aviation-chart 2.0.10 → 2.0.12

package/dist/nav-sdk.esm.js

@@ -1606,7 +1606,7 @@ function buildAMMLayersLight(sourceId = 'amm') {
       layout: {
         'text-field': ['get', 'idlin'],
         'text-size': 10,
-        "icon-image": "text_bg",
+        "icon-image": "stretch:text_bg",
         "icon-text-fit": "both",
         "icon-text-fit-padding": [
           1,
@@ -1632,7 +1632,7 @@ function buildAMMLayersLight(sourceId = 'amm') {
       'source-layer': 'amm-runway-threshold',
       minzoom: 12,
       layout: {
-        "icon-image": "text_bg",
+        "icon-image": "stretch:text_bg",
         "icon-text-fit": "both",
         "icon-text-fit-padding": [
           1,
@@ -1834,12 +1834,12 @@ function buildAMMLayersDark(sourceId = 'amm') {
     { id: 'amm-stand-line', type: 'line', source: sourceId, 'source-layer': 'amm-stand-line', minzoom: 13, paint: { 'line-color': C.standLine, 'line-width': 1 } },
     {
       id: 'amm-taxiway-label', type: 'symbol', source: sourceId, 'source-layer': 'amm-taxiway-line', minzoom: 14,
-      layout: { 'text-field': ['get', 'idlin'], 'text-size': 10, "icon-image": "text_bg", "icon-text-fit": "both", "icon-text-fit-padding": [1, 2, 1, 2], 'symbol-placement': 'line', 'text-keep-upright': true, 'text-allow-overlap': false },
+      layout: { 'text-field': ['get', 'idlin'], 'text-size': 10, "icon-image": "stretch:text_bg", "icon-text-fit": "both", "icon-text-fit-padding": [1, 2, 1, 2], 'symbol-placement': 'line', 'text-keep-upright': true, 'text-allow-overlap': false },
       paint: { 'text-color': "#0f172a", "icon-color": C.taxiwayLine },
     },
     {
       id: 'amm-runway-threshold-label', type: 'symbol', source: sourceId, 'source-layer': 'amm-runway-threshold', minzoom: 12,
-      layout: { "icon-image": "text_bg", "icon-text-fit": "both", "icon-text-fit-padding": [1, 2, 1, 2], 'text-field': ['get', 'idthr'], 'text-size': 14, 'text-allow-overlap': true, 'text-rotation-alignment': 'map', 'icon-rotation-alignment': 'map' },
+      layout: { "icon-image": "stretch:text_bg", "icon-text-fit": "both", "icon-text-fit-padding": [1, 2, 1, 2], 'text-field': ['get', 'idthr'], 'text-size': 14, 'text-allow-overlap': true, 'text-rotation-alignment': 'map', 'icon-rotation-alignment': 'map' },
       paint: { 'text-color': '#ffffff', "icon-color": "#ef4444" },
     },
     { id: 'amm-stand', type: 'circle', source: sourceId, 'source-layer': 'amm-stand', minzoom: 12, paint: { 'circle-color': C.stand, 'circle-radius': 1.5 } },
@@ -1897,7 +1897,7 @@ function buildAMMLayersNeutral(sourceId = 'amm') {
     { id: 'amm-taxiway-line', type: 'line', source: sourceId, 'source-layer': 'amm-taxiway-line', minzoom: 11, paint: { 'line-color': C.taxiwayLine, 'line-width': ['interpolate', ['linear'], ['zoom'], 15, 0.8, 18, 2] } },
     {
       id: 'amm-taxiway-label', type: 'symbol', source: sourceId, 'source-layer': 'amm-taxiway-line', minzoom: 14,
-      layout: { 'text-field': ['get', 'idlin'], 'text-size': 10, "icon-image": "text_bg", "icon-text-fit": "both", "icon-text-fit-padding": [1, 2, 1, 2], 'symbol-placement': 'line', 'text-keep-upright': true, 'text-allow-overlap': false },
+      layout: { 'text-field': ['get', 'idlin'], 'text-size': 10, "icon-image": "stretch:text_bg", "icon-text-fit": "both", "icon-text-fit-padding": [1, 2, 1, 2], 'symbol-placement': 'line', 'text-keep-upright': true, 'text-allow-overlap': false },
       paint: { 'text-color': H, "icon-color": C.taxiwayLine },
     },
     { id: 'amm-holding', type: 'line', source: sourceId, 'source-layer': 'amm-holding', minzoom: 11, paint: { 'line-color': C.holding, 'line-width': 1.5 } },
@@ -1915,7 +1915,7 @@ function buildAMMLayersNeutral(sourceId = 'amm') {
     { id: 'amm-stand-line', type: 'line', source: sourceId, 'source-layer': 'amm-stand-line', minzoom: 13, paint: { 'line-color': C.standLine, 'line-width': 1 } },
     {
       id: 'amm-runway-threshold-label', type: 'symbol', source: sourceId, 'source-layer': 'amm-runway-threshold', minzoom: 12,
-      layout: { "icon-image": "text_bg", "icon-text-fit": "both", "icon-text-fit-padding": [1, 2, 1, 2], 'text-field': ['get', 'idthr'], 'text-size': 14, 'text-allow-overlap': true, 'text-rotation-alignment': 'map', 'icon-rotation-alignment': 'map' },
+      layout: { "icon-image": "stretch:text_bg", "icon-text-fit": "both", "icon-text-fit-padding": [1, 2, 1, 2], 'text-field': ['get', 'idthr'], 'text-size': 14, 'text-allow-overlap': true, 'text-rotation-alignment': 'map', 'icon-rotation-alignment': 'map' },
       paint: { 'text-color': '#ffffff', "icon-color": C.threshold },
     },
     { id: 'amm-stand', type: 'circle', source: sourceId, 'source-layer': 'amm-stand', minzoom: 12, paint: { 'circle-color': C.stand, 'circle-radius': 1.5 } },
@@ -7430,6 +7430,7 @@ function getAviationBaseStyle(opts) {
             { id: "v2", url: `${spriteBase}/sprites/sprite-v2` },
             { id: "vor", url: `${spriteBase}/sprites/sprite-vor` },
             { id: "runway", url: `${spriteBase}/sprites/sprite-runway` },
+            { id: "stretch", url: `${spriteBase}/sprites/sprite-stretch` },
         ],
         sources: {
             land: { type: "geojson", data: { type: "FeatureCollection", features: [] } },
@@ -7596,6 +7597,2041 @@ async function fetchGzJson(url, headers = {}) {
     return new Response(stream).json();
 }
 
+/**
+ * Utilities for hex, bytes, CSPRNG.
+ * @module
+ */
+/*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) */
+/**
+ * Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.
+ * @param a - Value to inspect.
+ * @returns `true` when the value is a Uint8Array view, including Node's `Buffer`.
+ * @example
+ * Guards a value before treating it as raw key material.
+ *
+ * ```ts
+ * isBytes(new Uint8Array());
+ * ```
+ */
+function isBytes$1(a) {
+    // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy /
+    // cross-realm cases. The fallback still requires a real ArrayBuffer view
+    // so plain JSON-deserialized `{ constructor: ... }`
+    // spoofing is rejected, and `BYTES_PER_ELEMENT === 1` keeps the fallback on byte-oriented views.
+    return (a instanceof Uint8Array ||
+        (ArrayBuffer.isView(a) &&
+            a.constructor.name === 'Uint8Array' &&
+            'BYTES_PER_ELEMENT' in a &&
+            a.BYTES_PER_ELEMENT === 1));
+}
+/**
+ * Asserts something is boolean.
+ * @param b - Value to validate.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Validates a boolean option before branching on it.
+ *
+ * ```ts
+ * abool(true);
+ * ```
+ */
+function abool(b) {
+    if (typeof b !== 'boolean')
+        throw new TypeError(`boolean expected, not ${b}`);
+}
+/**
+ * Asserts something is a non-negative safe integer.
+ * @param n - Value to validate.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Validates a non-negative length or counter.
+ *
+ * ```ts
+ * anumber(1);
+ * ```
+ */
+function anumber$1(n) {
+    if (typeof n !== 'number')
+        throw new TypeError('number expected, got ' + typeof n);
+    if (!Number.isSafeInteger(n) || n < 0)
+        throw new RangeError('positive integer expected, got ' + n);
+}
+/**
+ * Asserts something is Uint8Array.
+ * @param value - Value to validate.
+ * @param length - Expected byte length.
+ * @param title - Optional label used in error messages.
+ * @returns The validated byte array.
+ * On Node, `Buffer` is accepted too because it is a Uint8Array view.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument lengths. {@link RangeError}
+ * @example
+ * Validates a fixed-length nonce or key buffer.
+ *
+ * ```ts
+ * abytes(new Uint8Array([1, 2]), 2);
+ * ```
+ */
+function abytes$1(value, length, title = '') {
+    const bytes = isBytes$1(value);
+    const len = value?.length;
+    const needsLen = length !== undefined;
+    if (!bytes || (needsLen && len !== length)) {
+        const prefix = title && `"${title}" `;
+        const ofLen = needsLen ? ` of length ${length}` : '';
+        const got = bytes ? `length=${len}` : `type=${typeof value}`;
+        const message = prefix + 'expected Uint8Array' + ofLen + ', got ' + got;
+        if (!bytes)
+            throw new TypeError(message);
+        throw new RangeError(message);
+    }
+    return value;
+}
+/**
+ * Asserts a hash- or MAC-like instance has not been destroyed or finished.
+ * @param instance - Stateful instance to validate.
+ * @param checkFinished - Whether to reject finished instances.
+ * When `false`, only `destroyed` is checked.
+ * @throws If the hash instance has already been destroyed or finalized. {@link Error}
+ * @example
+ * Guards against calling `update()` or `digest()` on a finished hash.
+ *
+ * ```ts
+ * aexists({ destroyed: false, finished: false });
+ * ```
+ */
+function aexists$1(instance, checkFinished = true) {
+    if (instance.destroyed)
+        throw new Error('Hash instance has been destroyed');
+    if (checkFinished && instance.finished)
+        throw new Error('Hash#digest() has already been called');
+}
+/**
+ * Asserts output is a properly-sized byte array.
+ * @param out - Output buffer to validate.
+ * @param instance - Hash-like instance providing `outputLen`.
+ * This is the relaxed `digestInto()`-style contract: output must be at least `outputLen`,
+ * unlike one-shot cipher helpers elsewhere in the repo that often require exact lengths.
+ * @throws On wrong argument types. {@link TypeError}
+ * @param onlyAligned - Whether `out` must be 4-byte aligned for zero-allocation word views.
+ * @throws On wrong output buffer lengths. {@link RangeError}
+ * @throws On wrong output buffer alignment. {@link Error}
+ * @example
+ * Verifies that a caller-provided output buffer is large enough.
+ *
+ * ```ts
+ * aoutput(new Uint8Array(16), { outputLen: 16 });
+ * ```
+ */
+function aoutput$1(out, instance, onlyAligned = false) {
+    abytes$1(out, undefined, 'output');
+    const min = instance.outputLen;
+    if (out.length < min) {
+        throw new RangeError('digestInto() expects output buffer of length at least ' + min);
+    }
+    if (onlyAligned && !isAligned32(out))
+        throw new Error('invalid output, must be aligned');
+}
+/**
+ * Casts a typed-array view to Uint8Array.
+ * @param arr - Typed-array view to reinterpret.
+ * @returns Uint8Array view over the same bytes.
+ * @example
+ * Views 32-bit words as raw bytes without copying.
+ *
+ * ```ts
+ * u8(new Uint32Array([1]));
+ * ```
+ */
+function u8$1(arr) {
+    return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+/**
+ * Casts a typed-array view to Uint32Array.
+ * @param arr - Typed-array view to reinterpret.
+ * @returns Uint32Array view over the same bytes. Callers are expected to provide a
+ * 4-byte-aligned offset; trailing `1..3` bytes are silently dropped.
+ * @example
+ * Views a byte buffer as 32-bit words for block processing.
+ *
+ * ```ts
+ * u32(new Uint8Array(4));
+ * ```
+ */
+function u32(arr) {
+    return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+/**
+ * Zeroizes typed arrays in place.
+ * Warning: JS provides no guarantees.
+ * @param arrays - Arrays to wipe.
+ * @example
+ * Wipes a temporary key buffer after use.
+ *
+ * ```ts
+ * const bytes = new Uint8Array([1]);
+ * clean(bytes);
+ * ```
+ */
+function clean$1(...arrays) {
+    for (let i = 0; i < arrays.length; i++) {
+        arrays[i].fill(0);
+    }
+}
+/**
+ * Creates a DataView for byte-level manipulation.
+ * @param arr - Typed-array view to wrap.
+ * @returns DataView over the same bytes.
+ * @example
+ * Creates an endian-aware view for length encoding.
+ *
+ * ```ts
+ * createView(new Uint8Array(4));
+ * ```
+ */
+function createView$1(arr) {
+    return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+/**
+ * Whether the current platform is little-endian.
