digiid-ts 2.0.3 → 3.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/README.md +3 -3
  2. package/dist/digiid-ts.es.js +1776 -2064
  3. package/dist/digiid-ts.es.js.map +1 -1
  4. package/dist/digiid-ts.umd.js +3 -3
  5. package/dist/digiid-ts.umd.js.map +1 -1
  6. package/package.json +19 -16
package/dist/digiid-ts.es.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"digiid-ts.es.js","sources":["../src/types.ts","../node_modules/@noble/curves/node_modules/@noble/hashes/utils.js","../node_modules/@noble/curves/node_modules/@noble/hashes/_md.js","../node_modules/@noble/curves/node_modules/@noble/hashes/sha2.js","../node_modules/@noble/curves/utils.js","../node_modules/@noble/curves/abstract/modular.js","../node_modules/@noble/curves/abstract/curve.js","../node_modules/@noble/curves/node_modules/@noble/hashes/hmac.js","../node_modules/@noble/curves/abstract/weierstrass.js","../node_modules/@noble/curves/secp256k1.js","../node_modules/@noble/hashes/esm/utils.js","../node_modules/@noble/hashes/esm/_md.js","../node_modules/@noble/hashes/esm/legacy.js","../node_modules/@noble/hashes/esm/ripemd160.js","../node_modules/@noble/hashes/esm/sha2.js","../node_modules/@noble/hashes/esm/sha256.js","../src/digiid.ts"],"sourcesContent":["/**\n * Options for generating a DigiID URI.\n */\nexport interface DigiIDUriOptions {\n /** The full URL that the user's DigiID wallet will send the verification data back to. */\n callbackUrl: string;\n /** A unique, unpredictable nonce (number used once) for this authentication request. If not provided, a secure random one might be generated (implementation specific). */\n nonce?: string;\n /** Set to true for testing over HTTP (insecure), defaults to false (HTTPS required). */\n unsecure?: boolean;\n}\n\n/**\n * Data structure typically received from the DigiID wallet callback.\n */\nexport interface DigiIDCallbackData {\n /** The DigiByte address used for signing. */\n address: string;\n /** The DigiID URI that was originally presented to the user. */\n uri: string;\n /** The signature proving ownership of the address, signing the URI. */\n signature: string;\n}\n\n/**\n * Options for verifying a DigiID callback.\n */\nexport interface DigiIDVerifyOptions {\n /** The expected callback URL (or parts of it, like domain/path) that should match the one in the received URI. */\n expectedCallbackUrl: string | URL;\n /** The specific nonce that was originally generated for this authentication attempt, to prevent replay attacks. */\n expectedNonce?: string;\n}\n\n/**\n * Result of a successful DigiID verification.\n */\nexport interface DigiIDVerificationResult {\n /** Indicates the verification was successful. */\n isValid: true;\n /** The DigiByte address that was successfully verified. */\n address: string;\n /** The nonce extracted from the verified URI. */\n nonce: string;\n}\n\n/**\n * Represents an error during DigiID processing.\n */\nexport class DigiIDError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'DigiIDError';\n }\n}\n","/**\n * Utilities for hex, bytes, CSPRNG.\n * @module\n */\n/*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */\n/** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */\nexport function isBytes(a) {\n return a instanceof Uint8Array || (ArrayBuffer.isView(a) && a.constructor.name === 'Uint8Array');\n}\n/** Asserts something is positive integer. */\nexport function anumber(n, title = '') {\n if (!Number.isSafeInteger(n) || n < 0) {\n const prefix = title && `\"${title}\" `;\n throw new Error(`${prefix}expected integer >= 0, got ${n}`);\n }\n}\n/** Asserts something is Uint8Array. */\nexport function abytes(value, length, title = '') {\n const bytes = isBytes(value);\n const len = value?.length;\n const needsLen = length !== undefined;\n if (!bytes || (needsLen && len !== length)) {\n const prefix = title && `\"${title}\" `;\n const ofLen = needsLen ? ` of length ${length}` : '';\n const got = bytes ? `length=${len}` : `type=${typeof value}`;\n throw new Error(prefix + 'expected Uint8Array' + ofLen + ', got ' + got);\n }\n return value;\n}\n/** Asserts something is hash */\nexport function ahash(h) {\n if (typeof h !== 'function' || typeof h.create !== 'function')\n throw new Error('Hash must wrapped by utils.createHasher');\n anumber(h.outputLen);\n anumber(h.blockLen);\n}\n/** Asserts a hash instance has not been destroyed / finished */\nexport function aexists(instance, checkFinished = true) {\n if (instance.destroyed)\n throw new Error('Hash instance has been destroyed');\n if (checkFinished && instance.finished)\n throw new Error('Hash#digest() has already been called');\n}\n/** Asserts output is properly-sized byte array */\nexport function aoutput(out, instance) {\n abytes(out, undefined, 'digestInto() output');\n const min = instance.outputLen;\n if (out.length < min) {\n throw new Error('\"digestInto() output\" expected to be of length >=' + min);\n }\n}\n/** Cast u8 / u16 / u32 to u8. */\nexport function u8(arr) {\n return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/** Cast u8 / u16 / u32 to u32. */\nexport function u32(arr) {\n return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));\n}\n/** Zeroize a byte array. Warning: JS provides no guarantees. */\nexport function clean(...arrays) {\n for (let i = 0; i < arrays.length; i++) {\n arrays[i].fill(0);\n }\n}\n/** Create DataView of an array for easy byte-level manipulation. */\nexport function createView(arr) {\n return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/** The rotate right (circular right shift) operation for uint32 */\nexport function rotr(word, shift) {\n return (word << (32 - shift)) | (word >>> shift);\n}\n/** The rotate left (circular left shift) operation for uint32 */\nexport function rotl(word, shift) {\n return (word << shift) | ((word >>> (32 - shift)) >>> 0);\n}\n/** Is current platform little-endian? Most are. Big-Endian platform: IBM */\nexport const isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44)();\n/** The byte swap operation for uint32 */\nexport function byteSwap(word) {\n return (((word << 24) & 0xff000000) |\n ((word << 8) & 0xff0000) |\n ((word >>> 8) & 0xff00) |\n ((word >>> 24) & 0xff));\n}\n/** Conditionally byte swap if on a big-endian platform */\nexport const swap8IfBE = isLE\n ? (n) => n\n : (n) => byteSwap(n);\n/** In place byte swap for Uint32Array */\nexport function byteSwap32(arr) {\n for (let i = 0; i < arr.length; i++) {\n arr[i] = byteSwap(arr[i]);\n }\n return arr;\n}\nexport const swap32IfBE = isLE\n ? (u) => u\n : byteSwap32;\n// Built-in hex conversion https://caniuse.com/mdn-javascript_builtins_uint8array_fromhex\nconst hasHexBuiltin = /* @__PURE__ */ (() => \n// @ts-ignore\ntypeof Uint8Array.from([]).toHex === 'function' && typeof Uint8Array.fromHex === 'function')();\n// Array where index 0xf0 (240) is mapped to string 'f0'\nconst hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));\n/**\n * Convert byte array to hex string. Uses built-in function, when available.\n * @example bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])) // 'cafe0123'\n */\nexport function bytesToHex(bytes) {\n abytes(bytes);\n // @ts-ignore\n if (hasHexBuiltin)\n return bytes.toHex();\n // pre-caching improves the speed 6x\n let hex = '';\n for (let i = 0; i < bytes.length; i++) {\n hex += hexes[bytes[i]];\n }\n return hex;\n}\n// We use optimized technique to convert hex string to byte array\nconst asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };\nfunction asciiToBase16(ch) {\n if (ch >= asciis._0 && ch <= asciis._9)\n return ch - asciis._0; // '2' => 50-48\n if (ch >= asciis.A && ch <= asciis.F)\n return ch - (asciis.A - 10); // 'B' => 66-(65-10)\n if (ch >= asciis.a && ch <= asciis.f)\n return ch - (asciis.a - 10); // 'b' => 98-(97-10)\n return;\n}\n/**\n * Convert hex string to byte array. Uses built-in function, when available.\n * @example hexToBytes('cafe0123') // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])\n */\nexport function hexToBytes(hex) {\n if (typeof hex !== 'string')\n throw new Error('hex string expected, got ' + typeof hex);\n // @ts-ignore\n if (hasHexBuiltin)\n return Uint8Array.fromHex(hex);\n const hl = hex.length;\n const al = hl / 2;\n if (hl % 2)\n throw new Error('hex string expected, got unpadded hex of length ' + hl);\n const array = new Uint8Array(al);\n for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {\n const n1 = asciiToBase16(hex.charCodeAt(hi));\n const n2 = asciiToBase16(hex.charCodeAt(hi + 1));\n if (n1 === undefined || n2 === undefined) {\n const char = hex[hi] + hex[hi + 1];\n throw new Error('hex string expected, got non-hex character \"' + char + '\" at index ' + hi);\n }\n array[ai] = n1 * 16 + n2; // multiply first octet, e.g. 'a3' => 10*16+3 => 160 + 3 => 163\n }\n return array;\n}\n/**\n * There is no setImmediate in browser and setTimeout is slow.\n * Call of async fn will return Promise, which will be fullfiled only on\n * next scheduler queue processing step and this is exactly what we need.\n */\nexport const nextTick = async () => { };\n/** Returns control to thread each 'tick' ms to avoid blocking. */\nexport async function asyncLoop(iters, tick, cb) {\n let ts = Date.now();\n for (let i = 0; i < iters; i++) {\n cb(i);\n // Date.now() is not monotonic, so in case if clock goes backwards we return return control too\n const diff = Date.now() - ts;\n if (diff >= 0 && diff < tick)\n continue;\n await nextTick();\n ts += diff;\n }\n}\n/**\n * Converts string to bytes using UTF8 encoding.\n * Built-in doesn't validate input to be string: we do the check.\n * @example utf8ToBytes('abc') // Uint8Array.from([97, 98, 99])\n */\nexport function utf8ToBytes(str) {\n if (typeof str !== 'string')\n throw new Error('string expected');\n return new Uint8Array(new TextEncoder().encode(str)); // https://bugzil.la/1681809\n}\n/**\n * Helper for KDFs: consumes uint8array or string.\n * When string is passed, does utf8 decoding, using TextDecoder.\n */\nexport function kdfInputToBytes(data, errorTitle = '') {\n if (typeof data === 'string')\n return utf8ToBytes(data);\n return abytes(data, undefined, errorTitle);\n}\n/** Copies several Uint8Arrays into one. */\nexport function concatBytes(...arrays) {\n let sum = 0;\n for (let i = 0; i < arrays.length; i++) {\n const a = arrays[i];\n abytes(a);\n sum += a.length;\n }\n const res = new Uint8Array(sum);\n for (let i = 0, pad = 0; i < arrays.length; i++) {\n const a = arrays[i];\n res.set(a, pad);\n pad += a.length;\n }\n return res;\n}\n/** Merges default options and passed options. */\nexport function checkOpts(defaults, opts) {\n if (opts !== undefined && {}.toString.call(opts) !== '[object Object]')\n throw new Error('options must be object or undefined');\n const merged = Object.assign(defaults, opts);\n return merged;\n}\n/** Creates function with outputLen, blockLen, create properties from a class constructor. */\nexport function createHasher(hashCons, info = {}) {\n const hashC = (msg, opts) => hashCons(opts).update(msg).digest();\n const tmp = hashCons(undefined);\n hashC.outputLen = tmp.outputLen;\n hashC.blockLen = tmp.blockLen;\n hashC.create = (opts) => hashCons(opts);\n Object.assign(hashC, info);\n return Object.freeze(hashC);\n}\n/** Cryptographically secure PRNG. Uses internal OS-level `crypto.getRandomValues`. */\nexport function randomBytes(bytesLength = 32) {\n const cr = typeof globalThis === 'object' ? globalThis.crypto : null;\n if (typeof cr?.getRandomValues !== 'function')\n throw new Error('crypto.getRandomValues must be defined');\n return cr.getRandomValues(new Uint8Array(bytesLength));\n}\n/** Creates OID opts for NIST hashes, with prefix 06 09 60 86 48 01 65 03 04 02. */\nexport const oidNist = (suffix) => ({\n oid: Uint8Array.from([0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, suffix]),\n});\n//# sourceMappingURL=utils.js.map","/**\n * Internal Merkle-Damgard hash utils.\n * @module\n */\nimport { abytes, aexists, aoutput, clean, createView } from \"./utils.js\";\n/** Choice: a ? b : c */\nexport function Chi(a, b, c) {\n return (a & b) ^ (~a & c);\n}\n/** Majority function, true if any two inputs is true. */\nexport function Maj(a, b, c) {\n return (a & b) ^ (a & c) ^ (b & c);\n}\n/**\n * Merkle-Damgard hash construction base class.\n * Could be used to create MD5, RIPEMD, SHA1, SHA2.\n */\nexport class HashMD {\n blockLen;\n outputLen;\n padOffset;\n isLE;\n // For partial updates less than block size\n buffer;\n view;\n finished = false;\n length = 0;\n pos = 0;\n destroyed = false;\n constructor(blockLen, outputLen, padOffset, isLE) {\n this.blockLen = blockLen;\n this.outputLen = outputLen;\n this.padOffset = padOffset;\n this.isLE = isLE;\n this.buffer = new Uint8Array(blockLen);\n this.view = createView(this.buffer);\n }\n update(data) {\n aexists(this);\n abytes(data);\n const { view, buffer, blockLen } = this;\n const len = data.length;\n for (let pos = 0; pos < len;) {\n const take = Math.min(blockLen - this.pos, len - pos);\n // Fast path: we have at least one block in input, cast it to view and process\n if (take === blockLen) {\n const dataView = createView(data);\n for (; blockLen <= len - pos; pos += blockLen)\n this.process(dataView, pos);\n continue;\n }\n buffer.set(data.subarray(pos, pos + take), this.pos);\n this.pos += take;\n pos += take;\n if (this.pos === blockLen) {\n this.process(view, 0);\n this.pos = 0;\n }\n }\n this.length += data.length;\n this.roundClean();\n return this;\n }\n digestInto(out) {\n aexists(this);\n aoutput(out, this);\n this.finished = true;\n // Padding\n // We can avoid allocation of buffer for padding completely if it\n // was previously not allocated here. But it won't change performance.\n const { buffer, view, blockLen, isLE } = this;\n let { pos } = this;\n // append the bit '1' to the message\n buffer[pos++] = 0b10000000;\n clean(this.buffer.subarray(pos));\n // we have less than padOffset left in buffer, so we cannot put length in\n // current block, need process it and pad again\n if (this.padOffset > blockLen - pos) {\n this.process(view, 0);\n pos = 0;\n }\n // Pad until full block byte with zeros\n for (let i = pos; i < blockLen; i++)\n buffer[i] = 0;\n // Note: sha512 requires length to be 128bit integer, but length in JS will overflow before that\n // You need to write around 2 exabytes (u64_max / 8 / (1024**6)) for this to happen.\n // So we just write lowest 64 bits of that value.\n view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);\n this.process(view, 0);\n const oview = createView(out);\n const len = this.outputLen;\n // NOTE: we do division by 4 later, which must be fused in single op with modulo by JIT\n if (len % 4)\n throw new Error('_sha2: outputLen must be aligned to 32bit');\n const outLen = len / 4;\n const state = this.get();\n if (outLen > state.length)\n throw new Error('_sha2: outputLen bigger than state');\n for (let i = 0; i < outLen; i++)\n oview.setUint32(4 * i, state[i], isLE);\n }\n digest() {\n const { buffer, outputLen } = this;\n this.digestInto(buffer);\n const res = buffer.slice(0, outputLen);\n this.destroy();\n return res;\n }\n _cloneInto(to) {\n to ||= new this.constructor();\n to.set(...this.get());\n const { blockLen, buffer, length, finished, destroyed, pos } = this;\n to.destroyed = destroyed;\n to.finished = finished;\n to.length = length;\n to.pos = pos;\n if (length % blockLen)\n to.buffer.set(buffer);\n return to;\n }\n clone() {\n return this._cloneInto();\n }\n}\n/**\n * Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.\n * Check out `test/misc/sha2-gen-iv.js` for recomputation guide.\n */\n/** Initial SHA256 state. Bits 0..32 of frac part of sqrt of primes 2..19 */\nexport const SHA256_IV = /* @__PURE__ */ Uint32Array.from([\n 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,\n]);\n/** Initial SHA224 state. Bits 32..64 of frac part of sqrt of primes 23..53 */\nexport const SHA224_IV = /* @__PURE__ */ Uint32Array.from([\n 0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939, 0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4,\n]);\n/** Initial SHA384 state. Bits 0..64 of frac part of sqrt of primes 23..53 */\nexport const SHA384_IV = /* @__PURE__ */ Uint32Array.from([\n 0xcbbb9d5d, 0xc1059ed8, 0x629a292a, 0x367cd507, 0x9159015a, 0x3070dd17, 0x152fecd8, 0xf70e5939,\n 0x67332667, 0xffc00b31, 0x8eb44a87, 0x68581511, 0xdb0c2e0d, 0x64f98fa7, 0x47b5481d, 0xbefa4fa4,\n]);\n/** Initial SHA512 state. Bits 0..64 of frac part of sqrt of primes 2..19 */\nexport const SHA512_IV = /* @__PURE__ */ Uint32Array.from([\n 0x6a09e667, 0xf3bcc908, 0xbb67ae85, 0x84caa73b, 0x3c6ef372, 0xfe94f82b, 0xa54ff53a, 0x5f1d36f1,\n 0x510e527f, 0xade682d1, 0x9b05688c, 0x2b3e6c1f, 0x1f83d9ab, 0xfb41bd6b, 0x5be0cd19, 0x137e2179,\n]);\n//# sourceMappingURL=_md.js.map","/**\n * SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.\n * SHA256 is the fastest hash implementable in JS, even faster than Blake3.\n * Check out [RFC 4634](https://www.rfc-editor.org/rfc/rfc4634) and\n * [FIPS 180-4](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf).\n * @module\n */\nimport { Chi, HashMD, Maj, SHA224_IV, SHA256_IV, SHA384_IV, SHA512_IV } from \"./_md.js\";\nimport * as u64 from \"./_u64.js\";\nimport { clean, createHasher, oidNist, rotr } from \"./utils.js\";\n/**\n * Round constants:\n * First 32 bits of fractional parts of the cube roots of the first 64 primes 2..311)\n */\n// prettier-ignore\nconst SHA256_K = /* @__PURE__ */ Uint32Array.from([\n 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,\n 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,\n 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,\n 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,\n 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,\n 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,\n 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,\n 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2\n]);\n/** Reusable temporary buffer. \"W\" comes straight from spec. */\nconst SHA256_W = /* @__PURE__ */ new Uint32Array(64);\n/** Internal 32-byte base SHA2 hash class. */\nclass SHA2_32B extends HashMD {\n constructor(outputLen) {\n super(64, outputLen, 8, false);\n }\n get() {\n const { A, B, C, D, E, F, G, H } = this;\n return [A, B, C, D, E, F, G, H];\n }\n // prettier-ignore\n set(A, B, C, D, E, F, G, H) {\n this.A = A | 0;\n this.B = B | 0;\n this.C = C | 0;\n this.D = D | 0;\n this.E = E | 0;\n this.F = F | 0;\n this.G = G | 0;\n this.H = H | 0;\n }\n process(view, offset) {\n // Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array\n for (let i = 0; i < 16; i++, offset += 4)\n SHA256_W[i] = view.getUint32(offset, false);\n for (let i = 16; i < 64; i++) {\n const W15 = SHA256_W[i - 15];\n const W2 = SHA256_W[i - 2];\n const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ (W15 >>> 3);\n const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ (W2 >>> 10);\n SHA256_W[i] = (s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16]) | 0;\n }\n // Compression function main loop, 64 rounds\n let { A, B, C, D, E, F, G, H } = this;\n for (let i = 0; i < 64; i++) {\n const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);\n const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);\n const T2 = (sigma0 + Maj(A, B, C)) | 0;\n H = G;\n G = F;\n F = E;\n E = (D + T1) | 0;\n D = C;\n C = B;\n B = A;\n A = (T1 + T2) | 0;\n }\n // Add the compressed chunk to the current hash value\n A = (A + this.A) | 0;\n B = (B + this.B) | 0;\n C = (C + this.C) | 0;\n D = (D + this.D) | 0;\n E = (E + this.E) | 0;\n F = (F + this.F) | 0;\n G = (G + this.G) | 0;\n H = (H + this.H) | 0;\n this.set(A, B, C, D, E, F, G, H);\n }\n roundClean() {\n clean(SHA256_W);\n }\n destroy() {\n this.set(0, 0, 0, 0, 0, 0, 0, 0);\n clean(this.buffer);\n }\n}\n/** Internal SHA2-256 hash class. */\nexport class _SHA256 extends SHA2_32B {\n // We cannot use array here since array allows indexing by variable\n // which means optimizer/compiler cannot use registers.\n A = SHA256_IV[0] | 0;\n B = SHA256_IV[1] | 0;\n C = SHA256_IV[2] | 0;\n D = SHA256_IV[3] | 0;\n E = SHA256_IV[4] | 0;\n F = SHA256_IV[5] | 0;\n G = SHA256_IV[6] | 0;\n H = SHA256_IV[7] | 0;\n constructor() {\n super(32);\n }\n}\n/** Internal SHA2-224 hash class. */\nexport class _SHA224 extends SHA2_32B {\n A = SHA224_IV[0] | 0;\n B = SHA224_IV[1] | 0;\n C = SHA224_IV[2] | 0;\n D = SHA224_IV[3] | 0;\n E = SHA224_IV[4] | 0;\n F = SHA224_IV[5] | 0;\n G = SHA224_IV[6] | 0;\n H = SHA224_IV[7] | 0;\n constructor() {\n super(28);\n }\n}\n// SHA2-512 is slower than sha256 in js because u64 operations are slow.\n// Round contants\n// First 32 bits of the fractional parts of the cube roots of the first 80 primes 2..409\n// prettier-ignore\nconst K512 = /* @__PURE__ */ (() => u64.split([\n '0x428a2f98d728ae22', '0x7137449123ef65cd', '0xb5c0fbcfec4d3b2f', '0xe9b5dba58189dbbc',\n '0x3956c25bf348b538', '0x59f111f1b605d019', '0x923f82a4af194f9b', '0xab1c5ed5da6d8118',\n '0xd807aa98a3030242', '0x12835b0145706fbe', '0x243185be4ee4b28c', '0x550c7dc3d5ffb4e2',\n '0x72be5d74f27b896f', '0x80deb1fe3b1696b1', '0x9bdc06a725c71235', '0xc19bf174cf692694',\n '0xe49b69c19ef14ad2', '0xefbe4786384f25e3', '0x0fc19dc68b8cd5b5', '0x240ca1cc77ac9c65',\n '0x2de92c6f592b0275', '0x4a7484aa6ea6e483', '0x5cb0a9dcbd41fbd4', '0x76f988da831153b5',\n '0x983e5152ee66dfab', '0xa831c66d2db43210', '0xb00327c898fb213f', '0xbf597fc7beef0ee4',\n '0xc6e00bf33da88fc2', '0xd5a79147930aa725', '0x06ca6351e003826f', '0x142929670a0e6e70',\n '0x27b70a8546d22ffc', '0x2e1b21385c26c926', '0x4d2c6dfc5ac42aed', '0x53380d139d95b3df',\n '0x650a73548baf63de', '0x766a0abb3c77b2a8', '0x81c2c92e47edaee6', '0x92722c851482353b',\n '0xa2bfe8a14cf10364', '0xa81a664bbc423001', '0xc24b8b70d0f89791', '0xc76c51a30654be30',\n '0xd192e819d6ef5218', '0xd69906245565a910', '0xf40e35855771202a', '0x106aa07032bbd1b8',\n '0x19a4c116b8d2d0c8', '0x1e376c085141ab53', '0x2748774cdf8eeb99', '0x34b0bcb5e19b48a8',\n '0x391c0cb3c5c95a63', '0x4ed8aa4ae3418acb', '0x5b9cca4f7763e373', '0x682e6ff3d6b2b8a3',\n '0x748f82ee5defb2fc', '0x78a5636f43172f60', '0x84c87814a1f0ab72', '0x8cc702081a6439ec',\n '0x90befffa23631e28', '0xa4506cebde82bde9', '0xbef9a3f7b2c67915', '0xc67178f2e372532b',\n '0xca273eceea26619c', '0xd186b8c721c0c207', '0xeada7dd6cde0eb1e', '0xf57d4f7fee6ed178',\n '0x06f067aa72176fba', '0x0a637dc5a2c898a6', '0x113f9804bef90dae', '0x1b710b35131c471b',\n '0x28db77f523047d84', '0x32caab7b40c72493', '0x3c9ebe0a15c9bebc', '0x431d67c49c100d4c',\n '0x4cc5d4becb3e42b6', '0x597f299cfc657e2a', '0x5fcb6fab3ad6faec', '0x6c44198c4a475817'\n].map(n => BigInt(n))))();\nconst SHA512_Kh = /* @__PURE__ */ (() => K512[0])();\nconst SHA512_Kl = /* @__PURE__ */ (() => K512[1])();\n// Reusable temporary buffers\nconst SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);\nconst SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);\n/** Internal 64-byte base SHA2 hash class. */\nclass SHA2_64B extends HashMD {\n constructor(outputLen) {\n super(128, outputLen, 16, false);\n }\n // prettier-ignore\n get() {\n const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];\n }\n // prettier-ignore\n set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {\n this.Ah = Ah | 0;\n this.Al = Al | 0;\n this.Bh = Bh | 0;\n this.Bl = Bl | 0;\n this.Ch = Ch | 0;\n this.Cl = Cl | 0;\n this.Dh = Dh | 0;\n this.Dl = Dl | 0;\n this.Eh = Eh | 0;\n this.El = El | 0;\n this.Fh = Fh | 0;\n this.Fl = Fl | 0;\n this.Gh = Gh | 0;\n this.Gl = Gl | 0;\n this.Hh = Hh | 0;\n this.Hl = Hl | 0;\n }\n process(view, offset) {\n // Extend the first 16 words into the remaining 64 words w[16..79] of the message schedule array\n for (let i = 0; i < 16; i++, offset += 4) {\n SHA512_W_H[i] = view.getUint32(offset);\n SHA512_W_L[i] = view.getUint32((offset += 4));\n }\n for (let i = 16; i < 80; i++) {\n // s0 := (w[i-15] rightrotate 1) xor (w[i-15] rightrotate 8) xor (w[i-15] rightshift 7)\n const W15h = SHA512_W_H[i - 15] | 0;\n const W15l = SHA512_W_L[i - 15] | 0;\n const s0h = u64.rotrSH(W15h, W15l, 1) ^ u64.rotrSH(W15h, W15l, 8) ^ u64.shrSH(W15h, W15l, 7);\n const s0l = u64.rotrSL(W15h, W15l, 1) ^ u64.rotrSL(W15h, W15l, 8) ^ u64.shrSL(W15h, W15l, 7);\n // s1 := (w[i-2] rightrotate 19) xor (w[i-2] rightrotate 61) xor (w[i-2] rightshift 6)\n const W2h = SHA512_W_H[i - 2] | 0;\n const W2l = SHA512_W_L[i - 2] | 0;\n const s1h = u64.rotrSH(W2h, W2l, 19) ^ u64.rotrBH(W2h, W2l, 61) ^ u64.shrSH(W2h, W2l, 6);\n const s1l = u64.rotrSL(W2h, W2l, 19) ^ u64.rotrBL(W2h, W2l, 61) ^ u64.shrSL(W2h, W2l, 6);\n // SHA256_W[i] = s0 + s1 + SHA256_W[i - 7] + SHA256_W[i - 16];\n const SUMl = u64.add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);\n const SUMh = u64.add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);\n SHA512_W_H[i] = SUMh | 0;\n SHA512_W_L[i] = SUMl | 0;\n }\n let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n // Compression function main loop, 80 rounds\n for (let i = 0; i < 80; i++) {\n // S1 := (e rightrotate 14) xor (e rightrotate 18) xor (e rightrotate 41)\n const sigma1h = u64.rotrSH(Eh, El, 14) ^ u64.rotrSH(Eh, El, 18) ^ u64.rotrBH(Eh, El, 41);\n const sigma1l = u64.rotrSL(Eh, El, 14) ^ u64.rotrSL(Eh, El, 18) ^ u64.rotrBL(Eh, El, 41);\n //const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n const CHIh = (Eh & Fh) ^ (~Eh & Gh);\n const CHIl = (El & Fl) ^ (~El & Gl);\n // T1 = H + sigma1 + Chi(E, F, G) + SHA512_K[i] + SHA512_W[i]\n // prettier-ignore\n const T1ll = u64.add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);\n const T1h = u64.add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);\n const T1l = T1ll | 0;\n // S0 := (a rightrotate 28) xor (a rightrotate 34) xor (a rightrotate 39)\n const sigma0h = u64.rotrSH(Ah, Al, 28) ^ u64.rotrBH(Ah, Al, 34) ^ u64.rotrBH(Ah, Al, 39);\n const sigma0l = u64.rotrSL(Ah, Al, 28) ^ u64.rotrBL(Ah, Al, 34) ^ u64.rotrBL(Ah, Al, 39);\n const MAJh = (Ah & Bh) ^ (Ah & Ch) ^ (Bh & Ch);\n const MAJl = (Al & Bl) ^ (Al & Cl) ^ (Bl & Cl);\n Hh = Gh | 0;\n Hl = Gl | 0;\n Gh = Fh | 0;\n Gl = Fl | 0;\n Fh = Eh | 0;\n Fl = El | 0;\n ({ h: Eh, l: El } = u64.add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));\n Dh = Ch | 0;\n Dl = Cl | 0;\n Ch = Bh | 0;\n Cl = Bl | 0;\n Bh = Ah | 0;\n Bl = Al | 0;\n const All = u64.add3L(T1l, sigma0l, MAJl);\n Ah = u64.add3H(All, T1h, sigma0h, MAJh);\n Al = All | 0;\n }\n // Add the compressed chunk to the current hash value\n ({ h: Ah, l: Al } = u64.add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));\n ({ h: Bh, l: Bl } = u64.add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));\n ({ h: Ch, l: Cl } = u64.add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));\n ({ h: Dh, l: Dl } = u64.add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));\n ({ h: Eh, l: El } = u64.add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));\n ({ h: Fh, l: Fl } = u64.add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));\n ({ h: Gh, l: Gl } = u64.add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));\n ({ h: Hh, l: Hl } = u64.add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));\n this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);\n }\n roundClean() {\n clean(SHA512_W_H, SHA512_W_L);\n }\n destroy() {\n clean(this.buffer);\n this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);\n }\n}\n/** Internal SHA2-512 hash class. */\nexport class _SHA512 extends SHA2_64B {\n Ah = SHA512_IV[0] | 0;\n Al = SHA512_IV[1] | 0;\n Bh = SHA512_IV[2] | 0;\n Bl = SHA512_IV[3] | 0;\n Ch = SHA512_IV[4] | 0;\n Cl = SHA512_IV[5] | 0;\n Dh = SHA512_IV[6] | 0;\n Dl = SHA512_IV[7] | 0;\n Eh = SHA512_IV[8] | 0;\n El = SHA512_IV[9] | 0;\n Fh = SHA512_IV[10] | 0;\n Fl = SHA512_IV[11] | 0;\n Gh = SHA512_IV[12] | 0;\n Gl = SHA512_IV[13] | 0;\n Hh = SHA512_IV[14] | 0;\n Hl = SHA512_IV[15] | 0;\n constructor() {\n super(64);\n }\n}\n/** Internal SHA2-384 hash class. */\nexport class _SHA384 extends SHA2_64B {\n Ah = SHA384_IV[0] | 0;\n Al = SHA384_IV[1] | 0;\n Bh = SHA384_IV[2] | 0;\n Bl = SHA384_IV[3] | 0;\n Ch = SHA384_IV[4] | 0;\n Cl = SHA384_IV[5] | 0;\n Dh = SHA384_IV[6] | 0;\n Dl = SHA384_IV[7] | 0;\n Eh = SHA384_IV[8] | 0;\n El = SHA384_IV[9] | 0;\n Fh = SHA384_IV[10] | 0;\n Fl = SHA384_IV[11] | 0;\n Gh = SHA384_IV[12] | 0;\n Gl = SHA384_IV[13] | 0;\n Hh = SHA384_IV[14] | 0;\n Hl = SHA384_IV[15] | 0;\n constructor() {\n super(48);\n }\n}\n/**\n * Truncated SHA512/256 and SHA512/224.\n * SHA512_IV is XORed with 0xa5a5a5a5a5a5a5a5, then used as \"intermediary\" IV of SHA512/t.\n * Then t hashes string to produce result IV.\n * See `test/misc/sha2-gen-iv.js`.\n */\n/** SHA512/224 IV */\nconst T224_IV = /* @__PURE__ */ Uint32Array.from([\n 0x8c3d37c8, 0x19544da2, 0x73e19966, 0x89dcd4d6, 0x1dfab7ae, 0x32ff9c82, 0x679dd514, 0x582f9fcf,\n 0x0f6d2b69, 0x7bd44da8, 0x77e36f73, 0x04c48942, 0x3f9d85a8, 0x6a1d36c8, 0x1112e6ad, 0x91d692a1,\n]);\n/** SHA512/256 IV */\nconst T256_IV = /* @__PURE__ */ Uint32Array.from([\n 0x22312194, 0xfc2bf72c, 0x9f555fa3, 0xc84c64c2, 0x2393b86b, 0x6f53b151, 0x96387719, 0x5940eabd,\n 0x96283ee2, 0xa88effe3, 0xbe5e1e25, 0x53863992, 0x2b0199fc, 0x2c85b8aa, 0x0eb72ddc, 0x81c52ca2,\n]);\n/** Internal SHA2-512/224 hash class. */\nexport class _SHA512_224 extends SHA2_64B {\n Ah = T224_IV[0] | 0;\n Al = T224_IV[1] | 0;\n Bh = T224_IV[2] | 0;\n Bl = T224_IV[3] | 0;\n Ch = T224_IV[4] | 0;\n Cl = T224_IV[5] | 0;\n Dh = T224_IV[6] | 0;\n Dl = T224_IV[7] | 0;\n Eh = T224_IV[8] | 0;\n El = T224_IV[9] | 0;\n Fh = T224_IV[10] | 0;\n Fl = T224_IV[11] | 0;\n Gh = T224_IV[12] | 0;\n Gl = T224_IV[13] | 0;\n Hh = T224_IV[14] | 0;\n Hl = T224_IV[15] | 0;\n constructor() {\n super(28);\n }\n}\n/** Internal SHA2-512/256 hash class. */\nexport class _SHA512_256 extends SHA2_64B {\n Ah = T256_IV[0] | 0;\n Al = T256_IV[1] | 0;\n Bh = T256_IV[2] | 0;\n Bl = T256_IV[3] | 0;\n Ch = T256_IV[4] | 0;\n Cl = T256_IV[5] | 0;\n Dh = T256_IV[6] | 0;\n Dl = T256_IV[7] | 0;\n Eh = T256_IV[8] | 0;\n El = T256_IV[9] | 0;\n Fh = T256_IV[10] | 0;\n Fl = T256_IV[11] | 0;\n Gh = T256_IV[12] | 0;\n Gl = T256_IV[13] | 0;\n Hh = T256_IV[14] | 0;\n Hl = T256_IV[15] | 0;\n constructor() {\n super(32);\n }\n}\n/**\n * SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info:\n *\n * - Trying 2^128 hashes would get 50% chance of collision, using birthday attack.\n * - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.\n * - Each sha256 hash is executing 2^18 bit operations.\n * - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.\n */\nexport const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), \n/* @__PURE__ */ oidNist(0x01));\n/** SHA2-224 hash function from RFC 4634 */\nexport const sha224 = /* @__PURE__ */ createHasher(() => new _SHA224(), \n/* @__PURE__ */ oidNist(0x04));\n/** SHA2-512 hash function from RFC 4634. */\nexport const sha512 = /* @__PURE__ */ createHasher(() => new _SHA512(), \n/* @__PURE__ */ oidNist(0x03));\n/** SHA2-384 hash function from RFC 4634. */\nexport const sha384 = /* @__PURE__ */ createHasher(() => new _SHA384(), \n/* @__PURE__ */ oidNist(0x02));\n/**\n * SHA2-512/256 \"truncated\" hash function, with improved resistance to length extension attacks.\n * See the paper on [truncated SHA512](https://eprint.iacr.org/2010/548.pdf).\n */\nexport const sha512_256 = /* @__PURE__ */ createHasher(() => new _SHA512_256(), \n/* @__PURE__ */ oidNist(0x06));\n/**\n * SHA2-512/224 \"truncated\" hash function, with improved resistance to length extension attacks.\n * See the paper on [truncated SHA512](https://eprint.iacr.org/2010/548.pdf).\n */\nexport const sha512_224 = /* @__PURE__ */ createHasher(() => new _SHA512_224(), \n/* @__PURE__ */ oidNist(0x05));\n//# sourceMappingURL=sha2.js.map","/**\n * Hex, bytes and number utilities.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { abytes as abytes_, anumber, bytesToHex as bytesToHex_, concatBytes as concatBytes_, hexToBytes as hexToBytes_, } from '@noble/hashes/utils.js';\nexport { abytes, anumber, bytesToHex, concatBytes, hexToBytes, isBytes, randomBytes, } from '@noble/hashes/utils.js';\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\nexport function abool(value, title = '') {\n if (typeof value !== 'boolean') {\n const prefix = title && `\"${title}\" `;\n throw new Error(prefix + 'expected boolean, got type=' + typeof value);\n }\n return value;\n}\n// Used in weierstrass, der\nfunction abignumber(n) {\n if (typeof n === 'bigint') {\n if (!isPosBig(n))\n throw new Error('positive bigint expected, got ' + n);\n }\n else\n anumber(n);\n return n;\n}\nexport function asafenumber(value, title = '') {\n if (!Number.isSafeInteger(value)) {\n const prefix = title && `\"${title}\" `;\n throw new Error(prefix + 'expected safe integer, got type=' + typeof value);\n }\n}\nexport function numberToHexUnpadded(num) {\n const hex = abignumber(num).toString(16);\n return hex.length & 1 ? '0' + hex : hex;\n}\nexport function hexToNumber(hex) {\n if (typeof hex !== 'string')\n throw new Error('hex string expected, got ' + typeof hex);\n return hex === '' ? _0n : BigInt('0x' + hex); // Big Endian\n}\n// BE: Big Endian, LE: Little Endian\nexport function bytesToNumberBE(bytes) {\n return hexToNumber(bytesToHex_(bytes));\n}\nexport function bytesToNumberLE(bytes) {\n return hexToNumber(bytesToHex_(copyBytes(abytes_(bytes)).reverse()));\n}\nexport function numberToBytesBE(n, len) {\n anumber(len);\n n = abignumber(n);\n const res = hexToBytes_(n.toString(16).padStart(len * 2, '0'));\n if (res.length !== len)\n throw new Error('number too large');\n return res;\n}\nexport function numberToBytesLE(n, len) {\n return numberToBytesBE(n, len).reverse();\n}\n// Unpadded, rarely used\nexport function numberToVarBytesBE(n) {\n return hexToBytes_(numberToHexUnpadded(abignumber(n)));\n}\n// Compares 2 u8a-s in kinda constant time\nexport function equalBytes(a, b) {\n if (a.length !== b.length)\n return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++)\n diff |= a[i] ^ b[i];\n return diff === 0;\n}\n/**\n * Copies Uint8Array. We can't use u8a.slice(), because u8a can be Buffer,\n * and Buffer#slice creates mutable copy. Never use Buffers!\n */\nexport function copyBytes(bytes) {\n return Uint8Array.from(bytes);\n}\n/**\n * Decodes 7-bit ASCII string to Uint8Array, throws on non-ascii symbols\n * Should be safe to use for things expected to be ASCII.\n * Returns exact same result as `TextEncoder` for ASCII or throws.\n */\nexport function asciiToBytes(ascii) {\n return Uint8Array.from(ascii, (c, i) => {\n const charCode = c.charCodeAt(0);\n if (c.length !== 1 || charCode > 127) {\n throw new Error(`string contains non-ASCII character \"${ascii[i]}\" with code ${charCode} at position ${i}`);\n }\n return charCode;\n });\n}\n// Is positive bigint\nconst isPosBig = (n) => typeof n === 'bigint' && _0n <= n;\nexport function inRange(n, min, max) {\n return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;\n}\n/**\n * Asserts min <= n < max. NOTE: It's < max and not <= max.\n * @example\n * aInRange('x', x, 1n, 256n); // would assume x is in (1n..255n)\n */\nexport function aInRange(title, n, min, max) {\n // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)?\n // consider P=256n, min=0n, max=P\n // - a for min=0 would require -1: `inRange('x', x, -1n, P)`\n // - b would commonly require subtraction: `inRange('x', x, 0n, P - 1n)`\n // - our way is the cleanest: `inRange('x', x, 0n, P)\n if (!inRange(n, min, max))\n throw new Error('expected valid ' + title + ': ' + min + ' <= n < ' + max + ', got ' + n);\n}\n// Bit operations\n/**\n * Calculates amount of bits in a bigint.\n * Same as `n.toString(2).length`\n * TODO: merge with nLength in modular\n */\nexport function bitLen(n) {\n let len;\n for (len = 0; n > _0n; n >>= _1n, len += 1)\n ;\n return len;\n}\n/**\n * Gets single bit at position.\n * NOTE: first bit position is 0 (same as arrays)\n * Same as `!!+Array.from(n.toString(2)).reverse()[pos]`\n */\nexport function bitGet(n, pos) {\n return (n >> BigInt(pos)) & _1n;\n}\n/**\n * Sets single bit at position.\n */\nexport function bitSet(n, pos, value) {\n return n | ((value ? _1n : _0n) << BigInt(pos));\n}\n/**\n * Calculate mask for N bits. Not using ** operator with bigints because of old engines.\n * Same as BigInt(`0b${Array(i).fill('1').join('')}`)\n */\nexport const bitMask = (n) => (_1n << BigInt(n)) - _1n;\n/**\n * Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n * @returns function that will call DRBG until 2nd arg returns something meaningful\n * @example\n * const drbg = createHmacDRBG<Key>(32, 32, hmac);\n * drbg(seed, bytesToKey); // bytesToKey must return Key or undefined\n */\nexport function createHmacDrbg(hashLen, qByteLen, hmacFn) {\n anumber(hashLen, 'hashLen');\n anumber(qByteLen, 'qByteLen');\n if (typeof hmacFn !== 'function')\n throw new Error('hmacFn must be a function');\n const u8n = (len) => new Uint8Array(len); // creates Uint8Array\n const NULL = Uint8Array.of();\n const byte0 = Uint8Array.of(0x00);\n const byte1 = Uint8Array.of(0x01);\n const _maxDrbgIters = 1000;\n // Step B, Step C: set hashLen to 8*ceil(hlen/8)\n let v = u8n(hashLen); // Minimal non-full-spec HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n let k = u8n(hashLen); // Steps B and C of RFC6979 3.2: set hashLen, in our case always same\n let i = 0; // Iterations counter, will throw when over 1000\n const reset = () => {\n v.fill(1);\n k.fill(0);\n i = 0;\n };\n const h = (...msgs) => hmacFn(k, concatBytes_(v, ...msgs)); // hmac(k)(v, ...values)\n const reseed = (seed = NULL) => {\n // HMAC-DRBG reseed() function. Steps D-G\n k = h(byte0, seed); // k = hmac(k || v || 0x00 || seed)\n v = h(); // v = hmac(k || v)\n if (seed.length === 0)\n return;\n k = h(byte1, seed); // k = hmac(k || v || 0x01 || seed)\n v = h(); // v = hmac(k || v)\n };\n const gen = () => {\n // HMAC-DRBG generate() function\n if (i++ >= _maxDrbgIters)\n throw new Error('drbg: tried max amount of iterations');\n let len = 0;\n const out = [];\n while (len < qByteLen) {\n v = h();\n const sl = v.slice();\n out.push(sl);\n len += v.length;\n }\n return concatBytes_(...out);\n };\n const genUntil = (seed, pred) => {\n reset();\n reseed(seed); // Steps D-G\n let res = undefined; // Step H: grind until k is in [1..n-1]\n while (!(res = pred(gen())))\n reseed();\n reset();\n return res;\n };\n return genUntil;\n}\nexport function validateObject(object, fields = {}, optFields = {}) {\n if (!object || typeof object !== 'object')\n throw new Error('expected valid options object');\n function checkField(fieldName, expectedType, isOpt) {\n const val = object[fieldName];\n if (isOpt && val === undefined)\n return;\n const current = typeof val;\n if (current !== expectedType || val === null)\n throw new Error(`param \"${fieldName}\" is invalid: expected ${expectedType}, got ${current}`);\n }\n const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));\n iter(fields, false);\n iter(optFields, true);\n}\n/**\n * throws not implemented error\n */\nexport const notImplemented = () => {\n throw new Error('not implemented');\n};\n/**\n * Memoizes (caches) computation result.\n * Uses WeakMap: the value is going auto-cleaned by GC after last reference is removed.\n */\nexport function memoized(fn) {\n const map = new WeakMap();\n return (arg, ...args) => {\n const val = map.get(arg);\n if (val !== undefined)\n return val;\n const computed = fn(arg, ...args);\n map.set(arg, computed);\n return computed;\n };\n}\n//# sourceMappingURL=utils.js.map","/**\n * Utils for modular division and fields.\n * Field over 11 is a finite (Galois) field is integer number operations `mod 11`.\n * There is no division: it is replaced by modular multiplicative inverse.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { abytes, anumber, bytesToNumberBE, bytesToNumberLE, numberToBytesBE, numberToBytesLE, validateObject, } from \"../utils.js\";\n// Numbers aren't used in x25519 / x448 builds\n// prettier-ignore\nconst _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2);\n// prettier-ignore\nconst _3n = /* @__PURE__ */ BigInt(3), _4n = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5);\n// prettier-ignore\nconst _7n = /* @__PURE__ */ BigInt(7), _8n = /* @__PURE__ */ BigInt(8), _9n = /* @__PURE__ */ BigInt(9);\nconst _16n = /* @__PURE__ */ BigInt(16);\n// Calculates a modulo b\nexport function mod(a, b) {\n const result = a % b;\n return result >= _0n ? result : b + result;\n}\n/**\n * Efficiently raise num to power and do modular division.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * @example\n * pow(2n, 6n, 11n) // 64n % 11n == 9n\n */\nexport function pow(num, power, modulo) {\n return FpPow(Field(modulo), num, power);\n}\n/** Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)` */\nexport function pow2(x, power, modulo) {\n let res = x;\n while (power-- > _0n) {\n res *= res;\n res %= modulo;\n }\n return res;\n}\n/**\n * Inverses number over modulo.\n * Implemented using [Euclidean GCD](https://brilliant.org/wiki/extended-euclidean-algorithm/).\n */\nexport function invert(number, modulo) {\n if (number === _0n)\n throw new Error('invert: expected non-zero number');\n if (modulo <= _0n)\n throw new Error('invert: expected positive modulus, got ' + modulo);\n // Fermat's little theorem \"CT-like\" version inv(n) = n^(m-2) mod m is 30x slower.\n let a = mod(number, modulo);\n let b = modulo;\n // prettier-ignore\n let x = _0n, y = _1n, u = _1n, v = _0n;\n while (a !== _0n) {\n // JIT applies optimization if those two lines follow each other\n const q = b / a;\n const r = b % a;\n const m = x - u * q;\n const n = y - v * q;\n // prettier-ignore\n b = a, a = r, x = u, y = v, u = m, v = n;\n }\n const gcd = b;\n if (gcd !== _1n)\n throw new Error('invert: does not exist');\n return mod(x, modulo);\n}\nfunction assertIsSquare(Fp, root, n) {\n if (!Fp.eql(Fp.sqr(root), n))\n throw new Error('Cannot find square root');\n}\n// Not all roots are possible! Example which will throw:\n// const NUM =\n// n = 72057594037927816n;\n// Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'));\nfunction sqrt3mod4(Fp, n) {\n const p1div4 = (Fp.ORDER + _1n) / _4n;\n const root = Fp.pow(n, p1div4);\n assertIsSquare(Fp, root, n);\n return root;\n}\nfunction sqrt5mod8(Fp, n) {\n const p5div8 = (Fp.ORDER - _5n) / _8n;\n const n2 = Fp.mul(n, _2n);\n const v = Fp.pow(n2, p5div8);\n const nv = Fp.mul(n, v);\n const i = Fp.mul(Fp.mul(nv, _2n), v);\n const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));\n assertIsSquare(Fp, root, n);\n return root;\n}\n// Based on RFC9380, Kong algorithm\n// prettier-ignore\nfunction sqrt9mod16(P) {\n const Fp_ = Field(P);\n const tn = tonelliShanks(P);\n const c1 = tn(Fp_, Fp_.neg(Fp_.ONE)); // 1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F\n const c2 = tn(Fp_, c1); // 2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F\n const c3 = tn(Fp_, Fp_.neg(c1)); // 3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F\n const c4 = (P + _7n) / _16n; // 4. c4 = (q + 7) / 16 # Integer arithmetic\n return (Fp, n) => {\n let tv1 = Fp.pow(n, c4); // 1. tv1 = x^c4\n let tv2 = Fp.mul(tv1, c1); // 2. tv2 = c1 * tv1\n const tv3 = Fp.mul(tv1, c2); // 3. tv3 = c2 * tv1\n const tv4 = Fp.mul(tv1, c3); // 4. tv4 = c3 * tv1\n const e1 = Fp.eql(Fp.sqr(tv2), n); // 5. e1 = (tv2^2) == x\n const e2 = Fp.eql(Fp.sqr(tv3), n); // 6. e2 = (tv3^2) == x\n tv1 = Fp.cmov(tv1, tv2, e1); // 7. tv1 = CMOV(tv1, tv2, e1) # Select tv2 if (tv2^2) == x\n tv2 = Fp.cmov(tv4, tv3, e2); // 8. tv2 = CMOV(tv4, tv3, e2) # Select tv3 if (tv3^2) == x\n const e3 = Fp.eql(Fp.sqr(tv2), n); // 9. e3 = (tv2^2) == x\n const root = Fp.cmov(tv1, tv2, e3); // 10. z = CMOV(tv1, tv2, e3) # Select sqrt from tv1 & tv2\n assertIsSquare(Fp, root, n);\n return root;\n };\n}\n/**\n * Tonelli-Shanks square root search algorithm.\n * 1. https://eprint.iacr.org/2012/685.pdf (page 12)\n * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks\n * @param P field order\n * @returns function that takes field Fp (created from P) and number n\n */\nexport function tonelliShanks(P) {\n // Initialization (precomputation).\n // Caching initialization could boost perf by 7%.\n if (P < _3n)\n throw new Error('sqrt is not defined for small field');\n // Factor P - 1 = Q * 2^S, where Q is odd\n let Q = P - _1n;\n let S = 0;\n while (Q % _2n === _0n) {\n Q /= _2n;\n S++;\n }\n // Find the first quadratic non-residue Z >= 2\n let Z = _2n;\n const _Fp = Field(P);\n while (FpLegendre(_Fp, Z) === 1) {\n // Basic primality test for P. After x iterations, chance of\n // not finding quadratic non-residue is 2^x, so 2^1000.\n if (Z++ > 1000)\n throw new Error('Cannot find square root: probably non-prime P');\n }\n // Fast-path; usually done before Z, but we do \"primality test\".\n if (S === 1)\n return sqrt3mod4;\n // Slow-path\n // TODO: test on Fp2 and others\n let cc = _Fp.pow(Z, Q); // c = z^Q\n const Q1div2 = (Q + _1n) / _2n;\n return function tonelliSlow(Fp, n) {\n if (Fp.is0(n))\n return n;\n // Check if n is a quadratic residue using Legendre symbol\n if (FpLegendre(Fp, n) !== 1)\n throw new Error('Cannot find square root');\n // Initialize variables for the main loop\n let M = S;\n let c = Fp.mul(Fp.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp\n let t = Fp.pow(n, Q); // t = n^Q, first guess at the fudge factor\n let R = Fp.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root\n // Main loop\n // while t != 1\n while (!Fp.eql(t, Fp.ONE)) {\n if (Fp.is0(t))\n return Fp.ZERO; // if t=0 return R=0\n let i = 1;\n // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P)\n let t_tmp = Fp.sqr(t); // t^(2^1)\n while (!Fp.eql(t_tmp, Fp.ONE)) {\n i++;\n t_tmp = Fp.sqr(t_tmp); // t^(2^2)...\n if (i === M)\n throw new Error('Cannot find square root');\n }\n // Calculate the exponent for b: 2^(M - i - 1)\n const exponent = _1n << BigInt(M - i - 1); // bigint is important\n const b = Fp.pow(c, exponent); // b = 2^(M - i - 1)\n // Update variables\n M = i;\n c = Fp.sqr(b); // c = b^2\n t = Fp.mul(t, c); // t = (t * b^2)\n R = Fp.mul(R, b); // R = R*b\n }\n return R;\n };\n}\n/**\n * Square root for a finite field. Will try optimized versions first:\n *\n * 1. P ≡ 3 (mod 4)\n * 2. P ≡ 5 (mod 8)\n * 3. P ≡ 9 (mod 16)\n * 4. Tonelli-Shanks algorithm\n *\n * Different algorithms can give different roots, it is up to user to decide which one they want.\n * For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).\n */\nexport function FpSqrt(P) {\n // P ≡ 3 (mod 4) => √n = n^((P+1)/4)\n if (P % _4n === _3n)\n return sqrt3mod4;\n // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf\n if (P % _8n === _5n)\n return sqrt5mod8;\n // P ≡ 9 (mod 16) => Kong algorithm, page 11 of https://eprint.iacr.org/2012/685.pdf (algorithm 4)\n if (P % _16n === _9n)\n return sqrt9mod16(P);\n // Tonelli-Shanks algorithm\n return tonelliShanks(P);\n}\n// Little-endian check for first LE bit (last BE bit);\nexport const isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n) === _1n;\n// prettier-ignore\nconst FIELD_FIELDS = [\n 'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',\n 'eql', 'add', 'sub', 'mul', 'pow', 'div',\n 'addN', 'subN', 'mulN', 'sqrN'\n];\nexport function validateField(field) {\n const initial = {\n ORDER: 'bigint',\n BYTES: 'number',\n BITS: 'number',\n };\n const opts = FIELD_FIELDS.reduce((map, val) => {\n map[val] = 'function';\n return map;\n }, initial);\n validateObject(field, opts);\n // const max = 16384;\n // if (field.BYTES < 1 || field.BYTES > max) throw new Error('invalid field');\n // if (field.BITS < 1 || field.BITS > 8 * max) throw new Error('invalid field');\n return field;\n}\n// Generic field functions\n/**\n * Same as `pow` but for Fp: non-constant-time.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n */\nexport function FpPow(Fp, num, power) {\n if (power < _0n)\n throw new Error('invalid exponent, negatives unsupported');\n if (power === _0n)\n return Fp.ONE;\n if (power === _1n)\n return num;\n let p = Fp.ONE;\n let d = num;\n while (power > _0n) {\n if (power & _1n)\n p = Fp.mul(p, d);\n d = Fp.sqr(d);\n power >>= _1n;\n }\n return p;\n}\n/**\n * Efficiently invert an array of Field elements.\n * Exception-free. Will return `undefined` for 0 elements.