@tatchi-xyz/sdk 0.21.0 → 0.31.1

package/dist/cjs/server/node_modules/.pnpm/@noble_curves@2.0.1/node_modules/@noble/curves/abstract/edwards.js

@@ -0,0 +1,401 @@
+const require_utils = require('../../../../../@noble_hashes@2.0.1/node_modules/@noble/hashes/utils.js');
+const require_utils$1 = require('../utils.js');
+const require_curve = require('./curve.js');
+
+//#region ../node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/abstract/edwards.js
+const _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _8n = BigInt(8);
+function isEdValidXY(Fp, CURVE, x, y) {
+	const x2 = Fp.sqr(x);
+	const y2 = Fp.sqr(y);
+	const left = Fp.add(Fp.mul(CURVE.a, x2), y2);
+	const right = Fp.add(Fp.ONE, Fp.mul(CURVE.d, Fp.mul(x2, y2)));
+	return Fp.eql(left, right);
+}
+function edwards(params, extraOpts = {}) {
+	const validated = require_curve.createCurveFields("edwards", params, extraOpts, extraOpts.FpFnLE);
+	const { Fp, Fn } = validated;
+	let CURVE = validated.CURVE;
+	const { h: cofactor } = CURVE;
+	require_utils$1.validateObject(extraOpts, {}, { uvRatio: "function" });
+	const MASK = _2n << BigInt(Fn.BYTES * 8) - _1n;
+	const modP = (n) => Fp.create(n);
+	const uvRatio = extraOpts.uvRatio || ((u, v) => {
+		try {
+			return {
+				isValid: true,
+				value: Fp.sqrt(Fp.div(u, v))
+			};
+		} catch (e) {
+			return {
+				isValid: false,
+				value: _0n
+			};
+		}
+	});
+	if (!isEdValidXY(Fp, CURVE, CURVE.Gx, CURVE.Gy)) throw new Error("bad curve params: generator point");
+	/**
+	* Asserts coordinate is valid: 0 <= n < MASK.
+	* Coordinates >= Fp.ORDER are allowed for zip215.
+	*/
+	function acoord(title, n, banZero = false) {
+		const min = banZero ? _1n : _0n;
+		require_utils$1.aInRange("coordinate " + title, n, min, MASK);
+		return n;
+	}
+	function aedpoint(other) {
+		if (!(other instanceof Point)) throw new Error("EdwardsPoint expected");
+	}
+	const toAffineMemo = require_utils$1.memoized((p, iz) => {
+		const { X, Y, Z } = p;
+		const is0 = p.is0();
+		if (iz == null) iz = is0 ? _8n : Fp.inv(Z);
+		const x = modP(X * iz);
+		const y = modP(Y * iz);
+		const zz = Fp.mul(Z, iz);
+		if (is0) return {
+			x: _0n,
+			y: _1n
+		};
+		if (zz !== _1n) throw new Error("invZ was invalid");
+		return {
+			x,
+			y
+		};
+	});
+	const assertValidMemo = require_utils$1.memoized((p) => {
+		const { a, d } = CURVE;
+		if (p.is0()) throw new Error("bad point: ZERO");
+		const { X, Y, Z, T } = p;
+		const X2 = modP(X * X);
+		const Y2 = modP(Y * Y);
+		const Z2 = modP(Z * Z);
+		const Z4 = modP(Z2 * Z2);
+		const aX2 = modP(X2 * a);
+		const left = modP(Z2 * modP(aX2 + Y2));
+		const right = modP(Z4 + modP(d * modP(X2 * Y2)));
+		if (left !== right) throw new Error("bad point: equation left != right (1)");
+		const XY = modP(X * Y);
+		const ZT = modP(Z * T);
+		if (XY !== ZT) throw new Error("bad point: equation left != right (2)");
+		return true;
+	});
+	class Point {
+		static BASE = new Point(CURVE.Gx, CURVE.Gy, _1n, modP(CURVE.Gx * CURVE.Gy));
+		static ZERO = new Point(_0n, _1n, _1n, _0n);
+		static Fp = Fp;
+		static Fn = Fn;
+		X;
+		Y;
+		Z;
+		T;
+		constructor(X, Y, Z, T) {
+			this.X = acoord("x", X);
+			this.Y = acoord("y", Y);
+			this.Z = acoord("z", Z, true);
+			this.T = acoord("t", T);
+			Object.freeze(this);
+		}
+		static CURVE() {
+			return CURVE;
+		}
+		static fromAffine(p) {
+			if (p instanceof Point) throw new Error("extended point not allowed");
+			const { x, y } = p || {};
+			acoord("x", x);
+			acoord("y", y);
+			return new Point(x, y, _1n, modP(x * y));
+		}
+		static fromBytes(bytes, zip215 = false) {
+			const len = Fp.BYTES;
+			const { a, d } = CURVE;
+			bytes = require_utils$1.copyBytes(require_utils.abytes(bytes, len, "point"));
+			require_utils$1.abool(zip215, "zip215");
+			const normed = require_utils$1.copyBytes(bytes);
+			const lastByte = bytes[len - 1];
+			normed[len - 1] = lastByte & -129;
+			const y = require_utils$1.bytesToNumberLE(normed);
+			const max = zip215 ? MASK : Fp.ORDER;
+			require_utils$1.aInRange("point.y", y, _0n, max);
+			const y2 = modP(y * y);
+			const u = modP(y2 - _1n);
+			const v = modP(d * y2 - a);
+			let { isValid, value: x } = uvRatio(u, v);
+			if (!isValid) throw new Error("bad point: invalid y coordinate");
+			const isXOdd = (x & _1n) === _1n;
+			const isLastByteOdd = (lastByte & 128) !== 0;
+			if (!zip215 && x === _0n && isLastByteOdd) throw new Error("bad point: x=0 and x_0=1");
+			if (isLastByteOdd !== isXOdd) x = modP(-x);
+			return Point.fromAffine({
+				x,
+				y
+			});
+		}
+		static fromHex(hex, zip215 = false) {
+			return Point.fromBytes(require_utils.hexToBytes(hex), zip215);
+		}
+		get x() {
+			return this.toAffine().x;
+		}
+		get y() {
+			return this.toAffine().y;
+		}
+		precompute(windowSize = 8, isLazy = true) {
+			wnaf.createCache(this, windowSize);
+			if (!isLazy) this.multiply(_2n);
+			return this;
+		}
+		assertValidity() {
+			assertValidMemo(this);
+		}
+		equals(other) {
+			aedpoint(other);
+			const { X: X1, Y: Y1, Z: Z1 } = this;
+			const { X: X2, Y: Y2, Z: Z2 } = other;
+			const X1Z2 = modP(X1 * Z2);
+			const X2Z1 = modP(X2 * Z1);
+			const Y1Z2 = modP(Y1 * Z2);
+			const Y2Z1 = modP(Y2 * Z1);
+			return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+		}
+		is0() {
+			return this.equals(Point.ZERO);
+		}
+		negate() {
+			return new Point(modP(-this.X), this.Y, this.Z, modP(-this.T));