+ * Most are; some IBM systems are not.
+ */
+const isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44)();
+/**
+ * Reverses byte order of one 32-bit word.
+ * @param word - Unsigned 32-bit word to swap.
+ * @returns The same word with bytes reversed.
+ * @example
+ * Swaps a big-endian word into little-endian byte order.
+ *
+ * ```ts
+ * byteSwap(0x11223344);
+ * ```
+ */
+const byteSwap = (word) => ((word << 24) & 0xff000000) |
+    ((word << 8) & 0xff0000) |
+    ((word >>> 8) & 0xff00) |
+    ((word >>> 24) & 0xff);
+/**
+ * Normalizes one 32-bit word to the little-endian representation expected by cipher cores.
+ * @param n - Unsigned 32-bit word to normalize.
+ * @returns Little-endian normalized word on big-endian hosts, else the input word unchanged.
+ * @example
+ * Normalizes a host-endian word before passing it into an ARX/AES core.
+ *
+ * ```ts
+ * swap8IfBE(0x11223344);
+ * ```
+ */
+const swap8IfBE = isLE
+    ? (n) => n
+    : (n) => byteSwap(n) >>> 0;
+/**
+ * Byte-swaps every word of a Uint32Array in place.
+ * @param arr - Uint32Array whose words should be swapped.
+ * @returns The same array after in-place byte swapping.
+ * @example
+ * Swaps every 32-bit word in a word-view buffer.
+ *
+ * ```ts
+ * byteSwap32(new Uint32Array([0x11223344]));
+ * ```
+ */
+const byteSwap32 = (arr) => {
+    for (let i = 0; i < arr.length; i++)
+        arr[i] = byteSwap(arr[i]);
+    return arr;
+};
+/**
+ * Normalizes a Uint32Array view to the little-endian representation expected by cipher cores.
+ * @param u - Word view to normalize in place.
+ * @returns Little-endian normalized word view.
+ * @example
+ * Normalizes a word-view buffer before block processing.
+ *
+ * ```ts
+ * swap32IfBE(new Uint32Array([0x11223344]));
+ * ```
+ */
+const swap32IfBE = isLE
+    ? (u) => u
+    : byteSwap32;
+/**
+ * Compares two byte arrays in kinda constant time once lengths already match.
+ * @param a - First byte array.
+ * @param b - Second byte array.
+ * @returns `true` when the arrays contain the same bytes. Different lengths still return early.
+ * @example
+ * Compares an expected authentication tag with the received one.
+ *
+ * ```ts
+ * equalBytes(new Uint8Array([1]), new Uint8Array([1]));
+ * ```
+ */
+function equalBytes(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+/**
+ * Wraps a keyed MAC constructor into a one-shot helper with `.create()`.
+ * @param keyLen - Valid probe-key length used to read static metadata once.
+ * The probe key is only used for `outputLen` / `blockLen`, so callers with several valid key sizes
+ * can pass any representative size as long as those values stay fixed.
+ * @param macCons - Keyed MAC constructor or factory.
+ * @param fromMsg - Optional adapter that derives extra constructor args from the one-shot message.
+ * @returns Callable MAC helper with `.create()`.
+ */
+function wrapMacConstructor(keyLen, macCons, fromMsg) {
+    const mac = macCons;
+    const getArgs = (fromMsg || (() => []));
+    const macC = (msg, key) => mac(key, ...getArgs(msg))
+        .update(msg)
+        .digest();
+    const tmp = mac(new Uint8Array(keyLen), ...getArgs(new Uint8Array(0)));
+    macC.outputLen = tmp.outputLen;
+    macC.blockLen = tmp.blockLen;
+    macC.create = (key, ...args) => mac(key, ...args);
+    return macC;
+}
+/**
+ * Wraps a cipher: validates args, ensures encrypt() can only be called once.
+ * Used internally by the exported cipher constructors.
+ * Output-buffer support is inferred from the wrapped `encrypt` / `decrypt`
+ * arity (`fn.length === 2`), and tag-bearing constructors are expected to use
+ * `args[1]` for optional AAD.
+ * @__NO_SIDE_EFFECTS__
+ * @param params - Static cipher metadata. See {@link CipherParams}.
+ * @param constructor - Cipher constructor.
+ * @returns Wrapped constructor with validation.
+ */
+const wrapCipher = (params, constructor) => {
+    function wrappedCipher(key, ...args) {
+        // Validate key
+        abytes$1(key, undefined, 'key');
+        // Validate nonce if nonceLength is present
+        if (params.nonceLength !== undefined) {
+            const nonce = args[0];
+            abytes$1(nonce, params.varSizeNonce ? undefined : params.nonceLength, 'nonce');
+        }
+        // Validate AAD if tagLength present
+        const tagl = params.tagLength;
+        if (tagl && args[1] !== undefined)
+            abytes$1(args[1], undefined, 'AAD');
+        const cipher = constructor(key, ...args);
+        const checkOutput = (fnLength, output) => {
+            if (output !== undefined) {
+                if (fnLength !== 2)
+                    throw new Error('cipher output not supported');
+                abytes$1(output, undefined, 'output');
+            }
+        };
+        // Create wrapped cipher with validation and single-use encryption
+        let called = false;
+        const wrCipher = {
+            encrypt(data, output) {
+                if (called)
+                    throw new Error('cannot encrypt() twice with same key + nonce');
+                called = true;
+                abytes$1(data);
+                checkOutput(cipher.encrypt.length, output);
+                return cipher.encrypt(data, output);
+            },
+            decrypt(data, output) {
+                abytes$1(data);
+                if (tagl && data.length < tagl)
+                    throw new Error('"ciphertext" expected length bigger than tagLength=' + tagl);
+                checkOutput(cipher.decrypt.length, output);
+                return cipher.decrypt(data, output);
+            },
+        };
+        return wrCipher;
+    }
+    Object.assign(wrappedCipher, params);
+    return wrappedCipher;
+};
+/**
+ * By default, returns u8a of length.
+ * When out is available, it checks it for validity and uses it.
+ * @param expectedLength - Required output length.
+ * @param out - Optional destination buffer.
+ * @param onlyAligned - Whether `out` must be 4-byte aligned.
+ * @returns Output buffer ready for writing.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws If the provided output buffer has the wrong size or alignment. {@link Error}
+ * @example
+ * Reuses a caller-provided output buffer when lengths match.
+ *
+ * ```ts
+ * getOutput(16, new Uint8Array(16));
+ * ```
+ */
+function getOutput(expectedLength, out, onlyAligned = true) {
+    if (out === undefined)
+        return new Uint8Array(expectedLength);
+    // Keep Buffer/cross-realm Uint8Array support here instead of trusting a shape-compatible object.
+    abytes$1(out, undefined, 'output');
+    if (out.length !== expectedLength)
+        throw new Error('"output" expected Uint8Array of length ' + expectedLength + ', got: ' + out.length);
+    if (onlyAligned && !isAligned32(out))
+        throw new Error('invalid output, must be aligned');
+    return out;
+}
+/**
+ * Encodes data and AAD bit lengths into a 16-byte buffer.
+ * @param dataLength - Data length in bits.
+ * @param aadLength - AAD length in bits.
+ * The serialized block is still `aadLength || dataLength`, matching GCM/Poly1305
+ * conventions even though the helper parameter order is `(dataLength, aadLength)`.
+ * @param isLE - Whether to encode lengths as little-endian.
+ * @returns 16-byte length block.
+ * @throws On wrong argument types passed to the endian validator. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Builds the length block appended by GCM and Poly1305.
+ *
+ * ```ts
+ * u64Lengths(16, 8, true);
+ * ```
+ */
+function u64Lengths(dataLength, aadLength, isLE) {
+    // Reject coercible non-number lengths like '10' and true before BigInt(...) accepts them.
+    anumber$1(dataLength);
+    anumber$1(aadLength);
+    abool(isLE);
+    const num = new Uint8Array(16);
+    const view = createView$1(num);
+    view.setBigUint64(0, BigInt(aadLength), isLE);
+    view.setBigUint64(8, BigInt(dataLength), isLE);
+    return num;
+}
+/**
+ * Checks whether a byte array is aligned to a 4-byte offset.
+ * @param bytes - Byte array to inspect.
+ * @returns `true` when the view is 4-byte aligned.
+ * @example
+ * Checks whether a buffer can be safely viewed as Uint32Array.
+ *
+ * ```ts
+ * isAligned32(new Uint8Array(4));
+ * ```
+ */
+function isAligned32(bytes) {
+    return bytes.byteOffset % 4 === 0;
+}
+/**
+ * Copies bytes into a new Uint8Array.
+ * @param bytes - Bytes to copy.
+ * @returns Copied byte array.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Copies input into an aligned Uint8Array before block processing.
+ *
+ * ```ts
+ * copyBytes(new Uint8Array([1, 2]));
+ * ```
+ */
+function copyBytes(bytes) {
+    // `Uint8Array.from(...)` would also accept arrays / other typed arrays. Keep this helper strict
+    // because callers use it at byte-validation boundaries before mutating the detached copy.
+    return Uint8Array.from(abytes$1(bytes));
+}
+
+/**
+ * GHash from AES-GCM and its little-endian "mirror image" Polyval from AES-SIV.
+ *
+ * Implemented in terms of GHash with conversion function for keys
+ * GCM GHASH from
+ * {@link https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf | NIST SP800-38d},
+ * SIV from
+ * {@link https://www.rfc-editor.org/rfc/rfc8452 | RFC 8452}.
+ *
+ * GHASH   modulo: x^128 + x^7   + x^2   + x     + 1
+ * POLYVAL modulo: x^128 + x^127 + x^126 + x^121 + 1
+ *
+ * @module
+ */
+const BLOCK_SIZE$1 = 16;
+// TODO: rewrite
+// temporary padding buffer
+// ZEROS32 aliases these bytes, so clean(ZEROS32) also resets this shared tail-padding scratch.
+const ZEROS16 = /* @__PURE__ */ new Uint8Array(16);
+const ZEROS32 = /* @__PURE__ */ u32(ZEROS16);
+// GHASH reduces modulo x^128 + x^7 + x^2 + x + 1, so the low-degree terms
+// x^7 + x^2 + x + 1 become bits `11100001` = 0xe1 in R = 0xe1 || 0^120.
+const POLY$1 = 0xe1;
+// v = 2*v % POLY
+// NOTE: because x + x = 0 (add/sub is same), mul2(x) != x+x
+// Montgomery ladder can multiply any field element with this doubling step;
+// addition stays simple xor.
+const mul2$1 = (s0, s1, s2, s3) => {
+    const hiBit = s3 & 1;
+    return {
+        s3: (s2 << 31) | (s3 >>> 1),
+        s2: (s1 << 31) | (s2 >>> 1),
+        s1: (s0 << 31) | (s1 >>> 1),
+        // NIST SP 800-38D §6.3 applies `V >> 1` and XORs R on carry. In this
+        // 4x32-bit split, R = 0xe1 || 0^120 lives in the top byte of s0.
+        s0: (s0 >>> 1) ^ ((POLY$1 << 24) & -(hiBit & 1)), // reduce % poly
+    };
+};
+// Per-word part of RFC 8452 `ByteReverse`; callers also reverse the 32-bit word order.
+const swapLE = (n) => (((n >>> 0) & 0xff) << 24) |
+    (((n >>> 8) & 0xff) << 16) |
+    (((n >>> 16) & 0xff) << 8) |
+    ((n >>> 24) & 0xff) |
+    0;
+// Precompute-window heuristic only: larger inputs trade memory for fewer table lookups.
+// Any caller-provided length hint still collapses to one of the supported windows {2, 4, 8}.
+const estimateWindow = (bytes) => {
+    if (bytes > 64 * 1024)
+        return 8;
+    if (bytes > 1024)
+        return 4;
+    return 2;
+};
+/**
+ * Incremental GHASH state for AES-GCM.
+ * @param key - 16-byte GHASH key.
+ * @param expectedLength - Expected message length for table sizing.
+ * Chunking is segment-based, not hash-streaming: every `update()` call is zero-padded
+ * to the next 16-byte boundary before it is absorbed. This matches the internal AES/GCM
+ * use where AAD, payload, and length block are separate padded segments.
+ * @example
+ * Feeds one ciphertext block into an incremental GHASH state with a fresh hash key.