\n * @param passZero map 0 to 0 (instead of undefined)\n */\nexport function FpInvertBatch(Fp, nums, passZero = false) {\n const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : undefined);\n // Walk from first to last, multiply them by each other MOD p\n const multipliedAcc = nums.reduce((acc, num, i) => {\n if (Fp.is0(num))\n return acc;\n inverted[i] = acc;\n return Fp.mul(acc, num);\n }, Fp.ONE);\n // Invert last element\n const invertedAcc = Fp.inv(multipliedAcc);\n // Walk from last to first, multiply them by inverted each other MOD p\n nums.reduceRight((acc, num, i) => {\n if (Fp.is0(num))\n return acc;\n inverted[i] = Fp.mul(acc, inverted[i]);\n return Fp.mul(acc, num);\n }, invertedAcc);\n return inverted;\n}\n// TODO: remove\nexport function FpDiv(Fp, lhs, rhs) {\n return Fp.mul(lhs, typeof rhs === 'bigint' ? invert(rhs, Fp.ORDER) : Fp.inv(rhs));\n}\n/**\n * Legendre symbol.\n * Legendre constant is used to calculate Legendre symbol (a | p)\n * which denotes the value of a^((p-1)/2) (mod p).\n *\n * * (a | p) ≡ 1 if a is a square (mod p), quadratic residue\n * * (a | p) ≡ -1 if a is not a square (mod p), quadratic non residue\n * * (a | p) ≡ 0 if a ≡ 0 (mod p)\n */\nexport function FpLegendre(Fp, n) {\n // We can use 3rd argument as optional cache of this value\n // but seems unneeded for now. The operation is very fast.\n const p1mod2 = (Fp.ORDER - _1n) / _2n;\n const powered = Fp.pow(n, p1mod2);\n const yes = Fp.eql(powered, Fp.ONE);\n const zero = Fp.eql(powered, Fp.ZERO);\n const no = Fp.eql(powered, Fp.neg(Fp.ONE));\n if (!yes && !zero && !no)\n throw new Error('invalid Legendre symbol result');\n return yes ? 1 : zero ? 0 : -1;\n}\n// This function returns True whenever the value x is a square in the field F.\nexport function FpIsSquare(Fp, n) {\n const l = FpLegendre(Fp, n);\n return l === 1;\n}\n// CURVE.n lengths\nexport function nLength(n, nBitLength) {\n // Bit size, byte size of CURVE.n\n if (nBitLength !== undefined)\n anumber(nBitLength);\n const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length;\n const nByteLength = Math.ceil(_nBitLength / 8);\n return { nBitLength: _nBitLength, nByteLength };\n}\nclass _Field {\n ORDER;\n BITS;\n BYTES;\n isLE;\n ZERO = _0n;\n ONE = _1n;\n _lengths;\n _sqrt; // cached sqrt\n _mod;\n constructor(ORDER, opts = {}) {\n if (ORDER <= _0n)\n throw new Error('invalid field: expected ORDER > 0, got ' + ORDER);\n let _nbitLength = undefined;\n this.isLE = false;\n if (opts != null && typeof opts === 'object') {\n if (typeof opts.BITS === 'number')\n _nbitLength = opts.BITS;\n if (typeof opts.sqrt === 'function')\n this.sqrt = opts.sqrt;\n if (typeof opts.isLE === 'boolean')\n this.isLE = opts.isLE;\n if (opts.allowedLengths)\n this._lengths = opts.allowedLengths?.slice();\n if (typeof opts.modFromBytes === 'boolean')\n this._mod = opts.modFromBytes;\n }\n const { nBitLength, nByteLength } = nLength(ORDER, _nbitLength);\n if (nByteLength > 2048)\n throw new Error('invalid field: expected ORDER of <= 2048 bytes');\n this.ORDER = ORDER;\n this.BITS = nBitLength;\n this.BYTES = nByteLength;\n this._sqrt = undefined;\n Object.preventExtensions(this);\n }\n create(num) {\n return mod(num, this.ORDER);\n }\n isValid(num) {\n if (typeof num !== 'bigint')\n throw new Error('invalid field element: expected bigint, got ' + typeof num);\n return _0n <= num && num < this.ORDER; // 0 is valid element, but it's not invertible\n }\n is0(num) {\n return num === _0n;\n }\n // is valid and invertible\n isValidNot0(num) {\n return !this.is0(num) && this.isValid(num);\n }\n isOdd(num) {\n return (num & _1n) === _1n;\n }\n neg(num) {\n return mod(-num, this.ORDER);\n }\n eql(lhs, rhs) {\n return lhs === rhs;\n }\n sqr(num) {\n return mod(num * num, this.ORDER);\n }\n add(lhs, rhs) {\n return mod(lhs + rhs, this.ORDER);\n }\n sub(lhs, rhs) {\n return mod(lhs - rhs, this.ORDER);\n }\n mul(lhs, rhs) {\n return mod(lhs * rhs, this.ORDER);\n }\n pow(num, power) {\n return FpPow(this, num, power);\n }\n div(lhs, rhs) {\n return mod(lhs * invert(rhs, this.ORDER), this.ORDER);\n }\n // Same as above, but doesn't normalize\n sqrN(num) {\n return num * num;\n }\n addN(lhs, rhs) {\n return lhs + rhs;\n }\n subN(lhs, rhs) {\n return lhs - rhs;\n }\n mulN(lhs, rhs) {\n return lhs * rhs;\n }\n inv(num) {\n return invert(num, this.ORDER);\n }\n sqrt(num) {\n // Caching _sqrt speeds up sqrt9mod16 by 5x and tonneli-shanks by 10%\n if (!this._sqrt)\n this._sqrt = FpSqrt(this.ORDER);\n return this._sqrt(this, num);\n }\n toBytes(num) {\n return this.isLE ? numberToBytesLE(num, this.BYTES) : numberToBytesBE(num, this.BYTES);\n }\n fromBytes(bytes, skipValidation = false) {\n abytes(bytes);\n const { _lengths: allowedLengths, BYTES, isLE, ORDER, _mod: modFromBytes } = this;\n if (allowedLengths) {\n if (!allowedLengths.includes(bytes.length) || bytes.length > BYTES) {\n throw new Error('Field.fromBytes: expected ' + allowedLengths + ' bytes, got ' + bytes.length);\n }\n const padded = new Uint8Array(BYTES);\n // isLE add 0 to right, !isLE to the left.\n padded.set(bytes, isLE ? 0 : padded.length - bytes.length);\n bytes = padded;\n }\n if (bytes.length !== BYTES)\n throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);\n let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n if (modFromBytes)\n scalar = mod(scalar, ORDER);\n if (!skipValidation)\n if (!this.isValid(scalar))\n throw new Error('invalid field element: outside of range 0..ORDER');\n // NOTE: we don't validate scalar here, please use isValid. This done such way because some\n // protocol may allow non-reduced scalar that reduced later or changed some other way.\n return scalar;\n }\n // TODO: we don't need it here, move out to separate fn\n invertBatch(lst) {\n return FpInvertBatch(this, lst);\n }\n // We can't move this out because Fp6, Fp12 implement it\n // and it's unclear what to return in there.\n cmov(a, b, condition) {\n return condition ? b : a;\n }\n}\n/**\n * Creates a finite field. Major performance optimizations:\n * * 1. Denormalized operations like mulN instead of mul.\n * * 2. Identical object shape: never add or remove keys.\n * * 3. `Object.freeze`.\n * Fragile: always run a benchmark on a change.\n * Security note: operations don't check 'isValid' for all elements for performance reasons,\n * it is caller responsibility to check this.\n * This is low-level code, please make sure you know what you're doing.\n *\n * Note about field properties:\n * * CHARACTERISTIC p = prime number, number of elements in main subgroup.\n * * ORDER q = similar to cofactor in curves, may be composite `q = p^m`.\n *\n * @param ORDER field order, probably prime, or could be composite\n * @param bitLen how many bits the field consumes\n * @param isLE (default: false) if encoding / decoding should be in little-endian\n * @param redef optional faster redefinitions of sqrt and other methods\n */\nexport function Field(ORDER, opts = {}) {\n return new _Field(ORDER, opts);\n}\n// Generic random scalar, we can do same for other fields if via Fp2.mul(Fp2.ONE, Fp2.random)?\n// This allows unsafe methods like ignore bias or zero. These unsafe, but often used in different protocols (if deterministic RNG).\n// which mean we cannot force this via opts.\n// Not sure what to do with randomBytes, we can accept it inside opts if wanted.\n// Probably need to export getMinHashLength somewhere?\n// random(bytes?: Uint8Array, unsafeAllowZero = false, unsafeAllowBias = false) {\n// const LEN = !unsafeAllowBias ? getMinHashLength(ORDER) : BYTES;\n// if (bytes === undefined) bytes = randomBytes(LEN); // _opts.randomBytes?\n// const num = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n// // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n// const reduced = unsafeAllowZero ? mod(num, ORDER) : mod(num, ORDER - _1n) + _1n;\n// return reduced;\n// },\nexport function FpSqrtOdd(Fp, elm) {\n if (!Fp.isOdd)\n throw new Error(\"Field doesn't have isOdd\");\n const root = Fp.sqrt(elm);\n return Fp.isOdd(root) ? root : Fp.neg(root);\n}\nexport function FpSqrtEven(Fp, elm) {\n if (!Fp.isOdd)\n throw new Error(\"Field doesn't have isOdd\");\n const root = Fp.sqrt(elm);\n return Fp.isOdd(root) ? Fp.neg(root) : root;\n}\n/**\n * Returns total number of bytes consumed by the field element.\n * For example, 32 bytes for usual 256-bit weierstrass curve.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of field\n */\nexport function getFieldBytesLength(fieldOrder) {\n if (typeof fieldOrder !== 'bigint')\n throw new Error('field order must be bigint');\n const bitLength = fieldOrder.toString(2).length;\n return Math.ceil(bitLength / 8);\n}\n/**\n * Returns minimal amount of bytes that can be safely reduced\n * by field order.\n * Should be 2^-128 for 128-bit curve such as P256.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of target hash\n */\nexport function getMinHashLength(fieldOrder) {\n const length = getFieldBytesLength(fieldOrder);\n return length + Math.ceil(length / 2);\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF\n * and convert them into private scalar, with the modulo bias being negligible.\n * Needs at least 48 bytes of input for 32-byte private key.\n * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/\n * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final\n * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5\n * @param hash hash output from SHA3 or a similar function\n * @param groupOrder size of subgroup - (e.g. secp256k1.Point.Fn.ORDER)\n * @param isLE interpret hash bytes as LE num\n * @returns valid private scalar\n */\nexport function mapHashToField(key, fieldOrder, isLE = false) {\n abytes(key);\n const len = key.length;\n const fieldLen = getFieldBytesLength(fieldOrder);\n const minLen = getMinHashLength(fieldOrder);\n // No small numbers: need to understand bias story. No huge numbers: easier to detect JS timings.\n if (len < 16 || len < minLen || len > 1024)\n throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);\n const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);\n // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n const reduced = mod(num, fieldOrder - _1n) + _1n;\n return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);\n}\n//# sourceMappingURL=modular.js.map","/**\n * Methods for elliptic curve multiplication by scalars.\n * Contains wNAF, pippenger.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { bitLen, bitMask } from \"../utils.js\";\nimport { Field, FpInvertBatch, validateField } from \"./modular.js\";\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\nexport function negateCt(condition, item) {\n const neg = item.negate();\n return condition ? neg : item;\n}\n/**\n * Takes a bunch of Projective Points but executes only one\n * inversion on all of them. Inversion is very slow operation,\n * so this improves performance massively.\n * Optimization: converts a list of projective points to a list of identical points with Z=1.\n */\nexport function normalizeZ(c, points) {\n const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));\n return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));\n}\nfunction validateW(W, bits) {\n if (!Number.isSafeInteger(W) || W <= 0 || W > bits)\n throw new Error('invalid window size, expected [1..' + bits + '], got W=' + W);\n}\nfunction calcWOpts(W, scalarBits) {\n validateW(W, scalarBits);\n const windows = Math.ceil(scalarBits / W) + 1; // W=8 33. Not 32, because we skip zero\n const windowSize = 2 ** (W - 1); // W=8 128. Not 256, because we skip zero\n const maxNumber = 2 ** W; // W=8 256\n const mask = bitMask(W); // W=8 255 == mask 0b11111111\n const shiftBy = BigInt(W); // W=8 8\n return { windows, windowSize, mask, maxNumber, shiftBy };\n}\nfunction calcOffsets(n, window, wOpts) {\n const { windowSize, mask, maxNumber, shiftBy } = wOpts;\n let wbits = Number(n & mask); // extract W bits.\n let nextN = n >> shiftBy; // shift number by W bits.\n // What actually happens here:\n // const highestBit = Number(mask ^ (mask >> 1n));\n // let wbits2 = wbits - 1; // skip zero\n // if (wbits2 & highestBit) { wbits2 ^= Number(mask); // (~);\n // split if bits > max: +224 => 256-32\n if (wbits > windowSize) {\n // we skip zero, which means instead of `>= size-1`, we do `> size`\n wbits -= maxNumber; // -32, can be maxNumber - wbits, but then we need to set isNeg here.\n nextN += _1n; // +256 (carry)\n }\n const offsetStart = window * windowSize;\n const offset = offsetStart + Math.abs(wbits) - 1; // -1 because we skip zero\n const isZero = wbits === 0; // is current window slice a 0?\n const isNeg = wbits < 0; // is current window slice negative?\n const isNegF = window % 2 !== 0; // fake random statement for noise\n const offsetF = offsetStart; // fake offset for noise\n return { nextN, offset, isZero, isNeg, isNegF, offsetF };\n}\nfunction validateMSMPoints(points, c) {\n if (!Array.isArray(points))\n throw new Error('array expected');\n points.forEach((p, i) => {\n if (!(p instanceof c))\n throw new Error('invalid point at index ' + i);\n });\n}\nfunction validateMSMScalars(scalars, field) {\n if (!Array.isArray(scalars))\n throw new Error('array of scalars expected');\n scalars.forEach((s, i) => {\n if (!field.isValid(s))\n throw new Error('invalid scalar at index ' + i);\n });\n}\n// Since points in different groups cannot be equal (different object constructor),\n// we can have single place to store precomputes.\n// Allows to make points frozen / immutable.\nconst pointPrecomputes = new WeakMap();\nconst pointWindowSizes = new WeakMap();\nfunction getW(P) {\n // To disable precomputes:\n // return 1;\n return pointWindowSizes.get(P) || 1;\n}\nfunction assert0(n) {\n if (n !== _0n)\n throw new Error('invalid wNAF');\n}\n/**\n * Elliptic curve multiplication of Point by scalar. Fragile.\n * Table generation takes **30MB of ram and 10ms on high-end CPU**,\n * but may take much longer on slow devices. Actual generation will happen on\n * first call of `multiply()`. By default, `BASE` point is precomputed.\n *\n * Scalars should always be less than curve order: this should be checked inside of a curve itself.\n * Creates precomputation tables for fast multiplication:\n * - private scalar is split by fixed size windows of W bits\n * - every window point is collected from window's table & added to accumulator\n * - since windows are different, same point inside tables won't be accessed more than once per calc\n * - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)\n * - +1 window is neccessary for wNAF\n * - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication\n *\n * @todo Research returning 2d JS array of windows, instead of a single window.\n * This would allow windows to be in different memory locations\n */\nexport class wNAF {\n BASE;\n ZERO;\n Fn;\n bits;\n // Parametrized with a given Point class (not individual point)\n constructor(Point, bits) {\n this.BASE = Point.BASE;\n this.ZERO = Point.ZERO;\n this.Fn = Point.Fn;\n this.bits = bits;\n }\n // non-const time multiplication ladder\n _unsafeLadder(elm, n, p = this.ZERO) {\n let d = elm;\n while (n > _0n) {\n if (n & _1n)\n p = p.add(d);\n d = d.double();\n n >>= _1n;\n }\n return p;\n }\n /**\n * Creates a wNAF precomputation window. Used for caching.\n * Default window size is set by `utils.precompute()` and is equal to 8.\n * Number of precomputed points depends on the curve size:\n * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:\n * - 𝑊 is the window size\n * - 𝑛 is the bitlength of the curve order.\n * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.\n * @param point Point instance\n * @param W window size\n * @returns precomputed point tables flattened to a single array\n */\n precomputeWindow(point, W) {\n const { windows, windowSize } = calcWOpts(W, this.bits);\n const points = [];\n let p = point;\n let base = p;\n for (let window = 0; window < windows; window++) {\n base = p;\n points.push(base);\n // i=1, bc we skip 0\n for (let i = 1; i < windowSize; i++) {\n base = base.add(p);\n points.push(base);\n }\n p = base.double();\n }\n return points;\n }\n /**\n * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.\n * More compact implementation:\n * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541\n * @returns real and fake (for const-time) points\n */\n wNAF(W, precomputes, n) {\n // Scalar should be smaller than field order\n if (!this.Fn.isValid(n))\n throw new Error('invalid scalar');\n // Accumulators\n let p = this.ZERO;\n let f = this.BASE;\n // This code was first written with assumption that 'f' and 'p' will never be infinity point:\n // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,\n // there is negate now: it is possible that negated element from low value\n // would be the same as high element, which will create carry into next window.\n // It's not obvious how this can fail, but still worth investigating later.\n const wo = calcWOpts(W, this.bits);\n for (let window = 0; window < wo.windows; window++) {\n // (n === _0n) is handled and not early-exited. isEven and offsetF are used for noise\n const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);\n n = nextN;\n if (isZero) {\n // bits are 0: add garbage to fake point\n // Important part for const-time getPublicKey: add random \"noise\" point to f.\n f = f.add(negateCt(isNegF, precomputes[offsetF]));\n }\n else {\n // bits are 1: add to result point\n p = p.add(negateCt(isNeg, precomputes[offset]));\n }\n }\n assert0(n);\n // Return both real and fake points: JIT won't eliminate f.\n // At this point there is a way to F be infinity-point even if p is not,\n // which makes it less const-time: around 1 bigint multiply.\n return { p, f };\n }\n /**\n * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.\n * @param acc accumulator point to add result of multiplication\n * @returns point\n */\n wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {\n const wo = calcWOpts(W, this.bits);\n for (let window = 0; window < wo.windows; window++) {\n if (n === _0n)\n break; // Early-exit, skip 0 value\n const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);\n n = nextN;\n if (isZero) {\n // Window bits are 0: skip processing.\n // Move to next window.\n continue;\n }\n else {\n const item = precomputes[offset];\n acc = acc.add(isNeg ? item.negate() : item); // Re-using acc allows to save adds in MSM\n }\n }\n assert0(n);\n return acc;\n }\n getPrecomputes(W, point, transform) {\n // Calculate precomputes on a first run, reuse them after\n let comp = pointPrecomputes.get(point);\n if (!comp) {\n comp = this.precomputeWindow(point, W);\n if (W !== 1) {\n // Doing transform outside of if brings 15% perf hit\n if (typeof transform === 'function')\n comp = transform(comp);\n pointPrecomputes.set(point, comp);\n }\n }\n return comp;\n }\n cached(point, scalar, transform) {\n const W = getW(point);\n return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);\n }\n unsafe(point, scalar, transform, prev) {\n const W = getW(point);\n if (W === 1)\n return this._unsafeLadder(point, scalar, prev); // For W=1 ladder is ~x2 faster\n return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);\n }\n // We calculate precomputes for elliptic curve point multiplication\n // using windowed method. This specifies window size and\n // stores precomputed values. Usually only base point would be precomputed.\n createCache(P, W) {\n validateW(W, this.bits);\n pointWindowSizes.set(P, W);\n pointPrecomputes.delete(P);\n }\n hasCache(elm) {\n return getW(elm) !== 1;\n }\n}\n/**\n * Endomorphism-specific multiplication for Koblitz curves.\n * Cost: 128 dbl, 0-256 adds.\n */\nexport function mulEndoUnsafe(Point, point, k1, k2) {\n let acc = point;\n let p1 = Point.ZERO;\n let p2 = Point.ZERO;\n while (k1 > _0n || k2 > _0n) {\n if (k1 & _1n)\n p1 = p1.add(acc);\n if (k2 & _1n)\n p2 = p2.add(acc);\n acc = acc.double();\n k1 >>= _1n;\n k2 >>= _1n;\n }\n return { p1, p2 };\n}\n/**\n * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * 30x faster vs naive addition on L=4096, 10x faster than precomputes.\n * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.\n * Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.\n * @param c Curve Point constructor\n * @param fieldN field over CURVE.N - important that it's not over CURVE.P\n * @param points array of L curve points\n * @param scalars array of L scalars (aka secret keys / bigints)\n */\nexport function pippenger(c, points, scalars) {\n // If we split scalars by some window (let's say 8 bits), every chunk will only\n // take 256 buckets even if there are 4096 scalars, also re-uses double.\n // TODO:\n // - https://eprint.iacr.org/2024/750.pdf\n // - https://tches.iacr.org/index.php/TCHES/article/view/10287\n // 0 is accepted in scalars\n const fieldN = c.Fn;\n validateMSMPoints(points, c);\n validateMSMScalars(scalars, fieldN);\n const plength = points.length;\n const slength = scalars.length;\n if (plength !== slength)\n throw new Error('arrays of points and scalars must have equal length');\n // if (plength === 0) throw new Error('array must be of length >= 2');\n const zero = c.ZERO;\n const wbits = bitLen(BigInt(plength));\n let windowSize = 1; // bits\n if (wbits > 12)\n windowSize = wbits - 3;\n else if (wbits > 4)\n windowSize = wbits - 2;\n else if (wbits > 0)\n windowSize = 2;\n const MASK = bitMask(windowSize);\n const buckets = new Array(Number(MASK) + 1).fill(zero); // +1 for zero array\n const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;\n let sum = zero;\n for (let i = lastBits; i >= 0; i -= windowSize) {\n buckets.fill(zero);\n for (let j = 0; j < slength; j++) {\n const scalar = scalars[j];\n const wbits = Number((scalar >> BigInt(i)) & MASK);\n buckets[wbits] = buckets[wbits].add(points[j]);\n }\n let resI = zero; // not using this will do small speed-up, but will lose ct\n // Skip first bucket, because it is zero\n for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {\n sumI = sumI.add(buckets[j]);\n resI = resI.add(sumI);\n }\n sum = sum.add(resI);\n if (i !== 0)\n for (let j = 0; j < windowSize; j++)\n sum = sum.double();\n }\n return sum;\n}\n/**\n * Precomputed multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * @param c Curve Point constructor\n * @param fieldN field over CURVE.N - important that it's not over CURVE.P\n * @param points array of L curve points\n * @returns function which multiplies points with scaars\n */\nexport function precomputeMSMUnsafe(c, points, windowSize) {\n /**\n * Performance Analysis of Window-based Precomputation\n *\n * Base Case (256-bit scalar, 8-bit window):\n * - Standard precomputation requires:\n * - 31 additions per scalar × 256 scalars = 7,936 ops\n * - Plus 255 summary additions = 8,191 total ops\n * Note: Summary additions can be optimized via accumulator\n *\n * Chunked Precomputation Analysis:\n * - Using 32 chunks requires:\n * - 255 additions per chunk\n * - 256 doublings\n * - Total: (255 × 32) + 256 = 8,416 ops\n *\n * Memory Usage Comparison:\n * Window Size | Standard Points | Chunked Points\n * ------------|-----------------|---------------\n * 4-bit | 520 | 15\n * 8-bit | 4,224 | 255\n * 10-bit | 13,824 | 1,023\n * 16-bit | 557,056 | 65,535\n *\n * Key Advantages:\n * 1. Enables larger window sizes due to reduced memory overhead\n * 2. More efficient for smaller scalar counts:\n * - 16 chunks: (16 × 255) + 256 = 4,336 ops\n * - ~2x faster than standard 8,191 ops\n *\n * Limitations:\n * - Not suitable for plain precomputes (requires 256 constant doublings)\n * - Performance degrades with larger scalar counts:\n * - Optimal for ~256 scalars\n * - Less efficient for 4096+ scalars (Pippenger preferred)\n */\n const fieldN = c.Fn;\n validateW(windowSize, fieldN.BITS);\n validateMSMPoints(points, c);\n const zero = c.ZERO;\n const tableSize = 2 ** windowSize - 1; // table size (without zero)\n const chunks = Math.ceil(fieldN.BITS / windowSize); // chunks of item\n const MASK = bitMask(windowSize);\n const tables = points.map((p) => {\n const res = [];\n for (let i = 0, acc = p; i < tableSize; i++) {\n res.push(acc);\n acc = acc.add(p);\n }\n return res;\n });\n return (scalars) => {\n validateMSMScalars(scalars, fieldN);\n if (scalars.length > points.length)\n throw new Error('array of scalars must be smaller than array of points');\n let res = zero;\n for (let i = 0; i < chunks; i++) {\n // No need to double if accumulator is still zero.\n if (res !== zero)\n for (let j = 0; j < windowSize; j++)\n res = res.double();\n const shiftBy = BigInt(chunks * windowSize - (i + 1) * windowSize);\n for (let j = 0; j < scalars.length; j++) {\n const n = scalars[j];\n const curr = Number((n >> shiftBy) & MASK);\n if (!curr)\n continue; // skip zero scalars chunks\n res = res.add(tables[j][curr - 1]);\n }\n }\n return res;\n };\n}\nfunction createField(order, field, isLE) {\n if (field) {\n if (field.ORDER !== order)\n throw new Error('Field.ORDER must match order: Fp == p, Fn == n');\n validateField(field);\n return field;\n }\n else {\n return Field(order, { isLE });\n }\n}\n/** Validates CURVE opts and creates fields */\nexport function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {\n if (FpFnLE === undefined)\n FpFnLE = type === 'edwards';\n if (!CURVE || typeof CURVE !== 'object')\n throw new Error(`expected valid ${type} CURVE object`);\n for (const p of ['p', 'n', 'h']) {\n const val = CURVE[p];\n if (!(typeof val === 'bigint' && val > _0n))\n throw new Error(`CURVE.${p} must be positive bigint`);\n }\n const Fp = createField(CURVE.p, curveOpts.Fp, FpFnLE);\n const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);\n const _b = type === 'weierstrass' ? 'b' : 'd';\n const params = ['Gx', 'Gy', 'a', _b];\n for (const p of params) {\n // @ts-ignore\n if (!Fp.isValid(CURVE[p]))\n throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);\n }\n CURVE = Object.freeze(Object.assign({}, CURVE));\n return { CURVE, Fp, Fn };\n}\nexport function createKeygen(randomSecretKey, getPublicKey) {\n return function keygen(seed) {\n const secretKey = randomSecretKey(seed);\n return { secretKey, publicKey: getPublicKey(secretKey) };\n };\n}\n//# sourceMappingURL=curve.js.map","/**\n * HMAC: RFC2104 message authentication code.\n * @module\n */\nimport { abytes, aexists, ahash, clean } from \"./utils.js\";\n/** Internal class for HMAC. */\nexport class _HMAC {\n oHash;\n iHash;\n blockLen;\n outputLen;\n finished = false;\n destroyed = false;\n constructor(hash, key) {\n ahash(hash);\n abytes(key, undefined, 'key');\n this.iHash = hash.create();\n if (typeof this.iHash.update !== 'function')\n throw new Error('Expected instance of class which extends utils.Hash');\n this.blockLen = this.iHash.blockLen;\n this.outputLen = this.iHash.outputLen;\n const blockLen = this.blockLen;\n const pad = new Uint8Array(blockLen);\n // blockLen can be bigger than outputLen\n pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);\n for (let i = 0; i < pad.length; i++)\n pad[i] ^= 0x36;\n this.iHash.update(pad);\n // By doing update (processing of first block) of outer hash here we can re-use it between multiple calls via clone\n this.oHash = hash.create();\n // Undo internal XOR && apply outer XOR\n for (let i = 0; i < pad.length; i++)\n pad[i] ^= 0x36 ^ 0x5c;\n this.oHash.update(pad);\n clean(pad);\n }\n update(buf) {\n aexists(this);\n this.iHash.update(buf);\n return this;\n }\n digestInto(out) {\n aexists(this);\n abytes(out, this.outputLen, 'output');\n this.finished = true;\n this.iHash.digestInto(out);\n this.oHash.update(out);\n this.oHash.digestInto(out);\n this.destroy();\n }\n digest() {\n const out = new Uint8Array(this.oHash.outputLen);\n this.digestInto(out);\n return out;\n }\n _cloneInto(to) {\n // Create new instance without calling constructor since key already in state and we don't know it.\n to ||= Object.create(Object.getPrototypeOf(this), {});\n const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;\n to = to;\n to.finished = finished;\n to.destroyed = destroyed;\n to.blockLen = blockLen;\n to.outputLen = outputLen;\n to.oHash = oHash._cloneInto(to.oHash);\n to.iHash = iHash._cloneInto(to.iHash);\n return to;\n }\n clone() {\n return this._cloneInto();\n }\n destroy() {\n this.destroyed = true;\n this.oHash.destroy();\n this.iHash.destroy();\n }\n}\n/**\n * HMAC: RFC2104 message authentication code.\n * @param hash - function that would be used e.g. sha256\n * @param key - message key\n * @param message - message data\n * @example\n * import { hmac } from '@noble/hashes/hmac';\n * import { sha256 } from '@noble/hashes/sha2';\n * const mac1 = hmac(sha256, 'key', 'message');\n */\nexport const hmac = (hash, key, message) => new _HMAC(hash, key).update(message).digest();\nhmac.create = (hash, key) => new _HMAC(hash, key);\n//# sourceMappingURL=hmac.js.map","/**\n * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.\n *\n * ### Design rationale for types\n *\n * * Interaction between classes from different curves should fail:\n * `k256.Point.BASE.add(p256.Point.BASE)`\n * * For this purpose we want to use `instanceof` operator, which is fast and works during runtime\n * * Different calls of `curve()` would return different classes -\n * `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,\n * it won't affect others\n *\n * TypeScript can't infer types for classes created inside a function. Classes is one instance\n * of nominative types in TypeScript and interfaces only check for shape, so it's hard to create\n * unique type for every function call.\n *\n * We can use generic types via some param, like curve opts, but that would:\n * 1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)\n * which is hard to debug.\n * 2. Params can be generic and we can't enforce them to be constant value:\n * if somebody creates curve from non-constant params,\n * it would be allowed to interact with other curves with non-constant params\n *\n * @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { hmac as nobleHmac } from '@noble/hashes/hmac.js';\nimport { ahash } from '@noble/hashes/utils.js';\nimport { abool, abytes, aInRange, bitLen, bitMask, bytesToHex, bytesToNumberBE, concatBytes, createHmacDrbg, hexToBytes, isBytes, memoized, numberToHexUnpadded, validateObject, randomBytes as wcRandomBytes, } from \"../utils.js\";\nimport { createCurveFields, createKeygen, mulEndoUnsafe, negateCt, normalizeZ, wNAF, } from \"./curve.js\";\nimport { FpInvertBatch, getMinHashLength, mapHashToField, validateField, } from \"./modular.js\";\n// We construct basis in such way that den is always positive and equals n, but num sign depends on basis (not on secret value)\nconst divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n) / den;\n/**\n * Splits scalar for GLV endomorphism.\n */\nexport function _splitEndoScalar(k, basis, n) {\n // Split scalar into two such that part is ~half bits: `abs(part) < sqrt(N)`\n // Since part can be negative, we need to do this on point.\n // TODO: verifyScalar function which consumes lambda\n const [[a1, b1], [a2, b2]] = basis;\n const c1 = divNearest(b2 * k, n);\n const c2 = divNearest(-b1 * k, n);\n // |k1|/|k2| is < sqrt(N), but can be negative.\n // If we do `k1 mod N`, we'll get big scalar (`> sqrt(N)`): so, we do cheaper negation instead.\n let k1 = k - c1 * a1 - c2 * a2;\n let k2 = -c1 * b1 - c2 * b2;\n const k1neg = k1 < _0n;\n const k2neg = k2 < _0n;\n if (k1neg)\n k1 = -k1;\n if (k2neg)\n k2 = -k2;\n // Double check that resulting scalar less than half bits of N: otherwise wNAF will fail.\n // This should only happen on wrong basises. Also, math inside is too complex and I don't trust it.\n const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n; // Half bits of N\n if (k1 < _0n || k1 >= MAX_NUM || k2 < _0n || k2 >= MAX_NUM) {\n throw new Error('splitScalar (endomorphism): failed, k=' + k);\n }\n return { k1neg, k1, k2neg, k2 };\n}\nfunction validateSigFormat(format) {\n if (!['compact', 'recovered', 'der'].includes(format))\n throw new Error('Signature format must be \"compact\", \"recovered\", or \"der\"');\n return format;\n}\nfunction validateSigOpts(opts, def) {\n const optsn = {};\n for (let optName of Object.keys(def)) {\n // @ts-ignore\n optsn[optName] = opts[optName] === undefined ? def[optName] : opts[optName];\n }\n abool(optsn.lowS, 'lowS');\n abool(optsn.prehash, 'prehash');\n if (optsn.format !== undefined)\n validateSigFormat(optsn.format);\n return optsn;\n}\nexport class DERErr extends Error {\n constructor(m = '') {\n super(m);\n }\n}\n/**\n * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:\n *\n * [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]\n *\n * Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html\n */\nexport const DER = {\n // asn.1 DER encoding utils\n Err: DERErr,\n // Basic building block is TLV (Tag-Length-Value)\n _tlv: {\n encode: (tag, data) => {\n const { Err: E } = DER;\n if (tag < 0 || tag > 256)\n throw new E('tlv.encode: wrong tag');\n if (data.length & 1)\n throw new E('tlv.encode: unpadded data');\n const dataLen = data.length / 2;\n const len = numberToHexUnpadded(dataLen);\n if ((len.length / 2) & 0b1000_0000)\n throw new E('tlv.encode: long form length too big');\n // length of length with long form flag\n const lenLen = dataLen > 127 ? numberToHexUnpadded((len.length / 2) | 0b1000_0000) : '';\n const t = numberToHexUnpadded(tag);\n return t + lenLen + len + data;\n },\n // v - value, l - left bytes (unparsed)\n decode(tag, data) {\n const { Err: E } = DER;\n let pos = 0;\n if (tag < 0 || tag > 256)\n throw new E('tlv.encode: wrong tag');\n if (data.length < 2 || data[pos++] !== tag)\n throw new E('tlv.decode: wrong tlv');\n const first = data[pos++];\n const isLong = !!(first & 0b1000_0000); // First bit of first length byte is flag for short/long form\n let length = 0;\n if (!isLong)\n length = first;\n else {\n // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]\n const lenLen = first & 0b0111_1111;\n if (!lenLen)\n throw new E('tlv.decode(long): indefinite length not supported');\n if (lenLen > 4)\n throw new E('tlv.decode(long): byte length is too big'); // this will overflow u32 in js\n const lengthBytes = data.subarray(pos, pos + lenLen);\n if (lengthBytes.length !== lenLen)\n throw new E('tlv.decode: length bytes not complete');\n if (lengthBytes[0] === 0)\n throw new E('tlv.decode(long): zero leftmost byte');\n for (const b of lengthBytes)\n length = (length << 8) | b;\n pos += lenLen;\n if (length < 128)\n throw new E('tlv.decode(long): not minimal encoding');\n }\n const v = data.subarray(pos, pos + length);\n if (v.length !== length)\n throw new E('tlv.decode: wrong value length');\n return { v, l: data.subarray(pos + length) };\n },\n },\n // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,\n // since we always use positive integers here. It must always be empty:\n // - add zero byte if exists\n // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)\n _int: {\n encode(num) {\n const { Err: E } = DER;\n if (num < _0n)\n throw new E('integer: negative integers are not allowed');\n let hex = numberToHexUnpadded(num);\n // Pad with zero byte if negative flag is present\n if (Number.parseInt(hex[0], 16) & 0b1000)\n hex = '00' + hex;\n if (hex.length & 1)\n throw new E('unexpected DER parsing assertion: unpadded hex');\n return hex;\n },\n decode(data) {\n const { Err: E } = DER;\n if (data[0] & 0b1000_0000)\n throw new E('invalid signature integer: negative');\n if (data[0] === 0x00 && !(data[1] & 0b1000_0000))\n throw new E('invalid signature integer: unnecessary leading zero');\n return bytesToNumberBE(data);\n },\n },\n toSig(bytes) {\n // parse DER signature\n const { Err: E, _int: int, _tlv: tlv } = DER;\n const data = abytes(bytes, undefined, 'signature');\n const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);\n if (seqLeftBytes.length)\n throw new E('invalid signature: left bytes after parsing');\n const { v: rBytes, l: rLeftBytes } = tlv.decode(0x02, seqBytes);\n const { v: sBytes, l: sLeftBytes } = tlv.decode(0x02, rLeftBytes);\n if (sLeftBytes.length)\n throw new E('invalid signature: left bytes after parsing');\n return { r: int.decode(rBytes), s: int.decode(sBytes) };\n },\n hexFromSig(sig) {\n const { _tlv: tlv, _int: int } = DER;\n const rs = tlv.encode(0x02, int.encode(sig.r));\n const ss = tlv.encode(0x02, int.encode(sig.s));\n const seq = rs + ss;\n return tlv.encode(0x30, seq);\n },\n};\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);\n/**\n * Creates weierstrass Point constructor, based on specified curve options.\n *\n * See {@link WeierstrassOpts}.\n *\n * @example\n```js\nconst opts = {\n p: 0xfffffffffffffffffffffffffffffffeffffac73n,\n n: 0x100000000000000000001b8fa16dfab9aca16b6b3n,\n h: 1n,\n a: 0n,\n b: 7n,\n Gx: 0x3b4c382ce37aa192a4019e763036f4f5dd4d7ebbn,\n Gy: 0x938cf935318fdced6bc28286531733c3f03c4feen,\n};\nconst secp160k1_Point = weierstrass(opts);\n```\n */\nexport function weierstrass(params, extraOpts = {}) {\n const validated = createCurveFields('weierstrass', params, extraOpts);\n const { Fp, Fn } = validated;\n let CURVE = validated.CURVE;\n const { h: cofactor, n: CURVE_ORDER } = CURVE;\n validateObject(extraOpts, {}, {\n allowInfinityPoint: 'boolean',\n clearCofactor: 'function',\n isTorsionFree: 'function',\n fromBytes: 'function',\n toBytes: 'function',\n endo: 'object',\n });\n const { endo } = extraOpts;\n if (endo) {\n // validateObject(endo, { beta: 'bigint', splitScalar: 'function' });\n if (!Fp.is0(CURVE.a) || typeof endo.beta !== 'bigint' || !Array.isArray(endo.basises)) {\n throw new Error('invalid endo: expected \"beta\": bigint and \"basises\": array');\n }\n }\n const lengths = getWLengths(Fp, Fn);\n function assertCompressionIsSupported() {\n if (!Fp.isOdd)\n throw new Error('compression is not supported: Field does not have .isOdd()');\n }\n // Implements IEEE P1363 point encoding\n function pointToBytes(_c, point, isCompressed) {\n const { x, y } = point.toAffine();\n const bx = Fp.toBytes(x);\n abool(isCompressed, 'isCompressed');\n if (isCompressed) {\n assertCompressionIsSupported();\n const hasEvenY = !Fp.isOdd(y);\n return concatBytes(pprefix(hasEvenY), bx);\n }\n else {\n return concatBytes(Uint8Array.of(0x04), bx, Fp.toBytes(y));\n }\n }\n function pointFromBytes(bytes) {\n abytes(bytes, undefined, 'Point');\n const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths; // e.g. for 32-byte: 33, 65\n const length = bytes.length;\n const head = bytes[0];\n const tail = bytes.subarray(1);\n // No actual validation is done here: use .assertValidity()\n if (length === comp && (head === 0x02 || head === 0x03)) {\n const x = Fp.fromBytes(tail);\n if (!Fp.isValid(x))\n throw new Error('bad point: is not on curve, wrong x');\n const y2 = weierstrassEquation(x); // y² = x³ + ax + b\n let y;\n try {\n y = Fp.sqrt(y2); // y = y² ^ (p+1)/4\n }\n catch (sqrtError) {\n const err = sqrtError instanceof Error ? ': ' + sqrtError.message : '';\n throw new Error('bad point: is not on curve, sqrt error' + err);\n }\n assertCompressionIsSupported();\n const evenY = Fp.isOdd(y);\n const evenH = (head & 1) === 1; // ECDSA-specific\n if (evenH !== evenY)\n y = Fp.neg(y);\n return { x, y };\n }\n else if (length === uncomp && head === 0x04) {\n // TODO: more checks\n const L = Fp.BYTES;\n const x = Fp.fromBytes(tail.subarray(0, L));\n const y = Fp.fromBytes(tail.subarray(L, L * 2));\n if (!isValidXY(x, y))\n throw new Error('bad point: is not on curve');\n return { x, y };\n }\n else {\n throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);\n }\n }\n const encodePoint = extraOpts.toBytes || pointToBytes;\n const decodePoint = extraOpts.fromBytes || pointFromBytes;\n function weierstrassEquation(x) {\n const x2 = Fp.sqr(x); // x * x\n const x3 = Fp.mul(x2, x); // x² * x\n return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b); // x³ + a * x + b\n }\n // TODO: move top-level\n /** Checks whether equation holds for given x, y: y² == x³ + ax + b */\n function isValidXY(x, y) {\n const left = Fp.sqr(y); // y²\n const right = weierstrassEquation(x); // x³ + ax + b\n return Fp.eql(left, right);\n }\n // Validate whether the passed curve params are valid.\n // Test 1: equation y² = x³ + ax + b should work for generator point.\n if (!isValidXY(CURVE.Gx, CURVE.Gy))\n throw new Error('bad curve params: generator point');\n // Test 2: discriminant Δ part should be non-zero: 4a³ + 27b² != 0.\n // Guarantees curve is genus-1, smooth (non-singular).\n const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);\n const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));\n if (Fp.is0(Fp.add(_4a3, _27b2)))\n throw new Error('bad curve params: a or b');\n /** Asserts coordinate is valid: 0 <= n < Fp.ORDER. */\n function acoord(title, n, banZero = false) {\n if (!Fp.isValid(n) || (banZero && Fp.is0(n)))\n throw new Error(`bad point coordinate ${title}`);\n return n;\n }\n function aprjpoint(other) {\n if (!(other instanceof Point))\n throw new Error('Weierstrass Point expected');\n }\n function splitEndoScalarN(k) {\n if (!endo || !endo.basises)\n throw new Error('no endo');\n return _splitEndoScalar(k, endo.basises, Fn.ORDER);\n }\n // Memoized toAffine / validity check. They are heavy. Points are immutable.\n // Converts Projective point to affine (x, y) coordinates.\n // Can accept precomputed Z^-1 - for example, from invertBatch.\n // (X, Y, Z) ∋ (x=X/Z, y=Y/Z)\n const toAffineMemo = memoized((p, iz) => {\n const { X, Y, Z } = p;\n // Fast-path for normalized points\n if (Fp.eql(Z, Fp.ONE))\n return { x: X, y: Y };\n const is0 = p.is0();\n // If invZ was 0, we return zero point. However we still want to execute\n // all operations, so we replace invZ with a random number, 1.\n if (iz == null)\n iz = is0 ? Fp.ONE : Fp.inv(Z);\n const x = Fp.mul(X, iz);\n const y = Fp.mul(Y, iz);\n const zz = Fp.mul(Z, iz);\n if (is0)\n return { x: Fp.ZERO, y: Fp.ZERO };\n if (!Fp.eql(zz, Fp.ONE))\n throw new Error('invZ was invalid');\n return { x, y };\n });\n // NOTE: on exception this will crash 'cached' and no value will be set.\n // Otherwise true will be return\n const assertValidMemo = memoized((p) => {\n if (p.is0()) {\n // (0, 1, 0) aka ZERO is invalid in most contexts.\n // In BLS, ZERO can be serialized, so we allow it.\n // (0, 0, 0) is invalid representation of ZERO.\n if (extraOpts.allowInfinityPoint && !Fp.is0(p.Y))\n return;\n throw new Error('bad point: ZERO');\n }\n // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`\n const { x, y } = p.toAffine();\n if (!Fp.isValid(x) || !Fp.isValid(y))\n throw new Error('bad point: x or y not field elements');\n if (!isValidXY(x, y))\n throw new Error('bad point: equation left != right');\n if (!p.isTorsionFree())\n throw new Error('bad point: not in prime-order subgroup');\n return true;\n });\n function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {\n k2p = new Point(Fp.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);\n k1p = negateCt(k1neg, k1p);\n k2p = negateCt(k2neg, k2p);\n return k1p.add(k2p);\n }\n /**\n * Projective Point works in 3d / projective (homogeneous) coordinates:(X, Y, Z) ∋ (x=X/Z, y=Y/Z).\n * Default Point works in 2d / affine coordinates: (x, y).\n * We're doing calculations in projective, because its operations don't require costly inversion.\n */\n class Point {\n // base / generator point\n static BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);\n // zero / infinity / identity point\n static ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO); // 0, 1, 0\n // math field\n static Fp = Fp;\n // scalar field\n static Fn = Fn;\n X;\n Y;\n Z;\n /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n constructor(X, Y, Z) {\n this.X = acoord('x', X);\n this.Y = acoord('y', Y, true);\n this.Z = acoord('z', Z);\n Object.freeze(this);\n }\n static CURVE() {\n return CURVE;\n }\n /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n static fromAffine(p) {\n const { x, y } = p || {};\n if (!p || !Fp.isValid(x) || !Fp.isValid(y))\n throw new Error('invalid affine point');\n if (p instanceof Point)\n throw new Error('projective point not allowed');\n // (0, 0) would've produced (0, 0, 1) - instead, we need (0, 1, 0)\n if (Fp.is0(x) && Fp.is0(y))\n return Point.ZERO;\n return new Point(x, y, Fp.ONE);\n }\n static fromBytes(bytes) {\n const P = Point.fromAffine(decodePoint(abytes(bytes, undefined, 'point')));\n P.assertValidity();\n return P;\n }\n static fromHex(hex) {\n return Point.fromBytes(hexToBytes(hex));\n }\n get x() {\n return this.toAffine().x;\n }\n get y() {\n return this.toAffine().y;\n }\n /**\n *\n * @param windowSize\n * @param isLazy true will defer table computation until the first multiplication\n * @returns\n */\n precompute(windowSize = 8, isLazy = true) {\n wnaf.createCache(this, windowSize);\n if (!isLazy)\n this.multiply(_3n); // random number\n return this;\n }\n // TODO: return `this`\n /** A point on curve is valid if it conforms to equation. */\n assertValidity() {\n assertValidMemo(this);\n }\n hasEvenY() {\n const { y } = this.toAffine();\n if (!Fp.isOdd)\n throw new Error(\"Field doesn't support isOdd\");\n return !Fp.isOdd(y);\n }\n /** Compare one point to another. */\n equals(other) {\n aprjpoint(other);\n const { X: X1, Y: Y1, Z: Z1 } = this;\n const { X: X2, Y: Y2, Z: Z2 } = other;\n const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));\n const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));\n return U1 && U2;\n }\n /** Flips point to one corresponding to (x, -y) in Affine coordinates. */\n negate() {\n return new Point(this.X, Fp.neg(this.Y), this.Z);\n }\n // Renes-Costello-Batina exception-free doubling formula.\n // There is 30% faster Jacobian formula, but it is not complete.\n // https://eprint.iacr.org/2015/1060, algorithm 3\n // Cost: 8M + 3S + 3*a + 2*b3 + 15add.\n double() {\n const { a, b } = CURVE;\n const b3 = Fp.mul(b, _3n);\n const { X: X1, Y: Y1, Z: Z1 } = this;\n let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n let t0 = Fp.mul(X1, X1); // step 1\n let t1 = Fp.mul(Y1, Y1);\n let t2 = Fp.mul(Z1, Z1);\n let t3 = Fp.mul(X1, Y1);\n t3 = Fp.add(t3, t3); // step 5\n Z3 = Fp.mul(X1, Z1);\n Z3 = Fp.add(Z3, Z3);\n X3 = Fp.mul(a, Z3);\n Y3 = Fp.mul(b3, t2);\n Y3 = Fp.add(X3, Y3); // step 10\n X3 = Fp.sub(t1, Y3);\n Y3 = Fp.add(t1, Y3);\n Y3 = Fp.mul(X3, Y3);\n X3 = Fp.mul(t3, X3);\n Z3 = Fp.mul(b3, Z3); // step 15\n t2 = Fp.mul(a, t2);\n t3 = Fp.sub(t0, t2);\n t3 = Fp.mul(a, t3);\n t3 = Fp.add(t3, Z3);\n Z3 = Fp.add(t0, t0); // step 20\n t0 = Fp.add(Z3, t0);\n t0 = Fp.add(t0, t2);\n t0 = Fp.mul(t0, t3);\n Y3 = Fp.add(Y3, t0);\n t2 = Fp.mul(Y1, Z1); // step 25\n t2 = Fp.add(t2, t2);\n t0 = Fp.mul(t2, t3);\n X3 = Fp.sub(X3, t0);\n Z3 = Fp.mul(t2, t1);\n Z3 = Fp.add(Z3, Z3); // step 30\n Z3 = Fp.add(Z3, Z3);\n return new Point(X3, Y3, Z3);\n }\n // Renes-Costello-Batina exception-free addition formula.\n // There is 30% faster Jacobian formula, but it is not complete.\n // https://eprint.iacr.org/2015/1060, algorithm 1\n // Cost: 12M + 0S + 3*a + 3*b3 + 23add.\n add(other) {\n aprjpoint(other);\n const { X: X1, Y: Y1, Z: Z1 } = this;\n const { X: X2, Y: Y2, Z: Z2 } = other;\n let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n const a = CURVE.a;\n const b3 = Fp.mul(CURVE.b, _3n);\n let t0 = Fp.mul(X1, X2); // step 1\n let t1 = Fp.mul(Y1, Y2);\n let t2 = Fp.mul(Z1, Z2);\n let t3 = Fp.add(X1, Y1);\n let t4 = Fp.add(X2, Y2); // step 5\n t3 = Fp.mul(t3, t4);\n t4 = Fp.add(t0, t1);\n t3 = Fp.sub(t3, t4);\n t4 = Fp.add(X1, Z1);\n let t5 = Fp.add(X2, Z2); // step 10\n t4 = Fp.mul(t4, t5);\n t5 = Fp.add(t0, t2);\n t4 = Fp.sub(t4, t5);\n t5 = Fp.add(Y1, Z1);\n X3 = Fp.add(Y2, Z2); // step 15\n t5 = Fp.mul(t5, X3);\n X3 = Fp.add(t1, t2);\n t5 = Fp.sub(t5, X3);\n Z3 = Fp.mul(a, t4);\n X3 = Fp.mul(b3, t2); // step 20\n Z3 = Fp.add(X3, Z3);\n X3 = Fp.sub(t1, Z3);\n Z3 = Fp.add(t1, Z3);\n Y3 = Fp.mul(X3, Z3);\n t1 = Fp.add(t0, t0); // step 25\n t1 = Fp.add(t1, t0);\n t2 = Fp.mul(a, t2);\n t4 = Fp.mul(b3, t4);\n t1 = Fp.add(t1, t2);\n t2 = Fp.sub(t0, t2); // step 30\n t2 = Fp.mul(a, t2);\n t4 = Fp.add(t4, t2);\n t0 = Fp.mul(t1, t4);\n Y3 = Fp.add(Y3, t0);\n t0 = Fp.mul(t5, t4); // step 35\n X3 = Fp.mul(t3, X3);\n X3 = Fp.sub(X3, t0);\n t0 = Fp.mul(t3, t1);\n Z3 = Fp.mul(t5, Z3);\n Z3 = Fp.add(Z3, t0); // step 40\n return new Point(X3, Y3, Z3);\n }\n subtract(other) {\n return this.add(other.negate());\n }\n is0() {\n return this.equals(Point.ZERO);\n }\n /**\n * Constant time multiplication.\n * Uses wNAF method. Windowed method may be 10% faster,\n * but takes 2x longer to generate and consumes 2x memory.\n * Uses precomputes when available.\n * Uses endomorphism for Koblitz curves.