+		}
+		double() {
+			const { a } = CURVE;
+			const { X: X1, Y: Y1, Z: Z1 } = this;
+			const A = modP(X1 * X1);
+			const B = modP(Y1 * Y1);
+			const C = modP(_2n * modP(Z1 * Z1));
+			const D = modP(a * A);
+			const x1y1 = X1 + Y1;
+			const E = modP(modP(x1y1 * x1y1) - A - B);
+			const G = D + B;
+			const F = G - C;
+			const H = D - B;
+			const X3 = modP(E * F);
+			const Y3 = modP(G * H);
+			const T3 = modP(E * H);
+			const Z3 = modP(F * G);
+			return new Point(X3, Y3, Z3, T3);
+		}
+		add(other) {
+			aedpoint(other);
+			const { a, d } = CURVE;
+			const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;
+			const { X: X2, Y: Y2, Z: Z2, T: T2 } = other;
+			const A = modP(X1 * X2);
+			const B = modP(Y1 * Y2);
+			const C = modP(T1 * d * T2);
+			const D = modP(Z1 * Z2);
+			const E = modP((X1 + Y1) * (X2 + Y2) - A - B);
+			const F = D - C;
+			const G = D + C;
+			const H = modP(B - a * A);
+			const X3 = modP(E * F);
+			const Y3 = modP(G * H);
+			const T3 = modP(E * H);
+			const Z3 = modP(F * G);
+			return new Point(X3, Y3, Z3, T3);
+		}
+		subtract(other) {
+			return this.add(other.negate());
+		}
+		multiply(scalar) {
+			if (!Fn.isValidNot0(scalar)) throw new Error("invalid scalar: expected 1 <= sc < curve.n");
+			const { p, f } = wnaf.cached(this, scalar, (p$1) => require_curve.normalizeZ(Point, p$1));
+			return require_curve.normalizeZ(Point, [p, f])[0];
+		}
+		multiplyUnsafe(scalar, acc = Point.ZERO) {
+			if (!Fn.isValid(scalar)) throw new Error("invalid scalar: expected 0 <= sc < curve.n");
+			if (scalar === _0n) return Point.ZERO;
+			if (this.is0() || scalar === _1n) return this;
+			return wnaf.unsafe(this, scalar, (p) => require_curve.normalizeZ(Point, p), acc);
+		}
+		isSmallOrder() {
+			return this.multiplyUnsafe(cofactor).is0();
+		}
+		isTorsionFree() {
+			return wnaf.unsafe(this, CURVE.n).is0();
+		}
+		toAffine(invertedZ) {
+			return toAffineMemo(this, invertedZ);
+		}
+		clearCofactor() {
+			if (cofactor === _1n) return this;
+			return this.multiplyUnsafe(cofactor);
+		}
+		toBytes() {
+			const { x, y } = this.toAffine();
+			const bytes = Fp.toBytes(y);
+			bytes[bytes.length - 1] |= x & _1n ? 128 : 0;
+			return bytes;
+		}
+		toHex() {
+			return require_utils.bytesToHex(this.toBytes());
+		}
+		toString() {
+			return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
+		}
+	}
+	const wnaf = new require_curve.wNAF(Point, Fn.BITS);
+	Point.BASE.precompute(8);
+	return Point;
+}
+/**
+* Initializes EdDSA signatures over given Edwards curve.
+*/
+function eddsa(Point, cHash, eddsaOpts = {}) {
+	if (typeof cHash !== "function") throw new Error("\"hash\" function param is required");
+	require_utils$1.validateObject(eddsaOpts, {}, {
+		adjustScalarBytes: "function",
+		randomBytes: "function",
+		domain: "function",
+		prehash: "function",
+		mapToCurve: "function"
+	});
+	const { prehash } = eddsaOpts;
+	const { BASE, Fp, Fn } = Point;
+	const randomBytes$1 = eddsaOpts.randomBytes || require_utils.randomBytes;
+	const adjustScalarBytes = eddsaOpts.adjustScalarBytes || ((bytes) => bytes);
+	const domain = eddsaOpts.domain || ((data, ctx, phflag) => {
+		require_utils$1.abool(phflag, "phflag");
+		if (ctx.length || phflag) throw new Error("Contexts/pre-hash are not supported");
+		return data;
+	});
+	function modN_LE(hash) {
+		return Fn.create(require_utils$1.bytesToNumberLE(hash));
+	}
+	function getPrivateScalar(key) {
+		const len = lengths.secretKey;
+		require_utils.abytes(key, lengths.secretKey, "secretKey");
+		const hashed = require_utils.abytes(cHash(key), 2 * len, "hashedSecretKey");
+		const head = adjustScalarBytes(hashed.slice(0, len));
+		const prefix = hashed.slice(len, 2 * len);
+		const scalar = modN_LE(head);
+		return {
+			head,
+			prefix,
+			scalar
+		};
+	}
+	/** Convenience method that creates public key from scalar. RFC8032 5.1.5 */
+	function getExtendedPublicKey(secretKey) {
+		const { head, prefix, scalar } = getPrivateScalar(secretKey);
+		const point = BASE.multiply(scalar);
+		const pointBytes = point.toBytes();
+		return {
+			head,
+			prefix,
+			scalar,
+			point,
+			pointBytes
+		};
+	}
+	/** Calculates EdDSA pub key. RFC8032 5.1.5. */
+	function getPublicKey(secretKey) {
+		return getExtendedPublicKey(secretKey).pointBytes;
+	}
+	function hashDomainToScalar(context = Uint8Array.of(), ...msgs) {
+		const msg = require_utils.concatBytes(...msgs);
+		return modN_LE(cHash(domain(msg, require_utils.abytes(context, void 0, "context"), !!prehash)));
+	}
+	/** Signs message with secret key. RFC8032 5.1.6 */
+	function sign(msg, secretKey, options = {}) {
+		msg = require_utils.abytes(msg, void 0, "message");
+		if (prehash) msg = prehash(msg);
+		const { prefix, scalar, pointBytes } = getExtendedPublicKey(secretKey);
+		const r = hashDomainToScalar(options.context, prefix, msg);
+		const R = BASE.multiply(r).toBytes();
+		const k = hashDomainToScalar(options.context, R, pointBytes, msg);
+		const s = Fn.create(r + k * scalar);
+		if (!Fn.isValid(s)) throw new Error("sign failed: invalid s");
+		const rs = require_utils.concatBytes(R, Fn.toBytes(s));
+		return require_utils.abytes(rs, lengths.signature, "result");
+	}
+	const verifyOpts = { zip215: true };
+	/**
+	* Verifies EdDSA signature against message and public key. RFC8032 5.1.7.
+	* An extended group equation is checked.
