2.0 §2.3.4 decodes 0x00 as infinity, but §3.2.2 rejects infinity as a public key.\n        // Leaving 0x00 undecodable by default makes that rejection structural rather than a check:\n        // callers reuse this parser as the strict key boundary, and infinity is simply not\n        // expressible. Curves where infinity is a real wire value opt into the codec instead.\n        // secp256k1 crosstests show OpenSSL raw point codecs accept 0x00 too.\n        if (allowInfinityPoint && length === 1 && head === 0x00)\n            return { x: Fp.ZERO, y: Fp.ZERO };\n        // No actual validation is done here: use .assertValidity()\n        if (length === comp && (head === 0x02 || head === 0x03)) {\n            const x = Fp.fromBytes(tail);\n            if (!Fp.isValid(x))\n                throw new Error('bad point: is not on curve, wrong x');\n            const y2 = weierstrassEquation(x); // y² = x³ + ax + b\n            let y;\n            try {\n                y = Fp.sqrt(y2); // y = y² ^ (p+1)/4\n            }\n            catch (sqrtError) {\n                const err = sqrtError instanceof Error ? ': ' + sqrtError.message : '';\n                throw new Error('bad point: is not on curve, sqrt error' + err);\n            }\n            assertCompressionIsSupported();\n            const evenY = Fp.isOdd(y);\n            const evenH = (head & 1) === 1; // ECDSA-specific\n            if (evenH !== evenY)\n                y = Fp.neg(y);\n            return { x, y };\n        }\n        else if (length === uncomp && head === 0x04) {\n            // TODO: more checks\n            const L = Fp.BYTES;\n            const x = Fp.fromBytes(tail.subarray(0, L));\n            const y = Fp.fromBytes(tail.subarray(L, L * 2));\n            if (!isValidXY(x, y))\n                throw new Error('bad point: is not on curve');\n            return { x, y };\n        }\n        else {\n            throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);\n        }\n    }\n    const encodePoint = toBytes === undefined ? pointToBytes : toBytes;\n    const decodePoint = fromBytes === undefined ? pointFromBytes : fromBytes;\n    // Hoisted from double() / add(): curve params never change after construction.\n    // Koblitz curves (a=0, e.g. secp256k1) skip the three a-multiplications per operation;\n    // the selection depends only on public curve constants.\n    const b3 = Fp.mul(CURVE.b, _3n);\n    const mulA = Fp.is0(CURVE.a) ? (_) => Fp.ZERO : (x) => Fp.mul(CURVE.a, x);\n    function weierstrassEquation(x) {\n        const x2 = Fp.sqr(x);\n        const x3 = Fp.mul(x2, x);\n        return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b); // x³ + a * x + b\n    }\n    // TODO: move top-level\n    /** Checks whether equation holds for given x, y: y² == x³ + ax + b */\n    function isValidXY(x, y) {\n        const left = Fp.sqr(y);\n        const right = weierstrassEquation(x); // x³ + ax + b\n        return Fp.eql(left, right);\n    }\n    // Keep constructor-time generator validation cheap: callers are responsible for supplying the\n    // correct prime-order base point, while eager subgroup checks here would slow heavy module imports.\n    // Test 1: equation y² = x³ + ax + b should work for generator point.\n    if (!isValidXY(CURVE.Gx, CURVE.Gy))\n        throw new Error('bad curve params: generator point');\n    // Test 2: discriminant Δ part should be non-zero: 4a³ + 27b² != 0.\n    // Guarantees curve is genus-1, smooth (non-singular).\n    const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);\n    const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));\n    if (Fp.is0(Fp.add(_4a3, _27b2)))\n        throw new Error('bad curve params: a or b');\n    /** Asserts coordinate is valid: 0 <= n < Fp.ORDER. */\n    function acoord(title, n, banZero = false) {\n        if (!Fp.isValid(n) || (banZero && Fp.is0(n)))\n            throw new Error(`bad point coordinate ${title}`);\n        // Extension-field elements are objects. Keep point coordinates detached from caller-owned\n        // objects so their mutation cannot invalidate cached on-curve / subgroup checks. Primitive\n        // field elements (bigints in shipped prime fields) are already immutable values.\n        return typeof n === 'object' && n !== null ? Fp.create(n) : n;\n    }\n    function aprjpoint(other) {\n        if (!(other instanceof Point))\n            throw new Error('Weierstrass Point expected');\n    }\n    function splitEndoScalarN(k) {\n        if (!endo || !endo.basises)\n            throw new Error('no endo');\n        return _splitEndoScalar(k, endo.basises, Fn.ORDER);\n    }\n    /**\n     * Appends a (point, scalar) pair to the inputs of a vartime wNAF walk\n     * ({@link mulAddUnsafe}). With GLV endomorphism the scalar is split into two half-width\n     * pairs against P and ψ(P) = (β⋅x, y), halving the walk's shared doubling chain;\n     * split signs fold into the points.\n     */\n    function pushWnafPair(points, scalars, p, k) {\n        if (!Fn.isValid(k))\n            throw new RangeError('invalid scalar: out of range'); // 0 is valid\n        if (endo) {\n            const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(k);\n            const psi = new Point(Fp.mul(p.X, endo.beta), p.Y, p.Z);\n            points.push(k1neg ? p.negate() : p, k2neg ? psi.negate() : psi);\n            scalars.push(k1, k2);\n        }\n        else {\n            points.push(p);\n            scalars.push(k);\n        }\n    }\n    // Successful assertValidity() results are cached: Point instances are frozen at construction,\n    // so on-curve + subgroup facts cannot change afterwards. Only success is cached — invalid\n    // points re-throw on every call. This matters most for pairing curves, where subgroup checks\n    // cost a scalar multiplication and the same instance is re-validated across layers\n    // (signature fromBytes, pairingBatch) or across repeated verifies with a cached public key.\n    const validityCache = new WeakSet();\n    /**\n     * Projective Point works in 3d / projective (homogeneous) coordinates:(X, Y, Z) ∋ (x=X/Z, y=Y/Z).\n     * Default Point works in 2d / affine coordinates: (x, y).\n     * We're doing calculations in projective, because its operations don't require costly inversion.\n     */\n    class Point {\n        static BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);\n        static ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO);\n        static Fp = Fp;\n        static Fn = Fn;\n        X;\n        Y;\n        Z;\n        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n        constructor(X, Y, Z) {\n            this.X = acoord('x', X);\n            // This is not just about ZERO / infinity: ambient curves can have real\n            // finite points with y=0. Those points are 2-torsion, so they cannot lie\n            // in the odd prime-order subgroups this point type is meant to represent.\n            this.Y = acoord('y', Y, true);\n            this.Z = acoord('z', Z);\n            Object.freeze(this);\n        }\n        static CURVE() {\n            return CURVE;\n        }\n        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n        static fromAffine(p) {\n            const { x, y } = p || {};\n            if (!p || !Fp.isValid(x) || !Fp.isValid(y))\n                throw new Error('invalid affine point');\n            if (p instanceof Point)\n                throw new Error('projective point not allowed');\n            // (0, 0) would've produced (0, 0, 1) - instead, we need (0, 1, 0)\n            if (Fp.is0(x) && Fp.is0(y))\n                return Point.ZERO;\n            return new Point(x, y, Fp.ONE);\n        }\n        static fromBytes(bytes) {\n            const P = Point.fromAffine(decodePoint(abytes(bytes, undefined, 'point')));\n            P.assertValidity();\n            return P;\n        }\n        static fromHex(hex) {\n            return Point.fromBytes(hexToBytes(hex));\n        }\n        get x() {\n            return this.toAffine().x;\n        }\n        get y() {\n            return this.toAffine().y;\n        }\n        /**\n         * @param isLazy - true will defer table computation until the first multiplication\n         */\n        precompute(windowSize = 6, isLazy = true) {\n            wnaf.setWindowSize(this, windowSize);\n            if (!isLazy)\n                this.multiply(_3n); // random number\n            return this;\n        }\n        // TODO: return `this`\n        /** A point on curve is valid if it conforms to equation. */\n        assertValidity() {\n            const p = this;\n            if (p.is0()) {\n                // (0, 1, 0) aka ZERO is invalid in most contexts.\n                // In BLS, ZERO can be serialized, so we allow it.\n                // Keep the accepted infinity encoding canonical: projective-equivalent (X, Y, 0) points\n                // like (1, 1, 0) compare equal to ZERO, but only (0, 1, 0) should pass this guard.\n                if (allowInfinityPoint && Fp.is0(p.X) && Fp.eql(p.Y, Fp.ONE) && Fp.is0(p.Z))\n                    return;\n                throw new Error('bad point: ZERO');\n            }\n            if (validityCache.has(p))\n                return;\n            // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`\n            const { x, y } = p.toAffine();\n            if (!Fp.isValid(x) || !Fp.isValid(y))\n                throw new Error('bad point: x or y not field elements');\n            if (!isValidXY(x, y))\n                throw new Error('bad point: equation left != right');\n            if (!p.isTorsionFree())\n                throw new Error('bad point: not in prime-order subgroup');\n            validityCache.add(p);\n        }\n        hasEvenY() {\n            const { y } = this.toAffine();\n            if (!Fp.isOdd)\n                throw new Error(\"Field doesn't support isOdd\");\n            return !Fp.isOdd(y);\n        }\n        /** Compare one point to another. */\n        equals(other) {\n            aprjpoint(other);\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            const { X: X2, Y: Y2, Z: Z2 } = other;\n            const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));\n            const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));\n            return U1 && U2;\n        }\n        /** Flips point to one corresponding to (x, -y) in Affine coordinates. */\n        negate() {\n            return new Point(this.X, Fp.neg(this.Y), this.Z);\n        }\n        // Renes-Costello-Batina exception-free doubling formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 3\n        // Cost: 8M + 3S + 3*a + 2*b3 + 15add.\n        double() {\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            let t0 = Fp.mul(X1, X1); // step 1\n            let t1 = Fp.mul(Y1, Y1);\n            let t2 = Fp.mul(Z1, Z1);\n            let t3 = Fp.mul(X1, Y1);\n            t3 = Fp.add(t3, t3); // step 5\n            Z3 = Fp.mul(X1, Z1);\n            Z3 = Fp.add(Z3, Z3);\n            X3 = mulA(Z3);\n            Y3 = Fp.mul(b3, t2);\n            Y3 = Fp.add(X3, Y3); // step 10\n            X3 = Fp.sub(t1, Y3);\n            Y3 = Fp.add(t1, Y3);\n            Y3 = Fp.mul(X3, Y3);\n            X3 = Fp.mul(t3, X3);\n            Z3 = Fp.mul(b3, Z3); // step 15\n            t2 = mulA(t2);\n            t3 = Fp.sub(t0, t2);\n            t3 = mulA(t3);\n            t3 = Fp.add(t3, Z3);\n            Z3 = Fp.add(t0, t0); // step 20\n            t0 = Fp.add(Z3, t0);\n            t0 = Fp.add(t0, t2);\n            t0 = Fp.mul(t0, t3);\n            Y3 = Fp.add(Y3, t0);\n            t2 = Fp.mul(Y1, Z1); // step 25\n            t2 = Fp.add(t2, t2);\n            t0 = Fp.mul(t2, t3);\n            X3 = Fp.sub(X3, t0);\n            Z3 = Fp.mul(t2, t1);\n            Z3 = Fp.add(Z3, Z3); // step 30\n            Z3 = Fp.add(Z3, Z3);\n            return new Point(X3, Y3, Z3);\n        }\n        // Renes-Costello-Batina exception-free addition formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 1\n        // Cost: 12M + 0S + 3*a + 3*b3 + 23add.\n        add(other) {\n            aprjpoint(other);\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            const { X: X2, Y: Y2, Z: Z2 } = other;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            let t0 = Fp.mul(X1, X2); // step 1\n            let t1 = Fp.mul(Y1, Y2);\n            let t2 = Fp.mul(Z1, Z2);\n            let t3 = Fp.add(X1, Y1);\n            let t4 = Fp.add(X2, Y2); // step 5\n            t3 = Fp.mul(t3, t4);\n            t4 = Fp.add(t0, t1);\n            t3 = Fp.sub(t3, t4);\n            t4 = Fp.add(X1, Z1);\n            let t5 = Fp.add(X2, Z2); // step 10\n            t4 = Fp.mul(t4, t5);\n            t5 = Fp.add(t0, t2);\n            t4 = Fp.sub(t4, t5);\n            t5 = Fp.add(Y1, Z1);\n            X3 = Fp.add(Y2, Z2); // step 15\n            t5 = Fp.mul(t5, X3);\n            X3 = Fp.add(t1, t2);\n            t5 = Fp.sub(t5, X3);\n            Z3 = mulA(t4);\n            X3 = Fp.mul(b3, t2); // step 20\n            Z3 = Fp.add(X3, Z3);\n            X3 = Fp.sub(t1, Z3);\n            Z3 = Fp.add(t1, Z3);\n            Y3 = Fp.mul(X3, Z3);\n            t1 = Fp.add(t0, t0); // step 25\n            t1 = Fp.add(t1, t0);\n            t2 = mulA(t2);\n            t4 = Fp.mul(b3, t4);\n            t1 = Fp.add(t1, t2);\n            t2 = Fp.sub(t0, t2); // step 30\n            t2 = mulA(t2);\n            t4 = Fp.add(t4, t2);\n            t0 = Fp.mul(t1, t4);\n            Y3 = Fp.add(Y3, t0);\n            t0 = Fp.mul(t5, t4); // step 35\n            X3 = Fp.mul(t3, X3);\n            X3 = Fp.sub(X3, t0);\n            t0 = Fp.mul(t3, t1);\n            Z3 = Fp.mul(t5, Z3);\n            Z3 = Fp.add(Z3, t0); // step 40\n            return new Point(X3, Y3, Z3);\n        }\n        subtract(other) {\n            // Validate before calling `negate()` so wrong inputs fail with the point guard\n            // instead of leaking a foreign `negate()` error.\n            aprjpoint(other);\n            return this.add(other.negate());\n        }\n        is0() {\n            return this.equals(Point.ZERO);\n        }\n        /**\n         * Constant time multiplication.\n         * Uses precomputed tables (signed fixed-window wNAF) when available.\n         * Uses scalar blinding and avoids endomorphism splitting in the secret-scalar path.\n         * @param scalar - by which the point would be multiplied\n         * @returns New point\n         */\n        multiply(scalar) {\n            // Keep the subgroup-scalar contract strict instead of reducing 0 / n to ZERO.\n            // In key/signature-style callers, those values usually mean broken hash/scalar plumbing,\n            // and failing closed is safer than silently producing the identity point.\n            if (!Fn.isValidNot0(scalar))\n                throw new RangeError('invalid scalar: out of range'); // 0 is invalid\n            const { p, f } = wnaf.mulSecret(this, scalar, cofactor, normalize);\n            return normalize([p, f])[0];\n        }\n        /**\n         * Non-constant-time multiplication. Uses width-4 wNAF with GLV endomorphism splitting\n         * when available (two half-width scalars sharing one halved doubling chain).\n         * It's faster, but should only be used when you don't care about\n         * an exposed secret key e.g. sig verification, which works over *public* keys.\n         */\n        multiplyUnsafe(scalar) {\n            const p = this;\n            const sc = scalar;\n            // Public-scalar callers may need 0, but n and larger values stay rejected here too.\n            // Reducing them mod n would turn bad caller input into an accidental identity point.\n            if (!Fn.isValid(sc))\n                throw new RangeError('invalid scalar: out of range'); // 0 is valid\n            if (sc === _0n || p.is0())\n                return Point.ZERO;\n            if (sc === _1n)\n                return p;\n            if (wnaf.hasWindowSize(this))\n                return wnaf.mulUnsafe(p, sc, normalize); // precomputes\n            const points = [];\n            const scalars = [];\n            pushWnafPair(points, scalars, p, sc);\n            return mulAddUnsafe(Point, points, scalars);\n        }\n        /**\n         * Non-constant-time double-scalar multiplication `a⋅this + b⋅other` (Strauss–Shamir).\n         * Both walks share one doubling chain via {@link mulAddUnsafe}, and GLV endomorphism\n         * (when available) halves the chain again by splitting each scalar into two half-width\n         * parts. Used by ECDSA verification and public-key recovery for `R = u1⋅G + u2⋅P`.\n         * Only for public scalars.\n         */\n        mulAddUnsafe(a, other, b) {\n            aprjpoint(other);\n            const points = [];\n            const scalars = [];\n            pushWnafPair(points, scalars, this, a);\n            pushWnafPair(points, scalars, other, b);\n            return mulAddUnsafe(Point, points, scalars);\n        }\n        /**\n         * Converts Projective point to affine (x, y) coordinates.\n         * (X, Y, Z) ∋ (x=X/Z, y=Y/Z).\n         * @param invertedZ - Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch\n         */\n        toAffine(invertedZ) {\n            const p = this;\n            let iz = invertedZ;\n            if (iz != null && !Fp.isValid(iz))\n                throw new RangeError('\"invertedZ\" expected valid field element');\n            const { X, Y, Z } = p;\n            // Fast-path for normalized points\n            if (Fp.eql(Z, Fp.ONE))\n                return { x: X, y: Y };\n            const is0 = p.is0();\n            // If invZ was 0, we return zero point. However we still want to execute\n            // all operations, so we replace invZ with a random number, 1.\n            if (iz == null)\n                iz = is0 ? Fp.ONE : Fp.inv(Z);\n            const x = Fp.mul(X, iz);\n            const y = Fp.mul(Y, iz);\n            const zz = Fp.mul(Z, iz);\n            if (is0)\n                return { x: Fp.ZERO, y: Fp.ZERO };\n            if (!Fp.eql(zz, Fp.ONE))\n                throw new Error('invZ was invalid');\n            return { x, y };\n        }\n        /**\n         * Checks whether Point is free of torsion elements (is in prime subgroup).\n         * Always torsion-free for cofactor=1 curves.\n         */\n        isTorsionFree() {\n            if (cofactor === _1n)\n                return true;\n            if (isTorsionFree)\n                return isTorsionFree(Point, this);\n            // unsafe() will use the uncached wNAF path internally, since CURVE_ORDER >= Fn.ORDER\n            return wnaf.mulUnsafe(this, CURVE_ORDER).is0();\n        }\n        clearCofactor() {\n            if (cofactor === _1n)\n                return this; // Fast-path\n            if (clearCofactor)\n                return clearCofactor(Point, this);\n            // Default fallback assumes the cofactor fits the usual subgroup-scalar\n            // multiplyUnsafe() contract. Curves with larger / structured cofactors\n            // should define a clearCofactor override anyway (e.g. psi/Frobenius maps).\n            return this.multiplyUnsafe(cofactor);\n        }\n        isSmallOrder() {\n            if (cofactor === _1n)\n                return this.is0(); // Fast-path\n            return this.clearCofactor().is0();\n        }\n        toBytes(isCompressed = true) {\n            abool(isCompressed, 'isCompressed');\n            // assertValidity() covers on-curve and subgroup membership. The encoder below repeats the\n            // infinity check rather than relying on this call, so it stays correct for any caller.