\n * @param scalar by which the point would be multiplied\n * @returns New point\n */\n multiply(scalar) {\n const { endo } = extraOpts;\n if (!Fn.isValidNot0(scalar))\n throw new Error('invalid scalar: out of range'); // 0 is invalid\n let point, fake; // Fake point is used to const-time mult\n const mul = (n) => wnaf.cached(this, n, (p) => normalizeZ(Point, p));\n /** See docs for {@link EndomorphismOpts} */\n if (endo) {\n const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(scalar);\n const { p: k1p, f: k1f } = mul(k1);\n const { p: k2p, f: k2f } = mul(k2);\n fake = k1f.add(k2f);\n point = finishEndo(endo.beta, k1p, k2p, k1neg, k2neg);\n }\n else {\n const { p, f } = mul(scalar);\n point = p;\n fake = f;\n }\n // Normalize `z` for both points, but return only real one\n return normalizeZ(Point, [point, fake])[0];\n }\n /**\n * Non-constant-time multiplication. Uses double-and-add algorithm.\n * It's faster, but should only be used when you don't care about\n * an exposed secret key e.g. sig verification, which works over *public* keys.\n */\n multiplyUnsafe(sc) {\n const { endo } = extraOpts;\n const p = this;\n if (!Fn.isValid(sc))\n throw new Error('invalid scalar: out of range'); // 0 is valid\n if (sc === _0n || p.is0())\n return Point.ZERO; // 0\n if (sc === _1n)\n return p; // 1\n if (wnaf.hasCache(this))\n return this.multiply(sc); // precomputes\n // We don't have method for double scalar multiplication (aP + bQ):\n // Even with using Strauss-Shamir trick, it's 35% slower than naïve mul+add.\n if (endo) {\n const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(sc);\n const { p1, p2 } = mulEndoUnsafe(Point, p, k1, k2); // 30% faster vs wnaf.unsafe\n return finishEndo(endo.beta, p1, p2, k1neg, k2neg);\n }\n else {\n return wnaf.unsafe(p, sc);\n }\n }\n /**\n * Converts Projective point to affine (x, y) coordinates.\n * @param invertedZ Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch\n */\n toAffine(invertedZ) {\n return toAffineMemo(this, invertedZ);\n }\n /**\n * Checks whether Point is free of torsion elements (is in prime subgroup).\n * Always torsion-free for cofactor=1 curves.\n */\n isTorsionFree() {\n const { isTorsionFree } = extraOpts;\n if (cofactor === _1n)\n return true;\n if (isTorsionFree)\n return isTorsionFree(Point, this);\n return wnaf.unsafe(this, CURVE_ORDER).is0();\n }\n clearCofactor() {\n const { clearCofactor } = extraOpts;\n if (cofactor === _1n)\n return this; // Fast-path\n if (clearCofactor)\n return clearCofactor(Point, this);\n return this.multiplyUnsafe(cofactor);\n }\n isSmallOrder() {\n // can we use this.clearCofactor()?\n return this.multiplyUnsafe(cofactor).is0();\n }\n toBytes(isCompressed = true) {\n abool(isCompressed, 'isCompressed');\n this.assertValidity();\n return encodePoint(Point, this, isCompressed);\n }\n toHex(isCompressed = true) {\n return bytesToHex(this.toBytes(isCompressed));\n }\n toString() {\n return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;\n }\n }\n const bits = Fn.BITS;\n const wnaf = new wNAF(Point, extraOpts.endo ? Math.ceil(bits / 2) : bits);\n Point.BASE.precompute(8); // Enable precomputes. Slows down first publicKey computation by 20ms.\n return Point;\n}\n// Points start with byte 0x02 when y is even; otherwise 0x03\nfunction pprefix(hasEvenY) {\n return Uint8Array.of(hasEvenY ? 0x02 : 0x03);\n}\n/**\n * Implementation of the Shallue and van de Woestijne method for any weierstrass curve.\n * TODO: check if there is a way to merge this with uvRatio in Edwards; move to modular.\n * b = True and y = sqrt(u / v) if (u / v) is square in F, and\n * b = False and y = sqrt(Z * (u / v)) otherwise.\n * @param Fp\n * @param Z\n * @returns\n */\nexport function SWUFpSqrtRatio(Fp, Z) {\n // Generic implementation\n const q = Fp.ORDER;\n let l = _0n;\n for (let o = q - _1n; o % _2n === _0n; o /= _2n)\n l += _1n;\n const c1 = l; // 1. c1, the largest integer such that 2^c1 divides q - 1.\n // We need 2n ** c1 and 2n ** (c1-1). We can't use **; but we can use <<.\n // 2n ** c1 == 2n << (c1-1)\n const _2n_pow_c1_1 = _2n << (c1 - _1n - _1n);\n const _2n_pow_c1 = _2n_pow_c1_1 * _2n;\n const c2 = (q - _1n) / _2n_pow_c1; // 2. c2 = (q - 1) / (2^c1) # Integer arithmetic\n const c3 = (c2 - _1n) / _2n; // 3. c3 = (c2 - 1) / 2 # Integer arithmetic\n const c4 = _2n_pow_c1 - _1n; // 4. c4 = 2^c1 - 1 # Integer arithmetic\n const c5 = _2n_pow_c1_1; // 5. c5 = 2^(c1 - 1) # Integer arithmetic\n const c6 = Fp.pow(Z, c2); // 6. c6 = Z^c2\n const c7 = Fp.pow(Z, (c2 + _1n) / _2n); // 7. c7 = Z^((c2 + 1) / 2)\n let sqrtRatio = (u, v) => {\n let tv1 = c6; // 1. tv1 = c6\n let tv2 = Fp.pow(v, c4); // 2. tv2 = v^c4\n let tv3 = Fp.sqr(tv2); // 3. tv3 = tv2^2\n tv3 = Fp.mul(tv3, v); // 4. tv3 = tv3 * v\n let tv5 = Fp.mul(u, tv3); // 5. tv5 = u * tv3\n tv5 = Fp.pow(tv5, c3); // 6. tv5 = tv5^c3\n tv5 = Fp.mul(tv5, tv2); // 7. tv5 = tv5 * tv2\n tv2 = Fp.mul(tv5, v); // 8. tv2 = tv5 * v\n tv3 = Fp.mul(tv5, u); // 9. tv3 = tv5 * u\n let tv4 = Fp.mul(tv3, tv2); // 10. tv4 = tv3 * tv2\n tv5 = Fp.pow(tv4, c5); // 11. tv5 = tv4^c5\n let isQR = Fp.eql(tv5, Fp.ONE); // 12. isQR = tv5 == 1\n tv2 = Fp.mul(tv3, c7); // 13. tv2 = tv3 * c7\n tv5 = Fp.mul(tv4, tv1); // 14. tv5 = tv4 * tv1\n tv3 = Fp.cmov(tv2, tv3, isQR); // 15. tv3 = CMOV(tv2, tv3, isQR)\n tv4 = Fp.cmov(tv5, tv4, isQR); // 16. tv4 = CMOV(tv5, tv4, isQR)\n // 17. for i in (c1, c1 - 1, ..., 2):\n for (let i = c1; i > _1n; i--) {\n let tv5 = i - _2n; // 18. tv5 = i - 2\n tv5 = _2n << (tv5 - _1n); // 19. tv5 = 2^tv5\n let tvv5 = Fp.pow(tv4, tv5); // 20. tv5 = tv4^tv5\n const e1 = Fp.eql(tvv5, Fp.ONE); // 21. e1 = tv5 == 1\n tv2 = Fp.mul(tv3, tv1); // 22. tv2 = tv3 * tv1\n tv1 = Fp.mul(tv1, tv1); // 23. tv1 = tv1 * tv1\n tvv5 = Fp.mul(tv4, tv1); // 24. tv5 = tv4 * tv1\n tv3 = Fp.cmov(tv2, tv3, e1); // 25. tv3 = CMOV(tv2, tv3, e1)\n tv4 = Fp.cmov(tvv5, tv4, e1); // 26. tv4 = CMOV(tv5, tv4, e1)\n }\n return { isValid: isQR, value: tv3 };\n };\n if (Fp.ORDER % _4n === _3n) {\n // sqrt_ratio_3mod4(u, v)\n const c1 = (Fp.ORDER - _3n) / _4n; // 1. c1 = (q - 3) / 4 # Integer arithmetic\n const c2 = Fp.sqrt(Fp.neg(Z)); // 2. c2 = sqrt(-Z)\n sqrtRatio = (u, v) => {\n let tv1 = Fp.sqr(v); // 1. tv1 = v^2\n const tv2 = Fp.mul(u, v); // 2. tv2 = u * v\n tv1 = Fp.mul(tv1, tv2); // 3. tv1 = tv1 * tv2\n let y1 = Fp.pow(tv1, c1); // 4. y1 = tv1^c1\n y1 = Fp.mul(y1, tv2); // 5. y1 = y1 * tv2\n const y2 = Fp.mul(y1, c2); // 6. y2 = y1 * c2\n const tv3 = Fp.mul(Fp.sqr(y1), v); // 7. tv3 = y1^2; 8. tv3 = tv3 * v\n const isQR = Fp.eql(tv3, u); // 9. isQR = tv3 == u\n let y = Fp.cmov(y2, y1, isQR); // 10. y = CMOV(y2, y1, isQR)\n return { isValid: isQR, value: y }; // 11. return (isQR, y) isQR ? y : y*c2\n };\n }\n // No curves uses that\n // if (Fp.ORDER % _8n === _5n) // sqrt_ratio_5mod8\n return sqrtRatio;\n}\n/**\n * Simplified Shallue-van de Woestijne-Ulas Method\n * https://www.rfc-editor.org/rfc/rfc9380#section-6.6.2\n */\nexport function mapToCurveSimpleSWU(Fp, opts) {\n validateField(Fp);\n const { A, B, Z } = opts;\n if (!Fp.isValid(A) || !Fp.isValid(B) || !Fp.isValid(Z))\n throw new Error('mapToCurveSimpleSWU: invalid opts');\n const sqrtRatio = SWUFpSqrtRatio(Fp, Z);\n if (!Fp.isOdd)\n throw new Error('Field does not have .isOdd()');\n // Input: u, an element of F.\n // Output: (x, y), a point on E.\n return (u) => {\n // prettier-ignore\n let tv1, tv2, tv3, tv4, tv5, tv6, x, y;\n tv1 = Fp.sqr(u); // 1. tv1 = u^2\n tv1 = Fp.mul(tv1, Z); // 2. tv1 = Z * tv1\n tv2 = Fp.sqr(tv1); // 3. tv2 = tv1^2\n tv2 = Fp.add(tv2, tv1); // 4. tv2 = tv2 + tv1\n tv3 = Fp.add(tv2, Fp.ONE); // 5. tv3 = tv2 + 1\n tv3 = Fp.mul(tv3, B); // 6. tv3 = B * tv3\n tv4 = Fp.cmov(Z, Fp.neg(tv2), !Fp.eql(tv2, Fp.ZERO)); // 7. tv4 = CMOV(Z, -tv2, tv2 != 0)\n tv4 = Fp.mul(tv4, A); // 8. tv4 = A * tv4\n tv2 = Fp.sqr(tv3); // 9. tv2 = tv3^2\n tv6 = Fp.sqr(tv4); // 10. tv6 = tv4^2\n tv5 = Fp.mul(tv6, A); // 11. tv5 = A * tv6\n tv2 = Fp.add(tv2, tv5); // 12. tv2 = tv2 + tv5\n tv2 = Fp.mul(tv2, tv3); // 13. tv2 = tv2 * tv3\n tv6 = Fp.mul(tv6, tv4); // 14. tv6 = tv6 * tv4\n tv5 = Fp.mul(tv6, B); // 15. tv5 = B * tv6\n tv2 = Fp.add(tv2, tv5); // 16. tv2 = tv2 + tv5\n x = Fp.mul(tv1, tv3); // 17. x = tv1 * tv3\n const { isValid, value } = sqrtRatio(tv2, tv6); // 18. (is_gx1_square, y1) = sqrt_ratio(tv2, tv6)\n y = Fp.mul(tv1, u); // 19. y = tv1 * u -> Z * u^3 * y1\n y = Fp.mul(y, value); // 20. y = y * y1\n x = Fp.cmov(x, tv3, isValid); // 21. x = CMOV(x, tv3, is_gx1_square)\n y = Fp.cmov(y, value, isValid); // 22. y = CMOV(y, y1, is_gx1_square)\n const e1 = Fp.isOdd(u) === Fp.isOdd(y); // 23. e1 = sgn0(u) == sgn0(y)\n y = Fp.cmov(Fp.neg(y), y, e1); // 24. y = CMOV(-y, y, e1)\n const tv4_inv = FpInvertBatch(Fp, [tv4], true)[0];\n x = Fp.mul(x, tv4_inv); // 25. x = x / tv4\n return { x, y };\n };\n}\nfunction getWLengths(Fp, Fn) {\n return {\n secretKey: Fn.BYTES,\n publicKey: 1 + Fp.BYTES,\n publicKeyUncompressed: 1 + 2 * Fp.BYTES,\n publicKeyHasPrefix: true,\n signature: 2 * Fn.BYTES,\n };\n}\n/**\n * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.\n * This helper ensures no signature functionality is present. Less code, smaller bundle size.\n */\nexport function ecdh(Point, ecdhOpts = {}) {\n const { Fn } = Point;\n const randomBytes_ = ecdhOpts.randomBytes || wcRandomBytes;\n const lengths = Object.assign(getWLengths(Point.Fp, Fn), { seed: getMinHashLength(Fn.ORDER) });\n function isValidSecretKey(secretKey) {\n try {\n const num = Fn.fromBytes(secretKey);\n return Fn.isValidNot0(num);\n }\n catch (error) {\n return false;\n }\n }\n function isValidPublicKey(publicKey, isCompressed) {\n const { publicKey: comp, publicKeyUncompressed } = lengths;\n try {\n const l = publicKey.length;\n if (isCompressed === true && l !== comp)\n return false;\n if (isCompressed === false && l !== publicKeyUncompressed)\n return false;\n return !!Point.fromBytes(publicKey);\n }\n catch (error) {\n return false;\n }\n }\n /**\n * Produces cryptographically secure secret key from random of size\n * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.\n */\n function randomSecretKey(seed = randomBytes_(lengths.seed)) {\n return mapHashToField(abytes(seed, lengths.seed, 'seed'), Fn.ORDER);\n }\n /**\n * Computes public key for a secret key. Checks for validity of the secret key.\n * @param isCompressed whether to return compact (default), or full key\n * @returns Public key, full when isCompressed=false; short when isCompressed=true\n */\n function getPublicKey(secretKey, isCompressed = true) {\n return Point.BASE.multiply(Fn.fromBytes(secretKey)).toBytes(isCompressed);\n }\n /**\n * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.\n */\n function isProbPub(item) {\n const { secretKey, publicKey, publicKeyUncompressed } = lengths;\n if (!isBytes(item))\n return undefined;\n if (('_lengths' in Fn && Fn._lengths) || secretKey === publicKey)\n return undefined;\n const l = abytes(item, undefined, 'key').length;\n return l === publicKey || l === publicKeyUncompressed;\n }\n /**\n * ECDH (Elliptic Curve Diffie Hellman).\n * Computes shared public key from secret key A and public key B.\n * Checks: 1) secret key validity 2) shared key is on-curve.\n * Does NOT hash the result.\n * @param isCompressed whether to return compact (default), or full key\n * @returns shared public key\n */\n function getSharedSecret(secretKeyA, publicKeyB, isCompressed = true) {\n if (isProbPub(secretKeyA) === true)\n throw new Error('first arg must be private key');\n if (isProbPub(publicKeyB) === false)\n throw new Error('second arg must be public key');\n const s = Fn.fromBytes(secretKeyA);\n const b = Point.fromBytes(publicKeyB); // checks for being on-curve\n return b.multiply(s).toBytes(isCompressed);\n }\n const utils = {\n isValidSecretKey,\n isValidPublicKey,\n randomSecretKey,\n };\n const keygen = createKeygen(randomSecretKey, getPublicKey);\n return Object.freeze({ getPublicKey, getSharedSecret, keygen, Point, utils, lengths });\n}\n/**\n * Creates ECDSA signing interface for given elliptic curve `Point` and `hash` function.\n *\n * @param Point created using {@link weierstrass} function\n * @param hash used for 1) message prehash-ing 2) k generation in `sign`, using hmac_drbg(hash)\n * @param ecdsaOpts rarely needed, see {@link ECDSAOpts}\n *\n * @example\n * ```js\n * const p256_Point = weierstrass(...);\n * const p256_sha256 = ecdsa(p256_Point, sha256);\n * const p256_sha224 = ecdsa(p256_Point, sha224);\n * const p256_sha224_r = ecdsa(p256_Point, sha224, { randomBytes: (length) => { ... } });\n * ```\n */\nexport function ecdsa(Point, hash, ecdsaOpts = {}) {\n ahash(hash);\n validateObject(ecdsaOpts, {}, {\n hmac: 'function',\n lowS: 'boolean',\n randomBytes: 'function',\n bits2int: 'function',\n bits2int_modN: 'function',\n });\n ecdsaOpts = Object.assign({}, ecdsaOpts);\n const randomBytes = ecdsaOpts.randomBytes || wcRandomBytes;\n const hmac = ecdsaOpts.hmac || ((key, msg) => nobleHmac(hash, key, msg));\n const { Fp, Fn } = Point;\n const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;\n const { keygen, getPublicKey, getSharedSecret, utils, lengths } = ecdh(Point, ecdsaOpts);\n const defaultSigOpts = {\n prehash: true,\n lowS: typeof ecdsaOpts.lowS === 'boolean' ? ecdsaOpts.lowS : true,\n format: 'compact',\n extraEntropy: false,\n };\n const hasLargeCofactor = CURVE_ORDER * _2n < Fp.ORDER; // Won't CURVE().h > 2n be more effective?\n function isBiggerThanHalfOrder(number) {\n const HALF = CURVE_ORDER >> _1n;\n return number > HALF;\n }\n function validateRS(title, num) {\n if (!Fn.isValidNot0(num))\n throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);\n return num;\n }\n function assertSmallCofactor() {\n // ECDSA recovery is hard for cofactor > 1 curves.\n // In sign, `r = q.x mod n`, and here we recover q.x from r.\n // While recovering q.x >= n, we need to add r+n for cofactor=1 curves.\n // However, for cofactor>1, r+n may not get q.x:\n // r+n*i would need to be done instead where i is unknown.\n // To easily get i, we either need to:\n // a. increase amount of valid recid values (4, 5...); OR\n // b. prohibit non-prime-order signatures (recid > 1).\n if (hasLargeCofactor)\n throw new Error('\"recovered\" sig type is not supported for cofactor >2 curves');\n }\n function validateSigLength(bytes, format) {\n validateSigFormat(format);\n const size = lengths.signature;\n const sizer = format === 'compact' ? size : format === 'recovered' ? size + 1 : undefined;\n return abytes(bytes, sizer);\n }\n /**\n * ECDSA signature with its (r, s) properties. Supports compact, recovered & DER representations.\n */\n class Signature {\n r;\n s;\n recovery;\n constructor(r, s, recovery) {\n this.r = validateRS('r', r); // r in [1..N-1];\n this.s = validateRS('s', s); // s in [1..N-1];\n if (recovery != null) {\n assertSmallCofactor();\n if (![0, 1, 2, 3].includes(recovery))\n throw new Error('invalid recovery id');\n this.recovery = recovery;\n }\n Object.freeze(this);\n }\n static fromBytes(bytes, format = defaultSigOpts.format) {\n validateSigLength(bytes, format);\n let recid;\n if (format === 'der') {\n const { r, s } = DER.toSig(abytes(bytes));\n return new Signature(r, s);\n }\n if (format === 'recovered') {\n recid = bytes[0];\n format = 'compact';\n bytes = bytes.subarray(1);\n }\n const L = lengths.signature / 2;\n const r = bytes.subarray(0, L);\n const s = bytes.subarray(L, L * 2);\n return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);\n }\n static fromHex(hex, format) {\n return this.fromBytes(hexToBytes(hex), format);\n }\n assertRecovery() {\n const { recovery } = this;\n if (recovery == null)\n throw new Error('invalid recovery id: must be present');\n return recovery;\n }\n addRecoveryBit(recovery) {\n return new Signature(this.r, this.s, recovery);\n }\n recoverPublicKey(messageHash) {\n const { r, s } = this;\n const recovery = this.assertRecovery();\n const radj = recovery === 2 || recovery === 3 ? r + CURVE_ORDER : r;\n if (!Fp.isValid(radj))\n throw new Error('invalid recovery id: sig.r+curve.n != R.x');\n const x = Fp.toBytes(radj);\n const R = Point.fromBytes(concatBytes(pprefix((recovery & 1) === 0), x));\n const ir = Fn.inv(radj); // r^-1\n const h = bits2int_modN(abytes(messageHash, undefined, 'msgHash')); // Truncate hash\n const u1 = Fn.create(-h * ir); // -hr^-1\n const u2 = Fn.create(s * ir); // sr^-1\n // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1). unsafe is fine: there is no private data.\n const Q = Point.BASE.multiplyUnsafe(u1).add(R.multiplyUnsafe(u2));\n if (Q.is0())\n throw new Error('invalid recovery: point at infinify');\n Q.assertValidity();\n return Q;\n }\n // Signatures should be low-s, to prevent malleability.\n hasHighS() {\n return isBiggerThanHalfOrder(this.s);\n }\n toBytes(format = defaultSigOpts.format) {\n validateSigFormat(format);\n if (format === 'der')\n return hexToBytes(DER.hexFromSig(this));\n const { r, s } = this;\n const rb = Fn.toBytes(r);\n const sb = Fn.toBytes(s);\n if (format === 'recovered') {\n assertSmallCofactor();\n return concatBytes(Uint8Array.of(this.assertRecovery()), rb, sb);\n }\n return concatBytes(rb, sb);\n }\n toHex(format) {\n return bytesToHex(this.toBytes(format));\n }\n }\n // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.\n // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.\n // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.\n // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors\n const bits2int = ecdsaOpts.bits2int ||\n function bits2int_def(bytes) {\n // Our custom check \"just in case\", for protection against DoS\n if (bytes.length > 8192)\n throw new Error('input is too large');\n // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)\n // for some cases, since bytes.length * 8 is not actual bitLength.\n const num = bytesToNumberBE(bytes); // check for == u8 done here\n const delta = bytes.length * 8 - fnBits; // truncate to nBitLength leftmost bits\n return delta > 0 ? num >> BigInt(delta) : num;\n };\n const bits2int_modN = ecdsaOpts.bits2int_modN ||\n function bits2int_modN_def(bytes) {\n return Fn.create(bits2int(bytes)); // can't use bytesToNumberBE here\n };\n // Pads output with zero as per spec\n const ORDER_MASK = bitMask(fnBits);\n /** Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`. */\n function int2octets(num) {\n // IMPORTANT: the check ensures working for case `Fn.BYTES != Fn.BITS * 8`\n aInRange('num < 2^' + fnBits, num, _0n, ORDER_MASK);\n return Fn.toBytes(num);\n }\n function validateMsgAndHash(message, prehash) {\n abytes(message, undefined, 'message');\n return prehash ? abytes(hash(message), undefined, 'prehashed message') : message;\n }\n /**\n * Steps A, D of RFC6979 3.2.\n * Creates RFC6979 seed; converts msg/privKey to numbers.\n * Used only in sign, not in verify.\n *\n * Warning: we cannot assume here that message has same amount of bytes as curve order,\n * this will be invalid at least for P521. Also it can be bigger for P224 + SHA256.\n */\n function prepSig(message, secretKey, opts) {\n const { lowS, prehash, extraEntropy } = validateSigOpts(opts, defaultSigOpts);\n message = validateMsgAndHash(message, prehash); // RFC6979 3.2 A: h1 = H(m)\n // We can't later call bits2octets, since nested bits2int is broken for curves\n // with fnBits % 8 !== 0. Because of that, we unwrap it here as int2octets call.\n // const bits2octets = (bits) => int2octets(bits2int_modN(bits))\n const h1int = bits2int_modN(message);\n const d = Fn.fromBytes(secretKey); // validate secret key, convert to bigint\n if (!Fn.isValidNot0(d))\n throw new Error('invalid private key');\n const seedArgs = [int2octets(d), int2octets(h1int)];\n // extraEntropy. RFC6979 3.6: additional k' (optional).\n if (extraEntropy != null && extraEntropy !== false) {\n // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')\n // gen random bytes OR pass as-is\n const e = extraEntropy === true ? randomBytes(lengths.secretKey) : extraEntropy;\n seedArgs.push(abytes(e, undefined, 'extraEntropy')); // check for being bytes\n }\n const seed = concatBytes(...seedArgs); // Step D of RFC6979 3.2\n const m = h1int; // no need to call bits2int second time here, it is inside truncateHash!\n // Converts signature params into point w r/s, checks result for validity.\n // To transform k => Signature:\n // q = k⋅G\n // r = q.x mod n\n // s = k^-1(m + rd) mod n\n // Can use scalar blinding b^-1(bm + bdr) where b ∈ [1,q−1] according to\n // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. We've decided against it:\n // a) dependency on CSPRNG b) 15% slowdown c) doesn't really help since bigints are not CT\n function k2sig(kBytes) {\n // RFC 6979 Section 3.2, step 3: k = bits2int(T)\n // Important: all mod() calls here must be done over N\n const k = bits2int(kBytes); // Cannot use fields methods, since it is group element\n if (!Fn.isValidNot0(k))\n return; // Valid scalars (including k) must be in 1..N-1\n const ik = Fn.inv(k); // k^-1 mod n\n const q = Point.BASE.multiply(k).toAffine(); // q = k⋅G\n const r = Fn.create(q.x); // r = q.x mod n\n if (r === _0n)\n return;\n const s = Fn.create(ik * Fn.create(m + r * d)); // s = k^-1(m + rd) mod n\n if (s === _0n)\n return;\n let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3 when q.x>n)\n let normS = s;\n if (lowS && isBiggerThanHalfOrder(s)) {\n normS = Fn.neg(s); // if lowS was passed, ensure s is always in the bottom half of N\n recovery ^= 1;\n }\n return new Signature(r, normS, hasLargeCofactor ? undefined : recovery);\n }\n return { seed, k2sig };\n }\n /**\n * Signs message hash with a secret key.\n *\n * ```\n * sign(m, d) where\n * k = rfc6979_hmac_drbg(m, d)\n * (x, y) = G × k\n * r = x mod n\n * s = (m + dr) / k mod n\n * ```\n */\n function sign(message, secretKey, opts = {}) {\n const { seed, k2sig } = prepSig(message, secretKey, opts); // Steps A, D of RFC6979 3.2.\n const drbg = createHmacDrbg(hash.outputLen, Fn.BYTES, hmac);\n const sig = drbg(seed, k2sig); // Steps B, C, D, E, F, G\n return sig.toBytes(opts.format);\n }\n /**\n * Verifies a signature against message and public key.\n * Rejects lowS signatures by default: see {@link ECDSAVerifyOpts}.\n * Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:\n *\n * ```\n * verify(r, s, h, P) where\n * u1 = hs^-1 mod n\n * u2 = rs^-1 mod n\n * R = u1⋅G + u2⋅P\n * mod(R.x, n) == r\n * ```\n */\n function verify(signature, message, publicKey, opts = {}) {\n const { lowS, prehash, format } = validateSigOpts(opts, defaultSigOpts);\n publicKey = abytes(publicKey, undefined, 'publicKey');\n message = validateMsgAndHash(message, prehash);\n if (!isBytes(signature)) {\n const end = signature instanceof Signature ? ', use sig.toBytes()' : '';\n throw new Error('verify expects Uint8Array signature' + end);\n }\n validateSigLength(signature, format); // execute this twice because we want loud error\n try {\n const sig = Signature.fromBytes(signature, format);\n const P = Point.fromBytes(publicKey);\n if (lowS && sig.hasHighS())\n return false;\n const { r, s } = sig;\n const h = bits2int_modN(message); // mod n, not mod p\n const is = Fn.inv(s); // s^-1 mod n\n const u1 = Fn.create(h * is); // u1 = hs^-1 mod n\n const u2 = Fn.create(r * is); // u2 = rs^-1 mod n\n const R = Point.BASE.multiplyUnsafe(u1).add(P.multiplyUnsafe(u2)); // u1⋅G + u2⋅P\n if (R.is0())\n return false;\n const v = Fn.create(R.x); // v = r.x mod n\n return v === r;\n }\n catch (e) {\n return false;\n }\n }\n function recoverPublicKey(signature, message, opts = {}) {\n const { prehash } = validateSigOpts(opts, defaultSigOpts);\n message = validateMsgAndHash(message, prehash);\n return Signature.fromBytes(signature, 'recovered').recoverPublicKey(message).toBytes();\n }\n return Object.freeze({\n keygen,\n getPublicKey,\n getSharedSecret,\n utils,\n lengths,\n Point,\n sign,\n verify,\n recoverPublicKey,\n Signature,\n hash,\n });\n}\n//# sourceMappingURL=weierstrass.js.map","/**\n * SECG secp256k1. See [pdf](https://www.secg.org/sec2-v2.pdf).\n *\n * Belongs to Koblitz curves: it has efficiently-computable GLV endomorphism ψ,\n * check out {@link EndomorphismOpts}. Seems to be rigid (not backdoored).\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha256 } from '@noble/hashes/sha2.js';\nimport { randomBytes } from '@noble/hashes/utils.js';\nimport { createKeygen } from \"./abstract/curve.js\";\nimport { createHasher, isogenyMap } from \"./abstract/hash-to-curve.js\";\nimport { Field, mapHashToField, pow2 } from \"./abstract/modular.js\";\nimport { ecdsa, mapToCurveSimpleSWU, weierstrass, } from \"./abstract/weierstrass.js\";\nimport { abytes, asciiToBytes, bytesToNumberBE, concatBytes } from \"./utils.js\";\n// Seems like generator was produced from some seed:\n// `Pointk1.BASE.multiply(Pointk1.Fn.inv(2n, N)).toAffine().x`\n// // gives short x 0x3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63n\nconst secp256k1_CURVE = {\n p: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f'),\n n: BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141'),\n h: BigInt(1),\n a: BigInt(0),\n b: BigInt(7),\n Gx: BigInt('0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798'),\n Gy: BigInt('0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8'),\n};\nconst secp256k1_ENDO = {\n beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),\n basises: [\n [BigInt('0x3086d221a7d46bcde86c90e49284eb15'), -BigInt('0xe4437ed6010e88286f547fa90abfe4c3')],\n [BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8'), BigInt('0x3086d221a7d46bcde86c90e49284eb15')],\n ],\n};\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _2n = /* @__PURE__ */ BigInt(2);\n/**\n * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.\n * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]\n */\nfunction sqrtMod(y) {\n const P = secp256k1_CURVE.p;\n // prettier-ignore\n const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);\n // prettier-ignore\n const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);\n const b2 = (y * y * y) % P; // x^3, 11\n const b3 = (b2 * b2 * y) % P; // x^7\n const b6 = (pow2(b3, _3n, P) * b3) % P;\n const b9 = (pow2(b6, _3n, P) * b3) % P;\n const b11 = (pow2(b9, _2n, P) * b2) % P;\n const b22 = (pow2(b11, _11n, P) * b11) % P;\n const b44 = (pow2(b22, _22n, P) * b22) % P;\n const b88 = (pow2(b44, _44n, P) * b44) % P;\n const b176 = (pow2(b88, _88n, P) * b88) % P;\n const b220 = (pow2(b176, _44n, P) * b44) % P;\n const b223 = (pow2(b220, _3n, P) * b3) % P;\n const t1 = (pow2(b223, _23n, P) * b22) % P;\n const t2 = (pow2(t1, _6n, P) * b2) % P;\n const root = pow2(t2, _2n, P);\n if (!Fpk1.eql(Fpk1.sqr(root), y))\n throw new Error('Cannot find square root');\n return root;\n}\nconst Fpk1 = Field(secp256k1_CURVE.p, { sqrt: sqrtMod });\nconst Pointk1 = /* @__PURE__ */ weierstrass(secp256k1_CURVE, {\n Fp: Fpk1,\n endo: secp256k1_ENDO,\n});\n/**\n * secp256k1 curve: ECDSA and ECDH methods.\n *\n * Uses sha256 to hash messages. To use a different hash,\n * pass `{ prehash: false }` to sign / verify.\n *\n * @example\n * ```js\n * import { secp256k1 } from '@noble/curves/secp256k1.js';\n * const { secretKey, publicKey } = secp256k1.keygen();\n * // const publicKey = secp256k1.getPublicKey(secretKey);\n * const msg = new TextEncoder().encode('hello noble');\n * const sig = secp256k1.sign(msg, secretKey);\n * const isValid = secp256k1.verify(sig, msg, publicKey);\n * // const sigKeccak = secp256k1.sign(keccak256(msg), secretKey, { prehash: false });\n * ```\n */\nexport const secp256k1 = /* @__PURE__ */ ecdsa(Pointk1, sha256);\n// Schnorr signatures are superior to ECDSA from above. Below is Schnorr-specific BIP0340 code.\n// https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\n/** An object mapping tags to their tagged hash prefix of [SHA256(tag) | SHA256(tag)] */\nconst TAGGED_HASH_PREFIXES = {};\nfunction taggedHash(tag, ...messages) {\n let tagP = TAGGED_HASH_PREFIXES[tag];\n if (tagP === undefined) {\n const tagH = sha256(asciiToBytes(tag));\n tagP = concatBytes(tagH, tagH);\n TAGGED_HASH_PREFIXES[tag] = tagP;\n }\n return sha256(concatBytes(tagP, ...messages));\n}\n// ECDSA compact points are 33-byte. Schnorr is 32: we strip first byte 0x02 or 0x03\nconst pointToBytes = (point) => point.toBytes(true).slice(1);\nconst hasEven = (y) => y % _2n === _0n;\n// Calculate point, scalar and bytes\nfunction schnorrGetExtPubKey(priv) {\n const { Fn, BASE } = Pointk1;\n const d_ = Fn.fromBytes(priv);\n const p = BASE.multiply(d_); // P = d'⋅G; 0 < d' < n check is done inside\n const scalar = hasEven(p.y) ? d_ : Fn.neg(d_);\n return { scalar, bytes: pointToBytes(p) };\n}\n/**\n * lift_x from BIP340. Convert 32-byte x coordinate to elliptic curve point.\n * @returns valid point checked for being on-curve\n */\nfunction lift_x(x) {\n const Fp = Fpk1;\n if (!Fp.isValidNot0(x))\n throw new Error('invalid x: Fail if x ≥ p');\n const xx = Fp.create(x * x);\n const c = Fp.create(xx * x + BigInt(7)); // Let c = x³ + 7 mod p.\n let y = Fp.sqrt(c); // Let y = c^(p+1)/4 mod p. Same as sqrt().\n // Return the unique point P such that x(P) = x and\n // y(P) = y if y mod 2 = 0 or y(P) = p-y otherwise.\n if (!hasEven(y))\n y = Fp.neg(y);\n const p = Pointk1.fromAffine({ x, y });\n p.assertValidity();\n return p;\n}\nconst num = bytesToNumberBE;\n/**\n * Create tagged hash, convert it to bigint, reduce modulo-n.\n */\nfunction challenge(...args) {\n return Pointk1.Fn.create(num(taggedHash('BIP0340/challenge', ...args)));\n}\n/**\n * Schnorr public key is just `x` coordinate of Point as per BIP340.\n */\nfunction schnorrGetPublicKey(secretKey) {\n return schnorrGetExtPubKey(secretKey).bytes; // d'=int(sk). Fail if d'=0 or d'≥n. Ret bytes(d'⋅G)\n}\n/**\n * Creates Schnorr signature as per BIP340. Verifies itself before returning anything.\n * auxRand is optional and is not the sole source of k generation: bad CSPRNG won't be dangerous.\n */\nfunction schnorrSign(message, secretKey, auxRand = randomBytes(32)) {\n const { Fn } = Pointk1;\n const m = abytes(message, undefined, 'message');\n const { bytes: px, scalar: d } = schnorrGetExtPubKey(secretKey); // checks for isWithinCurveOrder\n const a = abytes(auxRand, 32, 'auxRand'); // Auxiliary random data a: a 32-byte array\n const t = Fn.toBytes(d ^ num(taggedHash('BIP0340/aux', a))); // Let t be the byte-wise xor of bytes(d) and hash/aux(a)\n const rand = taggedHash('BIP0340/nonce', t, px, m); // Let rand = hash/nonce(t || bytes(P) || m)\n // Let k' = int(rand) mod n. Fail if k' = 0. Let R = k'⋅G\n const { bytes: rx, scalar: k } = schnorrGetExtPubKey(rand);\n const e = challenge(rx, px, m); // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.\n const sig = new Uint8Array(64); // Let sig = bytes(R) || bytes((k + ed) mod n).\n sig.set(rx, 0);\n sig.set(Fn.toBytes(Fn.create(k + e * d)), 32);\n // If Verify(bytes(P), m, sig) (see below) returns failure, abort\n if (!schnorrVerify(sig, m, px))\n throw new Error('sign: Invalid signature produced');\n return sig;\n}\n/**\n * Verifies Schnorr signature.\n * Will swallow errors & return false except for initial type validation of arguments.\n */\nfunction schnorrVerify(signature, message, publicKey) {\n const { Fp, Fn, BASE } = Pointk1;\n const sig = abytes(signature, 64, 'signature');\n const m = abytes(message, undefined, 'message');\n const pub = abytes(publicKey, 32, 'publicKey');\n try {\n const P = lift_x(num(pub)); // P = lift_x(int(pk)); fail if that fails\n const r = num(sig.subarray(0, 32)); // Let r = int(sig[0:32]); fail if r ≥ p.\n if (!Fp.isValidNot0(r))\n return false;\n const s = num(sig.subarray(32, 64)); // Let s = int(sig[32:64]); fail if s ≥ n.\n if (!Fn.isValidNot0(s))\n return false;\n const e = challenge(Fn.toBytes(r), pointToBytes(P), m); // int(challenge(bytes(r)||bytes(P)||m))%n\n // R = s⋅G - e⋅P, where -eP == (n-e)P\n const R = BASE.multiplyUnsafe(s).add(P.multiplyUnsafe(Fn.neg(e)));\n const { x, y } = R.toAffine();\n // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.\n if (R.is0() || !hasEven(y) || x !== r)\n return false;\n return true;\n }\n catch (error) {\n return false;\n }\n}\n/**\n * Schnorr signatures over secp256k1.\n * https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\n * @example\n * ```js\n * import { schnorr } from '@noble/curves/secp256k1.js';\n * const { secretKey, publicKey } = schnorr.keygen();\n * // const publicKey = schnorr.getPublicKey(secretKey);\n * const msg = new TextEncoder().encode('hello');\n * const sig = schnorr.sign(msg, secretKey);\n * const isValid = schnorr.verify(sig, msg, publicKey);\n * ```\n */\nexport const schnorr = /* @__PURE__ */ (() => {\n const size = 32;\n const seedLength = 48;\n const randomSecretKey = (seed = randomBytes(seedLength)) => {\n return mapHashToField(seed, secp256k1_CURVE.n);\n };\n return {\n keygen: createKeygen(randomSecretKey, schnorrGetPublicKey),\n getPublicKey: schnorrGetPublicKey,\n sign: schnorrSign,\n verify: schnorrVerify,\n Point: Pointk1,\n utils: {\n randomSecretKey,\n taggedHash,\n lift_x,\n pointToBytes,\n },\n lengths: {\n secretKey: size,\n publicKey: size,\n publicKeyHasPrefix: false,\n signature: size * 2,\n seed: seedLength,\n },\n };\n})();\nconst isoMap = /* @__PURE__ */ (() => isogenyMap(Fpk1, [\n // xNum\n [\n '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7',\n '0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581',\n '0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262',\n '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c',\n ],\n // xDen\n [\n '0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b',\n '0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14',\n '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n ],\n // yNum\n [\n '0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c',\n '0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3',\n '0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931',\n '0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84',\n ],\n // yDen\n [\n '0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b',\n '0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573',\n '0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f',\n '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n ],\n].map((i) => i.map((j) => BigInt(j)))))();\nconst mapSWU = /* @__PURE__ */ (() => mapToCurveSimpleSWU(Fpk1, {\n A: BigInt('0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533'),\n B: BigInt('1771'),\n Z: Fpk1.create(BigInt('-11')),\n}))();\n/** Hashing / encoding to secp256k1 points / field. RFC 9380 methods. */\nexport const secp256k1_hasher = /* @__PURE__ */ (() => createHasher(Pointk1, (scalars) => {\n const { x, y } = mapSWU(Fpk1.create(scalars[0]));\n return isoMap(x, y);\n}, {\n DST: 'secp256k1_XMD:SHA-256_SSWU_RO_',\n encodeDST: 'secp256k1_XMD:SHA-256_SSWU_NU_',\n p: Fpk1.ORDER,\n m: 1,\n k: 128,\n expand: 'xmd',\n hash: sha256,\n}))();\n//# sourceMappingURL=secp256k1.js.map","/**\n * Utilities for hex, bytes, CSPRNG.\n * @module\n */\n/*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */\n// We use WebCrypto aka globalThis.crypto, which exists in browsers and node.js 16+.\n// node.js versions earlier than v19 don't declare it in global scope.\n// For node.js, package.json#exports field mapping rewrites import\n// from `crypto` to `cryptoNode`, which imports native module.\n// Makes the utils un-importable in browsers without a bundler.\n// Once node.js 18 is deprecated (2025-04-30), we can just drop the import.\nimport { crypto } from '@noble/hashes/crypto';\n/** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */\nexport function isBytes(a) {\n return a instanceof Uint8Array || (ArrayBuffer.isView(a) && a.constructor.name === 'Uint8Array');\n}\n/** Asserts something is positive integer. */\nexport function anumber(n) {\n if (!Number.isSafeInteger(n) || n < 0)\n throw new Error('positive integer expected, got ' + n);\n}\n/** Asserts something is Uint8Array. */\nexport function abytes(b, ...lengths) {\n if (!isBytes(b))\n throw new Error('Uint8Array expected');\n if (lengths.length > 0 && !lengths.includes(b.length))\n throw new Error('Uint8Array expected of length ' + lengths + ', got length=' + b.length);\n}\n/** Asserts something is hash */\nexport function ahash(h) {\n if (typeof h !== 'function' || typeof h.create !== 'function')\n throw new Error('Hash should be wrapped by utils.createHasher');\n anumber(h.outputLen);\n anumber(h.blockLen);\n}\n/** Asserts a hash instance has not been destroyed / finished */\nexport function aexists(instance, checkFinished = true) {\n if (instance.destroyed)\n throw new Error('Hash instance has been destroyed');\n if (checkFinished && instance.finished)\n throw new Error('Hash#digest() has already been called');\n}\n/** Asserts output is properly-sized byte array */\nexport function aoutput(out, instance) {\n abytes(out);\n const min = instance.outputLen;\n if (out.length < min) {\n throw new Error('digestInto() expects output buffer of length at least ' + min);\n }\n}\n/** Cast u8 / u16 / u32 to u8. */\nexport function u8(arr) {\n return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/** Cast u8 / u16 / u32 to u32. */\nexport function u32(arr) {\n return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));\n}\n/** Zeroize a byte array. Warning: JS provides no guarantees. */\nexport function clean(...arrays) {\n for (let i = 0; i < arrays.length; i++) {\n arrays[i].fill(0);\n }\n}\n/** Create DataView of an array for easy byte-level manipulation. */\nexport function createView(arr) {\n return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/** The rotate right (circular right shift) operation for uint32 */\nexport function rotr(word, shift) {\n return (word << (32 - shift)) | (word >>> shift);\n}\n/** The rotate left (circular left shift) operation for uint32 */\nexport function rotl(word, shift) {\n return (word << shift) | ((word >>> (32 - shift)) >>> 0);\n}\n/** Is current platform little-endian? Most are. Big-Endian platform: IBM */\nexport const isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44)();\n/** The byte swap operation for uint32 */\nexport function byteSwap(word) {\n return (((word << 24) & 0xff000000) |\n ((word << 8) & 0xff0000) |\n ((word >>> 8) & 0xff00) |\n ((word >>> 24) & 0xff));\n}\n/** Conditionally byte swap if on a big-endian platform */\nexport const swap8IfBE = isLE\n ? (n) => n\n : (n) => byteSwap(n);\n/** @deprecated */\nexport const byteSwapIfBE = swap8IfBE;\n/** In place byte swap for Uint32Array */\nexport function byteSwap32(arr) {\n for (let i = 0; i < arr.length; i++) {\n arr[i] = byteSwap(arr[i]);\n }\n return arr;\n}\nexport const swap32IfBE = isLE\n ? (u) => u\n : byteSwap32;\n// Built-in hex conversion https://caniuse.com/mdn-javascript_builtins_uint8array_fromhex\nconst hasHexBuiltin = /* @__PURE__ */ (() => \n// @ts-ignore\ntypeof Uint8Array.from([]).toHex === 'function' && typeof Uint8Array.fromHex === 'function')();\n// Array where index 0xf0 (240) is mapped to string 'f0'\nconst hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));\n/**\n * Convert byte array to hex string. Uses built-in function, when available.\n * @example bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])) // 'cafe0123'\n */\nexport function bytesToHex(bytes) {\n abytes(bytes);\n // @ts-ignore\n if (hasHexBuiltin)\n return bytes.toHex();\n // pre-caching improves the speed 6x\n let hex = '';\n for (let i = 0; i < bytes.length; i++) {\n hex += hexes[bytes[i]];\n }\n return hex;\n}\n// We use optimized technique to convert hex string to byte array\nconst asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };\nfunction asciiToBase16(ch) {\n if (ch >= asciis._0 && ch <= asciis._9)\n return ch - asciis._0; // '2' => 50-48\n if (ch >= asciis.A && ch <= asciis.F)\n return ch - (asciis.A - 10); // 'B' => 66-(65-10)\n if (ch >= asciis.a && ch <= asciis.f)\n return ch - (asciis.a - 10); // 'b' => 98-(97-10)\n return;\n}\n/**\n * Convert hex string to byte array. Uses built-in function, when available.\n * @example hexToBytes('cafe0123') // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])\n */\nexport function hexToBytes(hex) {\n if (typeof hex !== 'string')\n throw new Error('hex string expected, got ' + typeof hex);\n // @ts-ignore\n if (hasHexBuiltin)\n return Uint8Array.fromHex(hex);\n const hl = hex.length;\n const al = hl / 2;\n if (hl % 2)\n throw new Error('hex string expected, got unpadded hex of length ' + hl);\n const array = new Uint8Array(al);\n for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {\n const n1 = asciiToBase16(hex.charCodeAt(hi));\n const n2 = asciiToBase16(hex.charCodeAt(hi + 1));\n if (n1 === undefined || n2 === undefined) {\n const char = hex[hi] + hex[hi + 1];\n throw new Error('hex string expected, got non-hex character \"' + char + '\" at index ' + hi);\n }\n array[ai] = n1 * 16 + n2; // multiply first octet, e.g. 'a3' => 10*16+3 => 160 + 3 => 163\n }\n return array;\n}\n/**\n * There is no setImmediate in browser and setTimeout is slow.\n * Call of async fn will return Promise, which will be fullfiled only on\n * next scheduler queue processing step and this is exactly what we need.\n */\nexport const nextTick = async () => { };\n/** Returns control to thread each 'tick' ms to avoid blocking. */\nexport async function asyncLoop(iters, tick, cb) {\n let ts = Date.now();\n for (let i = 0; i < iters; i++) {\n cb(i);\n // Date.now() is not monotonic, so in case if clock goes backwards we return return control too\n const diff = Date.now() - ts;\n if (diff >= 0 && diff < tick)\n continue;\n await nextTick();\n ts += diff;\n }\n}\n/**\n * Converts string to bytes using UTF8 encoding.\n * @example utf8ToBytes('abc') // Uint8Array.from([97, 98, 99])\n */\nexport function utf8ToBytes(str) {\n if (typeof str !== 'string')\n throw new Error('string expected');\n return new Uint8Array(new TextEncoder().encode(str)); // https://bugzil.la/1681809\n}\n/**\n * Converts bytes to string using UTF8 encoding.\n * @example bytesToUtf8(Uint8Array.from([97, 98, 99])) // 'abc'\n */\nexport function bytesToUtf8(bytes) {\n return new TextDecoder().decode(bytes);\n}\n/**\n * Normalizes (non-hex) string or Uint8Array to Uint8Array.\n * Warning: when Uint8Array is passed, it would NOT get copied.\n * Keep in mind for future mutable operations.\n */\nexport function toBytes(data) {\n if (typeof data === 'string')\n data = utf8ToBytes(data);\n abytes(data);\n return data;\n}\n/**\n * Helper for KDFs: consumes uint8array or string.\n * When string is passed, does utf8 decoding, using TextDecoder.\n */\nexport function kdfInputToBytes(data) {\n if (typeof data === 'string')\n data = utf8ToBytes(data);\n abytes(data);\n return data;\n}\n/** Copies several Uint8Arrays into one. */\nexport function concatBytes(...arrays) {\n let sum = 0;\n for (let i = 0; i < arrays.length; i++) {\n const a = arrays[i];\n abytes(a);\n sum += a.length;\n }\n const res = new Uint8Array(sum);\n for (let i = 0, pad = 0; i < arrays.length; i++) {\n const a = arrays[i];\n res.set(a, pad);\n pad += a.length;\n }\n return res;\n}\nexport function checkOpts(defaults, opts) {\n if (opts !== undefined && {}.toString.call(opts) !== '[object Object]')\n throw new Error('options should be object or undefined');\n const merged = Object.assign(defaults, opts);\n return merged;\n}\n/** For runtime check if class implements interface */\nexport class Hash {\n}\n/** Wraps hash function, creating an interface on top of it */\nexport function createHasher(hashCons) {\n const hashC = (msg) => hashCons().update(toBytes(msg)).digest();\n const tmp = hashCons();\n hashC.outputLen = tmp.outputLen;\n hashC.blockLen = tmp.blockLen;\n hashC.create = () => hashCons();\n return hashC;\n}\nexport function createOptHasher(hashCons) {\n const hashC = (msg, opts) => hashCons(opts).update(toBytes(msg)).digest();\n const tmp = hashCons({});\n hashC.outputLen = tmp.outputLen;\n hashC.blockLen = tmp.blockLen;\n hashC.create = (opts) => hashCons(opts);\n return hashC;\n}\nexport function createXOFer(hashCons) {\n const hashC = (msg, opts) => hashCons(opts).update(toBytes(msg)).digest();\n const tmp = hashCons({});\n hashC.outputLen = tmp.outputLen;\n hashC.blockLen = tmp.blockLen;\n hashC.create = (opts) => hashCons(opts);\n return hashC;\n}\nexport const wrapConstructor = createHasher;\nexport const wrapConstructorWithOpts = createOptHasher;\nexport const wrapXOFConstructorWithOpts = createXOFer;\n/** Cryptographically secure PRNG. Uses internal OS-level `crypto.getRandomValues`. */\nexport function randomBytes(bytesLength = 32) {\n if (crypto && typeof crypto.getRandomValues === 'function') {\n return crypto.getRandomValues(new Uint8Array(bytesLength));\n }\n // Legacy Node.js compatibility\n if (crypto && typeof crypto.randomBytes === 'function') {\n return Uint8Array.from(crypto.randomBytes(bytesLength));\n }\n throw new Error('crypto.getRandomValues must be defined');\n}\n//# sourceMappingURL=utils.js.map","/**\n * Internal Merkle-Damgard hash utils.\n * @module\n */\nimport { Hash, abytes, aexists, aoutput, clean, createView, toBytes } from \"./utils.js\";\n/** Polyfill for Safari 14. https://caniuse.com/mdn-javascript_builtins_dataview_setbiguint64 */\nexport function setBigUint64(view, byteOffset, value, isLE) {\n if (typeof view.setBigUint64 === 'function')\n return view.setBigUint64(byteOffset, value, isLE);\n const _32n = BigInt(32);\n const _u32_max = BigInt(0xffffffff);\n const wh = Number((value >> _32n) & _u32_max);\n const wl = Number(value & _u32_max);\n const h = isLE ? 4 : 0;\n const l = isLE ? 0 : 4;\n view.setUint32(byteOffset + h, wh, isLE);\n view.setUint32(byteOffset + l, wl, isLE);\n}\n/** Choice: a ? b : c */\nexport function Chi(a, b, c) {\n return (a & b) ^ (~a & c);\n}\n/** Majority function, true if any two inputs is true. */\nexport function Maj(a, b, c) {\n return (a & b) ^ (a & c) ^ (b & c);\n}\n/**\n * Merkle-Damgard hash construction base class.\n * Could be used to create MD5, RIPEMD, SHA1, SHA2.\n */\nexport class HashMD extends Hash {\n constructor(blockLen, outputLen, padOffset, isLE) {\n super();\n this.finished = false;\n this.length = 0;\n this.pos = 0;\n this.destroyed = false;\n this.blockLen = blockLen;\n this.outputLen = outputLen;\n this.padOffset = padOffset;\n this.isLE = isLE;\n this.buffer = new Uint8Array(blockLen);\n this.view = createView(this.buffer);\n }\n update(data) {\n aexists(this);\n data = toBytes(data);\n abytes(data);\n const { view, buffer, blockLen } = this;\n const len = data.length;\n for (let pos = 0; pos < len;) {\n const take = Math.min(blockLen - this.pos, len - pos);\n // Fast path: we have at least one block in input, cast it to view and process\n if (take === blockLen) {\n const dataView = createView(data);\n for (; blockLen <= len - pos; pos += blockLen)\n this.process(dataView, pos);\n continue;\n }\n buffer.set(data.subarray(pos, pos + take), this.pos);\n this.pos += take;\n pos += take;\n if (this.pos === blockLen) {\n this.process(view, 0);\n this.pos = 0;\n }\n }\n this.length += data.length;\n this.roundClean();\n return this;\n }\n digestInto(out) {\n aexists(this);\n aoutput(out, this);\n this.finished = true;\n // Padding\n // We can avoid allocation of buffer for padding completely if it\n // was previously not allocated here. But it won't change performance.\n const { buffer, view, blockLen, isLE } = this;\n let { pos } = this;\n // append the bit '1' to the message\n buffer[pos++] = 0b10000000;\n clean(this.buffer.subarray(pos));\n // we have less than padOffset left in buffer, so we cannot put length in\n // current block, need process it and pad again\n if (this.padOffset > blockLen - pos) {\n this.process(view, 0);\n pos = 0;\n }\n // Pad until full block byte with zeros\n for (let i = pos; i < blockLen; i++)\n buffer[i] = 0;\n // Note: sha512 requires length to be 128bit integer, but length in JS will overflow before that\n // You need to write around 2 exabytes (u64_max / 8 / (1024**6)) for this to happen.\n // So we just write lowest 64 bits of that value.\n setBigUint64(view, blockLen - 8, BigInt(this.length * 8), isLE);\n this.process(view, 0);\n const oview = createView(out);\n const len = this.outputLen;\n // NOTE: we do division by 4 later, which should be fused in single op with modulo by JIT\n if (len % 4)\n throw new Error('_sha2: outputLen should be aligned to 32bit');\n const outLen = len / 4;\n const state = this.get();\n if (outLen > state.length)\n throw new Error('_sha2: outputLen bigger than state');\n for (let i = 0; i < outLen; i++)\n oview.setUint32(4 * i, state[i], isLE);\n }\n digest() {\n const { buffer, outputLen } = this;\n this.digestInto(buffer);\n const res = buffer.slice(0, outputLen);\n this.destroy();\n return res;\n }\n _cloneInto(to) {\n to || (to = new this.constructor());\n to.set(...this.get());\n const { blockLen, buffer, length, finished, destroyed, pos } = this;\n to.destroyed = destroyed;\n to.finished = finished;\n to.length = length;\n to.pos = pos;\n if (length % blockLen)\n to.buffer.set(buffer);\n return to;\n }\n clone() {\n return this._cloneInto();\n }\n}\n/**\n * Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.