+	*/
+	function verify(sig, msg, publicKey, options = verifyOpts) {
+		const { context, zip215 } = options;
+		const len = lengths.signature;
+		sig = require_utils.abytes(sig, len, "signature");
+		msg = require_utils.abytes(msg, void 0, "message");
+		publicKey = require_utils.abytes(publicKey, lengths.publicKey, "publicKey");
+		if (zip215 !== void 0) require_utils$1.abool(zip215, "zip215");
+		if (prehash) msg = prehash(msg);
+		const mid = len / 2;
+		const r = sig.subarray(0, mid);
+		const s = require_utils$1.bytesToNumberLE(sig.subarray(mid, len));
+		let A, R, SB;
+		try {
+			A = Point.fromBytes(publicKey, zip215);
+			R = Point.fromBytes(r, zip215);
+			SB = BASE.multiplyUnsafe(s);
+		} catch (error) {
+			return false;
+		}
+		if (!zip215 && A.isSmallOrder()) return false;
+		const k = hashDomainToScalar(context, R.toBytes(), A.toBytes(), msg);
+		const RkA = R.add(A.multiplyUnsafe(k));
+		return RkA.subtract(SB).clearCofactor().is0();
+	}
+	const _size = Fp.BYTES;
+	const lengths = {
+		secretKey: _size,
+		publicKey: _size,
+		signature: 2 * _size,
+		seed: _size
+	};
+	function randomSecretKey(seed = randomBytes$1(lengths.seed)) {
+		return require_utils.abytes(seed, lengths.seed, "seed");
+	}
+	function isValidSecretKey(key) {
+		return require_utils.isBytes(key) && key.length === Fn.BYTES;
+	}
+	function isValidPublicKey(key, zip215) {
+		try {
+			return !!Point.fromBytes(key, zip215);
+		} catch (error) {
+			return false;
+		}
+	}
+	const utils = {
+		getExtendedPublicKey,
+		randomSecretKey,
+		isValidSecretKey,
+		isValidPublicKey,
+		toMontgomery(publicKey) {
+			const { y } = Point.fromBytes(publicKey);
+			const size = lengths.publicKey;
+			const is25519 = size === 32;
+			if (!is25519 && size !== 57) throw new Error("only defined for 25519 and 448");
+			const u = is25519 ? Fp.div(_1n + y, _1n - y) : Fp.div(y - _1n, y + _1n);
+			return Fp.toBytes(u);
+		},
+		toMontgomerySecret(secretKey) {
+			const size = lengths.secretKey;
+			require_utils.abytes(secretKey, size);
+			const hashed = cHash(secretKey.subarray(0, size));
+			return adjustScalarBytes(hashed).subarray(0, size);
+		}
+	};
+	return Object.freeze({
+		keygen: require_curve.createKeygen(randomSecretKey, getPublicKey),
+		getPublicKey,
+		sign,
+		verify,
+		utils,
+		Point,
+		lengths
+	});
+}
+
+//#endregion
+exports.eddsa = eddsa;
+exports.edwards = edwards;
+//# sourceMappingURL=edwards.js.map

package/dist/cjs/server/node_modules/.pnpm/@noble_curves@2.0.1/node_modules/@noble/curves/abstract/edwards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edwards.js","names":["createCurveFields","memoized","copyBytes","abytes","bytesToNumberLE","hexToBytes","normalizeZ","p","bytesToHex","wNAF","randomBytes","wcRandomBytes","concatBytes","isBytes","createKeygen"],"sources":["../../../../../../../../../../../node_modules/.pnpm/@noble+curves@2.0.1/node_modules/@noble/curves/abstract/edwards.js"],"sourcesContent":["/**\n * Twisted Edwards curve. The formula is: ax² + y² = 1 + dx²y².\n * For design rationale of types / exports, see weierstrass module documentation.\n * Untwisted Edwards curves exist, but they aren't used in real-world protocols.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { abool, abytes, aInRange, bytesToHex, bytesToNumberLE, concatBytes, copyBytes, hexToBytes, isBytes, memoized, notImplemented, validateObject, randomBytes as wcRandomBytes, } from \"../utils.js\";\nimport { createCurveFields, createKeygen, normalizeZ, wNAF, } from \"./curve.js\";\nimport {} from \"./modular.js\";\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _8n = BigInt(8);\nfunction isEdValidXY(Fp, CURVE, x, y) {\n    const x2 = Fp.sqr(x);\n    const y2 = Fp.sqr(y);\n    const left = Fp.add(Fp.mul(CURVE.a, x2), y2);\n    const right = Fp.add(Fp.ONE, Fp.mul(CURVE.d, Fp.mul(x2, y2)));\n    return Fp.eql(left, right);\n}\nexport function edwards(params, extraOpts = {}) {\n    const validated = createCurveFields('edwards', params, extraOpts, extraOpts.FpFnLE);\n    const { Fp, Fn } = validated;\n    let CURVE = validated.CURVE;\n    const { h: cofactor } = CURVE;\n    validateObject(extraOpts, {}, { uvRatio: 'function' });\n    // Important:\n    // There are some places where Fp.BYTES is used instead of nByteLength.\n    // So far, everything has been tested with curves of Fp.BYTES == nByteLength.\n    // TODO: test and find curves which behave otherwise.\n    const MASK = _2n << (BigInt(Fn.BYTES * 8) - _1n);\n    const modP = (n) => Fp.create(n); // Function overrides\n    // sqrt(u/v)\n    const uvRatio = extraOpts.uvRatio ||\n        ((u, v) => {\n            try {\n                return { isValid: true, value: Fp.sqrt(Fp.div(u, v)) };\n            }\n            catch (e) {\n                return { isValid: false, value: _0n };\n            }\n        });\n    // Validate whether the passed curve params are valid.\n    // equation ax² + y² = 1 + dx²y² should work for generator point.\n    if (!isEdValidXY(Fp, CURVE, CURVE.Gx, CURVE.Gy))\n        throw new Error('bad curve params: generator point');\n    /**\n     * Asserts coordinate is valid: 0 <= n < MASK.\n     * Coordinates >= Fp.ORDER are allowed for zip215.\n     */\n    function acoord(title, n, banZero = false) {\n        const min = banZero ? _1n : _0n;\n        aInRange('coordinate ' + title, n, min, MASK);\n        return n;\n    }\n    function aedpoint(other) {\n        if (!(other instanceof Point))\n            throw new Error('EdwardsPoint expected');\n    }\n    // Converts Extended point to default (x, y) coordinates.\n    // Can accept precomputed Z^-1 - for example, from invertBatch.