\n            this.assertValidity();\n            return encodePoint(Point, this, isCompressed);\n        }\n        toHex(isCompressed = true) {\n            return bytesToHex(this.toBytes(isCompressed));\n        }\n        toString() {\n            return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;\n        }\n    }\n    const normalize = (points) => normalizeZ(Point, points);\n    const wnaf = new ScalarMultiplier(Point, randomBytes);\n    // Enable W=6 wNAF precomputes. Slows down first publicKey computation.\n    // Disable for tiny toy curves, with scalar fields < 6 bits.\n    if (wnaf.bits >= 6)\n        Point.BASE.precompute(6);\n    Object.freeze(Point.prototype);\n    Object.freeze(Point);\n    return Point;\n}\n// Points start with byte 0x02 when y is even; otherwise 0x03\nfunction pprefix(hasEvenY) {\n    return Uint8Array.of(hasEvenY ? 0x02 : 0x03);\n}\nfunction getWLengths(Fp, Fn) {\n    return {\n        secretKey: Fn.BYTES,\n        publicKey: 1 + Fp.BYTES,\n        publicKeyUncompressed: 1 + 2 * Fp.BYTES,\n        publicKeyHasPrefix: true,\n        // Raw compact `(r || s)` signature width; DER and recovered signatures use\n        // different lengths outside this helper.\n        signature: 2 * Fn.BYTES,\n    };\n}\n/**\n * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.\n * This helper ensures no signature functionality is present. Less code, smaller bundle size.\n * @param Point - Weierstrass point constructor.\n * @param ecdhOpts - Optional randomness helpers:\n *   - `randomBytes` (optional): Optional RNG override.\n * @returns ECDH helper namespace.\n * @example\n * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.\n *\n * ```ts\n * import { ecdh } from '@noble/curves/abstract/weierstrass.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const dh = ecdh(p256.Point);\n * const alice = dh.keygen();\n * const shared = dh.getSharedSecret(alice.secretKey, alice.publicKey);\n * ```\n */\nexport function ecdh(Point, ecdhOpts = {}) {\n    validatePointCons(Point);\n    const { Fn } = Point;\n    const randomBytes_ = ecdhOpts.randomBytes === undefined ? wcRandomBytes : ecdhOpts.randomBytes;\n    // Keep the advertised seed length aligned with mapHashToField(), which keeps a hard 16-byte\n    // minimum even on toy curves.\n    const lengths = Object.assign(getWLengths(Point.Fp, Fn), {\n        seed: Math.max(getMinHashLength(Fn.ORDER), 16),\n    });\n    function isValidSecretKey(secretKey) {\n        try {\n            const num = Fn.fromBytes(secretKey);\n            return Fn.isValidNot0(num);\n        }\n        catch (error) {\n            return false;\n        }\n    }\n    function isValidPublicKey(publicKey, isCompressed) {\n        const { publicKey: comp, publicKeyUncompressed } = lengths;\n        try {\n            const l = publicKey.length;\n            if (isCompressed === true && l !== comp)\n                return false;\n            if (isCompressed === false && l !== publicKeyUncompressed)\n                return false;\n            // SEC 1 §3.2.2: the identity is never a valid public key, even on curves whose codec\n            // can decode it.\n            return !Point.fromBytes(publicKey).is0();\n        }\n        catch (error) {\n            return false;\n        }\n    }\n    /**\n     * Produces cryptographically secure secret key from random of size\n     * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.\n     */\n    function randomSecretKey(seed) {\n        seed = seed === undefined ? randomBytes_(lengths.seed) : seed;\n        return mapHashToField(abytes(seed, lengths.seed, 'seed'), Fn.ORDER);\n    }\n    /**\n     * Computes public key for a secret key. Checks for validity of the secret key.\n     * @param isCompressed - whether to return compact (default), or full key\n     * @returns Public key, full when isCompressed=false; short when isCompressed=true\n     */\n    function getPublicKey(secretKey, isCompressed = true) {\n        return Point.BASE.multiply(Fn.fromBytes(secretKey)).toBytes(isCompressed);\n    }\n    /**\n     * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.\n     */\n    function isProbPub(item) {\n        const { secretKey, publicKey, publicKeyUncompressed } = lengths;\n        const allowedLengths = Fn._lengths;\n        if (!isBytes(item))\n            return undefined;\n        const l = abytes(item, undefined, 'key').length;\n        const isPub = l === publicKey || l === publicKeyUncompressed;\n        const isSec = l === secretKey || !!allowedLengths?.includes(l);\n        // P-521 accepts both 65- and 66-byte secret keys, so overlapping lengths stay ambiguous.\n        if (isPub && isSec)\n            return undefined;\n        return isPub;\n    }\n    /**\n     * ECDH (Elliptic Curve Diffie Hellman).\n     * Computes encoded shared point from secret key A and public key B.\n     * Checks: 1) secret key validity 2) shared key is on-curve.\n     * Does NOT hash the result or expose the SEC 1 x-coordinate-only `z`.\n     * Returns the encoded shared point on purpose: callers that need `x_P`\n     * can derive it from the encoded point, but `x_P` alone cannot recover the\n     * point/parity back.\n     * This helper only exposes the fully validated public-key path, not cofactor DH.\n     * @param isCompressed - whether to return compact (default), or full key\n     * @returns shared point encoding\n     */\n    function getSharedSecret(secretKeyA, publicKeyB, isCompressed = true) {\n        if (isProbPub(secretKeyA) === true)\n            throw new Error('first arg must be private key');\n        if (isProbPub(publicKeyB) === false)\n            throw new Error('second arg must be public key');\n        const s = Fn.fromBytes(secretKeyA);\n        const b = Point.fromBytes(publicKeyB); // checks for being on-curve\n        if (b.is0())\n            throw new Error('invalid public key: point at infinity');\n        return b.multiply(s).toBytes(isCompressed);\n    }\n    const utils = {\n        isValidSecretKey,\n        isValidPublicKey,\n        randomSecretKey,\n    };\n    const keygen = createKeygen(randomSecretKey, getPublicKey);\n    Object.freeze(utils);\n    Object.freeze(lengths);\n    return Object.freeze({ getPublicKey, getSharedSecret, keygen, Point, utils, lengths });\n}\n/**\n * Creates ECDSA signing interface for given elliptic curve `Point` and `hash` function.\n *\n * @param Point - created using {@link weierstrass} function\n * @param hash - used for 1) message prehash-ing 2) k generation in `sign`, using hmac_drbg(hash)\n * @param ecdsaOpts - rarely needed, see {@link ECDSAOpts}:\n *   - `lowS`: Default low-S policy.\n *   - `hmac`: HMAC implementation used by RFC6979 DRBG.\n *   - `randomBytes`: Optional RNG override.\n *   - `bits2int`: Optional hash-to-int conversion override.\n *   - `bits2int_modN`: Optional hash-to-int-mod-n conversion override.\n *\n * @returns ECDSA helper namespace.\n * @example\n * Create an ECDSA signer/verifier bundle for one curve implementation.\n *\n * ```ts\n * import { ecdsa } from '@noble/curves/abstract/weierstrass.js';\n * import { p256 } from '@noble/curves/nist.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const p256ecdsa = ecdsa(p256.Point, sha256);\n * const { secretKey, publicKey } = p256ecdsa.keygen();\n * const msg = new TextEncoder().encode('hello noble');\n * const sig = p256ecdsa.sign(msg, secretKey);\n * const isValid = p256ecdsa.verify(sig, msg, publicKey);\n * ```\n */\nexport function ecdsa(Point, hash, ecdsaOpts = {}) {\n    validatePointCons(Point);\n    // Custom hash / bits2int hooks are treated as pure functions over validated caller-owned bytes.\n    const hash_ = hash;\n    ahash(hash_);\n    validateObject(ecdsaOpts, {}, {\n        hmac: 'function',\n        lowS: 'boolean',\n        randomBytes: 'function',\n        bits2int: 'function',\n        bits2int_modN: 'function',\n    });\n    const opts = Object.assign({}, ecdsaOpts);\n    const randomBytes = opts.randomBytes === undefined ? wcRandomBytes : opts.randomBytes;\n    const hmac = opts.hmac === undefined\n        ? (key, msg) => nobleHmac(hash_, key, msg)\n        : opts.hmac;\n    const { Fp, Fn } = Point;\n    const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;\n    // Nonce-inversion blinding in k2sig draws `getMinHashLength(n)` bytes per sign. Probe the RNG\n    // once (see {@link probeRandomBytes}, shared with ScalarMultiplier): in environments without\n    // working randomness, signing downgrades to Fermat inversion (invertCt) instead of throwing on\n    // every sign(). The shape of returned bytes is still validated (by mapHashToField) on every\n    // blinded call, where breakage fails closed.\n    const blindLength = getMinHashLength(CURVE_ORDER);\n    const csprng = probeRandomBytes(randomBytes, blindLength);\n    const { keygen, getPublicKey, getSharedSecret, utils, lengths } = ecdh(Point, opts);\n    const defaultSigOpts = {\n        prehash: true,\n        lowS: typeof opts.lowS === 'boolean' ? opts.lowS : true,\n        format: 'compact',\n        extraEntropy: false,\n    };\n    // SEC 1 4.1.6 public-key recovery tries x = r + jn for j = 0..h. Our recovered-signature\n    // format only stores one overflow bit, so it can only distinguish q.x = r from q.x = r + n.\n    // A third lift would have the form q.x = r + 2n. Since valid ECDSA r is in 1..n-1, the\n    // smallest such lift is 1 + 2n, not 2n.\n    const hasLargeRecoveryLifts = CURVE_ORDER * _2n + _1n < Fp.ORDER;\n    function isBiggerThanHalfOrder(number) {\n        const HALF = CURVE_ORDER >> _1n;\n        return number > HALF;\n    }\n    function validateRS(title, num) {\n        if (!Fn.isValidNot0(num))\n            throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);\n        return num;\n    }\n    function assertFieldSignIsSupported() {\n        if (!Fp.isOdd)\n            throw new Error(\"Field doesn't support isOdd\");\n    }\n    // Recovery id of an affine point (x, y) whose x reduces to signature `r` mod n:\n    // bit 0 = y parity, bit 1 = x overflowed the group order (x = r + n).\n    function getRecoveryBit(x, y, r) {\n        assertFieldSignIsSupported();\n        return (x === r ? 0 : 2) | Number(Fp.isOdd(y));\n    }\n    function assertRecoverableCurve() {\n        // ECDSA recovery only supports curves where the current recovery id can distinguish\n        // q.x = r and q.x = r + n; larger lifts may need additional `r + n*i` branches.\n        // SEC 1 4.1.6 recovers candidates via x = r + jn, but this format only encodes j = 0 or 1.\n        // The next possible candidate is q.x = r + 2n, and its smallest valid value is 1 + 2n.\n        // To easily get i, we either need to:\n        // a. increase amount of valid recid values (4, 5...); OR\n        // b. prohibit recovered signatures for those curves.\n        if (hasLargeRecoveryLifts)\n            throw new Error('\"recovered\" sig type is not supported for cofactor >2 curves');\n    }\n    function validateSigLength(bytes, format) {\n        validateSigFormat(format);\n        const size = lengths.signature;\n        const sizer = format === 'compact' ? size : format === 'recovered' ? size + 1 : undefined;\n        return abytes(bytes, sizer);\n    }\n    /**\n     * ECDSA signature with its (r, s) properties. Supports compact, recovered & DER representations.\n     */\n    class Signature {\n        r;\n        s;\n        recovery;\n        constructor(r, s, recovery) {\n            this.r = validateRS('r', r); // r in [1..N-1];\n            this.s = validateRS('s', s); // s in [1..N-1];\n            if (recovery != null) {\n                assertRecoverableCurve();\n                if (![0, 1, 2, 3].includes(recovery))\n                    throw new Error('invalid recovery id');\n                this.recovery = recovery;\n            }\n            Object.freeze(this);\n        }\n        static fromBytes(bytes, format = defaultSigOpts.format) {\n            validateSigLength(bytes, format);\n            let recid;\n            if (format === 'der') {\n                // Valid scalar INTEGERs use at most Fn.BYTES plus one DER sign-padding byte. Keep the\n                // total bound conservative so malformed inputs are rejected before parsing any INTEGER.\n                if (bytes.length > 2 * Fn.BYTES + 16)\n                    throw new DER.Err('invalid signature: DER signature too long');\n                const { r, s } = DER.toSig(abytes(bytes), Fn.BYTES + 1);\n                return new Signature(r, s);\n            }\n            if (format === 'recovered') {\n                recid = bytes[0];\n                format = 'compact';\n                bytes = bytes.subarray(1);\n            }\n            const L = lengths.signature / 2;\n            const r = bytes.subarray(0, L);\n            const s = bytes.subarray(L, L * 2);\n            return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);\n        }\n        static fromHex(hex, format) {\n            return this.fromBytes(hexToBytes(hex), format);\n        }\n        assertRecovery() {\n            const { recovery } = this;\n            if (recovery == null)\n                throw new Error('invalid recovery id: must be present');\n            return recovery;\n        }\n        addRecoveryBit(recovery) {\n            return new Signature(this.r, this.s, recovery);\n        }\n        // Unlike the top-level helper below, this method expects a digest that has\n        // already been hashed to the curve's message representative.\n        recoverPublicKey(messageHash) {\n            const { r, s } = this;\n            const recovery = this.assertRecovery();\n            const radj = recovery === 2 || recovery === 3 ? r + CURVE_ORDER : r;\n            if (!Fp.isValid(radj))\n                throw new Error('invalid recovery id: sig.r+curve.n != R.x');\n            const x = Fp.toBytes(radj);\n            const R = Point.fromBytes(concatBytes(pprefix((recovery & 1) === 0), x));\n            const ir = Fn.inv(radj); // r^-1\n            const h = bits2int_modN(abytes(messageHash, undefined, 'msgHash')); // Truncate hash\n            const u1 = Fn.create(-h * ir); // -hr^-1\n            const u2 = Fn.create(s * ir); // sr^-1\n            // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1). unsafe is fine: there is no private data.\n            const Q = Point.BASE.mulAddUnsafe(u1, R, u2);\n            if (Q.is0())\n                throw new Error('invalid recovery: point at infinify');\n            Q.assertValidity();\n            return Q;\n        }\n        // Signatures should be low-s, to prevent malleability.\n        hasHighS() {\n            return isBiggerThanHalfOrder(this.s);\n        }\n        toBytes(format = defaultSigOpts.format) {\n            validateSigFormat(format);\n            if (format === 'der')\n                return hexToBytes(DER.hexFromSig(this));\n            const { r, s } = this;\n            const rb = Fn.toBytes(r);\n            const sb = Fn.toBytes(s);\n            if (format === 'recovered') {\n                assertRecoverableCurve();\n                return concatBytes(Uint8Array.of(this.assertRecovery()), rb, sb);\n            }\n            return concatBytes(rb, sb);\n        }\n        toHex(format) {\n            return bytesToHex(this.toBytes(format));\n        }\n    }\n    Object.freeze(Signature.prototype);\n    Object.freeze(Signature);\n    // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.\n    // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.\n    // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.\n    // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors\n    const bits2int = opts.bits2int === undefined\n        ? function bits2int_def(bytes) {\n            // Our custom check \"just in case\", for protection against DoS\n            if (bytes.length > 8192)\n                throw new Error('input is too large');\n            // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)\n            // for some cases, since bytes.length * 8 is not actual bitLength.\n            const num = bytesToNumberBE(bytes); // check for == u8 done here\n            const delta = bytes.length * 8 - fnBits; // truncate to nBitLength leftmost bits\n            return delta > 0 ? num >> BigInt(delta) : num;\n        }\n        : opts.bits2int;\n    const bits2int_modN = opts.bits2int_modN === undefined\n        ? function bits2int_modN_def(bytes) {\n            return Fn.create(bits2int(bytes)); // can't use bytesToNumberBE here\n        }\n        : opts.bits2int_modN;\n    const ORDER_MASK = bitMask(fnBits);\n    // Pads output with zero as per spec.\n    /** Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`. */\n    function int2octets(num) {\n        aInRange('num < 2^' + fnBits, num, _0n, ORDER_MASK);\n        return Fn.toBytes(num);\n    }\n    function validateMsgAndHash(message, prehash) {\n        abytes(message, undefined, 'message');\n        return (prehash ? abytes(hash_(message), undefined, 'prehashed message') : message);\n    }\n    /**\n     * Steps A, D of RFC6979 3.2.\n     * Creates RFC6979 seed; converts msg/privKey to numbers.\n     * Used only in sign, not in verify.\n     *\n     * Warning: we cannot assume here that message has same amount of bytes as curve order,\n     * this will be invalid at least for P521. Also it can be bigger for P224 + SHA256.\n     */\n    function prepSig(message, secretKey, opts) {\n        const { lowS, prehash, extraEntropy } = validateSigOpts(opts, defaultSigOpts);\n        message = validateMsgAndHash(message, prehash); // RFC6979 3.2 A: h1 = H(m)\n        // We can't later call bits2octets, since nested bits2int is broken for curves\n        // with fnBits % 8 !== 0. Because of that, we unwrap it here as int2octets call.\n        // const bits2octets = (bits) => int2octets(bits2int_modN(bits))\n        const h1int = bits2int_modN(message);\n        const d = Fn.fromBytes(secretKey); // validate secret key, convert to bigint\n        if (!Fn.isValidNot0(d))\n            throw new Error('invalid private key');\n        const seedArgs = [int2octets(d), int2octets(h1int)];\n        // extraEntropy. RFC6979 3.6: additional k' (optional).\n        if (extraEntropy != null && extraEntropy !== false) {\n            // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')\n            // gen random bytes OR pass as-is\n            const e = extraEntropy === true ? randomBytes(lengths.secretKey) : extraEntropy;\n            seedArgs.push(abytes(e, undefined, 'extraEntropy')); // check for being bytes\n        }\n        const seed = concatBytes(...seedArgs); // Step D of RFC6979 3.2\n        const m = h1int; // no need to call bits2int second time here, it is inside truncateHash!\n        // Converts signature params into point w r/s, checks result for validity.\n        // To transform k => Signature:\n        // q = k⋅G\n        // r = q.x mod n\n        // s = k^-1(m + rd) mod n\n        // The nonce inversion is blinded: with random b ∈ [1,n−1], s = (bk)^-1(bm + bdr) per\n        // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. Fn.inv()'s extended-Euclidean\n        // loop count depends on its input (cf. Minerva), but here it only ever sees b·k — uniformly\n        // random, independent of k — so its timing reveals nothing about the nonce; b also masks d in\n        // the products. Without a CSPRNG (probed in ecdsa()) we fall back to Fermat inversion\n        // (invertCt), whose control flow is data-independent, at ~4x the inversion cost.\n        function k2sig(kBytes) {\n            // RFC 6979 Section 3.2, step 3: k = bits2int(T)\n            // Important: all mod() calls here must be done over N\n            const k = bits2int(kBytes); // Cannot use fields methods, since it is group element\n            if (!Fn.isValidNot0(k))\n                return; // Valid scalars (including k) must be in 1..N-1\n            const q = Point.BASE.multiply(k).toAffine(); // q = k⋅G\n            const r = Fn.create(q.x); // r = q.x mod n\n            if (r === _0n)\n                return;\n            let s;\n            if (csprng !