\n * Check out `test/misc/sha2-gen-iv.js` for recomputation guide.\n */\n/** Initial SHA256 state. Bits 0..32 of frac part of sqrt of primes 2..19 */\nexport const SHA256_IV = /* @__PURE__ */ Uint32Array.from([\n 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,\n]);\n/** Initial SHA224 state. Bits 32..64 of frac part of sqrt of primes 23..53 */\nexport const SHA224_IV = /* @__PURE__ */ Uint32Array.from([\n 0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939, 0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4,\n]);\n/** Initial SHA384 state. Bits 0..64 of frac part of sqrt of primes 23..53 */\nexport const SHA384_IV = /* @__PURE__ */ Uint32Array.from([\n 0xcbbb9d5d, 0xc1059ed8, 0x629a292a, 0x367cd507, 0x9159015a, 0x3070dd17, 0x152fecd8, 0xf70e5939,\n 0x67332667, 0xffc00b31, 0x8eb44a87, 0x68581511, 0xdb0c2e0d, 0x64f98fa7, 0x47b5481d, 0xbefa4fa4,\n]);\n/** Initial SHA512 state. Bits 0..64 of frac part of sqrt of primes 2..19 */\nexport const SHA512_IV = /* @__PURE__ */ Uint32Array.from([\n 0x6a09e667, 0xf3bcc908, 0xbb67ae85, 0x84caa73b, 0x3c6ef372, 0xfe94f82b, 0xa54ff53a, 0x5f1d36f1,\n 0x510e527f, 0xade682d1, 0x9b05688c, 0x2b3e6c1f, 0x1f83d9ab, 0xfb41bd6b, 0x5be0cd19, 0x137e2179,\n]);\n//# sourceMappingURL=_md.js.map","/**\n\nSHA1 (RFC 3174), MD5 (RFC 1321) and RIPEMD160 (RFC 2286) legacy, weak hash functions.\nDon't use them in a new protocol. What \"weak\" means:\n\n- Collisions can be made with 2^18 effort in MD5, 2^60 in SHA1, 2^80 in RIPEMD160.\n- No practical pre-image attacks (only theoretical, 2^123.4)\n- HMAC seems kinda ok: https://datatracker.ietf.org/doc/html/rfc6151\n * @module\n */\nimport { Chi, HashMD, Maj } from \"./_md.js\";\nimport { clean, createHasher, rotl } from \"./utils.js\";\n/** Initial SHA1 state */\nconst SHA1_IV = /* @__PURE__ */ Uint32Array.from([\n 0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0,\n]);\n// Reusable temporary buffer\nconst SHA1_W = /* @__PURE__ */ new Uint32Array(80);\n/** SHA1 legacy hash class. */\nexport class SHA1 extends HashMD {\n constructor() {\n super(64, 20, 8, false);\n this.A = SHA1_IV[0] | 0;\n this.B = SHA1_IV[1] | 0;\n this.C = SHA1_IV[2] | 0;\n this.D = SHA1_IV[3] | 0;\n this.E = SHA1_IV[4] | 0;\n }\n get() {\n const { A, B, C, D, E } = this;\n return [A, B, C, D, E];\n }\n set(A, B, C, D, E) {\n this.A = A | 0;\n this.B = B | 0;\n this.C = C | 0;\n this.D = D | 0;\n this.E = E | 0;\n }\n process(view, offset) {\n for (let i = 0; i < 16; i++, offset += 4)\n SHA1_W[i] = view.getUint32(offset, false);\n for (let i = 16; i < 80; i++)\n SHA1_W[i] = rotl(SHA1_W[i - 3] ^ SHA1_W[i - 8] ^ SHA1_W[i - 14] ^ SHA1_W[i - 16], 1);\n // Compression function main loop, 80 rounds\n let { A, B, C, D, E } = this;\n for (let i = 0; i < 80; i++) {\n let F, K;\n if (i < 20) {\n F = Chi(B, C, D);\n K = 0x5a827999;\n }\n else if (i < 40) {\n F = B ^ C ^ D;\n K = 0x6ed9eba1;\n }\n else if (i < 60) {\n F = Maj(B, C, D);\n K = 0x8f1bbcdc;\n }\n else {\n F = B ^ C ^ D;\n K = 0xca62c1d6;\n }\n const T = (rotl(A, 5) + F + E + K + SHA1_W[i]) | 0;\n E = D;\n D = C;\n C = rotl(B, 30);\n B = A;\n A = T;\n }\n // Add the compressed chunk to the current hash value\n A = (A + this.A) | 0;\n B = (B + this.B) | 0;\n C = (C + this.C) | 0;\n D = (D + this.D) | 0;\n E = (E + this.E) | 0;\n this.set(A, B, C, D, E);\n }\n roundClean() {\n clean(SHA1_W);\n }\n destroy() {\n this.set(0, 0, 0, 0, 0);\n clean(this.buffer);\n }\n}\n/** SHA1 (RFC 3174) legacy hash function. It was cryptographically broken. */\nexport const sha1 = /* @__PURE__ */ createHasher(() => new SHA1());\n/** Per-round constants */\nconst p32 = /* @__PURE__ */ Math.pow(2, 32);\nconst K = /* @__PURE__ */ Array.from({ length: 64 }, (_, i) => Math.floor(p32 * Math.abs(Math.sin(i + 1))));\n/** md5 initial state: same as sha1, but 4 u32 instead of 5. */\nconst MD5_IV = /* @__PURE__ */ SHA1_IV.slice(0, 4);\n// Reusable temporary buffer\nconst MD5_W = /* @__PURE__ */ new Uint32Array(16);\n/** MD5 legacy hash class. */\nexport class MD5 extends HashMD {\n constructor() {\n super(64, 16, 8, true);\n this.A = MD5_IV[0] | 0;\n this.B = MD5_IV[1] | 0;\n this.C = MD5_IV[2] | 0;\n this.D = MD5_IV[3] | 0;\n }\n get() {\n const { A, B, C, D } = this;\n return [A, B, C, D];\n }\n set(A, B, C, D) {\n this.A = A | 0;\n this.B = B | 0;\n this.C = C | 0;\n this.D = D | 0;\n }\n process(view, offset) {\n for (let i = 0; i < 16; i++, offset += 4)\n MD5_W[i] = view.getUint32(offset, true);\n // Compression function main loop, 64 rounds\n let { A, B, C, D } = this;\n for (let i = 0; i < 64; i++) {\n let F, g, s;\n if (i < 16) {\n F = Chi(B, C, D);\n g = i;\n s = [7, 12, 17, 22];\n }\n else if (i < 32) {\n F = Chi(D, B, C);\n g = (5 * i + 1) % 16;\n s = [5, 9, 14, 20];\n }\n else if (i < 48) {\n F = B ^ C ^ D;\n g = (3 * i + 5) % 16;\n s = [4, 11, 16, 23];\n }\n else {\n F = C ^ (B | ~D);\n g = (7 * i) % 16;\n s = [6, 10, 15, 21];\n }\n F = F + A + K[i] + MD5_W[g];\n A = D;\n D = C;\n C = B;\n B = B + rotl(F, s[i % 4]);\n }\n // Add the compressed chunk to the current hash value\n A = (A + this.A) | 0;\n B = (B + this.B) | 0;\n C = (C + this.C) | 0;\n D = (D + this.D) | 0;\n this.set(A, B, C, D);\n }\n roundClean() {\n clean(MD5_W);\n }\n destroy() {\n this.set(0, 0, 0, 0);\n clean(this.buffer);\n }\n}\n/**\n * MD5 (RFC 1321) legacy hash function. It was cryptographically broken.\n * MD5 architecture is similar to SHA1, with some differences:\n * - Reduced output length: 16 bytes (128 bit) instead of 20\n * - 64 rounds, instead of 80\n * - Little-endian: could be faster, but will require more code\n * - Non-linear index selection: huge speed-up for unroll\n * - Per round constants: more memory accesses, additional speed-up for unroll\n */\nexport const md5 = /* @__PURE__ */ createHasher(() => new MD5());\n// RIPEMD-160\nconst Rho160 = /* @__PURE__ */ Uint8Array.from([\n 7, 4, 13, 1, 10, 6, 15, 3, 12, 0, 9, 5, 2, 14, 11, 8,\n]);\nconst Id160 = /* @__PURE__ */ (() => Uint8Array.from(new Array(16).fill(0).map((_, i) => i)))();\nconst Pi160 = /* @__PURE__ */ (() => Id160.map((i) => (9 * i + 5) % 16))();\nconst idxLR = /* @__PURE__ */ (() => {\n const L = [Id160];\n const R = [Pi160];\n const res = [L, R];\n for (let i = 0; i < 4; i++)\n for (let j of res)\n j.push(j[i].map((k) => Rho160[k]));\n return res;\n})();\nconst idxL = /* @__PURE__ */ (() => idxLR[0])();\nconst idxR = /* @__PURE__ */ (() => idxLR[1])();\n// const [idxL, idxR] = idxLR;\nconst shifts160 = /* @__PURE__ */ [\n [11, 14, 15, 12, 5, 8, 7, 9, 11, 13, 14, 15, 6, 7, 9, 8],\n [12, 13, 11, 15, 6, 9, 9, 7, 12, 15, 11, 13, 7, 8, 7, 7],\n [13, 15, 14, 11, 7, 7, 6, 8, 13, 14, 13, 12, 5, 5, 6, 9],\n [14, 11, 12, 14, 8, 6, 5, 5, 15, 12, 15, 14, 9, 9, 8, 6],\n [15, 12, 13, 13, 9, 5, 8, 6, 14, 11, 12, 11, 8, 6, 5, 5],\n].map((i) => Uint8Array.from(i));\nconst shiftsL160 = /* @__PURE__ */ idxL.map((idx, i) => idx.map((j) => shifts160[i][j]));\nconst shiftsR160 = /* @__PURE__ */ idxR.map((idx, i) => idx.map((j) => shifts160[i][j]));\nconst Kl160 = /* @__PURE__ */ Uint32Array.from([\n 0x00000000, 0x5a827999, 0x6ed9eba1, 0x8f1bbcdc, 0xa953fd4e,\n]);\nconst Kr160 = /* @__PURE__ */ Uint32Array.from([\n 0x50a28be6, 0x5c4dd124, 0x6d703ef3, 0x7a6d76e9, 0x00000000,\n]);\n// It's called f() in spec.\nfunction ripemd_f(group, x, y, z) {\n if (group === 0)\n return x ^ y ^ z;\n if (group === 1)\n return (x & y) | (~x & z);\n if (group === 2)\n return (x | ~y) ^ z;\n if (group === 3)\n return (x & z) | (y & ~z);\n return x ^ (y | ~z);\n}\n// Reusable temporary buffer\nconst BUF_160 = /* @__PURE__ */ new Uint32Array(16);\nexport class RIPEMD160 extends HashMD {\n constructor() {\n super(64, 20, 8, true);\n this.h0 = 0x67452301 | 0;\n this.h1 = 0xefcdab89 | 0;\n this.h2 = 0x98badcfe | 0;\n this.h3 = 0x10325476 | 0;\n this.h4 = 0xc3d2e1f0 | 0;\n }\n get() {\n const { h0, h1, h2, h3, h4 } = this;\n return [h0, h1, h2, h3, h4];\n }\n set(h0, h1, h2, h3, h4) {\n this.h0 = h0 | 0;\n this.h1 = h1 | 0;\n this.h2 = h2 | 0;\n this.h3 = h3 | 0;\n this.h4 = h4 | 0;\n }\n process(view, offset) {\n for (let i = 0; i < 16; i++, offset += 4)\n BUF_160[i] = view.getUint32(offset, true);\n // prettier-ignore\n let al = this.h0 | 0, ar = al, bl = this.h1 | 0, br = bl, cl = this.h2 | 0, cr = cl, dl = this.h3 | 0, dr = dl, el = this.h4 | 0, er = el;\n // Instead of iterating 0 to 80, we split it into 5 groups\n // And use the groups in constants, functions, etc. Much simpler\n for (let group = 0; group < 5; group++) {\n const rGroup = 4 - group;\n const hbl = Kl160[group], hbr = Kr160[group]; // prettier-ignore\n const rl = idxL[group], rr = idxR[group]; // prettier-ignore\n const sl = shiftsL160[group], sr = shiftsR160[group]; // prettier-ignore\n for (let i = 0; i < 16; i++) {\n const tl = (rotl(al + ripemd_f(group, bl, cl, dl) + BUF_160[rl[i]] + hbl, sl[i]) + el) | 0;\n al = el, el = dl, dl = rotl(cl, 10) | 0, cl = bl, bl = tl; // prettier-ignore\n }\n // 2 loops are 10% faster\n for (let i = 0; i < 16; i++) {\n const tr = (rotl(ar + ripemd_f(rGroup, br, cr, dr) + BUF_160[rr[i]] + hbr, sr[i]) + er) | 0;\n ar = er, er = dr, dr = rotl(cr, 10) | 0, cr = br, br = tr; // prettier-ignore\n }\n }\n // Add the compressed chunk to the current hash value\n this.set((this.h1 + cl + dr) | 0, (this.h2 + dl + er) | 0, (this.h3 + el + ar) | 0, (this.h4 + al + br) | 0, (this.h0 + bl + cr) | 0);\n }\n roundClean() {\n clean(BUF_160);\n }\n destroy() {\n this.destroyed = true;\n clean(this.buffer);\n this.set(0, 0, 0, 0, 0);\n }\n}\n/**\n * RIPEMD-160 - a legacy hash function from 1990s.\n * * https://homes.esat.kuleuven.be/~bosselae/ripemd160.html\n * * https://homes.esat.kuleuven.be/~bosselae/ripemd160/pdf/AB-9601/AB-9601.pdf\n */\nexport const ripemd160 = /* @__PURE__ */ createHasher(() => new RIPEMD160());\n//# sourceMappingURL=legacy.js.map","/**\n * RIPEMD-160 legacy hash function.\n * https://homes.esat.kuleuven.be/~bosselae/ripemd160.html\n * https://homes.esat.kuleuven.be/~bosselae/ripemd160/pdf/AB-9601/AB-9601.pdf\n * @module\n * @deprecated\n */\nimport { RIPEMD160 as RIPEMD160n, ripemd160 as ripemd160n } from \"./legacy.js\";\n/** @deprecated Use import from `noble/hashes/legacy` module */\nexport const RIPEMD160 = RIPEMD160n;\n/** @deprecated Use import from `noble/hashes/legacy` module */\nexport const ripemd160 = ripemd160n;\n//# sourceMappingURL=ripemd160.js.map","/**\n * SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.\n * SHA256 is the fastest hash implementable in JS, even faster than Blake3.\n * Check out [RFC 4634](https://datatracker.ietf.org/doc/html/rfc4634) and\n * [FIPS 180-4](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf).\n * @module\n */\nimport { Chi, HashMD, Maj, SHA224_IV, SHA256_IV, SHA384_IV, SHA512_IV } from \"./_md.js\";\nimport * as u64 from \"./_u64.js\";\nimport { clean, createHasher, rotr } from \"./utils.js\";\n/**\n * Round constants:\n * First 32 bits of fractional parts of the cube roots of the first 64 primes 2..311)\n */\n// prettier-ignore\nconst SHA256_K = /* @__PURE__ */ Uint32Array.from([\n 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,\n 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,\n 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,\n 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,\n 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,\n 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,\n 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,\n 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2\n]);\n/** Reusable temporary buffer. \"W\" comes straight from spec. */\nconst SHA256_W = /* @__PURE__ */ new Uint32Array(64);\nexport class SHA256 extends HashMD {\n constructor(outputLen = 32) {\n super(64, outputLen, 8, false);\n // We cannot use array here since array allows indexing by variable\n // which means optimizer/compiler cannot use registers.\n this.A = SHA256_IV[0] | 0;\n this.B = SHA256_IV[1] | 0;\n this.C = SHA256_IV[2] | 0;\n this.D = SHA256_IV[3] | 0;\n this.E = SHA256_IV[4] | 0;\n this.F = SHA256_IV[5] | 0;\n this.G = SHA256_IV[6] | 0;\n this.H = SHA256_IV[7] | 0;\n }\n get() {\n const { A, B, C, D, E, F, G, H } = this;\n return [A, B, C, D, E, F, G, H];\n }\n // prettier-ignore\n set(A, B, C, D, E, F, G, H) {\n this.A = A | 0;\n this.B = B | 0;\n this.C = C | 0;\n this.D = D | 0;\n this.E = E | 0;\n this.F = F | 0;\n this.G = G | 0;\n this.H = H | 0;\n }\n process(view, offset) {\n // Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array\n for (let i = 0; i < 16; i++, offset += 4)\n SHA256_W[i] = view.getUint32(offset, false);\n for (let i = 16; i < 64; i++) {\n const W15 = SHA256_W[i - 15];\n const W2 = SHA256_W[i - 2];\n const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ (W15 >>> 3);\n const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ (W2 >>> 10);\n SHA256_W[i] = (s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16]) | 0;\n }\n // Compression function main loop, 64 rounds\n let { A, B, C, D, E, F, G, H } = this;\n for (let i = 0; i < 64; i++) {\n const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);\n const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);\n const T2 = (sigma0 + Maj(A, B, C)) | 0;\n H = G;\n G = F;\n F = E;\n E = (D + T1) | 0;\n D = C;\n C = B;\n B = A;\n A = (T1 + T2) | 0;\n }\n // Add the compressed chunk to the current hash value\n A = (A + this.A) | 0;\n B = (B + this.B) | 0;\n C = (C + this.C) | 0;\n D = (D + this.D) | 0;\n E = (E + this.E) | 0;\n F = (F + this.F) | 0;\n G = (G + this.G) | 0;\n H = (H + this.H) | 0;\n this.set(A, B, C, D, E, F, G, H);\n }\n roundClean() {\n clean(SHA256_W);\n }\n destroy() {\n this.set(0, 0, 0, 0, 0, 0, 0, 0);\n clean(this.buffer);\n }\n}\nexport class SHA224 extends SHA256 {\n constructor() {\n super(28);\n this.A = SHA224_IV[0] | 0;\n this.B = SHA224_IV[1] | 0;\n this.C = SHA224_IV[2] | 0;\n this.D = SHA224_IV[3] | 0;\n this.E = SHA224_IV[4] | 0;\n this.F = SHA224_IV[5] | 0;\n this.G = SHA224_IV[6] | 0;\n this.H = SHA224_IV[7] | 0;\n }\n}\n// SHA2-512 is slower than sha256 in js because u64 operations are slow.\n// Round contants\n// First 32 bits of the fractional parts of the cube roots of the first 80 primes 2..409\n// prettier-ignore\nconst K512 = /* @__PURE__ */ (() => u64.split([\n '0x428a2f98d728ae22', '0x7137449123ef65cd', '0xb5c0fbcfec4d3b2f', '0xe9b5dba58189dbbc',\n '0x3956c25bf348b538', '0x59f111f1b605d019', '0x923f82a4af194f9b', '0xab1c5ed5da6d8118',\n '0xd807aa98a3030242', '0x12835b0145706fbe', '0x243185be4ee4b28c', '0x550c7dc3d5ffb4e2',\n '0x72be5d74f27b896f', '0x80deb1fe3b1696b1', '0x9bdc06a725c71235', '0xc19bf174cf692694',\n '0xe49b69c19ef14ad2', '0xefbe4786384f25e3', '0x0fc19dc68b8cd5b5', '0x240ca1cc77ac9c65',\n '0x2de92c6f592b0275', '0x4a7484aa6ea6e483', '0x5cb0a9dcbd41fbd4', '0x76f988da831153b5',\n '0x983e5152ee66dfab', '0xa831c66d2db43210', '0xb00327c898fb213f', '0xbf597fc7beef0ee4',\n '0xc6e00bf33da88fc2', '0xd5a79147930aa725', '0x06ca6351e003826f', '0x142929670a0e6e70',\n '0x27b70a8546d22ffc', '0x2e1b21385c26c926', '0x4d2c6dfc5ac42aed', '0x53380d139d95b3df',\n '0x650a73548baf63de', '0x766a0abb3c77b2a8', '0x81c2c92e47edaee6', '0x92722c851482353b',\n '0xa2bfe8a14cf10364', '0xa81a664bbc423001', '0xc24b8b70d0f89791', '0xc76c51a30654be30',\n '0xd192e819d6ef5218', '0xd69906245565a910', '0xf40e35855771202a', '0x106aa07032bbd1b8',\n '0x19a4c116b8d2d0c8', '0x1e376c085141ab53', '0x2748774cdf8eeb99', '0x34b0bcb5e19b48a8',\n '0x391c0cb3c5c95a63', '0x4ed8aa4ae3418acb', '0x5b9cca4f7763e373', '0x682e6ff3d6b2b8a3',\n '0x748f82ee5defb2fc', '0x78a5636f43172f60', '0x84c87814a1f0ab72', '0x8cc702081a6439ec',\n '0x90befffa23631e28', '0xa4506cebde82bde9', '0xbef9a3f7b2c67915', '0xc67178f2e372532b',\n '0xca273eceea26619c', '0xd186b8c721c0c207', '0xeada7dd6cde0eb1e', '0xf57d4f7fee6ed178',\n '0x06f067aa72176fba', '0x0a637dc5a2c898a6', '0x113f9804bef90dae', '0x1b710b35131c471b',\n '0x28db77f523047d84', '0x32caab7b40c72493', '0x3c9ebe0a15c9bebc', '0x431d67c49c100d4c',\n '0x4cc5d4becb3e42b6', '0x597f299cfc657e2a', '0x5fcb6fab3ad6faec', '0x6c44198c4a475817'\n].map(n => BigInt(n))))();\nconst SHA512_Kh = /* @__PURE__ */ (() => K512[0])();\nconst SHA512_Kl = /* @__PURE__ */ (() => K512[1])();\n// Reusable temporary buffers\nconst SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);\nconst SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);\nexport class SHA512 extends HashMD {\n constructor(outputLen = 64) {\n super(128, outputLen, 16, false);\n // We cannot use array here since array allows indexing by variable\n // which means optimizer/compiler cannot use registers.\n // h -- high 32 bits, l -- low 32 bits\n this.Ah = SHA512_IV[0] | 0;\n this.Al = SHA512_IV[1] | 0;\n this.Bh = SHA512_IV[2] | 0;\n this.Bl = SHA512_IV[3] | 0;\n this.Ch = SHA512_IV[4] | 0;\n this.Cl = SHA512_IV[5] | 0;\n this.Dh = SHA512_IV[6] | 0;\n this.Dl = SHA512_IV[7] | 0;\n this.Eh = SHA512_IV[8] | 0;\n this.El = SHA512_IV[9] | 0;\n this.Fh = SHA512_IV[10] | 0;\n this.Fl = SHA512_IV[11] | 0;\n this.Gh = SHA512_IV[12] | 0;\n this.Gl = SHA512_IV[13] | 0;\n this.Hh = SHA512_IV[14] | 0;\n this.Hl = SHA512_IV[15] | 0;\n }\n // prettier-ignore\n get() {\n const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];\n }\n // prettier-ignore\n set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {\n this.Ah = Ah | 0;\n this.Al = Al | 0;\n this.Bh = Bh | 0;\n this.Bl = Bl | 0;\n this.Ch = Ch | 0;\n this.Cl = Cl | 0;\n this.Dh = Dh | 0;\n this.Dl = Dl | 0;\n this.Eh = Eh | 0;\n this.El = El | 0;\n this.Fh = Fh | 0;\n this.Fl = Fl | 0;\n this.Gh = Gh | 0;\n this.Gl = Gl | 0;\n this.Hh = Hh | 0;\n this.Hl = Hl | 0;\n }\n process(view, offset) {\n // Extend the first 16 words into the remaining 64 words w[16..79] of the message schedule array\n for (let i = 0; i < 16; i++, offset += 4) {\n SHA512_W_H[i] = view.getUint32(offset);\n SHA512_W_L[i] = view.getUint32((offset += 4));\n }\n for (let i = 16; i < 80; i++) {\n // s0 := (w[i-15] rightrotate 1) xor (w[i-15] rightrotate 8) xor (w[i-15] rightshift 7)\n const W15h = SHA512_W_H[i - 15] | 0;\n const W15l = SHA512_W_L[i - 15] | 0;\n const s0h = u64.rotrSH(W15h, W15l, 1) ^ u64.rotrSH(W15h, W15l, 8) ^ u64.shrSH(W15h, W15l, 7);\n const s0l = u64.rotrSL(W15h, W15l, 1) ^ u64.rotrSL(W15h, W15l, 8) ^ u64.shrSL(W15h, W15l, 7);\n // s1 := (w[i-2] rightrotate 19) xor (w[i-2] rightrotate 61) xor (w[i-2] rightshift 6)\n const W2h = SHA512_W_H[i - 2] | 0;\n const W2l = SHA512_W_L[i - 2] | 0;\n const s1h = u64.rotrSH(W2h, W2l, 19) ^ u64.rotrBH(W2h, W2l, 61) ^ u64.shrSH(W2h, W2l, 6);\n const s1l = u64.rotrSL(W2h, W2l, 19) ^ u64.rotrBL(W2h, W2l, 61) ^ u64.shrSL(W2h, W2l, 6);\n // SHA256_W[i] = s0 + s1 + SHA256_W[i - 7] + SHA256_W[i - 16];\n const SUMl = u64.add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);\n const SUMh = u64.add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);\n SHA512_W_H[i] = SUMh | 0;\n SHA512_W_L[i] = SUMl | 0;\n }\n let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n // Compression function main loop, 80 rounds\n for (let i = 0; i < 80; i++) {\n // S1 := (e rightrotate 14) xor (e rightrotate 18) xor (e rightrotate 41)\n const sigma1h = u64.rotrSH(Eh, El, 14) ^ u64.rotrSH(Eh, El, 18) ^ u64.rotrBH(Eh, El, 41);\n const sigma1l = u64.rotrSL(Eh, El, 14) ^ u64.rotrSL(Eh, El, 18) ^ u64.rotrBL(Eh, El, 41);\n //const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n const CHIh = (Eh & Fh) ^ (~Eh & Gh);\n const CHIl = (El & Fl) ^ (~El & Gl);\n // T1 = H + sigma1 + Chi(E, F, G) + SHA512_K[i] + SHA512_W[i]\n // prettier-ignore\n const T1ll = u64.add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);\n const T1h = u64.add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);\n const T1l = T1ll | 0;\n // S0 := (a rightrotate 28) xor (a rightrotate 34) xor (a rightrotate 39)\n const sigma0h = u64.rotrSH(Ah, Al, 28) ^ u64.rotrBH(Ah, Al, 34) ^ u64.rotrBH(Ah, Al, 39);\n const sigma0l = u64.rotrSL(Ah, Al, 28) ^ u64.rotrBL(Ah, Al, 34) ^ u64.rotrBL(Ah, Al, 39);\n const MAJh = (Ah & Bh) ^ (Ah & Ch) ^ (Bh & Ch);\n const MAJl = (Al & Bl) ^ (Al & Cl) ^ (Bl & Cl);\n Hh = Gh | 0;\n Hl = Gl | 0;\n Gh = Fh | 0;\n Gl = Fl | 0;\n Fh = Eh | 0;\n Fl = El | 0;\n ({ h: Eh, l: El } = u64.add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));\n Dh = Ch | 0;\n Dl = Cl | 0;\n Ch = Bh | 0;\n Cl = Bl | 0;\n Bh = Ah | 0;\n Bl = Al | 0;\n const All = u64.add3L(T1l, sigma0l, MAJl);\n Ah = u64.add3H(All, T1h, sigma0h, MAJh);\n Al = All | 0;\n }\n // Add the compressed chunk to the current hash value\n ({ h: Ah, l: Al } = u64.add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));\n ({ h: Bh, l: Bl } = u64.add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));\n ({ h: Ch, l: Cl } = u64.add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));\n ({ h: Dh, l: Dl } = u64.add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));\n ({ h: Eh, l: El } = u64.add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));\n ({ h: Fh, l: Fl } = u64.add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));\n ({ h: Gh, l: Gl } = u64.add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));\n ({ h: Hh, l: Hl } = u64.add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));\n this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);\n }\n roundClean() {\n clean(SHA512_W_H, SHA512_W_L);\n }\n destroy() {\n clean(this.buffer);\n this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);\n }\n}\nexport class SHA384 extends SHA512 {\n constructor() {\n super(48);\n this.Ah = SHA384_IV[0] | 0;\n this.Al = SHA384_IV[1] | 0;\n this.Bh = SHA384_IV[2] | 0;\n this.Bl = SHA384_IV[3] | 0;\n this.Ch = SHA384_IV[4] | 0;\n this.Cl = SHA384_IV[5] | 0;\n this.Dh = SHA384_IV[6] | 0;\n this.Dl = SHA384_IV[7] | 0;\n this.Eh = SHA384_IV[8] | 0;\n this.El = SHA384_IV[9] | 0;\n this.Fh = SHA384_IV[10] | 0;\n this.Fl = SHA384_IV[11] | 0;\n this.Gh = SHA384_IV[12] | 0;\n this.Gl = SHA384_IV[13] | 0;\n this.Hh = SHA384_IV[14] | 0;\n this.Hl = SHA384_IV[15] | 0;\n }\n}\n/**\n * Truncated SHA512/256 and SHA512/224.\n * SHA512_IV is XORed with 0xa5a5a5a5a5a5a5a5, then used as \"intermediary\" IV of SHA512/t.\n * Then t hashes string to produce result IV.\n * See `test/misc/sha2-gen-iv.js`.\n */\n/** SHA512/224 IV */\nconst T224_IV = /* @__PURE__ */ Uint32Array.from([\n 0x8c3d37c8, 0x19544da2, 0x73e19966, 0x89dcd4d6, 0x1dfab7ae, 0x32ff9c82, 0x679dd514, 0x582f9fcf,\n 0x0f6d2b69, 0x7bd44da8, 0x77e36f73, 0x04c48942, 0x3f9d85a8, 0x6a1d36c8, 0x1112e6ad, 0x91d692a1,\n]);\n/** SHA512/256 IV */\nconst T256_IV = /* @__PURE__ */ Uint32Array.from([\n 0x22312194, 0xfc2bf72c, 0x9f555fa3, 0xc84c64c2, 0x2393b86b, 0x6f53b151, 0x96387719, 0x5940eabd,\n 0x96283ee2, 0xa88effe3, 0xbe5e1e25, 0x53863992, 0x2b0199fc, 0x2c85b8aa, 0x0eb72ddc, 0x81c52ca2,\n]);\nexport class SHA512_224 extends SHA512 {\n constructor() {\n super(28);\n this.Ah = T224_IV[0] | 0;\n this.Al = T224_IV[1] | 0;\n this.Bh = T224_IV[2] | 0;\n this.Bl = T224_IV[3] | 0;\n this.Ch = T224_IV[4] | 0;\n this.Cl = T224_IV[5] | 0;\n this.Dh = T224_IV[6] | 0;\n this.Dl = T224_IV[7] | 0;\n this.Eh = T224_IV[8] | 0;\n this.El = T224_IV[9] | 0;\n this.Fh = T224_IV[10] | 0;\n this.Fl = T224_IV[11] | 0;\n this.Gh = T224_IV[12] | 0;\n this.Gl = T224_IV[13] | 0;\n this.Hh = T224_IV[14] | 0;\n this.Hl = T224_IV[15] | 0;\n }\n}\nexport class SHA512_256 extends SHA512 {\n constructor() {\n super(32);\n this.Ah = T256_IV[0] | 0;\n this.Al = T256_IV[1] | 0;\n this.Bh = T256_IV[2] | 0;\n this.Bl = T256_IV[3] | 0;\n this.Ch = T256_IV[4] | 0;\n this.Cl = T256_IV[5] | 0;\n this.Dh = T256_IV[6] | 0;\n this.Dl = T256_IV[7] | 0;\n this.Eh = T256_IV[8] | 0;\n this.El = T256_IV[9] | 0;\n this.Fh = T256_IV[10] | 0;\n this.Fl = T256_IV[11] | 0;\n this.Gh = T256_IV[12] | 0;\n this.Gl = T256_IV[13] | 0;\n this.Hh = T256_IV[14] | 0;\n this.Hl = T256_IV[15] | 0;\n }\n}\n/**\n * SHA2-256 hash function from RFC 4634.\n *\n * It is the fastest JS hash, even faster than Blake3.\n * To break sha256 using birthday attack, attackers need to try 2^128 hashes.\n * BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.\n */\nexport const sha256 = /* @__PURE__ */ createHasher(() => new SHA256());\n/** SHA2-224 hash function from RFC 4634 */\nexport const sha224 = /* @__PURE__ */ createHasher(() => new SHA224());\n/** SHA2-512 hash function from RFC 4634. */\nexport const sha512 = /* @__PURE__ */ createHasher(() => new SHA512());\n/** SHA2-384 hash function from RFC 4634. */\nexport const sha384 = /* @__PURE__ */ createHasher(() => new SHA384());\n/**\n * SHA2-512/256 \"truncated\" hash function, with improved resistance to length extension attacks.\n * See the paper on [truncated SHA512](https://eprint.iacr.org/2010/548.pdf).\n */\nexport const sha512_256 = /* @__PURE__ */ createHasher(() => new SHA512_256());\n/**\n * SHA2-512/224 \"truncated\" hash function, with improved resistance to length extension attacks.\n * See the paper on [truncated SHA512](https://eprint.iacr.org/2010/548.pdf).\n */\nexport const sha512_224 = /* @__PURE__ */ createHasher(() => new SHA512_224());\n//# sourceMappingURL=sha2.js.map","/**\n * SHA2-256 a.k.a. sha256. In JS, it is the fastest hash, even faster than Blake3.\n *\n * To break sha256 using birthday attack, attackers need to try 2^128 hashes.\n * BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.\n *\n * Check out [FIPS 180-4](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf).\n * @module\n * @deprecated\n */\nimport { SHA224 as SHA224n, sha224 as sha224n, SHA256 as SHA256n, sha256 as sha256n, } from \"./sha2.js\";\n/** @deprecated Use import from `noble/hashes/sha2` module */\nexport const SHA256 = SHA256n;\n/** @deprecated Use import from `noble/hashes/sha2` module */\nexport const sha256 = sha256n;\n/** @deprecated Use import from `noble/hashes/sha2` module */\nexport const SHA224 = SHA224n;\n/** @deprecated Use import from `noble/hashes/sha2` module */\nexport const sha224 = sha224n;\n//# sourceMappingURL=sha256.js.map","import { secp256k1 } from '@noble/curves/secp256k1.js';\nimport { ripemd160 } from '@noble/hashes/ripemd160';\nimport { sha256 } from '@noble/hashes/sha256';\nimport { randomBytes } from 'crypto';\nimport {\n DigiIDCallbackData,\n DigiIDError,\n DigiIDUriOptions,\n DigiIDVerificationResult,\n DigiIDVerifyOptions\n} from './types';\n\n/**\n * Base58 alphabet used for Bitcoin/DigiByte addresses\n */\nconst BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';\n\n/**\n * Decode a base58 string to bytes\n */\nfunction base58Decode(str: string): Uint8Array {\n const bytes: number[] = [0];\n for (let i = 0; i < str.length; i++) {\n const char = str[i];\n if (!char) continue;\n const value = BASE58_ALPHABET.indexOf(char);\n if (value === -1) throw new Error('Invalid base58 character');\n\n for (let j = 0; j < bytes.length; j++) {\n bytes[j]! *= 58;\n }\n bytes[0]! += value;\n\n let carry = 0;\n for (let j = 0; j < bytes.length; j++) {\n const byte = bytes[j]!;\n bytes[j] = byte + carry;\n carry = bytes[j]! >> 8;\n bytes[j]! &= 0xff;\n }\n while (carry > 0) {\n bytes.push(carry & 0xff);\n carry >>= 8;\n }\n }\n\n // Add leading zeros\n for (let i = 0; i < str.length && str[i] === '1'; i++) {\n bytes.push(0);\n }\n\n return new Uint8Array(bytes.reverse());\n}\n\n/**\n * Decode a bech32 address (simplified for verification purposes)\n */\nfunction decodeBech32(address: string): { version: number; program: Uint8Array } | null {\n const CHARSET = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';\n\n const lowerAddr = address.toLowerCase();\n const parts = lowerAddr.split('1');\n if (parts.length !== 2) return null;\n\n const hrp = parts[0];\n const data = parts[1];\n if (!hrp || !data) return null;\n if (hrp !== 'dgb') return null;\n\n const values: number[] = [];\n for (const char of data) {\n const val = CHARSET.indexOf(char);\n if (val === -1) return null;\n values.push(val);\n }\n\n // Remove checksum (last 6 chars)\n const payload = values.slice(0, -6);\n if (payload.length < 1) return null;\n\n const version = payload[0];\n if (version === undefined) return null;\n\n // Convert from 5-bit to 8-bit\n const converted = convertBits(payload.slice(1), 5, 8, false);\n if (!converted) return null;\n\n return { version, program: new Uint8Array(converted) };\n}\n\n/**\n * Convert bits between different bit groups\n */\nfunction convertBits(data: number[], fromBits: number, toBits: number, pad: boolean): number[] | null {\n let acc = 0;\n let bits = 0;\n const result: number[] = [];\n const maxv = (1 << toBits) - 1;\n\n for (const value of data) {\n if (value < 0 || value >> fromBits !== 0) return null;\n acc = (acc << fromBits) | value;\n bits += fromBits;\n while (bits >= toBits) {\n bits -= toBits;\n result.push((acc >> bits) & maxv);\n }\n }\n\n if (pad) {\n if (bits > 0) result.push((acc << (toBits - bits)) & maxv);\n } else if (bits >= fromBits || ((acc << (toBits - bits)) & maxv)) {\n return null;\n }\n\n return result;\n}\n\n/**\n * Hash message with Bitcoin/DigiByte message signing format\n */\nfunction hashMessage(message: string, messagePrefix: string): Uint8Array {\n // The messagePrefix already includes the length byte (e.g., '\\x19DigiByte Signed Message:\\n')\n // where \\x19 = 25 = length of \"DigiByte Signed Message:\\n\"\n const prefixBuffer = new TextEncoder().encode(messagePrefix);\n\n const messageBuffer = new TextEncoder().encode(message);\n const messageLengthBytes: number[] = [];\n let messageLength = messageBuffer.length;\n\n // Encode message length as variable-length integer\n if (messageLength < 0xfd) {\n messageLengthBytes.push(messageLength);\n } else if (messageLength <= 0xffff) {\n messageLengthBytes.push(0xfd, messageLength & 0xff, (messageLength >> 8) & 0xff);\n } else if (messageLength <= 0xffffffff) {\n messageLengthBytes.push(\n 0xfe,\n messageLength & 0xff,\n (messageLength >> 8) & 0xff,\n (messageLength >> 16) & 0xff,\n (messageLength >> 24) & 0xff\n );\n } else {\n throw new Error('Message too long');\n }\n\n const messageLengthBuffer = new Uint8Array(messageLengthBytes);\n\n // Concatenate: prefix + messageLengthBuffer + message\n const totalLength = prefixBuffer.length + messageLengthBuffer.length + messageBuffer.length;\n const combined = new Uint8Array(totalLength);\n let offset = 0;\n\n combined.set(prefixBuffer, offset);\n offset += prefixBuffer.length;\n combined.set(messageLengthBuffer, offset);\n offset += messageLengthBuffer.length;\n combined.set(messageBuffer, offset);\n\n // Double SHA256\n return sha256(sha256(combined));\n}\n\n/**\n * Recover public key from signature\n */\nfunction recoverPublicKey(messageHash: Uint8Array, signature: Uint8Array): Uint8Array[] {\n if (signature.length !== 65) {\n throw new Error('Invalid signature length');\n }\n\n const firstByte = signature[0];\n if (firstByte === undefined) throw new Error('Invalid signature');\n\n const r = signature.slice(1, 33);\n const s = signature.slice(33, 65);\n\n const results: Uint8Array[] = [];\n\n // Try all recovery IDs (0-3) to be thorough\n // Some implementations may encode the recovery ID differently\n for (let recId = 0; recId < 4; recId++) {\n try {\n // Create signature object\n const sig = new secp256k1.Signature(\n BigInt('0x' + Array.from(r).map(b => b.toString(16).padStart(2, '0')).join('')),\n BigInt('0x' + Array.from(s).map(b => b.toString(16).padStart(2, '0')).join(''))\n ).addRecoveryBit(recId);\n\n const point = sig.recoverPublicKey(messageHash);\n\n // Add both compressed and uncompressed versions\n const compressedBytes = point.toBytes(true);\n const uncompressedBytes = point.toBytes(false);\n\n // Add compressed first (more common for SegWit)\n results.push(compressedBytes);\n results.push(uncompressedBytes);\n } catch (e) {\n // This recovery ID didn't work, try the next one\n continue;\n }\n }\n\n if (results.length === 0) {\n throw new Error('Failed to recover any public keys');\n }\n\n return results;\n}\n\n/**\n * Hash160: RIPEMD160(SHA256(data))\n */\nfunction hash160(buffer: Uint8Array): Uint8Array {\n return ripemd160(sha256(buffer));\n}\n\n/**\n * Verify address matches public key\n */\nfunction verifyAddress(address: string, publicKey: Uint8Array): boolean {\n // Legacy address (starts with D or S)\n if (address.startsWith('D') || address.startsWith('S')) {\n try {\n const decoded = base58Decode(address);\n if (decoded.length < 25) return false;\n\n const payload = decoded.slice(0, -4);\n const checksum = decoded.slice(-4);\n\n const hash = sha256(sha256(payload));\n const expectedChecksum = hash.slice(0, 4);\n\n // Verify checksum\n if (!checksum.every((byte, i) => byte === expectedChecksum[i])) {\n return false;\n }\n\n const pubKeyHash = payload.slice(1);\n const computedHash = hash160(publicKey);\n\n return pubKeyHash.every((byte, i) => byte === computedHash[i]);\n } catch {\n return false;\n }\n }\n\n // Bech32 address (starts with dgb1)\n if (address.toLowerCase().startsWith('dgb1')) {\n try {\n const decoded = decodeBech32(address);\n if (!decoded) return false;\n\n const { version, program } = decoded;\n\n if (version === 0) {\n // For witness v0 P2WPKH, use hash160 of compressed public key\n let pkToHash = publicKey;\n\n // If uncompressed (65 bytes), convert to compressed (33 bytes)\n if (publicKey.length === 65) {\n const isEven = publicKey[64]! % 2 === 0;\n pkToHash = new Uint8Array(33);\n pkToHash[0] = isEven ? 0x02 : 0x03;\n pkToHash.set(publicKey.slice(1, 33), 1);\n }\n\n const computedHash = hash160(pkToHash);\n return program.every((byte, i) => byte === computedHash[i]);\n }\n\n return false;\n } catch {\n return false;\n }\n }\n\n return false;\n}\n\n/**\n * INTERNAL: Verifies the signature using @noble/curves.\n * Exported primarily for testing purposes (mocking/spying).\n * @internal\n */\nexport async function _internalVerifySignature(\n uri: string,\n address: string,\n signature: string\n): Promise<boolean> {\n // DigiByte Message Prefix\n const messagePrefix = '\\x19DigiByte Signed Message:\\n';\n\n try {\n // Decode base64 signature\n const sigBytes = Uint8Array.from(atob(signature), c => c.charCodeAt(0));\n\n if (sigBytes.length !== 65) {\n throw new Error('Invalid signature length');\n }\n\n // Hash the message\n const messageHash = hashMessage(uri, messagePrefix);\n\n // Recover public key from signature\n const publicKeys = recoverPublicKey(messageHash, sigBytes);\n\n // Verify that at least one recovered public key matches the address\n for (const pubKey of publicKeys) {\n if (verifyAddress(address, pubKey)) {\n return true;\n }\n }\n\n return false;\n } catch (e: unknown) {\n const errorMessage = e instanceof Error ? e.message : String(e);\n throw new DigiIDError(`Signature verification failed: ${errorMessage}`);\n }\n}\n\n/**\n * Generates a secure random nonce (hex string).\n * @param length - The number of bytes to generate (default: 16, resulting in 32 hex chars).\n * @returns A hex-encoded random string.\n */\nfunction generateNonce(length = 16): string {\n return randomBytes(length).toString('hex');\n}\n\n/**\n * Generates a DigiID authentication URI.\n *\n * @param options - Options for URI generation, including the callback URL.\n * @returns The generated DigiID URI string.\n * @throws {DigiIDError} If the callback URL is invalid or missing.\n */\nexport function generateDigiIDUri(options: DigiIDUriOptions): string {\n if (!options.callbackUrl) {\n throw new DigiIDError('Callback URL is required.');\n }\n\n let parsedUrl: URL;\n try {\n parsedUrl = new URL(options.callbackUrl);\n } catch (e) {\n throw new DigiIDError(`Invalid callback URL: ${(e as Error).message}`);\n }\n\n // DigiID spec requires stripping the scheme (http/https)\n const domainAndPath = parsedUrl.host + parsedUrl.pathname;\n\n const nonce = options.nonce || generateNonce();\n const unsecureFlag = options.unsecure ? '1' : '0'; // 1 for http, 0 for https\n\n // Validate scheme based on unsecure flag\n if (options.unsecure && parsedUrl.protocol !== 'http:') {\n throw new DigiIDError('Unsecure flag is true, but callback URL does not use http protocol.');\n }\n if (!options.unsecure && parsedUrl.protocol !== 'https:') {\n throw new DigiIDError('Callback URL must use https protocol unless unsecure flag is set to true.');\n }\n\n // Construct the URI\n // Example: digiid://example.com/callback?x=nonce_value&u=0\n const uri = `digiid://${domainAndPath}?x=${nonce}&u=${unsecureFlag}`;\n\n // Clean up potential trailing slash in path if no query params exist (though DigiID always has params)\n // This check might be redundant given DigiID structure, but good practice\n // const cleanedUri = uri.endsWith('/') && parsedUrl.search === '' ? uri.slice(0, -1) : uri;\n\n return uri;\n}\n\n/**\n * Verifies the signature and data received from a DigiID callback.\n *\n * @param callbackData - The data received from the wallet (address, uri, signature).\n * @param verifyOptions - Options for verification, including the expected callback URL and nonce.\n * @returns {Promise<DigiIDVerificationResult>} A promise that resolves with verification details if successful.\n * @throws {DigiIDError} If validation or signature verification fails.\n */\nexport async function verifyDigiIDCallback(\n callbackData: DigiIDCallbackData,\n verifyOptions: DigiIDVerifyOptions\n): Promise<DigiIDVerificationResult> {\n const { address, uri, signature } = callbackData;\n const { expectedCallbackUrl, expectedNonce } = verifyOptions;\n\n if (!address || !uri || !signature) {\n throw new DigiIDError('Missing required callback data: address, uri, or signature.');\n }\n\n // 1. Parse the received URI\n let parsedReceivedUri: URL;\n try {\n // Temporarily replace digiid:// with http:// for standard URL parsing\n const parsableUri = uri.replace(/^digiid:/, 'http:');\n parsedReceivedUri = new URL(parsableUri);\n } catch (e) {\n throw new DigiIDError(`Invalid URI received in callback: ${(e as Error).message}`);\n }\n\n const receivedNonce = parsedReceivedUri.searchParams.get('x');\n const receivedUnsecure = parsedReceivedUri.searchParams.get('u'); // 0 or 1\n const receivedDomainAndPath = parsedReceivedUri.host + parsedReceivedUri.pathname;\n\n if (receivedNonce === null || receivedUnsecure === null) {\n throw new DigiIDError('URI missing nonce (x) or unsecure (u) parameter.');\n }\n\n // 2. Validate Callback URL\n let parsedExpectedUrl: URL;\n try {\n // Allow expectedCallbackUrl to be a string or URL object\n parsedExpectedUrl = typeof expectedCallbackUrl === 'string' ? new URL(expectedCallbackUrl) : expectedCallbackUrl;\n } catch (e) {\n throw new DigiIDError(`Invalid expectedCallbackUrl provided: ${(e as Error).message}`);\n }\n\n const expectedDomainAndPath = parsedExpectedUrl.host + parsedExpectedUrl.pathname;\n\n if (receivedDomainAndPath !== expectedDomainAndPath) {\n throw new DigiIDError(`Callback URL mismatch: URI contained \"${receivedDomainAndPath}\", expected \"${expectedDomainAndPath}\"`);\n }\n\n // Validate scheme consistency\n const expectedScheme = parsedExpectedUrl.protocol;\n if (receivedUnsecure === '1' && expectedScheme !== 'http:') {\n throw new DigiIDError('URI indicates unsecure (u=1), but expectedCallbackUrl is not http.');\n }\n if (receivedUnsecure === '0' && expectedScheme !== 'https:') {\n throw new DigiIDError('URI indicates secure (u=0), but expectedCallbackUrl is not https.');\n }\n\n // 3. Validate Nonce (optional)\n if (expectedNonce && receivedNonce !== expectedNonce) {\n throw new DigiIDError(`Nonce mismatch: URI contained \"${receivedNonce}\", expected \"${expectedNonce}\". Possible replay attack.`);\n }\n\n // 4. Verify Signature using internal helper\n try {\n const isValidSignature = await _internalVerifySignature(uri, address, signature);\n if (!isValidSignature) {\n // If the helper returns false, throw the standard invalid signature error\n throw new DigiIDError('Invalid signature.');\n }\n } catch (error) {\n // If _internalVerifySignature throws (e.g., due to format/checksum errors from the lib, or our re-thrown error),\n // re-throw it. It should already be a DigiIDError.\n if (error instanceof DigiIDError) {\n throw error;\n } else {\n // Catch any unexpected errors and wrap them\n throw new DigiIDError(`Unexpected error during signature verification: ${(error as Error).message}`);\n }\n }\n\n // 5. Return successful result\n return {\n isValid: true,\n address: address,\n nonce: receivedNonce, // Return the nonce from the URI\n };\n}\n"],"names":["DigiIDError","message","isBytes","a","anumber","n","title","prefix","abytes","value","length","bytes","len","needsLen","ofLen","got","ahash","h","aexists","instance","checkFinished","aoutput","out","min","clean","arrays","i","createView","arr","rotr","word","shift","hasHexBuiltin","hexes","_","bytesToHex","hex","asciis","asciiToBase16","ch","hexToBytes","hl","al","array","ai","hi","n1","n2","char","concatBytes","sum","res","pad","createHasher","hashCons","info","hashC","msg","opts","tmp","randomBytes","bytesLength","cr","oidNist","suffix","Chi","b","c","Maj","HashMD$1","blockLen","outputLen","padOffset","isLE","__publicField","data","view","buffer","pos","take","dataView","oview","outLen","state","to","finished","destroyed","SHA256_IV","SHA256_K","SHA256_W","SHA2_32B","HashMD","A","B","C","D","E","F","G","H","offset","W15","W2","s0","s1","sigma1","T1","T2","_SHA256","sha256","_0n","_1n","abool","abignumber","isPosBig","numberToHexUnpadded","num","hexToNumber","bytesToNumberBE","bytesToHex_","bytesToNumberLE","copyBytes","abytes_","numberToBytesBE","hexToBytes_","numberToBytesLE","inRange","max","aInRange","bitLen","bitMask","createHmacDrbg","hashLen","qByteLen","hmacFn","u8n","NULL","byte0","byte1","_maxDrbgIters","v","k","reset","msgs","concatBytes_","reseed","seed","gen","sl","pred","validateObject","object","fields","optFields","checkField","fieldName","expectedType","isOpt","val","current","iter","f","memoized","fn","map","arg","args","computed","_2n","_3n","_4n","_5n","_7n","_8n","_9n","_16n","mod","result","pow2","x","power","modulo","invert","number","u","q","r","m","assertIsSquare","Fp","root","sqrt3mod4","p1div4","sqrt5mod8","p5div8","nv","sqrt9mod16","P","Fp_","Field","tn","tonelliShanks","c1","c2","c3","c4","tv1","tv2","tv3","tv4","e1","e2","e3","Q","S","Z","_Fp","FpLegendre","cc","Q1div2","M","t","R","t_tmp","exponent","FpSqrt","FIELD_FIELDS","validateField","field","initial","FpPow","p","d","FpInvertBatch","nums","passZero","inverted","multipliedAcc","acc","invertedAcc","p1mod2","powered","yes","zero","no","nLength","nBitLength","_nBitLength","nByteLength","_Field","ORDER","_nbitLength","_a","lhs","rhs","skipValidation","allowedLengths","BYTES","modFromBytes","padded","scalar","lst","condition","getFieldBytesLength","fieldOrder","bitLength","getMinHashLength","mapHashToField","key","fieldLen","minLen","reduced","negateCt","item","neg","normalizeZ","points","invertedZs","validateW","W","bits","calcWOpts","scalarBits","windows","windowSize","maxNumber","mask","shiftBy","calcOffsets","window","wOpts","wbits","nextN","offsetStart","isZero","isNeg","isNegF","pointPrecomputes","pointWindowSizes","getW","assert0","wNAF","Point","elm","point","base","precomputes","wo","offsetF","transform","comp","prev","mulEndoUnsafe","k1","k2","p1","p2","createField","order","createCurveFields","type","CURVE","curveOpts","FpFnLE","Fn","params","createKeygen","randomSecretKey","getPublicKey","secretKey","_HMAC","hash","buf","oHash","iHash","hmac","divNearest","den","_splitEndoScalar","basis","a1","b1","a2","b2","k1neg","k2neg","MAX_NUM","validateSigFormat","format","validateSigOpts","def","optsn","optName","DERErr","DER","tag","dataLen","lenLen","first","isLong","lengthBytes","int","tlv","seqBytes","seqLeftBytes","rBytes","rLeftBytes","sBytes","sLeftBytes","sig","rs","ss","seq","weierstrass","extraOpts","validated","cofactor","CURVE_ORDER","endo","lengths","getWLengths","assertCompressionIsSupported","pointToBytes","_c","isCompressed","y","bx","hasEvenY","pprefix","pointFromBytes","uncomp","head","tail","y2","weierstrassEquation","sqrtError","err","evenY","L","isValidXY","encodePoint","decodePoint","x2","x3","left","right","_4a3","_27b2","acoord","banZero","aprjpoint","other","splitEndoScalarN","toAffineMemo","iz","X","Y","is0","zz","assertValidMemo","finishEndo","endoBeta","k1p","k2p","_Point","isLazy","wnaf","X1","Y1","Z1","X2","Y2","Z2","U1","U2","b3","X3","Y3","Z3","t0","t1","t2","t3","t4","t5","fake","mul","k1f","k2f","sc","invertedZ","isTorsionFree","clearCofactor","ecdh","ecdhOpts","randomBytes_","wcRandomBytes","isValidSecretKey","isValidPublicKey","publicKey","publicKeyUncompressed","l","isProbPub","getSharedSecret","secretKeyA","publicKeyB","s","utils","keygen","ecdsa","ecdsaOpts","nobleHmac","fnBits","defaultSigOpts","hasLargeCofactor","isBiggerThanHalfOrder","HALF","validateRS","assertSmallCofactor","validateSigLength","size","sizer","Signature","recovery","recid","messageHash","radj","ir","bits2int_modN","u1","u2","rb","sb","bits2int","delta","ORDER_MASK","int2octets","validateMsgAndHash","prehash","prepSig","lowS","extraEntropy","h1int","seedArgs","e","k2sig","kBytes","ik","normS","sign","verify","signature","end","is","recoverPublicKey","secp256k1_CURVE","secp256k1_ENDO","sqrtMod","_6n","_11n","_22n","_23n","_44n","_88n","b6","b9","b11","b22","b44","b88","b176","b220","b223","Fpk1","Pointk1","secp256k1","rotl","utf8ToBytes","str","toBytes","Hash","setBigUint64","byteOffset","_32n","_u32_max","wh","wl","Rho160","Id160","Pi160","idxLR","j","idxL","idxR","shifts160","shiftsL160","idx","shiftsR160","Kl160","Kr160","ripemd_f","group","z","BUF_160","RIPEMD160","h0","h1","h2","h3","h4","ar","bl","br","cl","dl","dr","el","er","rGroup","hbl","hbr","rl","rr","sr","tl","tr","ripemd160","ripemd160n","SHA256","sha256n","BASE58_ALPHABET","base58Decode","carry","byte","decodeBech32","address","CHARSET","parts","hrp","values","payload","version","converted","convertBits","fromBits","toBits","maxv","hashMessage","messagePrefix","prefixBuffer","messageBuffer","messageLengthBytes","messageLength","messageLengthBuffer","totalLength","combined","results","recId","compressedBytes","uncompressedBytes","hash160","verifyAddress","decoded","checksum","expectedChecksum","pubKeyHash","computedHash","program","pkToHash","isEven","_internalVerifySignature","uri","sigBytes","publicKeys","pubKey","errorMessage","generateNonce","generateDigiIDUri","options","parsedUrl","domainAndPath","nonce","unsecureFlag","verifyDigiIDCallback","callbackData","verifyOptions","expectedCallbackUrl","expectedNonce","parsedReceivedUri","parsableUri","receivedNonce","receivedUnsecure","receivedDomainAndPath","parsedExpectedUrl","expectedDomainAndPath","expectedScheme","error"],"mappings":";;;;AAiDO,MAAMA,UAAoB,MAAM;AAAA,EACrC,YAAYC,GAAiB;AAC3B,UAAMA,CAAO,GACb,KAAK,OAAO;AAAA,EACd;AACF;AClDA;AAEO,SAASC,GAAQC,GAAG;AACvB,SAAOA,aAAa,cAAe,YAAY,OAAOA,CAAC,KAAKA,EAAE,YAAY,SAAS;AACvF;AAEO,SAASC,GAAQC,GAAGC,IAAQ,IAAI;AACnC,MAAI,CAAC,OAAO,cAAcD,CAAC,KAAKA,IAAI,GAAG;AACnC,UAAME,IAASD,KAAS,IAAIA,CAAK;AACjC,UAAM,IAAI,MAAM,GAAGC,CAAM,8BAA8BF,CAAC,EAAE;AAAA,EAC9D;AACJ;AAEO,SAASG,EAAOC,GAAOC,GAAQJ,IAAQ,IAAI;AAC9C,QAAMK,IAAQT,GAAQO,CAAK,GACrBG,IAAMH,KAAA,gBAAAA,EAAO,QACbI,IAAWH,MAAW;AAC5B,MAAI,CAACC,KAAUE,KAAYD,MAAQF,GAAS;AACxC,UAAMH,IAASD,KAAS,IAAIA,CAAK,MAC3BQ,IAAQD,IAAW,cAAcH,CAAM,KAAK,IAC5CK,IAAMJ,IAAQ,UAAUC,CAAG,KAAK,QAAQ,OAAOH,CAAK;AAC1D,UAAM,IAAI,MAAMF,IAAS,wBAAwBO,IAAQ,WAAWC,CAAG;AAAA,EAC3E;AACA,SAAON;AACX;AAEO,SAASO,GAAMC,GAAG;AACrB,MAAI,OAAOA,KAAM,cAAc,OAAOA,EAAE,UAAW;AAC/C,UAAM,IAAI,MAAM,yCAAyC;AAC7D,EAAAb,GAAQa,EAAE,SAAS,GACnBb,GAAQa,EAAE,QAAQ;AACtB;AAEO,SAASC,GAAQC,GAAUC,IAAgB,IAAM;AACpD,MAAID,EAAS;AACT,UAAM,IAAI,MAAM,kCAAkC;AACtD,MAAIC,KAAiBD,EAAS;AAC1B,UAAM,IAAI,MAAM,uCAAuC;AAC/D;AAEO,SAASE,GAAQC,GAAKH,GAAU;AACnCX,EAAAA,EAAOc,GAAK,QAAW,qBAAqB;AAC5C,QAAMC,IAAMJ,EAAS;AACrB,MAAIG,EAAI,SAASC;AACb,UAAM,IAAI,MAAM,sDAAsDA,CAAG;AAEjF;AAUO,SAASC,MAASC,GAAQ;AAC7B,WAASC,IAAI,GAAGA,IAAID,EAAO,QAAQC;AAC/B,IAAAD,EAAOC,CAAC,EAAE,KAAK,CAAC;AAExB;AAEO,SAASC,GAAWC,GAAK;AAC5B,SAAO,IAAI,SAASA,EAAI,QAAQA,EAAI,YAAYA,EAAI,UAAU;AAClE;AAEO,SAASC,EAAKC,GAAMC,GAAO;AAC9B,SAAQD,KAAS,KAAKC,IAAWD,MAASC;AAC9C;AA6BA,MAAMC,sBAEN,OAAO,WAAW,KAAK,CAAA,CAAE,EAAE,SAAU,cAAc,OAAO,WAAW,WAAY,YAE3EC,KAAwB,sBAAM,KAAK,EAAE,QAAQ,IAAG,GAAI,CAACC,GAAGR,MAAMA,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAK5F,SAASS,GAAWxB,GAAO;AAG9B,MAFAH,EAAOG,CAAK,GAERqB;AACA,WAAOrB,EAAM,MAAK;AAEtB,MAAIyB,IAAM;AACV,WAASV,IAAI,GAAGA,IAAIf,EAAM,QAAQe;AAC9B,IAAAU,KAAOH,GAAMtB,EAAMe,CAAC