\n    const toAffineMemo = memoized((p, iz) => {\n        const { X, Y, Z } = p;\n        const is0 = p.is0();\n        if (iz == null)\n            iz = is0 ? _8n : Fp.inv(Z); // 8 was chosen arbitrarily\n        const x = modP(X * iz);\n        const y = modP(Y * iz);\n        const zz = Fp.mul(Z, iz);\n        if (is0)\n            return { x: _0n, y: _1n };\n        if (zz !== _1n)\n            throw new Error('invZ was invalid');\n        return { x, y };\n    });\n    const assertValidMemo = memoized((p) => {\n        const { a, d } = CURVE;\n        if (p.is0())\n            throw new Error('bad point: ZERO'); // TODO: optimize, with vars below?\n        // Equation in affine coordinates: ax² + y² = 1 + dx²y²\n        // Equation in projective coordinates (X/Z, Y/Z, Z):  (aX² + Y²)Z² = Z⁴ + dX²Y²\n        const { X, Y, Z, T } = p;\n        const X2 = modP(X * X); // X²\n        const Y2 = modP(Y * Y); // Y²\n        const Z2 = modP(Z * Z); // Z²\n        const Z4 = modP(Z2 * Z2); // Z⁴\n        const aX2 = modP(X2 * a); // aX²\n        const left = modP(Z2 * modP(aX2 + Y2)); // (aX² + Y²)Z²\n        const right = modP(Z4 + modP(d * modP(X2 * Y2))); // Z⁴ + dX²Y²\n        if (left !== right)\n            throw new Error('bad point: equation left != right (1)');\n        // In Extended coordinates we also have T, which is x*y=T/Z: check X*Y == Z*T\n        const XY = modP(X * Y);\n        const ZT = modP(Z * T);\n        if (XY !== ZT)\n            throw new Error('bad point: equation left != right (2)');\n        return true;\n    });\n    // Extended Point works in extended coordinates: (X, Y, Z, T) ∋ (x=X/Z, y=Y/Z, T=xy).\n    // https://en.wikipedia.org/wiki/Twisted_Edwards_curve#Extended_coordinates\n    class Point {\n        // base / generator point\n        static BASE = new Point(CURVE.Gx, CURVE.Gy, _1n, modP(CURVE.Gx * CURVE.Gy));\n        // zero / infinity / identity point\n        static ZERO = new Point(_0n, _1n, _1n, _0n); // 0, 1, 1, 0\n        // math field\n        static Fp = Fp;\n        // scalar field\n        static Fn = Fn;\n        X;\n        Y;\n        Z;\n        T;\n        constructor(X, Y, Z, T) {\n            this.X = acoord('x', X);\n            this.Y = acoord('y', Y);\n            this.Z = acoord('z', Z, true);\n            this.T = acoord('t', T);\n            Object.freeze(this);\n        }\n        static CURVE() {\n            return CURVE;\n        }\n        static fromAffine(p) {\n            if (p instanceof Point)\n                throw new Error('extended point not allowed');\n            const { x, y } = p || {};\n            acoord('x', x);\n            acoord('y', y);\n            return new Point(x, y, _1n, modP(x * y));\n        }\n        // Uses algo from RFC8032 5.1.3.\n        static fromBytes(bytes, zip215 = false) {\n            const len = Fp.BYTES;\n            const { a, d } = CURVE;\n            bytes = copyBytes(abytes(bytes, len, 'point'));\n            abool(zip215, 'zip215');\n            const normed = copyBytes(bytes); // copy again, we'll manipulate it\n            const lastByte = bytes[len - 1]; // select last byte\n            normed[len - 1] = lastByte & ~0x80; // clear last bit\n            const y = bytesToNumberLE(normed);\n            // zip215=true is good for consensus-critical apps. =false follows RFC8032 / NIST186-5.\n            // RFC8032 prohibits >= p, but ZIP215 doesn't\n            // zip215=true:  0 <= y < MASK (2^256 for ed25519)\n            // zip215=false: 0 <= y < P (2^255-19 for ed25519)\n            const max = zip215 ? MASK : Fp.ORDER;\n            aInRange('point.y', y, _0n, max);\n            // Ed25519: x² = (y²-1)/(dy²+1) mod p. Ed448: x² = (y²-1)/(dy²-1) mod p. Generic case:\n            // ax²+y²=1+dx²y² => y²-1=dx²y²-ax² => y²-1=x²(dy²-a) => x²=(y²-1)/(dy²-a)\n            const y2 = modP(y * y); // denominator is always non-0 mod p.\n            const u = modP(y2 - _1n); // u = y² - 1\n            const v = modP(d * y2 - a); // v = d y² + 1.\n            let { isValid, value: x } = uvRatio(u, v); // √(u/v)\n            if (!isValid)\n                throw new Error('bad point: invalid y coordinate');\n            const isXOdd = (x & _1n) === _1n; // There are 2 square roots. Use x_0 bit to select proper\n            const isLastByteOdd = (lastByte & 0x80) !== 0; // x_0, last bit\n            if (!zip215 && x === _0n && isLastByteOdd)\n                // if x=0 and x_0 = 1, fail\n                throw new Error('bad point: x=0 and x_0=1');\n            if (isLastByteOdd !== isXOdd)\n                x = modP(-x); // if x_0 != x mod 2, set x = p-x\n            return Point.fromAffine({ x, y });\n        }\n        static fromHex(hex, zip215 = false) {\n            return Point.fromBytes(hexToBytes(hex), zip215);\n        }\n        get x() {\n            return this.toAffine().x;\n        }\n        get y() {\n            return this.toAffine().y;\n        }\n        precompute(windowSize = 8, isLazy = true) {\n            wnaf.createCache(this, windowSize);\n            if (!isLazy)\n                this.multiply(_2n); // random number\n            return this;\n        }\n        // Useful in fromAffine() - not for fromBytes(), which always created valid points.\n        assertValidity() {\n            assertValidMemo(this);\n        }\n        // Compare one point to another.\n        equals(other) {\n            aedpoint(other);\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            const { X: X2, Y: Y2, Z: Z2 } = other;\n            const X1Z2 = modP(X1 * Z2);\n            const X2Z1 = modP(X2 * Z1);\n            const Y1Z2 = modP(Y1 * Z2);\n            const Y2Z1 = modP(Y2 * Z1);\n            return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;\n        }\n        is0() {\n            return this.equals(Point.ZERO);\n        }\n        negate() {\n            // Flips point sign to a negative one (-x, y in affine coords)\n            return new Point(modP(-this.X), this.Y, this.Z, modP(-this.T));\n        }\n        // Fast algo for doubling Extended Point.