== undefined) {\n                // mapHashToField maps 1.5x-order-length uniform bytes into [1, n-1], negligible bias.\n                const b = bytesToNumberBE(mapHashToField(csprng(blindLength), CURVE_ORDER));\n                const ibk = Fn.inv(Fn.mul(b, k)); // (bk)^-1: inversion input is decorrelated from k\n                const bm = Fn.mul(b, m);\n                const bd = Fn.mul(b, d);\n                s = Fn.create(ibk * Fn.create(bm + bd * r)); // s = (bk)^-1(bm + bdr) = k^-1(m + rd) mod n\n            }\n            else {\n                const ik = invertCt(k, CURVE_ORDER); // k^-1 mod n with data-independent control flow\n                s = Fn.create(ik * Fn.create(m + r * d)); // s = k^-1(m + rd) mod n\n            }\n            if (s === _0n)\n                return;\n            let recovery = getRecoveryBit(q.x, q.y, r); // recovery bit (2 or 3 when q.x>n)\n            let normS = s;\n            if (lowS && isBiggerThanHalfOrder(s)) {\n                normS = Fn.neg(s); // if lowS was passed, ensure s is always in the bottom half of N\n                recovery ^= 1;\n            }\n            return new Signature(r, normS, hasLargeRecoveryLifts ? undefined : recovery);\n        }\n        return { seed, k2sig };\n    }\n    /**\n     * Signs a message or message hash with a secret key.\n     * With the default `prehash: true`, raw message bytes are hashed internally;\n     * only `{ prehash: false }` expects a caller-supplied digest.\n     *\n     * ```\n     * sign(m, d) where\n     *   k = rfc6979_hmac_drbg(m, d)\n     *   (x, y) = G × k\n     *   r = x mod n\n     *   s = (m + dr) / k mod n\n     * ```\n     */\n    function sign(message, secretKey, opts = {}) {\n        const { seed, k2sig } = prepSig(message, secretKey, opts); // Steps A, D of RFC6979 3.2.\n        const drbg = createHmacDrbg(hash_.outputLen, Fn.BYTES, hmac);\n        const sig = drbg(seed, k2sig); // Steps B, C, D, E, F, G\n        return sig.toBytes(opts.format);\n    }\n    /**\n     * Verifies a signature against message and public key.\n     * Rejects lowS signatures by default: see {@link ECDSAVerifyOpts}.\n     * Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:\n     *\n     * ```\n     * verify(r, s, h, P) where\n     *   u1 = hs^-1 mod n\n     *   u2 = rs^-1 mod n\n     *   R = u1⋅G + u2⋅P\n     *   mod(R.x, n) == r\n     * ```\n     */\n    function verify(signature, message, publicKey, opts = {}) {\n        const { lowS, prehash, format } = validateSigOpts(opts, defaultSigOpts);\n        publicKey = abytes(publicKey, undefined, 'publicKey');\n        message = validateMsgAndHash(message, prehash);\n        if (!isBytes(signature)) {\n            const end = signature instanceof Signature ? ', use sig.toBytes()' : '';\n            throw new Error('verify expects Uint8Array signature' + end);\n        }\n        validateSigLength(signature, format); // execute this twice because we want loud error\n        try {\n            const sig = Signature.fromBytes(signature, format);\n            const P = Point.fromBytes(publicKey);\n            // SEC 1 verification keys must not be the identity, even when the generic point decoder\n            // permits infinity for another protocol (for example, a pairing curve).\n            if (P.is0())\n                return false;\n            if (lowS && sig.hasHighS())\n                return false;\n            const { r, s } = sig;\n            const h = bits2int_modN(message); // mod n, not mod p\n            const is = Fn.inv(s); // s^-1 mod n\n            const u1 = Fn.create(h * is); // u1 = hs^-1 mod n\n            const u2 = Fn.create(r * is); // u2 = rs^-1 mod n\n            const R = Point.BASE.mulAddUnsafe(u1, P, u2); // u1⋅G + u2⋅P, joint Strauss–Shamir\n            if (R.is0())\n                return false;\n            const q = R.toAffine();\n            const v = Fn.create(q.x); // v = R.x mod n\n            if (v !== r)\n                return false;\n            // R is the exact point `recoverPublicKey(r, recid)` reconstructs (sR = hG + rP),\n            // so binding the signature to its recovery id only needs R's parity/overflow bits.\n            if (format === 'recovered' && sig.recovery !== getRecoveryBit(q.x, q.y, r))\n                return false;\n            return true;\n        }\n        catch (e) {\n            return false;\n        }\n    }\n    function recoverPublicKey(signature, message, opts = {}) {\n        // Top-level recovery mirrors `sign()` / `verify()`: it hashes raw message\n        // bytes first unless the caller passes `{ prehash: false }`.\n        const { prehash } = validateSigOpts(opts, defaultSigOpts);\n        message = validateMsgAndHash(message, prehash);\n        return Signature.fromBytes(signature, 'recovered').recoverPublicKey(message).toBytes();\n    }\n    // utils.isValidPublicKey() already rejects the identity, so ECDSA needs no shadow copy.\n    return Object.freeze({\n        keygen,\n        getPublicKey,\n        getSharedSecret,\n        utils,\n        lengths,\n        Point,\n        sign,\n        verify,\n        recoverPublicKey,\n        Signature,\n        hash: hash_,\n    });\n}\n","/**\n * SECG secp256k1. See [pdf](https://www.secg.org/sec2-v2.pdf).\n *\n * Belongs to Koblitz curves: it has efficiently-computable GLV endomorphism ψ,\n * check out {@link EndomorphismOpts}. Seems to be rigid (not backdoored).\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha256 } from '@noble/hashes/sha2.js';\nimport { randomBytes } from '@noble/hashes/utils.js';\nimport { createKeygen } from \"./abstract/curve.js\";\nimport { createFROST, } from \"./abstract/frost.js\";\nimport { createHasher, isogenyMap, mapToCurveSimpleSWU, } from \"./abstract/hash-to-curve.js\";\nimport { Field, mapHashToField, pow2 } from \"./abstract/modular.js\";\nimport { ecdsa, weierstrass, } from \"./abstract/weierstrass.js\";\nimport { abytes, asciiToBytes, bytesToNumberBE, concatBytes, copyBytes, } from \"./utils.js\";\n// Seems like generator was produced from some seed:\n// `Pointk1.BASE.multiply(Pointk1.Fn.inv(2n, N)).toAffine().x`\n// // gives short x 0x3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63n\nconst secp256k1_CURVE = {\n    p: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f'),\n    n: BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141'),\n    h: BigInt(1),\n    a: BigInt(0),\n    b: BigInt(7),\n    Gx: BigInt('0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798'),\n    Gy: BigInt('0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8'),\n};\nconst secp256k1_ENDO = {\n    beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),\n    basises: [\n        [BigInt('0x3086d221a7d46bcde86c90e49284eb15'), -BigInt('0xe4437ed6010e88286f547fa90abfe4c3')],\n        [BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8'), BigInt('0x3086d221a7d46bcde86c90e49284eb15')],\n    ],\n};\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _2n = /* @__PURE__ */ BigInt(2);\n/**\n * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.\n * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]\n */\nfunction sqrtMod(y) {\n    const P = secp256k1_CURVE.p;\n    // prettier-ignore\n    const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);\n    // prettier-ignore\n    const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);\n    const b2 = (y * y * y) % P; // x^3, 11\n    const b3 = (b2 * b2 * y) % P; // x^7\n    const b6 = (pow2(b3, _3n, P) * b3) % P;\n    const b9 = (pow2(b6, _3n, P) * b3) % P;\n    const b11 = (pow2(b9, _2n, P) * b2) % P;\n    const b22 = (pow2(b11, _11n, P) * b11) % P;\n    const b44 = (pow2(b22, _22n, P) * b22) % P;\n    const b88 = (pow2(b44, _44n, P) * b44) % P;\n    const b176 = (pow2(b88, _88n, P) * b88) % P;\n    const b220 = (pow2(b176, _44n, P) * b44) % P;\n    const b223 = (pow2(b220, _3n, P) * b3) % P;\n    const t1 = (pow2(b223, _23n, P) * b22) % P;\n    const t2 = (pow2(t1, _6n, P) * b2) % P;\n    const root = pow2(t2, _2n, P);\n    if (!Fpk1.eql(Fpk1.sqr(root), y))\n        throw new Error('Cannot find square root');\n    return root;\n}\nconst Fpk1 = /* @__PURE__ */ Field(secp256k1_CURVE.p, { sqrt: sqrtMod });\nconst Pointk1 = /* @__PURE__ */ weierstrass(secp256k1_CURVE, {\n    Fp: Fpk1,\n    endo: secp256k1_ENDO,\n});\n/**\n * secp256k1 curve: ECDSA and ECDH methods.\n *\n * Uses sha256 to hash messages. To use a different hash,\n * pass `{ prehash: false }` to sign / verify.\n *\n * @example\n * Generate one secp256k1 keypair, sign a message, and verify it.\n *\n * ```js\n * import { secp256k1 } from '@noble/curves/secp256k1.js';\n * const { secretKey, publicKey } = secp256k1.keygen();\n * // const publicKey = secp256k1.getPublicKey(secretKey);\n * const msg = new TextEncoder().encode('hello noble');\n * const sig = secp256k1.sign(msg, secretKey);\n * const isValid = secp256k1.verify(sig, msg, publicKey);\n * // const sigKeccak = secp256k1.sign(keccak256(msg), secretKey, { prehash: false });\n * ```\n */\nexport const secp256k1 = /* @__PURE__ */ ecdsa(Pointk1, sha256);\n// Schnorr signatures are superior to ECDSA from above. Below is Schnorr-specific BIP0340 code.\n// https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\n/** An object mapping tags to their tagged hash prefix of [SHA256(tag) | SHA256(tag)] */\nconst TAGGED_HASH_PREFIXES = Object.create(null);\n// BIP-340 phrases tags as UTF-8, but all current standardized names here are 7-bit ASCII.\nfunction taggedHash(tag, ...messages) {\n    let tagP = TAGGED_HASH_PREFIXES[tag];\n    if (tagP === undefined) {\n        const tagH = sha256(asciiToBytes(tag));\n        tagP = concatBytes(tagH, tagH);\n        TAGGED_HASH_PREFIXES[tag] = tagP;\n    }\n    return sha256(concatBytes(tagP, ...messages));\n}\n// ECDSA compact points are 33-byte. Schnorr is 32: we strip first byte 0x02 or 0x03\nconst pointToBytes = (point) => point.toBytes(true).slice(1);\nconst affineXToBytes = ({ x }) => Fpk1.toBytes(x);\nconst hasEven = (y) => !Fpk1.isOdd(y);\n// Calculate point, scalar and bytes\nfunction schnorrGetExtPubKey(priv) {\n    const { Fn, BASE } = Pointk1;\n    const d_ = Fn.fromBytes(abytes(priv, 32, 'secretKey'));\n    const p = BASE.multiply(d_); // P = d'⋅G; 0 < d' < n check is done inside\n    const affine = p.toAffine();\n    const scalar = hasEven(affine.y) ? d_ : Fn.neg(d_);\n    return { scalar, bytes: affineXToBytes(affine) };\n}\n/**\n * lift_x from BIP340. Convert 32-byte x coordinate to elliptic curve point.\n * @returns valid point checked for being on-curve\n */\nfunction lift_x(x) {\n    const Fp = Fpk1;\n    if (!Fp.isValidNot0(x))\n        throw new Error('invalid x: Fail if x ≥ p');\n    const xx = Fp.sqr(x);\n    const c = Fp.add(Fp.mulN(xx, x), BigInt(7)); // Let c = x³ + 7 mod p.\n    let y = Fp.sqrt(c); // Let y = c^(p+1)/4 mod p. Same as sqrt().\n    // Return the unique point P such that x(P) = x and\n    // y(P) = y if y mod 2 = 0 or y(P) = p-y otherwise.\n    if (!hasEven(y))\n        y = Fp.neg(y);\n    const p = Pointk1.fromAffine({ x, y });\n    p.assertValidity();\n    return p;\n}\n// BIP-340 callers still need to supply canonical 32-byte inputs where required; this alias only\n// parses big-endian bytes and does not enforce the fixed-width contract itself.\nconst num = bytesToNumberBE;\n/** Create tagged hash, convert it to bigint, reduce modulo-n. */\nfunction challenge(...args) {\n    return Pointk1.Fn.create(num(taggedHash('BIP0340/challenge', ...args)));\n}\n/** Schnorr public key is just `x` coordinate of Point as per BIP340. */\nfunction schnorrGetPublicKey(secretKey) {\n    return schnorrGetExtPubKey(secretKey).bytes; // d'=int(sk). Fail if d'=0 or d'≥n. Ret bytes(d'⋅G)\n}\n/**\n * Creates Schnorr signature as per BIP340. Verifies itself before returning anything.\n * `auxRand` is optional and is not the sole source of `k` generation: bad CSPRNG output will not\n * be catastrophic, but BIP-340 still recommends fresh auxiliary randomness when available to harden\n * deterministic signing against side-channel and fault-injection attacks.\n */\nfunction schnorrSign(message, secretKey, auxRand = randomBytes(32)) {\n    const { Fn, BASE } = Pointk1;\n    // Snapshot once: nonce, challenge, and self-verification must use one transcript.\n    const m = copyBytes(abytes(message, undefined, 'message'));\n    const { bytes: px, scalar: d } = schnorrGetExtPubKey(secretKey); // checks for isWithinCurveOrder\n    const a = abytes(auxRand, 32, 'auxRand'); // Auxiliary random data a: a 32-byte array\n    // Let t be the byte-wise xor of bytes(d) and hash/aux(a).\n    const t = Fn.toBytes(d ^ num(taggedHash('BIP0340/aux', a)));\n    const rand = taggedHash('BIP0340/nonce', t, px, m); // Let rand = hash/nonce(t || bytes(P) || m)\n    // BIP340 defines k' = int(rand) mod n. We can't reuse schnorrGetExtPubKey(rand)\n    // here: that helper parses canonical secret keys and rejects rand >= n instead\n    // of reducing the nonce hash modulo the group order.\n    const k_ = Fn.create(num(rand));\n    // BIP-340: \"Let k' = int(rand) mod n. Fail if k' = 0. Let R = k'⋅G.\"\n    if (k_ === _0n)\n        throw new Error('sign failed: k is zero');\n    const p = BASE.multiply(k_); // Rejects zero; only the raw nonce hash needs reduction.\n    const affine = p.toAffine();\n    const k = hasEven(affine.y) ? k_ : Fn.neg(k_);\n    const rx = affineXToBytes(affine);\n    const e = challenge(rx, px, m); // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.\n    const sig = new Uint8Array(64); // Let sig = bytes(R) || bytes((k + ed) mod n).\n    sig.set(rx, 0);\n    sig.set(Fn.toBytes(Fn.create(k + e * d)), 32);\n    // If Verify(bytes(P), m, sig) (see below) returns failure, abort\n    if (!schnorrVerify(sig, m, px))\n        throw new Error('sign: Invalid signature produced');\n    return sig;\n}\n/**\n * Verifies Schnorr signature.\n * Will swallow errors & return false except for initial type validation of arguments.\n */\nfunction schnorrVerify(signature, message, publicKey) {\n    const { Fp, Fn, BASE } = Pointk1;\n    const sig = abytes(signature, 64, 'signature');\n    const m = abytes(message, undefined, 'message');\n    const pub = abytes(publicKey, 32, 'publicKey');\n    try {\n        const P = lift_x(num(pub)); // P = lift_x(int(pk)); fail if that fails\n        const rBytes = sig.subarray(0, 32);\n        const r = num(rBytes); // Let r = int(sig[0:32]); fail if r ≥ p.\n        if (!Fp.isValidNot0(r))\n            return false;\n        const s = num(sig.subarray(32, 64)); // Let s = int(sig[32:64]); fail if s ≥ n.\n        // Stricter than BIP-340/libsecp256k1, which only reject s >= n. Honest signing reaches\n        // s = 0 only with negligible probability (k + e*d ≡ 0 mod n), so treat zero-s inputs as\n        // crafted edge cases and fail closed instead of carrying that extra verification surface.\n        if (!Fn.isValidNot0(s))\n            return false;\n        // int(challenge(bytes(r) || bytes(P) || m)) % n\n        const e = challenge(rBytes, pointToBytes(P), m);\n        // R = s⋅G - e⋅P, where -eP == (n-e)P\n        const R = BASE.mulAddUnsafe(s, P, Fn.neg(e)); // s⋅G + (-e)⋅P, joint Strauss–Shamir\n        const { x, y } = R.toAffine();\n        // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.\n        if (R.is0() || !hasEven(y) || !Fp.eql(x, r))\n            return false;\n        return true;\n    }\n    catch (error) {\n        return false;\n    }\n}\nexport const __TEST = /* @__PURE__ */ Object.freeze({ lift_x, frostTweakPublic, frostTweakSecret });\n/**\n * Schnorr signatures over secp256k1.\n * See {@link https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki | BIP 340}.\n * @example\n * Generate one BIP340 Schnorr keypair, sign a message, and verify it.\n *\n * ```js\n * import { schnorr } from '@noble/curves/secp256k1.js';\n * const { secretKey, publicKey } = schnorr.keygen();\n * // const publicKey = schnorr.getPublicKey(secretKey);\n * const msg = new TextEncoder().encode('hello');\n * const sig = schnorr.sign(msg, secretKey);\n * const isValid = schnorr.verify(sig, msg, publicKey);\n * ```\n */\nexport const schnorr = /* @__PURE__ */ (() => {\n    const size = 32;\n    const seedLength = 48;\n    const randomSecretKey = (seed) => {\n        seed = seed === undefined ? randomBytes(seedLength) : seed;\n        return mapHashToField(abytes(seed, seedLength, 'seed'), secp256k1_CURVE.n);\n    };\n    return Object.freeze({\n        keygen: createKeygen(randomSecretKey, schnorrGetPublicKey),\n        getPublicKey: schnorrGetPublicKey,\n        sign: schnorrSign,\n        verify: schnorrVerify,\n        Point: Pointk1,\n        utils: Object.freeze({\n            randomSecretKey,\n            taggedHash,\n            lift_x,\n            pointToBytes,\n        }),\n        lengths: Object.freeze({\n            secretKey: size,\n            publicKey: size,\n            publicKeyHasPrefix: false,\n            signature: size * 2,\n            seed: seedLength,\n        }),\n    });\n})();\n// RFC 9380 Appendix E.1 3-isogeny coefficients for secp256k1, stored in ascending degree order.\n// The final `1` in each denominator array is the explicit monic leading term.\nconst isoMap = /* @__PURE__ */ (() => isogenyMap(Fpk1, [\n    // xNum\n    [\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7',\n        '0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581',\n        '0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262',\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c',\n    ],\n    // xDen\n    [\n        '0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b',\n        '0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n    // yNum\n    [\n        '0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c',\n        '0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3',\n        '0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931',\n        '0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84',\n    ],\n    // yDen\n    [\n        '0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b',\n        '0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573',\n        '0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n].map((i) => i.map((j) => BigInt(j)))))();\n// RFC 9380 §8.7 secp256k1 E' parameters for the SWU-to-isogeny pipeline below.\nlet mapSWU;\nconst getMapSWU = () => mapSWU ||\n    (mapSWU = mapToCurveSimpleSWU(Fpk1, {\n        // Building the SWU sqrt-ratio helper eagerly adds noticeable `secp256k1.js` import cost, so\n        // defer it to first use; after that the cached mapper is reused directly.\n        A: BigInt('0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533'),\n        B: BigInt('1771'),\n        Z: Fpk1.create(BigInt('-11')),\n    }));\n/**\n * Hashing / encoding to secp256k1 points / field. RFC 9380 methods.\n * @example\n * Hash one message onto secp256k1.\n *\n * ```ts\n * const point = secp256k1_hasher.hashToCurve(new TextEncoder().encode('hello noble'));\n * ```\n */\nexport const secp256k1_hasher = /* @__PURE__ */ (() => createHasher(Pointk1, (scalars) => {\n    const { x, y } = getMapSWU()(Fpk1.create(scalars[0]));\n    return isoMap(x, y);\n}, {\n    DST: 'secp256k1_XMD:SHA-256_SSWU_RO_',\n    encodeDST: 'secp256k1_XMD:SHA-256_SSWU_NU_',\n    p: Fpk1.ORDER,\n    m: 1,\n    k: 128,\n    expand: 'xmd',\n    hash: sha256,\n}))();\n/**\n * FROST threshold signatures over secp256k1. RFC 9591.\n * @example\n * Create one trusted-dealer package for 2-of-3 secp256k1 signing.