,CAAC;AAEzB,SAAOU;AACX;AAEA,MAAMC,IAAS,EAAE,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAG;AAC5D,SAASC,GAAcC,GAAI;AACvB,MAAIA,KAAMF,EAAO,MAAME,KAAMF,EAAO;AAChC,WAAOE,IAAKF,EAAO;AACvB,MAAIE,KAAMF,EAAO,KAAKE,KAAMF,EAAO;AAC/B,WAAOE,KAAMF,EAAO,IAAI;AAC5B,MAAIE,KAAMF,EAAO,KAAKE,KAAMF,EAAO;AAC/B,WAAOE,KAAMF,EAAO,IAAI;AAEhC;AAKO,SAASG,GAAWJ,GAAK;AAC5B,MAAI,OAAOA,KAAQ;AACf,UAAM,IAAI,MAAM,8BAA8B,OAAOA,CAAG;AAE5D,MAAIJ;AACA,WAAO,WAAW,QAAQI,CAAG;AACjC,QAAMK,IAAKL,EAAI,QACTM,IAAKD,IAAK;AAChB,MAAIA,IAAK;AACL,UAAM,IAAI,MAAM,qDAAqDA,CAAE;AAC3E,QAAME,IAAQ,IAAI,WAAWD,CAAE;AAC/B,WAASE,IAAK,GAAGC,IAAK,GAAGD,IAAKF,GAAIE,KAAMC,KAAM,GAAG;AAC7C,UAAMC,IAAKR,GAAcF,EAAI,WAAWS,CAAE,CAAC,GACrCE,IAAKT,GAAcF,EAAI,WAAWS,IAAK,CAAC,CAAC;AAC/C,QAAIC,MAAO,UAAaC,MAAO,QAAW;AACtC,YAAMC,IAAOZ,EAAIS,CAAE,IAAIT,EAAIS,IAAK,CAAC;AACjC,YAAM,IAAI,MAAM,iDAAiDG,IAAO,gBAAgBH,CAAE;AAAA,IAC9F;AACA,IAAAF,EAAMC,CAAE,IAAIE,IAAK,KAAKC;AAAA,EAC1B;AACA,SAAOJ;AACX;AAwCO,SAASM,MAAexB,GAAQ;AACnC,MAAIyB,IAAM;AACV,WAASxB,IAAI,GAAGA,IAAID,EAAO,QAAQC,KAAK;AACpC,UAAMvB,IAAIsB,EAAOC,CAAC;AAClBlB,IAAAA,EAAOL,CAAC,GACR+C,KAAO/C,EAAE;AAAA,EACb;AACA,QAAMgD,IAAM,IAAI,WAAWD,CAAG;AAC9B,WAASxB,IAAI,GAAG0B,IAAM,GAAG1B,IAAID,EAAO,QAAQC,KAAK;AAC7C,UAAMvB,IAAIsB,EAAOC,CAAC;AAClB,IAAAyB,EAAI,IAAIhD,GAAGiD,CAAG,GACdA,KAAOjD,EAAE;AAAA,EACb;AACA,SAAOgD;AACX;AASO,SAASE,GAAaC,GAAUC,IAAO,IAAI;AAC9C,QAAMC,IAAQ,CAACC,GAAKC,MAASJ,EAASI,CAAI,EAAE,OAAOD,CAAG,EAAE,OAAM,GACxDE,IAAML,EAAS,MAAS;AAC9B,SAAAE,EAAM,YAAYG,EAAI,WACtBH,EAAM,WAAWG,EAAI,UACrBH,EAAM,SAAS,CAACE,MAASJ,EAASI,CAAI,GACtC,OAAO,OAAOF,GAAOD,CAAI,GAClB,OAAO,OAAOC,CAAK;AAC9B;AAEO,SAASI,GAAYC,IAAc,IAAI;AAC1C,QAAMC,IAAK,OAAO,cAAe,WAAW,WAAW,SAAS;AAChE,MAAI,QAAOA,KAAA,gBAAAA,EAAI,oBAAoB;AAC/B,UAAM,IAAI,MAAM,wCAAwC;AAC5D,SAAOA,EAAG,gBAAgB,IAAI,WAAWD,CAAW,CAAC;AACzD;AAEO,MAAME,KAAU,CAACC,OAAY;AAAA,EAChC,KAAK,WAAW,KAAK,CAAC,GAAM,GAAM,IAAM,KAAM,IAAM,GAAM,KAAM,GAAM,GAAM,GAAMA,CAAM,CAAC;AAC7F;AC1OO,SAASC,GAAI9D,GAAG+D,GAAGC,GAAG;AACzB,SAAQhE,IAAI+D,IAAM,CAAC/D,IAAIgE;AAC3B;AAEO,SAASC,GAAIjE,GAAG+D,GAAGC,GAAG;AACzB,SAAQhE,IAAI+D,IAAM/D,IAAIgE,IAAMD,IAAIC;AACpC;AAKO,IAAAE,KAAA,MAAa;AAAA,EAYhB,YAAYC,GAAUC,GAAWC,GAAWC,GAAM;AAXlD,IAAAC,EAAA;AACA,IAAAA,EAAA;AACA,IAAAA,EAAA;AACA,IAAAA,EAAA;AAEA;AAAA,IAAAA,EAAA;AACA,IAAAA,EAAA;AACA,IAAAA,EAAA,kBAAW;AACX,IAAAA,EAAA,gBAAS;AACT,IAAAA,EAAA,aAAM;AACN,IAAAA,EAAA,mBAAY;AAER,SAAK,WAAWJ,GAChB,KAAK,YAAYC,GACjB,KAAK,YAAYC,GACjB,KAAK,OAAOC,GACZ,KAAK,SAAS,IAAI,WAAWH,CAAQ,GACrC,KAAK,OAAO3C,GAAW,KAAK,MAAM;AAAA,EACtC;AAAA,EACA,OAAOgD,GAAM;AACTzD,IAAAA,GAAQ,IAAI,GACZV,EAAOmE,CAAI;AACX,UAAM,EAAE,MAAAC,GAAM,QAAAC,GAAQ,UAAAP,EAAQ,IAAK,MAC7B1D,IAAM+D,EAAK;AACjB,aAASG,IAAM,GAAGA,IAAMlE,KAAM;AAC1B,YAAMmE,IAAO,KAAK,IAAIT,IAAW,KAAK,KAAK1D,IAAMkE,CAAG;AAEpD,UAAIC,MAAST,GAAU;AACnB,cAAMU,IAAWrD,GAAWgD,CAAI;AAChC,eAAOL,KAAY1D,IAAMkE,GAAKA,KAAOR;AACjC,eAAK,QAAQU,GAAUF,CAAG;AAC9B;AAAA,MACJ;AACA,MAAAD,EAAO,IAAIF,EAAK,SAASG,GAAKA,IAAMC,CAAI,GAAG,KAAK,GAAG,GACnD,KAAK,OAAOA,GACZD,KAAOC,GACH,KAAK,QAAQT,MACb,KAAK,QAAQM,GAAM,CAAC,GACpB,KAAK,MAAM;AAAA,IAEnB;AACA,gBAAK,UAAUD,EAAK,QACpB,KAAK,WAAU,GACR;AAAA,EACX;AAAA,EACA,WAAWrD,GAAK;AACZJ,IAAAA,GAAQ,IAAI,GACZG,GAAQC,GAAK,IAAI,GACjB,KAAK,WAAW;AAIhB,UAAM,EAAE,QAAAuD,GAAQ,MAAAD,GAAM,UAAAN,GAAU,MAAAG,EAAI,IAAK;AACzC,QAAI,EAAE,KAAAK,EAAG,IAAK;AAEd,IAAAD,EAAOC,GAAK,IAAI,KAChBtD,GAAM,KAAK,OAAO,SAASsD,CAAG,CAAC,GAG3B,KAAK,YAAYR,IAAWQ,MAC5B,KAAK,QAAQF,GAAM,CAAC,GACpBE,IAAM;AAGV,aAASpD,IAAIoD,GAAKpD,IAAI4C,GAAU5C;AAC5B,MAAAmD,EAAOnD,CAAC,IAAI;AAIhB,IAAAkD,EAAK,aAAaN,IAAW,GAAG,OAAO,KAAK,SAAS,CAAC,GAAGG,CAAI,GAC7D,KAAK,QAAQG,GAAM,CAAC;AACpB,UAAMK,IAAQtD,GAAWL,CAAG,GACtBV,IAAM,KAAK;AAEjB,QAAIA,IAAM;AACN,YAAM,IAAI,MAAM,2CAA2C;AAC/D,UAAMsE,IAAStE,IAAM,GACfuE,IAAQ,KAAK,IAAG;AACtB,QAAID,IAASC,EAAM;AACf,YAAM,IAAI,MAAM,oCAAoC;AACxD,aAASzD,IAAI,GAAGA,IAAIwD,GAAQxD;AACxB,MAAAuD,EAAM,UAAU,IAAIvD,GAAGyD,EAAMzD,CAAC,GAAG+C,CAAI;AAAA,EAC7C;AAAA,EACA,SAAS;AACL,UAAM,EAAE,QAAAI,GAAQ,WAAAN,EAAS,IAAK;AAC9B,SAAK,WAAWM,CAAM;AACtB,UAAM1B,IAAM0B,EAAO,MAAM,GAAGN,CAAS;AACrC,gBAAK,QAAO,GACLpB;AAAA,EACX;AAAA,EACA,WAAWiC,GAAI;AACX,IAAAA,UAAO,IAAI,KAAK,YAAW,IAC3BA,EAAG,IAAI,GAAG,KAAK,IAAG,CAAE;AACpB,UAAM,EAAE,UAAAd,GAAU,QAAAO,GAAQ,QAAAnE,GAAQ,UAAA2E,GAAU,WAAAC,GAAW,KAAAR,EAAG,IAAK;AAC/D,WAAAM,EAAG,YAAYE,GACfF,EAAG,WAAWC,GACdD,EAAG,SAAS1E,GACZ0E,EAAG,MAAMN,GACLpE,IAAS4D,KACTc,EAAG,OAAO,IAAIP,CAAM,GACjBO;AAAA,EACX;AAAA,EACA,QAAQ;AACJ,WAAO,KAAK,WAAU;AAAA,EAC1B;AACJ;AAMO,MAAMG,KAA4B,4BAAY,KAAK;AAAA,EACtD;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AACxF,CAAC,GCpHKC,KAA2B,4BAAY,KAAK;AAAA,EAC9C;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AACxF,CAAC,GAEKC,KAA2B,oBAAI,YAAY,EAAE;AAEnD,MAAMC,WAAiBC,GAAO;AAAA,EAC1B,YAAYpB,GAAW;AACnB,UAAM,IAAIA,GAAW,GAAG,EAAK;AAAA,EACjC;AAAA,EACA,MAAM;AACF,UAAM,EAAE,GAAAqB,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,EAAC,IAAK;AACnC,WAAO,CAACP,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,CAAC;AAAA,EAClC;AAAA;AAAA,EAEA,IAAIP,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,GAAG;AACxB,SAAK,IAAIP,IAAI,GACb,KAAK,IAAIC,IAAI,GACb,KAAK,IAAIC,IAAI,GACb,KAAK,IAAIC,IAAI,GACb,KAAK,IAAIC,IAAI,GACb,KAAK,IAAIC,IAAI,GACb,KAAK,IAAIC,IAAI,GACb,KAAK,IAAIC,IAAI;AAAA,EACjB;AAAA,EACA,QAAQvB,GAAMwB,GAAQ;AAElB,aAAS1E,IAAI,GAAGA,IAAI,IAAIA,KAAK0E,KAAU;AACnCX,MAAAA,GAAS/D,CAAC,IAAIkD,EAAK,UAAUwB,GAAQ,EAAK;AAC9C,aAAS1E,IAAI,IAAIA,IAAI,IAAIA,KAAK;AAC1B,YAAM2E,IAAMZ,GAAS/D,IAAI,EAAE,GACrB4E,IAAKb,GAAS/D,IAAI,CAAC,GACnB6E,IAAK1E,EAAKwE,GAAK,CAAC,IAAIxE,EAAKwE,GAAK,EAAE,IAAKA,MAAQ,GAC7CG,IAAK3E,EAAKyE,GAAI,EAAE,IAAIzE,EAAKyE,GAAI,EAAE,IAAKA,MAAO;AACjDb,MAAAA,GAAS/D,CAAC,IAAK8E,IAAKf,GAAS/D,IAAI,CAAC,IAAI6E,IAAKd,GAAS/D,IAAI,EAAE,IAAK;AAAA,IACnE;AAEA,QAAI,EAAE,GAAAkE,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,EAAC,IAAK;AACjC,aAASzE,IAAI,GAAGA,IAAI,IAAIA,KAAK;AACzB,YAAM+E,IAAS5E,EAAKmE,GAAG,CAAC,IAAInE,EAAKmE,GAAG,EAAE,IAAInE,EAAKmE,GAAG,EAAE,GAC9CU,IAAMP,IAAIM,IAASxC,GAAI+B,GAAGC,GAAGC,CAAC,IAAIV,GAAS9D,CAAC,IAAI+D,GAAS/D,CAAC,IAAK,GAE/DiF,KADS9E,EAAK+D,GAAG,CAAC,IAAI/D,EAAK+D,GAAG,EAAE,IAAI/D,EAAK+D,GAAG,EAAE,KAC/BxB,GAAIwB,GAAGC,GAAGC,CAAC,IAAK;AACrC,MAAAK,IAAID,GACJA,IAAID,GACJA,IAAID,GACJA,IAAKD,IAAIW,IAAM,GACfX,IAAID,GACJA,IAAID,GACJA,IAAID,GACJA,IAAKc,IAAKC,IAAM;AAAA,IACpB;AAEA,IAAAf,IAAKA,IAAI,KAAK,IAAK,GACnBC,IAAKA,IAAI,KAAK,IAAK,GACnBC,IAAKA,IAAI,KAAK,IAAK,GACnBC,IAAKA,IAAI,KAAK,IAAK,GACnBC,IAAKA,IAAI,KAAK,IAAK,GACnBC,IAAKA,IAAI,KAAK,IAAK,GACnBC,IAAKA,IAAI,KAAK,IAAK,GACnBC,IAAKA,IAAI,KAAK,IAAK,GACnB,KAAK,IAAIP,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,CAAC;AAAA,EACnC;AAAA,EACA,aAAa;AACT3E,IAAAA,GAAMiE,EAAQ;AAAA,EAClB;AAAA,EACA,UAAU;AACN,SAAK,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,GAC/BjE,GAAM,KAAK,MAAM;AAAA,EACrB;AACJ;AAEO,MAAMoF,WAAgBlB,GAAS;AAAA,EAWlC,cAAc;AACV,UAAM,EAAE;AATZ;AAAA;AAAA,IAAAhB,EAAA,WAAIa,GAAU,CAAC,IAAI;AACnB,IAAAb,EAAA,WAAIa,GAAU,CAAC,IAAI;AACnB,IAAAb,EAAA,WAAIa,GAAU,CAAC,IAAI;AACnB,IAAAb,EAAA,WAAIa,GAAU,CAAC,IAAI;AACnB,IAAAb,EAAA,WAAIa,GAAU,CAAC,IAAI;AACnB,IAAAb,EAAA,WAAIa,GAAU,CAAC,IAAI;AACnB,IAAAb,EAAA,WAAIa,GAAU,CAAC,IAAI;AACnB,IAAAb,EAAA,WAAIa,GAAU,CAAC,IAAI;AAAA,EAGnB;AACJ;AAyQO,MAAMsB,KAAyBxD,gBAAAA;AAAAA,EAAa,MAAM,IAAIuD,GAAO;AAAA,EACpD,gBAAA7C,GAAQ,CAAI;AAAC;AClX7B;AAGA,MAAM+C,KAAsB,uBAAO,CAAC,GAC9BC,KAAsB,uBAAO,CAAC;AAC7B,SAASC,GAAMvG,GAAOH,IAAQ,IAAI;AACrC,MAAI,OAAOG,KAAU,WAAW;AAC5B,UAAMF,IAASD,KAAS,IAAIA,CAAK;AACjC,UAAM,IAAI,MAAMC,IAAS,gCAAgC,OAAOE,CAAK;AAAA,EACzE;AACA,SAAOA;AACX;AAEA,SAASwG,GAAW5G,GAAG;AACnB,MAAI,OAAOA,KAAM;AACb,QAAI,CAAC6G,GAAS7G,CAAC;AACX,YAAM,IAAI,MAAM,mCAAmCA,CAAC;AAAA;AAGxD,IAAAD,GAAQC,CAAC;AACb,SAAOA;AACX;AAOO,SAAS8G,GAAoBC,GAAK;AACrC,QAAMhF,IAAM6E,GAAWG,CAAG,EAAE,SAAS,EAAE;AACvC,SAAOhF,EAAI,SAAS,IAAI,MAAMA,IAAMA;AACxC;AACO,SAASiF,GAAYjF,GAAK;AAC7B,MAAI,OAAOA,KAAQ;AACf,UAAM,IAAI,MAAM,8BAA8B,OAAOA,CAAG;AAC5D,SAAOA,MAAQ,KAAK0E,KAAM,OAAO,OAAO1E,CAAG;AAC/C;AAEO,SAASkF,GAAgB3G,GAAO;AACnC,SAAO0G,GAAYE,GAAY5G,CAAK,CAAC;AACzC;AACO,SAAS6G,GAAgB7G,GAAO;AACnC,SAAO0G,GAAYE,GAAYE,GAAUC,EAAQ/G,CAAK,CAAC,EAAE,QAAO,CAAE,CAAC;AACvE;AACO,SAASgH,GAAgBtH,GAAGO,GAAK;AACpC,EAAAR,GAAQQ,CAAG,GACXP,IAAI4G,GAAW5G,CAAC;AAChB,QAAM8C,IAAMyE,GAAYvH,EAAE,SAAS,EAAE,EAAE,SAASO,IAAM,GAAG,GAAG,CAAC;AAC7D,MAAIuC,EAAI,WAAWvC;AACf,UAAM,IAAI,MAAM,kBAAkB;AACtC,SAAOuC;AACX;AACO,SAAS0E,GAAgBxH,GAAGO,GAAK;AACpC,SAAO+G,GAAgBtH,GAAGO,CAAG,EAAE,QAAO;AAC1C;AAkBO,SAAS6G,GAAU9G,GAAO;AAC7B,SAAO,WAAW,KAAKA,CAAK;AAChC;AAgBA,MAAMuG,KAAW,CAAC7G,MAAM,OAAOA,KAAM,YAAYyG,MAAOzG;AACjD,SAASyH,GAAQzH,GAAGkB,GAAKwG,GAAK;AACjC,SAAOb,GAAS7G,CAAC,KAAK6G,GAAS3F,CAAG,KAAK2F,GAASa,CAAG,KAAKxG,KAAOlB,KAAKA,IAAI0H;AAC5E;AAMO,SAASC,GAAS1H,GAAOD,GAAGkB,GAAKwG,GAAK;AAMzC,MAAI,CAACD,GAAQzH,GAAGkB,GAAKwG,CAAG;AACpB,UAAM,IAAI,MAAM,oBAAoBzH,IAAQ,OAAOiB,IAAM,aAAawG,IAAM,WAAW1H,CAAC;AAChG;AAOO,SAAS4H,GAAO5H,GAAG;AACtB,MAAIO;AACJ,OAAKA,IAAM,GAAGP,IAAIyG,IAAKzG,MAAM0G,IAAKnG,KAAO;AACrC;AACJ,SAAOA;AACX;AAmBO,MAAMsH,KAAU,CAAC7H,OAAO0G,MAAO,OAAO1G,CAAC,KAAK0G;AAQ5C,SAASoB,GAAeC,GAASC,GAAUC,GAAQ;AAGtD,MAFAlI,GAAQgI,GAAS,SAAS,GAC1BhI,GAAQiI,GAAU,UAAU,GACxB,OAAOC,KAAW;AAClB,UAAM,IAAI,MAAM,2BAA2B;AAC/C,QAAMC,IAAM,CAAC3H,MAAQ,IAAI,WAAWA,CAAG,GACjC4H,IAAO,WAAW,GAAE,GACpBC,IAAQ,WAAW,GAAG,CAAI,GAC1BC,IAAQ,WAAW,GAAG,CAAI,GAC1BC,IAAgB;AAEtB,MAAIC,IAAIL,EAAIH,CAAO,GACfS,IAAIN,EAAIH,CAAO,GACf1G,IAAI;AACR,QAAMoH,IAAQ,MAAM;AAChB,IAAAF,EAAE,KAAK,CAAC,GACRC,EAAE,KAAK,CAAC,GACRnH,IAAI;AAAA,EACR,GACMT,IAAI,IAAI8H,MAAST,EAAOO,GAAGG,GAAaJ,GAAG,GAAGG,CAAI,CAAC,GACnDE,IAAS,CAACC,IAAOV,MAAS;AAI5B,IAFAK,IAAI5H,EAAEwH,GAAOS,CAAI,GACjBN,IAAI3H,EAAC,GACDiI,EAAK,WAAW,MAEpBL,IAAI5H,EAAEyH,GAAOQ,CAAI,GACjBN,IAAI3H,EAAC;AAAA,EACT,GACMkI,IAAM,MAAM;AAEd,QAAIzH,OAAOiH;AACP,YAAM,IAAI,MAAM,sCAAsC;AAC1D,QAAI/H,IAAM;AACV,UAAMU,IAAM,CAAA;AACZ,WAAOV,IAAMyH,KAAU;AACnB,MAAAO,IAAI3H,EAAC;AACL,YAAMmI,IAAKR,EAAE,MAAK;AAClB,MAAAtH,EAAI,KAAK8H,CAAE,GACXxI,KAAOgI,EAAE;AAAA,IACb;AACA,WAAOI,GAAa,GAAG1H,CAAG;AAAA,EAC9B;AAUA,SATiB,CAAC4H,GAAMG,MAAS;AAC7B,IAAAP,EAAK,GACLG,EAAOC,CAAI;AACX,QAAI/F;AACJ,WAAO,EAAEA,IAAMkG,EAAKF,EAAG,CAAE;AACrB,MAAAF,EAAM;AACV,WAAAH,EAAK,GACE3F;AAAA,EACX;AAEJ;AACO,SAASmG,GAAeC,GAAQC,IAAS,CAAA,GAAIC,IAAY,CAAA,GAAI;AAChE,MAAI,CAACF,KAAU,OAAOA,KAAW;AAC7B,UAAM,IAAI,MAAM,+BAA+B;AACnD,WAASG,EAAWC,GAAWC,GAAcC,GAAO;AAChD,UAAMC,IAAMP,EAAOI,CAAS;AAC5B,QAAIE,KAASC,MAAQ;AACjB;AACJ,UAAMC,IAAU,OAAOD;AACvB,QAAIC,MAAYH,KAAgBE,MAAQ;AACpC,YAAM,IAAI,MAAM,UAAUH,CAAS,0BAA0BC,CAAY,SAASG,CAAO,EAAE;AAAA,EACnG;AACA,QAAMC,IAAO,CAACC,GAAGJ,MAAU,OAAO,QAAQI,CAAC,EAAE,QAAQ,CAAC,CAACpB,GAAGD,CAAC,MAAMc,EAAWb,GAAGD,GAAGiB,CAAK,CAAC;AACxF,EAAAG,EAAKR,GAAQ,EAAK,GAClBQ,EAAKP,GAAW,EAAI;AACxB;AAWO,SAASS,GAASC,GAAI;AACzB,QAAMC,IAAM,oBAAI,QAAO;AACvB,SAAO,CAACC,MAAQC,MAAS;AACrB,UAAMR,IAAMM,EAAI,IAAIC,CAAG;AACvB,QAAIP,MAAQ;AACR,aAAOA;AACX,UAAMS,IAAWJ,EAAGE,GAAK,GAAGC,CAAI;AAChC,WAAAF,EAAI,IAAIC,GAAKE,CAAQ,GACdA;AAAA,EACX;AACJ;ACzOA;AAIA,MAAMzD,IAAsB,uBAAO,CAAC,GAAGC,IAAsB,uBAAO,CAAC,GAAGyD,KAAsB,uBAAO,CAAC,GAEhGC,KAAsB,uBAAO,CAAC,GAAGC,KAAsB,uBAAO,CAAC,GAAGC,KAAsB,uBAAO,CAAC,GAEhGC,KAAsB,uBAAO,CAAC,GAAGC,KAAsB,uBAAO,CAAC,GAAGC,KAAsB,uBAAO,CAAC,GAChGC,KAAuB,uBAAO,EAAE;AAE/B,SAASC,EAAI7K,GAAG+D,GAAG;AACtB,QAAM+G,IAAS9K,IAAI+D;AACnB,SAAO+G,KAAUnE,IAAMmE,IAAS/G,IAAI+G;AACxC;AAWO,SAASC,EAAKC,GAAGC,GAAOC,GAAQ;AACnC,MAAIlI,IAAMgI;AACV,SAAOC,MAAUtE;AACb,IAAA3D,KAAOA,GACPA,KAAOkI;AAEX,SAAOlI;AACX;AAKO,SAASmI,GAAOC,GAAQF,GAAQ;AACnC,MAAIE,MAAWzE;AACX,UAAM,IAAI,MAAM,kCAAkC;AACtD,MAAIuE,KAAUvE;AACV,UAAM,IAAI,MAAM,4CAA4CuE,CAAM;AAEtE,MAAIlL,IAAI6K,EAAIO,GAAQF,CAAM,GACtBnH,IAAImH,GAEJF,IAAIrE,GAAc0E,IAAIzE;AAC1B,SAAO5G,MAAM2G,KAAK;AAEd,UAAM2E,IAAIvH,IAAI/D,GACRuL,IAAIxH,IAAI/D,GACRwL,IAAIR,IAAIK,IAAIC;AAGlB,IAAAvH,IAAI/D,GAAGA,IAAIuL,GAAGP,IAAIK,GAAUA,IAAIG;AAAA,EACpC;AAEA,MADYzH,MACA6C;AACR,UAAM,IAAI,MAAM,wBAAwB;AAC5C,SAAOiE,EAAIG,GAAGE,CAAM;AACxB;AACA,SAASO,GAAeC,GAAIC,GAAMzL,GAAG;AACjC,MAAI,CAACwL,EAAG,IAAIA,EAAG,IAAIC,CAAI,GAAGzL,CAAC;AACvB,UAAM,IAAI,MAAM,yBAAyB;AACjD;AAKA,SAAS0L,GAAUF,GAAIxL,GAAG;AACtB,QAAM2L,KAAUH,EAAG,QAAQ9E,KAAO2D,IAC5BoB,IAAOD,EAAG,IAAIxL,GAAG2L,CAAM;AAC7B,SAAAJ,GAAeC,GAAIC,GAAMzL,CAAC,GACnByL;AACX;AACA,SAASG,GAAUJ,GAAIxL,GAAG;AACtB,QAAM6L,KAAUL,EAAG,QAAQlB,MAAOE,IAC5B9H,IAAK8I,EAAG,IAAIxL,GAAGmK,EAAG,GAClB5B,IAAIiD,EAAG,IAAI9I,GAAImJ,CAAM,GACrBC,IAAKN,EAAG,IAAIxL,GAAGuI,CAAC,GAChB,IAAIiD,EAAG,IAAIA,EAAG,IAAIM,GAAI3B,EAAG,GAAG5B,CAAC,GAC7BkD,IAAOD,EAAG,IAAIM,GAAIN,EAAG,IAAI,GAAGA,EAAG,GAAG,CAAC;AACzC,SAAAD,GAAeC,GAAIC,GAAMzL,CAAC,GACnByL;AACX;AAGA,SAASM,GAAWC,GAAG;AACnB,QAAMC,IAAMC,GAAMF,CAAC,GACbG,IAAKC,GAAcJ,CAAC,GACpBK,IAAKF,EAAGF,GAAKA,EAAI,IAAIA,EAAI,GAAG,CAAC,GAC7BK,IAAKH,EAAGF,GAAKI,CAAE,GACfE,IAAKJ,EAAGF,GAAKA,EAAI,IAAII,CAAE,CAAC,GACxBG,KAAMR,IAAIzB,MAAOG;AACvB,SAAO,CAACc,GAAIxL,MAAM;AACd,QAAIyM,IAAMjB,EAAG,IAAIxL,GAAGwM,CAAE,GAClBE,IAAMlB,EAAG,IAAIiB,GAAKJ,CAAE;AACxB,UAAMM,IAAMnB,EAAG,IAAIiB,GAAKH,CAAE,GACpBM,IAAMpB,EAAG,IAAIiB,GAAKF,CAAE,GACpBM,IAAKrB,EAAG,IAAIA,EAAG,IAAIkB,CAAG,GAAG1M,CAAC,GAC1B8M,IAAKtB,EAAG,IAAIA,EAAG,IAAImB,CAAG,GAAG3M,CAAC;AAChC,IAAAyM,IAAMjB,EAAG,KAAKiB,GAAKC,GAAKG,CAAE,GAC1BH,IAAMlB,EAAG,KAAKoB,GAAKD,GAAKG,CAAE;AAC1B,UAAMC,IAAKvB,EAAG,IAAIA,EAAG,IAAIkB,CAAG,GAAG1M,CAAC,GAC1ByL,IAAOD,EAAG,KAAKiB,GAAKC,GAAKK,CAAE;AACjC,WAAAxB,GAAeC,GAAIC,GAAMzL,CAAC,GACnByL;AAAA,EACX;AACJ;AAQO,SAASW,GAAcJ,GAAG;AAG7B,MAAIA,IAAI5B;AACJ,UAAM,IAAI,MAAM,qCAAqC;AAEzD,MAAI4C,IAAIhB,IAAItF,GACRuG,IAAI;AACR,SAAOD,IAAI7C,OAAQ1D;AACf,IAAAuG,KAAK7C,IACL8C;AAGJ,MAAIC,IAAI/C;AACR,QAAMgD,IAAMjB,GAAMF,CAAC;AACnB,SAAOoB,GAAWD,GAAKD,CAAC,MAAM;AAG1B,QAAIA,MAAM;AACN,YAAM,IAAI,MAAM,+CAA+C;AAGvE,MAAID,MAAM;AACN,WAAOvB;AAGX,MAAI2B,IAAKF,EAAI,IAAID,GAAGF,CAAC;AACrB,QAAMM,KAAUN,IAAItG,KAAOyD;AAC3B,SAAO,SAAqBqB,GAAIxL,GAAG;AAC/B,QAAIwL,EAAG,IAAIxL,CAAC;AACR,aAAOA;AAEX,QAAIoN,GAAW5B,GAAIxL,CAAC,MAAM;AACtB,YAAM,IAAI,MAAM,yBAAyB;AAE7C,QAAIuN,IAAIN,GACJnJ,IAAI0H,EAAG,IAAIA,EAAG,KAAK6B,CAAE,GACrBG,IAAIhC,EAAG,IAAIxL,GAAGgN,CAAC,GACfS,IAAIjC,EAAG,IAAIxL,GAAGsN,CAAM;AAGxB,WAAO,CAAC9B,EAAG,IAAIgC,GAAGhC,EAAG,GAAG,KAAG;AACvB,UAAIA,EAAG,IAAIgC,CAAC;AACR,eAAOhC,EAAG;AACd,UAAInK,IAAI,GAEJqM,IAAQlC,EAAG,IAAIgC,CAAC;AACpB,aAAO,CAAChC,EAAG,IAAIkC,GAAOlC,EAAG,GAAG;AAGxB,YAFAnK,KACAqM,IAAQlC,EAAG,IAAIkC,CAAK,GAChBrM,MAAMkM;AACN,gBAAM,IAAI,MAAM,yBAAyB;AAGjD,YAAMI,IAAWjH,KAAO,OAAO6G,IAAIlM,IAAI,CAAC,GAClCwC,IAAI2H,EAAG,IAAI1H,GAAG6J,CAAQ;AAE5B,MAAAJ,IAAIlM,GACJyC,IAAI0H,EAAG,IAAI3H,CAAC,GACZ2J,IAAIhC,EAAG,IAAIgC,GAAG1J,CAAC,GACf2J,IAAIjC,EAAG,IAAIiC,GAAG5J,CAAC;AAAA,IACnB;AACA,WAAO4J;AAAA,EACX;AACJ;AAYO,SAASG,GAAO5B,GAAG;AAEtB,SAAIA,IAAI3B,OAAQD,KACLsB,KAEPM,IAAIxB,OAAQF,KACLsB,KAEPI,IAAItB,OAASD,KACNsB,GAAWC,CAAC,IAEhBI,GAAcJ,CAAC;AAC1B;AAIA,MAAM6B,KAAe;AAAA,EACjB;AAAA,EAAU;AAAA,EAAW;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAQ;AAAA,EAClD;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EACnC;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAC5B;AACO,SAASC,GAAcC,GAAO;AACjC,QAAMC,IAAU;AAAA,IACZ,OAAO;AAAA,IACP,OAAO;AAAA,IACP,MAAM;AAAA,EACd,GACU3K,IAAOwK,GAAa,OAAO,CAAC9D,GAAKN,OACnCM,EAAIN,CAAG,IAAI,YACJM,IACRiE,CAAO;AACV,SAAA/E,GAAe8E,GAAO1K,CAAI,GAInB0K;AACX;AAMO,SAASE,GAAMzC,GAAIzE,GAAKgE,GAAO;AAClC,MAAIA,IAAQtE;AACR,UAAM,IAAI,MAAM,yCAAyC;AAC7D,MAAIsE,MAAUtE;AACV,WAAO+E,EAAG;AACd,MAAIT,MAAUrE;AACV,WAAOK;AACX,MAAImH,IAAI1C,EAAG,KACP2C,IAAIpH;AACR,SAAOgE,IAAQtE;AACX,IAAIsE,IAAQrE,MACRwH,IAAI1C,EAAG,IAAI0C,GAAGC,CAAC,IACnBA,IAAI3C,EAAG,IAAI2C,CAAC,GACZpD,MAAUrE;AAEd,SAAOwH;AACX;AAMO,SAASE,GAAc5C,GAAI6C,GAAMC,IAAW,IAAO;AACtD,QAAMC,IAAW,IAAI,MAAMF,EAAK,MAAM,EAAE,KAAKC,IAAW9C,EAAG,OAAO,MAAS,GAErEgD,IAAgBH,EAAK,OAAO,CAACI,GAAK1H,GAAK1F,MACrCmK,EAAG,IAAIzE,CAAG,IACH0H,KACXF,EAASlN,CAAC,IAAIoN,GACPjD,EAAG,IAAIiD,GAAK1H,CAAG,IACvByE,EAAG,GAAG,GAEHkD,IAAclD,EAAG,IAAIgD,CAAa;AAExC,SAAAH,EAAK,YAAY,CAACI,GAAK1H,GAAK1F,MACpBmK,EAAG,IAAIzE,CAAG,IACH0H,KACXF,EAASlN,CAAC,IAAImK,EAAG,IAAIiD,GAAKF,EAASlN,CAAC,CAAC,GAC9BmK,EAAG,IAAIiD,GAAK1H,CAAG,IACvB2H,CAAW,GACPH;AACX;AAcO,SAASnB,GAAW5B,GAAIxL,GAAG;AAG9B,QAAM2O,KAAUnD,EAAG,QAAQ9E,KAAOyD,IAC5ByE,IAAUpD,EAAG,IAAIxL,GAAG2O,CAAM,GAC1BE,IAAMrD,EAAG,IAAIoD,GAASpD,EAAG,GAAG,GAC5BsD,IAAOtD,EAAG,IAAIoD,GAASpD,EAAG,IAAI,GAC9BuD,IAAKvD,EAAG,IAAIoD,GAASpD,EAAG,IAAIA,EAAG,GAAG,CAAC;AACzC,MAAI,CAACqD,KAAO,CAACC,KAAQ,CAACC;AAClB,UAAM,IAAI,MAAM,gCAAgC;AACpD,SAAOF,IAAM,IAAIC,IAAO,IAAI;AAChC;AAOO,SAASE,GAAQhP,GAAGiP,GAAY;AAEnC,EAAIA,MAAe,UACflP,GAAQkP,CAAU;AACtB,QAAMC,IAAcD,MAAe,SAAYA,IAAajP,EAAE,SAAS,CAAC,EAAE,QACpEmP,IAAc,KAAK,KAAKD,IAAc,CAAC;AAC7C,SAAO,EAAE,YAAYA,GAAa,aAAAC,EAAW;AACjD;AACA,MAAMC,GAAO;AAAA,EAUT,YAAYC,GAAOhM,IAAO,IAAI;AAT9B,IAAAgB,EAAA;AACA,IAAAA,EAAA;AACA,IAAAA,EAAA;AACA,IAAAA,EAAA;AACA,IAAAA,EAAA,cAAOoC;AACP,IAAApC,EAAA,aAAMqC;AACN,IAAArC,EAAA;AACA,IAAAA,EAAA;AACA;AAAA,IAAAA,EAAA;;AAEI,QAAIgL,KAAS5I;AACT,YAAM,IAAI,MAAM,4CAA4C4I,CAAK;AACrE,QAAIC;AACJ,SAAK,OAAO,IACRjM,KAAQ,QAAQ,OAAOA,KAAS,aAC5B,OAAOA,EAAK,QAAS,aACrBiM,IAAcjM,EAAK,OACnB,OAAOA,EAAK,QAAS,eACrB,KAAK,OAAOA,EAAK,OACjB,OAAOA,EAAK,QAAS,cACrB,KAAK,OAAOA,EAAK,OACjBA,EAAK,mBACL,KAAK,YAAWkM,IAAAlM,EAAK,mBAAL,gBAAAkM,EAAqB,UACrC,OAAOlM,EAAK,gBAAiB,cAC7B,KAAK,OAAOA,EAAK;AAEzB,UAAM,EAAE,YAAA4L,GAAY,aAAAE,EAAW,IAAKH,GAAQK,GAAOC,CAAW;AAC9D,QAAIH,IAAc;AACd,YAAM,IAAI,MAAM,gDAAgD;AACpE,SAAK,QAAQE,GACb,KAAK,OAAOJ,GACZ,KAAK,QAAQE,GACb,KAAK,QAAQ,QACb,OAAO,kBAAkB,IAAI;AAAA,EACjC;AAAA,EACA,OAAOpI,GAAK;AACR,WAAO4D,EAAI5D,GAAK,KAAK,KAAK;AAAA,EAC9B;AAAA,EACA,QAAQA,GAAK;AACT,QAAI,OAAOA,KAAQ;AACf,YAAM,IAAI,MAAM,iDAAiD,OAAOA,CAAG;AAC/E,WAAON,KAAOM,KAAOA,IAAM,KAAK;AAAA,EACpC;AAAA,EACA,IAAIA,GAAK;AACL,WAAOA,MAAQN;AAAAA,EACnB;AAAA;AAAA,EAEA,YAAYM,GAAK;AACb,WAAO,CAAC,KAAK,IAAIA,CAAG,KAAK,KAAK,QAAQA,CAAG;AAAA,EAC7C;AAAA,EACA,MAAMA,GAAK;AACP,YAAQA,IAAML,OAASA;AAAAA,EAC3B;AAAA,EACA,IAAIK,GAAK;AACL,WAAO4D,EAAI,CAAC5D,GAAK,KAAK,KAAK;AAAA,EAC/B;AAAA,EACA,IAAIyI,GAAKC,GAAK;AACV,WAAOD,MAAQC;AAAA,EACnB;AAAA,EACA,IAAI1I,GAAK;AACL,WAAO4D,EAAI5D,IAAMA,GAAK,KAAK,KAAK;AAAA,EACpC;AAAA,EACA,IAAIyI,GAAKC,GAAK;AACV,WAAO9E,EAAI6E,IAAMC,GAAK,KAAK,KAAK;AAAA,EACpC;AAAA,EACA,IAAID,GAAKC,GAAK;AACV,WAAO9E,EAAI6E,IAAMC,GAAK,KAAK,KAAK;AAAA,EACpC;AAAA,EACA,IAAID,GAAKC,GAAK;AACV,WAAO9E,EAAI6E,IAAMC,GAAK,KAAK,KAAK;AAAA,EACpC;AAAA,EACA,IAAI1I,GAAKgE,GAAO;AACZ,WAAOkD,GAAM,MAAMlH,GAAKgE,CAAK;AAAA,EACjC;AAAA,EACA,IAAIyE,GAAKC,GAAK;AACV,WAAO9E,EAAI6E,IAAMvE,GAAOwE,GAAK,KAAK,KAAK,GAAG,KAAK,KAAK;AAAA,EACxD;AAAA;AAAA,EAEA,KAAK1I,GAAK;AACN,WAAOA,IAAMA;AAAA,EACjB;AAAA,EACA,KAAKyI,GAAKC,GAAK;AACX,WAAOD,IAAMC;AAAA,EACjB;AAAA,EACA,KAAKD,GAAKC,GAAK;AACX,WAAOD,IAAMC;AAAA,EACjB;AAAA,EACA,KAAKD,GAAKC,GAAK;AACX,WAAOD,IAAMC;AAAA,EACjB;AAAA,EACA,IAAI1I,GAAK;AACL,WAAOkE,GAAOlE,GAAK,KAAK,KAAK;AAAA,EACjC;AAAA,EACA,KAAKA,GAAK;AAEN,WAAK,KAAK,UACN,KAAK,QAAQ6G,GAAO,KAAK,KAAK,IAC3B,KAAK,MAAM,MAAM7G,CAAG;AAAA,EAC/B;AAAA,EACA,QAAQA,GAAK;AACT,WAAO,KAAK,OAAOS,GAAgBT,GAAK,KAAK,KAAK,IAAIO,GAAgBP,GAAK,KAAK,KAAK;AAAA,EACzF;AAAA,EACA,UAAUzG,GAAOoP,IAAiB,IAAO;AACrCvP,IAAAA,EAAOG,CAAK;AACZ,UAAM,EAAE,UAAUqP,GAAgB,OAAAC,GAAO,MAAAxL,GAAM,OAAAiL,GAAO,MAAMQ,EAAY,IAAK;AAC7E,QAAIF,GAAgB;AAChB,UAAI,CAACA,EAAe,SAASrP,EAAM,MAAM,KAAKA,EAAM,SAASsP;AACzD,cAAM,IAAI,MAAM,+BAA+BD,IAAiB,iBAAiBrP,EAAM,MAAM;AAEjG,YAAMwP,IAAS,IAAI,WAAWF,CAAK;AAEnC,MAAAE,EAAO,IAAIxP,GAAO8D,IAAO,IAAI0L,EAAO,SAASxP,EAAM,MAAM,GACzDA,IAAQwP;AAAA,IACZ;AACA,QAAIxP,EAAM,WAAWsP;AACjB,YAAM,IAAI,MAAM,+BAA+BA,IAAQ,iBAAiBtP,EAAM,MAAM;AACxF,QAAIyP,IAAS3L,IAAO+C,GAAgB7G,CAAK,IAAI2G,GAAgB3G,CAAK;AAGlE,QAFIuP,MACAE,IAASpF,EAAIoF,GAAQV,CAAK,IAC1B,CAACK,KACG,CAAC,KAAK,QAAQK,CAAM;AACpB,YAAM,IAAI,MAAM,kDAAkD;AAG1E,WAAOA;AAAA,EACX;AAAA;AAAA,EAEA,YAAYC,GAAK;AACb,WAAO5B,GAAc,MAAM4B,CAAG;AAAA,EAClC;AAAA;AAAA;AAAA,EAGA,KAAKlQ,GAAG+D,GAAGoM,GAAW;AAClB,WAAOA,IAAYpM,IAAI/D;AAAA,EAC3B;AACJ;AAoBO,SAASoM,GAAMmD,GAAOhM,IAAO,IAAI;AACpC,SAAO,IAAI+L,GAAOC,GAAOhM,CAAI;AACjC;AAgCO,SAAS6M,GAAoBC,GAAY;AAC5C,MAAI,OAAOA,KAAe;AACtB,UAAM,IAAI,MAAM,4BAA4B;AAChD,QAAMC,IAAYD,EAAW,SAAS,CAAC,EAAE;AACzC,SAAO,KAAK,KAAKC,IAAY,CAAC;AAClC;AAQO,SAASC,GAAiBF,GAAY;AACzC,QAAM9P,IAAS6P,GAAoBC,CAAU;AAC7C,SAAO9P,IAAS,KAAK,KAAKA,IAAS,CAAC;AACxC;AAcO,SAASiQ,GAAeC,GAAKJ,GAAY/L,IAAO,IAAO;AAC1DjE,EAAAA,EAAOoQ,CAAG;AACV,QAAMhQ,IAAMgQ,EAAI,QACVC,IAAWN,GAAoBC,CAAU,GACzCM,IAASJ,GAAiBF,CAAU;AAE1C,MAAI5P,IAAM,MAAMA,IAAMkQ,KAAUlQ,IAAM;AAClC,UAAM,IAAI,MAAM,cAAckQ,IAAS,+BAA+BlQ,CAAG;AAC7E,QAAMwG,IAAM3C,IAAO+C,GAAgBoJ,CAAG,IAAItJ,GAAgBsJ,CAAG,GAEvDG,IAAU/F,EAAI5D,GAAKoJ,IAAazJ,CAAG,IAAIA;AAC7C,SAAOtC,IAAOoD,GAAgBkJ,GAASF,CAAQ,IAAIlJ,GAAgBoJ,GAASF,CAAQ;AACxF;ACpiBA;AAGA,MAAM/J,KAAsB,uBAAO,CAAC,GAC9BC,KAAsB,uBAAO,CAAC;AAC7B,SAASiK,GAASV,GAAWW,GAAM;AACtC,QAAMC,IAAMD,EAAK,OAAM;AACvB,SAAOX,IAAYY,IAAMD;AAC7B;AAOO,SAASE,GAAWhN,GAAGiN,GAAQ;AAClC,QAAMC,IAAa5C,GAActK,EAAE,IAAIiN,EAAO,IAAI,CAAC7C,MAAMA,EAAE,CAAC,CAAC;AAC7D,SAAO6C,EAAO,IAAI,CAAC7C,GAAG7M,MAAMyC,EAAE,WAAWoK,EAAE,SAAS8C,EAAW3P,CAAC,CAAC,CAAC,CAAC;AACvE;AACA,SAAS4P,GAAUC,GAAGC,GAAM;AACxB,MAAI,CAAC,OAAO,cAAcD,CAAC,KAAKA,KAAK,KAAKA,IAAIC;AAC1C,UAAM,IAAI,MAAM,uCAAuCA,IAAO,cAAcD,CAAC;AACrF;AACA,SAASE,GAAUF,GAAGG,GAAY;AAC9B,EAAAJ,GAAUC,GAAGG,CAAU;AACvB,QAAMC,IAAU,KAAK,KAAKD,IAAaH,CAAC,IAAI,GACtCK,IAAa,MAAML,IAAI,IACvBM,IAAY,KAAKN,GACjBO,IAAO5J,GAAQqJ,CAAC,GAChBQ,IAAU,OAAOR,CAAC;AACxB,SAAO,EAAE,SAAAI,GAAS,YAAAC,GAAY,MAAAE,GAAM,WAAAD,GAAW,SAAAE,EAAO;AAC1D;AACA,SAASC,GAAY3R,GAAG4R,GAAQC,GAAO;AACnC,QAAM,EAAE,YAAAN,GAAY,MAAAE,GAAM,WAAAD,GAAW,SAAAE,EAAO,IAAKG;AACjD,MAAIC,IAAQ,OAAO9R,IAAIyR,CAAI,GACvBM,IAAQ/R,KAAK0R;AAMjB,EAAII,IAAQP,MAERO,KAASN,GACTO,KAASrL;AAEb,QAAMsL,IAAcJ,IAASL,GACvBxL,IAASiM,IAAc,KAAK,IAAIF,CAAK,IAAI,GACzCG,IAASH,MAAU,GACnBI,IAAQJ,IAAQ,GAChBK,IAASP,IAAS,MAAM;AAE9B,SAAO,EAAE,OAAAG,GAAO,QAAAhM,GAAQ,QAAAkM,GAAQ,OAAAC,GAAO,QAAAC,GAAQ,SAD/BH,EACsC;AAC1D;AAoBA,MAAMI,KAAmB,oBAAI,QAAO,GAC9BC,KAAmB,oBAAI,QAAO;AACpC,SAASC,GAAKtG,GAAG;AAGb,SAAOqG,GAAiB,IAAIrG,CAAC,KAAK;AACtC;AACA,SAASuG,GAAQvS,GAAG;AAChB,MAAIA,MAAMyG;AACN,UAAM,IAAI,MAAM,cAAc;AACtC;AAmBO,MAAM+L,GAAK;AAAA;AAAA,EAMd,YAAYC,GAAOtB,GAAM;AALzB,IAAA9M,EAAA;AACA,IAAAA,EAAA;AACA,IAAAA,EAAA;AACA,IAAAA,EAAA;AAGI,SAAK,OAAOoO,EAAM,MAClB,KAAK,OAAOA,EAAM,MAClB,KAAK,KAAKA,EAAM,IAChB,KAAK,OAAOtB;AAAA,EAChB;AAAA;AAAA,EAEA,cAAcuB,GAAK1S,GAAGkO,IAAI,KAAK,MAAM;AACjC,QAAIC,IAAIuE;AACR,WAAO1S,IAAIyG;AACP,MAAIzG,IAAI0G,OACJwH,IAAIA,EAAE,IAAIC,CAAC,IACfA,IAAIA,EAAE,OAAM,GACZnO,MAAM0G;AAEV,WAAOwH;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,iBAAiByE,GAAOzB,GAAG;AACvB,UAAM,EAAE,SAAAI,GAAS,YAAAC,EAAU,IAAKH,GAAUF,GAAG,KAAK,IAAI,GAChDH,IAAS,CAAA;AACf,QAAI7C,IAAIyE,GACJC,IAAO1E;AACX,aAAS0D,IAAS,GAAGA,IAASN,GAASM,KAAU;AAC7C,MAAAgB,IAAO1E,GACP6C,EAAO,KAAK6B,CAAI;AAEhB,eAASvR,IAAI,GAAGA,IAAIkQ,GAAYlQ;AAC5B,QAAAuR,IAAOA,EAAK,IAAI1E,CAAC,GACjB6C,EAAO,KAAK6B,CAAI;AAEpB,MAAA1E,IAAI0E,EAAK,OAAM;AAAA,IACnB;AACA,WAAO7B;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAKG,GAAG2B,GAAa,GAAG;AAEpB,QAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;AAClB,YAAM,IAAI,MAAM,gBAAgB;AAEpC,QAAI3E,IAAI,KAAK,MACTtE,IAAI,KAAK;AAMb,UAAMkJ,IAAK1B,GAAUF,GAAG,KAAK,IAAI;AACjC,aAASU,IAAS,GAAGA,IAASkB,EAAG,SAASlB,KAAU;AAEhD,YAAM,EAAE,OAAAG,GAAO,QAAAhM,GAAQ,QAAAkM,GAAQ,OAAAC,GAAO,QAAAC,GAAQ,SAAAY,EAAO,IAAKpB,GAAY,GAAGC,GAAQkB,CAAE;AACnF,UAAIf,GACAE,IAGArI,IAAIA,EAAE,IAAI+G,GAASwB,GAAQU,EAAYE,CAAO,CAAC,CAAC,IAIhD7E,IAAIA,EAAE,IAAIyC,GAASuB,GAAOW,EAAY9M,CAAM,CAAC,CAAC;AAAA,IAEtD;AACA,WAAAwM,GAAQ,CAAC,GAIF,EAAE,GAAArE,GAAG,GAAAtE,EAAC;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAWsH,GAAG2B,GAAa,GAAGpE,IAAM,KAAK,MAAM;AAC3C,UAAMqE,IAAK1B,GAAUF,GAAG,KAAK,IAAI;AACjC,aAASU,IAAS,GAAGA,IAASkB,EAAG,WACzB,MAAMrM,IAD4BmL,KAAU;AAGhD,YAAM,EAAE,OAAAG,GAAO,QAAAhM,GAAQ,QAAAkM,GAAQ,OAAAC,EAAK,IAAKP,GAAY,GAAGC,GAAQkB,CAAE;AAElE,UADA,IAAIf,GACA,CAAAE,GAKC;AACD,cAAMrB,IAAOiC,EAAY9M,CAAM;AAC/B,QAAA0I,IAAMA,EAAI,IAAIyD,IAAQtB,EAAK,OAAM,IAAKA,CAAI;AAAA,MAC9C;AAAA,IACJ;AACA,WAAA2B,GAAQ,CAAC,GACF9D;AAAA,EACX;AAAA,EACA,eAAeyC,GAAGyB,GAAOK,GAAW;AAEhC,QAAIC,IAAOb,GAAiB,IAAIO,CAAK;AACrC,WAAKM,MACDA,IAAO,KAAK,iBAAiBN,GAAOzB,CAAC,GACjCA,MAAM,MAEF,OAAO8B,KAAc,eACrBC,IAAOD,EAAUC,CAAI,IACzBb,GAAiB,IAAIO,GAAOM,CAAI,KAGjCA;AAAA,EACX;AAAA,EACA,OAAON,GAAO5C,GAAQiD,GAAW;AAC7B,UAAM9B,IAAIoB,GAAKK,CAAK;AACpB,WAAO,KAAK,KAAKzB,GAAG,KAAK,eAAeA,GAAGyB,GAAOK,CAAS,GAAGjD,CAAM;AAAA,EACxE;AAAA,EACA,OAAO4C,GAAO5C,GAAQiD,GAAWE,GAAM;AACnC,UAAMhC,IAAIoB,GAAKK,CAAK;AACpB,WAAIzB,MAAM,IACC,KAAK,cAAcyB,GAAO5C,GAAQmD,CAAI,IAC1C,KAAK,WAAWhC,GAAG,KAAK,eAAeA,GAAGyB,GAAOK,CAAS,GAAGjD,GAAQmD,CAAI;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA,EAIA,YAAYlH,GAAGkF,GAAG;AACd,IAAAD,GAAUC,GAAG,KAAK,IAAI,GACtBmB,GAAiB,IAAIrG,GAAGkF,CAAC,GACzBkB,GAAiB,OAAOpG,CAAC;AAAA,EAC7B;AAAA,EACA,SAAS0G,GAAK;AACV,WAAOJ,GAAKI,CAAG,MAAM;AAAA,EACzB;AACJ;AAKO,SAASS,GAAcV,GAAOE,GAAOS,GAAIC,GAAI;AAChD,MAAI5E,IAAMkE,GACNW,IAAKb,EAAM,MACXc,IAAKd,EAAM;AACf,SAAOW,IAAK3M,MAAO4M,IAAK5M;AACpB,IAAI2M,IAAK1M,OACL4M,IAAKA,EAAG,IAAI7E,CAAG,IACf4E,IAAK3M,OACL6M,IAAKA,EAAG,IAAI9E,CAAG,IACnBA,IAAMA,EAAI,OAAM,GAChB2E,MAAO1M,IACP2M,MAAO3M;AAEX,SAAO,EAAE,IAAA4M,GAAI,IAAAC,EAAE;AACnB;AA2IA,SAASC,GAAYC,GAAO1F,GAAO3J,GAAM;AACrC,MAAI2J,GAAO;AACP,QAAIA,EAAM,UAAU0F;AAChB,YAAM,IAAI,MAAM,gDAAgD;AACpE,WAAA3F,GAAcC,CAAK,GACZA;AAAA,EACX;AAEI,WAAO7B,GAAMuH,GAAO,EAAE,MAAArP,GAAM;AAEpC;AAEO,SAASsP,GAAkBC,GAAMC,GAAOC,IAAY,CAAA,GAAIC,GAAQ;AAGnE,MAFIA,MAAW,WACXA,IAASH,MAAS,YAClB,CAACC,KAAS,OAAOA,KAAU;AAC3B,UAAM,IAAI,MAAM,kBAAkBD,CAAI,eAAe;AACzD,aAAWzF,KAAK,CAAC,KAAK,KAAK,GAAG,GAAG;AAC7B,UAAMzE,IAAMmK,EAAM1F,CAAC;AACnB,QAAI,EAAE,OAAOzE,KAAQ,YAAYA,IAAMhD;AACnC,YAAM,IAAI,MAAM,SAASyH,CAAC,0BAA0B;AAAA,EAC5D;AACA,QAAM1C,IAAKgI,GAAYI,EAAM,GAAGC,EAAU,IAAIC,CAAM,GAC9CC,IAAKP,GAAYI,EAAM,GAAGC,EAAU,IAAIC,CAAM,GAE9CE,IAAS,CAAC,MAAM,MAAM,KADQ,GACD;AACnC,aAAW9F,KAAK8F;AAEZ,QAAI,CAACxI,EAAG,QAAQoI,EAAM1F,CAAC,CAAC;AACpB,YAAM,IAAI,MAAM,SAASA,CAAC,0CAA0C;AAE5E,SAAA0F,IAAQ,OAAO,OAAO,OAAO,OAAO,CAAA,GAAIA,CAAK,CAAC,GACvC,EAAE,OAAAA,GAAO,IAAApI,GAAI,IAAAuI,EAAE;AAC1B;AACO,SAASE,GAAaC,GAAiBC,GAAc;AACxD,SAAO,SAAgBtL,GAAM;AACzB,UAAMuL,IAAYF,EAAgBrL,CAAI;AACtC,WAAO,EAAE,WAAAuL,GAAW,WAAWD,EAAaC,CAAS,EAAC;AAAA,EAC1D;AACJ;ACjcO,MAAMC,GAAM;AAAA,EAOf,YAAYC,GAAM/D,GAAK;AANvB,IAAAlM,EAAA;AACA,IAAAA,EAAA;AACA,IAAAA,EAAA;AACA,IAAAA,EAAA;AACA,IAAAA,EAAA,kBAAW;AACX,IAAAA,EAAA,mBAAY;AAKR,QAHA1D,GAAM2T,CAAI,GACVnU,EAAOoQ,GAAK,QAAW,KAAK,GAC5B,KAAK,QAAQ+D,EAAK,OAAM,GACpB,OAAO,KAAK,MAAM,UAAW;AAC7B,YAAM,IAAI,MAAM,qDAAqD;AACzE,SAAK,WAAW,KAAK,MAAM,UAC3B,KAAK,YAAY,KAAK,MAAM;AAC5B,UAAMrQ,IAAW,KAAK,UAChBlB,IAAM,IAAI,WAAWkB,CAAQ;AAEnC,IAAAlB,EAAI,IAAIwN,EAAI,SAAStM,IAAWqQ,EAAK,OAAM,EAAG,OAAO/D,CAAG,EAAE,OAAM,IAAKA,CAAG;AACxE,aAASlP,IAAI,GAAGA,IAAI0B,EAAI,QAAQ1B;AAC5B,MAAA0B,EAAI1B,CAAC,KAAK;AACd,SAAK,MAAM,OAAO0B,CAAG,GAErB,KAAK,QAAQuR,EAAK,OAAM;AAExB,aAASjT,IAAI,GAAGA,IAAI0B,EAAI,QAAQ1B;AAC5B,MAAA0B,EAAI1B,CAAC,KAAK;AACd,SAAK,MAAM,OAAO0B,CAAG,GACrB5B,GAAM4B,CAAG;AAAA,EACb;AAAA,EACA,OAAOwR,GAAK;AACR1T,WAAAA,GAAQ,IAAI,GACZ,KAAK,MAAM,OAAO0T,CAAG,GACd;AAAA,EACX;AAAA,EACA,WAAWtT,GAAK;AACZJ,IAAAA,GAAQ,IAAI,GACZV,EAAOc,GAAK,KAAK,WAAW,QAAQ,GACpC,KAAK,WAAW,IAChB,KAAK,MAAM,WAAWA,CAAG,GACzB,KAAK,MAAM,OAAOA,CAAG,GACrB,KAAK,MAAM,WAAWA,CAAG,GACzB,KAAK,QAAO;AAAA,EAChB;AAAA,EACA,SAAS;AACL,UAAMA,IAAM,IAAI,WAAW,KAAK,MAAM,SAAS;AAC/C,gBAAK,WAAWA,CAAG,GACZA;AAAA,EACX;AAAA,EACA,WAAW8D,GAAI;AAEX,IAAAA,UAAO,OAAO,OAAO,OAAO,eAAe,IAAI,GAAG,EAAE;AACpD,UAAM,EAAE,OAAAyP,GAAO,OAAAC,GAAO,UAAAzP,GAAU,WAAAC,GAAW,UAAAhB,GAAU,WAAAC,EAAS,IAAK;AACnE,WAAAa,IAAKA,GACLA,EAAG,WAAWC,GACdD,EAAG,YAAYE,GACfF,EAAG,WAAWd,GACdc,EAAG,YAAYb,GACfa,EAAG,QAAQyP,EAAM,WAAWzP,EAAG,KAAK,GACpCA,EAAG,QAAQ0P,EAAM,WAAW1P,EAAG,KAAK,GAC7BA;AAAA,EACX;AAAA,EACA,QAAQ;AACJ,WAAO,KAAK,WAAU;AAAA,EAC1B;AAAA,EACA,UAAU;AACN,SAAK,YAAY,IACjB,KAAK,MAAM,QAAO,GAClB,KAAK,MAAM,QAAO;AAAA,EACtB;AACJ;AAWO,MAAM2P,KAAO,CAACJ,GAAM/D,GAAK3Q,MAAY,IAAIyU,GAAMC,GAAM/D,CAAG,EAAE,OAAO3Q,CAAO,EAAE,OAAM;AACvF8U,GAAK,SAAS,CAACJ,GAAM/D,MAAQ,IAAI8D,GAAMC,GAAM/D,CAAG;AC9DhD;AAOA,MAAMoE,KAAa,CAAC5N,GAAK6N,OAAS7N,KAAOA,KAAO,IAAI6N,IAAM,CAACA,KAAOzK,MAAOyK;AAIlE,SAASC,GAAiBrM,GAAGsM,GAAO9U,GAAG;AAI1C,QAAM,CAAC,CAAC+U,GAAIC,CAAE,GAAG,CAACC,GAAIC,CAAE,CAAC,IAAIJ,GACvBzI,IAAKsI,GAAWO,IAAK1M,GAAGxI,CAAC,GACzBsM,IAAKqI,GAAW,CAACK,IAAKxM,GAAGxI,CAAC;AAGhC,MAAIoT,IAAK5K,IAAI6D,IAAK0I,IAAKzI,IAAK2I,GACxB5B,IAAK,CAAChH,IAAK2I,IAAK1I,IAAK4I;AACzB,QAAMC,IAAQ/B,IAAK3M,IACb2O,IAAQ/B,IAAK5M;AACnB,EAAI0O,MACA/B,IAAK,CAACA,IACNgC,MACA/B,IAAK,CAACA;AAGV,QAAMgC,IAAUxN,GAAQ,KAAK,KAAKD,GAAO5H,CAAC,IAAI,CAAC,CAAC,IAAI0G;AACpD,MAAI0M,IAAK3M,MAAO2M,KAAMiC,KAAWhC,IAAK5M,MAAO4M,KAAMgC;AAC/C,UAAM,IAAI,MAAM,2CAA2C7M,CAAC;AAEhE,SAAO,EAAE,OAAA2M,GAAO,IAAA/B,GAAI,OAAAgC,GAAO,IAAA/B,EAAE;AACjC;AACA,SAASiC,GAAkBC,GAAQ;AAC/B,MAAI,CAAC,CAAC,WAAW,aAAa,KAAK,EAAE,SAASA,CAAM;AAChD,UAAM,IAAI,MAAM,2DAA2D;AAC/E,SAAOA;AACX;AACA,SAASC,GAAgBnS,GAAMoS,GAAK;AAChC,QAAMC,IAAQ,CAAA;AACd,WAASC,KAAW,OAAO,KAAKF,CAAG;AAE/B,IAAAC,EAAMC,CAAO,IAAItS,EAAKsS,CAAO,MAAM,SAAYF,EAAIE,CAAO,IAAItS,EAAKsS,CAAO;AAE9E,SAAAhP,GAAM+O,EAAM,MAAM,MAAM,GACxB/O,GAAM+O,EAAM,SAAS,SAAS,GAC1BA,EAAM,WAAW,UACjBJ,GAAkBI,EAAM,MAAM,GAC3BA;AACX;AACO,MAAME,WAAe,MAAM;AAAA,EAC9B,YAAYtK,IAAI,IAAI;AAChB,UAAMA,CAAC;AAAA,EACX;AACJ;AAQO,MAAMuK,KAAM;AAAA;AAAA,EAEf,KAAKD;AAAA;AAAA,EAEL,MAAM;AAAA,IACF,QAAQ,CAACE,GAAKxR,MAAS;AACnB,YAAM,EAAE,KAAKqB,EAAC,IAAKkQ;AACnB,UAAIC,IAAM,KAAKA,IAAM;AACjB,cAAM,IAAInQ,EAAE,uBAAuB;AACvC,UAAIrB,EAAK,SAAS;AACd,cAAM,IAAIqB,EAAE,2BAA2B;AAC3C,YAAMoQ,IAAUzR,EAAK,SAAS,GACxB/D,IAAMuG,GAAoBiP,CAAO;AACvC,UAAKxV,EAAI,SAAS,IAAK;AACnB,cAAM,IAAIoF,EAAE,sCAAsC;AAEtD,YAAMqQ,IAASD,IAAU,MAAMjP,GAAqBvG,EAAI,SAAS,IAAK,GAAW,IAAI;AAErF,aADUuG,GAAoBgP,CAAG,IACtBE,IAASzV,IAAM+D;AAAA,IAC9B;AAAA;AAAA,IAEA,OAAOwR,GAAKxR,GAAM;AACd,YAAM,EAAE,KAAKqB,EAAC,IAAKkQ;AACnB,UAAIpR,IAAM;AACV,UAAIqR,IAAM,KAAKA,IAAM;AACjB,cAAM,IAAInQ,EAAE,uBAAuB;AACvC,UAAIrB,EAAK,SAAS,KAAKA,EAAKG,GAAK,MAAMqR;AACnC,cAAM,IAAInQ,EAAE,uBAAuB;AACvC,YAAMsQ,IAAQ3R,EAAKG,GAAK,GAClByR,IAAS,CAAC,EAAED,IAAQ;AAC1B,UAAI5V,IAAS;AACb,UAAI,CAAC6V;AACD,QAAA7V,IAAS4V;AAAA,WACR;AAED,cAAMD,IAASC,IAAQ;AACvB,YAAI,CAACD;AACD,gBAAM,IAAIrQ,EAAE,mDAAmD;AACnE,YAAIqQ,IAAS;AACT,gBAAM,IAAIrQ,EAAE,0CAA0C;AAC1D,cAAMwQ,IAAc7R,EAAK,SAASG,GAAKA,IAAMuR,CAAM;AACnD,YAAIG,EAAY,WAAWH;AACvB,gBAAM,IAAIrQ,EAAE,uCAAuC;AACvD,YAAIwQ,EAAY,CAAC,MAAM;AACnB,gBAAM,IAAIxQ,EAAE,sCAAsC;AACtD,mBAAW9B,KAAKsS;AACZ,UAAA9V,IAAUA,KAAU,IAAKwD;AAE7B,YADAY,KAAOuR,GACH3V,IAAS;AACT,gBAAM,IAAIsF,EAAE,wCAAwC;AAAA,MAC5D;AACA,YAAM4C,IAAIjE,EAAK,SAASG,GAAKA,IAAMpE,CAAM;AACzC,UAAIkI,EAAE,WAAWlI;AACb,cAAM,IAAIsF,EAAE,gCAAgC;AAChD,aAAO,EAAE,GAAA4C,GAAG,GAAGjE,EAAK,SAASG,IAAMpE,CAAM,EAAC;AAAA,IAC9C;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAKI,MAAM;AAAA,IACF,OAAO0G,GAAK;AACR,YAAM,EAAE,KAAKpB,EAAC,IAAKkQ;AACnB,UAAI9O,IAAMN;AACN,cAAM,IAAId,EAAE,4CAA4C;AAC5D,UAAI5D,IAAM+E,GAAoBC,CAAG;AAIjC,UAFI,OAAO,SAAShF,EAAI,CAAC,GAAG,EAAE,IAAI,MAC9BA,IAAM,OAAOA,IACbA,EAAI,SAAS;AACb,cAAM,IAAI4D,EAAE,gDAAgD;AAChE,aAAO5D;AAAA,IACX;AAAA,IACA,OAAOuC,GAAM;AACT,YAAM,EAAE,KAAKqB,EAAC,IAAKkQ;AACnB,UAAIvR,EAAK,CAAC,IAAI;AACV,cAAM,IAAIqB,EAAE,qCAAqC;AACrD,UAAIrB,EAAK,CAAC,MAAM,KAAQ,EAAEA,EAAK,CAAC,IAAI;AAChC,cAAM,IAAIqB,EAAE,qDAAqD;AACrE,aAAOsB,GAAgB3C,CAAI;AAAA,IAC/B;AAAA,EACR;AAAA,EACI,MAAMhE,GAAO;AAET,UAAM,EAAE,KAAKqF,GAAG,MAAMyQ,GAAK,MAAMC,EAAG,IAAKR,IACnCvR,IAAOnE,EAAOG,GAAO,QAAW,WAAW,GAC3C,EAAE,GAAGgW,GAAU,GAAGC,EAAY,IAAKF,EAAI,OAAO,IAAM/R,CAAI;AAC9D,QAAIiS,EAAa;AACb,YAAM,IAAI5Q,EAAE,6CAA6C;AAC7D,UAAM,EAAE,GAAG6Q,GAAQ,GAAGC,EAAU,IAAKJ,EAAI,OAAO,GAAMC,CAAQ,GACxD,EAAE,GAAGI,GAAQ,GAAGC,EAAU,IAAKN,EAAI,OAAO,GAAMI,CAAU;AAChE,QAAIE,EAAW;AACX,YAAM,IAAIhR,EAAE,6CAA6C;AAC7D,WAAO,EAAE,GAAGyQ,EAAI,OAAOI,CAAM,GAAG,GAAGJ,EAAI,OAAOM,CAAM,EAAC;AAAA,EACzD;AAAA,EACA,WAAWE,GAAK;AACZ,UAAM,EAAE,MAAMP,GAAK,MAAMD,EAAG,IAAKP,IAC3BgB,IAAKR,EAAI,OAAO,GAAMD,EAAI,OAAOQ,EAAI,CAAC,CAAC,GACvCE,IAAKT,EAAI,OAAO,GAAMD,EAAI,OAAOQ,EAAI,CAAC,CAAC,GACvCG,IAAMF,IAAKC;AACjB,WAAOT,EAAI,OAAO,IAAMU,CAAG;AAAA,EAC/B;AACJ,GAGMtQ,KAAM,OAAO,CAAC,GAAGC,KAAM,OAAO,CAAC,GAAGyD,KAAM,OAAO,CAAC,GAAGC,KAAM,OAAO,CAAC,GAAGC,KAAM,OAAO,CAAC;AAoBjF,SAAS2M,GAAYhD,GAAQiD,IAAY,IAAI;AAChD,QAAMC,IAAYxD,GAAkB,eAAeM,GAAQiD,CAAS,GAC9D,EAAE,IAAAzL,GAAI,IAAAuI,EAAE,IAAKmD;AACnB,MAAItD,IAAQsD,EAAU;AACtB,QAAM,EAAE,GAAGC,GAAU,GAAGC,EAAW,IAAKxD;AACxC,EAAA3K,GAAegO,GAAW,IAAI;AAAA,IAC1B,oBAAoB;AAAA,IACpB,eAAe;AAAA,IACf,eAAe;AAAA,IACf,WAAW;AAAA,IACX,SAAS;AAAA,IACT,MAAM;AAAA,EACd,CAAK;AACD,QAAM,EAAE,MAAAI,EAAI,IAAKJ;AACjB,MAAII,MAEI,CAAC7L,EAAG,IAAIoI,EAAM,CAAC,KAAK,OAAOyD,EAAK,QAAS,YAAY,CAAC,MAAM,QAAQA,EAAK,OAAO;AAChF,UAAM,IAAI,MAAM,4DAA4D;AAGpF,QAAMC,IAAUC,GAAY/L,GAAIuI,CAAE;AAClC,WAASyD,IAA+B;AACpC,QAAI,CAAChM,EAAG;AACJ,YAAM,IAAI,MAAM,4DAA4D;AAAA,EACpF;AAEA,WAASiM,EAAaC,GAAI/E,GAAOgF,GAAc;AAC3C,UAAM,EAAE,GAAA7M,GAAG,GAAA8M,MAAMjF,EAAM,SAAQ,GACzBkF,IAAKrM,EAAG,QAAQV,CAAC;AAEvB,QADAnE,GAAMgR,GAAc,cAAc,GAC9BA,GAAc;AACd,MAAAH,EAA4B;AAC5B,YAAMM,IAAW,CAACtM,EAAG,MAAMoM,CAAC;AAC5B,aAAOhV,GAAYmV,GAAQD,CAAQ,GAAGD,CAAE;AAAA,IAC5C;AAEI,aAAOjV,GAAY,WAAW,GAAG,CAAI,GAAGiV,GAAIrM,EAAG,QAAQoM,CAAC,CAAC;AAAA,EAEjE;AACA,WAASI,EAAe1X,GAAO;AAC3BH,IAAAA,EAAOG,GAAO,QAAW,OAAO;AAChC,UAAM,EAAE,WAAW2S,GAAM,uBAAuBgF,EAAM,IAAKX,GACrDjX,IAASC,EAAM,QACf4X,IAAO5X,EAAM,CAAC,GACd6X,IAAO7X,EAAM,SAAS,CAAC;AAE7B,QAAID,MAAW4S,MAASiF,MAAS,KAAQA,MAAS,IAAO;AACrD,YAAMpN,IAAIU,EAAG,UAAU2M,CAAI;AAC3B,UAAI,CAAC3M,EAAG,QAAQV,CAAC;AACb,cAAM,IAAI,MAAM,qCAAqC;AACzD,YAAMsN,IAAKC,EAAoBvN,CAAC;AAChC,UAAI8M;AACJ,UAAI;AACA,QAAAA,IAAIpM,EAAG,KAAK4M,CAAE;AAAA,MAClB,SACOE,GAAW;AACd,cAAMC,IAAMD,aAAqB,QAAQ,OAAOA,EAAU,UAAU;AACpE,cAAM,IAAI,MAAM,2CAA2CC,CAAG;AAAA,MAClE;AACA,MAAAf,EAA4B;AAC5B,YAAMgB,IAAQhN,EAAG,MAAMoM,CAAC;AAExB,cADeM,IAAO,OAAO,MACfM,MACVZ,IAAIpM,EAAG,IAAIoM,CAAC,IACT,EAAE,GAAA9M,GAAG,GAAA8M,EAAC;AAAA,IACjB,WACSvX,MAAW4X,KAAUC,MAAS,GAAM;AAEzC,YAAMO,IAAIjN,EAAG,OACPV,IAAIU,EAAG,UAAU2M,EAAK,SAAS,GAAGM,CAAC,CAAC,GACpCb,IAAIpM,EAAG,UAAU2M,EAAK,SAASM,GAAGA,IAAI,CAAC,CAAC;AAC9C,UAAI,CAACC,EAAU5N,GAAG8M,CAAC;AACf,cAAM,IAAI,MAAM,4BAA4B;AAChD,aAAO,EAAE,GAAA9M,GAAG,GAAA8M,EAAC;AAAA,IACjB;AAEI,YAAM,IAAI,MAAM,yBAAyBvX,CAAM,yBAAyB4S,CAAI,oBAAoBgF,CAAM,EAAE;AAAA,EAEhH;AACA,QAAMU,IAAc1B,EAAU,WAAWQ,GACnCmB,IAAc3B,EAAU,aAAae;AAC3C,WAASK,EAAoBvN,GAAG;AAC5B,UAAM+N,IAAKrN,EAAG,IAAIV,CAAC,GACbgO,IAAKtN,EAAG,IAAIqN,GAAI/N,CAAC;AACvB,WAAOU,EAAG,IAAIA,EAAG,IAAIsN,GAAItN,EAAG,IAAIV,GAAG8I,EAAM,CAAC,CAAC,GAAGA,EAAM,CAAC;AAAA,EACzD;AAGA,WAAS8E,EAAU5N,GAAG8M,GAAG;AACrB,UAAMmB,IAAOvN,EAAG,IAAIoM,CAAC,GACfoB,IAAQX,EAAoBvN,CAAC;AACnC,WAAOU,EAAG,IAAIuN,GAAMC,CAAK;AAAA,EAC7B;AAGA,MAAI,CAACN,EAAU9E,EAAM,IAAIA,EAAM,EAAE;AAC7B,UAAM,IAAI,MAAM,mCAAmC;AAGvD,QAAMqF,IAAOzN,EAAG,IAAIA,EAAG,IAAIoI,EAAM,GAAGxJ,EAAG,GAAGC,EAAG,GACvC6O,IAAQ1N,EAAG,IAAIA,EAAG,IAAIoI,EAAM,CAAC,GAAG,OAAO,EAAE,CAAC;AAChD,MAAIpI,EAAG,IAAIA,EAAG,IAAIyN,GAAMC,CAAK,CAAC;AAC1B,UAAM,IAAI,MAAM,0BAA0B;AAE9C,WAASC,EAAOlZ,GAAOD,GAAGoZ,IAAU,IAAO;AACvC,QAAI,CAAC5N,EAAG,QAAQxL,CAAC,KAAMoZ,KAAW5N,EAAG,IAAIxL,CAAC;AACtC,YAAM,IAAI,MAAM,wBAAwBC,CAAK,EAAE;AACnD,WAAOD;AAAA,EACX;AACA,WAASqZ,EAAUC,GAAO;AACtB,QAAI,EAAEA,aAAiB7G;AACnB,YAAM,IAAI,MAAM,4BAA4B;AAAA,EACpD;AACA,WAAS8G,EAAiB/Q,GAAG;AACzB,QAAI,CAAC6O,KAAQ,CAACA,EAAK;AACf,YAAM,IAAI,MAAM,SAAS;AAC7B,WAAOxC,GAAiBrM,GAAG6O,EAAK,SAAStD,EAAG,KAAK;AAAA,EACrD;AAKA,QAAMyF,IAAe3P,GAAS,CAACqE,GAAGuL,MAAO;AACrC,UAAM,EAAE,GAAAC,GAAG,GAAAC,GAAG,GAAAzM,EAAC,IAAKgB;AAEpB,QAAI1C,EAAG,IAAI0B,GAAG1B,EAAG,GAAG;AAChB,aAAO,EAAE,GAAGkO,GAAG,GAAGC,EAAC;AACvB,UAAMC,IAAM1L,EAAE,IAAG;AAGjB,IAAIuL,KAAM,SACNA,IAAKG,IAAMpO,EAAG,MAAMA,EAAG,IAAI0B,CAAC;AAChC,UAAMpC,IAAIU,EAAG,IAAIkO,GAAGD,CAAE,GAChB7B,IAAIpM,EAAG,IAAImO,GAAGF,CAAE,GAChBI,IAAKrO,EAAG,IAAI0B,GAAGuM,CAAE;AACvB,QAAIG;AACA,aAAO,EAAE,GAAGpO,EAAG,MAAM,GAAGA,EAAG,KAAI;AACnC,QAAI,CAACA,EAAG,IAAIqO,GAAIrO,EAAG,GAAG;AAClB,YAAM,IAAI,MAAM,kBAAkB;AACtC,WAAO,EAAE,GAAAV,GAAG,GAAA8M,EAAC;AAAA,EACjB,CAAC,GAGKkC,KAAkBjQ,GAAS,CAACqE,MAAM;AACpC,QAAIA,EAAE,OAAO;AAIT,UAAI+I,EAAU,sBAAsB,CAACzL,EAAG,IAAI0C,EAAE,CAAC;AAC3C;AACJ,YAAM,IAAI,MAAM,iBAAiB;AAAA,IACrC;AAEA,UAAM,EAAE,GAAApD,GAAG,GAAA8M,MAAM1J,EAAE,SAAQ;AAC3B,QAAI,CAAC1C,EAAG,QAAQV,CAAC,KAAK,CAACU,EAAG,QAAQoM,CAAC;AAC/B,YAAM,IAAI,MAAM,sCAAsC;AAC1D,QAAI,CAACc,EAAU5N,GAAG8M,CAAC;AACf,YAAM,IAAI,MAAM,mCAAmC;AACvD,QAAI,CAAC1J,EAAE,cAAa;AAChB,YAAM,IAAI,MAAM,wCAAwC;AAC5D,WAAO;AAAA,EACX,CAAC;AACD,WAAS6L,GAAWC,GAAUC,GAAKC,GAAK/E,GAAOC,GAAO;AAClD,WAAA8E,IAAM,IAAIzH,EAAMjH,EAAG,IAAI0O,EAAI,GAAGF,CAAQ,GAAGE,EAAI,GAAGA,EAAI,CAAC,GACrDD,IAAMtJ,GAASwE,GAAO8E,CAAG,GACzBC,IAAMvJ,GAASyE,GAAO8E,CAAG,GAClBD,EAAI,IAAIC,CAAG;AAAA,EACtB;AAMA,QAAMC,IAAN,MAAMA,EAAM;AAAA;AAAA,IAaR,YAAYT,GAAGC,GAAGzM,GAAG;AAJrB,MAAA7I,EAAA;AACA,MAAAA,EAAA;AACA,MAAAA,EAAA;AAGI,WAAK,IAAI8U,EAAO,KAAKO,CAAC,GACtB,KAAK,IAAIP,EAAO,KAAKQ,GAAG,EAAI,GAC5B,KAAK,IAAIR,EAAO,KAAKjM,CAAC,GACtB,OAAO,OAAO,IAAI;AAAA,IACtB;AAAA,IACA,OAAO,QAAQ;AACX,aAAO0G;AAAA,IACX;AAAA;AAAA,IAEA,OAAO,WAAW1F,GAAG;AACjB,YAAM,EAAE,GAAApD,GAAG,GAAA8M,EAAC,IAAK1J,KAAK,CAAA;AACtB,UAAI,CAACA,KAAK,CAAC1C,EAAG,QAAQV,CAAC,KAAK,CAACU,EAAG,QAAQoM,CAAC;AACrC,cAAM,IAAI,MAAM,sBAAsB;AAC1C,UAAI1J,aAAaiM;AACb,cAAM,IAAI,MAAM,8BAA8B;AAElD,aAAI3O,EAAG,IAAIV,CAAC,KAAKU,EAAG,IAAIoM,CAAC,IACduC,EAAM,OACV,IAAIA,EAAMrP,GAAG8M,GAAGpM,EAAG,GAAG;AAAA,IACjC;AAAA,IACA,OAAO,UAAUlL,GAAO;AACpB,YAAM0L,IAAImO,EAAM,WAAWvB,EAAYzY,EAAOG,GAAO,QAAW,OAAO,CAAC,CAAC;AACzE,aAAA0L,EAAE,eAAc,GACTA;AAAA,IACX;AAAA,IACA,OAAO,QAAQjK,GAAK;AAChB,aAAOoY,EAAM,UAAUhY,GAAWJ,CAAG,CAAC;AAAA,IAC1C;AAAA,IACA,IAAI,IAAI;AACJ,aAAO,KAAK,SAAQ,EAAG;AAAA,IAC3B;AAAA,IACA,IAAI,IAAI;AACJ,aAAO,KAAK,SAAQ,EAAG;AAAA,IAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,WAAWwP,IAAa,GAAG6I,IAAS,IAAM;AACtC,aAAAC,GAAK,YAAY,MAAM9I,CAAU,GAC5B6I,KACD,KAAK,SAAShQ,EAAG,GACd;AAAA,IACX;AAAA;AAAA;AAAA,IAGA,iBAAiB;AACb,MAAA0P,GAAgB,IAAI;AAAA,IACxB;AAAA,IACA,WAAW;AACP,YAAM,EAAE,GAAAlC,EAAC,IAAK,KAAK,SAAQ;AAC3B,UAAI,CAACpM,EAAG;AACJ,cAAM,IAAI,MAAM,6BAA6B;AACjD,aAAO,CAACA,EAAG,MAAMoM,CAAC;AAAA,IACtB;AAAA;AAAA,IAEA,OAAO0B,GAAO;AACV,MAAAD,EAAUC,CAAK;AACf,YAAM,EAAE,GAAGgB,GAAI,GAAGC,GAAI,GAAGC,EAAE,IAAK,MAC1B,EAAE,GAAGC,GAAI,GAAGC,GAAI,GAAGC,EAAE,IAAKrB,GAC1BsB,IAAKpP,EAAG,IAAIA,EAAG,IAAI8O,GAAIK,CAAE,GAAGnP,EAAG,IAAIiP,GAAID,CAAE,CAAC,GAC1CK,IAAKrP,EAAG,IAAIA,EAAG,IAAI+O,GAAII,CAAE,GAAGnP,EAAG,IAAIkP,GAAIF,CAAE,CAAC;AAChD,aAAOI,KAAMC;AAAA,IACjB;AAAA;AAAA,IAEA,SAAS;AACL,aAAO,IAAIV,EAAM,KAAK,GAAG3O,EAAG,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC;AAAA,IACnD;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,SAAS;AACL,YAAM,EAAE,GAAA1L,GAAG,GAAA+D,EAAC,IAAK+P,GACXkH,IAAKtP,EAAG,IAAI3H,GAAGuG,EAAG,GAClB,EAAE,GAAGkQ,GAAI,GAAGC,GAAI,GAAGC,EAAE,IAAK;AAChC,UAAIO,IAAKvP,EAAG,MAAMwP,IAAKxP,EAAG,MAAMyP,IAAKzP,EAAG,MACpC0P,IAAK1P,EAAG,IAAI8O,GAAIA,CAAE,GAClBa,IAAK3P,EAAG,IAAI+O,GAAIA,CAAE,GAClBa,IAAK5P,EAAG,IAAIgP,GAAIA,CAAE,GAClBa,IAAK7P,EAAG,IAAI8O,GAAIC,CAAE;AACtB,aAAAc,IAAK7P,EAAG,IAAI6P,GAAIA,CAAE,GAClBJ,IAAKzP,EAAG,IAAI8O,GAAIE,CAAE,GAClBS,IAAKzP,EAAG,IAAIyP,GAAIA,CAAE,GAClBF,IAAKvP,EAAG,IAAI1L,GAAGmb,CAAE,GACjBD,IAAKxP,EAAG,IAAIsP,GAAIM,CAAE,GAClBJ,IAAKxP,EAAG,IAAIuP,GAAIC,CAAE,GAClBD,IAAKvP,EAAG,IAAI2P,GAAIH,CAAE,GAClBA,IAAKxP,EAAG,IAAI2P,GAAIH,CAAE,GAClBA,IAAKxP,EAAG,IAAIuP,GAAIC,CAAE,GAClBD,IAAKvP,EAAG,IAAI6P,GAAIN,CAAE,GAClBE,IAAKzP,EAAG,IAAIsP,GAAIG,CAAE,GAClBG,IAAK5P,EAAG,IAAI1L,GAAGsb,CAAE,GACjBC,IAAK7P,EAAG,IAAI0P,GAAIE,CAAE,GAClBC,IAAK7P,EAAG,IAAI1L,GAAGub,CAAE,GACjBA,IAAK7P,EAAG,IAAI6P,GAAIJ,CAAE,GAClBA,IAAKzP,EAAG,IAAI0P,GAAIA,CAAE,GAClBA,IAAK1P,EAAG,IAAIyP,GAAIC,CAAE,GAClBA,IAAK1P,EAAG,IAAI0P,GAAIE,CAAE,GAClBF,IAAK1P,EAAG,IAAI0P,GAAIG,CAAE,GAClBL,IAAKxP,EAAG,IAAIwP,GAAIE,CAAE,GAClBE,IAAK5P,EAAG,IAAI+O,GAAIC,CAAE,GAClBY,IAAK5P,EAAG,IAAI4P,GAAIA,CAAE,GAClBF,IAAK1P,EAAG,IAAI4P,GAAIC,CAAE,GAClBN,IAAKvP,EAAG,IAAIuP,GAAIG,CAAE,GAClBD,IAAKzP,EAAG,IAAI4P,GAAID,CAAE,GAClBF,IAAKzP,EAAG,IAAIyP,GAAIA,CAAE,GAClBA,IAAKzP,EAAG,IAAIyP,GAAIA,CAAE,GACX,IAAId,EAAMY,GAAIC,GAAIC,CAAE;AAAA,IAC/B;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,IAAI3B,GAAO;AACP,MAAAD,EAAUC,CAAK;AACf,YAAM,EAAE,GAAGgB,GAAI,GAAGC,GAAI,GAAGC,EAAE,IAAK,MAC1B,EAAE,GAAGC,GAAI,GAAGC,GAAI,GAAGC,EAAE,IAAKrB;AAChC,UAAIyB,IAAKvP,EAAG,MAAMwP,IAAKxP,EAAG,MAAMyP,IAAKzP,EAAG;AACxC,YAAM1L,IAAI8T,EAAM,GACVkH,IAAKtP,EAAG,IAAIoI,EAAM,GAAGxJ,EAAG;AAC9B,UAAI8Q,IAAK1P,EAAG,IAAI8O,GAAIG,CAAE,GAClBU,IAAK3P,EAAG,IAAI+O,GAAIG,CAAE,GAClBU,IAAK5P,EAAG,IAAIgP,GAAIG,CAAE,GAClBU,IAAK7P,EAAG,IAAI8O,GAAIC,CAAE,GAClBe,IAAK9P,EAAG,IAAIiP,GAAIC,CAAE;AACtB,MAAAW,IAAK7P,EAAG,IAAI6P,GAAIC,CAAE,GAClBA,IAAK9P,EAAG,IAAI0P,GAAIC,CAAE,GAClBE,IAAK7P,EAAG,IAAI6P,GAAIC,CAAE,GAClBA,IAAK9P,EAAG,IAAI8O,GAAIE,CAAE;AAClB,UAAIe,IAAK/P,EAAG,IAAIiP,GAAIE,CAAE;AACtB,aAAAW,IAAK9P,EAAG,IAAI8P,GAAIC,CAAE,GAClBA,IAAK/P,EAAG,IAAI0P,GAAIE,CAAE,GAClBE,IAAK9P,EAAG,IAAI8P,GAAIC,CAAE,GAClBA,IAAK/P,EAAG,IAAI+O,GAAIC,CAAE,GAClBO,IAAKvP,EAAG,IAAIkP,GAAIC,CAAE,GAClBY,IAAK/P,EAAG,IAAI+P,GAAIR,CAAE,GAClBA,IAAKvP,EAAG,IAAI2P,GAAIC,CAAE,GAClBG,IAAK/P,EAAG,IAAI+P,GAAIR,CAAE,GAClBE,IAAKzP,EAAG,IAAI1L,GAAGwb,CAAE,GACjBP,IAAKvP,EAAG,IAAIsP,GAAIM,CAAE,GAClBH,IAAKzP,EAAG,IAAIuP,GAAIE,CAAE,GAClBF,IAAKvP,EAAG,IAAI2P,GAAIF,CAAE,GAClBA,IAAKzP,EAAG,IAAI2P,GAAIF,CAAE,GAClBD,IAAKxP,EAAG,IAAIuP,GAAIE,CAAE,GAClBE,IAAK3P,EAAG,IAAI0P,GAAIA,CAAE,GAClBC,IAAK3P,EAAG,IAAI2P,GAAID,CAAE,GAClBE,IAAK5P,EAAG,IAAI1L,GAAGsb,CAAE,GACjBE,IAAK9P,EAAG,IAAIsP,GAAIQ,CAAE,GAClBH,IAAK3P,EAAG,IAAI2P,GAAIC,CAAE,GAClBA,IAAK5P,EAAG,IAAI0P,GAAIE,CAAE,GAClBA,IAAK5P,EAAG,IAAI1L,GAAGsb,CAAE,GACjBE,IAAK9P,EAAG,IAAI8P,GAAIF,CAAE,GAClBF,IAAK1P,EAAG,IAAI2P,GAAIG,CAAE,GAClBN,IAAKxP,EAAG,IAAIwP,GAAIE,CAAE,GAClBA,IAAK1P,EAAG,IAAI+P,GAAID,CAAE,GAClBP,IAAKvP,EAAG,IAAI6P,GAAIN,CAAE,GAClBA,IAAKvP,EAAG,IAAIuP,GAAIG,CAAE,GAClBA,IAAK1P,EAAG,IAAI6P,GAAIF,CAAE,GAClBF,IAAKzP,EAAG,IAAI+P,GAAIN,CAAE,GAClBA,IAAKzP,EAAG,IAAIyP,GAAIC,CAAE,GACX,IAAIf,EAAMY,GAAIC,GAAIC,CAAE;AAAA,IAC/B;AAAA,IACA,SAAS3B,GAAO;AACZ,aAAO,KAAK,IAAIA,EAAM,OAAM,CAAE;AAAA,IAClC;AAAA,IACA,MAAM;AACF,aAAO,KAAK,OAAOa,EAAM,IAAI;AAAA,IACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUA,SAASpK,GAAQ;AACb,YAAM,EAAE,MAAAsH,EAAI,IAAKJ;AACjB,UAAI,CAAClD,EAAG,YAAYhE,CAAM;AACtB,cAAM,IAAI,MAAM,8BAA8B;AAClD,UAAI4C,GAAO6I;AACX,YAAMC,IAAM,CAACzb,MAAMqa,GAAK,OAAO,MAAMra,GAAG,CAACkO,MAAM4C,GAAWqJ,GAAOjM,CAAC,CAAC;AAEnE,UAAImJ,GAAM;AACN,cAAM,EAAE,OAAAlC,GAAO,IAAA/B,GAAI,OAAAgC,GAAO,IAAA/B,EAAE,IAAKkG,EAAiBxJ,CAAM,GAClD,EAAE,GAAGkK,GAAK,GAAGyB,EAAG,IAAKD,EAAIrI,CAAE,GAC3B,EAAE,GAAG8G,GAAK,GAAGyB,EAAG,IAAKF,EAAIpI,CAAE;AACjC,QAAAmI,IAAOE,EAAI,IAAIC,CAAG,GAClBhJ,IAAQoH,GAAW1C,EAAK,MAAM4C,GAAKC,GAAK/E,GAAOC,CAAK;AAAA,MACxD,OACK;AACD,cAAM,EAAE,GAAAlH,GAAG,GAAAtE,MAAM6R,EAAI1L,CAAM;AAC3B,QAAA4C,IAAQzE,GACRsN,IAAO5R;AAAA,MACX;AAEA,aAAOkH,GAAWqJ,GAAO,CAACxH,GAAO6I,CAAI,CAAC,EAAE,CAAC;AAAA,IAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,eAAeI,GAAI;AACf,YAAM,EAAE,MAAAvE,EAAI,IAAKJ,GACX/I,IAAI;AACV,UAAI,CAAC6F,EAAG,QAAQ6H,CAAE;AACd,cAAM,IAAI,MAAM,8BAA8B;AAClD,UAAIA,MAAOnV,MAAOyH,EAAE,IAAG;AACnB,eAAOiM,EAAM;AACjB,UAAIyB,MAAOlV;AACP,eAAOwH;AACX,UAAImM,GAAK,SAAS,IAAI;AAClB,eAAO,KAAK,SAASuB,CAAE;AAG3B,UAAIvE,GAAM;AACN,cAAM,EAAE,OAAAlC,GAAO,IAAA/B,GAAI,OAAAgC,GAAO,IAAA/B,EAAE,IAAKkG,EAAiBqC,CAAE,GAC9C,EAAE,IAAAtI,GAAI,IAAAC,MAAOJ,GAAcgH,GAAOjM,GAAGkF,GAAIC,CAAE;AACjD,eAAO0G,GAAW1C,EAAK,MAAM/D,GAAIC,GAAI4B,GAAOC,CAAK;AAAA,MACrD;AAEI,eAAOiF,GAAK,OAAOnM,GAAG0N,CAAE;AAAA,IAEhC;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,SAASC,GAAW;AAChB,aAAOrC,EAAa,MAAMqC,CAAS;AAAA,IACvC;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,gBAAgB;AACZ,YAAM,EAAE,eAAAC,EAAa,IAAK7E;AAC1B,aAAIE,MAAazQ,KACN,KACPoV,IACOA,EAAc3B,GAAO,IAAI,IAC7BE,GAAK,OAAO,MAAMjD,CAAW,EAAE,IAAG;AAAA,IAC7C;AAAA,IACA,gBAAgB;AACZ,YAAM,EAAE,eAAA2E,EAAa,IAAK9E;AAC1B,aAAIE,MAAazQ,KACN,OACPqV,IACOA,EAAc5B,GAAO,IAAI,IAC7B,KAAK,eAAehD,CAAQ;AAAA,IACvC;AAAA,IACA,eAAe;AAEX,aAAO,KAAK,eAAeA,CAAQ,EAAE,IAAG;AAAA,IAC5C;AAAA,IACA,QAAQQ,IAAe,IAAM;AACzB,aAAAhR,GAAMgR,GAAc,cAAc,GAClC,KAAK,eAAc,GACZgB,EAAYwB,GAAO,MAAMxC,CAAY;AAAA,IAChD;AAAA,IACA,MAAMA,IAAe,IAAM;AACvB,aAAO7V,GAAW,KAAK,QAAQ6V,CAAY,CAAC;AAAA,IAChD;AAAA,IACA,WAAW;AACP,aAAO,UAAU,KAAK,IAAG,IAAK,SAAS,KAAK,MAAK,CAAE;AAAA,IACvD;AAAA,EACR;AA3RQ;AAAA,EAAAtT,EAFE8V,GAEK,QAAO,IAAIA,EAAMvG,EAAM,IAAIA,EAAM,IAAIpI,EAAG,GAAG;AAAA,EAElDnH,EAJE8V,GAIK,QAAO,IAAIA,EAAM3O,EAAG,MAAMA,EAAG,KAAKA,EAAG,IAAI;AAAA;AAAA,EAEhDnH,EANE8V,GAMK,MAAK3O;AAAA,EAEZnH,EARE8V,GAQK,MAAKpG;AARhB,MAAMtB,IAAN0H;AA8RA,QAAMhJ,KAAO4C,EAAG,MACVsG,KAAO,IAAI7H,GAAKC,GAAOwE,EAAU,OAAO,KAAK,KAAK9F,KAAO,CAAC,IAAIA,EAAI;AACxE,SAAAsB,EAAM,KAAK,WAAW,CAAC,GAChBA;AACX;AAEA,SAASsF,GAAQD,GAAU;AACvB,SAAO,WAAW,GAAGA,IAAW,IAAO,CAAI;AAC/C;AA6HA,SAASP,GAAY/L,GAAIuI,GAAI;AACzB,SAAO;AAAA,IACH,WAAWA,EAAG;AAAA,IACd,WAAW,IAAIvI,EAAG;AAAA,IAClB,uBAAuB,IAAI,IAAIA,EAAG;AAAA,IAClC,oBAAoB;AAAA,IACpB,WAAW,IAAIuI,EAAG;AAAA,EAC1B;AACA;AAKO,SAASiI,GAAKvJ,GAAOwJ,IAAW,IAAI;AACvC,QAAM,EAAE,IAAAlI,EAAE,IAAKtB,GACTyJ,IAAeD,EAAS,eAAeE,IACvC7E,IAAU,OAAO,OAAOC,GAAY9E,EAAM,IAAIsB,CAAE,GAAG,EAAE,MAAM1D,GAAiB0D,EAAG,KAAK,EAAC,CAAE;AAC7F,WAASqI,EAAiBhI,GAAW;AACjC,QAAI;AACA,YAAMrN,IAAMgN,EAAG,UAAUK,CAAS;AAClC,aAAOL,EAAG,YAAYhN,CAAG;AAAA,IAC7B,QACc;AACV,aAAO;AAAA,IACX;AAAA,EACJ;AACA,WAASsV,EAAiBC,GAAW3E,GAAc;AAC/C,UAAM,EAAE,WAAW1E,GAAM,uBAAAsJ,EAAqB,IAAKjF;AACnD,QAAI;AACA,YAAMkF,IAAIF,EAAU;AAGpB,aAFI3E,MAAiB,MAAQ6E,MAAMvJ,KAE/B0E,MAAiB,MAAS6E,MAAMD,IACzB,KACJ,CAAC,CAAC9J,EAAM,UAAU6J,CAAS;AAAA,IACtC,QACc;AACV,aAAO;AAAA,IACX;AAAA,EACJ;AAKA,WAASpI,EAAgBrL,IAAOqT,EAAa5E,EAAQ,IAAI,GAAG;AACxD,WAAOhH,GAAenQ,EAAO0I,GAAMyO,EAAQ,MAAM,MAAM,GAAGvD,EAAG,KAAK;AAAA,EACtE;AAMA,WAASI,EAAaC,GAAWuD,IAAe,IAAM;AAClD,WAAOlF,EAAM,KAAK,SAASsB,EAAG,UAAUK,CAAS,CAAC,EAAE,QAAQuD,CAAY;AAAA,EAC5E;AAIA,WAAS8E,EAAU7L,GAAM;AACrB,UAAM,EAAE,WAAAwD,GAAW,WAAAkI,GAAW,uBAAAC,EAAqB,IAAKjF;AAGxD,QAFI,CAACzX,GAAQ+Q,CAAI,KAEZ,cAAcmD,KAAMA,EAAG,YAAaK,MAAckI;AACnD;AACJ,UAAME,IAAIrc,EAAOyQ,GAAM,QAAW,KAAK,EAAE;AACzC,WAAO4L,MAAMF,KAAaE,MAAMD;AAAA,EACpC;AASA,WAASG,EAAgBC,GAAYC,GAAYjF,IAAe,IAAM;AAClE,QAAI8E,EAAUE,CAAU,MAAM;AAC1B,YAAM,IAAI,MAAM,+BAA+B;AACnD,QAAIF,EAAUG,CAAU,MAAM;AAC1B,YAAM,IAAI,MAAM,+BAA+B;AACnD,UAAMC,IAAI9I,EAAG,UAAU4I,CAAU;AAEjC,WADUlK,EAAM,UAAUmK,CAAU,EAC3B,SAASC,CAAC,EAAE,QAAQlF,CAAY;AAAA,EAC7C;AACA,QAAMmF,IAAQ;AAAA,IACV,kBAAAV;AAAA,IACA,kBAAAC;AAAA,IACA,iBAAAnI;AAAA,EACR,GACU6I,IAAS9I,GAAaC,GAAiBC,CAAY;AACzD,SAAO,OAAO,OAAO,EAAE,cAAAA,GAAc,iBAAAuI,GAAiB,QAAAK,GAAQ,OAAAtK,GAAO,OAAAqK,GAAO,SAAAxF,GAAS;AACzF;AAgBO,SAAS0F,GAAMvK,GAAO6B,GAAM2I,IAAY,CAAA,GAAI;AAC/C,EAAAtc,GAAM2T,CAAI,GACVrL,GAAegU,GAAW,IAAI;AAAA,IAC1B,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACvB,CAAK,GACDA,IAAY,OAAO,OAAO,CAAA,GAAIA,CAAS;AACvC,QAAM1Z,IAAc0Z,EAAU,eAAed,IACvCzH,IAAOuI,EAAU,SAAS,CAAC1M,GAAKnN,MAAQ8Z,GAAU5I,GAAM/D,GAAKnN,CAAG,IAChE,EAAE,IAAAoI,GAAI,IAAAuI,EAAE,IAAKtB,GACb,EAAE,OAAO2E,GAAa,MAAM+F,EAAM,IAAKpJ,GACvC,EAAE,QAAAgJ,GAAQ,cAAA5I,GAAc,iBAAAuI,GAAiB,OAAAI,GAAO,SAAAxF,MAAY0E,GAAKvJ,GAAOwK,CAAS,GACjFG,IAAiB;AAAA,IACnB,SAAS;AAAA,IACT,MAAM,OAAOH,EAAU,QAAS,YAAYA,EAAU,OAAO;AAAA,IAC7D,QAAQ;AAAA,IACR,cAAc;AAAA,EACtB,GACUI,IAAmBjG,IAAcjN,KAAMqB,EAAG;AAChD,WAAS8R,EAAsBpS,GAAQ;AACnC,UAAMqS,IAAOnG,KAAe1Q;AAC5B,WAAOwE,IAASqS;AAAA,EACpB;AACA,WAASC,EAAWvd,GAAO8G,GAAK;AAC5B,QAAI,CAACgN,EAAG,YAAYhN,CAAG;AACnB,YAAM,IAAI,MAAM,qBAAqB9G,CAAK,kCAAkC;AAChF,WAAO8G;AAAA,EACX;AACA,WAAS0W,IAAsB;AAS3B,QAAIJ;AACA,YAAM,IAAI,MAAM,8DAA8D;AAAA,EACtF;AACA,WAASK,EAAkBpd,GAAOiV,GAAQ;AACtC,IAAAD,GAAkBC,CAAM;AACxB,UAAMoI,IAAOrG,EAAQ,WACfsG,IAAQrI,MAAW,YAAYoI,IAAOpI,MAAW,cAAcoI,IAAO,IAAI;AAChF,WAAOxd,EAAOG,GAAOsd,CAAK;AAAA,EAC9B;AAAA,EAIA,MAAMC,EAAU;AAAA,IAIZ,YAAYxS,GAAGwR,GAAGiB,GAAU;AAH5B,MAAAzZ,EAAA;AACA,MAAAA,EAAA;AACA,MAAAA,EAAA;AAII,UAFA,KAAK,IAAImZ,EAAW,KAAKnS,CAAC,GAC1B,KAAK,IAAImS,EAAW,KAAKX,CAAC,GACtBiB,KAAY,MAAM;AAElB,YADAL,EAAmB,GACf,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,SAASK,CAAQ;AAC/B,gBAAM,IAAI,MAAM,qBAAqB;AACzC,aAAK,WAAWA;AAAA,MACpB;AACA,aAAO,OAAO,IAAI;AAAA,IACtB;AAAA,IACA,OAAO,UAAUxd,GAAOiV,IAAS6H,EAAe,QAAQ;AACpD,MAAAM,EAAkBpd,GAAOiV,CAAM;AAC/B,UAAIwI;AACJ,UAAIxI,MAAW,OAAO;AAClB,cAAM,EAAE,GAAAlK,GAAG,GAAAwR,EAAC,IAAKhH,GAAI,MAAM1V,EAAOG,CAAK,CAAC;AACxC,eAAO,IAAIud,EAAUxS,GAAGwR,CAAC;AAAA,MAC7B;AACA,MAAItH,MAAW,gBACXwI,IAAQzd,EAAM,CAAC,GACfiV,IAAS,WACTjV,IAAQA,EAAM,SAAS,CAAC;AAE5B,YAAMmY,IAAInB,EAAQ,YAAY,GACxBjM,IAAI/K,EAAM,SAAS,GAAGmY,CAAC,GACvBoE,IAAIvc,EAAM,SAASmY,GAAGA,IAAI,CAAC;AACjC,aAAO,IAAIoF,EAAU9J,EAAG,UAAU1I,CAAC,GAAG0I,EAAG,UAAU8I,CAAC,GAAGkB,CAAK;AAAA,IAChE;AAAA,IACA,OAAO,QAAQhc,GAAKwT,GAAQ;AACxB,aAAO,KAAK,UAAUpT,GAAWJ,CAAG,GAAGwT,CAAM;AAAA,IACjD;AAAA,IACA,iBAAiB;AACb,YAAM,EAAE,UAAAuI,EAAQ,IAAK;AACrB,UAAIA,KAAY;AACZ,cAAM,IAAI,MAAM,sCAAsC;AAC1D,aAAOA;AAAA,IACX;AAAA,IACA,eAAeA,GAAU;AACrB,aAAO,IAAID,EAAU,KAAK,GAAG,KAAK,GAAGC,CAAQ;AAAA,IACjD;AAAA,IACA,iBAAiBE,GAAa;AAC1B,YAAM,EAAE,GAAA3S,GAAG,GAAAwR,EAAC,IAAK,MACXiB,IAAW,KAAK,eAAc,GAC9BG,IAAOH,MAAa,KAAKA,MAAa,IAAIzS,IAAI+L,IAAc/L;AAClE,UAAI,CAACG,EAAG,QAAQyS,CAAI;AAChB,cAAM,IAAI,MAAM,2CAA2C;AAC/D,YAAMnT,IAAIU,EAAG,QAAQyS,CAAI,GACnBxQ,IAAIgF,EAAM,UAAU7P,GAAYmV,IAAS+F,IAAW,OAAO,CAAC,GAAGhT,CAAC,CAAC,GACjEoT,IAAKnK,EAAG,IAAIkK,CAAI,GAChBrd,IAAIud,EAAche,EAAO6d,GAAa,QAAW,SAAS,CAAC,GAC3DI,IAAKrK,EAAG,OAAO,CAACnT,IAAIsd,CAAE,GACtBG,IAAKtK,EAAG,OAAO8I,IAAIqB,CAAE,GAErBlR,IAAIyF,EAAM,KAAK,eAAe2L,CAAE,EAAE,IAAI3Q,EAAE,eAAe4Q,CAAE,CAAC;AAChE,UAAIrR,EAAE,IAAG;AACL,cAAM,IAAI,MAAM,qCAAqC;AACzD,aAAAA,EAAE,eAAc,GACTA;AAAA,IACX;AAAA;AAAA,IAEA,WAAW;AACP,aAAOsQ,EAAsB,KAAK,CAAC;AAAA,IACvC;AAAA,IACA,QAAQ/H,IAAS6H,EAAe,QAAQ;AAEpC,UADA9H,GAAkBC,CAAM,GACpBA,MAAW;AACX,eAAOpT,GAAW0T,GAAI,WAAW,IAAI,CAAC;AAC1C,YAAM,EAAE,GAAAxK,GAAG,GAAAwR,EAAC,IAAK,MACXyB,IAAKvK,EAAG,QAAQ1I,CAAC,GACjBkT,IAAKxK,EAAG,QAAQ8I,CAAC;AACvB,aAAItH,MAAW,eACXkI,EAAmB,GACZ7a,GAAY,WAAW,GAAG,KAAK,gBAAgB,GAAG0b,GAAIC,CAAE,KAE5D3b,GAAY0b,GAAIC,CAAE;AAAA,IAC7B;AAAA,IACA,MAAMhJ,GAAQ;AACV,aAAOzT,GAAW,KAAK,QAAQyT,CAAM,CAAC;AAAA,IAC1C;AAAA,EACR;AAKI,QAAMiJ,IAAWvB,EAAU,YACvB,SAAsB3c,GAAO;AAEzB,QAAIA,EAAM,SAAS;AACf,YAAM,IAAI,MAAM,oBAAoB;AAGxC,UAAMyG,IAAME,GAAgB3G,CAAK,GAC3Bme,IAAQne,EAAM,SAAS,IAAI6c;AACjC,WAAOsB,IAAQ,IAAI1X,KAAO,OAAO0X,CAAK,IAAI1X;AAAA,EAC9C,GACEoX,IAAgBlB,EAAU,iBAC5B,SAA2B3c,GAAO;AAC9B,WAAOyT,EAAG,OAAOyK,EAASle,CAAK,CAAC;AAAA,EACpC,GAEEoe,KAAa7W,