\n        // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd\n        // Cost: 4M + 4S + 1*a + 6add + 1*2.\n        double() {\n            const { a } = CURVE;\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            const A = modP(X1 * X1); // A = X12\n            const B = modP(Y1 * Y1); // B = Y12\n            const C = modP(_2n * modP(Z1 * Z1)); // C = 2*Z12\n            const D = modP(a * A); // D = a*A\n            const x1y1 = X1 + Y1;\n            const E = modP(modP(x1y1 * x1y1) - A - B); // E = (X1+Y1)2-A-B\n            const G = D + B; // G = D+B\n            const F = G - C; // F = G-C\n            const H = D - B; // H = D-B\n            const X3 = modP(E * F); // X3 = E*F\n            const Y3 = modP(G * H); // Y3 = G*H\n            const T3 = modP(E * H); // T3 = E*H\n            const Z3 = modP(F * G); // Z3 = F*G\n            return new Point(X3, Y3, Z3, T3);\n        }\n        // Fast algo for adding 2 Extended Points.\n        // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd\n        // Cost: 9M + 1*a + 1*d + 7add.\n        add(other) {\n            aedpoint(other);\n            const { a, d } = CURVE;\n            const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;\n            const { X: X2, Y: Y2, Z: Z2, T: T2 } = other;\n            const A = modP(X1 * X2); // A = X1*X2\n            const B = modP(Y1 * Y2); // B = Y1*Y2\n            const C = modP(T1 * d * T2); // C = T1*d*T2\n            const D = modP(Z1 * Z2); // D = Z1*Z2\n            const E = modP((X1 + Y1) * (X2 + Y2) - A - B); // E = (X1+Y1)*(X2+Y2)-A-B\n            const F = D - C; // F = D-C\n            const G = D + C; // G = D+C\n            const H = modP(B - a * A); // H = B-a*A\n            const X3 = modP(E * F); // X3 = E*F\n            const Y3 = modP(G * H); // Y3 = G*H\n            const T3 = modP(E * H); // T3 = E*H\n            const Z3 = modP(F * G); // Z3 = F*G\n            return new Point(X3, Y3, Z3, T3);\n        }\n        subtract(other) {\n            return this.add(other.negate());\n        }\n        // Constant-time multiplication.\n        multiply(scalar) {\n            // 1 <= scalar < L\n            if (!Fn.isValidNot0(scalar))\n                throw new Error('invalid scalar: expected 1 <= sc < curve.n');\n            const { p, f } = wnaf.cached(this, scalar, (p) => normalizeZ(Point, p));\n            return normalizeZ(Point, [p, f])[0];\n        }\n        // Non-constant-time multiplication. Uses double-and-add algorithm.\n        // It's faster, but should only be used when you don't care about\n        // an exposed private key e.g. sig verification.\n        // Does NOT allow scalars higher than CURVE.n.\n        // Accepts optional accumulator to merge with multiply (important for sparse scalars)\n        multiplyUnsafe(scalar, acc = Point.ZERO) {\n            // 0 <= scalar < L\n            if (!Fn.isValid(scalar))\n                throw new Error('invalid scalar: expected 0 <= sc < curve.n');\n            if (scalar === _0n)\n                return Point.ZERO;\n            if (this.is0() || scalar === _1n)\n                return this;\n            return wnaf.unsafe(this, scalar, (p) => normalizeZ(Point, p), acc);\n        }\n        // Checks if point is of small order.\n        // If you add something to small order point, you will have \"dirty\"\n        // point with torsion component.\n        // Multiplies point by cofactor and checks if the result is 0.\n        isSmallOrder() {\n            return this.multiplyUnsafe(cofactor).is0();\n        }\n        // Multiplies point by curve order and checks if the result is 0.\n        // Returns `false` is the point is dirty.\n        isTorsionFree() {\n            return wnaf.unsafe(this, CURVE.n).is0();\n        }\n        // Converts Extended point to default (x, y) coordinates.\n        // Can accept precomputed Z^-1 - for example, from invertBatch.\n        toAffine(invertedZ) {\n            return toAffineMemo(this, invertedZ);\n        }\n        clearCofactor() {\n            if (cofactor === _1n)\n                return this;\n            return this.multiplyUnsafe(cofactor);\n        }\n        toBytes() {\n            const { x, y } = this.toAffine();\n            // Fp.toBytes() allows non-canonical encoding of y (>= p).\n            const bytes = Fp.toBytes(y);\n            // Each y has 2 valid points: (x, y), (x,-y).\n            // When compressing, it's enough to store y and use the last byte to encode sign of x\n            bytes[bytes.length - 1] |= x & _1n ? 0x80 : 0;\n            return bytes;\n        }\n        toHex() {\n            return bytesToHex(this.toBytes());\n        }\n        toString() {\n            return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;\n        }\n    }\n    const wnaf = new wNAF(Point, Fn.BITS);\n    Point.BASE.precompute(8); // Enable precomputes. Slows down first publicKey computation by 20ms.\n    return Point;\n}\n/**\n * Base class for prime-order points like Ristretto255 and Decaf448.\n * These points eliminate cofactor issues by representing equivalence classes\n * of Edwards curve points.