\n *\n * ```ts\n * const alice = secp256k1_FROST.Identifier.derive('alice@example.com');\n * const bob = secp256k1_FROST.Identifier.derive('bob@example.com');\n * const carol = secp256k1_FROST.Identifier.derive('carol@example.com');\n * const deal = secp256k1_FROST.trustedDealer({ min: 2, max: 3 }, [alice, bob, carol]);\n * ```\n */\nexport const secp256k1_FROST = /* @__PURE__ */ (() => createFROST({\n    name: 'FROST-secp256k1-SHA256-v1',\n    Point: Pointk1,\n    hashToScalar: secp256k1_hasher.hashToScalar,\n    hash: sha256,\n}))();\n// Taproot utils\n// `undefined` means \"disable TapTweak entirely\"; callers that want the BIP-341/BIP-386 empty\n// merkle root must pass `new Uint8Array(0)` explicitly.\nfunction tweak(point, merkleRoot) {\n    if (merkleRoot === undefined)\n        return _0n;\n    const x = pointToBytes(point);\n    const t = bytesToNumberBE(taggedHash('TapTweak', x, merkleRoot));\n    // BIP-341 taproot_tweak_pubkey/taproot_tweak_seckey: \"if t >= SECP256K1_ORDER:\n    // raise ValueError\". TapTweak must reject overflow instead of reducing modulo n.\n    if (!Pointk1.Fn.isValid(t))\n        throw new Error('invalid TapTweak hash');\n    return t;\n}\nfunction frostPubToEvenY(pub) {\n    const VK = Pointk1.fromBytes(pub.commitments[0]);\n    // Keep aliasing on the already-even path so wrapper callers can skip unnecessary cloning.\n    if (hasEven(VK.y))\n        return pub;\n    return {\n        signers: { min: pub.signers.min, max: pub.signers.max },\n        commitments: pub.commitments.map((i) => Pointk1.fromBytes(i).negate().toBytes()),\n        verifyingShares: Object.fromEntries(Object.entries(pub.verifyingShares).map(([k, v]) => [\n            k,\n            Pointk1.fromBytes(v).negate().toBytes(),\n        ])),\n    };\n}\nfunction frostSecretToEvenY(s, pub) {\n    const VK = Pointk1.fromBytes(pub.commitments[0]);\n    // Keep aliasing on the already-even path so wrapper callers can preserve package identity.\n    if (hasEven(VK.y))\n        return s;\n    const Fn = Pointk1.Fn;\n    return {\n        ...s,\n        signingShare: Fn.toBytes(Fn.neg(Fn.fromBytes(s.signingShare))),\n    };\n}\nfunction frostNoncesToEvenY(groupCommitment, nonces) {\n    if (hasEven(groupCommitment.y))\n        return nonces;\n    const Fn = Pointk1.Fn;\n    return {\n        binding: Fn.toBytes(Fn.neg(Fn.fromBytes(nonces.binding))),\n        hiding: Fn.toBytes(Fn.neg(Fn.fromBytes(nonces.hiding))),\n    };\n}\nfunction frostTweakSecret(s, pub, merkleRoot) {\n    const Fn = Pointk1.Fn;\n    const keyPackage = frostSecretToEvenY(s, pub);\n    const evenPub = frostPubToEvenY(pub);\n    const t = tweak(Pointk1.fromBytes(evenPub.commitments[0]), merkleRoot);\n    const signingShare = Fn.toBytes(Fn.add(Fn.fromBytes(keyPackage.signingShare), t));\n    return {\n        identifier: keyPackage.identifier,\n        signingShare,\n    };\n}\nfunction frostTweakPublic(pub, merkleRoot) {\n    const PKPackage = frostPubToEvenY(pub);\n    const t = tweak(Pointk1.fromBytes(PKPackage.commitments[0]), merkleRoot);\n    // Disabled TapTweak (t=0): return the even-Y-normalized package as-is. multiply() rejects\n    // zero scalars, and adding [0]G would be a no-op anyway.\n    if (t === _0n)\n        return PKPackage;\n    const tp = Pointk1.BASE.multiply(t);\n    const commitments = PKPackage.commitments.map((c, i) => (i === 0 ? Pointk1.fromBytes(c).add(tp) : Pointk1.fromBytes(c)).toBytes());\n    const verifyingShares = {};\n    for (const k in PKPackage.verifyingShares) {\n        verifyingShares[k] = Pointk1.fromBytes(PKPackage.verifyingShares[k]).add(tp).toBytes();\n    }\n    return {\n        signers: { min: PKPackage.signers.min, max: PKPackage.signers.max },\n        commitments,\n        verifyingShares,\n    };\n}\n/**\n * FROST threshold signatures over secp256k1-schnorr-taproot. RFC 9591.\n * DKG outputs are auto-tweaked with the empty Taproot merkle root for compatibility, while\n * `trustedDealer()` outputs stay untweaked unless callers apply the Taproot tweak themselves.\n * @example\n * Create one trusted-dealer package for Taproot-compatible FROST signing.\n *\n * ```ts\n * const alice = schnorr_FROST.Identifier.derive('alice@example.com');\n * const bob = schnorr_FROST.Identifier.derive('bob@example.com');\n * const carol = schnorr_FROST.Identifier.derive('carol@example.com');\n * const deal = schnorr_FROST.trustedDealer({ min: 2, max: 3 }, [alice, bob, carol]);\n * ```\n */\nexport const schnorr_FROST = /* @__PURE__ */ (() => createFROST({\n    name: 'FROST-secp256k1-SHA256-TR-v1',\n    Point: Pointk1,\n    hashToScalar: secp256k1_hasher.hashToScalar,\n    hash: sha256,\n    // Taproot related hacks\n    parsePublicKey(publicKey) {\n        // External Taproot keys are x-only, but local key packages still use compressed points.\n        if (publicKey.length === 32)\n            return lift_x(bytesToNumberBE(publicKey));\n        if (publicKey.length === 33)\n            return Pointk1.fromBytes(publicKey);\n        throw new Error(`expected x-only or compressed public key, got length=${publicKey.length}`);\n    },\n    adjustScalar(n) {\n        const PK = Pointk1.BASE.multiply(n);\n        return hasEven(PK.y) ? n : Pointk1.Fn.neg(n);\n    },\n    adjustPoint: (p) => (hasEven(p.y) ? p : p.negate()),\n    challenge(R, PK, msg) {\n        return challenge(pointToBytes(R), pointToBytes(PK), msg);\n    },\n    adjustNonces: frostNoncesToEvenY,\n    adjustGroupCommitmentShare: (GC, GCShare) => (!hasEven(GC.y) ? GCShare.negate() : GCShare),\n    adjustPublic: frostPubToEvenY,\n    adjustSecret: frostSecretToEvenY,\n    adjustTx: {\n        // Compat with official implementation\n        encode: (tx) => tx.subarray(1),\n        decode: (tx) => concatBytes(Uint8Array.of(0x02), tx),\n    },\n    adjustDKG: (k) => {\n        // Compatibility with frost-secp256k1-tr: DKG output is auto-tweaked with the\n        // empty Taproot merkle root, while dealer-generated keys stay untweaked.\n        const merkleRoot = new Uint8Array(0);\n        return {\n            public: frostTweakPublic(k.public, merkleRoot),\n            secret: frostTweakSecret(k.secret, k.public, merkleRoot),\n        };\n    },\n}))();\n","'use strict';\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.bech32m = exports.bech32 = void 0;\nconst ALPHABET = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';\nconst ALPHABET_MAP = {};\nfor (let z = 0; z < ALPHABET.length; z++) {\n    const x = ALPHABET.charAt(z);\n    ALPHABET_MAP[x] = z;\n}\nfunction polymodStep(pre) {\n    const b = pre >> 25;\n    return (((pre & 0x1ffffff) << 5) ^\n        (-((b >> 0) & 1) & 0x3b6a57b2) ^\n        (-((b >> 1) & 1) & 0x26508e6d) ^\n        (-((b >> 2) & 1) & 0x1ea119fa) ^\n        (-((b >> 3) & 1) & 0x3d4233dd) ^\n        (-((b >> 4) & 1) & 0x2a1462b3));\n}\nfunction prefixChk(prefix) {\n    let chk = 1;\n    for (let i = 0; i < prefix.length; ++i) {\n        const c = prefix.charCodeAt(i);\n        if (c < 33 || c > 126)\n            return 'Invalid prefix (' + prefix + ')';\n        chk = polymodStep(chk) ^ (c >> 5);\n    }\n    chk = polymodStep(chk);\n    for (let i = 0; i < prefix.length; ++i) {\n        const v = prefix.charCodeAt(i);\n        chk = polymodStep(chk) ^ (v & 0x1f);\n    }\n    return chk;\n}\nfunction convert(data, inBits, outBits, pad) {\n    let value = 0;\n    let bits = 0;\n    const maxV = (1 << outBits) - 1;\n    const result = [];\n    for (let i = 0; i < data.length; ++i) {\n        value = (value << inBits) | data[i];\n        bits += inBits;\n        while (bits >= outBits) {\n            bits -= outBits;\n            result.push((value >> bits) & maxV);\n        }\n    }\n    if (pad) {\n        if (bits > 0) {\n            result.push((value << (outBits - bits)) & maxV);\n        }\n    }\n    else {\n        if (bits >= inBits)\n            return 'Excess padding';\n        if ((value << (outBits - bits)) & maxV)\n            return 'Non-zero padding';\n    }\n    return result;\n}\nfunction toWords(bytes) {\n    return convert(bytes, 8, 5, true);\n}\nfunction fromWordsUnsafe(words) {\n    const res = convert(words, 5, 8, false);\n    if (Array.isArray(res))\n        return res;\n}\nfunction fromWords(words) {\n    const res = convert(words, 5, 8, false);\n    if (Array.isArray(res))\n        return res;\n    throw new Error(res);\n}\nfunction getLibraryFromEncoding(encoding) {\n    let ENCODING_CONST;\n    if (encoding === 'bech32') {\n        ENCODING_CONST = 1;\n    }\n    else {\n        ENCODING_CONST = 0x2bc830a3;\n    }\n    function encode(prefix, words, LIMIT) {\n        LIMIT = LIMIT || 90;\n        if (prefix.length + 7 + words.length > LIMIT)\n            throw new TypeError('Exceeds length limit');\n        prefix = prefix.toLowerCase();\n        // determine chk mod\n        let chk = prefixChk(prefix);\n        if (typeof chk === 'string')\n            throw new Error(chk);\n        let result = prefix + '1';\n        for (let i = 0; i < words.length; ++i) {\n            const x = words[i];\n            if (x >> 5 !== 0)\n                throw new Error('Non 5-bit word');\n            chk = polymodStep(chk) ^ x;\n            result += ALPHABET.charAt(x);\n        }\n        for (let i = 0; i < 6; ++i) {\n            chk = polymodStep(chk);\n        }\n        chk ^= ENCODING_CONST;\n        for (let i = 0; i < 6; ++i) {\n            const v = (chk >> ((5 - i) * 5)) & 0x1f;\n            result += ALPHABET.charAt(v);\n        }\n        return result;\n    }\n    function __decode(str, LIMIT) {\n        LIMIT = LIMIT || 90;\n        if (str.length < 8)\n            return str + ' too short';\n        if (str.length > LIMIT)\n            return 'Exceeds length limit';\n        // don't allow mixed case\n        const lowered = str.toLowerCase();\n        const uppered = str.toUpperCase();\n        if (str !== lowered && str !== uppered)\n            return 'Mixed-case string ' + str;\n        str = lowered;\n        const split = str.lastIndexOf('1');\n        if (split === -1)\n            return 'No separator character for ' + str;\n        if (split === 0)\n            return 'Missing prefix for ' + str;\n        const prefix = str.slice(0, split);\n        const wordChars = str.slice(split + 1);\n        if (wordChars.length < 6)\n            return 'Data too short';\n        let chk = prefixChk(prefix);\n        if (typeof chk === 'string')\n            return chk;\n        const words = [];\n        for (let i = 0; i < wordChars.length; ++i) {\n            const c = wordChars.charAt(i);\n            const v = ALPHABET_MAP[c];\n            if (v === undefined)\n                return 'Unknown character ' + c;\n            chk = polymodStep(chk) ^ v;\n            // not in the checksum?\n            if (i + 6 >= wordChars.length)\n                continue;\n            words.push(v);\n        }\n        if (chk !== ENCODING_CONST)\n            return 'Invalid checksum for ' + str;\n        return { prefix, words };\n    }\n    function decodeUnsafe(str, LIMIT) {\n        const res = __decode(str, LIMIT);\n        if (typeof res === 'object')\n            return res;\n    }\n    function decode(str, LIMIT) {\n        const res = __decode(str, LIMIT);\n        if (typeof res === 'object')\n            return res;\n        throw new Error(res);\n    }\n    return {\n        decodeUnsafe,\n        decode,\n        encode,\n        toWords,\n        fromWordsUnsafe,\n        fromWords,\n    };\n}\nexports.bech32 = getLibraryFromEncoding('bech32');\nexports.bech32m = getLibraryFromEncoding('bech32m');\n","/**\n * Nostr cryptographic utilities\n *\n * Handles keypair generation, encryption/decryption of private keys,\n * signature verification, and bech32 encoding for Nostr authentication.\n */\n\nimport {\n  createCipheriv,\n  createDecipheriv,\n  createHash,\n  hkdfSync,\n  randomBytes,\n} from 'node:crypto';\nimport { schnorr, secp256k1 } from '@noble/curves/secp256k1.js';\nimport { bech32 } from 'bech32';\n\nexport interface NostrKeypair {\n  /** Hex-encoded public key (64 characters) */\n  pubkey: string;\n  /** Hex-encoded private key (64 characters) */\n  privkey: string;\n}\n\nexport interface EncryptedKey {\n  /** Base64-encoded ciphertext */\n  ciphertext: string;\n  /** Base64-encoded initialization vector */\n  iv: string;\n  /** Base64-encoded authentication tag */\n  tag: string;\n}\n\nexport interface NostrEvent {\n  id?: string;\n  pubkey: string;\n  created_at: number;\n  kind: number;\n  tags: string[][];\n  content: string;\n  sig?: string;\n}\n\n/**\n * Generate a new Nostr keypair (secp256k1)\n */\nexport function generateNostrKeypair(): NostrKeypair {\n  // Generate 32 random bytes for private key\n  const privkeyBytes = randomBytes(32);\n  const privkey = Buffer.from(privkeyBytes).toString('hex');\n\n  // Derive public key from private key\n  const pubkeyBytes = secp256k1.getPublicKey(privkeyBytes, true);\n  // Remove the prefix byte (02 or 03) for compressed public key\n  const pubkey = Buffer.from(pubkeyBytes.slice(1)).toString('hex');\n\n  return { pubkey, privkey };\n}\n\n/**\n * Derive an encryption key from the master secret using HKDF\n * @param masterSecret - Server master secret\n */\nexport function deriveEncryptionKey(masterSecret: string): Buffer {\n  const salt = Buffer.from('nostr-privkey-encryption', 'utf8');\n  const info = Buffer.from('aes-256-gcm', 'utf8');\n  const keyMaterial = Buffer.from(masterSecret, 'utf8');\n\n  return Buffer.from(hkdfSync('sha256', keyMaterial, salt, info, 32));\n}\n\n/**\n * Encrypt a private key using AES-256-GCM\n * @param privkey - Hex-encoded private key\n * @param masterSecret - Server master secret (from env)\n */\nexport function encryptPrivkey(\n  privkey: string,\n  masterSecret: string,\n): EncryptedKey {\n  const key = deriveEncryptionKey(masterSecret);\n  const iv = randomBytes(12); // 96-bit IV for GCM\n\n  const cipher = createCipheriv('aes-256-gcm', key, iv);\n  const encrypted = Buffer.concat([\n    cipher.update(privkey, 'utf8'),\n    cipher.final(),\n  ]);\n  const tag = cipher.getAuthTag();\n\n  return {\n    ciphertext: encrypted.toString('base64'),\n    iv: iv.toString('base64'),\n    tag: tag.toString('base64'),\n  };\n}\n\n/**\n * Decrypt a private key using AES-256-GCM\n * @param encrypted - Encrypted key data\n * @param masterSecret - Server master secret (from env)\n */\nexport function decryptPrivkey(\n  encrypted: EncryptedKey,\n  masterSecret: string,\n): string {\n  const key = deriveEncryptionKey(masterSecret);\n  const iv = Buffer.from(encrypted.iv, 'base64');\n  const tag = Buffer.from(encrypted.tag, 'base64');\n  const ciphertext = Buffer.from(encrypted.ciphertext, 'base64');\n\n  const decipher = createDecipheriv('aes-256-gcm', key, iv);\n  decipher.setAuthTag(tag);\n\n  const decrypted = Buffer.concat([\n    decipher.update(ciphertext),\n    decipher.final(),\n  ]);\n\n  return decrypted.toString('utf8');\n}\n\n/**\n * Compute the event ID (SHA-256 hash of serialized event)\n */\nexport function computeEventId(event: NostrEvent): string {\n  const serialized = JSON.stringify([\n    0,\n    event.pubkey,\n    event.created_at,\n    event.kind,\n    event.tags,\n    event.content,\n  ]);\n\n  return createHash('sha256').update(serialized).digest('hex');\n}\n\n/**\n * Sign a Nostr event using Schnorr signatures (BIP-340)\n * @param event - Event to sign (without id and sig)\n * @param privkey - Hex-encoded private key\n */\nexport function signEvent(\n  event: Omit<NostrEvent, 'id' | 'sig'>,\n  privkey: string,\n): NostrEvent {\n  const id = computeEventId(event as NostrEvent);\n  const privkeyBytes = Buffer.from(privkey, 'hex');\n  const idBytes = Buffer.from(id, 'hex');\n\n  // Use Schnorr signature (BIP-340) for Nostr\n  const sig = schnorr.sign(idBytes, privkeyBytes);\n  const sigHex = Buffer.from(sig).toString('hex');\n\n  return {\n    ...event,\n    id,\n    sig: sigHex,\n  };\n}\n\n/**\n * Verify a Nostr event Schnorr signature (BIP-340)\n * @param event - Nostr event object with sig field\n */\nexport function verifyNostrSignature(event: NostrEvent): boolean {\n  if (!event.id || !event.sig) {\n    return false;\n  }\n\n  // Verify the event ID\n  const computedId = computeEventId(event);\n  if (computedId !== event.id) {\n    return false;\n  }\n\n  try {\n    const sigBytes = Buffer.from(event.sig, 'hex');\n    const idBytes = Buffer.from(event.id, 'hex');\n    // Nostr public keys are x-only (32 bytes) - use directly with Schnorr\n    const pubkeyBytes = Buffer.from(event.pubkey, 'hex');\n\n    return schnorr.verify(sigBytes, idBytes, pubkeyBytes);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Create a Nostr event for authentication (NIP-42 style)\n * @param privkey - Private key to sign with\n * @param challenge - Server challenge string\n * @param relay - Relay URL (optional)\n */\nexport function createAuthEvent(\n  privkey: string,\n  challenge: string,\n  relay?: string,\n): NostrEvent {\n  const privkeyBytes = Buffer.from(privkey, 'hex');\n  const pubkeyBytes = secp256k1.getPublicKey(privkeyBytes, true);\n  const pubkey = Buffer.from(pubkeyBytes.slice(1)).toString('hex');\n\n  const tags: string[][] = [['challenge', challenge]];\n  if (relay) {\n    tags.push(['relay', relay]);\n  }\n\n  const event: Omit<NostrEvent, 'id' | 'sig'> = {\n    pubkey,\n    created_at: Math.floor(Date.now() / 1000),\n    kind: 22242, // NIP-42 AUTH event kind\n    tags,\n    content: '',\n  };\n\n  return signEvent(event, privkey);\n}\n\n/**\n * Verify an authentication event\n * @param event - Auth event to verify\n * @param expectedChallenge - Expected challenge string\n * @param maxAgeSeconds - Maximum age of the event in seconds (default: 300 = 5 minutes)\n */\nexport function verifyAuthEvent(\n  event: NostrEvent,\n  expectedChallenge: string,\n  maxAgeSeconds: number = 300,\n): { valid: boolean; error?: string } {\n  // Check event kind\n  if (event.kind !== 22242) {\n    return { valid: false, error: 'Invalid event kind' };\n  }\n\n  // Check timestamp\n  const now = Math.floor(Date.now() / 1000);\n  const age = now - event.created_at;\n  if (age > maxAgeSeconds || age < -60) {\n    // Allow 60s clock skew in the future\n    return { valid: false, error: 'Event expired or too far in future' };\n  }\n\n  // Check challenge\n  const challengeTag = event.tags.find((t) => t[0] === 'challenge');\n  if (!challengeTag || challengeTag[1] !== expectedChallenge) {\n    return { valid: false, error: 'Challenge mismatch' };\n  }\n\n  // Verify signature\n  if (!verifyNostrSignature(event)) {\n    return { valid: false, error: 'Invalid signature' };\n  }\n\n  return { valid: true };\n}\n\n/**\n * Convert hex public key to npub (bech32)\n */\nexport function pubkeyToNpub(pubkey: string): string {\n  const words = bech32.toWords(Buffer.from(pubkey, 'hex'));\n  return bech32.encode('npub', words, 1000);\n}\n\n/**\n * Convert npub (bech32) to hex public key\n */\nexport function npubToPubkey(npub: string): string {\n  const { prefix, words } = bech32.decode(npub, 1000);\n  if (prefix !== 'npub') {\n    throw new Error('Invalid npub prefix');\n  }\n  return Buffer.from(bech32.fromWords(words)).toString('hex');\n}\n\n/**\n * Convert hex private key to nsec (bech32)\n */\nexport function privkeyToNsec(privkey: string): string {\n  const words = bech32.toWords(Buffer.from(privkey, 'hex'));\n  return bech32.encode('nsec', words, 1000);\n}\n\n/**\n * Convert nsec (bech32) to hex private key\n */\nexport function nsecToPrivkey(nsec: string): string {\n  const { prefix, words } = bech32.decode(nsec, 1000);\n  if (prefix !== 'nsec') {\n    throw new Error('Invalid nsec prefix');\n  }\n  return Buffer.from(bech32.fromWords(words)).toString('hex');\n}\n\n/**\n * Get public key from private key\n */\nexport function getPublicKey(privkey: string): string {\n  const privkeyBytes = Buffer.from(privkey, 'hex');\n  const pubkeyBytes = secp256k1.getPublicKey(privkeyBytes, true);\n  return Buffer.from(pubkeyBytes.slice(1)).toString('hex');\n}\n\n/**\n * Validate a hex-encoded public key\n */\nexport function isValidPubkey(pubkey: string): boolean {\n  if (!