GAAQsV,CAAM;AAEjC,WAASwB,GAAW5X,GAAK;AAErB,WAAAY,GAAS,aAAawV,GAAQpW,GAAKN,IAAKiY,EAAU,GAC3C3K,EAAG,QAAQhN,CAAG;AAAA,EACzB;AACA,WAAS6X,EAAmBhf,GAASif,GAAS;AAC1C1e,WAAAA,EAAOP,GAAS,QAAW,SAAS,GAC7Bif,IAAU1e,EAAOmU,EAAK1U,CAAO,GAAG,QAAW,mBAAmB,IAAIA;AAAA,EAC7E;AASA,WAASkf,GAAQlf,GAASwU,GAAW/Q,GAAM;AACvC,UAAM,EAAE,MAAA0b,GAAM,SAAAF,GAAS,cAAAG,EAAY,IAAKxJ,GAAgBnS,GAAM+Z,CAAc;AAC5E,IAAAxd,IAAUgf,EAAmBhf,GAASif,CAAO;AAI7C,UAAMI,IAAQd,EAAcve,CAAO,GAC7BuO,IAAI4F,EAAG,UAAUK,CAAS;AAChC,QAAI,CAACL,EAAG,YAAY5F,CAAC;AACjB,YAAM,IAAI,MAAM,qBAAqB;AACzC,UAAM+Q,IAAW,CAACP,GAAWxQ,CAAC,GAAGwQ,GAAWM,CAAK,CAAC;AAElD,QAAID,KAAgB,QAAQA,MAAiB,IAAO;AAGhD,YAAMG,IAAIH,MAAiB,KAAOzb,EAAY+T,EAAQ,SAAS,IAAI0H;AACnE,MAAAE,EAAS,KAAK/e,EAAOgf,GAAG,QAAW,cAAc,CAAC;AAAA,IACtD;AACA,UAAMtW,IAAOjG,GAAY,GAAGsc,CAAQ,GAC9B5T,IAAI2T;AASV,aAASG,EAAMC,GAAQ;AAGnB,YAAM7W,IAAIgW,EAASa,CAAM;AACzB,UAAI,CAACtL,EAAG,YAAYvL,CAAC;AACjB;AACJ,YAAM8W,IAAKvL,EAAG,IAAIvL,CAAC,GACb4C,IAAIqH,EAAM,KAAK,SAASjK,CAAC,EAAE,YAC3B6C,IAAI0I,EAAG,OAAO3I,EAAE,CAAC;AACvB,UAAIC,MAAM5E;AACN;AACJ,YAAMoW,IAAI9I,EAAG,OAAOuL,IAAKvL,EAAG,OAAOzI,IAAID,IAAI8C,CAAC,CAAC;AAC7C,UAAI0O,MAAMpW;AACN;AACJ,UAAIqX,MAAY1S,EAAE,MAAMC,IAAI,IAAI,KAAK,OAAOD,EAAE,IAAI1E,EAAG,GACjD6Y,KAAQ1C;AACZ,aAAIkC,KAAQzB,EAAsBT,CAAC,MAC/B0C,KAAQxL,EAAG,IAAI8I,CAAC,GAChBiB,MAAY,IAET,IAAID,EAAUxS,GAAGkU,IAAOlC,IAAmB,SAAYS,EAAQ;AAAA,IAC1E;AACA,WAAO,EAAE,MAAAjV,GAAM,OAAAuW,EAAK;AAAA,EACxB;AAYA,WAASI,GAAK5f,GAASwU,GAAW/Q,IAAO,CAAA,GAAI;AACzC,UAAM,EAAE,MAAAwF,GAAM,OAAAuW,EAAK,IAAKN,GAAQlf,GAASwU,GAAW/Q,CAAI;AAGxD,WAFayE,GAAewM,EAAK,WAAWP,EAAG,OAAOW,CAAI,EACzC7L,GAAMuW,CAAK,EACjB,QAAQ/b,EAAK,MAAM;AAAA,EAClC;AAcA,WAASoc,EAAOC,GAAW9f,GAAS0c,GAAWjZ,IAAO,CAAA,GAAI;AACtD,UAAM,EAAE,MAAA0b,GAAM,SAAAF,GAAS,QAAAtJ,EAAM,IAAKC,GAAgBnS,GAAM+Z,CAAc;AAGtE,QAFAd,IAAYnc,EAAOmc,GAAW,QAAW,WAAW,GACpD1c,IAAUgf,EAAmBhf,GAASif,CAAO,GACzC,CAAChf,GAAQ6f,CAAS,GAAG;AACrB,YAAMC,IAAMD,aAAqB7B,IAAY,wBAAwB;AACrE,YAAM,IAAI,MAAM,wCAAwC8B,CAAG;AAAA,IAC/D;AACA,IAAAjC,EAAkBgC,GAAWnK,CAAM;AACnC,QAAI;AACA,YAAMqB,IAAMiH,EAAU,UAAU6B,GAAWnK,CAAM,GAC3CvJ,IAAIyG,EAAM,UAAU6J,CAAS;AACnC,UAAIyC,KAAQnI,EAAI,SAAQ;AACpB,eAAO;AACX,YAAM,EAAE,GAAAvL,GAAG,GAAAwR,EAAC,IAAKjG,GACXhW,IAAIud,EAAcve,CAAO,GACzBggB,IAAK7L,EAAG,IAAI8I,CAAC,GACbuB,IAAKrK,EAAG,OAAOnT,IAAIgf,CAAE,GACrBvB,IAAKtK,EAAG,OAAO1I,IAAIuU,CAAE,GACrBnS,IAAIgF,EAAM,KAAK,eAAe2L,CAAE,EAAE,IAAIpS,EAAE,eAAeqS,CAAE,CAAC;AAChE,aAAI5Q,EAAE,IAAG,IACE,KACDsG,EAAG,OAAOtG,EAAE,CAAC,MACVpC;AAAA,IACjB,QACU;AACN,aAAO;AAAA,IACX;AAAA,EACJ;AACA,WAASwU,EAAiBH,GAAW9f,GAASyD,IAAO,CAAA,GAAI;AACrD,UAAM,EAAE,SAAAwb,EAAO,IAAKrJ,GAAgBnS,GAAM+Z,CAAc;AACxD,WAAAxd,IAAUgf,EAAmBhf,GAASif,CAAO,GACtChB,EAAU,UAAU6B,GAAW,WAAW,EAAE,iBAAiB9f,CAAO,EAAE,QAAO;AAAA,EACxF;AACA,SAAO,OAAO,OAAO;AAAA,IACjB,QAAAmd;AAAA,IACA,cAAA5I;AAAA,IACA,iBAAAuI;AAAA,IACA,OAAAI;AAAA,IACA,SAAAxF;AAAA,IACA,OAAA7E;AAAA,IACA,MAAA+M;AAAA,IACA,QAAAC;AAAA,IACA,kBAAAI;AAAA,IACA,WAAAhC;AAAA,IACA,MAAAvJ;AAAA,EACR,CAAK;AACL;AC7rCA;AAWA,MAAMwL,KAAkB;AAAA,EACpB,GAAG,OAAO,oEAAoE;AAAA,EAC9E,GAAG,OAAO,oEAAoE;AAAA,EAC9E,GAAG,OAAO,CAAC;AAAA,EACX,GAAG,OAAO,CAAC;AAAA,EACX,GAAG,OAAO,CAAC;AAAA,EACX,IAAI,OAAO,oEAAoE;AAAA,EAC/E,IAAI,OAAO,oEAAoE;AACnF,GACMC,KAAiB;AAAA,EACnB,MAAM,OAAO,oEAAoE;AAAA,EACjF,SAAS;AAAA,IACL,CAAC,OAAO,oCAAoC,GAAG,CAAC,OAAO,oCAAoC,CAAC;AAAA,IAC5F,CAAC,OAAO,qCAAqC,GAAG,OAAO,oCAAoC,CAAC;AAAA,EACpG;AACA,GAEM5V,KAAsB,uBAAO,CAAC;AAKpC,SAAS6V,GAAQpI,GAAG;AAChB,QAAM5L,IAAI8T,GAAgB,GAEpB1V,IAAM,OAAO,CAAC,GAAG6V,IAAM,OAAO,CAAC,GAAGC,IAAO,OAAO,EAAE,GAAGC,IAAO,OAAO,EAAE,GAErEC,IAAO,OAAO,EAAE,GAAGC,IAAO,OAAO,EAAE,GAAGC,IAAO,OAAO,EAAE,GACtDpL,IAAM0C,IAAIA,IAAIA,IAAK5L,GACnB8O,IAAM5F,IAAKA,IAAK0C,IAAK5L,GACrBuU,IAAM1V,EAAKiQ,GAAI1Q,GAAK4B,CAAC,IAAI8O,IAAM9O,GAC/BwU,IAAM3V,EAAK0V,GAAInW,GAAK4B,CAAC,IAAI8O,IAAM9O,GAC/ByU,IAAO5V,EAAK2V,GAAIrW,IAAK6B,CAAC,IAAIkJ,IAAMlJ,GAChC0U,IAAO7V,EAAK4V,GAAKP,GAAMlU,CAAC,IAAIyU,IAAOzU,GACnC2U,IAAO9V,EAAK6V,GAAKP,GAAMnU,CAAC,IAAI0U,IAAO1U,GACnC4U,IAAO/V,EAAK8V,GAAKN,GAAMrU,CAAC,IAAI2U,IAAO3U,GACnC6U,IAAQhW,EAAK+V,GAAKN,GAAMtU,CAAC,IAAI4U,IAAO5U,GACpC8U,IAAQjW,EAAKgW,GAAMR,GAAMrU,CAAC,IAAI2U,IAAO3U,GACrC+U,IAAQlW,EAAKiW,GAAM1W,GAAK4B,CAAC,IAAI8O,IAAM9O,GACnCmP,IAAMtQ,EAAKkW,GAAMX,GAAMpU,CAAC,IAAI0U,IAAO1U,GACnCoP,IAAMvQ,EAAKsQ,GAAI8E,GAAKjU,CAAC,IAAIkJ,IAAMlJ,GAC/BP,IAAOZ,EAAKuQ,GAAIjR,IAAK6B,CAAC;AAC5B,MAAI,CAACgV,GAAK,IAAIA,GAAK,IAAIvV,CAAI,GAAGmM,CAAC;AAC3B,UAAM,IAAI,MAAM,yBAAyB;AAC7C,SAAOnM;AACX;AACA,MAAMuV,KAAO9U,GAAM4T,GAAgB,GAAG,EAAE,MAAME,IAAS,GACjDiB,KAA0B,gBAAAjK,GAAY8I,IAAiB;AAAA,EACzD,IAAIkB;AAAA,EACJ,MAAMjB;AACV,CAAC,GAkBYmB,KAA4B,gBAAAlE,GAAMiE,IAASza,EAAM;AClF9D;AASO,SAAS3G,GAAQC,GAAG;AACvB,SAAOA,aAAa,cAAe,YAAY,OAAOA,CAAC,KAAKA,EAAE,YAAY,SAAS;AACvF;AAOO,SAASK,GAAO0D,MAAMyT,GAAS;AAClC,MAAI,CAACzX,GAAQgE,CAAC;AACV,UAAM,IAAI,MAAM,qBAAqB;AACzC,MAAIyT,EAAQ,SAAS,KAAK,CAACA,EAAQ,SAASzT,EAAE,MAAM;AAChD,UAAM,IAAI,MAAM,mCAAmCyT,IAAU,kBAAkBzT,EAAE,MAAM;AAC/F;AASO,SAAShD,GAAQC,GAAUC,IAAgB,IAAM;AACpD,MAAID,EAAS;AACT,UAAM,IAAI,MAAM,kCAAkC;AACtD,MAAIC,KAAiBD,EAAS;AAC1B,UAAM,IAAI,MAAM,uCAAuC;AAC/D;AAEO,SAASE,GAAQC,GAAKH,GAAU;AACnC,EAAAX,GAAOc,CAAG;AACV,QAAMC,IAAMJ,EAAS;AACrB,MAAIG,EAAI,SAASC;AACb,UAAM,IAAI,MAAM,2DAA2DA,CAAG;AAEtF;AAUO,SAASC,MAASC,GAAQ;AAC7B,WAASC,IAAI,GAAGA,IAAID,EAAO,QAAQC;AAC/B,IAAAD,EAAOC,CAAC,EAAE,KAAK,CAAC;AAExB;AAEO,SAASC,GAAWC,GAAK;AAC5B,SAAO,IAAI,SAASA,EAAI,QAAQA,EAAI,YAAYA,EAAI,UAAU;AAClE;AAEO,SAASC,EAAKC,GAAMC,GAAO;AAC9B,SAAQD,KAAS,KAAKC,IAAWD,MAASC;AAC9C;AAEO,SAASyf,GAAK1f,GAAMC,GAAO;AAC9B,SAAQD,KAAQC,IAAWD,MAAU,KAAKC,MAAY;AAC1D;AA4GO,SAAS0f,GAAYC,GAAK;AAC7B,MAAI,OAAOA,KAAQ;AACf,UAAM,IAAI,MAAM,iBAAiB;AACrC,SAAO,IAAI,WAAW,IAAI,YAAW,EAAG,OAAOA,CAAG,CAAC;AACvD;AAaO,SAASC,GAAQhd,GAAM;AAC1B,SAAI,OAAOA,KAAS,aAChBA,IAAO8c,GAAY9c,CAAI,IAC3BnE,GAAOmE,CAAI,GACJA;AACX;AAkCO,MAAMid,GAAK;AAClB;AAEO,SAASve,GAAaC,GAAU;AACnC,QAAME,IAAQ,CAACC,MAAQH,EAAQ,EAAG,OAAOqe,GAAQle,CAAG,CAAC,EAAE,OAAM,GACvDE,IAAML,EAAQ;AACpB,SAAAE,EAAM,YAAYG,EAAI,WACtBH,EAAM,WAAWG,EAAI,UACrBH,EAAM,SAAS,MAAMF,EAAQ,GACtBE;AACX;ACnPO,SAASqe,GAAajd,GAAMkd,GAAYrhB,GAAOgE,GAAM;AACxD,MAAI,OAAOG,EAAK,gBAAiB;AAC7B,WAAOA,EAAK,aAAakd,GAAYrhB,GAAOgE,CAAI;AACpD,QAAMsd,IAAO,OAAO,EAAE,GAChBC,IAAW,OAAO,UAAU,GAC5BC,IAAK,OAAQxhB,KAASshB,IAAQC,CAAQ,GACtCE,IAAK,OAAOzhB,IAAQuhB,CAAQ,GAC5B/gB,IAAIwD,IAAO,IAAI,GACfoY,IAAIpY,IAAO,IAAI;AACrB,EAAAG,EAAK,UAAUkd,IAAa7gB,GAAGghB,GAAIxd,CAAI,GACvCG,EAAK,UAAUkd,IAAajF,GAAGqF,GAAIzd,CAAI;AAC3C;AAEO,SAASR,GAAI9D,GAAG+D,GAAGC,GAAG;AACzB,SAAQhE,IAAI+D,IAAM,CAAC/D,IAAIgE;AAC3B;AAEO,SAASC,GAAIjE,GAAG+D,GAAGC,GAAG;AACzB,SAAQhE,IAAI+D,IAAM/D,IAAIgE,IAAMD,IAAIC;AACpC;AAKO,MAAMwB,WAAeic,GAAK;AAAA,EAC7B,YAAYtd,GAAUC,GAAWC,GAAWC,GAAM;AAC9C,UAAK,GACL,KAAK,WAAW,IAChB,KAAK,SAAS,GACd,KAAK,MAAM,GACX,KAAK,YAAY,IACjB,KAAK,WAAWH,GAChB,KAAK,YAAYC,GACjB,KAAK,YAAYC,GACjB,KAAK,OAAOC,GACZ,KAAK,SAAS,IAAI,WAAWH,CAAQ,GACrC,KAAK,OAAO3C,GAAW,KAAK,MAAM;AAAA,EACtC;AAAA,EACA,OAAOgD,GAAM;AACT,IAAAzD,GAAQ,IAAI,GACZyD,IAAOgd,GAAQhd,CAAI,GACnBnE,GAAOmE,CAAI;AACX,UAAM,EAAE,MAAAC,GAAM,QAAAC,GAAQ,UAAAP,EAAQ,IAAK,MAC7B1D,IAAM+D,EAAK;AACjB,aAASG,IAAM,GAAGA,IAAMlE,KAAM;AAC1B,YAAMmE,IAAO,KAAK,IAAIT,IAAW,KAAK,KAAK1D,IAAMkE,CAAG;AAEpD,UAAIC,MAAST,GAAU;AACnB,cAAMU,IAAWrD,GAAWgD,CAAI;AAChC,eAAOL,KAAY1D,IAAMkE,GAAKA,KAAOR;AACjC,eAAK,QAAQU,GAAUF,CAAG;AAC9B;AAAA,MACJ;AACA,MAAAD,EAAO,IAAIF,EAAK,SAASG,GAAKA,IAAMC,CAAI,GAAG,KAAK,GAAG,GACnD,KAAK,OAAOA,GACZD,KAAOC,GACH,KAAK,QAAQT,MACb,KAAK,QAAQM,GAAM,CAAC,GACpB,KAAK,MAAM;AAAA,IAEnB;AACA,gBAAK,UAAUD,EAAK,QACpB,KAAK,WAAU,GACR;AAAA,EACX;AAAA,EACA,WAAWrD,GAAK;AACZ,IAAAJ,GAAQ,IAAI,GACZG,GAAQC,GAAK,IAAI,GACjB,KAAK,WAAW;AAIhB,UAAM,EAAE,QAAAuD,GAAQ,MAAAD,GAAM,UAAAN,GAAU,MAAAG,EAAI,IAAK;AACzC,QAAI,EAAE,KAAAK,EAAG,IAAK;AAEd,IAAAD,EAAOC,GAAK,IAAI,KAChBtD,GAAM,KAAK,OAAO,SAASsD,CAAG,CAAC,GAG3B,KAAK,YAAYR,IAAWQ,MAC5B,KAAK,QAAQF,GAAM,CAAC,GACpBE,IAAM;AAGV,aAASpD,IAAIoD,GAAKpD,IAAI4C,GAAU5C;AAC5B,MAAAmD,EAAOnD,CAAC,IAAI;AAIhB,IAAAmgB,GAAajd,GAAMN,IAAW,GAAG,OAAO,KAAK,SAAS,CAAC,GAAGG,CAAI,GAC9D,KAAK,QAAQG,GAAM,CAAC;AACpB,UAAMK,IAAQtD,GAAWL,CAAG,GACtBV,IAAM,KAAK;AAEjB,QAAIA,IAAM;AACN,YAAM,IAAI,MAAM,6CAA6C;AACjE,UAAMsE,IAAStE,IAAM,GACfuE,IAAQ,KAAK,IAAG;AACtB,QAAID,IAASC,EAAM;AACf,YAAM,IAAI,MAAM,oCAAoC;AACxD,aAASzD,IAAI,GAAGA,IAAIwD,GAAQxD;AACxB,MAAAuD,EAAM,UAAU,IAAIvD,GAAGyD,EAAMzD,CAAC,GAAG+C,CAAI;AAAA,EAC7C;AAAA,EACA,SAAS;AACL,UAAM,EAAE,QAAAI,GAAQ,WAAAN,EAAS,IAAK;AAC9B,SAAK,WAAWM,CAAM;AACtB,UAAM1B,IAAM0B,EAAO,MAAM,GAAGN,CAAS;AACrC,gBAAK,QAAO,GACLpB;AAAA,EACX;AAAA,EACA,WAAWiC,GAAI;AACX,IAAAA,MAAOA,IAAK,IAAI,KAAK,YAAW,IAChCA,EAAG,IAAI,GAAG,KAAK,IAAG,CAAE;AACpB,UAAM,EAAE,UAAAd,GAAU,QAAAO,GAAQ,QAAAnE,GAAQ,UAAA2E,GAAU,WAAAC,GAAW,KAAAR,EAAG,IAAK;AAC/D,WAAAM,EAAG,YAAYE,GACfF,EAAG,WAAWC,GACdD,EAAG,SAAS1E,GACZ0E,EAAG,MAAMN,GACLpE,IAAS4D,KACTc,EAAG,OAAO,IAAIP,CAAM,GACjBO;AAAA,EACX;AAAA,EACA,QAAQ;AACJ,WAAO,KAAK,WAAU;AAAA,EAC1B;AACJ;AAMO,MAAMG,KAA4B,4BAAY,KAAK;AAAA,EACtD;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AACxF,CAAC,GCmCK4c,KAAyB,2BAAW,KAAK;AAAA,EAC3C;AAAA,EAAG;AAAA,EAAG;AAAA,EAAI;AAAA,EAAG;AAAA,EAAI;AAAA,EAAG;AAAA,EAAI;AAAA,EAAG;AAAA,EAAI;AAAA,EAAG;AAAA,EAAG;AAAA,EAAG;AAAA,EAAG;AAAA,EAAI;AAAA,EAAI;AACvD,CAAC,GACKC,KAA+B,WAAW,KAAK,IAAI,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,CAAClgB,GAAGR,MAAMA,CAAC,CAAC,GACrF2gB,KAA+BD,GAAM,IAAI,CAAC1gB,OAAO,IAAIA,IAAI,KAAK,EAAE,GAChE4gB,KAAyB,uBAAM;AAGjC,QAAMnf,IAAM,CAFF,CAACif,EAAK,GACN,CAACC,EAAK,CACC;AACjB,WAAS3gB,IAAI,GAAGA,IAAI,GAAGA;AACnB,aAAS6gB,KAAKpf;AACV,MAAAof,EAAE,KAAKA,EAAE7gB,CAAC,EAAE,IAAI,CAACmH,MAAMsZ,GAAOtZ,CAAC,CAAC,CAAC;AACzC,SAAO1F;AACX,GAAC,GACKqf,KAA8BF,GAAM,CAAC,GACrCG,KAA8BH,GAAM,CAAC,GAErCI,KAA4B;AAAA,EAC9B,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC;AAAA,EACvD,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC;AAAA,EACvD,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC;AAAA,EACvD,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC;AAAA,EACvD,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC;AAC3D,EAAE,IAAI,CAAChhB,MAAM,WAAW,KAAKA,CAAC,CAAC,GACzBihB,KAA6B,gBAAAH,GAAK,IAAI,CAACI,GAAKlhB,MAAMkhB,EAAI,IAAI,CAACL,MAAMG,GAAUhhB,CAAC,EAAE6gB,CAAC,CAAC,CAAC,GACjFM,KAA6B,gBAAAJ,GAAK,IAAI,CAACG,GAAKlhB,MAAMkhB,EAAI,IAAI,CAACL,MAAMG,GAAUhhB,CAAC,EAAE6gB,CAAC,CAAC,CAAC,GACjFO,KAAwB,4BAAY,KAAK;AAAA,EAC3C;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AACpD,CAAC,GACKC,KAAwB,4BAAY,KAAK;AAAA,EAC3C;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AACpD,CAAC;AAED,SAASC,GAASC,GAAO9X,GAAG8M,GAAGiL,GAAG;AAC9B,SAAID,MAAU,IACH9X,IAAI8M,IAAIiL,IACfD,MAAU,IACF9X,IAAI8M,IAAM,CAAC9M,IAAI+X,IACvBD,MAAU,KACF9X,IAAI,CAAC8M,KAAKiL,IAClBD,MAAU,IACF9X,IAAI+X,IAAMjL,IAAI,CAACiL,IACpB/X,KAAK8M,IAAI,CAACiL;AACrB;AAEA,MAAMC,KAA0B,oBAAI,YAAY,EAAE;AAC3C,MAAMC,WAAkBzd,GAAO;AAAA,EAClC,cAAc;AACV,UAAM,IAAI,IAAI,GAAG,EAAI,GACrB,KAAK,KAAK,YACV,KAAK,KAAK,YACV,KAAK,KAAK,aACV,KAAK,KAAK,WACV,KAAK,KAAK;AAAA,EACd;AAAA,EACA,MAAM;AACF,UAAM,EAAE,IAAA0d,GAAI,IAAAC,GAAI,IAAAC,GAAI,IAAAC,GAAI,IAAAC,EAAE,IAAK;AAC/B,WAAO,CAACJ,GAAIC,GAAIC,GAAIC,GAAIC,CAAE;AAAA,EAC9B;AAAA,EACA,IAAIJ,GAAIC,GAAIC,GAAIC,GAAIC,GAAI;AACpB,SAAK,KAAKJ,IAAK,GACf,KAAK,KAAKC,IAAK,GACf,KAAK,KAAKC,IAAK,GACf,KAAK,KAAKC,IAAK,GACf,KAAK,KAAKC,IAAK;AAAA,EACnB;AAAA,EACA,QAAQ7e,GAAMwB,GAAQ;AAClB,aAAS1E,IAAI,GAAGA,IAAI,IAAIA,KAAK0E,KAAU;AACnC,MAAA+c,GAAQzhB,CAAC,IAAIkD,EAAK,UAAUwB,GAAQ,EAAI;AAE5C,QAAI1D,IAAK,KAAK,KAAK,GAAGghB,IAAKhhB,GAAIihB,IAAK,KAAK,KAAK,GAAGC,IAAKD,GAAIE,IAAK,KAAK,KAAK,GAAG/f,IAAK+f,GAAIC,IAAK,KAAK,KAAK,GAAGC,IAAKD,GAAIE,IAAK,KAAK,KAAK,GAAGC,IAAKD;AAGvI,aAASf,IAAQ,GAAGA,IAAQ,GAAGA,KAAS;AACpC,YAAMiB,IAAS,IAAIjB,GACbkB,IAAMrB,GAAMG,CAAK,GAAGmB,IAAMrB,GAAME,CAAK,GACrCoB,IAAK7B,GAAKS,CAAK,GAAGqB,IAAK7B,GAAKQ,CAAK,GACjC7Z,IAAKuZ,GAAWM,CAAK,GAAGsB,IAAK1B,GAAWI,CAAK;AACnD,eAASvhB,IAAI,GAAGA,IAAI,IAAIA,KAAK;AACzB,cAAM8iB,IAAMhD,GAAK9e,IAAKsgB,GAASC,GAAOU,GAAIE,GAAIC,CAAE,IAAIX,GAAQkB,EAAG3iB,CAAC,CAAC,IAAIyiB,GAAK/a,EAAG1H,CAAC,CAAC,IAAIsiB,IAAM;AACzF,QAAAthB,IAAKshB,GAAIA,IAAKF,GAAIA,IAAKtC,GAAKqC,GAAI,EAAE,IAAI,GAAGA,IAAKF,GAAIA,IAAKa;AAAA,MAC3D;AAEA,eAAS9iB,IAAI,GAAGA,IAAI,IAAIA,KAAK;AACzB,cAAM+iB,IAAMjD,GAAKkC,IAAKV,GAASkB,GAAQN,GAAI9f,GAAIigB,CAAE,IAAIZ,GAAQmB,EAAG5iB,CAAC,CAAC,IAAI0iB,GAAKG,EAAG7iB,CAAC,CAAC,IAAIuiB,IAAM;AAC1F,QAAAP,IAAKO,GAAIA,IAAKF,GAAIA,IAAKvC,GAAK1d,GAAI,EAAE,IAAI,GAAGA,IAAK8f,GAAIA,IAAKa;AAAA,MAC3D;AAAA,IACJ;AAEA,SAAK,IAAK,KAAK,KAAKZ,IAAKE,IAAM,GAAI,KAAK,KAAKD,IAAKG,IAAM,GAAI,KAAK,KAAKD,IAAKN,IAAM,GAAI,KAAK,KAAKhhB,IAAKkhB,IAAM,GAAI,KAAK,KAAKD,IAAK7f,IAAM,CAAC;AAAA,EACxI;AAAA,EACA,aAAa;AACT,IAAAtC,GAAM2hB,EAAO;AAAA,EACjB;AAAA,EACA,UAAU;AACN,SAAK,YAAY,IACjB3hB,GAAM,KAAK,MAAM,GACjB,KAAK,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC;AAAA,EAC1B;AACJ;AAMO,MAAMkjB,KAA4B,gBAAArhB,GAAa,MAAM,IAAI+f,IAAW,GC5Q9DsB,KAAYC,ICInBnf,KAA2B,4BAAY,KAAK;AAAA,EAC9C;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AACxF,CAAC,GAEKC,KAA2B,oBAAI,YAAY,EAAE;AAC5C,MAAMmf,WAAejf,GAAO;AAAA,EAC/B,YAAYpB,IAAY,IAAI;AACxB,UAAM,IAAIA,GAAW,GAAG,EAAK,GAG7B,KAAK,IAAIgB,GAAU,CAAC,IAAI,GACxB,KAAK,IAAIA,GAAU,CAAC,IAAI,GACxB,KAAK,IAAIA,GAAU,CAAC,IAAI,GACxB,KAAK,IAAIA,GAAU,CAAC,IAAI,GACxB,KAAK,IAAIA,GAAU,CAAC,IAAI,GACxB,KAAK,IAAIA,GAAU,CAAC,IAAI,GACxB,KAAK,IAAIA,GAAU,CAAC,IAAI,GACxB,KAAK,IAAIA,GAAU,CAAC,IAAI;AAAA,EAC5B;AAAA,EACA,MAAM;AACF,UAAM,EAAE,GAAAK,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,EAAC,IAAK;AACnC,WAAO,CAACP,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,CAAC;AAAA,EAClC;AAAA;AAAA,EAEA,IAAIP,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,GAAG;AACxB,SAAK,IAAIP,IAAI,GACb,KAAK,IAAIC,IAAI,GACb,KAAK,IAAIC,IAAI,GACb,KAAK,IAAIC,IAAI,GACb,KAAK,IAAIC,IAAI,GACb,KAAK,IAAIC,IAAI,GACb,KAAK,IAAIC,IAAI,GACb,KAAK,IAAIC,IAAI;AAAA,EACjB;AAAA,EACA,QAAQvB,GAAMwB,GAAQ;AAElB,aAAS1E,IAAI,GAAGA,IAAI,IAAIA,KAAK0E,KAAU;AACnC,MAAAX,GAAS/D,CAAC,IAAIkD,EAAK,UAAUwB,GAAQ,EAAK;AAC9C,aAAS1E,IAAI,IAAIA,IAAI,IAAIA,KAAK;AAC1B,YAAM2E,IAAMZ,GAAS/D,IAAI,EAAE,GACrB4E,IAAKb,GAAS/D,IAAI,CAAC,GACnB6E,IAAK1E,EAAKwE,GAAK,CAAC,IAAIxE,EAAKwE,GAAK,EAAE,IAAKA,MAAQ,GAC7CG,IAAK3E,EAAKyE,GAAI,EAAE,IAAIzE,EAAKyE,GAAI,EAAE,IAAKA,MAAO;AACjD,MAAAb,GAAS/D,CAAC,IAAK8E,IAAKf,GAAS/D,IAAI,CAAC,IAAI6E,IAAKd,GAAS/D,IAAI,EAAE,IAAK;AAAA,IACnE;AAEA,QAAI,EAAE,GAAAkE,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,GAAG,GAAAC,EAAC,IAAK;AACjC,aAASzE,IAAI,GAAGA,IAAI,IAAIA,KAAK;AACzB,YAAM+E,IAAS5E,EAAKmE,GAAG,CAAC,IAAInE,EAAKmE,GAAG,EAAE,IAAInE,EAAKmE,GAAG,EAAE,GAC9CU,IAAMP,IAAIM,IAASxC,GAAI+B,GAAGC,GAAGC,CAAC,IAAIV,GAAS9D,CAAC,IAAI+D,GAAS/D,CAAC,IAAK,GAE/DiF,KADS9E,EAAK+D,GAAG,CAAC,IAAI/D,EAAK+D,GAAG,EAAE,IAAI/D,EAAK+D,GAAG,EAAE,KAC/BxB,GAAIwB,GAAGC,GAAGC,CAAC,IAAK;AACrC,MAAAK,IAAID,GACJA,IAAID,GACJA,IAAID,GACJA,IAAKD,IAAIW,IAAM,GACfX,IAAID,GACJA,IAAID,GACJA,IAAID,GACJA,IAAKc,IAAKC,IAAM;AAAA,IACpB;AAEA,IAAAf,IAAKA,IAAI,KAAK,IAAK,GACnBC,IAAKA,IAAI,KAAK,IAAK,GACnBC,IAAKA,IAAI,KAAK,IAAK,GACnBC,IAAKA,IAAI,KAAK,IAAK,GACnBC,IAAKA,IAAI,KAAK,IAAK,GACnBC,IAAKA,IAAI,KAAK,IAAK,GACnBC,IAAKA,IAAI,KAAK,IAAK,GACnBC,IAAKA,IAAI,KAAK,IAAK,GACnB,KAAK,IAAIP,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,CAAC;AAAA,EACnC;AAAA,EACA,aAAa;AACT,IAAA3E,GAAMiE,EAAQ;AAAA,EAClB;AAAA,EACA,UAAU;AACN,SAAK,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,GAC/BjE,GAAM,KAAK,MAAM;AAAA,EACrB;AACJ;AAgQO,MAAMqF,KAAyB,gBAAAxD,GAAa,MAAM,IAAIuhB,IAAQ,GCvVxD/d,KAASge,ICChBC,KAAkB;AAKxB,SAASC,GAAarD,GAAyB;AAC7C,QAAM/gB,IAAkB,CAAC,CAAC;AAC1B,WAASe,IAAI,GAAGA,IAAIggB,EAAI,QAAQhgB,KAAK;AACnC,UAAMsB,IAAO0e,EAAIhgB,CAAC;AAClB,QAAI,CAACsB,EAAM;AACX,UAAMvC,IAAQqkB,GAAgB,QAAQ9hB,CAAI;AAC1C,QAAIvC,MAAU,GAAI,OAAM,IAAI,MAAM,0BAA0B;AAE5D,aAAS8hB,IAAI,GAAGA,IAAI5hB,EAAM,QAAQ4hB;AAChC,MAAA5hB,EAAM4hB,CAAC,KAAM;AAEf,IAAA5hB,EAAM,CAAC,KAAMF;AAEb,QAAIukB,IAAQ;AACZ,aAASzC,IAAI,GAAGA,IAAI5hB,EAAM,QAAQ4hB,KAAK;AACrC,YAAM0C,IAAOtkB,EAAM4hB,CAAC;AACpB,MAAA5hB,EAAM4hB,CAAC,IAAI0C,IAAOD,GAClBA,IAAQrkB,EAAM4hB,CAAC,KAAM,GACrB5hB,EAAM4hB,CAAC,KAAM;AAAA,IACf;AACA,WAAOyC,IAAQ;AACb,MAAArkB,EAAM,KAAKqkB,IAAQ,GAAI,GACvBA,MAAU;AAAA,EAEd;AAGA,WAAStjB,IAAI,GAAGA,IAAIggB,EAAI,UAAUA,EAAIhgB,CAAC,MAAM,KAAKA;AAChD,IAAAf,EAAM,KAAK,CAAC;AAGd,SAAO,IAAI,WAAWA,EAAM,SAAS;AACvC;AAKA,SAASukB,GAAaC,GAAkE;AACtF,QAAMC,IAAU,oCAGVC,IADYF,EAAQ,YAAA,EACF,MAAM,GAAG;AACjC,MAAIE,EAAM,WAAW,EAAG,QAAO;AAE/B,QAAMC,IAAMD,EAAM,CAAC,GACb1gB,IAAO0gB,EAAM,CAAC;AAEpB,MADI,CAACC,KAAO,CAAC3gB,KACT2gB,MAAQ,MAAO,QAAO;AAE1B,QAAMC,IAAmB,CAAA;AACzB,aAAWviB,KAAQ2B,GAAM;AACvB,UAAMmF,IAAMsb,EAAQ,QAAQpiB,CAAI;AAChC,QAAI8G,MAAQ,GAAI,QAAO;AACvB,IAAAyb,EAAO,KAAKzb,CAAG;AAAA,EACjB;AAGA,QAAM0b,IAAUD,EAAO,MAAM,GAAG,EAAE;AAClC,MAAIC,EAAQ,SAAS,EAAG,QAAO;AAE/B,QAAMC,IAAUD,EAAQ,CAAC;AACzB,MAAIC,MAAY,OAAW,QAAO;AAGlC,QAAMC,IAAYC,GAAYH,EAAQ,MAAM,CAAC,GAAG,GAAG,CAAQ;AAC3D,SAAKE,IAEE,EAAE,SAAAD,GAAS,SAAS,IAAI,WAAWC,CAAS,EAAA,IAF5B;AAGzB;AAKA,SAASC,GAAYhhB,GAAgBihB,GAAkBC,GAAgBziB,GAA+B;AACpG,MAAI0L,IAAM,GACN0C,IAAO;AACX,QAAMvG,IAAmB,CAAA,GACnB6a,KAAQ,KAAKD,KAAU;AAE7B,aAAWplB,KAASkE,GAAM;AACxB,QAAIlE,IAAQ,KAAKA,KAASmlB,MAAa,EAAG,QAAO;AAGjD,SAFA9W,IAAOA,KAAO8W,IAAYnlB,GAC1B+Q,KAAQoU,GACDpU,KAAQqU;AACb,MAAArU,KAAQqU,GACR5a,EAAO,KAAM6D,KAAO0C,IAAQsU,CAAI;AAAA,EAEpC;SAIWtU,KAAQoU,KAAc9W,KAAQ+W,IAASrU,IAASsU,IAClD,OAGF7a;AACT;AAKA,SAAS8a,GAAY9lB,GAAiB+lB,GAAmC;AAGvE,QAAMC,IAAe,IAAI,cAAc,OAAOD,CAAa,GAErDE,IAAgB,IAAI,cAAc,OAAOjmB,CAAO,GAChDkmB,IAA+B,CAAA;AACrC,MAAIC,IAAgBF,EAAc;AAGlC,MAAIE,IAAgB;AAClB,IAAAD,EAAmB,KAAKC,CAAa;AAAA,WAC5BA,KAAiB;AAC1B,IAAAD,EAAmB,KAAK,KAAMC,IAAgB,KAAOA,KAAiB,IAAK,GAAI;AAAA,WACtEA,KAAiB;AAC1B,IAAAD,EAAmB;AAAA,MACjB;AAAA,MACAC,IAAgB;AAAA,MACfA,KAAiB,IAAK;AAAA,MACtBA,KAAiB,KAAM;AAAA,MACvBA,KAAiB,KAAM;AAAA,IAAA;AAAA;AAG1B,UAAM,IAAI,MAAM,kBAAkB;AAGpC,QAAMC,IAAsB,IAAI,WAAWF,CAAkB,GAGvDG,IAAcL,EAAa,SAASI,EAAoB,SAASH,EAAc,QAC/EK,IAAW,IAAI,WAAWD,CAAW;AAC3C,MAAIlgB,IAAS;AAEb,SAAAmgB,EAAS,IAAIN,GAAc7f,CAAM,GACjCA,KAAU6f,EAAa,QACvBM,EAAS,IAAIF,GAAqBjgB,CAAM,GACxCA,KAAUigB,EAAoB,QAC9BE,EAAS,IAAIL,GAAe9f,CAAM,GAG3BS,GAAOA,GAAO0f,CAAQ,CAAC;AAChC;AAKA,SAASrG,GAAiB7B,GAAyB0B,GAAqC;AACtF,MAAIA,EAAU,WAAW;AACvB,UAAM,IAAI,MAAM,0BAA0B;AAI5C,MADkBA,EAAU,CAAC,MACX,OAAW,OAAM,IAAI,MAAM,mBAAmB;AAEhE,QAAMrU,IAAIqU,EAAU,MAAM,GAAG,EAAE,GACzB,IAAIA,EAAU,MAAM,IAAI,EAAE,GAE1ByG,IAAwB,CAAA;AAI9B,WAASC,IAAQ,GAAGA,IAAQ,GAAGA;AAC7B,QAAI;AAOF,YAAMzT,IALM,IAAIuO,GAAU;AAAA,QACxB,OAAO,OAAO,MAAM,KAAK7V,CAAC,EAAE,IAAI,CAAAxH,MAAKA,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AAAA,QAC9E,OAAO,OAAO,MAAM,KAAK,CAAC,EAAE,IAAI,CAAAA,MAAKA,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AAAA,MAAA,EAC9E,eAAeuiB,CAAK,EAEJ,iBAAiBpI,CAAW,GAGxCqI,IAAkB1T,EAAM,QAAQ,EAAI,GACpC2T,IAAoB3T,EAAM,QAAQ,EAAK;AAG7C,MAAAwT,EAAQ,KAAKE,CAAe,GAC5BF,EAAQ,KAAKG,CAAiB;AAAA,IAChC,QAAY;AAEV;AAAA,IACF;AAGF,MAAIH,EAAQ,WAAW;AACrB,UAAM,IAAI,MAAM,mCAAmC;AAGrD,SAAOA;AACT;AAKA,SAASI,GAAQ/hB,GAAgC;AAC/C,SAAO6f,GAAU7d,GAAOhC,CAAM,CAAC;AACjC;AAKA,SAASgiB,GAAc1B,GAAiBxI,GAAgC;AAEtE,MAAIwI,EAAQ,WAAW,GAAG,KAAKA,EAAQ,WAAW,GAAG;AACnD,QAAI;AACF,YAAM2B,IAAU/B,GAAaI,CAAO;AACpC,UAAI2B,EAAQ,SAAS,GAAI,QAAO;AAEhC,YAAMtB,IAAUsB,EAAQ,MAAM,GAAG,EAAE,GAC7BC,IAAWD,EAAQ,MAAM,EAAE,GAG3BE,IADOngB,GAAOA,GAAO2e,CAAO,CAAC,EACL,MAAM,GAAG,CAAC;AAGxC,UAAI,CAACuB,EAAS,MAAM,CAAC9B,GAAMvjB,MAAMujB,MAAS+B,EAAiBtlB,CAAC,CAAC;AAC3D,eAAO;AAGT,YAAMulB,IAAazB,EAAQ,MAAM,CAAC,GAC5B0B,IAAeN,GAAQjK,CAAS;AAEtC,aAAOsK,EAAW,MAAM,CAAChC,GAAMvjB,MAAMujB,MAASiC,EAAaxlB,CAAC,CAAC;AAAA,IAC/D,QAAQ;AACN,aAAO;AAAA,IACT;AAIF,MAAIyjB,EAAQ,YAAA,EAAc,WAAW,MAAM;AACzC,QAAI;AACF,YAAM2B,IAAU5B,GAAaC,CAAO;AACpC,UAAI,CAAC2B,EAAS,QAAO;AAErB,YAAM,EAAE,SAAArB,GAAS,SAAA0B,EAAA,IAAYL;AAE7B,UAAIrB,MAAY,GAAG;AAEjB,YAAI2B,IAAWzK;AAGf,YAAIA,EAAU,WAAW,IAAI;AAC3B,gBAAM0K,IAAS1K,EAAU,EAAE,IAAK,MAAM;AACtC,UAAAyK,IAAW,IAAI,WAAW,EAAE,GAC5BA,EAAS,CAAC,IAAIC,IAAS,IAAO,GAC9BD,EAAS,IAAIzK,EAAU,MAAM,GAAG,EAAE,GAAG,CAAC;AAAA,QACxC;AAEA,cAAMuK,IAAeN,GAAQQ,CAAQ;AACrC,eAAOD,EAAQ,MAAM,CAAClC,GAAMvjB,MAAMujB,MAASiC,EAAaxlB,CAAC,CAAC;AAAA,MAC5D;AAEA,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAGF,SAAO;AACT;AAOA,eAAsB4lB,GACpBC,GACApC,GACApF,GACkB;AAElB,QAAMiG,IAAgB;AAAA;AAEtB,MAAI;AAEF,UAAMwB,IAAW,WAAW,KAAK,KAAKzH,CAAS,GAAG,CAAA,MAAK,EAAE,WAAW,CAAC,CAAC;AAEtE,QAAIyH,EAAS,WAAW;AACtB,YAAM,IAAI,MAAM,0BAA0B;AAI5C,UAAMnJ,IAAc0H,GAAYwB,GAAKvB,CAAa,GAG5CyB,IAAavH,GAAiB7B,GAAamJ,CAAQ;AAGzD,eAAWE,KAAUD;AACnB,UAAIZ,GAAc1B,GAASuC,CAAM;AAC/B,eAAO;AAIX,WAAO;AAAA,EACT,SAASlI,GAAY;AACnB,UAAMmI,IAAenI,aAAa,QAAQA,EAAE,UAAU,OAAOA,CAAC;AAC9D,UAAM,IAAIxf,EAAY,kCAAkC2nB,CAAY,EAAE;AAAA,EACxE;AACF;AAOA,SAASC,GAAclnB,IAAS,IAAY;AAC1C,SAAOkD,GAAYlD,CAAM,EAAE,SAAS,KAAK;AAC3C;AASO,SAASmnB,GAAkBC,GAAmC;AACnE,MAAI,CAACA,EAAQ;AACX,UAAM,IAAI9nB,EAAY,2BAA2B;AAGnD,MAAI+nB;AACJ,MAAI;AACF,IAAAA,IAAY,IAAI,IAAID,EAAQ,WAAW;AAAA,EACzC,SAAStI,GAAG;AACV,UAAM,IAAIxf,EAAY,yBAA0Bwf,EAAY,OAAO,EAAE;AAAA,EACvE;AAGA,QAAMwI,IAAgBD,EAAU,OAAOA,EAAU,UAE3CE,IAAQH,EAAQ,SAASF,GAAA,GACzBM,IAAeJ,EAAQ,WAAW,MAAM;AAG9C,MAAIA,EAAQ,YAAYC,EAAU,aAAa;AAC7C,UAAM,IAAI/nB,EAAY,qEAAqE;AAE7F,MAAI,CAAC8nB,EAAQ,YAAYC,EAAU,aAAa;AAC9C,UAAM,IAAI/nB,EAAY,2EAA2E;AAWnG,SANY,YAAYgoB,CAAa,MAAMC,CAAK,MAAMC,CAAY;AAOpE;AAUA,eAAsBC,GACpBC,GACAC,GACmC;AACnC,QAAM,EAAE,SAAAlD,GAAS,KAAAoC,GAAK,WAAAxH,EAAA,IAAcqI,GAC9B,EAAE,qBAAAE,GAAqB,eAAAC,EAAA,IAAkBF;AAE/C,MAAI,CAAClD,KAAW,CAACoC,KAAO,CAACxH;AACvB,UAAM,IAAI/f,EAAY,6DAA6D;AAIrF,MAAIwoB;AACJ,MAAI;AAEF,UAAMC,IAAclB,EAAI,QAAQ,YAAY,OAAO;AACnD,IAAAiB,IAAoB,IAAI,IAAIC,CAAW;AAAA,EACzC,SAASjJ,GAAG;AACV,UAAM,IAAIxf,EAAY,qCAAsCwf,EAAY,OAAO,EAAE;AAAA,EACnF;AAEA,QAAMkJ,IAAgBF,EAAkB,aAAa,IAAI,GAAG,GACtDG,IAAmBH,EAAkB,aAAa,IAAI,GAAG,GACzDI,IAAwBJ,EAAkB,OAAOA,EAAkB;AAEzE,MAAIE,MAAkB,QAAQC,MAAqB;AACjD,UAAM,IAAI3oB,EAAY,kDAAkD;AAI1E,MAAI6oB;AACJ,MAAI;AAEF,IAAAA,IAAoB,OAAOP,KAAwB,WAAW,IAAI,IAAIA,CAAmB,IAAIA;AAAA,EAC/F,SAAS9I,GAAG;AACV,UAAM,IAAIxf,EAAY,yCAA0Cwf,EAAY,OAAO,EAAE;AAAA,EACvF;AAEA,QAAMsJ,IAAwBD,EAAkB,OAAOA,EAAkB;AAEzE,MAAID,MAA0BE;AAC5B,UAAM,IAAI9oB,EAAY,yCAAyC4oB,CAAqB,gBAAgBE,CAAqB,GAAG;AAI9H,QAAMC,IAAiBF,EAAkB;AACzC,MAAIF,MAAqB,OAAOI,MAAmB;AACjD,UAAM,IAAI/oB,EAAY,oEAAoE;AAE5F,MAAI2oB,MAAqB,OAAOI,MAAmB;AACjD,UAAM,IAAI/oB,EAAY,mEAAmE;AAI3F,MAAIuoB,KAAiBG,MAAkBH;AACrC,UAAM,IAAIvoB,EAAY,kCAAkC0oB,CAAa,gBAAgBH,CAAa,4BAA4B;AAIhI,MAAI;AAEF,QAAI,CADqB,MAAMjB,GAAyBC,GAAKpC,GAASpF,CAAS;AAG7E,YAAM,IAAI/f,EAAY,oBAAoB;AAAA,EAE9C,SAASgpB,GAAO;AAGd,UAAIA,aAAiBhpB,IACbgpB,IAGA,IAAIhpB,EAAY,mDAAoDgpB,EAAgB,OAAO,EAAE;AAAA,EAEvG;AAGA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,SAAA7D;AAAA,IACA,OAAOuD;AAAA;AAAA,EAAA;AAEX;","x_google_ignoreList":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15]}
1
+ {"version":3,"file":"digiid-ts.es.js","names":["isBytes","anumber","abytes","bytesToHex","hexToBytes","concatBytes","randomBytes","abytes_","anumber_","bytesToHex_","concatBytes_","hexToBytes_","isBytes_","randomBytes","randomBytes_","_0n","_1n","_0n","_1n","_2n","_3n","_4n","gcd","_0n","_1n","_2n","wcRandomBytes","hmac","nobleHmac"],"sources":["../src/types.ts","../node_modules/@noble/hashes/utils.js","../node_modules/@noble/hashes/_md.js","../node_modules/@noble/hashes/sha2.js","../node_modules/@noble/curves/utils.js","../node_modules/@noble/curves/abstract/modular.js","../node_modules/@noble/curves/abstract/curve.js","../node_modules/@noble/hashes/hmac.js","../node_modules/@noble/curves/abstract/weierstrass.js","../node_modules/@noble/curves/secp256k1.js","../node_modules/@noble/hashes/legacy.js","../src/digiid.ts"],"sourcesContent":["/**\n * Options for generating a DigiID URI.\n */\nexport interface DigiIDUriOptions {\n /** The full URL that the user's DigiID wallet will send the verification data back to. */\n callbackUrl: string;\n /** A unique, unpredictable nonce (number used once) for this authentication request. If not provided, a secure random one might be generated (implementation specific). */\n nonce?: string;\n /** Set to true for testing over HTTP (insecure), defaults to false (HTTPS required). */\n unsecure?: boolean;\n}\n\n/**\n * Data structure typically received from the DigiID wallet callback.\n */\nexport interface DigiIDCallbackData {\n /** The DigiByte address used for signing. */\n address: string;\n /** The DigiID URI that was originally presented to the user. */\n uri: string;\n /** The signature proving ownership of the address, signing the URI. */\n signature: string;\n}\n\n/**\n * Options for verifying a DigiID callback.\n */\nexport interface DigiIDVerifyOptions {\n /** The expected callback URL (or parts of it, like domain/path) that should match the one in the received URI. */\n expectedCallbackUrl: string | URL;\n /** The specific nonce that was originally generated for this authentication attempt, to prevent replay attacks. */\n expectedNonce?: string;\n}\n\n/**\n * Result of a successful DigiID verification.\n */\nexport interface DigiIDVerificationResult {\n /** Indicates the verification was successful. */\n isValid: true;\n /** The DigiByte address that was successfully verified. */\n address: string;\n /** The nonce extracted from the verified URI. */\n nonce: string;\n}\n\n/**\n * Represents an error during DigiID processing.\n */\nexport class DigiIDError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'DigiIDError';\n }\n}\n","/**\n * Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.\n * @param a - value to test\n * @returns `true` when the value is a Uint8Array-compatible view.\n * @example\n * Check whether a value is a Uint8Array-compatible view.\n * ```ts\n * isBytes(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport function isBytes(a) {\n // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases.\n // The fallback still requires a real ArrayBuffer view, so plain\n // JSON-deserialized `{ constructor: ... }` spoofing is rejected, and\n // `BYTES_PER_ELEMENT === 1` keeps the fallback on byte-oriented views.\n return (a instanceof Uint8Array ||\n (ArrayBuffer.isView(a) &&\n a.constructor.name === 'Uint8Array' &&\n 'BYTES_PER_ELEMENT' in a &&\n a.BYTES_PER_ELEMENT === 1));\n}\n/**\n * Asserts something is a non-negative integer.\n * @param n - number to validate\n * @param title - label included in thrown errors\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validate a non-negative integer option.\n * ```ts\n * anumber(32, 'length');\n * ```\n */\nexport function anumber(n, title = '') {\n if (typeof n !== 'number') {\n const prefix = title && `\"${title}\" `;\n throw new TypeError(`${prefix}expected number, got ${typeof n}`);\n }\n if (!Number.isSafeInteger(n) || n < 0) {\n const prefix = title && `\"${title}\" `;\n throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);\n }\n}\n/**\n * Asserts something is Uint8Array.\n * @param value - value to validate\n * @param length - optional exact length constraint\n * @param title - label included in thrown errors\n * @returns The validated byte array.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validate that a value is a byte array.\n * ```ts\n * abytes(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport function abytes(value, length, title = '') {\n const bytes = isBytes(value);\n const len = value?.length;\n const needsLen = length !== undefined;\n if (!bytes || (needsLen && len !== length)) {\n const prefix = title && `\"${title}\" `;\n const ofLen = needsLen ? ` of length ${length}` : '';\n const got = bytes ? `length=${len}` : `type=${typeof value}`;\n const message = prefix + 'expected Uint8Array' + ofLen + ', got ' + got;\n if (!bytes)\n throw new TypeError(message);\n throw new RangeError(message);\n }\n return value;\n}\n/**\n * Copies bytes into a fresh Uint8Array.\n * Buffer-style slices can alias the same backing store, so callers that need ownership should copy.\n * @param bytes - source bytes to clone\n * @returns Freshly allocated copy of `bytes`.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Clone a byte array before mutating it.\n * ```ts\n * const copy = copyBytes(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport function copyBytes(bytes) {\n // `Uint8Array.from(...)` would also accept arrays / other typed arrays. Keep this helper strict\n // because callers use it at byte-validation boundaries before mutating the detached copy.\n return Uint8Array.from(abytes(bytes));\n}\n/**\n * Asserts something is a wrapped hash constructor.\n * @param h - hash constructor to validate\n * @throws On wrong argument types or invalid hash wrapper shape. {@link TypeError}\n * @throws On invalid hash metadata ranges or values. {@link RangeError}\n * @throws If the hash metadata allows empty outputs or block sizes. {@link Error}\n * @example\n * Validate a callable hash wrapper.\n * ```ts\n * import { ahash } from '@noble/hashes/utils.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * ahash(sha256);\n * ```\n */\nexport function ahash(h) {\n if (typeof h !== 'function' || typeof h.create !== 'function')\n throw new TypeError('Hash must wrapped by utils.createHasher');\n anumber(h.outputLen);\n anumber(h.blockLen);\n // HMAC and KDF callers treat these as real byte lengths; allowing zero lets fake wrappers pass\n // validation and can produce empty outputs instead of failing fast.\n if (h.outputLen < 1)\n throw new Error('\"outputLen\" must be >= 1');\n if (h.blockLen < 1)\n throw new Error('\"blockLen\" must be >= 1');\n}\n/**\n * Asserts a hash instance has not been destroyed or finished.\n * @param instance - hash instance to validate\n * @param checkFinished - whether to reject finalized instances\n * @throws If the hash instance has already been destroyed or finalized. {@link Error}\n * @example\n * Validate that a hash instance is still usable.\n * ```ts\n * import { aexists } from '@noble/hashes/utils.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const hash = sha256.create();\n * aexists(hash);\n * ```\n */\nexport function aexists(instance, checkFinished = true) {\n if (instance.destroyed)\n throw new Error('Hash instance has been destroyed');\n if (checkFinished && instance.finished)\n throw new Error('Hash#digest() has already been called');\n}\n/**\n * Asserts output is a sufficiently-sized byte array.\n * @param out - destination buffer\n * @param instance - hash instance providing output length\n * Oversized buffers are allowed; downstream code only promises to fill the first `outputLen` bytes.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validate a caller-provided digest buffer.\n * ```ts\n * import { aoutput } from '@noble/hashes/utils.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const hash = sha256.create();\n * aoutput(new Uint8Array(hash.outputLen), hash);\n * ```\n */\nexport function aoutput(out, instance) {\n abytes(out, undefined, 'digestInto() output');\n const min = instance.outputLen;\n if (out.length < min) {\n throw new RangeError('\"digestInto() output\" expected to be of length >=' + min);\n }\n}\n/**\n * Casts a typed array view to Uint8Array.\n * @param arr - source typed array\n * @returns Uint8Array view over the same buffer.\n * @example\n * Reinterpret a typed array as bytes.\n * ```ts\n * u8(new Uint32Array([1, 2]));\n * ```\n */\nexport function u8(arr) {\n return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/**\n * Casts a typed array view to Uint32Array.\n * `arr.byteOffset` must already be 4-byte aligned or the platform\n * Uint32Array constructor will throw.\n * @param arr - source typed array\n * @returns Uint32Array view over the same buffer.\n * @example\n * Reinterpret a byte array as 32-bit words.\n * ```ts\n * u32(new Uint8Array(8));\n * ```\n */\nexport function u32(arr) {\n return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));\n}\n/**\n * Zeroizes typed arrays in place. Warning: JS provides no guarantees.\n * @param arrays - arrays to overwrite with zeros\n * @example\n * Zeroize sensitive buffers in place.\n * ```ts\n * clean(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport function clean(...arrays) {\n for (let i = 0; i < arrays.length; i++) {\n arrays[i].fill(0);\n }\n}\n/**\n * Creates a DataView for byte-level manipulation.\n * @param arr - source typed array\n * @returns DataView over the same buffer region.\n * @example\n * Create a DataView over an existing buffer.\n * ```ts\n * createView(new Uint8Array(4));\n * ```\n */\nexport function createView(arr) {\n return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/**\n * Rotate-right operation for uint32 values.\n * @param word - source word\n * @param shift - shift amount in bits\n * @returns Rotated word.\n * @example\n * Rotate a 32-bit word to the right.\n * ```ts\n * rotr(0x12345678, 8);\n * ```\n */\nexport function rotr(word, shift) {\n return (word << (32 - shift)) | (word >>> shift);\n}\n/**\n * Rotate-left operation for uint32 values.\n * @param word - source word\n * @param shift - shift amount in bits\n * @returns Rotated word.\n * @example\n * Rotate a 32-bit word to the left.\n * ```ts\n * rotl(0x12345678, 8);\n * ```\n */\nexport function rotl(word, shift) {\n return (word << shift) | ((word >>> (32 - shift)) >>> 0);\n}\n/** Whether the current platform is little-endian. */\nexport const isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44)();\n/**\n * Byte-swap operation for uint32 values.\n * @param word - source word\n * @returns Word with reversed byte order.\n * @example\n * Reverse the byte order of a 32-bit word.\n * ```ts\n * byteSwap(0x11223344);\n * ```\n */\nexport function byteSwap(word) {\n return (((word << 24) & 0xff000000) |\n ((word << 8) & 0xff0000) |\n ((word >>> 8) & 0xff00) |\n ((word >>> 24) & 0xff));\n}\n/**\n * Conditionally byte-swaps one 32-bit word on big-endian platforms.\n * @param n - source word\n * @returns Original or byte-swapped word depending on platform endianness.\n * @example\n * Normalize a 32-bit word for host endianness.\n * ```ts\n * swap8IfBE(0x11223344);\n * ```\n */\nexport const swap8IfBE = isLE\n ? (n) => n\n : (n) => byteSwap(n) >>> 0;\n/**\n * Byte-swaps every word of a Uint32Array in place.\n * @param arr - array to mutate\n * @returns The same array after mutation; callers pass live state arrays here.\n * @example\n * Reverse the byte order of every word in place.\n * ```ts\n * byteSwap32(new Uint32Array([0x11223344]));\n * ```\n */\nexport function byteSwap32(arr) {\n for (let i = 0; i < arr.length; i++) {\n arr[i] = byteSwap(arr[i]);\n }\n return arr;\n}\n/**\n * Conditionally byte-swaps a Uint32Array on big-endian platforms.\n * @param u - array to normalize for host endianness\n * @returns Original or byte-swapped array depending on platform endianness.\n * On big-endian runtimes this mutates `u` in place via `byteSwap32(...)`.\n * @example\n * Normalize a word array for host endianness.\n * ```ts\n * swap32IfBE(new Uint32Array([0x11223344]));\n * ```\n */\nexport const swap32IfBE = isLE\n ? (u) => u\n : byteSwap32;\n// Built-in hex conversion https://caniuse.com/mdn-javascript_builtins_uint8array_fromhex\nconst hasHexBuiltin = /* @__PURE__ */ (() => \n// @ts-ignore\ntypeof Uint8Array.from([]).toHex === 'function' && typeof Uint8Array.fromHex === 'function')();\n// Array where index 0xf0 (240) is mapped to string 'f0'\nconst hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));\n/**\n * Convert byte array to hex string.\n * Uses the built-in function when available and assumes it matches the tested\n * fallback semantics.\n * @param bytes - bytes to encode\n * @returns Lowercase hexadecimal string.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Convert bytes to lowercase hexadecimal.\n * ```ts\n * bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])); // 'cafe0123'\n * ```\n */\nexport function bytesToHex(bytes) {\n abytes(bytes);\n // @ts-ignore\n if (hasHexBuiltin)\n return bytes.toHex();\n // pre-caching improves the speed 6x\n let hex = '';\n for (let i = 0; i < bytes.length; i++) {\n hex += hexes[bytes[i]];\n }\n return hex;\n}\n// We use optimized technique to convert hex string to byte array\nconst asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };\nfunction asciiToBase16(ch) {\n if (ch >= asciis._0 && ch <= asciis._9)\n return ch - asciis._0; // '2' => 50-48\n if (ch >= asciis.A && ch <= asciis.F)\n return ch - (asciis.A - 10); // 'B' => 66-(65-10)\n if (ch >= asciis.a && ch <= asciis.f)\n return ch - (asciis.a - 10); // 'b' => 98-(97-10)\n return;\n}\n/**\n * Convert hex string to byte array. Uses built-in function, when available.\n * @param hex - hexadecimal string to decode\n * @returns Decoded bytes.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Decode lowercase hexadecimal into bytes.\n * ```ts\n * hexToBytes('cafe0123'); // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])\n * ```\n */\nexport function hexToBytes(hex) {\n if (typeof hex !== 'string')\n throw new TypeError('hex string expected, got ' + typeof hex);\n if (hasHexBuiltin) {\n try {\n return Uint8Array.fromHex(hex);\n }\n catch (error) {\n if (error instanceof SyntaxError)\n throw new RangeError(error.message);\n throw error;\n }\n }\n const hl = hex.length;\n const al = hl / 2;\n if (hl % 2)\n throw new RangeError('hex string expected, got unpadded hex of length ' + hl);\n const array = new Uint8Array(al);\n for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {\n const n1 = asciiToBase16(hex.charCodeAt(hi));\n const n2 = asciiToBase16(hex.charCodeAt(hi + 1));\n if (n1 === undefined || n2 === undefined) {\n const char = hex[hi] + hex[hi + 1];\n throw new RangeError('hex string expected, got non-hex character \"' + char + '\" at index ' + hi);\n }\n array[ai] = n1 * 16 + n2; // multiply first octet, e.g. 'a3' => 10*16+3 => 160 + 3 => 163\n }\n return array;\n}\n/**\n * There is no setImmediate in browser and setTimeout is slow.\n * This yields to the Promise/microtask scheduler queue, not to timers or the\n * full macrotask event loop.\n * @example\n * Yield to the next scheduler tick.\n * ```ts\n * await nextTick();\n * ```\n */\nexport const nextTick = async () => { };\n/**\n * Returns control to the Promise/microtask scheduler every `tick`\n * milliseconds to avoid blocking long loops.\n * @param iters - number of loop iterations to run\n * @param tick - maximum time slice in milliseconds\n * @param cb - callback executed on each iteration\n * @example\n * Run a loop that periodically yields back to the event loop.\n * ```ts\n * await asyncLoop(2, 0, () => {});\n * ```\n */\nexport async function asyncLoop(iters, tick, cb) {\n let ts = Date.now();\n for (let i = 0; i < iters; i++) {\n cb(i);\n // Date.now() is not monotonic, so in case if clock goes backwards we return return control too\n const diff = Date.now() - ts;\n if (diff >= 0 && diff < tick)\n continue;\n await nextTick();\n ts += diff;\n }\n}\n/**\n * Converts string to bytes using UTF8 encoding.\n * Built-in doesn't validate input to be string: we do the check.\n * Non-ASCII details are delegated to the platform `TextEncoder`.\n * @param str - string to encode\n * @returns UTF-8 encoded bytes.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Encode a string as UTF-8 bytes.\n * ```ts\n * utf8ToBytes('abc'); // Uint8Array.from([97, 98, 99])\n * ```\n */\nexport function utf8ToBytes(str) {\n if (typeof str !== 'string')\n throw new TypeError('string expected');\n return new Uint8Array(new TextEncoder().encode(str)); // https://bugzil.la/1681809\n}\n/**\n * Helper for KDFs: consumes Uint8Array or string.\n * String inputs are UTF-8 encoded; byte-array inputs stay aliased to the caller buffer.\n * @param data - user-provided KDF input\n * @param errorTitle - label included in thrown errors\n * @returns Byte representation of the input.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Normalize KDF input to bytes.\n * ```ts\n * kdfInputToBytes('password');\n * ```\n */\nexport function kdfInputToBytes(data, errorTitle = '') {\n if (typeof data === 'string')\n return utf8ToBytes(data);\n return abytes(data, undefined, errorTitle);\n}\n/**\n * Copies several Uint8Arrays into one.\n * @param arrays - arrays to concatenate\n * @returns Concatenated byte array.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Concatenate multiple byte arrays.\n * ```ts\n * concatBytes(new Uint8Array([1]), new Uint8Array([2]));\n * ```\n */\nexport function concatBytes(...arrays) {\n let sum = 0;\n for (let i = 0; i < arrays.length; i++) {\n const a = arrays[i];\n abytes(a);\n sum += a.length;\n }\n const res = new Uint8Array(sum);\n for (let i = 0, pad = 0; i < arrays.length; i++) {\n const a = arrays[i];\n res.set(a, pad);\n pad += a.length;\n }\n return res;\n}\n/**\n * Merges default options and passed options.\n * @param defaults - base option object\n * @param opts - user overrides\n * @returns Merged option object. The merge mutates `defaults` in place.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Merge user overrides onto default options.\n * ```ts\n * checkOpts({ dkLen: 32 }, { asyncTick: 10 });\n * ```\n */\nexport function checkOpts(defaults, opts) {\n if (opts !== undefined && {}.toString.call(opts) !== '[object Object]')\n throw new TypeError('options must be object or undefined');\n const merged = Object.assign(defaults, opts);\n return merged;\n}\n/**\n * Creates a callable hash function from a stateful class constructor.\n * @param hashCons - hash constructor or factory\n * @param info - optional metadata such as DER OID\n * @returns Frozen callable hash wrapper with `.create()`.\n * Wrapper construction eagerly calls `hashCons(undefined)` once to read\n * `outputLen` / `blockLen`, so constructor side effects happen at module\n * init time.\n * @example\n * Wrap a stateful hash constructor into a callable helper.\n * ```ts\n * import { createHasher } from '@noble/hashes/utils.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const wrapped = createHasher(sha256.create, { oid: sha256.oid });\n * wrapped(new Uint8Array([1]));\n * ```\n */\nexport function createHasher(hashCons, info = {}) {\n const hashC = (msg, opts) => hashCons(opts)\n .update(msg)\n .digest();\n const tmp = hashCons(undefined);\n hashC.outputLen = tmp.outputLen;\n hashC.blockLen = tmp.blockLen;\n hashC.canXOF = tmp.canXOF;\n hashC.create = (opts) => hashCons(opts);\n Object.assign(hashC, info);\n return Object.freeze(hashC);\n}\n/**\n * Cryptographically secure PRNG backed by `crypto.getRandomValues`.\n * @param bytesLength - number of random bytes to generate\n * @returns Random bytes.\n * The platform `getRandomValues()` implementation still defines any\n * single-call length cap, and this helper rejects oversize requests\n * with a stable library `RangeError` instead of host-specific errors.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @throws If the current runtime does not provide `crypto.getRandomValues`. {@link Error}\n * @example\n * Generate a fresh random key or nonce.\n * ```ts\n * const key = randomBytes(16);\n * ```\n */\nexport function randomBytes(bytesLength = 32) {\n // Match the repo's other length-taking helpers instead of relying on Uint8Array coercion.\n anumber(bytesLength, 'bytesLength');\n const cr = typeof globalThis === 'object' ? globalThis.crypto : null;\n if (typeof cr?.getRandomValues !== 'function')\n throw new Error('crypto.getRandomValues must be defined');\n // Web Cryptography API Level 2 §10.1.1:\n // if `byteLength > 65536`, throw `QuotaExceededError`.\n // Keep the guard explicit so callers can see the quota in code\n // instead of discovering it by reading the spec or host errors.\n // This wrapper surfaces the same quota as a stable library RangeError.\n if (bytesLength > 65536)\n throw new RangeError(`\"bytesLength\" expected <= 65536, got ${bytesLength}`);\n return cr.getRandomValues(new Uint8Array(bytesLength));\n}\n/**\n * Creates OID metadata for NIST hashes with prefix `06 09 60 86 48 01 65 03 04 02`.\n * @param suffix - final OID byte for the selected hash.\n * The helper accepts any byte even though only the documented NIST hash\n * suffixes are meaningful downstream.\n * @returns Object containing the DER-encoded OID.\n * @example\n * Build OID metadata for a NIST hash.\n * ```ts\n * oidNist(0x01);\n * ```\n */\nexport const oidNist = (suffix) => ({\n // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.\n // Larger suffix values would need base-128 OID encoding and a different length byte.\n oid: Uint8Array.from([0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, suffix]),\n});\n//# sourceMappingURL=utils.js.map","/**\n * Internal Merkle-Damgard hash utils.\n * @module\n */\nimport { abytes, aexists, aoutput, clean, createView, } from \"./utils.js\";\n/**\n * Shared 32-bit conditional boolean primitive reused by SHA-256, SHA-1, and MD5 `F`.\n * Returns bits from `b` when `a` is set, otherwise from `c`.\n * The XOR form is equivalent to MD5's `F(X,Y,Z) = XY v not(X)Z` because the masked terms never\n * set the same bit.\n * @param a - selector word\n * @param b - word chosen when selector bit is set\n * @param c - word chosen when selector bit is clear\n * @returns Mixed 32-bit word.\n * @example\n * Combine three words with the shared 32-bit choice primitive.\n * ```ts\n * Chi(0xffffffff, 0x12345678, 0x87654321);\n * ```\n */\nexport function Chi(a, b, c) {\n return (a & b) ^ (~a & c);\n}\n/**\n * Shared 32-bit majority primitive reused by SHA-256 and SHA-1.\n * Returns bits shared by at least two inputs.\n * @param a - first input word\n * @param b - second input word\n * @param c - third input word\n * @returns Mixed 32-bit word.\n * @example\n * Combine three words with the shared 32-bit majority primitive.\n * ```ts\n * Maj(0xffffffff, 0x12345678, 0x87654321);\n * ```\n */\nexport function Maj(a, b, c) {\n return (a & b) ^ (a & c) ^ (b & c);\n}\n/**\n * Merkle-Damgard hash construction base class.\n * Could be used to create MD5, RIPEMD, SHA1, SHA2.\n * Accepts only byte-aligned `Uint8Array` input, even when the underlying spec describes bit\n * strings with partial-byte tails.\n * @param blockLen - internal block size in bytes\n * @param outputLen - digest size in bytes\n * @param padOffset - trailing length field size in bytes\n * @param isLE - whether length and state words are encoded in little-endian\n * @example\n * Use a concrete subclass to get the shared Merkle-Damgard update/digest flow.\n * ```ts\n * import { _SHA1 } from '@noble/hashes/legacy.js';\n * const hash = new _SHA1();\n * hash.update(new Uint8Array([97, 98, 99]));\n * hash.digest();\n * ```\n */\nexport class HashMD {\n blockLen;\n outputLen;\n canXOF = false;\n padOffset;\n isLE;\n // For partial updates less than block size\n buffer;\n view;\n finished = false;\n length = 0;\n pos = 0;\n destroyed = false;\n constructor(blockLen, outputLen, padOffset, isLE) {\n this.blockLen = blockLen;\n this.outputLen = outputLen;\n this.padOffset = padOffset;\n this.isLE = isLE;\n this.buffer = new Uint8Array(blockLen);\n this.view = createView(this.buffer);\n }\n update(data) {\n aexists(this);\n abytes(data);\n const { view, buffer, blockLen } = this;\n const len = data.length;\n for (let pos = 0; pos < len;) {\n const take = Math.min(blockLen - this.pos, len - pos);\n // Fast path only when there is no buffered partial block: `take === blockLen` implies\n // `this.pos === 0`, so we can process full blocks directly from the input view.\n if (take === blockLen) {\n const dataView = createView(data);\n for (; blockLen <= len - pos; pos += blockLen)\n this.process(dataView, pos);\n continue;\n }\n buffer.set(data.subarray(pos, pos + take), this.pos);\n this.pos += take;\n pos += take;\n if (this.pos === blockLen) {\n this.process(view, 0);\n this.pos = 0;\n }\n }\n this.length += data.length;\n this.roundClean();\n return this;\n }\n digestInto(out) {\n aexists(this);\n aoutput(out, this);\n this.finished = true;\n // Padding\n // We can avoid allocation of buffer for padding completely if it\n // was previously not allocated here. But it won't change performance.\n const { buffer, view, blockLen, isLE } = this;\n let { pos } = this;\n // append the bit '1' to the message\n buffer[pos++] = 0b10000000;\n clean(this.buffer.subarray(pos));\n // we have less than padOffset left in buffer, so we cannot put length in\n // current block, need process it and pad again\n if (this.padOffset > blockLen - pos) {\n this.process(view, 0);\n pos = 0;\n }\n // Pad until full block byte with zeros\n for (let i = pos; i < blockLen; i++)\n buffer[i] = 0;\n // `padOffset` reserves the whole length field. For SHA-384/512 the high 64 bits stay zero from\n // the padding fill above, and JS will overflow before user input can make that half non-zero.\n // So we only need to write the low 64 bits here.\n view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);\n this.process(view, 0);\n const oview = createView(out);\n const len = this.outputLen;\n // NOTE: we do division by 4 later, which must be fused in single op with modulo by JIT\n if (len % 4)\n throw new Error('_sha2: outputLen must be aligned to 32bit');\n const outLen = len / 4;\n const state = this.get();\n if (outLen > state.length)\n throw new Error('_sha2: outputLen bigger than state');\n for (let i = 0; i < outLen; i++)\n oview.setUint32(4 * i, state[i], isLE);\n }\n digest() {\n const { buffer, outputLen } = this;\n this.digestInto(buffer);\n // Copy before destroy(): subclasses wipe `buffer` during cleanup, but `digest()` must return\n // fresh bytes to the caller.