\n */\nexport class PrimeEdwardsPoint {\n    static BASE;\n    static ZERO;\n    static Fp;\n    static Fn;\n    ep;\n    constructor(ep) {\n        this.ep = ep;\n    }\n    // Static methods that must be implemented by subclasses\n    static fromBytes(_bytes) {\n        notImplemented();\n    }\n    static fromHex(_hex) {\n        notImplemented();\n    }\n    get x() {\n        return this.toAffine().x;\n    }\n    get y() {\n        return this.toAffine().y;\n    }\n    // Common implementations\n    clearCofactor() {\n        // no-op for prime-order groups\n        return this;\n    }\n    assertValidity() {\n        this.ep.assertValidity();\n    }\n    toAffine(invertedZ) {\n        return this.ep.toAffine(invertedZ);\n    }\n    toHex() {\n        return bytesToHex(this.toBytes());\n    }\n    toString() {\n        return this.toHex();\n    }\n    isTorsionFree() {\n        return true;\n    }\n    isSmallOrder() {\n        return false;\n    }\n    add(other) {\n        this.assertSame(other);\n        return this.init(this.ep.add(other.ep));\n    }\n    subtract(other) {\n        this.assertSame(other);\n        return this.init(this.ep.subtract(other.ep));\n    }\n    multiply(scalar) {\n        return this.init(this.ep.multiply(scalar));\n    }\n    multiplyUnsafe(scalar) {\n        return this.init(this.ep.multiplyUnsafe(scalar));\n    }\n    double() {\n        return this.init(this.ep.double());\n    }\n    negate() {\n        return this.init(this.ep.negate());\n    }\n    precompute(windowSize, isLazy) {\n        return this.init(this.ep.precompute(windowSize, isLazy));\n    }\n}\n/**\n * Initializes EdDSA signatures over given Edwards curve.\n */\nexport function eddsa(Point, cHash, eddsaOpts = {}) {\n    if (typeof cHash !== 'function')\n        throw new Error('\"hash\" function param is required');\n    validateObject(eddsaOpts, {}, {\n        adjustScalarBytes: 'function',\n        randomBytes: 'function',\n        domain: 'function',\n        prehash: 'function',\n        mapToCurve: 'function',\n    });\n    const { prehash } = eddsaOpts;\n    const { BASE, Fp, Fn } = Point;\n    const randomBytes = eddsaOpts.randomBytes || wcRandomBytes;\n    const adjustScalarBytes = eddsaOpts.adjustScalarBytes || ((bytes) => bytes);\n    const domain = eddsaOpts.domain ||\n        ((data, ctx, phflag) => {\n            abool(phflag, 'phflag');\n            if (ctx.length || phflag)\n                throw new Error('Contexts/pre-hash are not supported');\n            return data;\n        }); // NOOP\n    // Little-endian SHA512 with modulo n\n    function modN_LE(hash) {\n        return Fn.create(bytesToNumberLE(hash)); // Not Fn.fromBytes: it has length limit\n    }\n    // Get the hashed private scalar per RFC8032 5.1.5\n    function getPrivateScalar(key) {\n        const len = lengths.secretKey;\n        abytes(key, lengths.secretKey, 'secretKey');\n        // Hash private key with curve's hash function to produce uniformingly random input\n        // Check byte lengths: ensure(64, h(ensure(32, key)))\n        const hashed = abytes(cHash(key), 2 * len, 'hashedSecretKey');\n        const head = adjustScalarBytes(hashed.slice(0, len)); // clear first half bits, produce FE\n        const prefix = hashed.slice(len, 2 * len); // second half is called key prefix (5.1.6)\n        const scalar = modN_LE(head); // The actual private scalar\n        return { head, prefix, scalar };\n    }\n    /** Convenience method that creates public key from scalar. RFC8032 5.1.5 */\n    function getExtendedPublicKey(secretKey) {\n        const { head, prefix, scalar } = getPrivateScalar(secretKey);\n        const point = BASE.multiply(scalar); // Point on Edwards curve aka public key\n        const pointBytes = point.toBytes();\n        return { head, prefix, scalar, point, pointBytes };\n    }\n    /** Calculates EdDSA pub key. RFC8032 5.1.5. */\n    function getPublicKey(secretKey) {\n        return getExtendedPublicKey(secretKey).pointBytes;\n    }\n    // int('LE', SHA512(dom2(F, C) || msgs)) mod N\n    function hashDomainToScalar(context = Uint8Array.of(), ...msgs) {\n        const msg = concatBytes(...msgs);\n        return modN_LE(cHash(domain(msg, abytes(context, undefined, 'context'), !!prehash)));\n    }\n    /** Signs message with secret key. RFC8032 5.1.6 */\n    function sign(msg, secretKey, options = {}) {\n        msg = abytes(msg, undefined, 'message');\n        if (prehash)\n            msg = prehash(msg); // for ed25519ph etc.\n        const { prefix, scalar, pointBytes } = getExtendedPublicKey(secretKey);\n        const r = hashDomainToScalar(options.context, prefix, msg); // r = dom2(F, C) || prefix || PH(M)\n        const R = BASE.multiply(r).toBytes(); // R = rG\n        const k = hashDomainToScalar(options.context, R, pointBytes, msg); // R || A || PH(M)\n        const s = Fn.create(r + k * scalar); // S = (r + k * s) mod L\n        if (!Fn.isValid(s))\n            throw new Error('sign failed: invalid s'); // 0 <= s < L\n        const rs = concatBytes(R, Fn.toBytes(s));\n        return abytes(rs, lengths.signature, 'result');\n    }\n    // verification rule is either zip215 or rfc8032 / nist186-5. Consult fromHex:\n    const verifyOpts = { zip215: true };\n    /**\n     * Verifies EdDSA signature against message and public key. RFC8032 5.1.7.\n     * An extended group equation is checked.\n     */\n    function verify(sig, msg, publicKey, options = verifyOpts) {\n        const { context, zip215 } = options;\n        const len = lengths.signature;\n        sig = abytes(sig, len, 'signature');\n        msg = abytes(msg, undefined, 'message');\n        publicKey = abytes(publicKey, lengths.publicKey, 'publicKey');\n        if (zip215 !