/^[0-9a-f]{64}$/i.test(pubkey)) {\n    return false;\n  }\n  try {\n    // Try to use it in a point multiplication\n    const fullPubkey = Buffer.from(`02${pubkey}`, 'hex');\n    secp256k1.Point.fromBytes(fullPubkey);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Validate a hex-encoded private key\n */\nexport function isValidPrivkey(privkey: string): boolean {\n  if (!/^[0-9a-f]{64}$/i.test(privkey)) {\n    return false;\n  }\n  try {\n    const privkeyBytes = Buffer.from(privkey, 'hex');\n    // Check if it's a valid scalar for secp256k1\n    secp256k1.getPublicKey(privkeyBytes);\n    return true;\n  } catch {\n    return false;\n  }\n}\n","/**\n * NostrIdentity - Links Nostr identity to Profile\n *\n * Stores the Nostr keypair with encrypted private key for custodial auth.\n * The private key is encrypted using AES-256-GCM with the SERVER_MASTER_SECRET.\n * The public key serves as the unique identifier for NIP-05 verification.\n */\n\nimport {\n  field,\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport {\n  decryptPrivkey,\n  type EncryptedKey,\n  privkeyToNsec,\n  pubkeyToNpub,\n} from '../auth/nostrCrypto';\nimport type { Profile } from './Profile';\n\nexport interface NostrIdentityOptions extends SmrtObjectOptions {\n  profileId?: string;\n  pubkey?: string;\n  encryptedPrivkey?: string;\n  encryptionIv?: string;\n  encryptionTag?: string;\n  email?: string;\n  nip05Username?: string;\n  lastUsedAt?: Date | null;\n  verifiedAt?: Date | null;\n}\n\n@smrt({\n  tableName: 'nostr_identities',\n  // Holds custodial private-key material (AES-256-GCM ciphertext, IV, auth\n  // tag). Never in the change feed (#2937).\n  sensitive: true,\n  api: { include: ['list', 'get'] }, // No create/update via API - only internal\n  mcp: { include: ['list', 'get'] },\n  cli: { include: ['list', 'get'] },\n})\nexport class NostrIdentity extends SmrtObject { static __smrtPackage__ = \"@happyvertical/smrt-profiles\";\n  /**\n   * Link to the Profile (Person, Organization, Bot)\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * Hex-encoded secp256k1 public key (64 characters).\n   *\n   * Indexed: `findByPubkey()` looks identities up by this column (#2364,\n   * epic #2382 finding A3).\n   */\n  @field({ indexed: true })\n  pubkey: string = '';\n\n  /**\n   * AES-256-GCM encrypted private key (base64-encoded ciphertext)\n   */\n  encryptedPrivkey: string = '';\n\n  /**\n   * Initialization vector for AES-GCM decryption (base64)\n   */\n  encryptionIv: string = '';\n\n  /**\n   * Authentication tag from AES-GCM (base64)\n   */\n  encryptionTag: string = '';\n\n  /**\n   * Email address associated with this identity\n   */\n  email: string = '';\n\n  /**\n   * Username for NIP-05 verification (e.g., \"alice\" for alice@domain.com)\n   */\n  nip05Username: string = '';\n\n  /**\n   * Last time this identity was used for authentication\n   */\n  lastUsedAt: Date | null = null;\n\n  /**\n   * When this identity was verified via magic link\n   */\n  verifiedAt: Date | null = null;\n\n  constructor(options: NostrIdentityOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.pubkey) this.pubkey = options.pubkey;\n    if (options.encryptedPrivkey)\n      this.encryptedPrivkey = options.encryptedPrivkey;\n    if (options.encryptionIv) this.encryptionIv = options.encryptionIv;\n    if (options.encryptionTag) this.encryptionTag = options.encryptionTag;\n    if (options.email) this.email = options.email;\n    if (options.nip05Username) this.nip05Username = options.nip05Username;\n    if (options.lastUsedAt !== undefined) this.lastUsedAt = options.lastUsedAt;\n    if (options.verifiedAt !== undefined) this.verifiedAt = options.verifiedAt;\n  }\n\n  /**\n   * Get the linked Profile\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Find identity by public key\n   */\n  static async findByPubkey(\n    pubkey: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<NostrIdentity | null> {\n    const { NostrIdentityCollection } = await import(\n      '../collections/NostrIdentityCollection'\n    );\n    const collection = await NostrIdentityCollection.create(options);\n    return await collection.findOne({\n      where: { pubkey },\n    });\n  }\n\n  /**\n   * Find identity by email\n   */\n  static async findByEmail(\n    email: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<NostrIdentity | null> {\n    const { NostrIdentityCollection } = await import(\n      '../collections/NostrIdentityCollection'\n    );\n    const collection = await NostrIdentityCollection.create(options);\n    return await collection.findOne({\n      where: { email: email.toLowerCase() },\n    });\n  }\n\n  /**\n   * Find identity by NIP-05 username\n   */\n  static async findByNip05(\n    username: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<NostrIdentity | null> {\n    const { NostrIdentityCollection } = await import(\n      '../collections/NostrIdentityCollection'\n    );\n    const collection = await NostrIdentityCollection.create(options);\n    return await collection.findOne({\n      where: { nip05Username: username.toLowerCase() },\n    });\n  }\n\n  /**\n   * Decrypt the private key using the server master secret\n   * @param masterSecret - SERVER_MASTER_SECRET from environment\n   * @returns Hex-encoded private key\n   */\n  decryptPrivkey(masterSecret: string): string {\n    const encrypted: EncryptedKey = {\n      ciphertext: this.encryptedPrivkey,\n      iv: this.encryptionIv,\n      tag: this.encryptionTag,\n    };\n    return decryptPrivkey(encrypted, masterSecret);\n  }\n\n  /**\n   * Get the full keypair (requires master secret)\n   * @param masterSecret - SERVER_MASTER_SECRET from environment\n   */\n  getKeypair(masterSecret: string): {\n    pubkey: string;\n    privkey: string;\n    npub: string;\n    nsec: string;\n  } {\n    const privkey = this.decryptPrivkey(masterSecret);\n    return {\n      pubkey: this.pubkey,\n      privkey,\n      npub: pubkeyToNpub(this.pubkey),\n      nsec: privkeyToNsec(privkey),\n    };\n  }\n\n  /**\n   * Record usage of this identity\n   */\n  async recordUsage(): Promise<void> {\n    for (let attempt = 0; attempt < 4; attempt += 1) {\n      if (this.isPersisted) await this.loadFromId();\n      this.lastUsedAt = new Date();\n      try {\n        await this.save();\n        return;\n      } catch (error) {\n        if (\n          attempt === 3 ||\n          !(\n            error instanceof Error &&\n            'code' in error &&\n            error.code === 'RUNTIME_REVISION_CONFLICT'\n          )\n        ) {\n          throw error;\n        }\n      }\n    }\n  }\n\n  /**\n   * Mark this identity as verified\n   */\n  async markVerified(): Promise<void> {\n    this.verifiedAt = new Date();\n    this.lastUsedAt = new Date();\n    await this.save();\n  }\n\n  /**\n   * Check if this identity is verified\n   */\n  isVerified(): boolean {\n    return this.verifiedAt !== null;\n  }\n\n  /**\n   * Get the NIP-05 identifier (username@domain)\n   * Note: Domain must be provided by the application\n   */\n  getNip05Identifier(domain: string): string {\n    const username = this.nip05Username || this.email.split('@')[0];\n    return `${username}@${domain}`;\n  }\n}\n"],"x_google_ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11],"mappings":";;;;;;;;;;;;;;;;AA2BA,IAAM,YAAY,MAAO,IAAI,KAAK,KAAM;AACxC,IAAM,YAAY,MAAM,MAAM;AAG9B,SAAS,cAAc,MAAM,YAAY,GAAG,MAAM;CAC9C,MAAM,IAAI,SAAS,CAAC;CACpB,MAAM,IAAI,SAAS,CAAC;CACpB,KAAK,UAAU,YAAY,OAAO,IAAI,GAAG,IAAI;CAC7C,KAAK,UAAU,aAAa,GAAG,OAAO,IAAI,GAAG,IAAI;AACrD;;;;;;;;;;;;;AC1BA,SAAgBA,UAAQ,GAAG;CAKvB,OAAQ,aAAa,cAChB,YAAY,OAAO,CAAC,KACjB,EAAE,YAAY,SAAS,gBACvB,uBAAuB,KACvB,EAAE,sBAAsB;AACpC;AAGA,IAAMC,YAAU,UAAW,QAAQ,IAAI,MAAM,MAAM;;;;;;;;;;;;;;AAcnD,SAAgBC,UAAQ,GAAG,QAAQ,IAAI;CACnC,IAAI,OAAO,MAAM,UACb,MAAM,IAAI,UAAUD,SAAO,KAAK,IAAI,0BAA0B,OAAO,CAAC;CAC1E,IAAI,CAAC,OAAO,cAAc,CAAC,KAAK,IAAI,GAChC,MAAM,IAAI,WAAWA,SAAO,KAAK,IAAI,gCAAgC,CAAC;CAC1E,OAAO;AACX;;;;;;;;;;;;;;;AAgCA,SAAgBE,SAAO,OAAO,QAAQ,QAAQ,IAAI;CAG9C,IAAIH,UAAQ,KAAK,MAAM,WAAW,KAAA,KAAa,MAAM,WAAW,SAC5D,OAAO;CAEX,IAAI,WAAW,KAAA,GACX,UAAQ,QAAQ,QAAQ;CAC5B,MAAM,QAAQA,UAAQ,KAAK;CAC3B,MAAM,QAAQ,WAAW,KAAA,IAAY,cAAc,WAAW;CAC9D,MAAM,MAAM,QAAQ,UAAU,MAAM,WAAW,QAAQ,OAAO;CAC9D,MAAM,UAAUC,SAAO,KAAK,IAAI,wBAAwB,QAAQ,WAAW;CAC3E,IAAI,CAAC,OACD,MAAM,IAAI,UAAU,OAAO;CAC/B,MAAM,IAAI,WAAW,OAAO;AAChC;;;;;;;;;;;;;;;AAgCA,SAAgB,MAAM,GAAG;CACrB,IAAI,OAAO,MAAM,cAAc,OAAO,EAAE,WAAW,YAC/C,MAAM,IAAI,UAAU,6CAA6C;CACrE,UAAQ,EAAE,SAAS;CACnB,UAAQ,EAAE,QAAQ;CAGlB,IAAI,EAAE,YAAY,KAAK,EAAE,WAAW,GAChC,MAAM,IAAI,MAAM,wCAAwC;AAChE;AACA,IAAMG,aAAW,OAAO,UAAU;CAC9B,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAClE,MAAM,IAAI,WAAW,UAAU,WAAW,KAAK,IAAI,MAAM,OAAO,+BAA+B,OAAO,KAAK;AACnH;AACA,IAAM,SAAS,OAAO,UAAU;CAC5B,UAAQ,OAAO,KAAK;CACpB,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,IAAI,UAAU,OAAO,aAAa,UAAU,MACxC,MAAM,IAAI,UAAU,IAAI,MAAM,wBAAwB;CAG1D,IAAI,OAAO,OAAO,OAAO,WAAW,GAChC,MAAM,IAAI,UAAU,IAAI,MAAM,2BAA2B;AACjE;;;;;;;;;;;;;;;AAeA,SAAgB,QAAQ,UAAU,gBAAgB,MAAM;CAGpD,IAAI,SAAS,WACT,MAAM,IAAI,MAAM,oBAAoB;CACxC,IAAI,iBAAiB,SAAS,UAC1B,MAAM,IAAI,MAAM,6BAA6B;AACrD;;;;;;;;;;;;;;;;;AAiBA,SAAgB,QAAQ,KAAK,UAAU;CACnC,SAAO,KAAK,KAAA,GAAW,QAAQ;CAG/B,MAAM,MAAM,SAAS;CACrB,IAAI,EAAE,IAAI,UAAU,MAChB,MAAM,IAAI,WAAW,mCAAiC,GAAG;AAEjE;;;;;;;;;;AAsCA,SAAgB,MAAM,GAAG,QAAQ;CAC7B,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAC/B,OAAO,EAAE,CAAC,KAAK,CAAC;AAExB;;;;;;;;;;;AAWA,SAAgB,WAAW,KAAK;CAC5B,OAAO,IAAI,SAAS,IAAI,QAAQ,IAAI,YAAY,IAAI,UAAU;AAClE;;;;;;;;;;;;AAYA,SAAgB,KAAK,MAAM,OAAO;CAC9B,OAAQ,QAAS,KAAK,QAAW,SAAS;AAC9C;AA6EA,IAAM,gBAAgC,uBAEtC,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,cAAc,OAAO,WAAW,YAAY,WAAA,CAAY;AAE7F,IAAM,QAAwB,sBAAM,KAAK,EAAE,QAAQ,IAAI,IAAI,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;;;;;;;;;;;;;;AAcnG,SAAgBC,aAAW,OAAO;CAC9B,SAAO,KAAK;CAEZ,IAAI,eACA,OAAO,MAAM,MAAM;CAEvB,IAAI,MAAM;CACV,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAC9B,OAAO,MAAM,MAAM;CAEvB,OAAO;AACX;AAIA,SAAS,cAAc,IAAI;CACvB,OAAO,MAAM,MAAM,MAAM,KAAK,KAAK,KAC7B,MAAM,MAAM,MAAM,KAAK,KAAM,KACzB,MAAM,MAAM,MAAM,MAAM,KAAM,KAC1B,KAAA;AAClB;;;;;;;;;;;;;AAaA,SAAgBC,aAAW,KAAK;CAC5B,IAAI,OAAO,QAAQ,UACf,MAAM,IAAI,UAAU,8BAA8B,OAAO,GAAG;CAChE,IAAI,eACA,IAAI;EACA,OAAO,WAAW,QAAQ,GAAG;CACjC,SACO,OAAO;EACV,IAAI,iBAAiB,aACjB,MAAM,IAAI,WAAW,MAAM,OAAO;EACtC,MAAM;CACV;CAEJ,MAAM,KAAK,IAAI;CACf,MAAM,KAAK,KAAK;CAChB,IAAI,KAAK,GACL,MAAM,IAAI,WAAW,qDAAqD,EAAE;CAChF,MAAM,QAAQ,IAAI,WAAW,EAAE;CAC/B,KAAK,IAAI,KAAK,GAAG,KAAK,GAAG,KAAK,IAAI,MAAM,MAAM,GAAG;EAC7C,MAAM,KAAK,cAAc,IAAI,WAAW,EAAE,CAAC;EAC3C,MAAM,KAAK,cAAc,IAAI,WAAW,KAAK,CAAC,CAAC;EAC/C,IAAI,OAAO,KAAA,KAAa,OAAO,KAAA,GAAW;GACtC,MAAM,OAAO,IAAI,MAAM,IAAI,KAAK;GAChC,MAAM,IAAI,WAAW,kDAAiD,OAAO,iBAAgB,EAAE;EACnG;EACA,MAAM,MAAM,KAAK,KAAK;CAC1B;CACA,OAAO;AACX;;;;;;;;;;;;AAgHA,SAAgBC,cAAY,GAAG,QAAQ;CACnC,IAAI,MAAM;CACV,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;EACpC,MAAM,IAAI,OAAO;EACjB,SAAO,CAAC;EACR,OAAO,EAAE;CACb;CACA,MAAM,MAAM,IAAI,WAAW,GAAG;CAC9B,KAAK,IAAI,IAAI,GAAG,MAAM,GAAG,IAAI,OAAO,QAAQ,KAAK;EAC7C,MAAM,IAAI,OAAO;EACjB,IAAI,IAAI,GAAG,GAAG;EACd,OAAO,EAAE;CACb;CACA,OAAO;AACX;;;;;;;;;;;;;;AAsDA,SAAgB,UAAU,UAAU,MAAM,QAAQ,QAAQ;CACtD,MAAM,UAAU,UAAU;CAC1B,IAAI,SAAS,KAAA,GACT,MAAM,MAAM,KAAK;CAIrB,OADe,OAAO,OAAO,OAAO,OAAO,IAAI,GAAG,UAAU,IAChD;AAChB;;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,aAAa,UAAU,OAAO,CAAC,GAAG;CAC9C,IAAI,OAAO,aAAa,YACpB,MAAM,IAAI,UAAU,8CAA4C,OAAO,QAAQ;CACnF,OAAO,UAAU,CAAC,GAAG,MAAM,MAAM;CACjC,MAAM,SAAS,KAAK,SAAS,SAAS,IAAI,CAAC,CACtC,OAAO,GAAG,CAAC,CACX,OAAO;CACZ,MAAM,MAAM,SAAS,KAAA,CAAS;CAC9B,MAAM,YAAY,IAAI;CACtB,MAAM,WAAW,IAAI;CACrB,MAAM,SAAS,IAAI;CACnB,MAAM,UAAU,SAAS,SAAS,IAAI;CACtC,OAAO,OAAO,OAAO,IAAI;CACzB,OAAO,OAAO,OAAO,KAAK;AAC9B;;;;;;;;;;;;;;;;;AAiBA,SAAgBC,cAAY,cAAc,IAAI;CAE1C,UAAQ,aAAa,aAAa;CAClC,MAAM,KAAK,OAAO,eAAe,WAAW,WAAW,SAAS;CAChE,IAAI,OAAO,IAAI,oBAAoB,YAC/B,MAAM,IAAI,MAAM,wCAAwC;CAM5D,IAAI,cAAc,OACd,MAAM,IAAI,WAAW,wCAAwC,aAAa;CAC9E,OAAO,GAAG,gBAAgB,IAAI,WAAW,WAAW,CAAC;AACzD;;;;;;;;;;;;;AAaA,IAAa,WAAW,YAAY,EAGhC,KAAK,WAAW,KAAK;CAAC;CAAM;CAAM;CAAM;CAAM;CAAM;CAAM;CAAM;CAAM;CAAM;CAAM;AAAM,CAAC,EAC7F;;;;;;;;;;;;;;;;;;;;;;ACzpBA,SAAgB,IAAI,GAAG,GAAG,GAAG;CACzB,OAAQ,IAAI,IAAM,CAAC,IAAI;AAC3B;;;;;;;;;;;;;;AAcA,SAAgB,IAAI,GAAG,GAAG,GAAG;CACzB,OAAQ,IAAI,IAAM,IAAI,IAAM,IAAI;AACpC;;;;;;;;;;;;;;;;;;;AAmBA,IAAa,SAAb,MAAoB;CAChB;CACA;CACA,SAAS;CACT;CACA;CAEA;CACA;CACA,WAAW;CACX,SAAS;CACT,MAAM;CACN,YAAY;CACZ,YAAY,UAAU,WAAW,WAAW,MAAM;EAC9C,KAAK,WAAW;EAChB,KAAK,YAAY;EACjB,KAAK,YAAY;EACjB,KAAK,OAAO;EACZ,KAAK,SAAS,IAAI,WAAW,QAAQ;EACrC,KAAK,OAAO,WAAW,KAAK,MAAM;CACtC;CACA,OAAO,MAAM;EACT,QAAQ,IAAI;EACZ,SAAO,IAAI;EACX,MAAM,EAAE,MAAM,QAAQ,aAAa;EACnC,MAAM,MAAM,KAAK;EACjB,IAAI,YAAY;EAChB,KAAK,IAAI,MAAM,GAAG,MAAM,MAAM;GAC1B,MAAM,OAAO,KAAK,IAAI,WAAW,KAAK,KAAK,MAAM,GAAG;GAGpD,IAAI,SAAS,UAAU;IACnB,MAAM,WAAW,WAAW,IAAI;IAChC,OAAO,YAAY,MAAM,KAAK,OAAO,UACjC,KAAK,QAAQ,UAAU,GAAG;IAC9B,YAAY;IACZ;GACJ;GAGA,OAAO,IAAI,QAAQ,KAAK,SAAS,MAAM,OAAO,KAAK,SAAS,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG;GACtF,KAAK,OAAO;GACZ,OAAO;GACP,IAAI,KAAK,QAAQ,UAAU;IACvB,KAAK,QAAQ,MAAM,CAAC;IACpB,KAAK,MAAM;IACX,YAAY;GAChB;EACJ;EACA,KAAK,UAAU,KAAK;EAGpB,IAAI,WACA,KAAK,WAAW;EACpB,OAAO;CACX;CACA,WAAW,KAAK;EACZ,QAAQ,IAAI;EACZ,QAAQ,KAAK,IAAI;EACjB,KAAK,WAAW;EAIhB,MAAM,EAAE,QAAQ,MAAM,UAAU,SAAS;EACzC,IAAI,EAAE,QAAQ;EAEd,OAAO,SAAS;EAChB,OAAO,KAAK,GAAG,GAAG;EAGlB,IAAI,KAAK,YAAY,WAAW,KAAK;GACjC,KAAK,QAAQ,MAAM,CAAC;GACpB,OAAO,KAAK,CAAC;EACjB;EAKA,cAAc,MAAM,WAAW,GAAG,KAAK,SAAS,GAAG,IAAI;EACvD,KAAK,QAAQ,MAAM,CAAC;EAGpB,KAAK,WAAW;EAEhB,MAAM,QAAQ,QAAQ,SAAS,OAAO,WAAW,GAAG;EACpD,MAAM,MAAM,KAAK;EAEjB,MAAM,SAAS,MAAM;EACrB,MAAM,QAAQ,KAAK,IAAI;EAEvB,IAAI,MAAM,KAAK,SAAS,MAAM,QAC1B,MAAM,IAAI,MAAM,mBAAmB;EACvC,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,KACxB,MAAM,UAAU,IAAI,GAAG,MAAM,IAAI,IAAI;CAC7C;CACA,SAAS;EACL,MAAM,EAAE,QAAQ,cAAc;EAC9B,KAAK,WAAW,MAAM;EAGtB,MAAM,MAAM,OAAO,MAAM,GAAG,SAAS;EACrC,KAAK,QAAQ;EACb,OAAO;CACX;CACA,eAAe,IAAI;EACf,MAAM,EAAE,QAAQ,QAAQ,UAAU,WAAW,QAAQ;EACrD,GAAG,YAAY;EACf,GAAG,WAAW;EACd,GAAG,SAAS;EACZ,GAAG,MAAM;EAGT,IAAI,KACA,GAAG,OAAO,IAAI,MAAM;EACxB,OAAO;CACX;CACA,QAAQ;EACJ,OAAO,KAAK,WAAW;CAC3B;AACJ;;;;;;;;AAQA,IAAa,YAA4B,4BAAY,KAAK;CACtD;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;AACxF,CAAC;;;;;;;;;;;;;;AC5KD,IAAM,WAA2B,4BAAY,KAAK;CAC9C;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;AACxF,CAAC;;AAED,IAAM,2BAA2B,IAAI,YAAY,EAAE;;AAEnD,IAAM,WAAN,cAAuB,OAAO;CAK1B,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,YAAY,WAAW,IAAI;EACvB,MAAM,IAAI,WAAW,GAAG,KAAK;EAC7B,KAAK,IAAI,GAAG,KAAK;EACjB,KAAK,IAAI,GAAG,KAAK;EACjB,KAAK,IAAI,GAAG,KAAK;EACjB,KAAK,IAAI,GAAG,KAAK;EACjB,KAAK,IAAI,GAAG,KAAK;EACjB,KAAK,IAAI,GAAG,KAAK;EACjB,KAAK,IAAI,GAAG,KAAK;EACjB,KAAK,IAAI,GAAG,KAAK;CACrB;CACA,MAAM;EACF,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,MAAM;EACnC,OAAO;GAAC;GAAG;GAAG;GAAG;GAAG;GAAG;GAAG;GAAG;EAAC;CAClC;CAEA,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG;EACxB,KAAK,IAAI,IAAI;EACb,KAAK,IAAI,IAAI;EACb,KAAK,IAAI,IAAI;EACb,KAAK,IAAI,IAAI;EACb,KAAK,IAAI,IAAI;EACb,KAAK,IAAI,IAAI;EACb,KAAK,IAAI,IAAI;EACb,KAAK,IAAI,IAAI;CACjB;CACA,WAAW,IAAI;EACX,CAAC,OAAO,IAAI,KAAK,YAAY,EAAA,CAAG,IAAI,GAAG,KAAK,IAAI,CAAC;EACjD,OAAO,KAAK,eAAe,EAAE;CACjC;CACA,QAAQ,MAAM,QAAQ;EAElB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,UAAU,GACnC,SAAS,KAAK,KAAK,UAAU,QAAQ,KAAK;EAC9C,KAAK,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK;GAC1B,MAAM,MAAM,SAAS,IAAI;GACzB,MAAM,KAAK,SAAS,IAAI;GACxB,MAAM,KAAK,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,IAAK,QAAQ;GAEnD,SAAS,MADE,KAAK,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,IAAK,OAAO,MAC7B,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,MAAO;EACnE;EAEA,IAAI,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,MAAM;EACjC,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;GACzB,MAAM,SAAS,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE;GACpD,MAAM,KAAM,IAAI,SAAS,IAAI,GAAG,GAAG,CAAC,IAAI,SAAS,KAAK,SAAS,KAAM;GAErE,MAAM,MADS,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE,KAC/B,IAAI,GAAG,GAAG,CAAC,IAAK;GACrC,IAAI;GACJ,IAAI;GACJ,IAAI;GACJ,IAAK,IAAI,KAAM;GACf,IAAI;GACJ,IAAI;GACJ,IAAI;GACJ,IAAK,KAAK,KAAM;EACpB;EAEA,IAAK,IAAI,KAAK,IAAK;EACnB,IAAK,IAAI,KAAK,IAAK;EACnB,IAAK,IAAI,KAAK,IAAK;EACnB,IAAK,IAAI,KAAK,IAAK;EACnB,IAAK,IAAI,KAAK,IAAK;EACnB,IAAK,IAAI,KAAK,IAAK;EACnB,IAAK,IAAI,KAAK,IAAK;EACnB,IAAK,IAAI,KAAK,IAAK;EACnB,KAAK,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;CACnC;CACA,aAAa;EACT,MAAM,QAAQ;CAClB;CACA,UAAU;EAGN,KAAK,YAAY;EACjB,KAAK,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;EAC/B,MAAM,KAAK,MAAM;CACrB;AACJ;;AAEA,IAAa,UAAb,cAA6B,SAAS;CAClC,cAAc;EACV,MAAM,IAAI,SAAS;CACvB;AACJ;;;;;;;;;;;;;;;;;AA4PA,IAAa,SAAyB,mCAAmB,IAAI,QAAQ,GACrD,wBAAQ,CAAI,CAAC;;;;;;;;;;;;;;;;;;;;;ACvW7B,SAAgB,OAAO,MAAM,OAAO,cAAc,CAAE,GAAG;CACnD,IAAI,CAAC,MAAM,QAAQ,IAAI,GACnB,MAAM,IAAI,UAAU,IAAI,MAAM,6BAA6B,OAAO,MAAM;CAC5E,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAC7B,MAAM,KAAK,IAAI,GAAG,MAAM,GAAG,EAAE,EAAE;CACnC,OAAO;AACX;;;;;;;;;;;;;;AAcA,IAAa,UAAU,OAAO,QAAQ,UAAUC,SAAQ,OAAO,QAAQ,KAAK;;;;;;;;;;;;;AAa5E,IAAa,UAAUC;;;;;;;;;;;;;;AAcvB,SAAgB,QAAQ,OAAO,QAAQ,IAAI;CACvC,IAAI,OAAO,UAAU,UAAU;EAC3B,MAAM,SAAS,SAAS,IAAI,MAAM;EAClC,MAAM,IAAI,UAAU,SAAS,+BAA+B,OAAO,KAAK;CAC5E;CACA,OAAO;AACX;;;;;;;;;;;;;;AAcA,SAAgB,QAAQ,OAAO,QAAQ,UAAU;CAC7C,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAClE,MAAM,IAAI,UAAU,UAAU,WACxB,kCACA,IAAI,MAAM,8BAA8B,OAAO,OAAO;CAChE,OAAO;AACX;;;;;;;;;;;;;;AAcA,SAAgB,UAAU,OAAO,OAAO;CACpC,IAAI,OAAO,UAAU,YACjB,MAAM,IAAI,UAAU,IAAI,MAAM,uCAAuC,OAAO,OAAO;CACvF,OAAO;AACX;;;;;;;;;;;;AAYA,IAAa,aAAaC;;;;;;;;;;;;AAY1B,IAAa,eAAe,GAAG,WAAWC,cAAa,GAAG,MAAM;;;;;;;;;;;;AAYhE,IAAa,cAAc,QAAQC,aAAY,GAAG;;;;;;;;;;;;AAYlD,IAAa,UAAUC;;;;;;;;;;;;AAYvB,IAAaC,iBAAe,gBAAgBC,cAAa,WAAW;AACpE,IAAMC,QAAsB,uBAAO,CAAC;AACpC,IAAMC,QAAsB,uBAAO,CAAC;AAGpC,IAAM,UAAU,UAAW,QAAQ,IAAI,MAAM,MAAM;;;;;;;;;;;;;;AAcnD,SAAgB,MAAM,OAAO,QAAQ,IAAI;CACrC,IAAI,OAAO,UAAU,WACjB,MAAM,IAAI,UAAU,OAAO,KAAK,IAAI,gCAAgC,OAAO,KAAK;CACpF,OAAO;AACX;;;;;;;;;;;;;AAaA,SAAgB,WAAW,GAAG;CAC1B,IAAI,OAAO,MAAM;MACT,CAAC,SAAS,CAAC,GACX,MAAM,IAAI,WAAW,mCAAmC,CAAC;CAAA,OAG7D,QAAQ,CAAC;CACb,OAAO;AACX;;;;;;;;;;;;;;AAcA,SAAgB,YAAY,OAAO,QAAQ,IAAI;CAC3C,IAAI,OAAO,UAAU,UAAU;EAC3B,MAAM,SAAS,SAAS,IAAI,MAAM;EAClC,MAAM,IAAI,UAAU,SAAS,+BAA+B,OAAO,KAAK;CAC5E;CACA,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG;EAC9B,MAAM,SAAS,SAAS,IAAI,MAAM;EAClC,MAAM,IAAI,WAAW,SAAS,gCAAgC,KAAK;CACvE;AACJ;;;;;;;;;;;;;;;AAeA,SAAgB,oBAAoB,KAAK;CACrC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,SAAS,EAAE;CACvC,OAAO,IAAI,SAAS,IAAI,MAAM,MAAM;AACxC;;;;;;;;;;;;;;;AAeA,SAAgB,YAAY,KAAK;CAC7B,IAAI,OAAO,QAAQ,UACf,MAAM,IAAI,UAAU,8BAA8B,OAAO,GAAG;CAChE,OAAO,QAAQ,KAAKD,QAAM,OAAO,OAAO,GAAG;AAC/C;;;;;;;;;;;;;AAcA,SAAgB,gBAAgB,OAAO;CACnC,OAAO,YAAYN,aAAY,KAAK,CAAC;AACzC;;;;;;;;;;;;;AAaA,SAAgB,gBAAgB,OAAO;CACnC,OAAO,YAAYA,aAAY,UAAUF,SAAQ,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACvE;;;;;;;;;;;;;;;AAeA,SAAgB,gBAAgB,GAAG,KAAK;CACpC,UAAS,GAAG;CACZ,IAAI,QAAQ,GACR,MAAM,IAAI,MAAM,+BAA+B;CACnD,IAAI,WAAW,CAAC;CAChB,MAAM,cAAc,MAAM;CAC1B,MAAM,MAAM,EAAE,SAAS,EAAE;CAEzB,IAAI,IAAI,SAAS,aACb,MAAM,IAAI,WAAW,qBAAqB;CAC9C,OAAOI,aAAY,IAAI,SAAS,aAAa,GAAG,CAAC;AACrD;;;;;;;;;;;;;;;AAeA,SAAgB,gBAAgB,GAAG,KAAK;CACpC,OAAO,gBAAgB,GAAG,GAAG,CAAC,CAAC,QAAQ;AAC3C;;;;;;;;;;;;;AAoDA,SAAgB,UAAU,OAAO;CAG7B,OAAO,WAAW,KAAK,OAAO,KAAK,CAAC;AACxC;;;;;;;;;;;;;;;AAeA,SAAgB,aAAa,OAAO;CAChC,IAAI,OAAO,UAAU,UACjB,MAAM,IAAI,UAAU,gCAAgC,OAAO,KAAK;CACpE,OAAO,WAAW,KAAK,QAAQ,GAAG,MAAM;EACpC,MAAM,WAAW,EAAE,WAAW,CAAC;EAC/B,IAAI,EAAE,WAAW,KAAK,WAAW,KAC7B,MAAM,IAAI,WAAW,wCAAwC,MAAM,GAAG,cAAc,SAAS,eAAe,GAAG;EAEnH,OAAO;CACX,CAAC;AACL;;;;;;;;;;;;AAYA,SAAgB,SAAS,GAAG;CACxB,OAAO,OAAO,MAAM,YAAYI,SAAO;AAC3C;;;;;;;;;;;;;;AAcA,SAAgB,QAAQ,GAAG,KAAK,KAAK;CACjC,OAAO,SAAS,CAAC,KAAK,SAAS,GAAG,KAAK,SAAS,GAAG,KAAK,OAAO,KAAK,IAAI;AAC5E;;;;;;;;;;;;;;;;;AAiBA,SAAgB,SAAS,OAAO,GAAG,KAAK,