+ *
+ * ```ts
+ * import { GHASH } from '@noble/ciphers/_polyval.js';
+ * import { randomBytes } from '@noble/ciphers/utils.js';
+ * const key = randomBytes(16);
+ * const mac = new GHASH(key);
+ * mac.update(new Uint8Array(16));
+ * mac.digest();
+ * ```
+ */
+class GHASH {
+    blockLen = BLOCK_SIZE$1;
+    outputLen = BLOCK_SIZE$1;
+    s0 = 0;
+    s1 = 0;
+    s2 = 0;
+    s3 = 0;
+    finished = false;
+    destroyed = false;
+    t;
+    W;
+    windowSize;
+    // We select bits per window adaptively based on expectedLength
+    constructor(key, expectedLength) {
+        abytes$1(key, 16, 'key');
+        key = copyBytes(key);
+        const kView = createView$1(key);
+        let k0 = kView.getUint32(0, false);
+        let k1 = kView.getUint32(4, false);
+        let k2 = kView.getUint32(8, false);
+        let k3 = kView.getUint32(12, false);
+        // generate table of doubled keys (half of montgomery ladder)
+        const doubles = [];
+        for (let i = 0; i < 128; i++) {
+            doubles.push({ s0: swapLE(k0), s1: swapLE(k1), s2: swapLE(k2), s3: swapLE(k3) });
+            ({ s0: k0, s1: k1, s2: k2, s3: k3 } = mul2$1(k0, k1, k2, k3));
+        }
+        const W = estimateWindow(expectedLength || 1024);
+        if (![1, 2, 4, 8].includes(W))
+            throw new Error('ghash: invalid window size, expected 2, 4 or 8');
+        this.W = W;
+        const bits = 128; // always 128 bits;
+        const windows = bits / W;
+        const windowSize = (this.windowSize = 2 ** W);
+        const items = [];
+        // Create precompute table for window of W bits
+        for (let w = 0; w < windows; w++) {
+            // truth table: 00, 01, 10, 11
+            for (let byte = 0; byte < windowSize; byte++) {
+                // prettier-ignore
+                let s0 = 0, s1 = 0, s2 = 0, s3 = 0;
+                for (let j = 0; j < W; j++) {
+                    const bit = (byte >>> (W - j - 1)) & 1;
+                    if (!bit)
+                        continue;
+                    const { s0: d0, s1: d1, s2: d2, s3: d3 } = doubles[W * w + j];
+                    ((s0 ^= d0), (s1 ^= d1), (s2 ^= d2), (s3 ^= d3));
+                }
+                items.push({ s0, s1, s2, s3 });
+            }
+        }
+        this.t = items;
+    }
+    _updateBlock(s0, s1, s2, s3) {
+        ((s0 ^= this.s0), (s1 ^= this.s1), (s2 ^= this.s2), (s3 ^= this.s3));
+        const { W, t, windowSize } = this;
+        // prettier-ignore
+        let o0 = 0, o1 = 0, o2 = 0, o3 = 0;
+        const mask = (1 << W) - 1; // 2**W will kill performance.
+        let w = 0;
+        // NIST SP 800-38D §6.3 interprets blocks as little-endian polynomials,
+        // so the lookup walk consumes each word byte-by-byte from
+        // least-significant to most-significant bits.
+        for (const num of [s0, s1, s2, s3]) {
+            for (let bytePos = 0; bytePos < 4; bytePos++) {
+                const byte = (num >>> (8 * bytePos)) & 0xff;
+                for (let bitPos = 8 / W - 1; bitPos >= 0; bitPos--) {
+                    const bit = (byte >>> (W * bitPos)) & mask;
+                    const { s0: e0, s1: e1, s2: e2, s3: e3 } = t[w * windowSize + bit];
+                    ((o0 ^= e0), (o1 ^= e1), (o2 ^= e2), (o3 ^= e3));
+                    w += 1;
+                }
+            }
+        }
+        this.s0 = o0;
+        this.s1 = o1;
+        this.s2 = o2;
+        this.s3 = o3;
+    }
+    update(data) {
+        aexists$1(this);
+        abytes$1(data);
+        data = copyBytes(data);
+        const b32 = u32(data);
+        const blocks = Math.floor(data.length / BLOCK_SIZE$1);
+        const left = data.length % BLOCK_SIZE$1;
+        for (let i = 0; i < blocks; i++) {
+            this._updateBlock(swap8IfBE(b32[i * 4 + 0]), swap8IfBE(b32[i * 4 + 1]), swap8IfBE(b32[i * 4 + 2]), swap8IfBE(b32[i * 4 + 3]));
+        }
+        if (left) {
+            ZEROS16.set(data.subarray(blocks * BLOCK_SIZE$1));
+            // Tail blocks go through the shared ZEROS32 scratch, so they need the same host-endian
+            // normalization as full blocks; otherwise segmented GHASH/POLYVAL updates diverge on BE.
+            this._updateBlock(swap8IfBE(ZEROS32[0]), swap8IfBE(ZEROS32[1]), swap8IfBE(ZEROS32[2]), swap8IfBE(ZEROS32[3]));
+            clean$1(ZEROS32); // clean tmp buffer
+        }
+        return this;
+    }
+    destroy() {
+        // `aexists(this)` guards update/digest paths, so destroy must mark the instance unusable too.
+        this.destroyed = true;
+        const { t } = this;
+        // Wipe the key-derived precompute table; scalar accumulator words remain,
+        // but the destroyed guard blocks further use.
+        // clean precompute table
+        for (const elm of t) {
+            ((elm.s0 = 0), (elm.s1 = 0), (elm.s2 = 0), (elm.s3 = 0));
+        }
+    }
+    digestInto(out) {
+        aexists$1(this);
+        // `digestInto(out)` is the no-allocation fast path, so callers must pass a
+        // 32-bit-aligned buffer before we reinterpret it with `u32(out)`.
+        aoutput$1(out, this, true);
+        this.finished = true;
+        // NIST SP 800-38D §6.4 returns the final 128-bit block Y_m.
+        // `digestInto()` follows the relaxed `aoutput()` contract, so only
+        // out[0..15] may be touched.
+        const { s0, s1, s2, s3 } = this;
+        const o32 = u32(out);
+        o32[0] = s0;
+        o32[1] = s1;
+        o32[2] = s2;
+        o32[3] = s3;
+        swap32IfBE(o32);
+    }
+    digest() {
+        const res = new Uint8Array(BLOCK_SIZE$1);
+        this.digestInto(res);
+        // `res` is independent of internal state, so it stays valid after destroy() wipes the table.
+        this.destroy();
+        return res;
+    }
+}
+/**
+ * GHash MAC for AES-GCM.
+ * @param msg - Message bytes to authenticate.
+ * @param key - 16-byte GHASH key.
+ * @returns 16-byte authentication tag.
+ * @example
+ * Authenticates a short message with GHASH and a fresh hash key.
+ *
+ * ```ts
+ * import { ghash } from '@noble/ciphers/_polyval.js';
+ * import { randomBytes } from '@noble/ciphers/utils.js';
+ * const key = randomBytes(16);
+ * ghash(new Uint8Array(), key);
+ * ```
+ */
+const ghash = 
+/* @__PURE__ */ wrapMacConstructor(16, (key, expectedLength) => new GHASH(key, expectedLength), (msg) => [msg.length]);
+
+/**
+ * {@link https://en.wikipedia.org/wiki/Advanced_Encryption_Standard | AES}
+ * a.k.a. Advanced Encryption Standard
+ * is a variant of Rijndael block cipher, standardized by NIST in 2001.
+ * We provide the fastest available pure JS implementation.
+ *
+ * `cipher = encrypt(block, key)`
+ *
+ * Data is split into 128-bit blocks.
+ * Encrypted in 10/12/14 rounds (128/192/256 bits). In every round:
+ * 1. **S-box**, table substitution
+ * 2. **Shift rows**, cyclic shift left of all rows of data array
+ * 3. **Mix columns**, multiplying every column by fixed polynomial
+ * 4. **Add round key**, round_key xor i-th column of array
+ *
+ * Check out
+ * {@link https://csrc.nist.gov/files/pubs/fips/197/final/docs/fips-197.pdf | FIPS-197},
+ * {@link https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38G.pdf | NIST 800-38G},
+ * and {@link https://csrc.nist.gov/csrc/media/projects/cryptographic-standards-and-guidelines/documents/aes-development/rijndael-ammended.pdf | original proposal}.
+ * @module
+ */
+const BLOCK_SIZE = 16;
+// AES operates on 16-byte blocks, i.e. 4 32-bit words.
+const BLOCK_SIZE32 = 4;
+// Shared zero block (`0^128`) used by GCM's `H = CIPH_K(0^128)` / J0 scratch
+// and by CMAC / SIV helpers; callers take `.slice()` before mutating it.
+const EMPTY_BLOCK = /* @__PURE__ */ new Uint8Array(BLOCK_SIZE);
+const POLY = 0x11b; // 1 + x + x**3 + x**4 + x**8
+// Validates plain AES key sizes only; AES-SIV's doubled-key contract is checked elsewhere.
+function validateKeyLength(key) {
+    if (![16, 24, 32].includes(key.length))
+        throw new Error('"aes key" expected Uint8Array of length 16/24/32, got length=' + key.length);
+}
+// TODO: remove multiplication, binary ops only
+// Doubles one GF(2^8) field element; callers are expected to stay in byte range.
+// FIPS 197 upd1 §4.3 equation (4.5): XTIMES(b) left-shifts by one and, when
+// b7=1, reduces by m(x); using POLY=0x11b here yields the same byte result
+// as XORing with {1b} after the shift.
+function mul2(n) {
+    return (n << 1) ^ (POLY & -(n >> 7));
+}
+// Shift-and-add multiplication in GF(2^8); callers are expected to pass byte values.
+// FIPS 197 upd1 §4.3 equation (4.7): general products are XORs of repeated
+// XTIMES() multiples, e.g. {57}•{13} = {57}⊕{ae}⊕{07}.
+function mul(a, b) {
+    let res = 0;
+    for (; b > 0; b >>= 1) {
+        // Usual shift-and-add step in GF(2^8), not a scalar-multiplication ladder.
+        res ^= a & -(b & 1); // if (b&1) res ^=a (but const-time).
+        a = mul2(a); // a = 2*a
+    }
+    return res;
+}
+// AES S-box is generated using finite field inversion,
+// an affine transform, and xor of a constant 0x63.
+const sbox = /* @__PURE__ */ (() => {
+    const t = new Uint8Array(256);
+    // Repeated multiplication by {03} walks all 255 nonzero field elements
+    // once, so t[255 - i] is the multiplicative inverse of t[i] for the
+    // affine step.
+    for (let i = 0, x = 1; i < 256; i++, x ^= mul2(x))
+        t[i] = x;
+    const box = new Uint8Array(256);
+    // FIPS 197 upd1 §5.1.1: SBOX({00}) = {63} because the inverse step leaves
+    // {00} at {00}, then the affine transform xors in c = {63}.
+    box[0] = 0x63;
+    for (let i = 0; i < 255; i++) {
+        let x = t[255 - i];
+        x |= x << 8;
+        box[t[i]] = (x ^ (x >> 4) ^ (x >> 5) ^ (x >> 6) ^ (x >> 7) ^ 0x63) & 0xff;
+    }
+    clean$1(t);
+    return box;
+})();
+// FIPS 197 upd1 §5.2: ROTWORD([a0,a1,a2,a3]) = [a1,a2,a3,a0]; with this LE
+// word packing that is a right rotate by 8 bits.
+const rotr32_8 = (n) => (n << 24) | (n >>> 8);
+// LE T-table helper: rotates one precomputed word by one byte so T1/T2/T3
+// reuse T0's substitution/mix result in the other byte lanes.
+const rotl32_8 = (n) => (n << 8) | (n >>> 24);
+// T-table is optimization suggested in 5.2 of original proposal (missed from FIPS-197). Changes:
+// - LE instead of BE
+// - bigger tables: T0 and T1 are merged into T01 table and T2 & T3 into T23;
+//   so index is u16, instead of u8. This speeds up things, unexpectedly
+function genTtable(sbox, fn) {
+    if (sbox.length !== 256)
+        throw new Error('Wrong sbox length');
+    const T0 = new Uint32Array(256).map((_, j) => fn(sbox[j]));
+    const T1 = T0.map(rotl32_8);
+    const T2 = T1.map(rotl32_8);
+    const T3 = T2.map(rotl32_8);
+    // Pre-xor adjacent lanes so apply0123/applySbox can fetch two substituted
+    // byte lanes per lookup in the LE round layout.
+    const T01 = new Uint32Array(256 * 256);
+    const T23 = new Uint32Array(256 * 256);
+    const sbox2 = new Uint16Array(256 * 256);
+    for (let i = 0; i < 256; i++) {
+        for (let j = 0; j < 256; j++) {
+            const idx = i * 256 + j;
+            T01[idx] = T0[i] ^ T1[j];
+            T23[idx] = T2[i] ^ T3[j];
+            sbox2[idx] = (sbox[i] << 8) | sbox[j];
+        }
+    }
+    return { sbox, sbox2, T0, T1, T2, T3, T01, T23 };
+}
+// Forward round precompute: the packed word stores the MIXCOLUMNS row
+// [{02},{01},{01},{03}] in LE byte-lane order, and the returned `sbox2`
+// is also reused by key expansion and the final round.