== undefined)\n            abool(zip215, 'zip215');\n        if (prehash)\n            msg = prehash(msg); // for ed25519ph, etc\n        const mid = len / 2;\n        const r = sig.subarray(0, mid);\n        const s = bytesToNumberLE(sig.subarray(mid, len));\n        let A, R, SB;\n        try {\n            // zip215=true is good for consensus-critical apps. =false follows RFC8032 / NIST186-5.\n            // zip215=true:  0 <= y < MASK (2^256 for ed25519)\n            // zip215=false: 0 <= y < P (2^255-19 for ed25519)\n            A = Point.fromBytes(publicKey, zip215);\n            R = Point.fromBytes(r, zip215);\n            SB = BASE.multiplyUnsafe(s); // 0 <= s < l is done inside\n        }\n        catch (error) {\n            return false;\n        }\n        if (!zip215 && A.isSmallOrder())\n            return false; // zip215 allows public keys of small order\n        const k = hashDomainToScalar(context, R.toBytes(), A.toBytes(), msg);\n        const RkA = R.add(A.multiplyUnsafe(k));\n        // Extended group equation\n        // [8][S]B = [8]R + [8][k]A'\n        return RkA.subtract(SB).clearCofactor().is0();\n    }\n    const _size = Fp.BYTES; // 32 for ed25519, 57 for ed448\n    const lengths = {\n        secretKey: _size,\n        publicKey: _size,\n        signature: 2 * _size,\n        seed: _size,\n    };\n    function randomSecretKey(seed = randomBytes(lengths.seed)) {\n        return abytes(seed, lengths.seed, 'seed');\n    }\n    function isValidSecretKey(key) {\n        return isBytes(key) && key.length === Fn.BYTES;\n    }\n    function isValidPublicKey(key, zip215) {\n        try {\n            return !!Point.fromBytes(key, zip215);\n        }\n        catch (error) {\n            return false;\n        }\n    }\n    const utils = {\n        getExtendedPublicKey,\n        randomSecretKey,\n        isValidSecretKey,\n        isValidPublicKey,\n        /**\n         * Converts ed public key to x public key. Uses formula:\n         * - ed25519:\n         *   - `(u, v) = ((1+y)/(1-y), sqrt(-486664)*u/x)`\n         *   - `(x, y) = (sqrt(-486664)*u/v, (u-1)/(u+1))`\n         * - ed448:\n         *   - `(u, v) = ((y-1)/(y+1), sqrt(156324)*u/x)`\n         *   - `(x, y) = (sqrt(156324)*u/v, (1+u)/(1-u))`\n         */\n        toMontgomery(publicKey) {\n            const { y } = Point.fromBytes(publicKey);\n            const size = lengths.publicKey;\n            const is25519 = size === 32;\n            if (!is25519 && size !== 57)\n                throw new Error('only defined for 25519 and 448');\n            const u = is25519 ? Fp.div(_1n + y, _1n - y) : Fp.div(y - _1n, y + _1n);\n            return Fp.toBytes(u);\n        },\n        toMontgomerySecret(secretKey) {\n            const size = lengths.secretKey;\n            abytes(secretKey, size);\n            const hashed = cHash(secretKey.subarray(0, size));\n            return adjustScalarBytes(hashed).subarray(0, size);\n        },\n    };\n    return Object.freeze({\n        keygen: createKeygen(randomSecretKey, getPublicKey),\n        getPublicKey,\n        sign,\n        verify,\n        utils,\n        Point,\n        lengths,\n    });\n}\n//# sourceMappingURL=edwards.js.map"],"x_google_ignoreList":[0],"mappings":";;;;;AAYA,MAAM,MAAM,OAAO,IAAI,MAAM,OAAO,IAAI,MAAM,OAAO,IAAI,MAAM,OAAO;AACtE,SAAS,YAAY,IAAI,OAAO,GAAG,GAAG;CAClC,MAAM,KAAK,GAAG,IAAI;CAClB,MAAM,KAAK,GAAG,IAAI;CAClB,MAAM,OAAO,GAAG,IAAI,GAAG,IAAI,MAAM,GAAG,KAAK;CACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,IAAI;AACxD,QAAO,GAAG,IAAI,MAAM;;AAExB,SAAgB,QAAQ,QAAQ,YAAY,IAAI;CAC5C,MAAM,YAAYA,gCAAkB,WAAW,QAAQ,WAAW,UAAU;CAC5E,MAAM,EAAE,IAAI,OAAO;CACnB,IAAI,QAAQ,UAAU;CACtB,MAAM,EAAE,GAAG,aAAa;AACxB,gCAAe,WAAW,IAAI,EAAE,SAAS;CAKzC,MAAM,OAAO,OAAQ,OAAO,GAAG,QAAQ,KAAK;CAC5C,MAAM,QAAQ,MAAM,GAAG,OAAO;CAE9B,MAAM,UAAU,UAAU,aACpB,GAAG,MAAM;AACP,MAAI;AACA,UAAO;IAAE,SAAS;IAAM,OAAO,GAAG,KAAK,GAAG,IAAI,GAAG;;WAE9C,GAAG;AACN,UAAO;IAAE,SAAS;IAAO,OAAO;;;;AAK5C,KAAI,CAAC,YAAY,IAAI,OAAO,MAAM,IAAI,MAAM,IACxC,OAAM,IAAI,MAAM;;;;;CAKpB,SAAS,OAAO,OAAO,GAAG,UAAU,OAAO;EACvC,MAAM,MAAM,UAAU,MAAM;AAC5B,2BAAS,gBAAgB,OAAO,GAAG,KAAK;AACxC,SAAO;;CAEX,SAAS,SAAS,OAAO;AACrB,MAAI,EAAE,iBAAiB,OACnB,OAAM,IAAI,MAAM;;CAIxB,MAAM,eAAeC,0BAAU,GAAG,OAAO;EACrC,MAAM,EAAE,GAAG,GAAG,MAAM;EACpB,MAAM,MAAM,EAAE;AACd,MAAI,MAAM,KACN,MAAK,MAAM,MAAM,GAAG,IAAI;EAC5B,MAAM,IAAI,KAAK,IAAI;EACnB,MAAM,IAAI,KAAK,IAAI;EACnB,MAAM,KAAK,GAAG,IAAI,GAAG;AACrB,MAAI,IACA,QAAO;GAAE,GAAG;GAAK,GAAG;;AACxB,MAAI,OAAO,IACP,OAAM,IAAI,MAAM;AACpB,SAAO;GAAE;GAAG;;;CAEhB,MAAM,kBAAkBA,0BAAU,MAAM;EACpC,MAAM,EAAE,GAAG,MAAM;AACjB,MAAI,EAAE,MACF,OAAM,IAAI,MAAM;EAGpB,MAAM,EAAE,GAAG,GAAG,GAAG,MAAM;EACvB,MAAM,KAAK,KAAK,IAAI;EACpB,MAAM,KAAK,KAAK,IAAI;EACpB,MAAM,KAAK,KAAK,IAAI;EACpB,MAAM,KAAK,KAAK,KAAK;EACrB,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,OAAO,KAAK,KAAK,KAAK,MAAM;EAClC,MAAM,QAAQ,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK;AAC3C,MAAI,SAAS,MACT,OAAM,IAAI,MAAM;EAEpB,MAAM,KAAK,KAAK,IAAI;EACpB,MAAM,KAAK,KAAK,IAAI;AACpB,MAAI,OAAO,GACP,OAAM,IAAI,MAAM;AACpB,SAAO;;CAIX,MAAM,MAAM;EAER,OAAO,OAAO,IAAI,MAAM,MAAM,IAAI,MAAM,IAAI,KAAK,KAAK,MAAM,KAAK,MAAM;EAEvE,OAAO,OAAO,IAAI,MAAM,KAAK,KAAK,KAAK;EAEvC,OAAO,KAAK;EAEZ,OAAO,KAAK;EACZ;EACA;EACA;EACA;EACA,YAAY,GAAG,GAAG,GAAG,GAAG;AACpB,QAAK,IAAI,OAAO,KAAK;AACrB,QAAK,IAAI,OAAO,KAAK;AACrB,QAAK,IAAI,OAAO,KAAK,GAAG;AACxB,QAAK,IAAI,OAAO,KAAK;AACrB,UAAO,OAAO;;EAElB,OAAO,QAAQ;AACX,UAAO;;EAEX,OAAO,WAAW,GAAG;AACjB,OAAI,aAAa,MACb,OAAM,IAAI,MAAM;GACpB,MAAM,EAAE,GAAG,MAAM,KAAK;AACtB,UAAO,KAAK;AACZ,UAAO,KAAK;AACZ,UAAO,IAAI,MAAM,GAAG,GAAG,KAAK,KAAK,IAAI;;EAGzC,OAAO,UAAU,OAAO,SAAS,OAAO;GACpC,MAAM,MAAM,GAAG;GACf,MAAM,EAAE,GAAG,MAAM;AACjB,WAAQC,0BAAUC,qBAAO,OAAO,KAAK;AACrC,yBAAM,QAAQ;GACd,MAAM,SAASD,0BAAU;GACzB,MAAM,WAAW,MAAM,MAAM;AAC7B,UAAO,MAAM,KAAK,WAAW;GAC7B,MAAM,IAAIE,gCAAgB;GAK1B,MAAM,MAAM,SAAS,OAAO,GAAG;AAC/B,4BAAS,WAAW,GAAG,KAAK;GAG5B,MAAM,KAAK,KAAK,IAAI;