\n const res = buffer.slice(0, outputLen);\n this.destroy();\n return res;\n }\n _cloneInto(to) {\n to ||= new this.constructor();\n to.set(...this.get());\n const { blockLen, buffer, length, finished, destroyed, pos } = this;\n to.destroyed = destroyed;\n to.finished = finished;\n to.length = length;\n to.pos = pos;\n // Only partial-block bytes need copying: when `length % blockLen === 0`, `pos === 0` and\n // later `update()` / `digestInto()` overwrite `to.buffer` from the start before reading it.\n if (length % blockLen)\n to.buffer.set(buffer);\n return to;\n }\n clone() {\n return this._cloneInto();\n }\n}\n/**\n * Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.\n * Check out `test/misc/sha2-gen-iv.js` for recomputation guide.\n */\n/** Initial SHA256 state from RFC 6234 §6.1: the first 32 bits of the fractional parts of the\n * square roots of the first eight prime numbers. Exported as a shared table; callers must treat\n * it as read-only because constructors copy words from it by index. */\nexport const SHA256_IV = /* @__PURE__ */ Uint32Array.from([\n 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,\n]);\n/** Initial SHA224 state `H(0)` from RFC 6234 §6.1. Exported as a shared table; callers must\n * treat it as read-only because constructors copy words from it by index. */\nexport const SHA224_IV = /* @__PURE__ */ Uint32Array.from([\n 0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939, 0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4,\n]);\n/** Initial SHA384 state from RFC 6234 §6.3: eight RFC 64-bit `H(0)` words stored as sixteen\n * big-endian 32-bit halves. Derived from the fractional parts of the square roots of the ninth\n * through sixteenth prime numbers. Exported as a shared table; callers must treat it as read-only\n * because constructors copy halves from it by index. */\nexport const SHA384_IV = /* @__PURE__ */ Uint32Array.from([\n 0xcbbb9d5d, 0xc1059ed8, 0x629a292a, 0x367cd507, 0x9159015a, 0x3070dd17, 0x152fecd8, 0xf70e5939,\n 0x67332667, 0xffc00b31, 0x8eb44a87, 0x68581511, 0xdb0c2e0d, 0x64f98fa7, 0x47b5481d, 0xbefa4fa4,\n]);\n/** Initial SHA512 state from RFC 6234 §6.3: eight RFC 64-bit `H(0)` words stored as sixteen\n * big-endian 32-bit halves. Derived from the fractional parts of the square roots of the first\n * eight prime numbers. Exported as a shared table; callers must treat it as read-only because\n * constructors copy halves from it by index. */\nexport const SHA512_IV = /* @__PURE__ */ Uint32Array.from([\n 0x6a09e667, 0xf3bcc908, 0xbb67ae85, 0x84caa73b, 0x3c6ef372, 0xfe94f82b, 0xa54ff53a, 0x5f1d36f1,\n 0x510e527f, 0xade682d1, 0x9b05688c, 0x2b3e6c1f, 0x1f83d9ab, 0xfb41bd6b, 0x5be0cd19, 0x137e2179,\n]);\n//# sourceMappingURL=_md.js.map","/**\n * SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.\n * SHA256 is the fastest hash implementable in JS, even faster than Blake3.\n * Check out {@link https://www.rfc-editor.org/rfc/rfc4634 | RFC 4634} and\n * {@link https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf | FIPS 180-4}.\n * @module\n */\nimport { Chi, HashMD, Maj, SHA224_IV, SHA256_IV, SHA384_IV, SHA512_IV } from \"./_md.js\";\nimport * as u64 from \"./_u64.js\";\nimport { clean, createHasher, oidNist, rotr } from \"./utils.js\";\n/**\n * SHA-224 / SHA-256 round constants from RFC 6234 §5.1: the first 32 bits\n * of the cube roots of the first 64 primes (2..311).\n */\n// prettier-ignore\nconst SHA256_K = /* @__PURE__ */ Uint32Array.from([\n 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,\n 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,\n 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,\n 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,\n 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,\n 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,\n 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,\n 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2\n]);\n/** Reusable SHA-224 / SHA-256 message schedule buffer `W_t` from RFC 6234 §6.2 step 1. */\nconst SHA256_W = /* @__PURE__ */ new Uint32Array(64);\n/** Internal SHA-224 / SHA-256 compression engine from RFC 6234 §6.2. */\nclass SHA2_32B extends HashMD {\n constructor(outputLen) {\n super(64, outputLen, 8, false);\n }\n get() {\n const { A, B, C, D, E, F, G, H } = this;\n return [A, B, C, D, E, F, G, H];\n }\n // prettier-ignore\n set(A, B, C, D, E, F, G, H) {\n this.A = A | 0;\n this.B = B | 0;\n this.C = C | 0;\n this.D = D | 0;\n this.E = E | 0;\n this.F = F | 0;\n this.G = G | 0;\n this.H = H | 0;\n }\n process(view, offset) {\n // Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array\n for (let i = 0; i < 16; i++, offset += 4)\n SHA256_W[i] = view.getUint32(offset, false);\n for (let i = 16; i < 64; i++) {\n const W15 = SHA256_W[i - 15];\n const W2 = SHA256_W[i - 2];\n const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ (W15 >>> 3);\n const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ (W2 >>> 10);\n SHA256_W[i] = (s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16]) | 0;\n }\n // Compression function main loop, 64 rounds\n let { A, B, C, D, E, F, G, H } = this;\n for (let i = 0; i < 64; i++) {\n const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);\n const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);\n const T2 = (sigma0 + Maj(A, B, C)) | 0;\n H = G;\n G = F;\n F = E;\n E = (D + T1) | 0;\n D = C;\n C = B;\n B = A;\n A = (T1 + T2) | 0;\n }\n // Add the compressed chunk to the current hash value\n A = (A + this.A) | 0;\n B = (B + this.B) | 0;\n C = (C + this.C) | 0;\n D = (D + this.D) | 0;\n E = (E + this.E) | 0;\n F = (F + this.F) | 0;\n G = (G + this.G) | 0;\n H = (H + this.H) | 0;\n this.set(A, B, C, D, E, F, G, H);\n }\n roundClean() {\n clean(SHA256_W);\n }\n destroy() {\n // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves\n // update()/digest() callable on reused instances.\n this.destroyed = true;\n this.set(0, 0, 0, 0, 0, 0, 0, 0);\n clean(this.buffer);\n }\n}\n/** Internal SHA-256 hash class grounded in RFC 6234 §6.2. */\nexport class _SHA256 extends SHA2_32B {\n // We cannot use array here since array allows indexing by variable\n // which means optimizer/compiler cannot use registers.\n A = SHA256_IV[0] | 0;\n B = SHA256_IV[1] | 0;\n C = SHA256_IV[2] | 0;\n D = SHA256_IV[3] | 0;\n E = SHA256_IV[4] | 0;\n F = SHA256_IV[5] | 0;\n G = SHA256_IV[6] | 0;\n H = SHA256_IV[7] | 0;\n constructor() {\n super(32);\n }\n}\n/** Internal SHA-224 hash class grounded in RFC 6234 §6.2 and §8.5. */\nexport class _SHA224 extends SHA2_32B {\n A = SHA224_IV[0] | 0;\n B = SHA224_IV[1] | 0;\n C = SHA224_IV[2] | 0;\n D = SHA224_IV[3] | 0;\n E = SHA224_IV[4] | 0;\n F = SHA224_IV[5] | 0;\n G = SHA224_IV[6] | 0;\n H = SHA224_IV[7] | 0;\n constructor() {\n super(28);\n }\n}\n// SHA2-512 is slower than sha256 in js because u64 operations are slow.\n// SHA-384 / SHA-512 round constants from RFC 6234 §5.2:\n// 80 full 64-bit words split into high/low halves.\n// prettier-ignore\nconst K512 = /* @__PURE__ */ (() => u64.split([\n '0x428a2f98d728ae22', '0x7137449123ef65cd', '0xb5c0fbcfec4d3b2f', '0xe9b5dba58189dbbc',\n '0x3956c25bf348b538', '0x59f111f1b605d019', '0x923f82a4af194f9b', '0xab1c5ed5da6d8118',\n '0xd807aa98a3030242', '0x12835b0145706fbe', '0x243185be4ee4b28c', '0x550c7dc3d5ffb4e2',\n '0x72be5d74f27b896f', '0x80deb1fe3b1696b1', '0x9bdc06a725c71235', '0xc19bf174cf692694',\n '0xe49b69c19ef14ad2', '0xefbe4786384f25e3', '0x0fc19dc68b8cd5b5', '0x240ca1cc77ac9c65',\n '0x2de92c6f592b0275', '0x4a7484aa6ea6e483', '0x5cb0a9dcbd41fbd4', '0x76f988da831153b5',\n '0x983e5152ee66dfab', '0xa831c66d2db43210', '0xb00327c898fb213f', '0xbf597fc7beef0ee4',\n '0xc6e00bf33da88fc2', '0xd5a79147930aa725', '0x06ca6351e003826f', '0x142929670a0e6e70',\n '0x27b70a8546d22ffc', '0x2e1b21385c26c926', '0x4d2c6dfc5ac42aed', '0x53380d139d95b3df',\n '0x650a73548baf63de', '0x766a0abb3c77b2a8', '0x81c2c92e47edaee6', '0x92722c851482353b',\n '0xa2bfe8a14cf10364', '0xa81a664bbc423001', '0xc24b8b70d0f89791', '0xc76c51a30654be30',\n '0xd192e819d6ef5218', '0xd69906245565a910', '0xf40e35855771202a', '0x106aa07032bbd1b8',\n '0x19a4c116b8d2d0c8', '0x1e376c085141ab53', '0x2748774cdf8eeb99', '0x34b0bcb5e19b48a8',\n '0x391c0cb3c5c95a63', '0x4ed8aa4ae3418acb', '0x5b9cca4f7763e373', '0x682e6ff3d6b2b8a3',\n '0x748f82ee5defb2fc', '0x78a5636f43172f60', '0x84c87814a1f0ab72', '0x8cc702081a6439ec',\n '0x90befffa23631e28', '0xa4506cebde82bde9', '0xbef9a3f7b2c67915', '0xc67178f2e372532b',\n '0xca273eceea26619c', '0xd186b8c721c0c207', '0xeada7dd6cde0eb1e', '0xf57d4f7fee6ed178',\n '0x06f067aa72176fba', '0x0a637dc5a2c898a6', '0x113f9804bef90dae', '0x1b710b35131c471b',\n '0x28db77f523047d84', '0x32caab7b40c72493', '0x3c9ebe0a15c9bebc', '0x431d67c49c100d4c',\n '0x4cc5d4becb3e42b6', '0x597f299cfc657e2a', '0x5fcb6fab3ad6faec', '0x6c44198c4a475817'\n].map(n => BigInt(n))))();\nconst SHA512_Kh = /* @__PURE__ */ (() => K512[0])();\nconst SHA512_Kl = /* @__PURE__ */ (() => K512[1])();\n// Reusable high-half schedule buffer for the RFC 6234 §6.4 64-bit `W_t` words.\nconst SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);\n// Reusable low-half schedule buffer for the RFC 6234 §6.4 64-bit `W_t` words.\nconst SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);\n/** Internal SHA-384 / SHA-512 compression engine from RFC 6234 §6.4. */\nclass SHA2_64B extends HashMD {\n constructor(outputLen) {\n super(128, outputLen, 16, false);\n }\n // prettier-ignore\n get() {\n const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];\n }\n // prettier-ignore\n set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {\n this.Ah = Ah | 0;\n this.Al = Al | 0;\n this.Bh = Bh | 0;\n this.Bl = Bl | 0;\n this.Ch = Ch | 0;\n this.Cl = Cl | 0;\n this.Dh = Dh | 0;\n this.Dl = Dl | 0;\n this.Eh = Eh | 0;\n this.El = El | 0;\n this.Fh = Fh | 0;\n this.Fl = Fl | 0;\n this.Gh = Gh | 0;\n this.Gl = Gl | 0;\n this.Hh = Hh | 0;\n this.Hl = Hl | 0;\n }\n process(view, offset) {\n // Extend the first 16 words into the remaining 64 words w[16..79] of the message schedule array\n for (let i = 0; i < 16; i++, offset += 4) {\n SHA512_W_H[i] = view.getUint32(offset);\n SHA512_W_L[i] = view.getUint32((offset += 4));\n }\n for (let i = 16; i < 80; i++) {\n // s0 := (w[i-15] rightrotate 1) xor (w[i-15] rightrotate 8) xor (w[i-15] rightshift 7)\n const W15h = SHA512_W_H[i - 15] | 0;\n const W15l = SHA512_W_L[i - 15] | 0;\n const s0h = u64.rotrSH(W15h, W15l, 1) ^ u64.rotrSH(W15h, W15l, 8) ^ u64.shrSH(W15h, W15l, 7);\n const s0l = u64.rotrSL(W15h, W15l, 1) ^ u64.rotrSL(W15h, W15l, 8) ^ u64.shrSL(W15h, W15l, 7);\n // s1 := (w[i-2] rightrotate 19) xor (w[i-2] rightrotate 61) xor (w[i-2] rightshift 6)\n const W2h = SHA512_W_H[i - 2] | 0;\n const W2l = SHA512_W_L[i - 2] | 0;\n const s1h = u64.rotrSH(W2h, W2l, 19) ^ u64.rotrBH(W2h, W2l, 61) ^ u64.shrSH(W2h, W2l, 6);\n const s1l = u64.rotrSL(W2h, W2l, 19) ^ u64.rotrBL(W2h, W2l, 61) ^ u64.shrSL(W2h, W2l, 6);\n // SHA512_W[i] = s0 + s1 + SHA512_W[i - 7] + SHA512_W[i - 16];\n const SUMl = u64.add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);\n const SUMh = u64.add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);\n SHA512_W_H[i] = SUMh | 0;\n SHA512_W_L[i] = SUMl | 0;\n }\n let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n // Compression function main loop, 80 rounds\n for (let i = 0; i < 80; i++) {\n // S1 := (e rightrotate 14) xor (e rightrotate 18) xor (e rightrotate 41)\n const sigma1h = u64.rotrSH(Eh, El, 14) ^ u64.rotrSH(Eh, El, 18) ^ u64.rotrBH(Eh, El, 41);\n const sigma1l = u64.rotrSL(Eh, El, 14) ^ u64.rotrSL(Eh, El, 18) ^ u64.rotrBL(Eh, El, 41);\n //const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n const CHIh = (Eh & Fh) ^ (~Eh & Gh);\n const CHIl = (El & Fl) ^ (~El & Gl);\n // T1 = H + sigma1 + Chi(E, F, G) + SHA512_K[i] + SHA512_W[i]\n // prettier-ignore\n const T1ll = u64.add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);\n const T1h = u64.add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);\n const T1l = T1ll | 0;\n // S0 := (a rightrotate 28) xor (a rightrotate 34) xor (a rightrotate 39)\n const sigma0h = u64.rotrSH(Ah, Al, 28) ^ u64.rotrBH(Ah, Al, 34) ^ u64.rotrBH(Ah, Al, 39);\n const sigma0l = u64.rotrSL(Ah, Al, 28) ^ u64.rotrBL(Ah, Al, 34) ^ u64.rotrBL(Ah, Al, 39);\n const MAJh = (Ah & Bh) ^ (Ah & Ch) ^ (Bh & Ch);\n const MAJl = (Al & Bl) ^ (Al & Cl) ^ (Bl & Cl);\n Hh = Gh | 0;\n Hl = Gl | 0;\n Gh = Fh | 0;\n Gl = Fl | 0;\n Fh = Eh | 0;\n Fl = El | 0;\n ({ h: Eh, l: El } = u64.add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));\n Dh = Ch | 0;\n Dl = Cl | 0;\n Ch = Bh | 0;\n Cl = Bl | 0;\n Bh = Ah | 0;\n Bl = Al | 0;\n const All = u64.add3L(T1l, sigma0l, MAJl);\n Ah = u64.add3H(All, T1h, sigma0h, MAJh);\n Al = All | 0;\n }\n // Add the compressed chunk to the current hash value\n ({ h: Ah, l: Al } = u64.add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));\n ({ h: Bh, l: Bl } = u64.add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));\n ({ h: Ch, l: Cl } = u64.add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));\n ({ h: Dh, l: Dl } = u64.add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));\n ({ h: Eh, l: El } = u64.add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));\n ({ h: Fh, l: Fl } = u64.add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));\n ({ h: Gh, l: Gl } = u64.add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));\n ({ h: Hh, l: Hl } = u64.add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));\n this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);\n }\n roundClean() {\n clean(SHA512_W_H, SHA512_W_L);\n }\n destroy() {\n // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves\n // update()/digest() callable on reused instances.\n this.destroyed = true;\n clean(this.buffer);\n this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);\n }\n}\n/** Internal SHA-512 hash class grounded in RFC 6234 §6.3 and §6.4. */\nexport class _SHA512 extends SHA2_64B {\n Ah = SHA512_IV[0] | 0;\n Al = SHA512_IV[1] | 0;\n Bh = SHA512_IV[2] | 0;\n Bl = SHA512_IV[3] | 0;\n Ch = SHA512_IV[4] | 0;\n Cl = SHA512_IV[5] | 0;\n Dh = SHA512_IV[6] | 0;\n Dl = SHA512_IV[7] | 0;\n Eh = SHA512_IV[8] | 0;\n El = SHA512_IV[9] | 0;\n Fh = SHA512_IV[10] | 0;\n Fl = SHA512_IV[11] | 0;\n Gh = SHA512_IV[12] | 0;\n Gl = SHA512_IV[13] | 0;\n Hh = SHA512_IV[14] | 0;\n Hl = SHA512_IV[15] | 0;\n constructor() {\n super(64);\n }\n}\n/** Internal SHA-384 hash class grounded in RFC 6234 §6.3 and §6.4. */\nexport class _SHA384 extends SHA2_64B {\n Ah = SHA384_IV[0] | 0;\n Al = SHA384_IV[1] | 0;\n Bh = SHA384_IV[2] | 0;\n Bl = SHA384_IV[3] | 0;\n Ch = SHA384_IV[4] | 0;\n Cl = SHA384_IV[5] | 0;\n Dh = SHA384_IV[6] | 0;\n Dl = SHA384_IV[7] | 0;\n Eh = SHA384_IV[8] | 0;\n El = SHA384_IV[9] | 0;\n Fh = SHA384_IV[10] | 0;\n Fl = SHA384_IV[11] | 0;\n Gh = SHA384_IV[12] | 0;\n Gl = SHA384_IV[13] | 0;\n Hh = SHA384_IV[14] | 0;\n Hl = SHA384_IV[15] | 0;\n constructor() {\n super(48);\n }\n}\n/**\n * Truncated SHA512/256 and SHA512/224.\n * SHA512_IV is XORed with 0xa5a5a5a5a5a5a5a5, then used as \"intermediary\" IV of SHA512/t.\n * Then t hashes string to produce result IV.\n * See the repo-side derivation recipe in `test/misc/sha2-gen-iv.js`.\n * These IV literals are checked against that script rather than a dedicated\n * local RFC section.\n */\n/** SHA-512/224 IV derived by the SHA-512/t recipe in `test/misc/sha2-gen-iv.js` and\n * stored as sixteen big-endian 32-bit halves. */\nconst T224_IV = /* @__PURE__ */ Uint32Array.from([\n 0x8c3d37c8, 0x19544da2, 0x73e19966, 0x89dcd4d6, 0x1dfab7ae, 0x32ff9c82, 0x679dd514, 0x582f9fcf,\n 0x0f6d2b69, 0x7bd44da8, 0x77e36f73, 0x04c48942, 0x3f9d85a8, 0x6a1d36c8, 0x1112e6ad, 0x91d692a1,\n]);\n/** SHA-512/256 IV derived by the SHA-512/t recipe in `test/misc/sha2-gen-iv.js` and\n * stored as sixteen big-endian 32-bit halves. */\nconst T256_IV = /* @__PURE__ */ Uint32Array.from([\n 0x22312194, 0xfc2bf72c, 0x9f555fa3, 0xc84c64c2, 0x2393b86b, 0x6f53b151, 0x96387719, 0x5940eabd,\n 0x96283ee2, 0xa88effe3, 0xbe5e1e25, 0x53863992, 0x2b0199fc, 0x2c85b8aa, 0x0eb72ddc, 0x81c52ca2,\n]);\n/** Internal SHA-512/224 hash class using the derived `T224_IV` and the shared\n * RFC 6234 §6.4 compression engine. */\nexport class _SHA512_224 extends SHA2_64B {\n Ah = T224_IV[0] | 0;\n Al = T224_IV[1] | 0;\n Bh = T224_IV[2] | 0;\n Bl = T224_IV[3] | 0;\n Ch = T224_IV[4] | 0;\n Cl = T224_IV[5] | 0;\n Dh = T224_IV[6] | 0;\n Dl = T224_IV[7] | 0;\n Eh = T224_IV[8] | 0;\n El = T224_IV[9] | 0;\n Fh = T224_IV[10] | 0;\n Fl = T224_IV[11] | 0;\n Gh = T224_IV[12] | 0;\n Gl = T224_IV[13] | 0;\n Hh = T224_IV[14] | 0;\n Hl = T224_IV[15] | 0;\n constructor() {\n super(28);\n }\n}\n/** Internal SHA-512/256 hash class using the derived `T256_IV` and the shared\n * RFC 6234 §6.4 compression engine. */\nexport class _SHA512_256 extends SHA2_64B {\n Ah = T256_IV[0] | 0;\n Al = T256_IV[1] | 0;\n Bh = T256_IV[2] | 0;\n Bl = T256_IV[3] | 0;\n Ch = T256_IV[4] | 0;\n Cl = T256_IV[5] | 0;\n Dh = T256_IV[6] | 0;\n Dl = T256_IV[7] | 0;\n Eh = T256_IV[8] | 0;\n El = T256_IV[9] | 0;\n Fh = T256_IV[10] | 0;\n Fl = T256_IV[11] | 0;\n Gh = T256_IV[12] | 0;\n Gl = T256_IV[13] | 0;\n Hh = T256_IV[14] | 0;\n Hl = T256_IV[15] | 0;\n constructor() {\n super(32);\n }\n}\n/**\n * SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info:\n *\n * - Trying 2^128 hashes would get 50% chance of collision, using birthday attack.\n * - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.\n * - Each sha256 hash is executing 2^18 bit operations.\n * - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.\n * @param msg - message bytes to hash\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-256.\n * ```ts\n * sha256(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), \n/* @__PURE__ */ oidNist(0x01));\n/**\n * SHA2-224 hash function from RFC 4634.\n * @param msg - message bytes to hash\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-224.\n * ```ts\n * sha224(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha224 = /* @__PURE__ */ createHasher(() => new _SHA224(), \n/* @__PURE__ */ oidNist(0x04));\n/**\n * SHA2-512 hash function from RFC 4634.\n * @param msg - message bytes to hash\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-512.\n * ```ts\n * sha512(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha512 = /* @__PURE__ */ createHasher(() => new _SHA512(), \n/* @__PURE__ */ oidNist(0x03));\n/**\n * SHA2-384 hash function from RFC 4634.\n * @param msg - message bytes to hash\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-384.\n * ```ts\n * sha384(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha384 = /* @__PURE__ */ createHasher(() => new _SHA384(), \n/* @__PURE__ */ oidNist(0x02));\n/**\n * SHA2-512/256 \"truncated\" hash function, with improved resistance to length extension attacks.\n * See the paper on {@link https://eprint.iacr.org/2010/548.pdf | truncated SHA512}.\n * @param msg - message bytes to hash\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-512/256.\n * ```ts\n * sha512_256(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha512_256 = /* @__PURE__ */ createHasher(() => new _SHA512_256(), \n/* @__PURE__ */ oidNist(0x06));\n/**\n * SHA2-512/224 \"truncated\" hash function, with improved resistance to length extension attacks.\n * See the paper on {@link https://eprint.iacr.org/2010/548.pdf | truncated SHA512}.\n * @param msg - message bytes to hash\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-512/224.\n * ```ts\n * sha512_224(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha512_224 = /* @__PURE__ */ createHasher(() => new _SHA512_224(), \n/* @__PURE__ */ oidNist(0x05));\n//# sourceMappingURL=sha2.js.map","/**\n * Hex, bytes and number utilities.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { abytes as abytes_, anumber as anumber_, bytesToHex as bytesToHex_, concatBytes as concatBytes_, hexToBytes as hexToBytes_, isBytes as isBytes_, randomBytes as randomBytes_, } from '@noble/hashes/utils.js';\n/**\n * Validates that a value is a byte array.\n * @param value - Value to validate.\n * @param length - Optional exact byte length.\n * @param title - Optional field name.\n * @returns Original byte array.\n * @example\n * Reject non-byte input before passing data into curve code.\n *\n * ```ts\n * abytes(new Uint8Array(1));\n * ```\n */\nexport const abytes = (value, length, title) => abytes_(value, length, title);\n/**\n * Validates that a value is a non-negative safe integer.\n * @param n - Value to validate.\n * @param title - Optional field name.\n * @example\n * Validate a numeric length before allocating buffers.\n *\n * ```ts\n * anumber(1);\n * ```\n */\nexport const anumber = anumber_;\n/**\n * Encodes bytes as lowercase hex.\n * @param bytes - Bytes to encode.\n * @returns Lowercase hex string.\n * @example\n * Serialize bytes as hex for logging or fixtures.\n *\n * ```ts\n * bytesToHex(Uint8Array.of(1, 2, 3));\n * ```\n */\nexport const bytesToHex = bytesToHex_;\n/**\n * Concatenates byte arrays.\n * @param arrays - Byte arrays to join.\n * @returns Concatenated bytes.\n * @example\n * Join domain-separated chunks into one buffer.\n *\n * ```ts\n * concatBytes(Uint8Array.of(1), Uint8Array.of(2));\n * ```\n */\nexport const concatBytes = (...arrays) => concatBytes_(...arrays);\n/**\n * Decodes lowercase or uppercase hex into bytes.\n * @param hex - Hex string to decode.\n * @returns Decoded bytes.\n * @example\n * Parse fixture hex into bytes before hashing.\n *\n * ```ts\n * hexToBytes('0102');\n * ```\n */\nexport const hexToBytes = (hex) => hexToBytes_(hex);\n/**\n * Checks whether a value is a Uint8Array.\n * @param a - Value to inspect.\n * @returns `true` when `a` is a Uint8Array.\n * @example\n * Branch on byte input before decoding it.\n *\n * ```ts\n * isBytes(new Uint8Array(1));\n * ```\n */\nexport const isBytes = isBytes_;\n/**\n * Reads random bytes from the platform CSPRNG.\n * @param bytesLength - Number of random bytes to read.\n * @returns Fresh random bytes.\n * @example\n * Generate a random seed for a keypair.\n *\n * ```ts\n * randomBytes(2);\n * ```\n */\nexport const randomBytes = (bytesLength) => randomBytes_(bytesLength);\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\n/**\n * Validates that a flag is boolean.\n * @param value - Value to validate.\n * @param title - Optional field name.\n * @returns Original value.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Reject non-boolean option flags early.\n *\n * ```ts\n * abool(true);\n * ```\n */\nexport function abool(value, title = '') {\n if (typeof value !== 'boolean') {\n const prefix = title && `\"${title}\" `;\n throw new TypeError(prefix + 'expected boolean, got type=' + typeof value);\n }\n return value;\n}\n/**\n * Validates that a value is a non-negative bigint or safe integer.\n * @param n - Value to validate.\n * @returns The same validated value.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validate one integer-like value before serializing it.\n *\n * ```ts\n * abignumber(1n);\n * ```\n */\nexport function abignumber(n) {\n if (typeof n === 'bigint') {\n if (!isPosBig(n))\n throw new RangeError('positive bigint expected, got ' + n);\n }\n else\n anumber(n);\n return n;\n}\n/**\n * Validates that a value is a safe integer.\n * @param value - Integer to validate.\n * @param title - Optional field name.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validate a window size before scalar arithmetic uses it.\n *\n * ```ts\n * asafenumber(1);\n * ```\n */\nexport function asafenumber(value, title = '') {\n if (typeof value !== 'number') {\n const prefix = title && `\"${title}\" `;\n throw new TypeError(prefix + 'expected number, got type=' + typeof value);\n }\n if (!Number.isSafeInteger(value)) {\n const prefix = title && `\"${title}\" `;\n throw new RangeError(prefix + 'expected safe integer, got ' + value);\n }\n}\n/**\n * Encodes a bigint into even-length big-endian hex.\n * The historical \"unpadded\" name only means \"no fixed-width field padding\"; odd-length hex still\n * gets one leading zero nibble so the result always represents whole bytes.\n * @param num - Number to encode.\n * @returns Big-endian hex string.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Encode a scalar into hex without a `0x` prefix.\n *\n * ```ts\n * numberToHexUnpadded(255n);\n * ```\n */\nexport function numberToHexUnpadded(num) {\n const hex = abignumber(num).toString(16);\n return hex.length & 1 ? '0' + hex : hex;\n}\n/**\n * Parses a big-endian hex string into bigint.\n * Accepts odd-length hex through the native `BigInt('0x' + hex)` parser and currently surfaces the\n * same native `SyntaxError` for malformed hex instead of wrapping it in a library-specific error.\n * @param hex - Hex string without `0x`.\n * @returns Parsed bigint value.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Parse a scalar from fixture hex.\n *\n * ```ts\n * hexToNumber('ff');\n * ```\n */\nexport function hexToNumber(hex) {\n if (typeof hex !== 'string')\n throw new TypeError('hex string expected, got ' + typeof hex);\n return hex === '' ? _0n : BigInt('0x' + hex); // Big Endian\n}\n// BE: Big Endian, LE: Little Endian\n/**\n * Parses big-endian bytes into bigint.\n * @param bytes - Bytes in big-endian order.\n * @returns Parsed bigint value.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Read a scalar encoded in network byte order.\n *\n * ```ts\n * bytesToNumberBE(Uint8Array.of(1, 0));\n * ```\n */\nexport function bytesToNumberBE(bytes) {\n return hexToNumber(bytesToHex_(bytes));\n}\n/**\n * Parses little-endian bytes into bigint.\n * @param bytes - Bytes in little-endian order.\n * @returns Parsed bigint value.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Read a scalar encoded in little-endian form.\n *\n * ```ts\n * bytesToNumberLE(Uint8Array.of(1, 0));\n * ```\n */\nexport function bytesToNumberLE(bytes) {\n return hexToNumber(bytesToHex_(copyBytes(abytes_(bytes)).reverse()));\n}\n/**\n * Encodes a bigint into fixed-length big-endian bytes.\n * @param n - Number to encode.\n * @param len - Output length in bytes. Must be greater than zero.\n * @returns Big-endian byte array.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Serialize a scalar into a 32-byte field element.\n *\n * ```ts\n * numberToBytesBE(255n, 2);\n * ```\n */\nexport function numberToBytesBE(n, len) {\n anumber_(len);\n if (len === 0)\n throw new RangeError('zero length');\n n = abignumber(n);\n const hex = n.toString(16);\n // Detect overflow before hex parsing so oversized values don't leak the shared odd-hex error.\n if (hex.length > len * 2)\n throw new RangeError('number too large');\n return hexToBytes_(hex.padStart(len * 2, '0'));\n}\n/**\n * Encodes a bigint into fixed-length little-endian bytes.\n * @param n - Number to encode.\n * @param len - Output length in bytes.\n * @returns Little-endian byte array.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Serialize a scalar for little-endian protocols.\n *\n * ```ts\n * numberToBytesLE(255n, 2);\n * ```\n */\nexport function numberToBytesLE(n, len) {\n return numberToBytesBE(n, len).reverse();\n}\n// Unpadded, rarely used\n/**\n * Encodes a bigint into variable-length big-endian bytes.\n * @param n - Number to encode.\n * @returns Variable-length big-endian bytes.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Serialize a bigint without fixed-width padding.\n *\n * ```ts\n * numberToVarBytesBE(255n);\n * ```\n */\nexport function numberToVarBytesBE(n) {\n return hexToBytes_(numberToHexUnpadded(abignumber(n)));\n}\n// Compares 2 u8a-s in kinda constant time\n/**\n * Compares two byte arrays in constant-ish time.\n * @param a - Left byte array.\n * @param b - Right byte array.\n * @returns `true` when bytes match.\n * @example\n * Compare two encoded points without early exit.\n *\n * ```ts\n * equalBytes(Uint8Array.of(1), Uint8Array.of(1));\n * ```\n */\nexport function equalBytes(a, b) {\n a = abytes(a);\n b = abytes(b);\n if (a.length !== b.length)\n return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++)\n diff |= a[i] ^ b[i];\n return diff === 0;\n}\n/**\n * Copies Uint8Array. We can't use u8a.slice(), because u8a can be Buffer,\n * and Buffer#slice creates mutable copy. Never use Buffers!\n * @param bytes - Bytes to copy.\n * @returns Detached copy.\n * @example\n * Make an isolated copy before mutating serialized bytes.\n *\n * ```ts\n * copyBytes(Uint8Array.of(1, 2, 3));\n * ```\n */\nexport function copyBytes(bytes) {\n // `Uint8Array.from(...)` would also accept arrays / other typed arrays. Keep this helper strict\n // because callers use it at byte-validation boundaries before mutating the detached copy.\n return Uint8Array.from(abytes(bytes));\n}\n/**\n * Decodes 7-bit ASCII string to Uint8Array, throws on non-ascii symbols\n * Should be safe to use for things expected to be ASCII.\n * Returns exact same result as `TextEncoder` for ASCII or throws.\n * @param ascii - ASCII input text.\n * @returns Encoded bytes.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Encode an ASCII domain-separation tag.\n *\n * ```ts\n * asciiToBytes('ABC');\n * ```\n */\nexport function asciiToBytes(ascii) {\n if (typeof ascii !== 'string')\n throw new TypeError('ascii string expected, got ' + typeof ascii);\n return Uint8Array.from(ascii, (c, i) => {\n const charCode = c.charCodeAt(0);\n if (c.length !== 1 || charCode > 127) {\n throw new RangeError(`string contains non-ASCII character \"${ascii[i]}\" with code ${charCode} at position ${i}`);\n }\n return charCode;\n });\n}\n// Historical name: this accepts non-negative bigints, including zero.\nconst isPosBig = (n) => typeof n === 'bigint' && _0n <= n;\n/**\n * Checks whether a bigint lies inside a half-open range.\n * @param n - Candidate value.\n * @param min - Inclusive lower bound.\n * @param max - Exclusive upper bound.\n * @returns `true` when the value is inside the range.\n * @example\n * Check whether a candidate scalar fits the field order.\n *\n * ```ts\n * inRange(2n, 1n, 3n);\n * ```\n */\nexport function inRange(n, min, max) {\n return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;\n}\n/**\n * Asserts `min <= n < max`. NOTE: upper bound is exclusive.\n * @param title - Value label for error messages.\n * @param n - Candidate value.\n * @param min - Inclusive lower bound.\n * @param max - Exclusive upper bound.\n * Wrong-type inputs are not separated from out-of-range values here: they still flow through the\n * shared `RangeError` path because this is only a throwing wrapper around `inRange(...)`.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Assert that a bigint stays within one half-open range.\n *\n * ```ts\n * aInRange('x', 2n, 1n, 256n);\n * ```\n */\nexport function aInRange(title, n, min, max) {\n // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)?\n // consider P=256n, min=0n, max=P\n // - a for min=0 would require -1: `inRange('x', x, -1n, P)`\n // - b would commonly require subtraction: `inRange('x', x, 0n, P - 1n)`\n // - our way is the cleanest: `inRange('x', x, 0n, P)\n if (!inRange(n, min, max))\n throw new RangeError('expected valid ' + title + ': ' + min + ' <= n < ' + max + ', got ' + n);\n}\n// Bit operations\n/**\n * Calculates amount of bits in a bigint.\n * Same as `n.toString(2).length`\n * TODO: merge with nLength in modular\n * @param n - Value to inspect.\n * @returns Bit length.\n * @throws If the value is negative. {@link Error}\n * @example\n * Measure the bit length of a scalar before serialization.\n *\n * ```ts\n * bitLen(8n);\n * ```\n */\nexport function bitLen(n) {\n // Size callers in this repo only use non-negative orders / scalars, so negative inputs are a\n // contract bug and must not silently collapse to zero bits.\n if (n < _0n)\n throw new Error('expected non-negative bigint, got ' + n);\n let len;\n for (len = 0; n > _0n; n >>= _1n, len += 1)\n ;\n return len;\n}\n/**\n * Gets single bit at position.\n * NOTE: first bit position is 0 (same as arrays)\n * Same as `!!+Array.from(n.toString(2)).reverse()[pos]`\n * @param n - Source value.\n * @param pos - Bit position. Negative positions are passed through to raw\n * bigint shift semantics; because the mask is built as `1n << pos`,\n * they currently collapse to `0n` and make the helper a no-op.\n * @returns Bit as bigint.\n * @example\n * Gets single bit at position.\n *\n * ```ts\n * bitGet(5n, 0);\n * ```\n */\nexport function bitGet(n, pos) {\n return (n >> BigInt(pos)) & _1n;\n}\n/**\n * Sets single bit at position.\n * @param n - Source value.\n * @param pos - Bit position. Negative positions are passed through to raw bigint shift semantics,\n * so they currently behave like left shifts.\n * @param value - Whether the bit should be set.\n * @returns Updated bigint.\n * @example\n * Sets single bit at position.\n *\n * ```ts\n * bitSet(0n, 1, true);\n * ```\n */\nexport function bitSet(n, pos, value) {\n const mask = _1n << BigInt(pos);\n // Clearing needs AND-not here; OR with zero leaves an already-set bit untouched.\n return value ? n | mask : n & ~mask;\n}\n/**\n * Calculate mask for N bits. Not using ** operator with bigints because of old engines.\n * Same as BigInt(`0b${Array(i).fill('1').join('')}`)\n * @param n - Number of bits. Negative widths are currently passed through to raw bigint shift\n * semantics and therefore produce `-1n`.\n * @returns Bitmask value.\n * @example\n * Calculate mask for N bits.\n *\n * ```ts\n * bitMask(4);\n * ```\n */\nexport const bitMask = (n) => (_1n << BigInt(n)) - _1n;\n/**\n * Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n * @param hashLen - Hash output size in bytes. Callers are expected to pass a positive length; `0`\n * is not rejected here and would make the internal generate loop non-progressing.\n * @param qByteLen - Requested output size in bytes. Callers are expected to pass a positive length.\n * @param hmacFn - HMAC implementation.\n * @returns Function that will call DRBG until the predicate returns anything\n * other than `undefined`.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Build a deterministic nonce generator for RFC6979-style signing.\n *\n * ```ts\n * import { createHmacDrbg } from '@noble/curves/utils.js';\n * import { hmac } from '@noble/hashes/hmac.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const drbg = createHmacDrbg(32, 32, (key, msg) => hmac(sha256, key, msg));\n * const seed = new Uint8Array(32);\n * drbg(seed, (bytes) => bytes);\n * ```\n */\nexport function createHmacDrbg(hashLen, qByteLen, hmacFn) {\n anumber_(hashLen, 'hashLen');\n anumber_(qByteLen, 'qByteLen');\n if (typeof hmacFn !== 'function')\n throw new TypeError('hmacFn must be a function');\n // creates Uint8Array\n const u8n = (len) => new Uint8Array(len);\n const NULL = Uint8Array.of();\n const byte0 = Uint8Array.of(0x00);\n const byte1 = Uint8Array.of(0x01);\n const _maxDrbgIters = 1000;\n // Step B, Step C: set hashLen to 8*ceil(hlen/8).\n // Minimal non-full-spec HMAC-DRBG from NIST 800-90 for RFC6979 signatures.\n let v = u8n(hashLen);\n // Steps B and C of RFC6979 3.2.\n let k = u8n(hashLen);\n let i = 0; // Iterations counter, will throw when over 1000\n const reset = () => {\n v.fill(1);\n k.fill(0);\n i = 0;\n };\n // hmac(k)(v, ...values)\n const h = (...msgs) => hmacFn(k, concatBytes(v, ...msgs));\n const reseed = (seed = NULL) => {\n // HMAC-DRBG reseed() function. Steps D-G\n k = h(byte0, seed); // k = hmac(k || v || 0x00 || seed)\n v = h(); // v = hmac(k || v)\n if (seed.length === 0)\n return;\n k = h(byte1, seed); // k = hmac(k || v || 0x01 || seed)\n v = h(); // v = hmac(k || v)\n };\n const gen = () => {\n // HMAC-DRBG generate() function\n if (i++ >= _maxDrbgIters)\n throw new Error('drbg: tried max amount of iterations');\n let len = 0;\n const out = [];\n while (len < qByteLen) {\n v = h();\n const sl = v.slice();\n out.push(sl);\n len += v.length;\n }\n return concatBytes(...out);\n };\n const genUntil = (seed, pred) => {\n reset();\n reseed(seed); // Steps D-G\n let res = undefined; // Step H: grind until the predicate accepts a candidate.\n // Falsy values like 0 are valid outputs.\n while ((res = pred(gen())) === undefined)\n reseed();\n reset();\n return res;\n };\n return genUntil;\n}\n/**\n * Validates declared required and optional field types on a plain object.\n * Extra keys are intentionally ignored because many callers validate only the subset they use from\n * richer option bags or runtime objects.\n * @param object - Object to validate.\n * @param fields - Required field types.\n * @param optFields - Optional field types.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Check user options before building a curve helper.\n *\n * ```ts\n * validateObject({ flag: true }, { flag: 'boolean' });\n * ```\n */\nexport function validateObject(object, fields = {}, optFields = {}) {\n if (Object.prototype.toString.call(object) !== '[object Object]')\n throw new TypeError('expected valid options object');\n function checkField(fieldName, expectedType, isOpt) {\n // Config/data fields must be explicit own properties, but runtime objects such as Field\n // instances intentionally satisfy required method slots via their shared prototype.\n if (!isOpt && expectedType !== 'function' && !Object.hasOwn(object, fieldName))\n throw new TypeError(`param \"${fieldName}\" is invalid: expected own property`);\n const val = object[fieldName];\n if (isOpt && val === undefined)\n return;\n const current = typeof val;\n if (current !== expectedType || val === null)\n throw new TypeError(`param \"${fieldName}\" is invalid: expected ${expectedType}, got ${current}`);\n }\n const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));\n iter(fields, false);\n iter(optFields, true);\n}\n/**\n * Throws not implemented error.\n * @returns Never returns.\n * @throws If the unfinished code path is reached. {@link Error}\n * @example\n * Surface the placeholder error from an unfinished code path.\n *\n * ```ts\n * try {\n * notImplemented();\n * } catch {}\n * ```\n */\nexport const notImplemented = () => {\n throw new Error('not implemented');\n};\n//# sourceMappingURL=utils.js.map","/**\n * Utils for modular division and fields.\n * Field over 11 is a finite (Galois) field is integer number operations `mod 11`.\n * There is no division: it is replaced by modular multiplicative inverse.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { abool, abytes, anumber, asafenumber, bitLen, bytesToNumberBE, bytesToNumberLE, numberToBytesBE, numberToBytesLE, validateObject, } from \"../utils.js\";\n// Numbers aren't used in x25519 / x448 builds\n// prettier-ignore\nconst _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2);\n// prettier-ignore\nconst _3n = /* @__PURE__ */ BigInt(3), _4n = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5);\n// prettier-ignore\nconst _7n = /* @__PURE__ */ BigInt(7), _8n = /* @__PURE__ */ BigInt(8), _9n = /* @__PURE__ */ BigInt(9);\nconst _16n = /* @__PURE__ */ BigInt(16);\n/**\n * @param a - Dividend value.\n * @param b - Positive modulus.\n * @returns Reduced value in `[0, b)` only when `b` is positive.\n * @throws If the modulus is not positive. {@link Error}\n * @example\n * Normalize a bigint into one field residue.\n *\n * ```ts\n * mod(-1n, 5n);\n * ```\n */\nexport function mod(a, b) {\n if (b <= _0n)\n throw new Error('mod: expected positive modulus, got ' + b);\n const result = a % b;\n return result >= _0n ? result : b + result;\n}\n/**\n * Efficiently raise num to a power with modular reduction.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * Low-level helper: callers that need canonical residues must pass a valid `num` for the chosen\n * modulus instead of relying on the `power===0/1` fast paths to normalize it.\n * @param num - Base value.\n * @param power - Exponent value.\n * @param modulo - Reduction modulus.\n * @returns Modular exponentiation result.\n * @throws If the modulus or exponent is invalid. {@link Error}\n * @example\n * Raise one bigint to a modular power.\n *\n * ```ts\n * pow(2n, 6n, 11n) // 64n % 11n == 9n\n * ```\n */\nexport function pow(num, power, modulo) {\n return FpPow(Field(modulo), num, power);\n}\n/**\n * Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)`.\n * Low-level helper: callers that need canonical residues must pass a valid `x` for the chosen\n * modulus; the `power===0` fast path intentionally returns the input unchanged.\n * @param x - Base value.\n * @param power - Number of squarings.\n * @param modulo - Reduction modulus.\n * @returns Repeated-squaring result.\n * @throws If the exponent is negative. {@link Error}\n * @example\n * Apply repeated squaring inside one field.\n *\n * ```ts\n * pow2(3n, 2n, 11n);\n * ```\n */\nexport function pow2(x, power, modulo) {\n if (power < _0n)\n throw new Error('pow2: expected non-negative exponent, got ' + power);\n let res = x;\n while (power-- > _0n) {\n res *= res;\n res %= modulo;\n }\n return res;\n}\n/**\n * Inverses number over modulo.\n * Implemented using the {@link https://brilliant.org/wiki/extended-euclidean-algorithm/ | extended Euclidean algorithm}.\n * @param number - Value to invert.\n * @param modulo - Positive modulus.\n * @returns Multiplicative inverse.\n * @throws If the modulus is invalid or the inverse does not exist. {@link Error}\n * @example\n * Compute one modular inverse with the extended Euclidean algorithm.\n *\n * ```ts\n * invert(3n, 11n);\n * ```\n */\nexport function invert(number, modulo) {\n if (number === _0n)\n throw new Error('invert: expected non-zero number');\n if (modulo <= _0n)\n throw new Error('invert: expected positive modulus, got ' + modulo);\n // Fermat's little theorem \"CT-like\" version inv(n) = n^(m-2) mod m is 30x slower.\n let a = mod(number, modulo);\n let b = modulo;\n // prettier-ignore\n let x = _0n, y = _1n, u = _1n, v = _0n;\n while (a !== _0n) {\n const q = b / a;\n const r = b - a * q;\n const m = x - u * q;\n const n = y - v * q;\n // prettier-ignore\n b = a, a = r, x = u, y = v, u = m, v = n;\n }\n const gcd = b;\n if (gcd !== _1n)\n throw new Error('invert: does not exist');\n return mod(x, modulo);\n}\nfunction assertIsSquare(Fp, root, n) {\n const F = Fp;\n if (!F.eql(F.sqr(root), n))\n throw new Error('Cannot find square root');\n}\n// Not all roots are possible! Example which will throw:\n// const NUM =\n// n = 72057594037927816n;\n// Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'));\nfunction sqrt3mod4(Fp, n) {\n const F = Fp;\n const p1div4 = (F.ORDER + _1n) / _4n;\n const root = F.pow(n, p1div4);\n assertIsSquare(F, root, n);\n return root;\n}\n// Equivalent `q = 5 (mod 8)` square-root formula (Atkin-style), not the RFC Appendix I.2 CMOV\n// pseudocode verbatim.\nfunction sqrt5mod8(Fp, n) {\n const F = Fp;\n const p5div8 = (F.ORDER - _5n) / _8n;\n const n2 = F.mul(n, _2n);\n const v = F.pow(n2, p5div8);\n const nv = F.mul(n, v);\n const i = F.mul(F.mul(nv, _2n), v);\n const root = F.mul(nv, F.sub(i, F.ONE));\n assertIsSquare(F, root, n);\n return root;\n}\n// Based on RFC9380, Kong algorithm\n// prettier-ignore\nfunction sqrt9mod16(P) {\n const Fp_ = Field(P);\n const tn = tonelliShanks(P);\n const c1 = tn(Fp_, Fp_.neg(Fp_.ONE)); // 1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F\n const c2 = tn(Fp_, c1); // 2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F\n const c3 = tn(Fp_, Fp_.neg(c1)); // 3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F\n const c4 = (P + _7n) / _16n; // 4. c4 = (q + 7) / 16 # Integer arithmetic\n return ((Fp, n) => {\n const F = Fp;\n let tv1 = F.pow(n, c4); // 1. tv1 = x^c4\n let tv2 = F.mul(tv1, c1); // 2. tv2 = c1 * tv1\n const tv3 = F.mul(tv1, c2); // 3. tv3 = c2 * tv1\n const tv4 = F.mul(tv1, c3); // 4. tv4 = c3 * tv1\n const e1 = F.eql(F.sqr(tv2), n); // 5. e1 = (tv2^2) == x\n const e2 = F.eql(F.sqr(tv3), n); // 6. e2 = (tv3^2) == x\n tv1 = F.cmov(tv1, tv2, e1); // 7. tv1 = CMOV(tv1, tv2, e1) # Select tv2 if (tv2^2) == x\n tv2 = F.cmov(tv4, tv3, e2); // 8. tv2 = CMOV(tv4, tv3, e2) # Select tv3 if (tv3^2) == x\n const e3 = F.eql(F.sqr(tv2), n); // 9. e3 = (tv2^2) == x\n const root = F.cmov(tv1, tv2, e3); // 10. z = CMOV(tv1, tv2, e3) # Select sqrt from tv1 & tv2\n assertIsSquare(F, root, n);\n return root;\n });\n}\n/**\n * Tonelli-Shanks square root search algorithm.\n * This implementation is variable-time: it searches data-dependently for the first non-residue `Z`\n * and for the smallest `i` in the main loop, unlike RFC 9380 Appendix I.4's constant-time shape.\n * 1. {@link https://eprint.iacr.org/2012/685.pdf | eprint 2012/685}, page 12\n * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks\n * @param P - field order\n * @returns function that takes field Fp (created from P) and number n\n * @throws If the field is too small, non-prime, or the square root does not exist. {@link Error}\n * @example\n * Construct a square-root helper for primes that need Tonelli-Shanks.\n *\n * ```ts\n * import { Field, tonelliShanks } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const sqrt = tonelliShanks(17n)(Fp, 4n);\n * ```\n */\nexport function tonelliShanks(P) {\n // Initialization (precomputation).\n // Caching initialization could boost perf by 7%.\n if (P < _3n)\n throw new Error('sqrt is not defined for small field');\n // Factor P - 1 = Q * 2^S, where Q is odd\n let Q = P - _1n;\n let S = 0;\n while (Q % _2n === _0n) {\n Q /= _2n;\n S++;\n }\n // Find the first quadratic non-residue Z >= 2\n let Z = _2n;\n const _Fp = Field(P);\n while (FpLegendre(_Fp, Z) === 1) {\n // Basic primality test for P. After x iterations, chance of\n // not finding quadratic non-residue is 2^x, so 2^1000.\n if (Z++ > 1000)\n throw new Error('Cannot find square root: probably non-prime P');\n }\n // Fast-path; usually done before Z, but we do \"primality test\".\n if (S === 1)\n return sqrt3mod4;\n // Slow-path\n // TODO: test on Fp2 and others\n let cc = _Fp.pow(Z, Q); // c = z^Q\n const Q1div2 = (Q + _1n) / _2n;\n return function tonelliSlow(Fp, n) {\n const F = Fp;\n if (F.is0(n))\n return n;\n // Check if n is a quadratic residue using Legendre symbol\n if (FpLegendre(F, n) !== 1)\n throw new Error('Cannot find square root');\n // Initialize variables for the main loop\n let M = S;\n let c = F.mul(F.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp\n let t = F.pow(n, Q); // t = n^Q, first guess at the fudge factor\n let R = F.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root\n // Main loop\n // while t != 1\n while (!F.eql(t, F.ONE)) {\n if (F.is0(t))\n return F.ZERO; // if t=0 return R=0\n let i = 1;\n // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P)\n let t_tmp = F.sqr(t); // t^(2^1)\n while (!F.eql(t_tmp, F.ONE)) {\n i++;\n t_tmp = F.sqr(t_tmp); // t^(2^2)...\n if (i === M)\n throw new Error('Cannot find square root');\n }\n // Calculate the exponent for b: 2^(M - i - 1)\n const exponent = _1n << BigInt(M - i - 1); // bigint is important\n const b = F.pow(c, exponent); // b = 2^(M - i - 1)\n // Update variables\n M = i;\n c = F.sqr(b); // c = b^2\n t = F.mul(t, c); // t = (t * b^2)\n R = F.mul(R, b); // R = R*b\n }\n return R;\n };\n}\n/**\n * Square root for a finite field. Will try optimized versions first:\n *\n * 1. P ≡ 3 (mod 4)\n * 2. P ≡ 5 (mod 8)\n * 3. P ≡ 9 (mod 16)\n * 4. Tonelli-Shanks algorithm\n *\n * Different algorithms can give different roots, it is up to user to decide which one they want.\n * For example there is FpSqrtOdd/FpSqrtEven to choose a root by oddness\n * (used for hash-to-curve).\n * @param P - Field order.\n * @returns Square-root helper. The generic fallback inherits Tonelli-Shanks' variable-time\n * behavior and this selector assumes prime-field-style integer moduli.\n * @throws If the field is unsupported or the square root does not exist. {@link Error}\n * @example\n * Choose the square-root helper appropriate for one field modulus.\n *\n * ```ts\n * import { Field, FpSqrt } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const sqrt = FpSqrt(17n)(Fp, 4n);\n * ```\n */\nexport function FpSqrt(P) {\n // P ≡ 3 (mod 4) => √n = n^((P+1)/4)\n if (P % _4n === _3n)\n return sqrt3mod4;\n // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf\n if (P % _8n === _5n)\n return sqrt5mod8;\n // P ≡ 9 (mod 16) => Kong algorithm, page 11 of https://eprint.iacr.org/2012/685.pdf (algorithm 4)\n if (P % _16n === _9n)\n return sqrt9mod16(P);\n // Tonelli-Shanks algorithm\n return tonelliShanks(P);\n}\n/**\n * @param num - Value to inspect.\n * @param modulo - Field modulus.