+const tableEncoding = /* @__PURE__ */ genTtable(sbox, (s) => (mul(s, 3) << 24) | (s << 16) | (s << 8) | mul(s, 2));
+// FIPS 197 upd1 §5.2 Table 5: left-most bytes of Rcon[j] = x^(j-1), generated by repeated XTIMES().
+const xPowers = /* @__PURE__ */ (() => {
+    const p = new Uint8Array(16);
+    for (let i = 0, x = 1; i < 16; i++, x = mul2(x))
+        p[i] = x;
+    return p;
+})();
+/** Forward AES key expansion used across ECB/CBC/CTR/GCM/CMAC/KW-style paths. */
+function expandKeyLE(key) {
+    abytes$1(key);
+    const len = key.length;
+    validateKeyLength(key);
+    const { sbox2 } = tableEncoding;
+    const toClean = [];
+    // Copy on BE or misaligned inputs so the LE word normalization below never
+    // mutates caller key bytes in place.
+    if (!isLE || !isAligned32(key))
+        toClean.push((key = copyBytes(key)));
+    const k32 = swap32IfBE(u32(key));
+    const Nk = k32.length;
+    // `applySbox` normally reads one byte lane from each argument; repeating
+    // `n` across all four lanes turns it into SUBWORD(n).
+    const subByte = (n) => applySbox(sbox2, n, n, n, n);
+    // AES key sizes are 16/24/32 bytes, so len + 28 yields the 44/52/60
+    // schedule words from FIPS 197 §5.2 / Table 3.
+    const xk = new Uint32Array(len + 28); // expanded key
+    xk.set(k32);
+    // 4.3.1 Key expansion
+    for (let i = Nk; i < xk.length; i++) {
+        let t = xk[i - 1];
+        if (i % Nk === 0)
+            t = subByte(rotr32_8(t)) ^ xPowers[i / Nk - 1];
+        else if (Nk > 6 && i % Nk === 4)
+            t = subByte(t);
+        xk[i] = xk[i - Nk] ^ t;
+    }
+    clean$1(...toClean);
+    return xk;
+}
+// Apply tables
+function apply0123(T01, T23, s0, s1, s2, s3) {
+    // `T01` takes the low byte lane from `s0` plus the next lane from `s1`;
+    // `T23` does the same for `s2`/`s3`.
+    // Equivalent to `T0[s0&0xff] ^ T1[(s1>>>8)&0xff] ^ T2[(s2>>>16)&0xff] ^
+    // T3[s3>>>24]`, but with two merged-table fetches.
+    return (T01[((s0 << 8) & 0xff00) | ((s1 >>> 8) & 0xff)] ^
+        T23[((s2 >>> 8) & 0xff00) | ((s3 >>> 24) & 0xff)]);
+}
+function applySbox(sbox2, s0, s1, s2, s3) {
+    // `sbox2` packs two substituted byte lanes at a time in the same LE
+    // layout used by the round code.
+    // Equivalent to `SBOX(byte0(s0)) | SBOX(byte1(s1))<<8 |
+    // SBOX(byte2(s2))<<16 | SBOX(byte3(s3))<<24`.
+    return (sbox2[(s0 & 0xff) | (s1 & 0xff00)] |
+        (sbox2[((s2 >>> 16) & 0xff) | ((s3 >>> 16) & 0xff00)] << 16));
+}
+function encrypt(xk, s0, s1, s2, s3) {
+    const { sbox2, T01, T23 } = tableEncoding;
+    let k = 0;
+    ((s0 ^= xk[k++]), (s1 ^= xk[k++]), (s2 ^= xk[k++]), (s3 ^= xk[k++]));
+    // `xk` has Nr+1 round-key blocks, so after the initial AddRoundKey and the
+    // final S-box-only round there are Nr-1 full table/MixColumns rounds left.
+    const rounds = xk.length / 4 - 2;
+    for (let i = 0; i < rounds; i++) {
+        const t0 = xk[k++] ^ apply0123(T01, T23, s0, s1, s2, s3);
+        const t1 = xk[k++] ^ apply0123(T01, T23, s1, s2, s3, s0);
+        const t2 = xk[k++] ^ apply0123(T01, T23, s2, s3, s0, s1);
+        const t3 = xk[k++] ^ apply0123(T01, T23, s3, s0, s1, s2);
+        ((s0 = t0), (s1 = t1), (s2 = t2), (s3 = t3));
+    }
+    // last round (without mixcolumns, so using SBOX2 table)
+    const t0 = xk[k++] ^ applySbox(sbox2, s0, s1, s2, s3);
+    const t1 = xk[k++] ^ applySbox(sbox2, s1, s2, s3, s0);
+    const t2 = xk[k++] ^ applySbox(sbox2, s2, s3, s0, s1);
+    const t3 = xk[k++] ^ applySbox(sbox2, s3, s0, s1, s2);
+    return { s0: t0, s1: t1, s2: t2, s3: t3 };
+}
+// AES CTR with overflowing 32 bit counter
+// It's possible to do 32le significantly simpler (and probably faster) by using u32.
+// But, we need both, and perf bottleneck is in ghash anyway.
+// Unsafe 32-bit CTR helper: mutates `nonce` in place, expects aligned `src`/`dst`,
+// and uses `isLE` to choose which 32-bit counter word is incremented.
+function ctr32(xk, isLE, nonce, src, dst) {
+    abytes$1(nonce, BLOCK_SIZE, 'nonce');
+    abytes$1(src);
+    dst = getOutput(src.length, dst);
+    const ctr = nonce; // write new value to nonce, so it can be re-used
+    const c32 = u32(ctr);
+    const view = createView$1(ctr);
+    const src32 = u32(src);
+    const dst32 = u32(dst);
+    // NIST SP 800-38D GCTR increments the rightmost 32 bits of J0, while
+    // RFC 8452 AES-GCM-SIV increments the first 32 bits as a little-endian u32.
+    const ctrPos = isLE ? 0 : 12;
+    const srcLen = src.length;
+    // Fill block (empty, ctr=0)
+    let ctrNum = view.getUint32(ctrPos, isLE); // read current counter value
+    let { s0, s1, s2, s3 } = encrypt(xk, swap8IfBE(c32[0]), swap8IfBE(c32[1]), swap8IfBE(c32[2]), swap8IfBE(c32[3]));
+    // process blocks
+    for (let i = 0; i + 4 <= src32.length; i += 4) {
+        dst32[i + 0] = src32[i + 0] ^ swap8IfBE(s0);
+        dst32[i + 1] = src32[i + 1] ^ swap8IfBE(s1);
+        dst32[i + 2] = src32[i + 2] ^ swap8IfBE(s2);
+        dst32[i + 3] = src32[i + 3] ^ swap8IfBE(s3);
+        ctrNum = (ctrNum + 1) >>> 0; // u32 wrap
+        view.setUint32(ctrPos, ctrNum, isLE);
+        ({ s0, s1, s2, s3 } = encrypt(xk, swap8IfBE(c32[0]), swap8IfBE(c32[1]), swap8IfBE(c32[2]), swap8IfBE(c32[3])));
+    }
+    // leftovers (less than a block)
+    const start = BLOCK_SIZE * Math.floor(src32.length / BLOCK_SIZE32);
+    if (start < srcLen) {
+        const b32 = new Uint32Array([s0, s1, s2, s3]);
+        swap32IfBE(b32);
+        const buf = u8$1(b32);
+        for (let i = start, pos = 0; i < srcLen; i++, pos++)
+            dst[i] = src[i] ^ buf[pos];
+        clean$1(b32);
+    }
+    // Same unsafe contract as ctrCounter(): only full blocks advance the stored
+    // mutable counter state; partial-block continuation is caller-managed.
+    return dst;
+}
+// TODO: merge with chacha, however gcm has bitLen while chacha has byteLen
+// `data` is the payload covered by the polynomial MAC: ciphertext for GCM,
+// plaintext for GCM-SIV. Keep AAD/data/length as separate updates because
+// GHASH/POLYVAL pad each call to block boundaries, so the chunks must match the
+// spec-defined segments instead of arbitrary concatenation boundaries.
+function computeTag(fn, isLE, key, data, AAD) {
+    const aadLength = AAD ? AAD.length : 0;
+    const h = fn.create(key, data.length + aadLength);
+    if (AAD)
+        h.update(AAD);
+    // u64Lengths() takes (dataBits, aadBits) but still serializes the final
+    // block as len(AAD) || len(data), matching both GCM and GCM-SIV.
+    const num = u64Lengths(8 * data.length, 8 * aadLength, isLE);
+    h.update(data);
+    h.update(num);
+    const res = h.digest();
+    clean$1(num);
+    return res;
+}
+/**
+ * **GCM** (Galois/Counter Mode): Combines CTR mode with polynomial MAC. Efficient and widely used.
+ * Not perfect:
+ * a) conservative key wear-out is `2**32` (4B) msgs.
+ * b) key wear-out under random nonces is even smaller: `2**23` (8M) messages for `2**-50` chance.
+ * c) MAC can be forged: see Poly1305 documentation.
+ * @param key - AES key bytes.
+ * @param nonce - Nonce bytes (12 recommended, minimum 8; other lengths use GHASH J0 derivation).
+ * @param AAD - Additional authenticated data.
+ * @returns AEAD cipher instance with a fixed 16-byte tag.
+ * @example
+ * Encrypts and authenticates plaintext with a fresh key and 12-byte nonce.
+ *
+ * ```ts
+ * import { gcm } from '@noble/ciphers/aes.js';
+ * import { randomBytes } from '@noble/ciphers/utils.js';
+ * const key = randomBytes(16);
+ * const nonce = randomBytes(12);
+ * const cipher = gcm(key, nonce);
+ * cipher.encrypt(new Uint8Array([1, 2, 3]));
+ * ```
+ */
+const gcm = /* @__PURE__ */ wrapCipher({ blockSize: 16, nonceLength: 12, tagLength: 16, varSizeNonce: true }, function aesgcm(key, nonce, AAD) {
+    // SP 800-38D lets implementations narrow supported IV lengths.
+    // This wrapper intentionally requires at least 8 bytes; OpenSSL accepts shorter IVs too.
+    // 12-byte nonces take the fast path; other allowed lengths use GHASH to derive J0.
+    if (nonce.length < 8)
+        throw new Error('aes/gcm: invalid nonce length');
+    const tagLength = 16;
+    function _computeTag(authKey, tagMask, data) {
+        const tag = computeTag(ghash, false, authKey, data, AAD);
+        for (let i = 0; i < tagMask.length; i++)
+            tag[i] ^= tagMask[i];
+        return tag;
+    }
+    function deriveKeys() {
+        const xk = expandKeyLE(key);
+        const authKey = EMPTY_BLOCK.slice();
+        const counter = EMPTY_BLOCK.slice();
+        ctr32(xk, false, counter, counter, authKey);
+        // NIST 800-38d, page 15: different behavior for 96-bit and non-96-bit nonces
+        if (nonce.length === 12) {
+            counter.set(nonce);
+        }
+        else {
+            const nonceLen = EMPTY_BLOCK.slice();
+            const view = createView$1(nonceLen);
+            view.setBigUint64(8, BigInt(nonce.length * 8), false);
+            // GHASH.update() pads each call to 16 bytes, so
+            // update(nonce).update(nonceLen) realizes
+            // IV || 0^s || 0^64 || [len(IV)]_64 for non-96-bit nonces.
+            // ghash(nonce || u64be(0) || u64be(nonceLen*8))
+            const g = ghash.create(authKey).update(nonce).update(nonceLen);
+            g.digestInto(counter); // digestInto doesn't trigger '.destroy'
+            g.destroy();
+        }
+        // GCTR_K(J0, 0^128) = E_K(J0); reusing ctr32() here extracts that tag
+        // mask and leaves `counter` advanced to inc32(J0) for payload GCTR.
+        const tagMask = ctr32(xk, false, counter, EMPTY_BLOCK);
+        return { xk, authKey, counter, tagMask };
+    }
+    return {
+        encrypt(plaintext) {
+            const { xk, authKey, counter, tagMask } = deriveKeys();
+            const out = new Uint8Array(plaintext.length + tagLength);
+            const toClean = [xk, authKey, counter, tagMask];
+            if (!isAligned32(plaintext))
+                toClean.push((plaintext = copyBytes(plaintext)));
+            ctr32(xk, false, counter, plaintext, out.subarray(0, plaintext.length));
+            const tag = _computeTag(authKey, tagMask, out.subarray(0, out.length - tagLength));
+            toClean.push(tag);
+            out.set(tag, plaintext.length);
+            clean$1(...toClean);
+            return out;
+        },
+        decrypt(ciphertext) {
+            const { xk, authKey, counter, tagMask } = deriveKeys();
+            const toClean = [xk, authKey, tagMask, counter];
+            if (!isAligned32(ciphertext))
+                toClean.push((ciphertext = copyBytes(ciphertext)));
+            const data = ciphertext.subarray(0, -tagLength);
+            const passedTag = ciphertext.subarray(-tagLength);
+            const tag = _computeTag(authKey, tagMask, data);
+            toClean.push(tag);
+            // NIST SP 800-38D §7.2 permits equivalent step orderings; verify the
+            // tag before CTR so unauthenticated plaintext is never materialized.