GACpB,MAAM,IAAI,KAAK,KAAK;GACpB,MAAM,IAAI,KAAK,IAAI,KAAK;GACxB,IAAI,EAAE,SAAS,OAAO,MAAM,QAAQ,GAAG;AACvC,OAAI,CAAC,QACD,OAAM,IAAI,MAAM;GACpB,MAAM,UAAU,IAAI,SAAS;GAC7B,MAAM,iBAAiB,WAAW,SAAU;AAC5C,OAAI,CAAC,UAAU,MAAM,OAAO,cAExB,OAAM,IAAI,MAAM;AACpB,OAAI,kBAAkB,OAClB,KAAI,KAAK,CAAC;AACd,UAAO,MAAM,WAAW;IAAE;IAAG;;;EAEjC,OAAO,QAAQ,KAAK,SAAS,OAAO;AAChC,UAAO,MAAM,UAAUC,yBAAW,MAAM;;EAE5C,IAAI,IAAI;AACJ,UAAO,KAAK,WAAW;;EAE3B,IAAI,IAAI;AACJ,UAAO,KAAK,WAAW;;EAE3B,WAAW,aAAa,GAAG,SAAS,MAAM;AACtC,QAAK,YAAY,MAAM;AACvB,OAAI,CAAC,OACD,MAAK,SAAS;AAClB,UAAO;;EAGX,iBAAiB;AACb,mBAAgB;;EAGpB,OAAO,OAAO;AACV,YAAS;GACT,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO;GAChC,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO;GAChC,MAAM,OAAO,KAAK,KAAK;GACvB,MAAM,OAAO,KAAK,KAAK;GACvB,MAAM,OAAO,KAAK,KAAK;GACvB,MAAM,OAAO,KAAK,KAAK;AACvB,UAAO,SAAS,QAAQ,SAAS;;EAErC,MAAM;AACF,UAAO,KAAK,OAAO,MAAM;;EAE7B,SAAS;AAEL,UAAO,IAAI,MAAM,KAAK,CAAC,KAAK,IAAI,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,KAAK;;EAK/D,SAAS;GACL,MAAM,EAAE,MAAM;GACd,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO;GAChC,MAAM,IAAI,KAAK,KAAK;GACpB,MAAM,IAAI,KAAK,KAAK;GACpB,MAAM,IAAI,KAAK,MAAM,KAAK,KAAK;GAC/B,MAAM,IAAI,KAAK,IAAI;GACnB,MAAM,OAAO,KAAK;GAClB,MAAM,IAAI,KAAK,KAAK,OAAO,QAAQ,IAAI;GACvC,MAAM,IAAI,IAAI;GACd,MAAM,IAAI,IAAI;GACd,MAAM,IAAI,IAAI;GACd,MAAM,KAAK,KAAK,IAAI;GACpB,MAAM,KAAK,KAAK,IAAI;GACpB,MAAM,KAAK,KAAK,IAAI;GACpB,MAAM,KAAK,KAAK,IAAI;AACpB,UAAO,IAAI,MAAM,IAAI,IAAI,IAAI;;EAKjC,IAAI,OAAO;AACP,YAAS;GACT,MAAM,EAAE,GAAG,MAAM;GACjB,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO;GACvC,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO;GACvC,MAAM,IAAI,KAAK,KAAK;GACpB,MAAM,IAAI,KAAK,KAAK;GACpB,MAAM,IAAI,KAAK,KAAK,IAAI;GACxB,MAAM,IAAI,KAAK,KAAK;GACpB,MAAM,IAAI,MAAM,KAAK,OAAO,KAAK,MAAM,IAAI;GAC3C,MAAM,IAAI,IAAI;GACd,MAAM,IAAI,IAAI;GACd,MAAM,IAAI,KAAK,IAAI,IAAI;GACvB,MAAM,KAAK,KAAK,IAAI;GACpB,MAAM,KAAK,KAAK,IAAI;GACpB,MAAM,KAAK,KAAK,IAAI;GACpB,MAAM,KAAK,KAAK,IAAI;AACpB,UAAO,IAAI,MAAM,IAAI,IAAI,IAAI;;EAEjC,SAAS,OAAO;AACZ,UAAO,KAAK,IAAI,MAAM;;EAG1B,SAAS,QAAQ;AAEb,OAAI,CAAC,GAAG,YAAY,QAChB,OAAM,IAAI,MAAM;GACpB,MAAM,EAAE,GAAG,MAAM,KAAK,OAAO,MAAM,SAAS,QAAMC,yBAAW,OAAOC;AACpE,UAAOD,yBAAW,OAAO,CAAC,GAAG,IAAI;;EAOrC,eAAe,QAAQ,MAAM,MAAM,MAAM;AAErC,OAAI,CAAC,GAAG,QAAQ,QACZ,OAAM,IAAI,MAAM;AACpB,OAAI,WAAW,IACX,QAAO,MAAM;AACjB,OAAI,KAAK,SAAS,WAAW,IACzB,QAAO;AACX,UAAO,KAAK,OAAO,MAAM,SAAS,MAAMA,yBAAW,OAAO,IAAI;;EAMlE,eAAe;AACX,UAAO,KAAK,eAAe,UAAU;;EAIzC,gBAAgB;AACZ,UAAO,KAAK,OAAO,MAAM,MAAM,GAAG;;EAItC,SAAS,WAAW;AAChB,UAAO,aAAa,MAAM;;EAE9B,gBAAgB;AACZ,OAAI,aAAa,IACb,QAAO;AACX,UAAO,KAAK,eAAe;;EAE/B,UAAU;GACN,MAAM,EAAE,GAAG,MAAM,KAAK;GAEtB,MAAM,QAAQ,GAAG,QAAQ;AAGzB,SAAM,MAAM,SAAS,MAAM,IAAI,MAAM,MAAO;AAC5C,UAAO;;EAEX,QAAQ;AACJ,UAAOE,yBAAW,KAAK;;EAE3B,WAAW;AACP,UAAO,UAAU,KAAK,QAAQ,SAAS,KAAK,QAAQ;;;CAG5D,MAAM,OAAO,IAAIC,mBAAK,OAAO,GAAG;AAChC,OAAM,KAAK,WAAW;AACtB,QAAO;;;;;AA+EX,SAAgB,MAAM,OAAO,OAAO,YAAY,IAAI;AAChD,KAAI,OAAO,UAAU,WACjB,OAAM,IAAI,MAAM;AACpB,gCAAe,WAAW,IAAI;EAC1B,mBAAmB;EACnB,aAAa;EACb,QAAQ;EACR,SAAS;EACT,YAAY;;CAEhB,MAAM,EAAE,YAAY;CACpB,MAAM,EAAE,MAAM,IAAI,OAAO;CACzB,MAAMC,gBAAc,UAAU,eAAeC;CAC7C,MAAM,oBAAoB,UAAU,uBAAuB,UAAU;CACrE,MAAM,SAAS,UAAU,YACnB,MAAM,KAAK,WAAW;AACpB,wBAAM,QAAQ;AACd,MAAI,IAAI,UAAU,OACd,OAAM,IAAI,MAAM;AACpB,SAAO;;CAGf,SAAS,QAAQ,MAAM;AACnB,SAAO,GAAG,OAAOP,gCAAgB;;CAGrC,SAAS,iBAAiB,KAAK;EAC3B,MAAM,MAAM,QAAQ;AACpB,uBAAO,KAAK,QAAQ,WAAW;EAG/B,MAAM,SAASD,qBAAO,MAAM,MAAM,IAAI,KAAK;EAC3C,MAAM,OAAO,kBAAkB,OAAO,MAAM,GAAG;EAC/C,MAAM,SAAS,OAAO,MAAM,KAAK,IAAI;EACrC,MAAM,SAAS,QAAQ;AACvB,SAAO;GAAE;GAAM;GAAQ;;;;CAG3B,SAAS,qBAAqB,WAAW;EACrC,MAAM,EAAE,MAAM,QAAQ,WAAW,iBAAiB;EAClD,MAAM,QAAQ,KAAK,SAAS;EAC5B,MAAM,aAAa,MAAM;AACzB,SAAO;GAAE;GAAM;GAAQ;GAAQ;GAAO;;;;CAG1C,SAAS,aAAa,WAAW;AAC7B,SAAO,qBAAqB,WAAW;;CAG3C,SAAS,mBAAmB,UAAU,WAAW,MAAM,GAAG,MAAM;EAC5D,MAAM,MAAMS,0BAAY,GAAG;AAC3B,SAAO,QAAQ,MAAM,OAAO,KAAKT,qBAAO,SAAS,QAAW,YAAY,CAAC,CAAC;;;CAG9E,SAAS,KAAK,KAAK,WAAW,UAAU,IAAI;AACxC,QAAMA,qBAAO,KAAK,QAAW;AAC7B,MAAI,QACA,OAAM,QAAQ;EAClB,MAAM,EAAE,QAAQ,QAAQ,eAAe,qBAAqB;EAC5D,MAAM,IAAI,mBAAmB,QAAQ,SAAS,QAAQ;EACtD,MAAM,IAAI,KAAK,SAAS,GAAG;EAC3B,MAAM,IAAI,mBAAmB,QAAQ,SAAS,GAAG,YAAY;EAC7D,MAAM,IAAI,GAAG,OAAO,IAAI,IAAI;AAC5B,MAAI,CAAC,GAAG,QAAQ,GACZ,OAAM,IAAI,MAAM;EACpB,MAAM,KAAKS,0BAAY,GAAG,GAAG,QAAQ;AACrC,SAAOT,qBAAO,IAAI,QAAQ,WAAW;;CAGzC,MAAM,aAAa,EAAE,QAAQ;;;;;CAK7B,SAAS,OAAO,KAAK,KAAK,WAAW,UAAU,YAAY;EACvD,MAAM,EAAE,SAAS,WAAW;EAC5B,MAAM,MAAM,QAAQ;AACpB,QAAMA,qBAAO,KAAK,KAAK;AACvB,QAAMA,qBAAO,KAAK,QAAW;AAC7B,cAAYA,qBAAO,WAAW,QAAQ,WAAW;AACjD,MAAI,WAAW,OACX,uBAAM,QAAQ;AAClB,MAAI,QACA,OAAM,QAAQ;EAClB,MAAM,MAAM,MAAM;EAClB,MAAM,IAAI,IAAI,SAAS,GAAG;EAC1B,MAAM,IAAIC,gCAAgB,IAAI,SAAS,KAAK;EAC5C,IAAI,GAAG,GAAG;AACV,MAAI;AAIA,OAAI,MAAM,UAAU,WAAW;AAC/B,OAAI,MAAM,UAAU,GAAG;AACvB,QAAK,KAAK,eAAe;WAEtB,OAAO;AACV,UAAO;;AAEX,MAAI,CAAC,UAAU,EAAE,eACb,QAAO;EACX,MAAM,IAAI,mBAAmB,SAAS,EAAE,WAAW,EAAE,WAAW;EAChE,MAAM,MAAM,EAAE,IAAI,EAAE,eAAe;AAGnC,SAAO,IAAI,SAAS,IAAI,gBAAgB;;CAE5C,MAAM,QAAQ,GAAG;CACjB,MAAM,UAAU;EACZ,WAAW;EACX,WAAW;EACX,WAAW,IAAI;EACf,MAAM;;CAEV,SAAS,gBAAgB,OAAOM,cAAY,QAAQ,OAAO;AACvD,SAAOP,qBAAO,MAAM,QAAQ,MAAM;;CAEtC,SAAS,iBAAiB,KAAK;AAC3B,SAAOU,sBAAQ,QAAQ,IAAI,WAAW,GAAG;;CAE7C,SAAS,iBAAiB,KAAK,QAAQ;AACnC,MAAI;AACA,UAAO,CAAC,CAAC,MAAM,UAAU,KAAK;WAE3B,OAAO;AACV,UAAO;;;CAGf,MAAM,QAAQ;EACV;EACA;EACA;EACA;EAUA,aAAa,WAAW;GACpB,MAAM,EAAE,MAAM,MAAM,UAAU;GAC9B,MAAM,OAAO,QAAQ;GACrB,MAAM,UAAU,SAAS;AACzB,OAAI,CAAC,WAAW,SAAS,GACrB,OAAM,IAAI,MAAM;GACpB,MAAM,IAAI,UAAU,GAAG,IAAI,MAAM,GAAG,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;AACnE,UAAO,GAAG,QAAQ;;EAEtB,mBAAmB,WAAW;GAC1B,MAAM,OAAO,QAAQ;AACrB,wBAAO,WAAW;GAClB,MAAM,SAAS,MAAM,UAAU,SAAS,GAAG;AAC3C,UAAO,kBAAkB,QAAQ,SAAS,GAAG;;;AAGrD,QAAO,OAAO,OAAO;EACjB,QAAQC,2BAAa,iBAAiB;EACtC;EACA;EACA;EACA;EACA;EACA"}