KAAK;CAMzC,IAAI,CAAC,QAAQ,GAAG,KAAK,GAAG,GACpB,MAAM,IAAI,WAAW,oBAAoB,QAAQ,OAAO,MAAM,aAAa,MAAM,WAAW,CAAC;AACrG;;;;;;;;;;;;;;;AAgBA,SAAgB,OAAO,GAAG;CAGtB,IAAI,IAAIA,OACJ,MAAM,IAAI,MAAM,uCAAuC,CAAC;CAE5D,OAAO,MAAMA,QAAM,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AACzC;;;;;;;;;;;;;;AA2DA,IAAa,WAAW,MAAM;CAC1B,YAAY,GAAG,GAAG;CAClB,QAAQC,SAAO,OAAO,CAAC,KAAKA;AAChC;;;;;;;;;;;;;;;;;;;;;;;AAuBA,SAAgB,eAAe,SAAS,UAAU,QAAQ;CACtD,UAAS,SAAS,SAAS;CAC3B,UAAS,UAAU,UAAU;CAC7B,IAAI,OAAO,WAAW,YAClB,MAAM,IAAI,UAAU,2BAA2B;CAEnD,MAAM,OAAO,QAAQ,IAAI,WAAW,GAAG;CACvC,MAAM,OAAO,WAAW,GAAG;CAC3B,MAAM,QAAQ,WAAW,GAAG,CAAI;CAChC,MAAM,QAAQ,WAAW,GAAG,CAAI;CAChC,MAAM,gBAAgB;CAGtB,IAAI,IAAI,IAAI,OAAO;CAEnB,IAAI,IAAI,IAAI,OAAO;CACnB,IAAI,IAAI;CACR,MAAM,cAAc;EAChB,EAAE,KAAK,CAAC;EACR,EAAE,KAAK,CAAC;EACR,IAAI;CACR;CAEA,MAAM,KAAK,GAAG,SAAS,OAAO,GAAG,YAAY,GAAG,GAAG,IAAI,CAAC;CACxD,MAAM,UAAU,OAAO,SAAS;EAE5B,IAAI,EAAE,OAAO,IAAI;EACjB,IAAI,EAAE;EACN,IAAI,KAAK,WAAW,GAChB;EACJ,IAAI,EAAE,OAAO,IAAI;EACjB,IAAI,EAAE;CACV;CACA,MAAM,YAAY;EAEd,IAAI,OAAO,eACP,MAAM,IAAI,MAAM,sCAAsC;EAC1D,IAAI,MAAM;EACV,MAAM,MAAM,CAAC;EACb,OAAO,MAAM,UAAU;GACnB,IAAI,EAAE;GACN,MAAM,KAAK,EAAE,MAAM;GACnB,IAAI,KAAK,EAAE;GACX,OAAO,EAAE;EACb;EACA,OAAO,YAAY,GAAG,GAAG;CAC7B;CACA,MAAM,YAAY,MAAM,SAAS;EAC7B,MAAM;EACN,OAAO,IAAI;EACX,IAAI,MAAM,KAAA;EAEV,QAAQ,MAAM,KAAK,IAAI,CAAC,OAAO,KAAA,GAC3B,OAAO;EACX,MAAM;EACN,OAAO;CACX;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,eAAe,QAAQ,SAAS,CAAC,GAAG,YAAY,CAAC,GAAG,QAAQ,UAAU;CAClF,QAAQ,QAAQ,KAAK;CACrB,QAAQ,QAAQ,QAAQ;CACxB,QAAQ,WAAW,WAAW;CAC9B,SAAS,WAAW,WAAW,cAAc,OAAO;EAChD,MAAM,QAAQ,UAAU,WAAW,UAAU,OAAO,SAAS,EAAE,KAAK,IAAI,MAAM,GAAG,OAAO,SAAS,EAAE;EAGnG,MAAM,MAAM,OAAO;EAGnB,IAAI,CAAC,OAAO,OAAO,QAAQ,SAAS,MAC/B,QAAQ,QAAQ,KAAA,IAAY,iBAAiB,aAC9C,MAAM,IAAI,UAAU,GAAG,MAAM,mCAAmC;EAEpE,IAAI,SAAS,QAAQ,KAAA,GACjB;EACJ,MAAM,UAAU,OAAO;EACvB,IAAI,YAAY,gBAAgB,QAAQ,MACpC,MAAM,IAAI,UAAU,GAAG,MAAM,wBAAwB,aAAa,QAAQ,SAAS;CAC3F;CACA,MAAM,QAAQ,GAAG,UAAU,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,OAAO,WAAW,GAAG,GAAG,KAAK,CAAC;CACxF,KAAK,QAAQ,KAAK;CAClB,KAAK,WAAW,IAAI;AACxB;;;;;;;;;;AC3qBA,IAAMC,QAAsB,uBAAO,CAAC,GAAGC,QAAsB,uBAAO,CAAC,GAAGC,QAAsB,uBAAO,CAAC;AAEtG,IAAMC,QAAsB,uBAAO,CAAC,GAAGC,QAAsB,uBAAO,CAAC,GAAG,MAAsB,uBAAO,CAAC;AAEtG,IAAM,MAAsB,uBAAO,CAAC,GAAG,MAAsB,uBAAO,CAAC,GAAG,MAAsB,uBAAO,CAAC;AACtG,IAAM,OAAuB,uBAAO,EAAE,GAAG,OAAuB,uBAAO,EAAE;AAGzE,IAAM,mBAAmC,uBAAO,qBAAqB;;;;;;;;;;;;;AAarE,SAAgB,IAAI,GAAG,GAAG;CACtB,IAAI,KAAKJ,OACL,MAAM,IAAI,MAAM,yCAAyC,CAAC;CAC9D,MAAM,SAAS,IAAI;CACnB,OAAO,UAAUA,QAAM,SAAS,IAAI;AACxC;;;;;;;;;;;;;;;;;;AAkBA,SAAgB,IAAI,KAAK,OAAO,QAAQ;CACpC,IAAI,UAAUC,OACV,MAAM,IAAI,MAAM,oCAAoC,MAAM;CAE9D,IAAI,OAAO,UAAU,UACjB,MAAM,IAAI,UAAU,4CAA4C,OAAO,KAAK;CAChF,IAAI,QAAQD,OACR,MAAM,IAAI,MAAM,yCAAyC;CAC7D,IAAI,UAAUA,OACV,OAAOC;CACX,IAAI,UAAUA,OACV,OAAO;CACX,IAAI,IAAI,MAAM;CACd,IAAI,IAAID,OACJ,KAAK;CAGT,IAAI,QAAQ,kBAAkB;EAE1B,IAAI,IAAIC;EACR,OAAO,QAAQD,OAAK;GAChB,IAAI,QAAQC,OACR,IAAK,IAAI,IAAK;GAClB,IAAK,IAAI,IAAK;GACd,UAAUA;EACd;EACA,OAAO;CACX;CAIA,MAAM,SAAS,CAAC;CAChB,OAAO,QAAQD,OAAK;EAChB,OAAO,KAAK,OAAO,QAAQ,IAAI,CAAC;EAChC,UAAUI;CACd;CACA,MAAM,QAAQ,IAAI,MAAM,EAAE;CAC1B,MAAM,KAAKH;CACX,MAAM,KAAK;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KACpB,MAAM,KAAM,MAAM,IAAI,KAAK,IAAK;CACpC,IAAI,IAAI,MAAM,OAAO,OAAO,SAAS;CACrC,KAAK,IAAI,IAAI,OAAO,SAAS,GAAG,KAAK,GAAG,KAAK;EACzC,IAAK,IAAI,IAAK;EACd,IAAK,IAAI,IAAK;EACd,IAAK,IAAI,IAAK;EACd,IAAK,IAAI,IAAK;EACd,MAAM,QAAQ,OAAO;EACrB,IAAI,UAAU,GACV,IAAK,IAAI,MAAM,SAAU;CACjC;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;AAiBA,SAAgB,KAAK,GAAG,OAAO,QAAQ;CACnC,IAAI,UAAUA,OACV,MAAM,IAAI,MAAM,qCAAqC,MAAM;CAC/D,IAAI,QAAQD,OACR,MAAM,IAAI,MAAM,+CAA+C,KAAK;CACxE,IAAI,MAAM;CACV,OAAO,UAAUA,OAAK;EAClB,OAAO;EACP,OAAO;CACX;CACA,OAAO;AACX;;;;;;;;;;;;;;;AAeA,SAAgB,OAAO,QAAQ,QAAQ;CACnC,IAAI,WAAWA,OACX,MAAM,IAAI,MAAM,kCAAkC;CAGtD,IAAI,UAAUC,OACV,MAAM,IAAI,MAAM,uCAAuC,MAAM;CAGjE,IAAI,IAAI,IAAI,QAAQ,MAAM;CAC1B,IAAI,IAAI;CAIR,IAAI,IAAID,OAAK,IAAIC;CACjB,OAAO,MAAMD,OAAK;EACd,MAAM,IAAI,IAAI;EACd,MAAM,IAAI,IAAI,IAAI;EAClB,MAAM,IAAI,IAAI,IAAI;EAElB,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI;CAC7B;CAEA,IAAIK,MAAQJ,OACR,MAAM,IAAI,MAAM,wBAAwB;CAC5C,OAAO,IAAI,GAAG,MAAM;AACxB;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,SAAgB,SAAS,GAAG,OAAO;CAC/B,IAAI,SAASA,OACT,MAAM,IAAI,MAAM,+CAA+C,KAAK;CACxE,MAAM,KAAK,IAAI,GAAG,KAAK;CACvB,IAAI,OAAOD,OACP,MAAM,IAAI,MAAM,oCAAoC;CAExD,MAAM,UAAU,IAAI,IAAI,QAAQE,OAAK,KAAK;CAE1C,IAAI,IAAI,KAAK,SAAS,KAAK,MAAMD,OAC7B,MAAM,IAAI,MAAM,0BAA0B;CAC9C,OAAO;AACX;AACA,SAAS,eAAe,IAAI,MAAM,GAAG;CACjC,MAAM,IAAI;CACV,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,GACrB,MAAM,IAAI,MAAM,yBAAyB;AACjD;AAMA,SAAS,YAAY,OAAO,QAAQ;CAChC,KAAK,QAAQA,WAASD,OAClB,MAAM,IAAI,MAAM,SAAS,iCAAiC,KAAK;AACvE;AAKA,SAAS,UAAU,IAAI,GAAG;CACtB,MAAM,IAAI;CACV,MAAM,UAAU,EAAE,QAAQC,SAAOG;CACjC,MAAM,OAAO,EAAE,IAAI,GAAG,MAAM;CAC5B,eAAe,GAAG,MAAM,CAAC;CACzB,OAAO;AACX;AAGA,SAAS,UAAU,IAAI,GAAG;CACtB,MAAM,IAAI;CACV,MAAM,UAAU,EAAE,QAAQ,OAAO;CACjC,MAAM,KAAK,EAAE,IAAI,GAAGF,KAAG;CACvB,MAAM,IAAI,EAAE,IAAI,IAAI,MAAM;CAC1B,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC;CACrB,MAAM,IAAI,EAAE,IAAI,EAAE,IAAI,IAAIA,KAAG,GAAG,CAAC;CACjC,MAAM,OAAO,EAAE,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE,GAAG,CAAC;CACtC,eAAe,GAAG,MAAM,CAAC;CACzB,OAAO;AACX;AAGA,SAAS,WAAW,GAAG;CACnB,MAAM,MAAM,MAAM,CAAC;CACnB,MAAM,KAAK,cAAc,CAAC;CAC1B,MAAM,KAAK,GAAG,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC;CACnC,MAAM,KAAK,GAAG,KAAK,EAAE;CACrB,MAAM,KAAK,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC;CAC9B,MAAM,MAAM,IAAI,OAAO;CACvB,SAAS,IAAI,MAAM;EACf,MAAM,IAAI;EACV,IAAI,MAAM,EAAE,IAAI,GAAG,EAAE;EACrB,IAAI,MAAM,EAAE,IAAI,KAAK,EAAE;EACvB,MAAM,MAAM,EAAE,IAAI,KAAK,EAAE;EACzB,MAAM,MAAM,EAAE,IAAI,KAAK,EAAE;EACzB,MAAM,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,GAAG,CAAC;EAC9B,MAAM,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,GAAG,CAAC;EAC9B,MAAM,EAAE,KAAK,KAAK,KAAK,EAAE;EACzB,MAAM,EAAE,KAAK,KAAK,KAAK,EAAE;EACzB,MAAM,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,GAAG,CAAC;EAC9B,MAAM,OAAO,EAAE,KAAK,KAAK,KAAK,EAAE;EAChC,eAAe,GAAG,MAAM,CAAC;EACzB,OAAO;CACX;AACJ;;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,cAAc,GAAG;CAG7B,IAAI,IAAIC,OACJ,MAAM,IAAI,MAAM,qCAAqC;CACzD,YAAY,GAAG,eAAe;CAE9B,IAAI,IAAI,IAAIF;CACZ,IAAI,IAAI;CACR,OAAO,IAAIC,UAAQF,OAAK;EACpB,KAAKE;EACL;CACJ;CAEA,IAAI,IAAIA;CACR,MAAM,MAAM,MAAM,CAAC;CACnB,OAAO,WAAW,KAAK,CAAC,MAAM,GAG1B,IAAI,MAAM,KACN,MAAM,IAAI,MAAM,+CAA+C;CAGvE,IAAI,MAAM,GACN,OAAO;CAGX,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC;CACrB,MAAM,UAAU,IAAID,SAAOC;CAC3B,OAAO,SAAS,YAAY,IAAI,GAAG;EAC/B,MAAM,IAAI;EACV,IAAI,EAAE,IAAI,CAAC,GACP,OAAO;EAEX,IAAI,WAAW,GAAG,CAAC,MAAM,GACrB,MAAM,IAAI,MAAM,yBAAyB;EAE7C,IAAI,IAAI;EACR,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;EACvB,IAAI,IAAI,EAAE,IAAI,GAAG,CAAC;EAClB,IAAI,IAAI,EAAE,IAAI,GAAG,MAAM;EAGvB,OAAO,CAAC,EAAE,IAAI,GAAG,EAAE,GAAG,GAAG;GAGrB,IAAI,EAAE,IAAI,CAAC,GACP,MAAM,IAAI,MAAM,+CAA+C;GACnE,IAAI,IAAI;GAER,IAAI,QAAQ,EAAE,IAAI,CAAC;GACnB,OAAO,CAAC,EAAE,IAAI,OAAO,EAAE,GAAG,GAAG;IACzB;IACA,QAAQ,EAAE,IAAI,KAAK;IACnB,IAAI,MAAM,GACN,MAAM,IAAI,MAAM,yBAAyB;GACjD;GAEA,MAAM,WAAWD,SAAO,OAAO,IAAI,IAAI,CAAC;GACxC,MAAM,IAAI,EAAE,IAAI,GAAG,QAAQ;GAE3B,IAAI;GACJ,IAAI,EAAE,IAAI,CAAC;GACX,IAAI,EAAE,IAAI,GAAG,CAAC;GACd,IAAI,EAAE,IAAI,GAAG,CAAC;EAClB;EACA,OAAO;CACX;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,OAAO,GAAG;CACtB,YAAY,GAAG,SAAS;CAExB,IAAI,IAAIG,UAAQD,OACZ,OAAO;CAEX,IAAI,IAAI,QAAQ,KACZ,OAAO;CAEX,IAAI,IAAI,SAAS,KACb,OAAO,WAAW,CAAC;CAEvB,OAAO,cAAc,CAAC;AAC1B;AAkBA,IAAM,eAAe;CACjB;CAAU;CAAW;CAAO;CAAO;CAAO;CAAQ;CAClD;CAAO;CAAO;CAAO;CAAO;CAAO;CACnC;CAAQ;CAAQ;CAAQ;AAC5B;;;;;;;;;;;;;;;AAeA,SAAgB,cAAc,OAAO;CACjC,QAAQ,OAAO,OAAO;CACtB,IAAI,OAAO,MAAM,UAAU,UACvB,MAAM,IAAI,UAAU,sDAAoD,OAAO,MAAM,KAAK;CAG9F,YAAY,MAAM,OAAO,OAAO;CAChC,YAAY,MAAM,MAAM,MAAM;CAC9B,KAAK,MAAM,QAAQ,cACf,UAAU,MAAM,OAAO,WAAW,IAAI;CAG1C,IAAI,MAAM,QAAQ,KAAK,MAAM,OAAO,GAChC,MAAM,IAAI,MAAM,wCAAwC;CAC5D,IAAI,MAAM,SAASF,OACf,MAAM,IAAI,MAAM,4CAA4C,MAAM,KAAK;CAC3E,OAAO;AACX;AAkEA,SAAgB,cAAc,IAAI,MAAM,WAAW,OAAO;CACtD,cAAc,EAAE;CAChB,OAAO,MAAM,MAAM;CACnB,MAAM,UAAU,UAAU;CAC1B,MAAM,IAAI;CACV,MAAM,WAAW,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,KAAK,WAAW,EAAE,OAAO,KAAA,CAAS;CAE1E,MAAM,gBAAgB,KAAK,QAAQ,KAAK,KAAK,MAAM;EAC/C,IAAI,EAAE,IAAI,GAAG,GACT,OAAO;EACX,SAAS,KAAK;EACd,OAAO,EAAE,IAAI,KAAK,GAAG;CACzB,GAAG,EAAE,GAAG;CAER,MAAM,cAAc,EAAE,IAAI,aAAa;CAEvC,KAAK,aAAa,KAAK,KAAK,MAAM;EAC9B,IAAI,EAAE,IAAI,GAAG,GACT,OAAO;EAEX,SAAS,KAAK,EAAE,IAAI,KAAK,SAAS,EAAE;EACpC,OAAO,EAAE,IAAI,KAAK,GAAG;CACzB,GAAG,WAAW;CACd,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;AA0CA,SAAgB,WAAW,IAAI,GAAG;CAC9B,cAAc,EAAE;CAChB,MAAM,IAAI;CACV,YAAY,EAAE,OAAO,YAAY;CAGjC,MAAM,UAAU,EAAE,QAAQA,SAAOC;CACjC,MAAM,UAAU,EAAE,IAAI,GAAG,MAAM;CAC/B,MAAM,MAAM,EAAE,IAAI,SAAS,EAAE,GAAG;CAChC,MAAM,OAAO,EAAE,IAAI,SAAS,EAAE,IAAI;CAClC,MAAM,KAAK,EAAE,IAAI,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC;CACtC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAClB,MAAM,IAAI,MAAM,gCAAgC;CACpD,OAAO,MAAM,IAAI,OAAO,IAAI;AAChC;;;;;;;;;;;;;;AAkCA,SAAgB,QAAQ,GAAG,YAAY;CAEnC,IAAI,eAAe,KAAA,GACf,QAAQ,UAAU;CACtB,IAAI,KAAKF,OACL,MAAM,IAAI,MAAM,gDAAgD,CAAC;CACrE,IAAI,eAAe,KAAA,KAAa,aAAa,GACzC,MAAM,IAAI,MAAM,yDAAyD,UAAU;CACvF,MAAM,OAAO,OAAO,CAAC;CAGrB,IAAI,eAAe,KAAA,KAAa,aAAa,MACzC,MAAM,IAAI,MAAM,0CAA0C,WAAW,kBAAkB,KAAK,EAAE;CAClG,MAAM,cAAc,eAAe,KAAA,IAAY,aAAa;CAE5D,OAAO;EAAE,YAAY;EAAa,aADd,KAAK,KAAK,cAAc,CACA;CAAE;AAClD;AAGA,IAAM,6BAAa,IAAI,QAAQ;AAC/B,IAAM,SAAN,MAAa;CACT;CACA;CACA;CACA;CACA,OAAOA;CACP,MAAMC;CACN;CACA;CACA,YAAY,OAAO,OAAO,CAAC,GAAG;EAG1B,IAAI,SAASA,OACT,MAAM,IAAI,MAAM,4CAA4C,KAAK;EACrE,IAAI,cAAc,KAAA;EAClB,KAAK,OAAO;EACZ,IAAI,QAAQ,QAAQ,OAAO,SAAS,UAAU;GAE1C,IAAI,OAAO,KAAK,SAAS,UACrB,cAAc,KAAK;GACvB,IAAI,OAAO,KAAK,SAAS,YAGrB,OAAO,eAAe,MAAM,QAAQ;IAAE,OAAO,KAAK;IAAM,YAAY;GAAK,CAAC;GAC9E,IAAI,OAAO,KAAK,SAAS,WACrB,KAAK,OAAO,KAAK;GACrB,IAAI,KAAK,gBACL,KAAK,WAAW,OAAO,OAAO,KAAK,eAAe,MAAM,CAAC;GAC7D,IAAI,OAAO,KAAK,iBAAiB,WAC7B,KAAK,OAAO,KAAK;EACzB;EACA,MAAM,EAAE,YAAY,gBAAgB,QAAQ,OAAO,WAAW;EAC9D,IAAI,cAAc,MACd,MAAM,IAAI,MAAM,gDAAgD;EACpE,KAAK,QAAQ;EACb,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,OAAO,OAAO,IAAI;CACtB;CACA,OAAO,KAAK;EACR,OAAO,IAAI,KAAK,KAAK,KAAK;CAC9B;CACA,QAAQ,KAAK;EACT,IAAI,OAAO,QAAQ,UACf,MAAM,IAAI,UAAU,iDAAiD,OAAO,GAAG;EACnF,OAAOD,SAAO,OAAO,MAAM,KAAK;CACpC;CACA,IAAI,KAAK;EACL,OAAO,QAAQA;CACnB;CAEA,YAAY,KAAK;EACb,OAAO,CAAC,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,GAAG;CAC7C;CACA,MAAM,KAAK;EACP,QAAQ,MAAMC,WAASA;CAC3B;CACA,IAAI,KAAK;EACL,OAAO,IAAI,CAAC,KAAK,KAAK,KAAK;CAC/B;CACA,IAAI,KAAK,KAAK;EACV,OAAO,QAAQ;CACnB;CACA,IAAI,KAAK;EACL,OAAO,IAAI,MAAM,KAAK,KAAK,KAAK;CACpC;CACA,IAAI,KAAK,KAAK;EACV,OAAO,IAAI,MAAM,KAAK,KAAK,KAAK;CACpC;CACA,IAAI,KAAK,KAAK;EACV,OAAO,IAAI,MAAM,KAAK,KAAK,KAAK;CACpC;CACA,IAAI,KAAK,KAAK;EACV,OAAO,IAAI,MAAM,KAAK,KAAK,KAAK;CACpC;CACA,IAAI,KAAK,OAAO;EACZ,OAAO,IAAI,KAAK,OAAO,KAAK,KAAK;CACrC;CACA,IAAI,KAAK,KAAK;EACV,OAAO,IAAI,MAAM,OAAO,KAAK,KAAK,KAAK,GAAG,KAAK,KAAK;CACxD;CAEA,KAAK,KAAK;EACN,OAAO,MAAM;CACjB;CACA,KAAK,KAAK,KAAK;EACX,OAAO,MAAM;CACjB;CACA,KAAK,KAAK,KAAK;EACX,OAAO,MAAM;CACjB;CACA,KAAK,KAAK,KAAK;EACX,OAAO,MAAM;CACjB;CACA,IAAI,KAAK;EACL,OAAO,OAAO,KAAK,KAAK,KAAK;CACjC;CACA,KAAK,KAAK;EAGN,IAAI,OAAO,WAAW,IAAI,IAAI;EAC9B,IAAI,CAAC,MACD,WAAW,IAAI,MAAO,OAAO,OAAO,KAAK,KAAK,CAAE;EACpD,OAAO,KAAK,MAAM,GAAG;CACzB;CACA,QAAQ,KAAK;EAIT,OAAO,KAAK,OAAO,gBAAgB,KAAK,KAAK,KAAK,IAAI,gBAAgB,KAAK,KAAK,KAAK;CACzF;CACA,UAAU,OAAO,iBAAiB,OAAO;EACrC,OAAO,KAAK;EACZ,MAAM,EAAE,UAAU,gBAAgB,OAAO,MAAM,OAAO,MAAM,iBAAiB;EAC7E,IAAI,gBAAgB;GAGhB,IAAI,MAAM,SAAS,KAAK,CAAC,eAAe,SAAS,MAAM,MAAM,KAAK,MAAM,SAAS,OAC7E,MAAM,IAAI,MAAM,+BAA+B,iBAAiB,iBAAiB,MAAM,MAAM;GAEjG,MAAM,SAAS,IAAI,WAAW,KAAK;GAEnC,OAAO,IAAI,OAAO,OAAO,IAAI,OAAO,SAAS,MAAM,MAAM;GACzD,QAAQ;EACZ;EACA,IAAI,MAAM,WAAW,OACjB,MAAM,IAAI,MAAM,+BAA+B,QAAQ,iBAAiB,MAAM,MAAM;EACxF,IAAI,SAAS,OAAO,gBAAgB,KAAK,IAAI,gBAAgB,KAAK;EAClE,IAAI,cACA,SAAS,IAAI,QAAQ,KAAK;EAC9B,IAAI,CAAC;OACG,CAAC,KAAK,QAAQ,MAAM,GACpB,MAAM,IAAI,MAAM,kDAAkD;EAAA;EAG1E,OAAO;CACX;CAEA,YAAY,KAAK;EAIb,OAAO,cAAc,MAAM,KAAK,IAAI;CACxC;CAGA,KAAK,GAAG,GAAG,WAAW;EAGlB,MAAM,WAAW,WAAW;EAC5B,OAAO,YAAY,IAAI;CAC3B;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAgB,MAAM,OAAO,OAAO,CAAC,GAAG;CAKpC,OAAO,OAAO,OAAO,SAAS;CAC9B,OAAO,IAAI,OAAO,OAAO,IAAI;AACjC;;;;;;;;;;;;;;;AA4DA,SAAgB,oBAAoB,YAAY;CAC5C,IAAI,OAAO,eAAe,UACtB,MAAM,IAAI,MAAM,4BAA4B;CAEhD,IAAI,cAAcA,OACd,MAAM,IAAI,MAAM,oCAAoC;CAExD,MAAM,YAAY,OAAO,aAAaA,KAAG;CACzC,OAAO,KAAK,KAAK,YAAY,CAAC;AAClC;;;;;;;;;;;;;;;;;AAiBA,SAAgB,iBAAiB,YAAY;CACzC,MAAM,SAAS,oBAAoB,UAAU;CAC7C,OAAO,SAAS,KAAK,KAAK,SAAS,CAAC;AACxC;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,eAAe,KAAK,YAAY,OAAO,OAAO;CAC1D,OAAO,GAAG;CACV,MAAM,MAAM,IAAI;CAChB,MAAM,WAAW,oBAAoB,UAAU;CAC/C,MAAM,SAAS,KAAK,IAAI,iBAAiB,UAAU,GAAG,EAAE;CAGxD,IAAI,MAAM,UAAU,MAAM,MACtB,MAAM,IAAI,MAAM,cAAc,SAAS,+BAA+B,GAAG;CAO7E,MAAM,UAAU,IANJ,OAAO,gBAAgB,GAAG,IAAI,gBAAgB,GAAG,GAMpC,aAAaA,KAAG,IAAIA;CAC7C,OAAO,OAAO,gBAAgB,SAAS,QAAQ,IAAI,gBAAgB,SAAS,QAAQ;AACxF;;;;;;;;;ACn8BA,IAAMK,QAAsB,uBAAO,CAAC;AACpC,IAAMC,QAAsB,uBAAO,CAAC;AACpC,IAAMC,QAAsB,uBAAO,CAAC;AACpC,IAAM,cAAc;AACpB,IAAM,aAAa;AAInB,IAAM,YAAY;AAIlB,IAAM,kBAAkC,uBAAO,KAAK,GAAA,CAAI;;;;;;;;;;;;;;;;AAgBxD,SAAgB,kBAAkB,OAAO;CACrC,MAAM,KAAK;CACX,IAAI,OAAO,OAAO,YACd,MAAM,IAAI,UAAU,8CAA4C,OAAO,KAAK;CAChF,UAAU,GAAG,YAAY,kBAAkB;CAC3C,UAAU,GAAG,WAAW,iBAAiB;CACzC,UAAU,GAAG,SAAS,eAAe;CAGrC,QAAQ,GAAG,MAAM,YAAY;CAC7B,QAAQ,GAAG,MAAM,YAAY;CAC7B,cAAc,GAAG,EAAE;CACnB,cAAc,GAAG,EAAE;AACvB;;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,WAAW,GAAG,QAAQ;CAElC,kBAAkB,CAAC;CACnB,kBAAkB,QAAQ,CAAC;CAI3B,MAAM,aAAa,cAAc,EAAE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;CAC7D,OAAO,OAAO,KAAK,GAAG,MAAM,EAAE,WAAW,EAAE,SAAS,WAAW,EAAE,CAAC,CAAC;AACvE;AACA,SAAS,UAAU,GAAG,MAAM,MAAM,GAAG;CACjC,IAAI,CAAC,OAAO,cAAc,CAAC,KAAK,IAAI,OAAO,IAAI,MAC3C,MAAM,IAAI,MAAM,oCAAoC,MAAM,OAAO,OAAO,cAAc,CAAC;AAC/F;AAIA,SAAS,mBAAmB,WAAW,SAAS;CAC5C,MAAM,QAAQ,aAAa,IAAI,UAAU;CACzC,IAAI,QAAQ,iBACR,MAAM,IAAI,MAAM,4CACZ,KAAK,KAAK,QAAQ,KAAK,EAAE,IACzB,eACA,kBAAkB,KAAK,KACvB,MAAM;AAClB;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,iBAAiB,aAAa,QAAQ;CAClD,IAAI,gBAAgB,KAAA,GAChB,OAAO,KAAA;CACX,UAAU,aAAa,aAAa;CACpC,IAAI;EACA,MAAM,QAAQ,YAAY,MAAM;EAChC,IAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,WAAW,QACpC,OAAO,KAAA;CACf,QACM;EACF;CACJ;CACA,OAAO;AACX;AACA,SAAS,kBAAkB,QAAQ,GAAG;CAClC,OAAO,QAAQ,QAAQ;CACvB,OAAO,SAAS,GAAG,MAAM;EACrB,IAAI,EAAE,aAAa,IACf,MAAM,IAAI,MAAM,4BAA4B,CAAC;CACrD,CAAC;AACL;AAGA,SAAS,mBAAmB,SAAS,OAAO,WAAW;CACnD,IAAI,CAAC,MAAM,QAAQ,OAAO,GACtB,MAAM,IAAI,MAAM,2BAA2B;CAC/C,QAAQ,SAAS,GAAG,MAAM;EAEtB,IAAI,EADO,cAAc,KAAA,IAAY,MAAM,QAAQ,CAAC,IAAI,SAAS,CAAC,KAAK,IAAI,YAEvE,MAAM,IAAI,MAAM,6BAA6B,CAAC;CACtD,CAAC;AACL;AACA,IAAM,mCAAmB,IAAI,QAAQ;AACrC,SAAS,cAAc,GAAG;CAEtB,OAAO,iBAAiB,IAAI,CAAC,KAAK;AACtC;;AAEA,SAAS,aAAa,GAAG,MAAM;CAC3B,MAAM,MAAM,EAAE,OAAO;CACrB,MAAM,IAAI,CAAC,CAAC;CACZ,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KACtB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC;CAC5B,OAAO;AACX;;;;;AAKA,SAAS,WAAW,GAAG,GAAG;CACtB,MAAM,OAAO,KAAK;CAClB,MAAM,OAAO,OAAO;CACpB,MAAM,OAAO,OAAO,OAAO,CAAC;CAC5B,MAAM,IAAI,CAAC;CACX,OAAO,IAAIF,OAAK;EACZ,IAAI,IAAI;EACR,IAAI,IAAIC,OAAK;GACT,IAAI,OAAO,IAAI,IAAI;GACnB,IAAI,KAAK,MACL,KAAK;GACT,KAAK,OAAO,CAAC;EACjB;EACA,EAAE,KAAK,CAAC;EACR,MAAMA;CACV;CACA,OAAO;AACX;;;;;;AAMA,SAAS,mBAAmB,GAAG,GAAG,SAAS;CACvC,MAAM,OAAO,KAAK;CAClB,MAAM,OAAO,OAAO;CACpB,MAAM,OAAO,OAAO,OAAO,CAAC;CAC5B,MAAM,UAAU,OAAO,CAAC;CACxB,MAAM,IAAI,CAAC;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK;EAC9B,IAAI,IAAI,OAAO,IAAI,IAAI;EACvB,MAAM;EACN,IAAI,IAAI,MAAM;GACV,KAAK;GACL,KAAKA;EACT;EACA,EAAE,KAAK,CAAC;CACZ;CAEA,IAAI,MAAMD,OACN,MAAM,IAAI,MAAM,cAAc;CAClC,OAAO;AACX;;;;;;AAMA,SAAS,SAAS,MAAM,QAAQ,QAAQ;CACpC,IAAI,MAAM;CACV,KAAK,MAAM,KAAK,QACZ,MAAM,KAAK,IAAI,KAAK,EAAE,MAAM;CAChC,IAAI,MAAM;CACV,KAAK,IAAI,MAAM,MAAM,GAAG,OAAO,GAAG,OAAO;EACrC,IAAI,QAAQ,MAAM,GACd,MAAM,IAAI,OAAO;EACrB,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;GACpC,MAAM,IAAI,OAAO,EAAE,CAAC;GACpB,IAAI,GAAG;IACH,MAAM,OAAO,OAAO,EAAE,CAAE,KAAK,IAAI,CAAC,IAAI,KAAM;IAC5C,MAAM,IAAI,IAAI,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI;GAC9C;EACJ;CACJ;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,IAAa,mBAAb,MAA8B;CAC1B;CACA;CACA;CACA;CACA,kCAAkB,IAAI,QAAQ;CAC9B;CACA;CAEA,YAAY,OAAO,aAAa;EAC5B,kBAAkB,KAAK;EAKvB,KAAK,cAAc,iBAAiB,aAAa,WAAW;EAC5D,KAAK,QAAQ;EACb,KAAK,OAAO,MAAM;EAClB,KAAK,OAAO,MAAM;EAClB,KAAK,OAAO,MAAM,GAAG;CACzB;;;;;;;;;;;CAWA,eAAe,OAAO,GAAG,MAAM;EAI3B,MAAM,UAAU,KAAK,KAAK,OAAO,CAAC,IAAI;EACtC,MAAM,OAAO,MAAM,IAAI;EACvB,MAAM,OAAO,CAAC;EACd,IAAI,OAAO;EACX,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK;GAC9B,IAAI,MAAM;GACV,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KAAK;IAC3B,KAAK,KAAK,GAAG;IACb,MAAM,IAAI,IAAI,IAAI;GACtB;GACA,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC,OAAO;EACxC;EACA,OAAO;GAAE;GAAG;GAAM;GAAS;EAAK;CACpC;;;;;;;;;;CAUA,aAAa,aAAa,GAAG;EACzB,MAAM,EAAE,GAAG,SAAS,SAAS;EAC7B,MAAM,OAAO,MAAM,IAAI;EACvB,MAAM,SAAS,mBAAmB,GAAG,GAAG,OAAO;EAC/C,IAAI,IAAI,KAAK;EACb,IAAI,IAAI,KAAK;EACb,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK;GAC9B,MAAM,QAAQ,OAAO;GACrB,MAAM,QAAQ,IAAI;GAElB,MAAM,MAAM,KAAK,IAAI,KAAK,IAAI;GAC9B,IAAI,MAAM,KAAK;GACf,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KACtB,MAAM,MAAM,MAAM,KAAK,QAAQ,KAAK;GACxC,MAAM,MAAM,IAAI,OAAO;GACvB,IAAI,UAAU,GACV,IAAI,EAAE,IAAI,KAAK,MAAM;QAErB,IAAI,EAAE,IAAI,QAAQ,IAAI,MAAM,GAAG;EACvC;EACA,OAAO;GAAE;GAAG;EAAE;CAClB;CAIA,mBAAmB,GAAG,OAAO,MAAM,WAAW;EAC1C,IAAI,UAAU,KAAK,gBAAgB,IAAI,KAAK;EAC5C,IAAI,OAAO,SAAS,MAAM,UAAU,MAAM,MAAM,KAAK,MAAM,SAAS,IAAI;EACxE,IAAI,CAAC,MAAM;GACP,OAAO,KAAK,eAAe,OAAO,GAAG,IAAI;GACzC,IAAI,OAAO,cAAc,YACrB,OAAO;IAAE,GAAG;IAAM,MAAM,UAAU,KAAK,IAAI;GAAE;GACjD,IAAI,CAAC,SAAS;IACV,UAAU,CAAC;IACX,KAAK,gBAAgB,IAAI,OAAO,OAAO;GAC3C;GACA,QAAQ,KAAK,IAAI;EACrB;EACA,OAAO;CACX;CACA,YAAY,OAAO;EACf,IAAI,EAAE,iBAAiB,KAAK,QACxB,MAAM,IAAI,UAAU,iDAA+C,OAAO,KAAK;CACvF;CAIA,iBAAiB,OAAO,QAAQ;EAC5B,KAAK,YAAY,KAAK;EACtB,IAAI,CAAC,QAAQ,QAAQC,OAAK,KAAK,MAAM,GAAG,KAAK,GACzC,MAAM,IAAI,MAAM,gBAAgB;CACxC;CAIA,MAAM,OAAO,GAAG,MAAM,WAAW;EAC7B,MAAM,IAAI,cAAc,KAAK;EAC7B,IAAI,MAAM,GACN,OAAO,KAAK,cAAc,OAAO,GAAG,IAAI;EAC5C,OAAO,KAAK,aAAa,KAAK,mBAAmB,GAAG,OAAO,MAAM,SAAS,GAAG,CAAC;CAClF;CACA,MAAM,OAAO,QAAQ,WAAW;EAC5B,KAAK,iBAAiB,OAAO,MAAM;EACnC,OAAO,KAAK,MAAM,OAAO,QAAQ,KAAK,MAAM,SAAS;CACzD;CACA,aAAa,OAAO,QAAQ,WAAW;EACnC,KAAK,iBAAiB,OAAO,MAAM;EAKnC,IAAI,KAAK,gBAAgB,KAAA,GACrB,MAAM,IAAI,MAAM,6CAA6C;EACjE,MAAM,OAAO,KAAK,MAAM,GAAG,OAAO;EAClC,MAAM,QAAQ,KAAK,YAAY,WAAW;EAC1C,IAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,WAAW,aACpC,MAAM,IAAI,MAAM,yCAAyC;EAS7D,MAAM,KAAM,MAAM,KAAK,KAAQ;EAK/B,MAAM,IAAI,SAAS,gBAAgB,KAAK,IAAI,KAAK,MAAM,GAAG;EAC1D,OAAO,KAAK,MAAM,OAAO,GAAG,MAAM,SAAS;CAC/C;;;;;;;;;;;;;;;;CAgBA,cAAc,OAAO,GAAG,MAAM;EAC1B,MAAM,IAAI;EACV,MAAM,OAAO,KAAK;EAClB,MAAM,OAAO,QAAQ,CAAC;EAEtB,MAAM,QAAQ,IAAI,MAAM,IAAI;EAC5B,MAAM,KAAK,KAAK;EAChB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KACtB,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC,IAAI,KAAK;EAErC,MAAM,UAAU,KAAK,KAAK,OAAO,CAAC;EAClC,IAAI,MAAM,KAAK;EACf,KAAK,IAAI,SAAS,UAAU,GAAG,UAAU,GAAG,UAAU;GAGlD,IAAI,WAAW,UAAU,GACrB,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KACnB,MAAM,IAAI,OAAO;GACzB,MAAM,QAAQ,OAAQ,KAAK,OAAO,SAAS,CAAC,IAAK,IAAI;GAErD,IAAI,MAAM,MAAM;GAChB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KACtB,MAAM,MAAM,QAAQ,MAAM,KAAK;GACnC,MAAM,IAAI,IAAI,GAAG;EACrB;EACA,OAAO;GAAE,GAAG;GAAK,GAAG;EAAI;CAC5B;CACA,YAAY,OAAO,UAAU;EAEzB,IAAI,KAAK,gBAAgB,KAAA,GACrB,OAAO;EACX,IAAI,aAAaA,OACb,OAAO;EACX,IAAI,UAAU,KAAK,MACf,OAAO;EACX,IAAI,KAAK,qBAAqB,KAAA,GAC1B,KAAK,mBAAmB,KAAK,UAAU,KAAK,MAAM,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI;EAC/E,OAAO,KAAK;CAChB;CACA,UAAU,OAAO,QAAQ,UAAU,WAAW;EAC1C,OAAO,KAAK,YAAY,OAAO,QAAQ,IACjC,KAAK,aAAa,OAAO,QAAQ,SAAS,IAC1C,KAAK,MAAM,OAAO,QAAQ,SAAS;CAC7C;CACA,UAAU,OAAO,QAAQ,WAAW;EAChC,KAAK,YAAY,KAAK;EACtB,IAAI,CAAC,SAAS,MAAM,GAChB,MAAM,IAAI,MAAM,gBAAgB;EACpC,MAAM,IAAI,cAAc,KAAK;EAQ7B,IAAI,MAAM,KAAK,UAAU,KAAK,MAAM,GAAG,OACnC,OAAO,aAAa,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,IAAI;EAI3D,MAAM,cAAc,KAAK,mBAAmB,GAAG,OAAO,KAAK,MAAM,SAAS;EAC1E,OAAO,KAAK,aAAa,aAAa,MAAM,CAAC,CAAC;CAClD;CAKA,cAAc,OAAO,GAAG;EACpB,KAAK,YAAY,KAAK;EACtB,UAAU,GAAG,KAAK,IAAI;EAGtB,oBADgB,KAAK,MAAM,KAAK,OAAO,cAAc,CAAC,IAAI,KAC7B,MAAM,IAAI,IAAI,KAAK,MAAM,GAAG,KAAK;EAC9D,iBAAiB,IAAI,OAAO,CAAC;EAC7B,KAAK,gBAAgB,OAAO,KAAK;CACrC;CAEA,cAAc,OAAO;EACjB,OAAO,cAAc,KAAK,MAAM;CACpC;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAgB,aAAa,GAAG,QAAQ,SAAS,iBAAiB,OAAO;CACrE,kBAAkB,CAAC;CACnB,kBAAkB,QAAQ,CAAC;CAC3B,MAAM,gBAAgB,gBAAgB;CAEtC,mBAAmB,SAAS,EAAE,IAAI,iBAAiB,EAAE,GAAG,SAASC,QAAM,KAAA,CAAS;CAChF,IAAI,OAAO,WAAW,QAAQ,QAC1B,MAAM,IAAI,MAAM,qDAAqD;CACzE,MAAM,SAAS,OAAO,KAAK,MAAM,aAAa,GAAG,CAAC,CAAC;CACnD,MAAM,SAAS,QAAQ,KAAK,MAAM,WAAW,GAAG,CAAC,CAAC;CAClD,OAAO,SAAS,EAAE,MAAM,QAAQ,MAAM;AAC1C;AAsHA,SAAS,YAAY,OAAO,OAAO,MAAM;CACrC,IAAI,OAAO;EAIP,IAAI,MAAM,UAAU,OAChB,MAAM,IAAI,MAAM,gDAAgD;EACpE,cAAc,KAAK;EACnB,OAAO;CACX,OAEI,OAAO,MAAM,OAAO,EAAE,KAAK,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAgB,kBAAkB,MAAM,OAAO,YAAY,CAAC,GAAG,QAAQ;CACnE,IAAI,SAAS,iBAAiB,SAAS,WACnC,MAAM,IAAI,MAAM,oDAAgD;CACpE,IAAI,WAAW,KAAA,GACX,SAAS,SAAS;CACtB,IAAI,CAAC,SAAS,OAAO,UAAU,UAC3B,MAAM,IAAI,MAAM,kBAAkB,KAAK,cAAc;CAEzD,eAAe,SAAS;CACxB,KAAK,MAAM,KAAK;EAAC;EAAK;EAAK;CAAG,GAAG;EAC7B,MAAM,MAAM,MAAM;EAClB,IAAI,EAAE,SAAS,GAAG,KAAK,QAAQF,QAC3B,MAAM,IAAI,MAAM,SAAS,EAAE,yBAAyB;CAC5D;CACA,MAAM,KAAK,YAAY,MAAM,GAAG,UAAU,IAAI,MAAM;CACpD,MAAM,KAAK,YAAY,MAAM,GAAG,UAAU,IAAI,MAAM;CAEpD,MAAM,SAAS;EAAC;EAAM;EAAM;EADjB,SAAS,gBAAgB,MAAM;CACP;CACnC,KAAK,MAAM,KAAK,QAEZ,IAAI,CAAC,GAAG,QAAQ,MAAM,EAAE,GACpB,MAAM,IAAI,MAAM,SAAS,EAAE,yCAAyC;CAE5E,QAAQ,OAAO,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC;CAC9C,OAAO;EAAE;EAAO;EAAI;CAAG;AAC3B;;;;;;;;;;;;;;;AAeA,SAAgB,aAAa,iBAAiB,cAAc;CACxD,OAAO,SAAS,OAAO,MAAM;EACzB,MAAM,YAAY,gBAAgB,IAAI;EACtC,OAAO;GAAE;GAAW,WAAW,aAAa,SAAS;EAAE;CAC3D;AACJ;;;;;;;;;;;;ACruBA,IAAa,QAAb,MAAmB;CACf;CACA;CACA;CACA;CACA,SAAS;CACT,WAAW;CACX,YAAY;CACZ,YAAY,MAAM,KAAK;EACnB,MAAM,IAAI;EACV,SAAO,KAAK,KAAA,GAAW,KAAK;EAC5B,KAAK,QAAQ,KAAK,OAAO;EACzB,IAAI,OAAO,KAAK,MAAM,WAAW,YAC7B,MAAM,IAAI,MAAM,wBAAwB;EAC5C,KAAK,WAAW,KAAK,MAAM;EAC3B,KAAK,YAAY,KAAK,MAAM;EAC5B,MAAM,WAAW,KAAK;EACtB,MAAM,MAAM,IAAI,WAAW,QAAQ;EAEnC,IAAI,IAAI,IAAI,SAAS,WAAW,KAAK,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,GAAG;EACxE,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAC5B,IAAI,MAAM;EACd,KAAK,MAAM,OAAO,GAAG;EAGrB,KAAK,QAAQ,KAAK,OAAO;EAEzB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAC5B,IAAI,MAAM;EACd,KAAK,MAAM,OAAO,GAAG;EACrB,MAAM,GAAG;CACb;CACA,OAAO,KAAK;EACR,QAAQ,IAAI;EACZ,KAAK,MAAM,OAAO,GAAG;EACrB,OAAO;CACX;CACA,WAAW,KAAK;EACZ,QAAQ,IAAI;EACZ,QAAQ,KAAK,IAAI;EACjB,KAAK,WAAW;EAChB,MAAM,MAAM,IAAI,SAAS,GAAG,KAAK,SAAS;EAG1C,KAAK,MAAM,WAAW,GAAG;EACzB,KAAK,MAAM,OAAO,GAAG;EACrB,KAAK,MAAM,WAAW,GAAG;EACzB,KAAK,QAAQ;CACjB;CACA,SAAS;EACL,MAAM,MAAM,IAAI,WAAW,KAAK,MAAM,SAAS;EAC/C,KAAK,WAAW,GAAG;EACnB,OAAO;CACX;CACA,WAAW,IAAI;EAGX,OAAO,OAAO,OAAO,OAAO,eAAe,IAAI,GAAG,CAAC,CAAC;EACpD,MAAM,EAAE,OAAO,OAAO,UAAU,WAAW,UAAU,WAAW,WAAW;EAC3E,KAAK;EACL,GAAG,WAAW;EACd,GAAG,YAAY;EACf,GAAG,WAAW;EACd,GAAG,YAAY;EACf,GAAG,SAAS;EACZ,GAAG,QAAQ,MAAM,WAAW,GAAG,KAAK;EACpC,GAAG,QAAQ,MAAM,WAAW,GAAG,KAAK;EACpC,OAAO;CACX;CACA,QAAQ;EACJ,OAAO,KAAK,WAAW;CAC3B;CACA,UAAU;EACN,KAAK,YAAY;EACjB,KAAK,MAAM,QAAQ;EACnB,KAAK,MAAM,QAAQ;CACvB;AACJ;AACA,IAAa,OAAuB,uBAAO;CACvC,MAAM,UAAU,MAAM,KAAK,YAAY,IAAI,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO;CACnF,MAAM,UAAU,MAAM,QAAQ,IAAI,MAAM,MAAM,GAAG;CACjD,OAAO;AACX,EAAA,CAAG;;;;;;;;;ACrFH,IAAMG,QAAsB,uBAAO,CAAC;;;;;;;;;;AAUpC,IAAa,SAAb,cAA4B,MAAM;CAC9B,YAAY,IAAI,IAAI;EAChB,MAAM,CAAC;CACX;AACJ;AAGA,IAAM,OAAO;CAET,KAAK;CAEL,MAAM;EACF,SAAS,KAAK,SAAS;GACnB,MAAM,EAAE,KAAK,MAAM;GACnB,YAAY,KAAK,KAAK;GACtB,IAAI,MAAM,KAAK,MAAM,KACjB,MAAM,IAAI,EAAE,uBAAuB;GACvC,QAAQ,MAAM,MAAM;GAGpB,IAAI,KAAK,SAAS,GACd,MAAM,IAAI,EAAE,2BAA2B;GAC3C,MAAM,UAAU,KAAK,SAAS;GAC9B,MAAM,MAAM,oBAAoB,OAAO;GACvC,IAAK,IAAI,SAAS,IAAK,KACnB,MAAM,IAAI,EAAE,sCAAsC;GAEtD,MAAM,SAAS,UAAU,MAAM,oBAAqB,IAAI,SAAS,IAAK,GAAW,IAAI;GAErF,OADU,oBAAoB,GACvB,IAAI,SAAS,MAAM;EAC9B;EAEA,OAAO,KAAK,MAAM;GACd,MAAM,EAAE,KAAK,MAAM;GACnB,OAAO,OAAO,MAAM,KAAA,GAAW,UAAU;GACzC,IAAI,MAAM;GACV,IAAI,MAAM,KAAK,MAAM,KACjB,MAAM,IAAI,EAAE,uBAAuB;GACvC,IAAI,KAAK,SAAS,KAAK,KAAK,WAAW,KACnC,MAAM,IAAI,EAAE,uBAAuB;GACvC,MAAM,QAAQ,KAAK;GAEnB,MAAM,SAAS,CAAC,EAAE,QAAQ;GAC1B,IAAI,SAAS;GACb,IAAI,CAAC,QACD,SAAS;QACR;IAED,MAAM,SAAS,QAAQ;IACvB,IAAI,CAAC,QACD,MAAM,IAAI,EAAE,mDAAmD;IAEnE,IAAI,SAAS,GACT,MAAM,IAAI,EAAE,0CAA0C;IAC1D,MAAM,cAAc,KAAK,SAAS,KAAK,MAAM,MAAM;IACnD,IAAI,YAAY,WAAW,QACvB,MAAM,IAAI,EAAE,uCAAuC;IACvD,IAAI,YAAY,OAAO,GACnB,MAAM,IAAI,EAAE,sCAAsC;IACtD,KAAK,MAAM,KAAK,aACZ,SAAU,UAAU,IAAK;IAC7B,OAAO;IACP,IAAI,SAAS,KACT,MAAM,IAAI,EAAE,wCAAwC;GAC5D;GACA,MAAM,IAAI,KAAK,SAAS,KAAK,MAAM,MAAM;GACzC,IAAI,EAAE,WAAW,QACb,MAAM,IAAI,EAAE,gCAAgC;GAChD,OAAO;IAAE;IAAG,GAAG,KAAK,SAAS,MAAM,MAAM;GAAE;EAC/C;CACJ;CAKA,MAAM;EACF,OAAO,KAAK;GACR,MAAM,EAAE,KAAK,MAAM;GACnB,WAAW,GAAG;GACd,IAAI,MAAMA,OACN,MAAM,IAAI,EAAE,4CAA4C;GAC5D,IAAI,MAAM,oBAAoB,GAAG;GAEjC,IAAI,OAAO,SAAS,IAAI,IAAI,EAAE,IAAI,GAC9B,MAAM,OAAO;GACjB,IAAI,IAAI,SAAS,GACb,MAAM,IAAI,EAAE,gDAAgD;GAChE,OAAO;EACX;EACA,OAAO,MAAM;GACT,MAAM,EAAE,KAAK,MAAM;GACnB,IAAI,KAAK,SAAS,GACd,MAAM,IAAI,EAAE,kCAAkC;GAClD,IAAI,KAAK,KAAK,KACV,MAAM,IAAI,EAAE,qCAAqC;GAErD,IAAI,KAAK,SAAS,KAAK,KAAK,OAAO,KAAQ,EAAE,KAAK,KAAK,MACnD,MAAM,IAAI,EAAE,qDAAqD;GACrE,OAAO,gBAAgB,IAAI;EAC/B;CACJ;CACA,MAAM,OAAO,gBAAgB;EAEzB,MAAM,EAAE,KAAK,GAAG,MAAM,KAAK,MAAM,QAAQ;EACzC,IAAI,mBAAmB,KAAA,GAAW;GAC9B,YAAY,gBAAgB,gBAAgB;GAC5C,IAAI,iBAAiB,GACjB,MAAM,IAAI,EAAE,oDAAoD;EACxE;EACA,MAAM,OAAO,OAAO,OAAO,KAAA,GAAW,WAAW;EACjD,MAAM,EAAE,GAAG,UAAU,GAAG,iBAAiB,IAAI,OAAO,IAAM,IAAI;EAC9D,IAAI,aAAa,QACb,MAAM,IAAI,EAAE,6CAA6C;EAC7D,MAAM,EAAE,GAAG,QAAQ,GAAG,eAAe,IAAI,OAAO,GAAM,QAAQ;EAC9D,MAAM,EAAE,GAAG,QAAQ,GAAG,eAAe,IAAI,OAAO,GAAM,UAAU;EAChE,IAAI,WAAW,QACX,MAAM,IAAI,EAAE,6CAA6C;EAE7D,IAAI,mBAAmB,KAAA,MAClB,OAAO,SAAS,kBAAkB,OAAO,SAAS,iBACnD,MAAM,IAAI,EAAE,sCAAsC;EACtD,OAAO;GAAE,GAAG,IAAI,OAAO,MAAM;GAAG,GAAG,IAAI,OAAO,MAAM;EAAE;CAC1D;CACA,WAAW,KAAK;EACZ,MAAM,EAAE,MAAM,KAAK,MAAM,QAAQ;EACjC,eAAe,KAAK;GAAE,GAAG;GAAU,GAAG;EAAS,GAAG,CAAC,GAAG,KAAK;EAG3D,MAAM,MAFK,IAAI,OAAO,GAAM,IAAI,OAAO,IAAI,CAAC,CAE/B,IADF,IAAI,OAAO,GAAM,IAAI,OAAO,IAAI,CAAC,CAC1B;EAClB,OAAO,IAAI,OAAO,IAAM,GAAG;CAC/B;AACJ;;;;;;;;;;;;;;;AAeA,IAAa,MAAsB,uBAAO;CACtC,OAAO,OAAO,KAAK,IAAI;CACvB,OAAO,OAAO,KAAK,IAAI;CACvB,OAAO,OAAO,OAAO,IAAI;AAC7B,EAAA,CAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AChIH,IAAM,cAAc,KAAK,SAAS,OAAO,OAAO,IAAI,MAAM,CAAC,OAAOC,SAAO;;AAEzE,SAAgB,iBAAiB,GAAG,OAAO,GAAG;CAM1C,SAAS,UAAU,GAAGC,OAAK,CAAC;CAE5B,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO;CAC7B,MAAM,KAAK,WAAW,KAAK,GAAG,CAAC;CAC/B,MAAM,KAAK,WAAW,CAAC,KAAK,GAAG,CAAC;CAGhC,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK;CAC5B,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;CACzB,MAAM,QAAQ,KAAKA;CACnB,MAAM,QAAQ,KAAKA;CACnB,IAAI,OACA,KAAK,CAAC;CACV,IAAI,OACA,KAAK,CAAC;CAIV,MAAM,UAAU,QAAQ,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI;CACpD,IAAI,KAAKA,SAAO,MAAM,WAAW,KAAKA,SAAO,MAAM,SAC/C,MAAM,IAAI,MAAM,0CAA0C;CAE9D,OAAO;EAAE;EAAO;EAAI;EAAO;CAAG;AAClC;AACA,SAAS,kBAAkB,QAAQ;CAC/B,IAAI,CAAC;EAAC;EAAW;EAAa;CAAK,CAAC,CAAC,SAAS,MAAM,GAChD,MAAM,IAAI,MAAM,iEAA2D;CAC/E,OAAO;AACX;AACA,SAAS,gBAAgB,MAAM,KAAK;CAChC,eAAe,IAAI;CACnB,MAAM,QAAQ,CAAC;CAIf,KAAK,IAAI,WAAW,OAAO,KAAK,GAAG,GAE/B,MAAM,WAAW,KAAK,aAAa,KAAA,IAAY,IAAI,WAAW,KAAK;CAEvE,MAAM,MAAM,MAAM,MAAM;CACxB,MAAM,MAAM,SAAS,SAAS;CAC9B,IAAI,MAAM,WAAW,KAAA,GACjB,kBAAkB,MAAM,MAAM;CAClC,OAAO;AACX;AAGA,IAAMA,QAAsB,uBAAO,CAAC,GAAG,MAAsB,uBAAO,CAAC,GAAGD,QAAsB,uBAAO,CAAC,GAAG,MAAsB,uBAAO,CAAC,GAAG,MAAsB,uBAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BxK,SAAgB,YAAY,QAAQ,YAAY,CAAC,GAAG;CAChD,MAAM,YAAY,kBAAkB,eAAe,QAAQ,SAAS;CACpE,MAAM,KAAK,UAAU;CACrB,MAAM,KAAK,UAAU;CACrB,IAAI,QAAQ,UAAU;CACtB,MAAM,EAAE,GAAG,UAAU,GAAG,gBAAgB;CACxC,eAAe,WAAW,CAAC,GAAG;EAC1B,oBAAoB;EACpB,eAAe;EACf,eAAe;EACf,WAAW;EACX,SAAS;EACT,MAAM;EACN,aAAa;CACjB,CAAC;CAGD,MAAM,EAAE,MAAM,UAAU,oBAAoB,eAAe,eAAe,WAAW,YAAa;CAClG,MAAM,cAAc,UAAU,gBAAgB,KAAA,IAAYE,gBAAgB,UAAU;CACpF,IAAI;MACI,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,OAAO,SAAS,SAAS,YAAY,CAAC,MAAM,QAAQ,SAAS,OAAO,GACxF,MAAM,IAAI,MAAM,gEAA4D;CAAA;CAGpF,MAAM,OAAO,WACP;EACE,MAAM,SAAS;EACf,SAAS,SAAS,QAAQ,KAAK,UAAU,CAAC,GAAG,KAAK,CAAC;CACvD,IACE,KAAA;CACN,MAAM,UAAU,YAAY,IAAI,EAAE;CAClC,SAAS,+BAA+B;EACpC,IAAI,CAAC,GAAG,OACJ,MAAM,IAAI,MAAM,4DAA4D;CACpF;CAEA,SAAS,aAAa,IAAI,OAAO,cAAc;EAI3C,IAAI,MAAM,IAAI,GAAG;GACb,IAAI,CAAC,oBACD,MAAM,IAAI,MAAM,iBAAiB;GACrC,OAAO,WAAW,GAAG,CAAC;EAC1B;EACA,MAAM,EAAE,GAAG,MAAM,MAAM,SAAS;EAChC,MAAM,KAAK,GAAG,QAAQ,CAAC;EACvB,MAAM,cAAc,cAAc;EAClC,IAAI,cAAc;GACd,6BAA6B;GAE7B,OAAO,YAAY,QAAQ,CADT,GAAG,MAAM,CAAC,CACO,GAAG,EAAE;EAC5C,OAEI,OAAO,YAAY,WAAW,GAAG,CAAI,GAAG,IAAI,GAAG,QAAQ,CAAC,CAAC;CAEjE;CACA,SAAS,eAAe,OAAO;EAC3B,OAAO,OAAO,KAAA,GAAW,OAAO;EAChC,MAAM,EAAE,WAAW,MAAM,uBAAuB,WAAW;EAC3D,MAAM,SAAS,MAAM;EACrB,MAAM,OAAO,MAAM;EACnB,MAAM,OAAO,MAAM,SAAS,CAAC;EAM7B,IAAI,sBAAsB,WAAW,KAAK,SAAS,GAC/C,OAAO;GAAE,GAAG,GAAG;GAAM,GAAG,GAAG;EAAK;EAEpC,IAAI,WAAW,SAAS,SAAS,KAAQ,SAAS,IAAO;GACrD,MAAM,IAAI,GAAG,UAAU,IAAI;GAC3B,IAAI,CAAC,GAAG,QAAQ,CAAC,GACb,MAAM,IAAI,MAAM,qCAAqC;GACzD,MAAM,KAAK,oBAAoB,CAAC;GAChC,IAAI;GACJ,IAAI;IACA,IAAI,GAAG,KAAK,EAAE;GAClB,SACO,WAAW;IACd,MAAM,MAAM,qBAAqB,QAAQ,OAAO,UAAU,UAAU;IACpE,MAAM,IAAI,MAAM,2CAA2C,GAAG;GAClE;GACA,6BAA6B;GAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC;GAExB,KADe,OAAO,OAAO,MACf,OACV,IAAI,GAAG,IAAI,CAAC;GAChB,OAAO;IAAE;IAAG;GAAE;EAClB,OACK,IAAI,WAAW,UAAU,SAAS,GAAM;GAEzC,MAAM,IAAI,GAAG;GACb,MAAM,IAAI,GAAG,UAAU,KAAK,SAAS,GAAG,CAAC,CAAC;GAC1C,MAAM,IAAI,GAAG,UAAU,KAAK,SAAS,GAAG,IAAI,CAAC,CAAC;GAC9C,IAAI,CAAC,UAAU,GAAG,CAAC,GACf,MAAM,IAAI,MAAM,4BAA4B;GAChD,OAAO;IAAE;IAAG;GAAE;EAClB,OAEI,MAAM,IAAI,MAAM,yBAAyB,OAAO,wBAAwB,KAAK,mBAAmB,QAAQ;CAEhH;CACA,MAAM,cAAc,YAAY,KAAA,IAAY,eAAe;CAC3D,MAAM,cAAc,cAAc,KAAA,IAAY,iBAAiB;CAI/D,MAAM,KAAK,GAAG,IAAI,MAAM,GAAG,GAAG;CAC9B,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,KAAK,MAAM,GAAG,QAAQ,MAAM,GAAG,IAAI,MAAM,GAAG,CAAC;CACxE,SAAS,oBAAoB,GAAG;EAC5B,MAAM,KAAK,GAAG,IAAI,CAAC;EACnB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC;EACvB,OAAO,GAAG,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC;CACzD;;CAGA,SAAS,UAAU,GAAG,GAAG;EACrB,MAAM,OAAO,GAAG,IAAI,CAAC;EACrB,MAAM,QAAQ,oBAAoB,CAAC;EACnC,OAAO,GAAG,IAAI,MAAM,KAAK;CAC7B;CAIA,IAAI,CAAC,UAAU,MAAM,IAAI,MAAM,EAAE,GAC7B,MAAM,IAAI,MAAM,mCAAmC;CAGvD,MAAM,OAAO,GAAG,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,GAAG,GAAG;CAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;CAChD,IAAI,GAAG,IAAI,GAAG,IAAI,MAAM,KAAK,CAAC,GAC1B,MAAM,IAAI,MAAM,0BAA0B;;CAE9C,SAAS,OAAO,OAAO,GAAG,UAAU,OAAO;EACvC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAM,WAAW,GAAG,IAAI,CAAC,GACtC,MAAM,IAAI,MAAM,wBAAwB,OAAO;EAInD,OAAO,OAAO,MAAM,YAAY,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI;CAChE;CACA,SAAS,UAAU,OAAO;EACtB,IAAI,EAAE,iBAAiB,QACnB,MAAM,IAAI,MAAM,4BAA4B;CACpD;CACA,SAAS,iBAAiB,GAAG;EACzB,IAAI,CAAC,QAAQ,CAAC,KAAK,SACf,MAAM,IAAI,MAAM,SAAS;EAC7B,OAAO,iBAAiB,GAAG,KAAK,SAAS,GAAG,KAAK;CACrD;;;;;;;CAOA,SAAS,aAAa,QAAQ,SAAS,GAAG,GAAG;EACzC,IAAI,CAAC,GAAG,QAAQ,CAAC,GACb,MAAM,IAAI,WAAW,8BAA8B;EACvD,IAAI,MAAM;GACN,MAAM,EAAE,OAAO,IAAI,OAAO,OAAO,iBAAiB,CAAC;GACnD,MAAM,MAAM,IAAI,MAAM,GAAG,IAAI,EAAE,GAAG,KAAK,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC;GACtD,OAAO,KAAK,QAAQ,EAAE,OAAO,IAAI,GAAG,QAAQ,IAAI,OAAO,IAAI,GAAG;GAC9D,QAAQ,KAAK,IAAI,EAAE;EACvB,OACK;GACD,OAAO,KAAK,CAAC;GACb,QAAQ,KAAK,CAAC;EAClB;CACJ;CAMA,MAAM,gCAAgB,IAAI,QAAQ;;;;;;CAMlC,MAAM,MAAM;EACR,OAAO,OAAO,IAAI,MAAM,MAAM,IAAI,MAAM,IAAI,GAAG,GAAG;EAClD,OAAO,OAAO,IAAI,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,IAAI;EAChD,OAAO,KAAK;EACZ,OAAO,KAAK;EACZ;EACA;EACA;;EAEA,YAAY,GAAG,GAAG,GAAG;GACjB,KAAK,IAAI,OAAO,KAAK,CAAC;GAItB,KAAK,IAAI,OAAO,KAAK,GAAG,IAAI;GAC5B,KAAK,IAAI,OAAO,KAAK,CAAC;GACtB,OAAO,OAAO,IAAI;EACtB;EACA,OAAO,QAAQ;GACX,OAAO;EACX;;EAEA,OAAO,WAAW,GAAG;GACjB,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC;GACvB,IAAI,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,GACrC,MAAM,IAAI,MAAM,sBAAsB;GAC1C,IAAI,aAAa,OACb,MAAM,IAAI,MAAM,8BAA8B;GAElD,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GACrB,OAAO,MAAM;GACjB,OAAO,IAAI,MAAM,GAAG,GAAG,GAAG,GAAG;EACjC;EACA,OAAO,UAAU,OAAO;GACpB,MAAM,IAAI,MAAM,WAAW,YAAY,OAAO,OAAO,KAAA,GAAW,OAAO,CAAC,CAAC;GACzE,EAAE,eAAe;GACjB,OAAO;EACX;EACA,OAAO,QAAQ,KAAK;GAChB,OAAO,MAAM,UAAU,WAAW,GAAG,CAAC;EAC1C;EACA,IAAI,IAAI;GACJ,OAAO,KAAK,SAAS,CAAC,CAAC;EAC3B;EACA,IAAI,IAAI;GACJ,OAAO,KAAK,SAAS,CAAC,CAAC;EAC3B;;;;EAIA,WAAW,aAAa,GAAG,SAAS,MAAM;GACtC,KAAK,cAAc,MAAM,UAAU;GACnC,IAAI,CAAC,QACD,KAAK,SAAS,GAAG;GACrB,OAAO;EACX;;EAGA,iBAAiB;GACb,MAAM,IAAI;GACV,IAAI,EAAE,IAAI,GAAG;IAKT,IAAI,sBAAsB,GAAG,IAAI,EAAE,CAAC,KAAK,GAAG,IAAI,EAAE,GAAG,GAAG,GAAG,KAAK,GAAG,IAAI,EAAE,CAAC,GACtE;IACJ,MAAM,IAAI,MAAM,iBAAiB;GACrC;GACA,IAAI,cAAc,IAAI,CAAC,GACnB;GAEJ,MAAM,EAAE,GAAG,MAAM,EAAE,SAAS;GAC5B,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,GAC/B,MAAM,IAAI,MAAM,sCAAsC;GAC1D,IAAI,CAAC,UAAU,GAAG,CAAC,GACf,MAAM,IAAI,MAAM,mCAAmC;GACvD,IAAI,CAAC,EAAE,cAAc,GACjB,MAAM,IAAI,MAAM,wCAAwC;GAC5D,cAAc,IAAI,CAAC;EACvB;EACA,WAAW;GACP,MAAM,EAAE,MAAM,KAAK,SAAS;GAC5B,IAAI,CAAC,GAAG,OACJ,MAAM,IAAI,MAAM,6BAA6B;GACjD,OAAO,CAAC,GAAG,MAAM,CAAC;EACtB;;EAEA,OAAO,OAAO;GACV,UAAU,KAAK;GACf,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO;GAChC,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO;GAChC,MAAM,KAAK,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;GAChD,MAAM,KAAK,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;GAChD,OAAO,MAAM;EACjB;;EAEA,SAAS;GACL,OAAO,IAAI,MAAM,KAAK,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC;EACnD;EAKA,SAAS;GACL,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO;GAChC,IAAI,KAAK,GAAG,MAAM,KAAK,GAAG,MAAM,KAAK,GAAG;GACxC,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,KAAK,EAAE;GACZ,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,KAAK,EAAE;GACZ,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,KAAK,EAAE;GACZ,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,OAAO,IAAI,MAAM,IAAI,IAAI,EAAE;EAC/B;EAKA,IAAI,OAAO;GACP,UAAU,KAAK;GACf,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO;GAChC,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO;GAChC,IAAI,KAAK,GAAG,MAAM,KAAK,GAAG,MAAM,KAAK,GAAG;GACxC,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE;GACtB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,KAAK,EAAE;GACZ,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,KAAK,EAAE;GACZ,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,KAAK,EAAE;GACZ,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,KAAK,GAAG,IAAI,IAAI,EAAE;GAClB,OAAO,IAAI,MAAM,IAAI,IAAI,EAAE;EAC/B;EACA,SAAS,OAAO;GAGZ,UAAU,KAAK;GACf,OAAO,KAAK,IAAI,MAAM,OAAO,CAAC;EAClC;EACA,MAAM;GACF,OAAO,KAAK,OAAO,MAAM,IAAI;EACjC;;;;;;;;EAQA,SAAS,QAAQ;GAIb,IAAI,CAAC,GAAG,YAAY,MAAM,GACtB,MAAM,IAAI,WAAW,8BAA8B;GACvD,MAAM,EAAE,GAAG,MAAM,KAAK,UAAU,MAAM,QAAQ,UAAU,SAAS;GACjE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;EAC7B;;;;;;;EAOA,eAAe,QAAQ;GACnB,MAAM,IAAI;GACV,MAAM,KAAK;GAGX,IAAI,CAAC,GAAG,QAAQ,EAAE,GACd,MAAM,IAAI,WAAW,8BAA8B;GACvD,IAAI,OAAOD,SAAO,EAAE,IAAI,GACpB,OAAO,MAAM;GACjB,IAAI,OAAO,KACP,OAAO;GACX,IAAI,KAAK,cAAc,IAAI,GACvB,OAAO,KAAK,UAAU,GAAG,IAAI,SAAS;GAC1C,MAAM,SAAS,CAAC;GAChB,MAAM,UAAU,CAAC;GACjB,aAAa,QAAQ,SAAS,GAAG,EAAE;GACnC,OAAO,aAAa,OAAO,QAAQ,OAAO;EAC9C;;;;;;;;EAQA,aAAa,GAAG,OAAO,GAAG;GACtB,UAAU,KAAK;GACf,MAAM,SAAS,CAAC;GAChB,MAAM,UAAU,CAAC;GACjB,aAAa,QAAQ,SAAS,MAAM,CAAC;GACrC,aAAa,QAAQ,SAAS,OAAO,CAAC;GACtC,OAAO,aAAa,OAAO,QAAQ,OAAO;EAC9C;;;;;;EAMA,SAAS,WAAW;GAChB,MAAM,IAAI;GACV,IAAI,KAAK;GACT,IAAI,MAAM,QAAQ,CAAC,GAAG,QAAQ,EAAE,GAC5B,MAAM,IAAI,WAAW,4CAA0C;GACnE,MAAM,EAAE,GAAG,GAAG,MAAM;GAEpB,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,GAChB,OAAO;IAAE,GAAG;IAAG,GAAG;GAAE;GACxB,MAAM,MAAM,EAAE,IAAI;GAGlB,IAAI,MAAM,MACN,KAAK,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;GAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAE;GACtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAE;GACtB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE;GACvB,IAAI,KACA,OAAO;IAAE,GAAG,GAAG;IAAM,GAAG,GAAG;GAAK;GACpC,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,GAClB,MAAM,IAAI,MAAM,kBAAkB;GACtC,OAAO;IAAE;IAAG;GAAE;EAClB;;;;;EAKA,gBAAgB;GACZ,IAAI,aAAa,KACb,OAAO;GACX,IAAI,eACA,OAAO,cAAc,OAAO,IAAI;GAEpC,OAAO,KAAK,UAAU,MAAM,WAAW,CAAC,CAAC,IAAI;EACjD;EACA,gBAAgB;GACZ,IAAI,aAAa,KACb,OAAO;GACX,IAAI,eACA,OAAO,cAAc,OAAO,IAAI;GAIpC,OAAO,KAAK,eAAe,QAAQ;EACvC;EACA,eAAe;GACX,IAAI,aAAa,KACb,OAAO,KAAK,IAAI;GACpB,OAAO,KAAK,cAAc,CAAC,CAAC,IAAI;EACpC;EACA,QAAQ,eAAe,MAAM;GACzB,MAAM,cAAc,cAAc;GAGlC,KAAK,eAAe;GACpB,OAAO,YAAY,OAAO,MAAM,YAAY;EAChD;EACA,MAAM,eAAe,MAAM;GACvB,OAAO,WAAW,KAAK,QAAQ,YAAY,CAAC;EAChD;EACA,WAAW;GACP,OAAO,UAAU,KAAK,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE;EACxD;CACJ;CACA,MAAM,aAAa,WAAW,WAAW,OAAO,MAAM;CACtD,MAAM,OAAO,IAAI,iBAAiB,OAAO,WAAW;CAGpD,IAAI,KAAK,QAAQ,GACb,MAAM,KAAK,WAAW,CAAC;CAC3B,OAAO,OAAO,MAAM,SAAS;CAC7B,OAAO,OAAO,KAAK;CACnB,OAAO;AACX;AAEA,SAAS,QAAQ,UAAU;CACvB,OAAO,WAAW,GAAG,WAAW,IAAO,CAAI;AAC/C;AACA,SAAS,YAAY,IAAI,IAAI;CACzB,OAAO;EACH,WAAW,GAAG;EACd,WAAW,IAAI,GAAG;EAClB,uBAAuB,IAAI,IAAI,GAAG;EAClC,oBAAoB;EAGpB,WAAW,IAAI,GAAG;CACtB;AACJ;;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,KAAK,OAAO,WAAW,CAAC,GAAG;CACvC,kBAAkB,KAAK;CACvB,MAAM,EAAE,OAAO;CACf,MAAM,eAAe,SAAS,gBAAgB,KAAA,IAAYC,gBAAgB,SAAS;CAGnF,MAAM,UAAU,OAAO,OAAO,YAAY,MAAM,IAAI,EAAE,GAAG,EACrD,MAAM,KAAK,IAAI,iBAAiB,GAAG,KAAK,GAAG,EAAE,EACjD,CAAC;CACD,SAAS,iBAAiB,WAAW;EACjC,IAAI;GACA,MAAM,MAAM,GAAG,UAAU,SAAS;GAClC,OAAO,GAAG,YAAY,GAAG;EAC7B,SACO,OAAO;GACV,OAAO;EACX;CACJ;CACA,SAAS,iBAAiB,WAAW,cAAc;EAC/C,MAAM,EAAE,WAAW,MAAM,0BAA0B;EACnD,IAAI;GACA,MAAM,IAAI,UAAU;GACpB,IAAI,iBAAiB,QAAQ,MAAM,MAC/B,OAAO;GACX,IAAI,iBAAiB,SAAS,MAAM,uBAChC,OAAO;GAGX,OAAO,CAAC,MAAM,UAAU,SAAS,CAAC,CAAC,IAAI;EAC3C,SACO,OAAO;GACV,OAAO;EACX;CACJ;;;;;CAKA,SAAS,gBAAgB,MAAM;EAC3B,OAAO,SAAS,KAAA,IAAY,aAAa,QAAQ,IAAI,IAAI;EACzD,OAAO,eAAe,OAAO,MAAM,QAAQ,MAAM,MAAM,GAAG,GAAG,KAAK;CACtE;;;;;;CAMA,SAAS,aAAa,WAAW,eAAe,MAAM;EAClD,OAAO,MAAM,KAAK,SAAS,GAAG,UAAU,SAAS,CAAC,CAAC,CAAC,QAAQ,YAAY;CAC5E;;;;CAIA,SAAS,UAAU,MAAM;EACrB,MAAM,EAAE,WAAW,WAAW,0BAA0B;EACxD,MAAM,iBAAiB,GAAG;EAC1B,IAAI,CAAC,QAAQ,IAAI,GACb,OAAO,KAAA;EACX,MAAM,IAAI,OAAO,MAAM,KAAA,GAAW,KAAK,CAAC,CAAC;EACzC,MAAM,QAAQ,MAAM,aAAa,MAAM;EACvC,MAAM,QAAQ,MAAM,aAAa,CAAC,CAAC,gBAAgB,SAAS,CAAC;EAE7D,IAAI,SAAS,OACT,OAAO,KAAA;EACX,OAAO;CACX;;;;;;;;;;;;;CAaA,SAAS,gBAAgB,YAAY,YAAY,eAAe,MAAM;EAClE,IAAI,UAAU,UAAU,MAAM,MAC1B,MAAM,IAAI,MAAM,+BAA+B;EACnD,IAAI,UAAU,UAAU,MAAM,OAC1B,MAAM,IAAI,MAAM,+BAA+B;EACnD,MAAM,IAAI,GAAG,UAAU,UAAU;EACjC,MAAM,IAAI,MAAM,UAAU,UAAU;EACpC,IAAI,EAAE,IAAI,GACN,MAAM,IAAI,MAAM,uCAAuC;EAC3D,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,YAAY;CAC7C;CACA,MAAM,QAAQ;EACV;EACA;EACA;CACJ;CACA,MAAM,SAAS,aAAa,iBAAiB,YAAY;CACzD,OAAO,OAAO,KAAK;CACnB,OAAO,OAAO,OAAO;CACrB,OAAO,OAAO,OAAO;EAAE;EAAc;EAAiB;EAAQ;EAAO;EAAO;CAAQ,CAAC;AACzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAgB,MAAM,OAAO,MAAM,YAAY,CAAC,GAAG;CAC/C,kBAAkB,KAAK;CAEvB,MAAM,QAAQ;CACd,MAAM,KAAK;CACX,eAAe,WAAW,CAAC,GAAG;EAC1B,MAAM;EACN,MAAM;EACN,aAAa;EACb,UAAU;EACV,eAAe;CACnB,CAAC;CACD,MAAM,OAAO,OAAO,OAAO,CAAC,GAAG,SAAS;CACxC,MAAM,cAAc,KAAK,gBAAgB,KAAA,IAAYA,gBAAgB,KAAK;CAC1E,MAAMC,SAAO,KAAK,SAAS,KAAA,KACpB,KAAK,QAAQC,KAAU,OAAO,KAAK,GAAG,IACvC,KAAK;CACX,MAAM,EAAE,IAAI,OAAO;CACnB,MAAM,EAAE,OAAO,aAAa,MAAM,WAAW;CAM7C,MAAM,cAAc,iBAAiB,WAAW;CAChD,MAAM,SAAS,iBAAiB,aAAa,WAAW;CACxD,MAAM,EAAE,QAAQ,cAAc,iBAAiB,OAAO,YAAY,KAAK,OAAO,IAAI;CAClF,MAAM,iBAAiB;EACnB,SAAS;EACT,MAAM,OAAO,KAAK,SAAS,YAAY,KAAK,OAAO;EACnD,QAAQ;EACR,cAAc;CAClB;CAKA,MAAM,wBAAwB,cAAcJ,QAAM,MAAM,GAAG;CAC3D,SAAS,sBAAsB,QAAQ;EAEnC,OAAO,SADM,eAAe;CAEhC;CACA,SAAS,WAAW,OAAO,KAAK;EAC5B,IAAI,CAAC,GAAG,YAAY,GAAG,GACnB,MAAM,IAAI,MAAM,qBAAqB,MAAM,iCAAiC;EAChF,OAAO;CACX;CACA,SAAS,6BAA6B;EAClC,IAAI,CAAC,GAAG,OACJ,MAAM,IAAI,MAAM,6BAA6B;CACrD;CAGA,SAAS,eAAe,GAAG,GAAG,GAAG;EAC7B,2BAA2B;EAC3B,QAAQ,MAAM,IAAI,IAAI,KAAK,OAAO,GAAG,MAAM,CAAC,CAAC;CACjD;CACA,SAAS,yBAAyB;EAQ9B,IAAI,uBACA,MAAM,IAAI,MAAM,gEAA8D;CACtF;CACA,SAAS,kBAAkB,OAAO,QAAQ;EACtC,kBAAkB,MAAM;EACxB,MAAM,OAAO,QAAQ;EAErB,OAAO,OAAO,OADA,WAAW,YAAY,OAAO,WAAW,cAAc,OAAO,IAAI,KAAA,CACtD;CAC9B;;;;CAIA,MAAM,UAAU;EACZ;EACA;EACA;EACA,YAAY,GAAG,GAAG,UAAU;GACxB,KAAK,IAAI,WAAW,KAAK,CAAC;GAC1B,KAAK,IAAI,WAAW,KAAK,CAAC;GAC1B,IAAI,YAAY,MAAM;IAClB,uBAAuB;IACvB,IAAI,CAAC;KAAC;KAAG;KAAG;KAAG;IAAC,CAAC,CAAC,SAAS,QAAQ,GAC/B,MAAM,IAAI,MAAM,qBAAqB;IACzC,KAAK,WAAW;GACpB;GACA,OAAO,OAAO,IAAI;EACtB;EACA,OAAO,UAAU,OAAO,SAAS,eAAe,QAAQ;GACpD,kBAAkB,OAAO,MAAM;GAC/B,IAAI;GACJ,IAAI,WAAW,OAAO;IAGlB,IAAI,MAAM,SAAS,IAAI,GAAG,QAAQ,IAC9B,MAAM,IAAI,IAAI,IAAI,2CAA2C;IACjE,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,OAAO,KAAK,GAAG,GAAG,QAAQ,CAAC;IACtD,OAAO,IAAI,UAAU,GAAG,CAAC;GAC7B;GACA,IAAI,WAAW,aAAa;IACxB,QAAQ,MAAM;IACd,SAAS;IACT,QAAQ,MAAM,SAAS,CAAC;GAC5B;GACA,MAAM,IAAI,QAAQ,YAAY;GAC9B,MAAM,IAAI,MAAM,SAAS,GAAG,CAAC;GAC7B,MAAM,IAAI,MAAM,SAAS,GAAG,IAAI,CAAC;GACjC,OAAO,IAAI,UAAU,GAAG,UAAU,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,KAAK;EAChE;EACA,OAAO,QAAQ,KAAK,QAAQ;GACxB,OAAO,KAAK,UAAU,WAAW,GAAG,GAAG,MAAM;EACjD;EACA,iBAAiB;GACb,MAAM,EAAE,aAAa;GACrB,IAAI,YAAY,MACZ,MAAM,IAAI,MAAM,sCAAsC;GAC1D,OAAO;EACX;EACA,eAAe,UAAU;GACrB,OAAO,IAAI,UAAU,KAAK,GAAG,KAAK,GAAG,QAAQ;EACjD;EAGA,iBAAiB,aAAa;GAC1B,MAAM,EAAE,GAAG,MAAM;GACjB,MAAM,WAAW,KAAK,eAAe;GACrC,MAAM,OAAO,aAAa,KAAK,aAAa,IAAI,IAAI,cAAc;GAClE,IAAI,CAAC,GAAG,QAAQ,IAAI,GAChB,MAAM,IAAI,MAAM,2CAA2C;GAC/D,MAAM,IAAI,GAAG,QAAQ,IAAI;GACzB,MAAM,IAAI,MAAM,UAAU,YAAY,SAAS,WAAW,OAAO,CAAC,GAAG,CAAC,CAAC;GACvE,MAAM,KAAK,GAAG,IAAI,IAAI;GACtB,MAAM,IAAI,cAAc,OAAO,aAAa,KAAA,GAAW,SAAS,CAAC;GACjE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE;GAC5B,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE;GAE3B,MAAM,IAAI,MAAM,KAAK,aAAa,IAAI,GAAG,EAAE;GAC3C,IAAI,EAAE,IAAI,GACN,MAAM,IAAI,MAAM,qCAAqC;GACzD,EAAE,eAAe;GACjB,OAAO;EACX;EAEA,WAAW;GACP,OAAO,sBAAsB,KAAK,CAAC;EACvC;EACA,QAAQ,SAAS,eAAe,QAAQ;GACpC,kBAAkB,MAAM;GACxB,IAAI,WAAW,OACX,OAAO,WAAW,IAAI,WAAW,IAAI,CAAC;GAC1C,MAAM,EAAE,GAAG,MAAM;GACjB,MAAM,KAAK,GAAG,QAAQ,CAAC;GACvB,MAAM,KAAK,GAAG,QAAQ,CAAC;GACvB,IAAI,WAAW,aAAa;IACxB,uBAAuB;IACvB,OAAO,YAAY,WAAW,GAAG,KAAK,eAAe,CAAC,GAAG,IAAI,EAAE;GACnE;GACA,OAAO,YAAY,IAAI,EAAE;EAC7B;EACA,MAAM,QAAQ;GACV,OAAO,WAAW,KAAK,QAAQ,MAAM,CAAC;EAC1C;CACJ;CACA,OAAO,OAAO,UAAU,SAAS;CACjC,OAAO,OAAO,SAAS;CAKvB,MAAM,WAAW,KAAK,aAAa,KAAA,IAC7B,SAAS,aAAa,OAAO;EAE3B,IAAI,MAAM,SAAS,MACf,MAAM,IAAI,MAAM,oBAAoB;EAGxC,MAAM,MAAM,gBAAgB,KAAK;EACjC,MAAM,QAAQ,MAAM,SAAS,IAAI;EACjC,OAAO,QAAQ,IAAI,OAAO,OAAO,KAAK,IAAI;CAC9C,IACE,KAAK;CACX,MAAM,gBAAgB,KAAK,kBAAkB,KAAA,IACvC,SAAS,kBAAkB,OAAO;EAChC,OAAO,GAAG,OAAO,SAAS,KAAK,CAAC;CACpC,IACE,KAAK;CACX,MAAM,aAAa,QAAQ,MAAM;;CAGjC,SAAS,WAAW,KAAK;EACrB,SAAS,aAAa,QAAQ,KAAKC,OAAK,UAAU;EAClD,OAAO,GAAG,QAAQ,GAAG;CACzB;CACA,SAAS,mBAAmB,SAAS,SAAS;EAC1C,OAAO,SAAS,KAAA,GAAW,SAAS;EACpC,OAAQ,UAAU,OAAO,MAAM,OAAO,GAAG,KAAA,GAAW,mBAAmB,IAAI;CAC/E;;;;;;;;;CASA,SAAS,QAAQ,SAAS,WAAW,MAAM;EACvC,MAAM,EAAE,MAAM,SAAS,iBAAiB,gBAAgB,MAAM,cAAc;EAC5E,UAAU,mBAAmB,SAAS,OAAO;EAI7C,MAAM,QAAQ,cAAc,OAAO;EACnC,MAAM,IAAI,GAAG,UAAU,SAAS;EAChC,IAAI,CAAC,GAAG,YAAY,CAAC,GACjB,MAAM,IAAI,MAAM,qBAAqB;EACzC,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,WAAW,KAAK,CAAC;EAElD,IAAI,gBAAgB,QAAQ,iBAAiB,OAAO;GAGhD,MAAM,IAAI,iBAAiB,OAAO,YAAY,QAAQ,SAAS,IAAI;GACnE,SAAS,KAAK,OAAO,GAAG,KAAA,GAAW,cAAc,CAAC;EACtD;EACA,MAAM,OAAO,YAAY,GAAG,QAAQ;EACpC,MAAM,IAAI;EAYV,SAAS,MAAM,QAAQ;GAGnB,MAAM,IAAI,SAAS,MAAM;GACzB,IAAI,CAAC,GAAG,YAAY,CAAC,GACjB;GACJ,MAAM,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;GAC1C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;GACvB,IAAI,MAAMA,OACN;GACJ,IAAI;GACJ,IAAI,WAAW,KAAA,GAAW;IAEtB,MAAM,IAAI,gBAAgB,eAAe,OAAO,WAAW,GAAG,WAAW,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;IACtB,IAAI,GAAG,OAAO,MAAM,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC;GAC9C,OACK;IACD,MAAM,KAAK,SAAS,GAAG,WAAW;IAClC,IAAI,GAAG,OAAO,KAAK,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC;GAC3C;GACA,IAAI,MAAMA,OACN;GACJ,IAAI,WAAW,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC;GACzC,IAAI,QAAQ;GACZ,IAAI,QAAQ,sBAAsB,CAAC,GAAG;IAClC,QAAQ,GAAG,IAAI,CAAC;IAChB,YAAY;GAChB;GACA,OAAO,IAAI,UAAU,GAAG,OAAO,wBAAwB,KAAA,IAAY,QAAQ;EAC/E;EACA,OAAO;GAAE;GAAM;EAAM;CACzB;;;;;;;;;;;;;;CAcA,SAAS,KAAK,SAAS,WAAW,OAAO,CAAC,GAAG;EACzC,MAAM,EAAE,MAAM,UAAU,QAAQ,SAAS,WAAW,IAAI;EAGxD,OAFa,eAAe,MAAM,WAAW,GAAG,OAAOE,MACxC,CAAC,CAAC,MAAM,KACd,CAAC,CAAC,QAAQ,KAAK,MAAM;CAClC;;;;;;;;;;;;;;CAcA,SAAS,OAAO,WAAW,SAAS,WAAW,OAAO,CAAC,GAAG;EACtD,MAAM,EAAE,MAAM,SAAS,WAAW,gBAAgB,MAAM,cAAc;EACtE,YAAY,OAAO,WAAW,KAAA,GAAW,WAAW;EACpD,UAAU,mBAAmB,SAAS,OAAO;EAC7C,IAAI,CAAC,QAAQ,SAAS,GAAG;GACrB,MAAM,MAAM,qBAAqB,YAAY,wBAAwB;GACrE,MAAM,IAAI,MAAM,wCAAwC,GAAG;EAC/D;EACA,kBAAkB,WAAW,MAAM;EACnC,IAAI;GACA,MAAM,MAAM,UAAU,UAAU,WAAW,MAAM;GACjD,MAAM,IAAI,MAAM,UAAU,SAAS;GAGnC,IAAI,EAAE,IAAI,GACN,OAAO;GACX,IAAI,QAAQ,IAAI,SAAS,GACrB,OAAO;GACX,MAAM,EAAE,GAAG,MAAM;GACjB,MAAM,IAAI,cAAc,OAAO;GAC/B,MAAM,KAAK,GAAG,IAAI,CAAC;GACnB,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE;GAC3B,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE;GAC3B,MAAM,IAAI,MAAM,KAAK,aAAa,IAAI,GAAG,EAAE;GAC3C,IAAI,EAAE,IAAI,GACN,OAAO;GACX,MAAM,IAAI,EAAE,SAAS;GAErB,IADU,GAAG,OAAO,EAAE,CAClB,MAAM,GACN,OAAO;GAGX,IAAI,WAAW,eAAe,IAAI,aAAa,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,GACrE,OAAO;GACX,OAAO;EACX,SACO,GAAG;GACN,OAAO;EACX;CACJ;CACA,SAAS,iBAAiB,WAAW,SAAS,OAAO,CAAC,GAAG;EAGrD,MAAM,EAAE,YAAY,gBAAgB,MAAM,cAAc;EACxD,UAAU,mBAAmB,SAAS,OAAO;EAC7C,OAAO,UAAU,UAAU,WAAW,WAAW,CAAC,CAAC,iBAAiB,OAAO,CAAC,CAAC,QAAQ;CACzF;CAEA,OAAO,OAAO,OAAO;EACjB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,MAAM;CACV,CAAC;AACL;;;;;;;;;;;ACznCA,IAAM,kBAAkB;CACpB,GAAG,OAAO,oEAAoE;CAC9E,GAAG,OAAO,oEAAoE;CAC9E,GAAG,OAAO,CAAC;CACX,GAAG,OAAO,CAAC;CACX,GAAG,OAAO,CAAC;CACX,IAAI,OAAO,oEAAoE;CAC/E,IAAI,OAAO,oEAAoE;AACnF;AACA,IAAM,iBAAiB;CACnB,MAAM,OAAO,oEAAoE;CACjF,SAAS,CACL,CAAC,OAAO,oCAAoC,GAAG,CAAC,OAAO,oCAAoC,CAAC,GAC5F,CAAC,OAAO,qCAAqC,GAAG,OAAO,oCAAoC,CAAC,CAChG;AACJ;AACA,IAAM,MAAsB,uBAAO,CAAC;AACpC,IAAM,MAAsB,uBAAO,CAAC;;;;;AAKpC,SAAS,QAAQ,GAAG;CAChB,MAAM,IAAI,gBAAgB;CAE1B,MAAM,MAAM,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,OAAO,EAAE,GAAG,OAAO,OAAO,EAAE;CAE3E,MAAM,OAAO,OAAO,EAAE,GAAG,OAAO,OAAO,EAAE,GAAG,OAAO,OAAO,EAAE;CAC5D,MAAM,KAAM,IAAI,IAAI,IAAK;CACzB,MAAM,KAAM,KAAK,KAAK,IAAK;CAG3B,MAAM,MAAO,KADD,KADA,KAAK,IAAI,KAAK,CAAC,IAAI,KAAM,GAChB,KAAK,CAAC,IAAI,KAAM,GACf,KAAK,CAAC,IAAI,KAAM;CACtC,MAAM,MAAO,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO;CACzC,MAAM,MAAO,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO;CACzC,MAAM,MAAO,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO;CAMzC,MAAM,OAAO,KADD,KADA,KADE,KADA,KADA,KAAK,KAAK,MAAM,CAAC,IAAI,MAAO,GACjB,MAAM,CAAC,IAAI,MAAO,GAClB,KAAK,CAAC,IAAI,KAAM,GAClB,MAAM,CAAC,IAAI,MAAO,GACpB,KAAK,CAAC,IAAI,KAAM,GACf,KAAK,CAAC;CAC5B,IAAI,CAAC,KAAK,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,GAC3B,MAAM,IAAI,MAAM,yBAAyB;CAC7C,OAAO;AACX;AACA,IAAM,OAAuB,sBAAM,gBAAgB,GAAG,EAAE,MAAM,QAAQ,CAAC;AACvE,IAAM,UAA0B,4BAAY,iBAAiB;CACzD,IAAI;CACJ,MAAM;AACV,CAAC;;;;;;;;;;;;;;;;;;;;AAoBD,IAAa,YAA4B,sBAAM,SAAS,MAAM;;AAI9D,IAAM,uBAAuB,OAAO,OAAO,IAAI;AAE/C,SAAS,WAAW,KAAK,GAAG,UAAU;CAClC,IAAI,OAAO,qBAAqB;CAChC,IAAI,SAAS,KAAA,GAAW;EACpB,MAAM,OAAO,OAAO,aAAa,GAAG,CAAC;EACrC,OAAO,YAAY,MAAM,IAAI;EAC7B,qBAAqB,OAAO;CAChC;CACA,OAAO,OAAO,YAAY,MAAM,GAAG,QAAQ,CAAC;AAChD;AAEA,IAAM,gBAAgB,UAAU,MAAM,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC;AAC3D,IAAM,kBAAkB,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAChD,IAAM,WAAW,MAAM,CAAC,KAAK,MAAM,CAAC;AAEpC,SAAS,oBAAoB,MAAM;CAC/B,MAAM,EAAE,IAAI,SAAS;CACrB,MAAM,KAAK,GAAG,UAAU,OAAO,MAAM,IAAI,WAAW,CAAC;CAErD,MAAM,SADI,KAAK,SAAS,EACT,CAAC,CAAC,SAAS;CAE1B,OAAO;EAAE,QADM,QAAQ,OAAO,CAAC,IAAI,KAAK,GAAG,IAAI,EAAE;EAChC,OAAO,eAAe,MAAM;CAAE;AACnD;;;;;AAKA,SAAS,OAAO,GAAG;CACf,MAAM,KAAK;CACX,IAAI,CAAC,GAAG,YAAY,CAAC,GACjB,MAAM,IAAI,MAAM,0BAA0B;CAC9C,MAAM,KAAK,GAAG,IAAI,CAAC;CACnB,MAAM,IAAI,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;CAC1C,IAAI,IAAI,GAAG,KAAK,CAAC;CAGjB,IAAI,CAAC,QAAQ,CAAC,GACV,IAAI,GAAG,IAAI,CAAC;CAChB,MAAM,IAAI,QAAQ,WAAW;EAAE;EAAG;CAAE,CAAC;CACrC,EAAE,eAAe;CACjB,OAAO;AACX;AAGA,IAAM,MAAM;;AAEZ,SAAS,UAAU,GAAG,MAAM;CACxB,OAAO,QAAQ,GAAG,OAAO,IAAI,WAAW,qBAAqB,GAAG,IAAI,CAAC,CAAC;AAC1E;;AAEA,SAAS,oBAAoB,WAAW;CACpC,OAAO,oBAAoB,SAAS,CAAC,CAAC;AAC1C;;;;;;;AAOA,SAAS,YAAY,SAAS,WAAW,UAAUE,cAAY,EAAE,GAAG;CAChE,MAAM,EAAE,IAAI,SAAS;CAErB,MAAM,IAAI,UAAU,OAAO,SAAS,KAAA,GAAW,SAAS,CAAC;CACzD,MAAM,EAAE,OAAO,IAAI,QAAQ,MAAM,oBAAoB,SAAS;CAC9D,MAAM,IAAI,OAAO,SAAS,IAAI,SAAS;CAGvC,MAAM,OAAO,WAAW,iBADd,GAAG,QAAQ,IAAI,IAAI,WAAW,eAAe,CAAC,CAAC,CAChB,GAAG,IAAI,CAAC;CAIjD,MAAM,KAAK,GAAG,OAAO,IAAI,IAAI,CAAC;CAE9B,IAAI,OAAO,KACP,MAAM,IAAI,MAAM,wBAAwB;CAE5C,MAAM,SADI,KAAK,SAAS,EACT,CAAC,CAAC,SAAS;CAC1B,MAAM,IAAI,QAAQ,OAAO,CAAC,IAAI,KAAK,GAAG,IAAI,EAAE;CAC5C,MAAM,KAAK,eAAe,MAAM;CAChC,MAAM,IAAI,UAAU,IAAI,IAAI,CAAC;CAC7B,MAAM,sBAAM,IAAI,WAAW,EAAE;CAC7B,IAAI,IAAI,IAAI,CAAC;CACb,IAAI,IAAI,GAAG,QAAQ,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE;CAE5C,IAAI,CAAC,cAAc,KAAK,GAAG,EAAE,GACzB,MAAM,IAAI,MAAM,kCAAkC;CACtD,OAAO;AACX;;;;;AAKA,SAAS,cAAc,WAAW,SAAS,WAAW;CAClD,MAAM,EAAE,IAAI,IAAI,SAAS;CACzB,MAAM,MAAM,OAAO,WAAW,IAAI,WAAW;CAC7C,MAAM,IAAI,OAAO,SAAS,KAAA,GAAW,SAAS;CAC9C,MAAM,MAAM,OAAO,WAAW,IAAI,WAAW;CAC7C,IAAI;EACA,MAAM,IAAI,OAAO,IAAI,GAAG,CAAC;EACzB,MAAM,SAAS,IAAI,SAAS,GAAG,EAAE;EACjC,MAAM,IAAI,IAAI,MAAM;EACpB,IAAI,CAAC,GAAG,YAAY,CAAC,GACjB,OAAO;EACX,MAAM,IAAI,IAAI,IAAI,SAAS,IAAI,EAAE,CAAC;EAIlC,IAAI,CAAC,GAAG,YAAY,CAAC,GACjB,OAAO;EAEX,MAAM,IAAI,UAAU,QAAQ,aAAa,CAAC,GAAG,CAAC;EAE9C,MAAM,IAAI,KAAK,aAAa,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;EAC3C,MAAM,EAAE,GAAG,MAAM,EAAE,SAAS;EAE5B,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,GACtC,OAAO;EACX,OAAO;CACX,SACO,OAAO;EACV,OAAO;CACX;AACJ;;;;;;;;;;;;;;;;AAiBA,IAAa,UAA0B,uBAAO;CAC1C,MAAM,OAAO;CACb,MAAM,aAAa;CACnB,MAAM,mBAAmB,SAAS;EAC9B,OAAO,SAAS,KAAA,IAAYA,cAAY,UAAU,IAAI;EACtD,OAAO,eAAe,OAAO,MAAM,YAAY,MAAM,GAAG,gBAAgB,CAAC;CAC7E;CACA,OAAO,OAAO,OAAO;EACjB,QAAQ,aAAa,iBAAiB,mBAAmB;EACzD,cAAc;EACd,MAAM;EACN,QAAQ;EACR,OAAO;EACP,OAAO,OAAO,OAAO;GACjB;GACA;GACA;GACA;EACJ,CAAC;EACD,SAAS,OAAO,OAAO;GACnB,WAAW;GACX,WAAW;GACX,oBAAoB;GACpB,WAAW,OAAO;GAClB,MAAM;EACV,CAAC;CACL,CAAC;AACL,EAAA,CAAG;;;;CCnQH,OAAO,eAAe,SAAS,cAAc,EAAE,OAAO,KAAK,CAAC;CAC5D,QAAQ,UAAU,QAAQ,SAAS,KAAK;CACxC,IAAM,WAAW;CACjB,IAAM,eAAe,CAAC;CACtB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAiB,KAAK;EACtC,MAAM,IAAI,SAAS,OAAO,CAAC;EAC3B,aAAa,KAAK;CACtB;CACA,SAAS,YAAY,KAAK;EACtB,MAAM,IAAI,OAAO;EACjB,QAAU,MAAM,aAAc,IACzB,EAAG,KAAK,IAAK,KAAK,YAClB,EAAG,KAAK,IAAK,KAAK,YAClB,EAAG,KAAK,IAAK,KAAK,YAClB,EAAG,KAAK,IAAK,KAAK,aAClB,EAAG,KAAK,IAAK,KAAK;CAC3B;CACA,SAAS,UAAU,QAAQ;EACvB,IAAI,MAAM;EACV,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,EAAE,GAAG;GACpC,MAAM,IAAI,OAAO,WAAW,CAAC;GAC7B,IAAI,IAAI,MAAM,IAAI,KACd,OAAO,qBAAqB,SAAS;GACzC,MAAM,YAAY,GAAG,IAAK,KAAK;EACnC;EACA,MAAM,YAAY,GAAG;EACrB,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,EAAE,GAAG;GACpC,MAAM,IAAI,OAAO,WAAW,CAAC;GAC7B,MAAM,YAAY,GAAG,IAAK,IAAI;EAClC;EACA,OAAO;CACX;CACA,SAAS,QAAQ,MAAM,QAAQ,SAAS,KAAK;EACzC,IAAI,QAAQ;EACZ,IAAI,OAAO;EACX,MAAM,QAAQ,KAAK,WAAW;EAC9B,MAAM,SAAS,CAAC;EAChB,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,EAAE,GAAG;GAClC,QAAS,SAAS,SAAU,KAAK;GACjC,QAAQ;GACR,OAAO,QAAQ,SAAS;IACpB,QAAQ;IACR,OAAO,KAAM,SAAS,OAAQ,IAAI;GACtC;EACJ;EACA,IAAI;OACI,OAAO,GACP,OAAO,KAAM,SAAU,UAAU,OAAS,IAAI;EAAA,OAGjD;GACD,IAAI,QAAQ,QACR,OAAO;GACX,IAAK,SAAU,UAAU,OAAS,MAC9B,OAAO;EACf;EACA,OAAO;CACX;CACA,SAAS,QAAQ,OAAO;EACpB,OAAO,QAAQ,OAAO,GAAG,GAAG,IAAI;CACpC;CACA,SAAS,gBAAgB,OAAO;EAC5B,MAAM,MAAM,QAAQ,OAAO,GAAG,GAAG,KAAK;EACtC,IAAI,MAAM,QAAQ,GAAG,GACjB,OAAO;CACf;CACA,SAAS,UAAU,OAAO;EACtB,MAAM,MAAM,QAAQ,OAAO,GAAG,GAAG,KAAK;EACtC,IAAI,MAAM,QAAQ,GAAG,GACjB,OAAO;EACX,MAAM,IAAI,MAAM,GAAG;CACvB;CACA,SAAS,uBAAuB,UAAU;EACtC,IAAI;EACJ,IAAI,aAAa,UACb,iBAAiB;OAGjB,iBAAiB;EAErB,SAAS,OAAO,QAAQ,OAAO,OAAO;GAClC,QAAQ,SAAS;GACjB,IAAI,OAAO,SAAS,IAAI,MAAM,SAAS,OACnC,MAAM,IAAI,UAAU,sBAAsB;GAC9C,SAAS,OAAO,YAAY;GAE5B,IAAI,MAAM,UAAU,MAAM;GAC1B,IAAI,OAAO,QAAQ,UACf,MAAM,IAAI,MAAM,GAAG;GACvB,IAAI,SAAS,SAAS;GACtB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,EAAE,GAAG;IACnC,MAAM,IAAI,MAAM;IAChB,IAAI,KAAK,MAAM,GACX,MAAM,IAAI,MAAM,gBAAgB;IACpC,MAAM,YAAY,GAAG,IAAI;IACzB,UAAU,SAAS,OAAO,CAAC;GAC/B;GACA,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,EAAE,GACrB,MAAM,YAAY,GAAG;GAEzB,OAAO;GACP,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,EAAE,GAAG;IACxB,MAAM,IAAK,QAAS,IAAI,KAAK,IAAM;IACnC,UAAU,SAAS,OAAO,CAAC;GAC/B;GACA,OAAO;EACX;EACA,SAAS,SAAS,KAAK,OAAO;GAC1B,QAAQ,SAAS;GACjB,IAAI,IAAI,SAAS,GACb,OAAO,MAAM;GACjB,IAAI,IAAI,SAAS,OACb,OAAO;GAEX,MAAM,UAAU,IAAI,YAAY;GAChC,MAAM,UAAU,IAAI,YAAY;GAChC,IAAI,QAAQ,WAAW,QAAQ,SAC3B,OAAO,uBAAuB;GAClC,MAAM;GACN,MAAM,QAAQ,IAAI,YAAY,GAAG;GACjC,IAAI,UAAU,IACV,OAAO,gCAAgC;GAC3C,IAAI,UAAU,GACV,OAAO,wBAAwB;GACnC,MAAM,SAAS,IAAI,MAAM,GAAG,KAAK;GACjC,MAAM,YAAY,IAAI,MAAM,QAAQ,CAAC;GACrC,IAAI,UAAU,SAAS,GACnB,OAAO;GACX,IAAI,MAAM,UAAU,MAAM;GAC1B,IAAI,OAAO,QAAQ,UACf,OAAO;GACX,MAAM,QAAQ,CAAC;GACf,KAAK,IAAI,IAAI,GAAG,IAAI,UAAU,QAAQ,EAAE,GAAG;IACvC,MAAM,IAAI,UAAU,OAAO,CAAC;IAC5B,MAAM,IAAI,aAAa;IACvB,IAAI,MAAM,KAAA,GACN,OAAO,uBAAuB;IAClC,MAAM,YAAY,GAAG,IAAI;IAEzB,IAAI,IAAI,KAAK,UAAU,QACnB;IACJ,MAAM,KAAK,CAAC;GAChB;GACA,IAAI,QAAQ,gBACR,OAAO,0BAA0B;GACrC,OAAO;IAAE;IAAQ;GAAM;EAC3B;EACA,SAAS,aAAa,KAAK,OAAO;GAC9B,MAAM,MAAM,SAAS,KAAK,KAAK;GAC/B,IAAI,OAAO,QAAQ,UACf,OAAO;EACf;EACA,SAAS,OAAO,KAAK,OAAO;GACxB,MAAM,MAAM,SAAS,KAAK,KAAK;GAC/B,IAAI,OAAO,QAAQ,UACf,OAAO;GACX,MAAM,IAAI,MAAM,GAAG;EACvB;EACA,OAAO;GACH;GACA;GACA;GACA;GACA;GACA;EACJ;CACJ;CACA,QAAQ,SAAS,uBAAuB,QAAQ;CAChD,QAAQ,UAAU,uBAAuB,SAAS;;AC3H3C,SAAS,uBAAqC;CAEnD,MAAM,eAAe,YAAY,EAAE;CACnC,MAAM,UAAU,OAAO,KAAK,YAAY,CAAA,CAAE,SAAS,KAAK;CAGxD,MAAM,cAAc,UAAU,aAAa,cAAc,IAAI;CAI7D,OAAO;EAAE,QAFM,OAAO,KAAK,YAAY,MAAM,CAAC,CAAC,CAAA,CAAE,SAAS,KAEjD;EAAQ;CAAQ;AAC3B;AAMO,SAAS,oBAAoB,cAA8B;CAChE,MAAM,OAAO,OAAO,KAAK,4BAA4B,MAAM;CAC3D,MAAM,OAAO,OAAO,KAAK,eAAe,MAAM;CAC9C,MAAM,cAAc,OAAO,KAAK,cAAc,MAAM;CAEpD,OAAO,OAAO,KAAK,SAAS,UAAU,aAAa,MAAM,MAAM,EAAE,CAAC;AACpE;AAOO,SAAS,eACd,SACA,cACc;CACd,MAAM,MAAM,oBAAoB,YAAY;CAC5C,MAAM,KAAK,YAAY,EAAE;CAEzB,MAAM,SAAS,eAAe,eAAe,KAAK,EAAE;CACpD,MAAM,YAAY,OAAO,OAAO,CAC9B,OAAO,OAAO,SAAS,MAAM,GAC7B,OAAO,MAAM,CACf,CAAC;CACD,MAAM,MAAM,OAAO,WAAW;CAE9B,OAAO;EACL,YAAY,UAAU,SAAS,QAAQ;EACvC,IAAI,GAAG,SAAS,QAAQ;EACxB,KAAK,IAAI,SAAS,QAAQ;CAC5B;AACF;AAOO,SAAS,eACd,WACA,cACQ;CACR,MAAM,MAAM,oBAAoB,YAAY;CAC5C,MAAM,KAAK,OAAO,KAAK,UAAU,IAAI,QAAQ;CAC7C,MAAM,MAAM,OAAO,KAAK,UAAU,KAAK,QAAQ;CAC/C,MAAM,aAAa,OAAO,KAAK,UAAU,YAAY,QAAQ;CAE7D,MAAM,WAAW,iBAAiB,eAAe,KAAK,EAAE;CACxD,SAAS,WAAW,GAAG;CAOvB,OALkB,OAAO,OAAO,CAC9B,SAAS,OAAO,UAAU,GAC1B,SAAS,MAAM,CACjB,CAEO,CAAA,CAAU,SAAS,MAAM;AAClC;AAKO,SAAS,eAAe,OAA2B;CACxD,MAAM,aAAa,KAAK,UAAU;EAChC;EACA,MAAM;EACN,MAAM;EACN,MAAM;EACN,MAAM;EACN,MAAM;CACR,CAAC;CAED,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,UAAU,CAAA,CAAE,OAAO,KAAK;AAC7D;AAOO,SAAS,UACd,OACA,SACY;CACZ,MAAM,KAAK,eAAe,KAAmB;CAC7C,MAAM,eAAe,OAAO,KAAK,SAAS,KAAK;CAC/C,MAAM,UAAU,OAAO,KAAK,IAAI,KAAK;CAGrC,MAAM,MAAM,QAAQ,KAAK,SAAS,YAAY;CAC9C,MAAM,SAAS,OAAO,KAAK,GAAG,CAAA,CAAE,SAAS,KAAK;CAE9C,OAAO;EACL,GAAG;EACH;EACA,KAAK;CACP;AACF;AAMO,SAAS,qBAAqB,OAA4B;CAC/D,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,KACtB,OAAO;CAKT,IADmB,eAAe,KAC9B,MAAe,MAAM,IACvB,OAAO;CAGT,IAAI;EACF,MAAM,WAAW,OAAO,KAAK,MAAM,KAAK,KAAK;EAC7C,MAAM,UAAU,OAAO,KAAK,MAAM,IAAI,KAAK;EAE3C,MAAM,cAAc,OAAO,KAAK,MAAM,QAAQ,KAAK;EAEnD,OAAO,QAAQ,OAAO,UAAU,SAAS,WAAW;CACtD,QAAQ;EACN,OAAO;CACT;AACF;AAQO,SAAS,gBACd,SACA,WACA,OACY;CACZ,MAAM,eAAe,OAAO,KAAK,SAAS,KAAK;CAC/C,MAAM,cAAc,UAAU,aAAa,cAAc,IAAI;CAC7D,MAAM,SAAS,OAAO,KAAK,YAAY,MAAM,CAAC,CAAC,CAAA,CAAE,SAAS,KAAK;CAE/D,MAAM,OAAmB,CAAC,CAAC,aAAa,SAAS,CAAC;CAClD,IAAI,OACF,KAAK,KAAK,CAAC,SAAS,KAAK,CAAC;CAW5B,OAAO,UAAU;EAPf;EACA,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM;EACN;EACA,SAAS;CAGM,GAAO,OAAO;AACjC;AAQO,SAAS,gBACd,OACA,mBACA,gBAAwB,KACY;CAEpC,IAAI,MAAM,SAAS,OACjB,OAAO;EAAE,OAAO;EAAO,OAAO;CAAqB;CAKrD,MAAM,MADM,KAAK,MAAM,KAAK,IAAI,IAAI,GACxB,IAAM,MAAM;CACxB,IAAI,MAAM,iBAAiB,MAAM,KAE/B,OAAO;EAAE,OAAO;EAAO,OAAO;CAAqC;CAIrE,MAAM,eAAe,MAAM,KAAK,MAAM,MAAM,EAAE,OAAO,WAAW;CAChE,IAAI,CAAC,gBAAgB,aAAa,OAAO,mBACvC,OAAO;EAAE,OAAO;EAAO,OAAO;CAAqB;CAIrD,IAAI,CAAC,qBAAqB,KAAK,GAC7B,OAAO;EAAE,OAAO;EAAO,OAAO;CAAoB;CAGpD,OAAO,EAAE,OAAO,KAAK;AACvB;AAKO,SAAS,aAAa,QAAwB;CACnD,MAAM,QAAQ,YAAA,OAAO,QAAQ,OAAO,KAAK,QAAQ,KAAK,CAAC;CACvD,OAAO,YAAA,OAAO,OAAO,QAAQ,OAAO,GAAI;AAC1C;AAKO,SAAS,aAAa,MAAsB;CACjD,MAAM,EAAE,QAAQ,UAAU,YAAA,OAAO,OAAO,MAAM,GAAI;CAClD,IAAI,WAAW,QACb,MAAM,IAAI,MAAM,qBAAqB;CAEvC,OAAO,OAAO,KAAK,YAAA,OAAO,UAAU,KAAK,CAAC,CAAA,CAAE,SAAS,KAAK;AAC5D;AAKO,SAAS,cAAc,SAAyB;CACrD,MAAM,QAAQ,YAAA,OAAO,QAAQ,OAAO,KAAK,SAAS,KAAK,CAAC;CACxD,OAAO,YAAA,OAAO,OAAO,QAAQ,OAAO,GAAI;AAC1C;AAKO,SAAS,cAAc,MAAsB;CAClD,MAAM,EAAE,QAAQ,UAAU,YAAA,OAAO,OAAO,MAAM,GAAI;CAClD,IAAI,WAAW,QACb,MAAM,IAAI,MAAM,qBAAqB;CAEvC,OAAO,OAAO,KAAK,YAAA,OAAO,UAAU,KAAK,CAAC,CAAA,CAAE,SAAS,KAAK;AAC5D;AAKO,SAAS,aAAa,SAAyB;CACpD,MAAM,eAAe,OAAO,KAAK,SAAS,KAAK;CAC/C,MAAM,cAAc,UAAU,aAAa,cAAc,IAAI;CAC7D,OAAO,OAAO,KAAK,YAAY,MAAM,CAAC,CAAC,CAAA,CAAE,SAAS,KAAK;AACzD;AAKO,SAAS,cAAc,QAAyB;CACrD,IAAI,CAAC,kBAAkB,KAAK,MAAM,GAChC,OAAO;CAET,IAAI;EAEF,MAAM,aAAa,OAAO,KAAK,KAAK,UAAU,KAAK;EACnD,UAAU,MAAM,UAAU,UAAU;EACpC,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;AAKO,SAAS,eAAe,SAA0B;CACvD,IAAI,CAAC,kBAAkB,KAAK,OAAO,GACjC,OAAO;CAET,IAAI;EACF,MAAM,eAAe,OAAO,KAAK,SAAS,KAAK;EAE/C,UAAU,aAAa,YAAY;EACnC,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;;;;;;;;;ACrSO,IAAM,gBAAN,cAA4B,WAAW;CAK5C;CASA,SAAiB;;;;CAKjB,mBAA2B;;;;CAK3B,eAAuB;;;;CAKvB,gBAAwB;;;;CAKxB,QAAgB;;;;CAKhB,gBAAwB;;;;CAKxB,aAA0B;;;;CAK1B,aAA0B;CAE1B,YAAY,UAAgC,CAAC,GAAG;EAC9C,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,kBACV,KAAK,mBAAmB,QAAQ;EAClC,IAAI,QAAQ,cAAc,KAAK,eAAe,QAAQ;EACtD,IAAI,QAAQ,eAAe,KAAK,gBAAgB,QAAQ;EACxD,IAAI,QAAQ,OAAO,KAAK,QAAQ,QAAQ;EACxC,IAAI,QAAQ,eAAe,KAAK,gBAAgB,QAAQ;EACxD,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;EAChE,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;CAClE;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,aAAa,aACX,QACA,UAA6B,CAAC,GACC;EAC/B,MAAM,EAAE,4BAA4B,MAAM,OACxC,wCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAGF,OAAO,OAAM,MADY,wBAAwB,OAAO,OAAO,EAAA,CACvC,QAAQ,EAC9B,OAAO,EAAE,OAAO,EAClB,CAAC;CACH;;;;CAKA,aAAa,YACX,OACA,UAA6B,CAAC,GACC;EAC/B,MAAM,EAAE,4BAA4B,MAAM,OACxC,wCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAGF,OAAO,OAAM,MADY,wBAAwB,OAAO,OAAO,EAAA,CACvC,QAAQ,EAC9B,OAAO,EAAE,OAAO,MAAM,YAAY,EAAE,EACtC,CAAC;CACH;;;;CAKA,aAAa,YACX,UACA,UAA6B,CAAC,GACC;EAC/B,MAAM,EAAE,4BAA4B,MAAM,OACxC,wCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAGF,OAAO,OAAM,MADY,wBAAwB,OAAO,OAAO,EAAA,CACvC,QAAQ,EAC9B,OAAO,EAAE,eAAe,SAAS,YAAY,EAAE,EACjD,CAAC;CACH;;;;;;CAOA,eAAe,cAA8B;EAM3C,OAAO,eAAe;GAJpB,YAAY,KAAK;GACjB,IAAI,KAAK;GACT,KAAK,KAAK;EAEU,GAAW,YAAY;CAC/C;;;;;CAMA,WAAW,cAKT;EACA,MAAM,UAAU,KAAK,eAAe,YAAY;EAChD,OAAO;GACL,QAAQ,KAAK;GACb;GACA,MAAM,aAAa,KAAK,MAAM;GAC9B,MAAM,cAAc,OAAO;EAC7B;CACF;;;;CAKA,MAAM,cAA6B;EACjC,KAAA,IAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;GAC/C,IAAI,KAAK,aAAa,MAAM,KAAK,WAAW;GAC5C,KAAK,6BAAa,IAAI,KAAK;GAC3B,IAAI;IACF,MAAM,KAAK,KAAK;IAChB;GACF,SAAS,OAAO;IACd,IACE,YAAY,KACZ,EACE,iBAAiB,SACjB,UAAU,SACV,MAAM,SAAS,8BAGjB,MAAM;GAEV;EACF;CACF;;;;CAKA,MAAM,eAA8B;EAClC,KAAK,6BAAa,IAAI,KAAK;EAC3B,KAAK,6BAAa,IAAI,KAAK;EAC3B,MAAM,KAAK,KAAK;CAClB;;;;CAKA,aAAsB;EACpB,OAAO,KAAK,eAAe;CAC7B;;;;;CAMA,mBAAmB,QAAwB;EAEzC,OAAO,GADU,KAAK,iBAAiB,KAAK,MAAM,MAAM,GAAG,CAAA,CAAE,GAC3C,GAAI;CACxB;AACF;AA1MgD,cAAnC,eAA0C,mBAAkB,8BAAA;AAKvE,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,cAKX,WAAA,aAAA,CAAA;AASA,gBAAA,CADC,MAAM,EAAE,SAAS,KAAK,CAAC,CAAA,GAbb,cAcX,WAAA,UAAA,CAAA;AAdW,gBAAN,gBAAA,CATN,KAAK;CACJ,WAAW;CAGX,WAAW;CACX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;AAClC,CAAC,CAAA,GACY,aAAA"}