+            if (!equalBytes(tag, passedTag)) {
+                clean$1(...toClean);
+                throw new Error('aes/gcm: invalid ghash tag');
+            }
+            const out = ctr32(xk, false, counter, data);
+            clean$1(...toClean);
+            return out;
+        },
+    };
+});
+
+/**
+ * Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.
+ * @param a - value to test
+ * @returns `true` when the value is a Uint8Array-compatible view.
+ * @example
+ * Check whether a value is a Uint8Array-compatible view.
+ * ```ts
+ * isBytes(new Uint8Array([1, 2, 3]));
+ * ```
+ */
+function isBytes(a) {
+    // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases.
+    // The fallback still requires a real ArrayBuffer view, so plain
+    // JSON-deserialized `{ constructor: ... }` spoofing is rejected, and
+    // `BYTES_PER_ELEMENT === 1` keeps the fallback on byte-oriented views.
+    return (a instanceof Uint8Array ||
+        (ArrayBuffer.isView(a) &&
+            a.constructor.name === 'Uint8Array' &&
+            'BYTES_PER_ELEMENT' in a &&
+            a.BYTES_PER_ELEMENT === 1));
+}
+/**
+ * Asserts something is a non-negative integer.
+ * @param n - number to validate
+ * @param title - label included in thrown errors
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Validate a non-negative integer option.
+ * ```ts
+ * anumber(32, 'length');
+ * ```
+ */
+function anumber(n, title = '') {
+    if (typeof n !== 'number') {
+        const prefix = title && `"${title}" `;
+        throw new TypeError(`${prefix}expected number, got ${typeof n}`);
+    }
+    if (!Number.isSafeInteger(n) || n < 0) {
+        const prefix = title && `"${title}" `;
+        throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);
+    }
+}
+/**
+ * Asserts something is Uint8Array.
+ * @param value - value to validate
+ * @param length - optional exact length constraint
+ * @param title - label included in thrown errors
+ * @returns The validated byte array.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Validate that a value is a byte array.
+ * ```ts
+ * abytes(new Uint8Array([1, 2, 3]));
+ * ```
+ */
+function abytes(value, length, title = '') {
+    const bytes = isBytes(value);
+    const len = value?.length;
+    const needsLen = length !== undefined;
+    if (!bytes || (needsLen && len !== length)) {
+        const prefix = title && `"${title}" `;
+        const ofLen = needsLen ? ` of length ${length}` : '';
+        const got = bytes ? `length=${len}` : `type=${typeof value}`;
+        const message = prefix + 'expected Uint8Array' + ofLen + ', got ' + got;
+        if (!bytes)
+            throw new TypeError(message);
+        throw new RangeError(message);
+    }
+    return value;
+}
+/**
+ * Asserts something is a wrapped hash constructor.
+ * @param h - hash constructor to validate
+ * @throws On wrong argument types or invalid hash wrapper shape. {@link TypeError}
+ * @throws On invalid hash metadata ranges or values. {@link RangeError}
+ * @throws If the hash metadata allows empty outputs or block sizes. {@link Error}
+ * @example
+ * Validate a callable hash wrapper.
+ * ```ts
+ * import { ahash } from '@noble/hashes/utils.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * ahash(sha256);
+ * ```
+ */
+function ahash(h) {
+    if (typeof h !== 'function' || typeof h.create !== 'function')
+        throw new TypeError('Hash must wrapped by utils.createHasher');
+    anumber(h.outputLen);
+    anumber(h.blockLen);
+    // HMAC and KDF callers treat these as real byte lengths; allowing zero lets fake wrappers pass
+    // validation and can produce empty outputs instead of failing fast.
+    if (h.outputLen < 1)
+        throw new Error('"outputLen" must be >= 1');
+    if (h.blockLen < 1)
+        throw new Error('"blockLen" must be >= 1');
+}
+/**
+ * Asserts a hash instance has not been destroyed or finished.
+ * @param instance - hash instance to validate
+ * @param checkFinished - whether to reject finalized instances
+ * @throws If the hash instance has already been destroyed or finalized. {@link Error}
+ * @example
+ * Validate that a hash instance is still usable.
+ * ```ts
+ * import { aexists } from '@noble/hashes/utils.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * const hash = sha256.create();
+ * aexists(hash);
+ * ```
+ */
+function aexists(instance, checkFinished = true) {
+    if (instance.destroyed)
+        throw new Error('Hash instance has been destroyed');
+    if (checkFinished && instance.finished)
+        throw new Error('Hash#digest() has already been called');
+}
+/**
+ * Asserts output is a sufficiently-sized byte array.
+ * @param out - destination buffer
+ * @param instance - hash instance providing output length
+ * Oversized buffers are allowed; downstream code only promises to fill the first `outputLen` bytes.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Validate a caller-provided digest buffer.
+ * ```ts
+ * import { aoutput } from '@noble/hashes/utils.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * const hash = sha256.create();
+ * aoutput(new Uint8Array(hash.outputLen), hash);
+ * ```
+ */
+function aoutput(out, instance) {
+    abytes(out, undefined, 'digestInto() output');
+    const min = instance.outputLen;
+    if (out.length < min) {
+        throw new RangeError('"digestInto() output" expected to be of length >=' + min);
+    }
+}
+/**
+ * Zeroizes typed arrays in place. Warning: JS provides no guarantees.
+ * @param arrays - arrays to overwrite with zeros
+ * @example
+ * Zeroize sensitive buffers in place.
+ * ```ts
+ * clean(new Uint8Array([1, 2, 3]));
+ * ```
+ */
+function clean(...arrays) {
+    for (let i = 0; i < arrays.length; i++) {
+        arrays[i].fill(0);
+    }
+}
+/**
+ * Creates a DataView for byte-level manipulation.
+ * @param arr - source typed array
+ * @returns DataView over the same buffer region.
+ * @example
+ * Create a DataView over an existing buffer.
+ * ```ts
+ * createView(new Uint8Array(4));
+ * ```
+ */
+function createView(arr) {
+    return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+/**
+ * Rotate-right operation for uint32 values.
+ * @param word - source word
+ * @param shift - shift amount in bits
+ * @returns Rotated word.
+ * @example
+ * Rotate a 32-bit word to the right.
+ * ```ts
+ * rotr(0x12345678, 8);
+ * ```
+ */
+function rotr(word, shift) {
+    return (word << (32 - shift)) | (word >>> shift);
+}
+/**
+ * Creates a callable hash function from a stateful class constructor.
+ * @param hashCons - hash constructor or factory
+ * @param info - optional metadata such as DER OID
+ * @returns Frozen callable hash wrapper with `.create()`.
+ *   Wrapper construction eagerly calls `hashCons(undefined)` once to read
+ *   `outputLen` / `blockLen`, so constructor side effects happen at module
+ *   init time.
+ * @example
+ * Wrap a stateful hash constructor into a callable helper.
+ * ```ts
+ * import { createHasher } from '@noble/hashes/utils.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * const wrapped = createHasher(sha256.create, { oid: sha256.oid });
+ * wrapped(new Uint8Array([1]));
+ * ```
+ */
+function createHasher(hashCons, info = {}) {
+    const hashC = (msg, opts) => hashCons(opts)
+        .update(msg)
+        .digest();
+    const tmp = hashCons(undefined);
+    hashC.outputLen = tmp.outputLen;
+    hashC.blockLen = tmp.blockLen;
+    hashC.canXOF = tmp.canXOF;
+    hashC.create = (opts) => hashCons(opts);
+    Object.assign(hashC, info);
+    return Object.freeze(hashC);
+}
+/**
+ * Creates OID metadata for NIST hashes with prefix `06 09 60 86 48 01 65 03 04 02`.
+ * @param suffix - final OID byte for the selected hash.
+ *   The helper accepts any byte even though only the documented NIST hash
+ *   suffixes are meaningful downstream.
+ * @returns Object containing the DER-encoded OID.
+ * @example
+ * Build OID metadata for a NIST hash.
+ * ```ts
+ * oidNist(0x01);
+ * ```
+ */
+const oidNist = (suffix) => ({
+    // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+    // Larger suffix values would need base-128 OID encoding and a different length byte.
+    oid: Uint8Array.from([0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, suffix]),
+});
+
+/**
+ * HMAC: RFC2104 message authentication code.
+ * @module
+ */
+/**
+ * Internal class for HMAC.
+ * Accepts any byte key, although RFC 2104 §3 recommends keys at least
+ * `HashLen` bytes long.
+ */
+class _HMAC {
+    oHash;
+    iHash;
+    blockLen;
+    outputLen;
+    canXOF = false;
+    finished = false;
+    destroyed = false;
+    constructor(hash, key) {
+        ahash(hash);
+        abytes(key, undefined, 'key');
+        this.iHash = hash.create();
+        if (typeof this.iHash.update !== 'function')
+            throw new Error('Expected instance of class which extends utils.Hash');
+        this.blockLen = this.iHash.blockLen;
+        this.outputLen = this.iHash.outputLen;
+        const blockLen = this.blockLen;
+        const pad = new Uint8Array(blockLen);
+        // blockLen can be bigger than outputLen
+        pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+        for (let i = 0; i < pad.length; i++)
+            pad[i] ^= 0x36;
+        this.iHash.update(pad);
+        // By doing update (processing of the first block) of the outer hash here,
+        // we can re-use it between multiple calls via clone.
+        this.oHash = hash.create();
+        // Undo internal XOR && apply outer XOR
+        for (let i = 0; i < pad.length; i++)
+            pad[i] ^= 0x36 ^ 0x5c;
+        this.oHash.update(pad);
+        clean(pad);
+    }
+    update(buf) {
+        aexists(this);
+        this.iHash.update(buf);
+        return this;
+    }
+    digestInto(out) {
+        aexists(this);
+        aoutput(out, this);
+        this.finished = true;
+        const buf = out.subarray(0, this.outputLen);
+        // Reuse the first outputLen bytes for the inner digest; the outer hash consumes them before
+        // overwriting that same prefix with the final tag, leaving any oversized tail untouched.
+        this.iHash.digestInto(buf);
+        this.oHash.update(buf);
+        this.oHash.digestInto(buf);
+        this.destroy();
+    }
+    digest() {
+        const out = new Uint8Array(this.oHash.outputLen);
+        this.digestInto(out);
+        return out;
+    }
+    _cloneInto(to) {
+        // Create new instance without calling constructor since the key
+        // is already in state and we don't know it.
+        to ||= Object.create(Object.getPrototypeOf(this), {});
+        const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+        to = to;
+        to.finished = finished;
+        to.destroyed = destroyed;
+        to.blockLen = blockLen;
+        to.outputLen = outputLen;
+        to.oHash = oHash._cloneInto(to.oHash);
+        to.iHash = iHash._cloneInto(to.iHash);
+        return to;
+    }
+    clone() {
+        return this._cloneInto();
+    }
+    destroy() {
+        this.destroyed = true;
+        this.oHash.destroy();
+        this.iHash.destroy();
+    }
+}
+const hmac = /* @__PURE__ */ (() => {
+    const hmac_ = ((hash, key, message) => new _HMAC(hash, key).update(message).digest());
+    hmac_.create = (hash, key) => new _HMAC(hash, key);
+    return hmac_;
+})();
+
+/**
+ * Internal Merkle-Damgard hash utils.
+ * @module
+ */
+/**
+ * Shared 32-bit conditional boolean primitive reused by SHA-256, SHA-1, and MD5 `F`.
+ * Returns bits from `b` when `a` is set, otherwise from `c`.
+ * The XOR form is equivalent to MD5's `F(X,Y,Z) = XY v not(X)Z` because the masked terms never
+ * set the same bit.
+ * @param a - selector word
+ * @param b - word chosen when selector bit is set
+ * @param c - word chosen when selector bit is clear
+ * @returns Mixed 32-bit word.
+ * @example
+ * Combine three words with the shared 32-bit choice primitive.
+ * ```ts
+ * Chi(0xffffffff, 0x12345678, 0x87654321);
+ * ```
+ */
+function Chi(a, b, c) {
+    return (a & b) ^ (~a & c);
+}
+/**
+ * Shared 32-bit majority primitive reused by SHA-256 and SHA-1.
+ * Returns bits shared by at least two inputs.
+ * @param a - first input word
+ * @param b - second input word
+ * @param c - third input word
+ * @returns Mixed 32-bit word.
+ * @example
+ * Combine three words with the shared 32-bit majority primitive.
+ * ```ts
+ * Maj(0xffffffff, 0x12345678, 0x87654321);
+ * ```
+ */
+function Maj(a, b, c) {
+    return (a & b) ^ (a & c) ^ (b & c);
+}
+/**
+ * Merkle-Damgard hash construction base class.
+ * Could be used to create MD5, RIPEMD, SHA1, SHA2.
+ * Accepts only byte-aligned `Uint8Array` input, even when the underlying spec describes bit
+ * strings with partial-byte tails.
+ * @param blockLen - internal block size in bytes
+ * @param outputLen - digest size in bytes
+ * @param padOffset - trailing length field size in bytes
+ * @param isLE - whether length and state words are encoded in little-endian
+ * @example
+ * Use a concrete subclass to get the shared Merkle-Damgard update/digest flow.
+ * ```ts
+ * import { _SHA1 } from '@noble/hashes/legacy.js';
+ * const hash = new _SHA1();
+ * hash.update(new Uint8Array([97, 98, 99]));
+ * hash.digest();
+ * ```
+ */
+class HashMD {
+    blockLen;
+    outputLen;
+    canXOF = false;
+    padOffset;
+    isLE;
+    // For partial updates less than block size
+    buffer;
+    view;
+    finished = false;
+    length = 0;
+    pos = 0;
+    destroyed = false;
+    constructor(blockLen, outputLen, padOffset, isLE) {
+        this.blockLen = blockLen;
+        this.outputLen = outputLen;
+        this.padOffset = padOffset;
+        this.isLE = isLE;
+        this.buffer = new Uint8Array(blockLen);
+        this.view = createView(this.buffer);
+    }
+    update(data) {
+        aexists(this);
+        abytes(data);
+        const { view, buffer, blockLen } = this;
+        const len = data.length;
+        for (let pos = 0; pos < len;) {
+            const take = Math.min(blockLen - this.pos, len - pos);
+            // Fast path only when there is no buffered partial block: `take === blockLen` implies
+            // `this.pos === 0`, so we can process full blocks directly from the input view.
+            if (take === blockLen) {
+                const dataView = createView(data);
+                for (; blockLen <= len - pos; pos += blockLen)
+                    this.process(dataView, pos);
+                continue;
+            }
+            buffer.set(data.subarray(pos, pos + take), this.pos);
+            this.pos += take;
+            pos += take;
+            if (this.pos === blockLen) {
+                this.process(view, 0);
+                this.pos = 0;
+            }
+        }
+        this.length += data.length;
+        this.roundClean();
+        return this;
+    }
+    digestInto(out) {
+        aexists(this);
+        aoutput(out, this);
+        this.finished = true;
+        // Padding
+        // We can avoid allocation of buffer for padding completely if it
+        // was previously not allocated here. But it won't change performance.
+        const { buffer, view, blockLen, isLE } = this;
+        let { pos } = this;
+        // append the bit '1' to the message
+        buffer[pos++] = 0b10000000;
+        clean(this.buffer.subarray(pos));
+        // we have less than padOffset left in buffer, so we cannot put length in
+        // current block, need process it and pad again
+        if (this.padOffset > blockLen - pos) {
+            this.process(view, 0);
+            pos = 0;
+        }
+        // Pad until full block byte with zeros
+        for (let i = pos; i < blockLen; i++)
+            buffer[i] = 0;
+        // `padOffset` reserves the whole length field. For SHA-384/512 the high 64 bits stay zero from
+        // the padding fill above, and JS will overflow before user input can make that half non-zero.
+        // So we only need to write the low 64 bits here.
+        view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);
+        this.process(view, 0);
+        const oview = createView(out);
+        const len = this.outputLen;
+        // NOTE: we do division by 4 later, which must be fused in single op with modulo by JIT
+        if (len % 4)
+            throw new Error('_sha2: outputLen must be aligned to 32bit');
+        const outLen = len / 4;
+        const state = this.get();
+        if (outLen > state.length)
+            throw new Error('_sha2: outputLen bigger than state');
+        for (let i = 0; i < outLen; i++)
+            oview.setUint32(4 * i, state[i], isLE);
+    }
+    digest() {
+        const { buffer, outputLen } = this;
+        this.digestInto(buffer);
+        // Copy before destroy(): subclasses wipe `buffer` during cleanup, but `digest()` must return
+        // fresh bytes to the caller.
+        const res = buffer.slice(0, outputLen);
+        this.destroy();
+        return res;
+    }
+    _cloneInto(to) {
+        to ||= new this.constructor();
+        to.set(...this.get());
+        const { blockLen, buffer, length, finished, destroyed, pos } = this;
+        to.destroyed = destroyed;
+        to.finished = finished;
+        to.length = length;
+        to.pos = pos;
+        // Only partial-block bytes need copying: when `length % blockLen === 0`, `pos === 0` and
+        // later `update()` / `digestInto()` overwrite `to.buffer` from the start before reading it.
+        if (length % blockLen)
+            to.buffer.set(buffer);
+        return to;
+    }
+    clone() {
+        return this._cloneInto();
+    }
+}
+/**
+ * Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.
+ * Check out `test/misc/sha2-gen-iv.js` for recomputation guide.
+ */
+/** Initial SHA256 state from RFC 6234 §6.1: the first 32 bits of the fractional parts of the
+ * square roots of the first eight prime numbers. Exported as a shared table; callers must treat
+ * it as read-only because constructors copy words from it by index. */
+const SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+]);
+
+/**
+ * SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.
+ * SHA256 is the fastest hash implementable in JS, even faster than Blake3.
+ * Check out {@link https://www.rfc-editor.org/rfc/rfc4634 | RFC 4634} and
+ * {@link https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf | FIPS 180-4}.
+ * @module
+ */
+/**
+ * SHA-224 / SHA-256 round constants from RFC 6234 §5.1: the first 32 bits
+ * of the cube roots of the first 64 primes (2..311).
+ */
+// prettier-ignore
+const SHA256_K = /* @__PURE__ */ Uint32Array.from([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+]);
+/** Reusable SHA-224 / SHA-256 message schedule buffer `W_t` from RFC 6234 §6.2 step 1. */
+const SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+/** Internal SHA-224 / SHA-256 compression engine from RFC 6234 §6.2. */
+class SHA2_32B extends HashMD {
+    constructor(outputLen) {
+        super(64, outputLen, 8, false);
+    }
+    get() {
+        const { A, B, C, D, E, F, G, H } = this;
+        return [A, B, C, D, E, F, G, H];
+    }
+    // prettier-ignore
+    set(A, B, C, D, E, F, G, H) {
+        this.A = A | 0;
+        this.B = B | 0;
+        this.C = C | 0;
+        this.D = D | 0;
+        this.E = E | 0;
+        this.F = F | 0;
+        this.G = G | 0;
+        this.H = H | 0;
+    }
+    process(view, offset) {
+        // Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array
+        for (let i = 0; i < 16; i++, offset += 4)
+            SHA256_W[i] = view.getUint32(offset, false);
+        for (let i = 16; i < 64; i++) {
+            const W15 = SHA256_W[i - 15];
+            const W2 = SHA256_W[i - 2];
+            const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ (W15 >>> 3);
+            const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ (W2 >>> 10);
+            SHA256_W[i] = (s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16]) | 0;
+        }
+        // Compression function main loop, 64 rounds
+        let { A, B, C, D, E, F, G, H } = this;
+        for (let i = 0; i < 64; i++) {
+            const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+            const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;
+            const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
+            const T2 = (sigma0 + Maj(A, B, C)) | 0;
+            H = G;
+            G = F;
+            F = E;
+            E = (D + T1) | 0;
+            D = C;
+            C = B;
+            B = A;
+            A = (T1 + T2) | 0;
+        }
+        // Add the compressed chunk to the current hash value
+        A = (A + this.A) | 0;
+        B = (B + this.B) | 0;
+        C = (C + this.C) | 0;
+        D = (D + this.D) | 0;
+        E = (E + this.E) | 0;
+        F = (F + this.F) | 0;
+        G = (G + this.G) | 0;
+        H = (H + this.H) | 0;
+        this.set(A, B, C, D, E, F, G, H);
+    }
+    roundClean() {
+        clean(SHA256_W);
+    }
+    destroy() {
+        // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves
+        // update()/digest() callable on reused instances.
+        this.destroyed = true;
+        this.set(0, 0, 0, 0, 0, 0, 0, 0);
+        clean(this.buffer);
+    }
+}
+/** Internal SHA-256 hash class grounded in RFC 6234 §6.2. */
+class _SHA256 extends SHA2_32B {
+    // We cannot use array here since array allows indexing by variable
+    // which means optimizer/compiler cannot use registers.
+    A = SHA256_IV[0] | 0;
+    B = SHA256_IV[1] | 0;
+    C = SHA256_IV[2] | 0;
+    D = SHA256_IV[3] | 0;
+    E = SHA256_IV[4] | 0;
+    F = SHA256_IV[5] | 0;
+    G = SHA256_IV[6] | 0;
+    H = SHA256_IV[7] | 0;
+    constructor() {
+        super(32);
+    }
+}
+/**
+ * SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info:
+ *
+ * - Trying 2^128 hashes would get 50% chance of collision, using birthday attack.
+ * - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.
+ * - Each sha256 hash is executing 2^18 bit operations.
+ * - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.
+ * @param msg - message bytes to hash
+ * @returns Digest bytes.
+ * @example
+ * Hash a message with SHA2-256.
+ * ```ts
+ * sha256(new Uint8Array([97, 98, 99]));
+ * ```
+ */
+const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), 
+/* @__PURE__ */ oidNist(0x01));
+
+// DEFLATE is a complex format; to read this code, you should probably check the RFC first:
+// https://tools.ietf.org/html/rfc1951
+// You may also wish to take a look at the guide I made about this program:
+// https://gist.github.com/101arrowz/253f31eb5abc3d9275ab943003ffecad
+// Some of the following code is similar to that of UZIP.js:
+// https://github.com/photopea/UZIP.js
+// However, the vast majority of the codebase has diverged from UZIP.js to increase performance and reduce bundle size.
+// Sometimes 0 will appear where -1 would be more appropriate. This is because using a uint
+// is better for memory in most engines (I *think*).
+
+// aliases for shorter compressed code (most minifers don't do this)
+var u8 = Uint8Array, u16 = Uint16Array, i32 = Int32Array;
+// fixed length extra bits
+var fleb = new u8([0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0, /* unused */ 0, 0, /* impossible */ 0]);
+// fixed distance extra bits
+var fdeb = new u8([0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13, /* unused */ 0, 0]);
+// code length index map
+var clim = new u8([16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15]);
+// get base, reverse index map from extra bits
+var freb = function (eb, start) {
+    var b = new u16(31);
+    for (var i = 0; i < 31; ++i) {
+        b[i] = start += 1 << eb[i - 1];
+    }
+    // numbers here are at max 18 bits
+    var r = new i32(b[30]);
+    for (var i = 1; i < 30; ++i) {
+        for (var j = b[i]; j < b[i + 1]; ++j) {
+            r[j] = ((j - b[i]) << 5) | i;
+        }
+    }
+    return { b: b, r: r };
+};
+var _a$1 = freb(fleb, 2), fl$1 = _a$1.b, revfl = _a$1.r;
+// we can ignore the fact that the other numbers are wrong; they never happen anyway
+fl$1[28] = 258, revfl[258] = 28;
+var _b = freb(fdeb, 0), fd$1 = _b.b;
+// map of value to reverse (assuming 16 bits)
+var rev = new u16(32768);
+for (var i = 0; i < 32768; ++i) {
+    // reverse table algorithm from SO
+    var x = ((i & 0xAAAA) >> 1) | ((i & 0x5555) << 1);
+    x = ((x & 0xCCCC) >> 2) | ((x & 0x3333) << 2);
+    x = ((x & 0xF0F0) >> 4) | ((x & 0x0F0F) << 4);
+    rev[i] = (((x & 0xFF00) >> 8) | ((x & 0x00FF) << 8)) >> 1;
+}
+// create huffman tree from u8 "map": index -> code length for code index
+// mb (max bits) must be at most 15
+// TODO: optimize/split up?
+var hMap = (function (cd, mb, r) {
+    var s = cd.length;
+    // index
+    var i = 0;
+    // u16 "map": index -> # of codes with bit length = index
+    var l = new u16(mb);
+    // length of cd must be 288 (total # of codes)
+    for (; i < s; ++i) {
+        if (cd[i])
+            ++l[cd[i] - 1];
+    }
+    // u16 "map": index -> minimum code for bit length = index
+    var le = new u16(mb);
+    for (i = 1; i < mb; ++i) {
+        le[i] = (le[i - 1] + l[i - 1]) << 1;
+    }
+    var co;
+    if (r) {
+        // u16 "map": index -> number of actual bits, symbol for code
+        co = new u16(1 << mb);
+        // bits to remove for reverser
+        var rvb = 15 - mb;
+        for (i = 0; i < s; ++i) {
+            // ignore 0 lengths
+            if (cd[i]) {
+                // num encoding both symbol and bits read
+                var sv = (i << 4) | cd[i];
+                // free bits
+                var r_1 = mb - cd[i];
+                // start value
+                var v = le[cd[i] - 1]++ << r_1;
+                // m is end value
+                for (var m = v | ((1 << r_1) - 1); v <= m; ++v) {
+                    // every 16 bit value starting with the code yields the same result
+                    co[rev[v] >> rvb] = sv;
+                }
+            }
+        }
+    }
+    else {
+        co = new u16(s);
+        for (i = 0; i < s; ++i) {
+            if (cd[i]) {
+                co[i] = rev[le[cd[i] - 1]++] >> (15 - cd[i]);
+            }
+        }
+    }
+    return co;
+});
+// fixed length tree
+var flt = new u8(288);
+for (var i = 0; i < 144; ++i)
+    flt[i] = 8;
+for (var i = 144; i < 256; ++i)
+    flt[i] = 9;
+for (var i = 256; i < 280; ++i)
+    flt[i] = 7;
+for (var i = 280; i < 288; ++i)
+    flt[i] = 8;
+// fixed distance tree
+var fdt = new u8(32);
+for (var i = 0; i < 32; ++i)
+    fdt[i] = 5;
+// fixed length map
+var flrm = /*#__PURE__*/ hMap(flt, 9, 1);
+// fixed distance map
+var fdrm = /*#__PURE__*/ hMap(fdt, 5, 1);
+// find max of array
+var max = function (a) {
+    var m = a[0];
+    for (var i = 1; i < a.length; ++i) {
+        if (a[i] > m)
+            m = a[i];
+    }
+    return m;
+};
+// read d, starting at bit p and mask with m
+var bits = function (d, p, m) {
+    var o = (p / 8) | 0;
+    return ((d[o] | (d[o + 1] << 8)) >> (p & 7)) & m;
+};
+// read d, starting at bit p continuing for at least 16 bits
+var bits16 = function (d, p) {
+    var o = (p / 8) | 0;
+    return ((d[o] | (d[o + 1] << 8) | (d[o + 2] << 16)) >> (p & 7));
+};
+// get end of byte
+var shft = function (p) { return ((p + 7) / 8) | 0; };
+// typed array slice - allows garbage collector to free original reference,
+// while being more compatible than .slice
+var slc = function (v, s, e) {
+    if (s == null || s < 0)
+        s = 0;
+    if (e == null || e > v.length)
+        e = v.length;
+    // can't use .constructor in case user-supplied
+    return new u8(v.subarray(s, e));
+};
+// error codes
+var ec$1 = [
+    'unexpected EOF',
+    'invalid block type',
+    'invalid length/literal',
+    'invalid distance',
+    'stream finished',
+    'no stream handler',
+    , // determined by compression function
+    'no callback',
+    'invalid UTF-8 data',
+    'extra field too long',
+    'date not in range 1980-2099',
+    'filename too long',
+    'stream finishing',
+    'invalid zip data'
+    // determined by unknown compression method
+];
+var err = function (ind, msg, nt) {
+    var e = new Error(msg || ec$1[ind]);
+    e.code = ind;
+    if (Error.captureStackTrace)
+        Error.captureStackTrace(e, err);
+    if (!nt)
+        throw e;
+    return e;
+};
+// expands raw DEFLATE data
+var inflt = function (dat, st, buf, dict) {
+    // source length       dict length
+    var sl = dat.length, dl = dict ? dict.length : 0;
+    if (!sl || st.f && !st.l)
+        return buf || new u8(0);
+    var noBuf = !buf;
+    // have to estimate size
+    var resize = noBuf || st.i != 2;
+    // no state
+    var noSt = st.i;
+    // Assumes roughly 33% compression ratio average
+    if (noBuf)
+        buf = new u8(sl * 3);
+    // ensure buffer can fit at least l elements
+    var cbuf = function (l) {
+        var bl = buf.length;
+        // need to increase size to fit
+        if (l > bl) {
+            // Double or set to necessary, whichever is greater
+            var nbuf = new u8(Math.max(bl * 2, l));
+            nbuf.set(buf);
+            buf = nbuf;
+        }
+    };
+    //  last chunk         bitpos           bytes
+    var final = st.f || 0, pos = st.p || 0, bt = st.b || 0, lm = st.l, dm = st.d, lbt = st.m, dbt = st.n;
+    // total bits
+    var tbts = sl * 8;
+    do {
+        if (!lm) {
+            // BFINAL - this is only 1 when last chunk is next
+            final = bits(dat, pos, 1);
+            // type: 0 = no compression, 1 = fixed huffman, 2 = dynamic huffman
+            var type = bits(dat, pos + 1, 3);
+            pos += 3;
+            if (!type) {
+                // go to end of byte boundary
+                var s = shft(pos) + 4, l = dat[s - 4] | (dat[s - 3] << 8), t = s + l;
+                if (t > sl) {
+                    if (noSt)
+                        err(0);
+                    break;
+                }
+                // ensure size
+                if (resize)
+                    cbuf(bt + l);
+                // Copy over uncompressed data
+                buf.set(dat.subarray(s, t), bt);
+                // Get new bitpos, update byte count
+                st.b = bt += l, st.p = pos = t * 8, st.f = final;
+                continue;
+            }
+            else if (type == 1)
+                lm = flrm, dm = fdrm, lbt = 9, dbt = 5;
+            else if (type == 2) {
+                //  literal                            lengths
+                var hLit = bits(dat, pos, 31) + 257, hcLen = bits(dat, pos + 10, 15) + 4;
+                var tl = hLit + bits(dat, pos + 5, 31) + 1;
+                pos += 14;
+                // length+distance tree
+                var ldt = new u8(tl);
+                // code length tree
+                var clt = new u8(19);
+                for (var i = 0; i < hcLen; ++i) {
+                    // use index map to get real code
+                    clt[clim[i]] = bits(dat, pos + i * 3, 7);
+                }
+                pos += hcLen * 3;
+                // code lengths bits
+                var clb = max(clt), clbmsk = (1 << clb) - 1;
+                // code lengths map
+                var clm = hMap(clt, clb, 1);
+                for (var i = 0; i < tl;) {
+                    var r = clm[bits(dat, pos, clbmsk)];
+                    // bits read
+                    pos += r & 15;
+                    // symbol
+                    var s = r >> 4;
+                    // code length to copy
+                    if (s < 16) {
+                        ldt[i++] = s;
+                    }
+                    else {
+                        //  copy   count
+                        var c = 0, n = 0;
+                        if (s == 16)
+                            n = 3 + bits(dat, pos, 3), pos += 2, c = ldt[i - 1];
+                        else if (s == 17)
+                            n = 3 + bits(dat, pos, 7), pos += 3;
+                        else if (s == 18)
+                            n = 11 + bits(dat, pos, 127), pos += 7;
+                        while (n--)
+                            ldt[i++] = c;
+                    }
+                }
+                //    length tree                 distance tree
+                var lt = ldt.subarray(0, hLit), dt = ldt.subarray(hLit);
+                // max length bits
+                lbt = max(lt);
+                // max dist bits
+                dbt = max(dt);
+                lm = hMap(lt, lbt, 1);
+                dm = hMap(dt, dbt, 1);
+            }
+            else
+                err(1);
+            if (pos > tbts) {
+                if (noSt)
+                    err(0);
+                break;
+            }
+        }
+        // Make sure the buffer can hold this + the largest possible addition
+        // Maximum chunk size (practically, theoretically infinite) is 2^17
+        if (resize)
+            cbuf(bt + 131072);
+        var lms = (1 << lbt) - 1, dms = (1 << dbt) - 1;
+        var lpos = pos;
+        for (;; lpos = pos) {
+            // bits read, code
+            var c = lm[bits16(dat, pos) & lms], sym = c >> 4;
+            pos += c & 15;
+            if (pos > tbts) {
+                if (noSt)
+                    err(0);
+                break;
+            }
+            if (!c)
+                err(2);
+            if (sym < 256)
+                buf[bt++] = sym;
+            else if (sym == 256) {
+                lpos = pos, lm = null;
+                break;
+            }
+            else {
+                var add = sym - 254;
+                // no extra bits needed if less
+                if (sym > 264) {
+                    // index
+                    var i = sym - 257, b = fleb[i];
+                    add = bits(dat, pos, (1 << b) - 1) + fl$1[i];
+                    pos += b;
+                }
+                // dist
+                var d = dm[bits16(dat, pos) & dms], dsym = d >> 4;
+                if (!d)
+                    err(3);
+                pos += d & 15;
+                var dt = fd$1[dsym];
+                if (dsym > 3) {
+                    var b = fdeb[dsym];
+                    dt += bits16(dat, pos) & (1 << b) - 1, pos += b;
+                }
+                if (pos > tbts) {
+                    if (noSt)
+                        err(0);
+                    break;
+                }
+                if (resize)
+                    cbuf(bt + 131072);
+                var end = bt + add;
+                if (bt < dt) {
+                    var shift = dl - dt, dend = Math.min(dt, end);
+                    if (shift + bt < 0)
+                        err(3);
+                    for (; bt < dend; ++bt)
+                        buf[bt] = dict[shift + bt];
+                }
+                for (; bt < end; ++bt)
+                    buf[bt] = buf[bt - dt];
+            }
+        }
+        st.l = lm, st.p = lpos, st.b = bt, st.f = final;
+        if (lm)
+            final = 1, st.m = lbt, st.d = dm, st.n = dbt;
+    } while (!final);
+    // don't reallocate for streams or user buffers
+    return bt != buf.length && noBuf ? slc(buf, 0, bt) : buf.subarray(0, bt);
+};
+// empty
+var et = /*#__PURE__*/ new u8(0);
+// gzip footer: -8 to -4 = CRC, -4 to -0 is length
+// gzip start
+var gzs = function (d) {
+    if (d[0] != 31 || d[1] != 139 || d[2] != 8)
+        err(6, 'invalid gzip data');
+    var flg = d[3];
+    var st = 10;
+    if (flg & 4)
+        st += (d[10] | d[11] << 8) + 2;
+    for (var zs = (flg >> 3 & 1) + (flg >> 4 & 1); zs > 0; zs -= !d[st++])
+        ;
+    return st + (flg & 2);
+};
+// gzip length
+var gzl = function (d) {
+    var l = d.length;
+    return (d[l - 4] | d[l - 3] << 8 | d[l - 2] << 16 | d[l - 1] << 24) >>> 0;
+};
+function gunzipSync(data, opts) {
+    var st = gzs(data);
+    if (st + 8 > data.length)
+        err(6, 'invalid gzip data');
+    return inflt(data.subarray(st, -8), { i: 2 }, opts && opts.out || new u8(gzl(data)), opts && opts.dictionary);
+}
+// text decoder
+var td$1 = typeof TextDecoder != 'undefined' && /*#__PURE__*/ new TextDecoder();
+// text decoder stream
+var tds = 0;
+try {
+    td$1.decode(et, { stream: true });
+    tds = 1;
+}
+catch (e) { }
+
 const MAGIC = "KYT1";
 const IV_LEN = 12;
 const HEADER_LEN = 6;
@@ -7607,10 +9643,39 @@ function b64ToBytes(b64) {
         out[i] = bin.charCodeAt(i);
     return out;
 }
+const hasSubtle = typeof crypto !== "undefined" && !!crypto.subtle;
+async function aesGcmDecrypt(keyRaw, iv, ct, aad) {
+    if (hasSubtle) {
+        const key = await crypto.subtle.importKey("raw", keyRaw, { name: "AES-GCM" }, false, ["decrypt"]);
+        const params = aad
+            ? { name: "AES-GCM", iv: iv, additionalData: aad }
+            : { name: "AES-GCM", iv: iv };
+        const pt = await crypto.subtle.decrypt(params, key, ct);
+        return new Uint8Array(pt);
+    }
+    return gcm(keyRaw, iv, aad).decrypt(ct);
+}
+async function hmacSha256(keyRaw, msg) {
+    if (hasSubtle) {
+        const key = await crypto.subtle.importKey("raw", keyRaw, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+        const sig = await crypto.subtle.sign("HMAC", key, msg);
+        return new Uint8Array(sig);
+    }
+    return hmac(sha256, keyRaw, msg);
+}
 async function gunzip(buf) {
-    const ds = new globalThis.DecompressionStream("gzip");
-    const stream = new Blob([buf]).stream().pipeThrough(ds);
-    return await new Response(stream).arrayBuffer();
+    const DS = globalThis.DecompressionStream;
+    if (DS) {
+        const stream = new Blob([buf]).stream().pipeThrough(new DS("gzip"));
+        return new Uint8Array(await new Response(stream).arrayBuffer());
+    }
+    return gunzipSync(buf);
+}
+function toHex(bytes) {
+    let s = "";
+    for (const b of bytes)
+        s += b.toString(16).padStart(2, "0");
+    return s;
 }
 class TileCipher {
     constructor(apiUrl, version, licenseKey) {
@@ -7620,27 +9685,18 @@ class TileCipher {
             throw new Error("[MapSDK] 无效的 licenseKey，应为 \"customerId.base64Key\"");
         }
         this.cid = licenseKey.slice(0, dot);
-        const raw = b64ToBytes(licenseKey.slice(dot + 1));
-        this.customerKeyRaw = raw;
-        this.customerKey = crypto.subtle.importKey("raw", raw, { name: "AES-GCM" }, false, ["decrypt"]);
+        this.customerKeyRaw = b64ToBytes(licenseKey.slice(dot + 1));
         this.wrapBase = apiPrefix(apiUrl, version);
     }
     async apiAuthHeaders() {
-        const key = await this.authKey();
+        const authKey = await this.authKey();
         const ts = Math.floor(Date.now() / 1000);
-        const sigBuf = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${this.cid}|${ts}`));
-        const sig = Array.from(new Uint8Array(sigBuf))
-            .map((b) => b.toString(16).padStart(2, "0"))
-            .join("");
-        return { "X-Cid": this.cid, "X-Ts": String(ts), "X-Sig": sig };
+        const sig = await hmacSha256(authKey, new TextEncoder().encode(`${this.cid}|${ts}`));
+        return { "X-Cid": this.cid, "X-Ts": String(ts), "X-Sig": toHex(sig) };
     }
     authKey() {
         if (!this.authKeyPromise) {
-            this.authKeyPromise = (async () => {
-                const ck = await crypto.subtle.importKey("raw", this.customerKeyRaw, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-                const derived = await crypto.subtle.sign("HMAC", ck, new TextEncoder().encode("kunyu-api-auth-v1"));
-                return crypto.subtle.importKey("raw", derived, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-            })();
+            this.authKeyPromise = hmacSha256(this.customerKeyRaw, new TextEncoder().encode("kunyu-api-auth-v1"));
         }
         return this.authKeyPromise;
     }
@@ -7663,11 +9719,7 @@ class TileCipher {
         }
         const { wrapped } = (await resp.json());
         const blob = b64ToBytes(wrapped);
-        const iv = blob.slice(0, IV_LEN);
-        const ct = blob.slice(IV_LEN);
-        const ck = await this.customerKey;
-        const rawPeriodKey = await crypto.subtle.decrypt({ name: "AES-GCM", iv: iv }, ck, ct);
-        return crypto.subtle.importKey("raw", rawPeriodKey, { name: "AES-GCM" }, false, ["decrypt"]);
+        return aesGcmDecrypt(this.customerKeyRaw, blob.slice(0, IV_LEN), blob.slice(IV_LEN));
     }
     async decrypt(realUrl, envelope) {
         const m = realUrl.match(/\/tiles\/e\/([^/]+)\//);
@@ -7684,10 +9736,10 @@ class TileCipher {
         const iv = bytes.slice(HEADER_LEN, HEADER_LEN + IV_LEN);
         const ct = bytes.slice(HEADER_LEN + IV_LEN);
         const key = await this.periodKey(period);
-        let plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv: iv, additionalData: aad }, key, ct);
+        let plain = await aesGcmDecrypt(key, iv, ct, aad);
         if (flags & FLAG_GZIP)
             plain = await gunzip(plain);
-        return plain;
+        return plain.buffer.slice(plain.byteOffset, plain.byteOffset + plain.byteLength);
     }
 }
 
@@ -7727,7 +9779,7 @@ const THEME_TOKENS = {
     segmentRemark: '#E8A020',       // HAS_REMARK 航段
     airport: '#006400',             // 机场图标色
     airportText: '#006400',         // 机场文字色（非 AMM）
-    runway: '#333333',
+    runway: '#006400',
     vorDial: '#0b417a',
     vorNormal: '#3874cb',
     vor: '#00008B',
@@ -7763,7 +9815,7 @@ const THEME_TOKENS = {
     segmentRemark: '#fbbf24',
     airport: '#73ccdd',
     airportText: '#E0F7FA',
-    runway: '#64748b',
+    runway: '#73ccdd',
     vorDial: '#38bdf8',
     vorNormal: '#38bdf8',
     vor: '#72aae5',
@@ -7800,7 +9852,7 @@ const THEME_TOKENS = {
     segmentRemark: '#f4c542',
     airport: '#7fd1ae',
     airportText: '#dce9f0',
-    runway: '#7c8ea3',
+    runway: '#7fd1ae',
     vorDial: '#5dade2',
     vorNormal: '#5dade2',
     vor: '#85a9e0',
@@ -7838,7 +9890,7 @@ const THEME_TOKENS = {
     segmentRemark: '#D68910',
     airport: '#B03060',
     airportText: '#1B2631',
-    runway: '#4A4A4A',
+    runway: '#B03060',
     vorDial: '#2E5C8A',
     vorNormal: '#2E5C8A',
     vor: '#154360',
@@ -7960,7 +10012,7 @@ function buildLayers(themeId = 'light') {
     {
       id: 'airline_label', type: 'symbol', source: sourceId, 'source-layer': 'segment', minzoom: 6,
       layout: {
-        "icon-image": ["case", ["all", ["has", "TXT_DESIG"], ["!=", ["get", "TXT_DESIG"], ""], ["!=", ["get", "TXT_DESIG"], " "], ["!=", ["get", "TXT_DESIG"], null]], "segment-both", ["all", ["has", "TXT_DESIG_FORWARD"]], "segment-right", ["all", ["has", "TXT_DESIG_BACKWARD"]], "segment-left", "segment-both"],
+        "icon-image": ["case", ["all", ["has", "TXT_DESIG"], ["!=", ["get", "TXT_DESIG"], ""], ["!=", ["get", "TXT_DESIG"], " "], ["!=", ["get", "TXT_DESIG"], null]], "stretch:segment-both", ["all", ["has", "TXT_DESIG_FORWARD"]], "stretch:segment-right", ["all", ["has", "TXT_DESIG_BACKWARD"]], "stretch:segment-left", "stretch:segment-both"],
         "icon-anchor": "center", "symbol-placement": "line", "icon-text-fit": "width", "icon-size": 1,
         "text-allow-overlap": false, "icon-allow-overlap": false, "text-optional": false,
         "text-anchor": "center", "text-justify": "center", "text-line-height": 1.3, "text-letter-spacing": 0.1,
@@ -8007,19 +10059,19 @@ function buildLayers(themeId = 'light') {
       // 4级前就显示大型机场+中型，5级后全部显示
       filter:
         ['case',
-          ['<=', ['zoom'], 3], ['<=', ['get', 'level'], 2],   // ≤4 只显 大型+中型
-          true                                                // >4 全部
+          ['<=', ['zoom'], 3], ['<=', ['get', 'level'], 1],   // zoom ≤3，只显示 level=1（大型）
+          ['<=', ['zoom'], 4], ['<=', ['get', 'level'], 2],   // zoom ≤4，显示 level≤2（大型+中型）
+          ['<=', ['zoom'], 5], ['<=', ['get', 'level'], 3],   // zoom ≤5，显示 level≤3（大型+中型+小型）
+          true                                                 // zoom >5，全部显示
         ],
       layout: {
         "icon-image": ["case", ["==", ["get", "CODE_TYPE_MIL_OPS"], "MIL"], "airport-mil", ["==", ["get", "CODE_TYPE_MIL_OPS"], "MILEXT"], "airport-milext", "airport-civ"],
-        "icon-size": ["interpolate", ["linear"], ["zoom"], 4, 0.5, 10, 0.7],
         "symbol-z-order": "viewport-y",
-        "text-field": ["get", "codeId"],
         "text-letter-spacing": 0.05,
         'text-field': ['get', 'CODE_ID'],
         "text-anchor": "bottom",
         "text-justify": "center",
-        "text-size": ["interpolate", ["linear"], ["zoom"], 4, 0, 5, 10, 9, 11],
+        "text-size": ["interpolate", ["linear"], ["zoom"], 4, 0, 5, 10],
         "text-offset": [
           "interpolate", ["linear"], ["zoom"],
           5, ["literal", [0, -0.8]],
@@ -8028,14 +10080,33 @@ function buildLayers(themeId = 'light') {
         ],
         "icon-allow-overlap": true,
         "icon-ignore-placement": true,
-        "text-allow-overlap": true,
-        "text-ignore-placement": true,
+        "text-allow-overlap": false,
+        "text-ignore-placement": false,
+        "text-optional": true,
         "visibility": "none",
-        "icon-size": ["interpolate", ["linear"], ["zoom"], 5, 0.7, 9, 1.2, 12, 1.3]
+        "icon-size": ["interpolate", ["linear"], ["zoom"], 2, 0.6, 5, 0.7, 9, 1, 12, 1.1]
       },
       paint: {
         'icon-color': ['case', ['has', 'has_amm'], '#4B2D6E', T.airport],
-        "icon-opacity": ["interpolate", ["linear"], ["zoom"], 2, 0.75, 3, 0.95, 5, 1, 9, 1, 11, 0.2],
+        "icon-opacity": [
+          "interpolate",
+          [
+            "linear"
+          ],
+          [
+            "zoom"
+          ],
+          2,
+          0.75,
+          3,
+          0.95,
+          5,
+          1,
+          9,
+          1,
+          11,
+          0.2
+        ],
         "text-color": ['case', ['has', 'has_amm'], '#4B2D6E', T.airportText],
         "text-opacity": ["interpolate", ["linear"], ["zoom"], 4, 0.95, 5, 1, 9, 1, 11, 0.2],
       },
@@ -8047,37 +10118,55 @@ function buildLayers(themeId = 'light') {
     // keeps the strip aligned to the ground as the map rotates. The `runway-strip`
     // sprite is supplied by the host sprite sheet.
     {
-      id: 'airport-runway', type: 'symbol', source: sourceId, minzoom: 2, 'source-layer': 'airport',
-      filter: ['all', ['has', 'RWY_BRG1'], ['case', ['<=', ['zoom'], 3], ['<=', ['get', 'level'], 2], true]],
+      id: 'airport-runway', type: 'symbol', source: sourceId, minzoom: 4, 'source-layer': 'airport',
+      filter: [
+        'all',
+        ['has', 'RWY_BRG1'],
+        ['case',
+          ['<=', ['zoom'], 3], ['<=', ['get', 'level'], 1],
+          ['<=', ['zoom'], 4], ['<=', ['get', 'level'], 2],
+          ['<=', ['zoom'], 5], ['<=', ['get', 'level'], 3],
+          true
+        ]
+      ],
       layout: {
         'icon-image': 'runway:runway-strip',
         'icon-rotate': ['get', 'RWY_BRG1'],
         'icon-rotation-alignment': 'map',
-        'icon-size': ['interpolate', ['linear'], ['zoom'], 5, 0.5, 9, 0.7, 12, 0.75],
+        'icon-size': ['interpolate', ['linear'], ['zoom'], 2, 0.3, 9, 0.7, 12, 0.7],
         'icon-allow-overlap': true,
         'icon-ignore-placement': true,
         'visibility': 'none',
       },
       paint: {
-        "icon-color": T.airport,
-        "icon-opacity": ["interpolate", ["linear"], ["zoom"], 2, 0.65, 3, 0.85, 5, 0.9, 9, 1, 11, 0.2],
+        "icon-color": T.runway,
+        "icon-opacity": ["interpolate", ["linear"], ["zoom"], 2, 0.75, 9, 1, 11, 0.2],
       },
     },
     {
-      id: 'airport-runway-cross', type: 'symbol', source: sourceId, minzoom: 2, 'source-layer': 'airport',
-      filter: ['all', ['has', 'RWY_BRG2'], ['case', ['<=', ['zoom'], 3], ['<=', ['get', 'level'], 2], true]],
+      id: 'airport-runway-cross', type: 'symbol', source: sourceId, minzoom: 4, 'source-layer': 'airport',
+      filter: [
+        'all',
+        ['has', 'RWY_BRG2'],
+        ['case',
+          ['<=', ['zoom'], 3], ['<=', ['get', 'level'], 1],
+          ['<=', ['zoom'], 4], ['<=', ['get', 'level'], 2],
+          ['<=', ['zoom'], 5], ['<=', ['get', 'level'], 3],
+          true
+        ]
+      ],
       layout: {
         'icon-image': 'runway:runway-strip',
         'icon-rotate': ['get', 'RWY_BRG2'],
         'icon-rotation-alignment': 'map',
-        'icon-size': ['interpolate', ['linear'], ['zoom'], 5, 0.5, 9, 0.7, 12, 0.75],
+        'icon-size': ['interpolate', ['linear'], ['zoom'], 2, 0.3, 9, 0.7, 12, 0.7],
         'icon-allow-overlap': true,
         'icon-ignore-placement': true,
         'visibility': 'none',
       },
       paint: {
-        "icon-color": T.airport,
-        "icon-opacity": ["interpolate", ["linear"], ["zoom"], 2, 0.65, 3, 0.85, 5, 0.9, 9, 1, 11, 0.2],
+        "icon-color": T.runway,
+        "icon-opacity": ["interpolate", ["linear"], ["zoom"], 2, 0.75, 9, 1, 11, 0.2],
       },
     },
     {