\n * @returns `true` when the least-significant little-endian bit is set.\n * @throws If the modulus is invalid for `mod(...)`. {@link Error}\n * @example\n * Inspect the low bit used by little-endian sign conventions.\n *\n * ```ts\n * isNegativeLE(3n, 11n);\n * ```\n */\nexport const isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n) === _1n;\n// prettier-ignore\n// Arithmetic-only subset checked by validateField(). This is intentionally not the full runtime\n// IField contract: helpers like `isValidNot0`, `invertBatch`, `toBytes`, `fromBytes`, `cmov`, and\n// field-specific extras like `isOdd` are left to the callers that actually need them.\nconst FIELD_FIELDS = [\n 'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',\n 'eql', 'add', 'sub', 'mul', 'pow', 'div',\n 'addN', 'subN', 'mulN', 'sqrN'\n];\n/**\n * @param field - Field implementation.\n * @returns Validated field. This only checks the arithmetic subset needed by generic helpers; it\n * does not guarantee full runtime-method coverage for serialization, batching, `cmov`, or\n * field-specific extras beyond positive `BYTES` / `BITS`.\n * @throws If the field shape or numeric metadata are invalid. {@link Error}\n * @example\n * Check that a field implementation exposes the operations curve code expects.\n *\n * ```ts\n * import { Field, validateField } from '@noble/curves/abstract/modular.js';\n * const Fp = validateField(Field(17n));\n * ```\n */\nexport function validateField(field) {\n const initial = {\n ORDER: 'bigint',\n BYTES: 'number',\n BITS: 'number',\n };\n const opts = FIELD_FIELDS.reduce((map, val) => {\n map[val] = 'function';\n return map;\n }, initial);\n validateObject(field, opts);\n // Runtime field implementations must expose real integer byte/bit sizes; fractional / NaN /\n // infinite metadata leaks through validateObject(type='number') but breaks encoders and caches.\n asafenumber(field.BYTES, 'BYTES');\n asafenumber(field.BITS, 'BITS');\n // Runtime field implementations must expose positive byte/bit sizes; zero leaks through the\n // numeric shape checks above but still breaks encoding helpers and cached-length assumptions.\n if (field.BYTES < 1 || field.BITS < 1)\n throw new Error('invalid field: expected BYTES/BITS > 0');\n if (field.ORDER <= _1n)\n throw new Error('invalid field: expected ORDER > 1, got ' + field.ORDER);\n return field;\n}\n// Generic field functions\n/**\n * Same as `pow` but for Fp: non-constant-time.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * @param Fp - Field implementation.\n * @param num - Base value.\n * @param power - Exponent value.\n * @returns Powered field element.\n * @throws If the exponent is negative. {@link Error}\n * @example\n * Raise one field element to a public exponent.\n *\n * ```ts\n * import { Field, FpPow } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const x = FpPow(Fp, 3n, 5n);\n * ```\n */\nexport function FpPow(Fp, num, power) {\n const F = Fp;\n if (power < _0n)\n throw new Error('invalid exponent, negatives unsupported');\n if (power === _0n)\n return F.ONE;\n if (power === _1n)\n return num;\n let p = F.ONE;\n let d = num;\n while (power > _0n) {\n if (power & _1n)\n p = F.mul(p, d);\n d = F.sqr(d);\n power >>= _1n;\n }\n return p;\n}\n/**\n * Efficiently invert an array of Field elements.\n * Exception-free. Zero-valued field elements stay `undefined` unless `passZero` is enabled.\n * @param Fp - Field implementation.\n * @param nums - Values to invert.\n * @param passZero - map 0 to 0 (instead of undefined)\n * @returns Inverted values.\n * @example\n * Invert several field elements with one shared inversion.\n *\n * ```ts\n * import { Field, FpInvertBatch } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const inv = FpInvertBatch(Fp, [1n, 2n, 4n]);\n * ```\n */\nexport function FpInvertBatch(Fp, nums, passZero = false) {\n const F = Fp;\n const inverted = new Array(nums.length).fill(passZero ? F.ZERO : undefined);\n // Walk from first to last, multiply them by each other MOD p\n const multipliedAcc = nums.reduce((acc, num, i) => {\n if (F.is0(num))\n return acc;\n inverted[i] = acc;\n return F.mul(acc, num);\n }, F.ONE);\n // Invert last element\n const invertedAcc = F.inv(multipliedAcc);\n // Walk from last to first, multiply them by inverted each other MOD p\n nums.reduceRight((acc, num, i) => {\n if (F.is0(num))\n return acc;\n inverted[i] = F.mul(acc, inverted[i]);\n return F.mul(acc, num);\n }, invertedAcc);\n return inverted;\n}\n/**\n * @param Fp - Field implementation.\n * @param lhs - Dividend value.\n * @param rhs - Divisor value.\n * @returns Division result.\n * @throws If the divisor is non-invertible. {@link Error}\n * @example\n * Divide one field element by another.\n *\n * ```ts\n * import { Field, FpDiv } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const x = FpDiv(Fp, 6n, 3n);\n * ```\n */\nexport function FpDiv(Fp, lhs, rhs) {\n const F = Fp;\n return F.mul(lhs, typeof rhs === 'bigint' ? invert(rhs, F.ORDER) : F.inv(rhs));\n}\n/**\n * Legendre symbol.\n * Legendre constant is used to calculate Legendre symbol (a | p)\n * which denotes the value of a^((p-1)/2) (mod p).\n *\n * * (a | p) ≡ 1 if a is a square (mod p), quadratic residue\n * * (a | p) ≡ -1 if a is not a square (mod p), quadratic non residue\n * * (a | p) ≡ 0 if a ≡ 0 (mod p)\n * @param Fp - Field implementation.\n * @param n - Value to inspect.\n * @returns Legendre symbol.\n * @throws If the field returns an invalid Legendre symbol value. {@link Error}\n * @example\n * Compute the Legendre symbol of one field element.\n *\n * ```ts\n * import { Field, FpLegendre } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const symbol = FpLegendre(Fp, 4n);\n * ```\n */\nexport function FpLegendre(Fp, n) {\n const F = Fp;\n // We can use 3rd argument as optional cache of this value\n // but seems unneeded for now. The operation is very fast.\n const p1mod2 = (F.ORDER - _1n) / _2n;\n const powered = F.pow(n, p1mod2);\n const yes = F.eql(powered, F.ONE);\n const zero = F.eql(powered, F.ZERO);\n const no = F.eql(powered, F.neg(F.ONE));\n if (!yes && !zero && !no)\n throw new Error('invalid Legendre symbol result');\n return yes ? 1 : zero ? 0 : -1;\n}\n/**\n * @param Fp - Field implementation.\n * @param n - Value to inspect.\n * @returns `true` when `Fp.sqrt(n)` exists. This includes `0`, even though strict \"quadratic\n * residue\" terminology often reserves that name for the non-zero square class.\n * @throws If the field returns an invalid Legendre symbol value. {@link Error}\n * @example\n * Check whether one field element has a square root in the field.\n *\n * ```ts\n * import { Field, FpIsSquare } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const isSquare = FpIsSquare(Fp, 4n);\n * ```\n */\nexport function FpIsSquare(Fp, n) {\n const l = FpLegendre(Fp, n);\n // Zero is a square too: 0 = 0^2, and Fp.sqrt(0) already returns 0.\n return l !== -1;\n}\n/**\n * @param n - Curve order. Callers are expected to pass a positive order.\n * @param nBitLength - Optional cached bit length. Callers are expected to pass a positive cached\n * value when overriding the derived bit length.\n * @returns Byte and bit lengths.\n * @throws If the order or cached bit length is invalid. {@link Error}\n * @example\n * Measure the encoding sizes needed for one modulus.\n *\n * ```ts\n * nLength(255n);\n * ```\n */\nexport function nLength(n, nBitLength) {\n // Bit size, byte size of CURVE.n\n if (nBitLength !== undefined)\n anumber(nBitLength);\n if (n <= _0n)\n throw new Error('invalid n length: expected positive n, got ' + n);\n if (nBitLength !== undefined && nBitLength < 1)\n throw new Error('invalid n length: expected positive bit length, got ' + nBitLength);\n const bits = bitLen(n);\n // Cached bit lengths smaller than ORDER would truncate serialized scalars/elements and poison\n // any math that relies on the derived field metadata.\n if (nBitLength !== undefined && nBitLength < bits)\n throw new Error(`invalid n length: expected bit length (${bits}) >= n.length (${nBitLength})`);\n const _nBitLength = nBitLength !== undefined ? nBitLength : bits;\n const nByteLength = Math.ceil(_nBitLength / 8);\n return { nBitLength: _nBitLength, nByteLength };\n}\n// Keep the lazy sqrt cache off-instance so Field(...) can return a frozen object. Otherwise the\n// cached helper write would keep the field surface externally mutable.\nconst FIELD_SQRT = new WeakMap();\nclass _Field {\n ORDER;\n BITS;\n BYTES;\n isLE;\n ZERO = _0n;\n ONE = _1n;\n _lengths;\n _mod;\n constructor(ORDER, opts = {}) {\n // ORDER <= 1 is degenerate: ONE would not be a valid field element and helpers like pow/inv\n // would stop modeling field arithmetic.\n if (ORDER <= _1n)\n throw new Error('invalid field: expected ORDER > 1, got ' + ORDER);\n let _nbitLength = undefined;\n this.isLE = false;\n if (opts != null && typeof opts === 'object') {\n // Cached bit lengths are trusted here and should already be positive / consistent with ORDER.\n if (typeof opts.BITS === 'number')\n _nbitLength = opts.BITS;\n if (typeof opts.sqrt === 'function')\n // `_Field.prototype` is frozen below, so custom sqrt hooks must become own properties\n // explicitly instead of relying on writable prototype shadowing via assignment.\n Object.defineProperty(this, 'sqrt', { value: opts.sqrt, enumerable: true });\n if (typeof opts.isLE === 'boolean')\n this.isLE = opts.isLE;\n if (opts.allowedLengths)\n this._lengths = Object.freeze(opts.allowedLengths.slice());\n if (typeof opts.modFromBytes === 'boolean')\n this._mod = opts.modFromBytes;\n }\n const { nBitLength, nByteLength } = nLength(ORDER, _nbitLength);\n if (nByteLength > 2048)\n throw new Error('invalid field: expected ORDER of <= 2048 bytes');\n this.ORDER = ORDER;\n this.BITS = nBitLength;\n this.BYTES = nByteLength;\n Object.freeze(this);\n }\n create(num) {\n return mod(num, this.ORDER);\n }\n isValid(num) {\n if (typeof num !== 'bigint')\n throw new TypeError('invalid field element: expected bigint, got ' + typeof num);\n return _0n <= num && num < this.ORDER; // 0 is valid element, but it's not invertible\n }\n is0(num) {\n return num === _0n;\n }\n // is valid and invertible\n isValidNot0(num) {\n return !this.is0(num) && this.isValid(num);\n }\n isOdd(num) {\n return (num & _1n) === _1n;\n }\n neg(num) {\n return mod(-num, this.ORDER);\n }\n eql(lhs, rhs) {\n return lhs === rhs;\n }\n sqr(num) {\n return mod(num * num, this.ORDER);\n }\n add(lhs, rhs) {\n return mod(lhs + rhs, this.ORDER);\n }\n sub(lhs, rhs) {\n return mod(lhs - rhs, this.ORDER);\n }\n mul(lhs, rhs) {\n return mod(lhs * rhs, this.ORDER);\n }\n pow(num, power) {\n return FpPow(this, num, power);\n }\n div(lhs, rhs) {\n return mod(lhs * invert(rhs, this.ORDER), this.ORDER);\n }\n // Same as above, but doesn't normalize\n sqrN(num) {\n return num * num;\n }\n addN(lhs, rhs) {\n return lhs + rhs;\n }\n subN(lhs, rhs) {\n return lhs - rhs;\n }\n mulN(lhs, rhs) {\n return lhs * rhs;\n }\n inv(num) {\n return invert(num, this.ORDER);\n }\n sqrt(num) {\n // Caching sqrt helpers speeds up sqrt9mod16 by 5x and Tonelli-Shanks by about 10% without keeping\n // the field instance itself mutable.\n let sqrt = FIELD_SQRT.get(this);\n if (!sqrt)\n FIELD_SQRT.set(this, (sqrt = FpSqrt(this.ORDER)));\n return sqrt(this, num);\n }\n toBytes(num) {\n // Serialize fixed-width limbs without re-validating the field range. Callers that need a\n // canonical encoding must pass a valid element; some protocols intentionally serialize raw\n // residues here and reduce or validate them elsewhere.\n return this.isLE ? numberToBytesLE(num, this.BYTES) : numberToBytesBE(num, this.BYTES);\n }\n fromBytes(bytes, skipValidation = false) {\n abytes(bytes);\n const { _lengths: allowedLengths, BYTES, isLE, ORDER, _mod: modFromBytes } = this;\n if (allowedLengths) {\n // `allowedLengths` must list real positive byte lengths; otherwise empty input would get\n // padded into zero and silently decode as a field element.\n if (bytes.length < 1 || !allowedLengths.includes(bytes.length) || bytes.length > BYTES) {\n throw new Error('Field.fromBytes: expected ' + allowedLengths + ' bytes, got ' + bytes.length);\n }\n const padded = new Uint8Array(BYTES);\n // isLE add 0 to right, !isLE to the left.\n padded.set(bytes, isLE ? 0 : padded.length - bytes.length);\n bytes = padded;\n }\n if (bytes.length !== BYTES)\n throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);\n let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n if (modFromBytes)\n scalar = mod(scalar, ORDER);\n if (!skipValidation)\n if (!this.isValid(scalar))\n throw new Error('invalid field element: outside of range 0..ORDER');\n // Range validation is optional here because some protocols intentionally decode raw residues\n // and reduce or validate them elsewhere.\n return scalar;\n }\n // TODO: we don't need it here, move out to separate fn\n invertBatch(lst) {\n return FpInvertBatch(this, lst);\n }\n // We can't move this out because Fp6, Fp12 implement it\n // and it's unclear what to return in there.\n cmov(a, b, condition) {\n // Field elements have `isValid(...)`; the CMOV branch bit is a direct runtime input, so reject\n // non-boolean selectors here instead of letting JS truthiness silently change arithmetic.\n abool(condition, 'condition');\n return condition ? b : a;\n }\n}\n// Freeze the shared method surface too; otherwise callers can still poison every Field instance by\n// monkey-patching `_Field.prototype` even if each instance is frozen.\nObject.freeze(_Field.prototype);\n/**\n * Creates a finite field. Major performance optimizations:\n * * 1. Denormalized operations like mulN instead of mul.\n * * 2. Identical object shape: never add or remove keys.\n * * 3. Frozen stable object shape; the lazy sqrt cache lives in a module-level `WeakMap`.\n * Fragile: always run a benchmark on a change.\n * Security note: operations and low-level serializers like `toBytes` don't check `isValid` for\n * all elements for performance and protocol-flexibility reasons; callers are responsible for\n * supplying valid elements when they need canonical field behavior.\n * This is low-level code, please make sure you know what you're doing.\n *\n * Note about field properties:\n * * CHARACTERISTIC p = prime number, number of elements in main subgroup.\n * * ORDER q = similar to cofactor in curves, may be composite `q = p^m`.\n *\n * @param ORDER - field order, probably prime, or could be composite\n * @param opts - Field options such as bit length or endianness. See {@link FieldOpts}.\n * @returns Frozen field instance with a stable object shape. This wrapper forwards `opts` straight\n * into `_Field`, so it inherits `_Field`'s assumptions about cached sizes and `allowedLengths`.\n * @example\n * Construct one prime field with optional overrides.\n *\n * ```ts\n * Field(11n);\n * ```\n */\nexport function Field(ORDER, opts = {}) {\n return new _Field(ORDER, opts);\n}\n// Generic random scalar, we can do same for other fields if via Fp2.mul(Fp2.ONE, Fp2.random)?\n// This allows unsafe methods like ignore bias or zero. These unsafe, but often used in different protocols (if deterministic RNG).\n// which mean we cannot force this via opts.\n// Not sure what to do with randomBytes, we can accept it inside opts if wanted.\n// Probably need to export getMinHashLength somewhere?\n// random(bytes?: Uint8Array, unsafeAllowZero = false, unsafeAllowBias = false) {\n// const LEN = !unsafeAllowBias ? getMinHashLength(ORDER) : BYTES;\n// if (bytes === undefined) bytes = randomBytes(LEN); // _opts.randomBytes?\n// const num = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n// // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n// const reduced = unsafeAllowZero ? mod(num, ORDER) : mod(num, ORDER - _1n) + _1n;\n// return reduced;\n// },\n/**\n * @param Fp - Field implementation.\n * @param elm - Value to square-root.\n * @returns Odd square root when two roots exist. The special case `elm = 0` still returns `0`,\n * which is the only square root but is not odd.\n * @throws If the field lacks oddness checks or the square root does not exist. {@link Error}\n * @example\n * Select the odd square root when two roots exist.\n *\n * ```ts\n * import { Field, FpSqrtOdd } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const root = FpSqrtOdd(Fp, 4n);\n * ```\n */\nexport function FpSqrtOdd(Fp, elm) {\n const F = Fp;\n if (!F.isOdd)\n throw new Error(\"Field doesn't have isOdd\");\n const root = F.sqrt(elm);\n return F.isOdd(root) ? root : F.neg(root);\n}\n/**\n * @param Fp - Field implementation.\n * @param elm - Value to square-root.\n * @returns Even square root.\n * @throws If the field lacks oddness checks or the square root does not exist. {@link Error}\n * @example\n * Select the even square root when two roots exist.\n *\n * ```ts\n * import { Field, FpSqrtEven } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const root = FpSqrtEven(Fp, 4n);\n * ```\n */\nexport function FpSqrtEven(Fp, elm) {\n const F = Fp;\n if (!F.isOdd)\n throw new Error(\"Field doesn't have isOdd\");\n const root = F.sqrt(elm);\n return F.isOdd(root) ? F.neg(root) : root;\n}\n/**\n * Returns total number of bytes consumed by the field element.\n * For example, 32 bytes for usual 256-bit weierstrass curve.\n * @param fieldOrder - number of field elements, usually CURVE.n. Callers are expected to pass an\n * order greater than 1.\n * @returns byte length of field\n * @throws If the field order is not a bigint. {@link Error}\n * @example\n * Read the fixed-width byte length of one field.\n *\n * ```ts\n * getFieldBytesLength(255n);\n * ```\n */\nexport function getFieldBytesLength(fieldOrder) {\n if (typeof fieldOrder !== 'bigint')\n throw new Error('field order must be bigint');\n // Valid field elements are in 0..ORDER-1, so ORDER <= 1 would make the encoded range degenerate.\n if (fieldOrder <= _1n)\n throw new Error('field order must be greater than 1');\n // Valid field elements are < ORDER, so the maximal encoded element is ORDER - 1.\n const bitLength = bitLen(fieldOrder - _1n);\n return Math.ceil(bitLength / 8);\n}\n/**\n * Returns minimal amount of bytes that can be safely reduced\n * by field order.\n * Should be 2^-128 for 128-bit curve such as P256.\n * This is the reduction / modulo-bias lower bound; higher-level helpers may still impose a larger\n * absolute floor for policy reasons.\n * @param fieldOrder - number of field elements greater than 1, usually CURVE.n.\n * @returns byte length of target hash\n * @throws If the field order is invalid. {@link Error}\n * @example\n * Compute the minimum hash length needed for field reduction.\n *\n * ```ts\n * getMinHashLength(255n);\n * ```\n */\nexport function getMinHashLength(fieldOrder) {\n const length = getFieldBytesLength(fieldOrder);\n return length + Math.ceil(length / 2);\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF\n * and convert them into private scalar, with the modulo bias being negligible.\n * Needs at least 48 bytes of input for 32-byte private key. The implementation also keeps a hard\n * 16-byte minimum even when `getMinHashLength(...)` is smaller, so toy-small inputs do not look\n * accidentally acceptable for real scalar derivation.\n * See {@link https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/ | Kudelski's modulo-bias guide},\n * {@link https://csrc.nist.gov/publications/detail/fips/186/5/final | FIPS 186-5 appendix A.2}, and\n * {@link https://www.rfc-editor.org/rfc/rfc9380#section-5 | RFC 9380 section 5}. Unlike RFC 9380\n * `hash_to_field`, this helper intentionally maps into the non-zero private-scalar range `1..n-1`.\n * @param key - Uniform input bytes.\n * @param fieldOrder - Size of subgroup.\n * @param isLE - interpret hash bytes as LE num\n * @returns valid private scalar\n * @throws If the hash length or field order is invalid for scalar reduction. {@link Error}\n * @example\n * Map hash output into a private scalar range.\n *\n * ```ts\n * mapHashToField(new Uint8Array(48).fill(1), 255n);\n * ```\n */\nexport function mapHashToField(key, fieldOrder, isLE = false) {\n abytes(key);\n const len = key.length;\n const fieldLen = getFieldBytesLength(fieldOrder);\n const minLen = Math.max(getMinHashLength(fieldOrder), 16);\n // No toy-small inputs: the helper is for real scalar derivation, not tiny test curves. No huge\n // inputs: easier to reason about JS timing / allocation behavior.\n if (len < minLen || len > 1024)\n throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);\n const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);\n // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n const reduced = mod(num, fieldOrder - _1n) + _1n;\n return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);\n}\n//# sourceMappingURL=modular.js.map","/**\n * Methods for elliptic curve multiplication by scalars.\n * Contains wNAF, pippenger.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { bitLen, bitMask, validateObject } from \"../utils.js\";\nimport { Field, FpInvertBatch, validateField } from \"./modular.js\";\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\n/**\n * Validates the static surface of a point constructor.\n * This is only a cheap sanity check for the constructor hooks and fields consumed by generic\n * factories; it does not certify `BASE`/`ZERO` semantics or prove the curve implementation itself.\n * @param Point - Runtime point constructor.\n * @throws On missing constructor hooks or malformed field metadata. {@link TypeError}\n * @example\n * Check that one point constructor exposes the static hooks generic helpers need.\n *\n * ```ts\n * import { ed25519 } from '@noble/curves/ed25519.js';\n * import { validatePointCons } from '@noble/curves/abstract/curve.js';\n * validatePointCons(ed25519.Point);\n * ```\n */\nexport function validatePointCons(Point) {\n const pc = Point;\n if (typeof pc !== 'function')\n throw new TypeError('Point must be a constructor');\n // validateObject only accepts plain objects, so copy the constructor statics into one bag first.\n validateObject({\n Fp: pc.Fp,\n Fn: pc.Fn,\n fromAffine: pc.fromAffine,\n fromBytes: pc.fromBytes,\n fromHex: pc.fromHex,\n }, {\n Fp: 'object',\n Fn: 'object',\n fromAffine: 'function',\n fromBytes: 'function',\n fromHex: 'function',\n });\n validateField(pc.Fp);\n validateField(pc.Fn);\n}\n/**\n * Computes both candidates first, but the final selection still branches on `condition`, so this\n * is not a strict constant-time CMOV primitive.\n * @param condition - Whether to negate the point.\n * @param item - Point-like value.\n * @returns Original or negated value.\n * @example\n * Keep the point or return its negation based on one boolean branch.\n *\n * ```ts\n * import { negateCt } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const maybeNegated = negateCt(true, p256.Point.BASE);\n * ```\n */\nexport function negateCt(condition, item) {\n const neg = item.negate();\n return condition ? neg : item;\n}\n/**\n * Takes a bunch of Projective Points but executes only one\n * inversion on all of them. Inversion is very slow operation,\n * so this improves performance massively.\n * Optimization: converts a list of projective points to a list of identical points with Z=1.\n * Input points are left unchanged; the normalized points are returned as fresh instances.\n * @param c - Point constructor.\n * @param points - Projective points.\n * @returns Fresh projective points reconstructed from normalized affine coordinates.\n * @example\n * Batch-normalize projective points with a single shared inversion.\n *\n * ```ts\n * import { normalizeZ } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const points = normalizeZ(p256.Point, [p256.Point.BASE, p256.Point.BASE.double()]);\n * ```\n */\nexport function normalizeZ(c, points) {\n const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));\n return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));\n}\nfunction validateW(W, bits) {\n if (!Number.isSafeInteger(W) || W <= 0 || W > bits)\n throw new Error('invalid window size, expected [1..' + bits + '], got W=' + W);\n}\nfunction calcWOpts(W, scalarBits) {\n validateW(W, scalarBits);\n const windows = Math.ceil(scalarBits / W) + 1; // W=8 33. Not 32, because we skip zero\n const windowSize = 2 ** (W - 1); // W=8 128. Not 256, because we skip zero\n const maxNumber = 2 ** W; // W=8 256\n const mask = bitMask(W); // W=8 255 == mask 0b11111111\n const shiftBy = BigInt(W); // W=8 8\n return { windows, windowSize, mask, maxNumber, shiftBy };\n}\nfunction calcOffsets(n, window, wOpts) {\n const { windowSize, mask, maxNumber, shiftBy } = wOpts;\n let wbits = Number(n & mask); // extract W bits.\n let nextN = n >> shiftBy; // shift number by W bits.\n // What actually happens here:\n // const highestBit = Number(mask ^ (mask >> 1n));\n // let wbits2 = wbits - 1; // skip zero\n // if (wbits2 & highestBit) { wbits2 ^= Number(mask); // (~);\n // split if bits > max: +224 => 256-32\n if (wbits > windowSize) {\n // we skip zero, which means instead of `>= size-1`, we do `> size`\n wbits -= maxNumber; // -32, can be maxNumber - wbits, but then we need to set isNeg here.\n nextN += _1n; // +256 (carry)\n }\n const offsetStart = window * windowSize;\n const offset = offsetStart + Math.abs(wbits) - 1; // -1 because we skip zero; ignore when isZero\n const isZero = wbits === 0; // is current window slice a 0?\n const isNeg = wbits < 0; // is current window slice negative?\n const isNegF = window % 2 !== 0; // fake branch noise only\n const offsetF = offsetStart; // fake branch noise only\n return { nextN, offset, isZero, isNeg, isNegF, offsetF };\n}\nfunction validateMSMPoints(points, c) {\n if (!Array.isArray(points))\n throw new Error('array expected');\n points.forEach((p, i) => {\n if (!(p instanceof c))\n throw new Error('invalid point at index ' + i);\n });\n}\nfunction validateMSMScalars(scalars, field) {\n if (!Array.isArray(scalars))\n throw new Error('array of scalars expected');\n scalars.forEach((s, i) => {\n if (!field.isValid(s))\n throw new Error('invalid scalar at index ' + i);\n });\n}\n// Since points in different groups cannot be equal (different object constructor),\n// we can have single place to store precomputes.\n// Allows to make points frozen / immutable.\nconst pointPrecomputes = new WeakMap();\nconst pointWindowSizes = new WeakMap();\nfunction getW(P) {\n // To disable precomputes:\n // return 1;\n // `1` is also the uncached sentinel: use the ladder / non-precomputed path.\n return pointWindowSizes.get(P) || 1;\n}\nfunction assert0(n) {\n // Internal invariant: a non-zero remainder here means the wNAF window decomposition or loop\n // count is inconsistent, not that the original caller provided a bad scalar.\n if (n !== _0n)\n throw new Error('invalid wNAF');\n}\n/**\n * Elliptic curve multiplication of Point by scalar. Fragile.\n * Table generation takes **30MB of ram and 10ms on high-end CPU**,\n * but may take much longer on slow devices. Actual generation will happen on\n * first call of `multiply()`. By default, `BASE` point is precomputed.\n *\n * Scalars should always be less than curve order: this should be checked inside of a curve itself.\n * Creates precomputation tables for fast multiplication:\n * - private scalar is split by fixed size windows of W bits\n * - every window point is collected from window's table & added to accumulator\n * - since windows are different, same point inside tables won't be accessed more than once per calc\n * - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)\n * - +1 window is neccessary for wNAF\n * - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication\n *\n * TODO: research returning a 2d JS array of windows instead of a single window.\n * This would allow windows to be in different memory locations.\n * @param Point - Point constructor.\n * @param bits - Scalar bit length.\n * @example\n * Elliptic curve multiplication of Point by scalar.\n *\n * ```ts\n * import { wNAF } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const ladder = new wNAF(p256.Point, p256.Point.Fn.BITS);\n * ```\n */\nexport class wNAF {\n BASE;\n ZERO;\n Fn;\n bits;\n // Parametrized with a given Point class (not individual point)\n constructor(Point, bits) {\n this.BASE = Point.BASE;\n this.ZERO = Point.ZERO;\n this.Fn = Point.Fn;\n this.bits = bits;\n }\n // non-const time multiplication ladder\n _unsafeLadder(elm, n, p = this.ZERO) {\n let d = elm;\n while (n > _0n) {\n if (n & _1n)\n p = p.add(d);\n d = d.double();\n n >>= _1n;\n }\n return p;\n }\n /**\n * Creates a wNAF precomputation window. Used for caching.\n * Default window size is set by `utils.precompute()` and is equal to 8.\n * Number of precomputed points depends on the curve size:\n * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:\n * - 𝑊 is the window size\n * - 𝑛 is the bitlength of the curve order.\n * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.\n * @param point - Point instance\n * @param W - window size\n * @returns precomputed point tables flattened to a single array\n */\n precomputeWindow(point, W) {\n const { windows, windowSize } = calcWOpts(W, this.bits);\n const points = [];\n let p = point;\n let base = p;\n for (let window = 0; window < windows; window++) {\n base = p;\n points.push(base);\n // i=1, bc we skip 0\n for (let i = 1; i < windowSize; i++) {\n base = base.add(p);\n points.push(base);\n }\n p = base.double();\n }\n return points;\n }\n /**\n * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.\n * More compact implementation:\n * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541\n * @returns real and fake (for const-time) points\n */\n wNAF(W, precomputes, n) {\n // Scalar should be smaller than field order\n if (!this.Fn.isValid(n))\n throw new Error('invalid scalar');\n // Accumulators\n let p = this.ZERO;\n let f = this.BASE;\n // This code was first written with assumption that 'f' and 'p' will never be infinity point:\n // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,\n // there is negate now: it is possible that negated element from low value\n // would be the same as high element, which will create carry into next window.\n // It's not obvious how this can fail, but still worth investigating later.\n const wo = calcWOpts(W, this.bits);\n for (let window = 0; window < wo.windows; window++) {\n // (n === _0n) is handled and not early-exited. isEven and offsetF are used for noise\n const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);\n n = nextN;\n if (isZero) {\n // bits are 0: add garbage to fake point\n // Important part for const-time getPublicKey: add random \"noise\" point to f.\n f = f.add(negateCt(isNegF, precomputes[offsetF]));\n }\n else {\n // bits are 1: add to result point\n p = p.add(negateCt(isNeg, precomputes[offset]));\n }\n }\n assert0(n);\n // Return both real and fake points so JIT keeps the noise path alive.\n // Known caveat: negate/carry interactions can still drive `f` to infinity even when `p` is not,\n // which weakens the noise path and leaves this only \"less const-time\" by about one bigint mul.\n return { p, f };\n }\n /**\n * Implements unsafe EC multiplication using precomputed tables\n * and w-ary non-adjacent form.\n * @param acc - accumulator point to add result of multiplication\n * @returns point\n */\n wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {\n const wo = calcWOpts(W, this.bits);\n for (let window = 0; window < wo.windows; window++) {\n if (n === _0n)\n break; // Early-exit, skip 0 value\n const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);\n n = nextN;\n if (isZero) {\n // Window bits are 0: skip processing.\n // Move to next window.\n continue;\n }\n else {\n const item = precomputes[offset];\n acc = acc.add(isNeg ? item.negate() : item); // Re-using acc allows to save adds in MSM\n }\n }\n assert0(n);\n return acc;\n }\n getPrecomputes(W, point, transform) {\n // Cache key is only point identity plus the remembered window size; callers must not reuse the\n // same point with incompatible `transform(...)` layouts and expect a separate cache entry.\n let comp = pointPrecomputes.get(point);\n if (!comp) {\n comp = this.precomputeWindow(point, W);\n if (W !== 1) {\n // Doing transform outside of if brings 15% perf hit\n if (typeof transform === 'function')\n comp = transform(comp);\n pointPrecomputes.set(point, comp);\n }\n }\n return comp;\n }\n cached(point, scalar, transform) {\n const W = getW(point);\n return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);\n }\n unsafe(point, scalar, transform, prev) {\n const W = getW(point);\n if (W === 1)\n return this._unsafeLadder(point, scalar, prev); // For W=1 ladder is ~x2 faster\n return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);\n }\n // We calculate precomputes for elliptic curve point multiplication\n // using windowed method. This specifies window size and\n // stores precomputed values. Usually only base point would be precomputed.\n createCache(P, W) {\n validateW(W, this.bits);\n pointWindowSizes.set(P, W);\n pointPrecomputes.delete(P);\n }\n hasCache(elm) {\n return getW(elm) !== 1;\n }\n}\n/**\n * Endomorphism-specific multiplication for Koblitz curves.\n * Cost: 128 dbl, 0-256 adds.\n * @param Point - Point constructor.\n * @param point - Input point.\n * @param k1 - First non-negative absolute scalar chunk.\n * @param k2 - Second non-negative absolute scalar chunk.\n * @returns Partial multiplication results.\n * @example\n * Endomorphism-specific multiplication for Koblitz curves.\n *\n * ```ts\n * import { mulEndoUnsafe } from '@noble/curves/abstract/curve.js';\n * import { secp256k1 } from '@noble/curves/secp256k1.js';\n * const parts = mulEndoUnsafe(secp256k1.Point, secp256k1.Point.BASE, 3n, 5n);\n * ```\n */\nexport function mulEndoUnsafe(Point, point, k1, k2) {\n let acc = point;\n let p1 = Point.ZERO;\n let p2 = Point.ZERO;\n while (k1 > _0n || k2 > _0n) {\n if (k1 & _1n)\n p1 = p1.add(acc);\n if (k2 & _1n)\n p2 = p2.add(acc);\n acc = acc.double();\n k1 >>= _1n;\n k2 >>= _1n;\n }\n return { p1, p2 };\n}\n/**\n * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * 30x faster vs naive addition on L=4096, 10x faster than precomputes.\n * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.\n * Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.\n * @param c - Curve Point constructor\n * @param points - array of L curve points\n * @param scalars - array of L scalars (aka secret keys / bigints)\n * @returns MSM result point. Empty input is accepted and returns the identity.\n * @throws If the point set, scalar set, or MSM sizing is invalid. {@link Error}\n * @example\n * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n *\n * ```ts\n * import { pippenger } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const point = pippenger(p256.Point, [p256.Point.BASE, p256.Point.BASE.double()], [2n, 3n]);\n * ```\n */\nexport function pippenger(c, points, scalars) {\n // If we split scalars by some window (let's say 8 bits), every chunk will only\n // take 256 buckets even if there are 4096 scalars, also re-uses double.\n // TODO:\n // - https://eprint.iacr.org/2024/750.pdf\n // - https://tches.iacr.org/index.php/TCHES/article/view/10287\n // 0 is accepted in scalars\n const fieldN = c.Fn;\n validateMSMPoints(points, c);\n validateMSMScalars(scalars, fieldN);\n const plength = points.length;\n const slength = scalars.length;\n if (plength !== slength)\n throw new Error('arrays of points and scalars must have equal length');\n // if (plength === 0) throw new Error('array must be of length >= 2');\n const zero = c.ZERO;\n const wbits = bitLen(BigInt(plength));\n let windowSize = 1; // bits\n if (wbits > 12)\n windowSize = wbits - 3;\n else if (wbits > 4)\n windowSize = wbits - 2;\n else if (wbits > 0)\n windowSize = 2;\n const MASK = bitMask(windowSize);\n const buckets = new Array(Number(MASK) + 1).fill(zero); // +1 for zero array\n const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;\n let sum = zero;\n for (let i = lastBits; i >= 0; i -= windowSize) {\n buckets.fill(zero);\n for (let j = 0; j < slength; j++) {\n const scalar = scalars[j];\n const wbits = Number((scalar >> BigInt(i)) & MASK);\n buckets[wbits] = buckets[wbits].add(points[j]);\n }\n let resI = zero; // not using this will do small speed-up, but will lose ct\n // Skip first bucket, because it is zero\n for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {\n sumI = sumI.add(buckets[j]);\n resI = resI.add(sumI);\n }\n sum = sum.add(resI);\n if (i !== 0)\n for (let j = 0; j < windowSize; j++)\n sum = sum.double();\n }\n return sum;\n}\n/**\n * Precomputed multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * @param c - Curve Point constructor\n * @param points - array of L curve points\n * @param windowSize - Precompute window size.\n * @returns Function which multiplies points with scalars. The closure accepts\n * `scalars.length <= points.length`, and omitted trailing scalars are treated as zero.\n * @throws If the point set or precompute window is invalid. {@link Error}\n * @example\n * Precomputed multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n *\n * ```ts\n * import { precomputeMSMUnsafe } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const msm = precomputeMSMUnsafe(p256.Point, [p256.Point.BASE], 4);\n * const point = msm([3n]);\n * ```\n */\nexport function precomputeMSMUnsafe(c, points, windowSize) {\n /**\n * Performance Analysis of Window-based Precomputation\n *\n * Base Case (256-bit scalar, 8-bit window):\n * - Standard precomputation requires:\n * - 31 additions per scalar × 256 scalars = 7,936 ops\n * - Plus 255 summary additions = 8,191 total ops\n * Note: Summary additions can be optimized via accumulator\n *\n * Chunked Precomputation Analysis:\n * - Using 32 chunks requires:\n * - 255 additions per chunk\n * - 256 doublings\n * - Total: (255 × 32) + 256 = 8,416 ops\n *\n * Memory Usage Comparison:\n * Window Size | Standard Points | Chunked Points\n * ------------|-----------------|---------------\n * 4-bit | 520 | 15\n * 8-bit | 4,224 | 255\n * 10-bit | 13,824 | 1,023\n * 16-bit | 557,056 | 65,535\n *\n * Key Advantages:\n * 1. Enables larger window sizes due to reduced memory overhead\n * 2. More efficient for smaller scalar counts:\n * - 16 chunks: (16 × 255) + 256 = 4,336 ops\n * - ~2x faster than standard 8,191 ops\n *\n * Limitations:\n * - Not suitable for plain precomputes (requires 256 constant doublings)\n * - Performance degrades with larger scalar counts:\n * - Optimal for ~256 scalars\n * - Less efficient for 4096+ scalars (Pippenger preferred)\n */\n const fieldN = c.Fn;\n validateW(windowSize, fieldN.BITS);\n validateMSMPoints(points, c);\n const zero = c.ZERO;\n const tableSize = 2 ** windowSize - 1; // table size (without zero)\n const chunks = Math.ceil(fieldN.BITS / windowSize); // chunks of item\n const MASK = bitMask(windowSize);\n const tables = points.map((p) => {\n const res = [];\n for (let i = 0, acc = p; i < tableSize; i++) {\n res.push(acc);\n acc = acc.add(p);\n }\n return res;\n });\n return (scalars) => {\n validateMSMScalars(scalars, fieldN);\n if (scalars.length > points.length)\n throw new Error('array of scalars must be smaller than array of points');\n let res = zero;\n for (let i = 0; i < chunks; i++) {\n // No need to double if accumulator is still zero.\n if (res !== zero)\n for (let j = 0; j < windowSize; j++)\n res = res.double();\n const shiftBy = BigInt(chunks * windowSize - (i + 1) * windowSize);\n for (let j = 0; j < scalars.length; j++) {\n const n = scalars[j];\n const curr = Number((n >> shiftBy) & MASK);\n if (!curr)\n continue; // skip zero scalars chunks\n res = res.add(tables[j][curr - 1]);\n }\n }\n return res;\n };\n}\nfunction createField(order, field, isLE) {\n if (field) {\n // Reuse supplied field overrides as-is; `isLE` only affects freshly constructed fallback\n // fields, and validateField() below only checks the arithmetic subset, not full byte/cmov\n // behavior.\n if (field.ORDER !== order)\n throw new Error('Field.ORDER must match order: Fp == p, Fn == n');\n validateField(field);\n return field;\n }\n else {\n return Field(order, { isLE });\n }\n}\n/**\n * Validates basic CURVE shape and field membership, then creates fields.\n * This does not prove that the generator is on-curve, that subgroup/order data are consistent, or\n * that the curve equation itself is otherwise sane.\n * @param type - Curve family.\n * @param CURVE - Curve parameters.\n * @param curveOpts - Optional field overrides:\n * - `Fp` (optional): Optional base-field override.\n * - `Fn` (optional): Optional scalar-field override.\n * @param FpFnLE - Whether field encoding is little-endian.\n * @returns Frozen curve parameters and fields.\n * @throws If the curve parameters or field overrides are invalid. {@link Error}\n * @example\n * Build curve fields from raw constants before constructing a curve instance.\n *\n * ```ts\n * const curve = createCurveFields('weierstrass', {\n * p: 17n,\n * n: 19n,\n * h: 1n,\n * a: 2n,\n * b: 2n,\n * Gx: 5n,\n * Gy: 1n,\n * });\n * ```\n */\nexport function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {\n if (FpFnLE === undefined)\n FpFnLE = type === 'edwards';\n if (!CURVE || typeof CURVE !== 'object')\n throw new Error(`expected valid ${type} CURVE object`);\n for (const p of ['p', 'n', 'h']) {\n const val = CURVE[p];\n if (!(typeof val === 'bigint' && val > _0n))\n throw new Error(`CURVE.${p} must be positive bigint`);\n }\n const Fp = createField(CURVE.p, curveOpts.Fp, FpFnLE);\n const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);\n const _b = type === 'weierstrass' ? 'b' : 'd';\n const params = ['Gx', 'Gy', 'a', _b];\n for (const p of params) {\n // @ts-ignore\n if (!Fp.isValid(CURVE[p]))\n throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);\n }\n CURVE = Object.freeze(Object.assign({}, CURVE));\n return { CURVE, Fp, Fn };\n}\n/**\n * @param randomSecretKey - Secret-key generator.\n * @param getPublicKey - Public-key derivation helper.\n * @returns Keypair generator.\n * @example\n * Build a `keygen()` helper from existing secret-key and public-key primitives.\n *\n * ```ts\n * import { createKeygen } from '@noble/curves/abstract/curve.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const keygen = createKeygen(p256.utils.randomSecretKey, p256.getPublicKey);\n * const pair = keygen();\n * ```\n */\nexport function createKeygen(randomSecretKey, getPublicKey) {\n return function keygen(seed) {\n const secretKey = randomSecretKey(seed);\n return { secretKey, publicKey: getPublicKey(secretKey) };\n };\n}\n//# sourceMappingURL=curve.js.map","/**\n * HMAC: RFC2104 message authentication code.\n * @module\n */\nimport { abytes, aexists, ahash, aoutput, clean, } from \"./utils.js\";\n/**\n * Internal class for HMAC.\n * Accepts any byte key, although RFC 2104 §3 recommends keys at least\n * `HashLen` bytes long.\n */\nexport class _HMAC {\n oHash;\n iHash;\n blockLen;\n outputLen;\n canXOF = false;\n finished = false;\n destroyed = false;\n constructor(hash, key) {\n ahash(hash);\n abytes(key, undefined, 'key');\n this.iHash = hash.create();\n if (typeof this.iHash.update !== 'function')\n throw new Error('Expected instance of class which extends utils.Hash');\n this.blockLen = this.iHash.blockLen;\n this.outputLen = this.iHash.outputLen;\n const blockLen = this.blockLen;\n const pad = new Uint8Array(blockLen);\n // blockLen can be bigger than outputLen\n pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);\n for (let i = 0; i < pad.length; i++)\n pad[i] ^= 0x36;\n this.iHash.update(pad);\n // By doing update (processing of the first block) of the outer hash here,\n // we can re-use it between multiple calls via clone.\n this.oHash = hash.create();\n // Undo internal XOR && apply outer XOR\n for (let i = 0; i < pad.length; i++)\n pad[i] ^= 0x36 ^ 0x5c;\n this.oHash.update(pad);\n clean(pad);\n }\n update(buf) {\n aexists(this);\n this.iHash.update(buf);\n return this;\n }\n digestInto(out) {\n aexists(this);\n aoutput(out, this);\n this.finished = true;\n const buf = out.subarray(0, this.outputLen);\n // Reuse the first outputLen bytes for the inner digest; the outer hash consumes them before\n // overwriting that same prefix with the final tag, leaving any oversized tail untouched.\n this.iHash.digestInto(buf);\n this.oHash.update(buf);\n this.oHash.digestInto(buf);\n this.destroy();\n }\n digest() {\n const out = new Uint8Array(this.oHash.outputLen);\n this.digestInto(out);\n return out;\n }\n _cloneInto(to) {\n // Create new instance without calling constructor since the key\n // is already in state and we don't know it.\n to ||= Object.create(Object.getPrototypeOf(this), {});\n const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;\n to = to;\n to.finished = finished;\n to.destroyed = destroyed;\n to.blockLen = blockLen;\n to.outputLen = outputLen;\n to.oHash = oHash._cloneInto(to.oHash);\n to.iHash = iHash._cloneInto(to.iHash);\n return to;\n }\n clone() {\n return this._cloneInto();\n }\n destroy() {\n this.destroyed = true;\n this.oHash.destroy();\n this.iHash.destroy();\n }\n}\nexport const hmac = /* @__PURE__ */ (() => {\n const hmac_ = ((hash, key, message) => new _HMAC(hash, key).update(message).digest());\n hmac_.create = (hash, key) => new _HMAC(hash, key);\n return hmac_;\n})();\n//# sourceMappingURL=hmac.js.map","/**\n * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.\n *\n * ### Design rationale for types\n *\n * * Interaction between classes from different curves should fail:\n * `k256.Point.BASE.add(p256.Point.BASE)`\n * * For this purpose we want to use `instanceof` operator, which is fast and works during runtime\n * * Different calls of `curve()` would return different classes -\n * `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,\n * it won't affect others\n *\n * TypeScript can't infer types for classes created inside a function. Classes is one instance\n * of nominative types in TypeScript and interfaces only check for shape, so it's hard to create\n * unique type for every function call.\n *\n * We can use generic types via some param, like curve opts, but that would:\n * 1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)\n * which is hard to debug.\n * 2. Params can be generic and we can't enforce them to be constant value:\n * if somebody creates curve from non-constant params,\n * it would be allowed to interact with other curves with non-constant params\n *\n * @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { hmac as nobleHmac } from '@noble/hashes/hmac.js';\nimport { ahash } from '@noble/hashes/utils.js';\nimport { abignumber, abool, abytes, aInRange, asafenumber, bitLen, bitMask, bytesToHex, bytesToNumberBE, concatBytes, createHmacDrbg, hexToBytes, isBytes, numberToHexUnpadded, validateObject, randomBytes as wcRandomBytes, } from \"../utils.js\";\nimport { createCurveFields, createKeygen, mulEndoUnsafe, negateCt, normalizeZ, wNAF, } from \"./curve.js\";\nimport { FpInvertBatch, FpIsSquare, getMinHashLength, mapHashToField, validateField, } from \"./modular.js\";\n// We construct the basis so `den` is always positive and equals `n`,\n// but the `num` sign depends on the basis, not on the secret value.\n// Exact half-way cases round away from zero, which keeps the split symmetric\n// around the reduced-basis boundaries used by endomorphism decomposition.\nconst divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n) / den;\n/** Splits scalar for GLV endomorphism. */\nexport function _splitEndoScalar(k, basis, n) {\n // Split scalar into two such that part is ~half bits: `abs(part) < sqrt(N)`\n // Since part can be negative, we need to do this on point.\n // Callers must provide a reduced GLV basis whose vectors satisfy\n // `a + b * lambda ≡ 0 (mod n)`; this helper only sees the basis and `n`.\n // Reject unreduced scalars instead of silently treating them mod n.\n aInRange('scalar', k, _0n, n);\n // TODO: verifyScalar function which consumes lambda\n const [[a1, b1], [a2, b2]] = basis;\n const c1 = divNearest(b2 * k, n);\n const c2 = divNearest(-b1 * k, n);\n // |k1|/|k2| is < sqrt(N), but can be negative.\n // If we do `k1 mod N`, we'll get big scalar (`> sqrt(N)`): so, we do cheaper negation instead.\n let k1 = k - c1 * a1 - c2 * a2;\n let k2 = -c1 * b1 - c2 * b2;\n const k1neg = k1 < _0n;\n const k2neg = k2 < _0n;\n if (k1neg)\n k1 = -k1;\n if (k2neg)\n k2 = -k2;\n // Double check that resulting scalar less than half bits of N: otherwise wNAF will fail.\n // This should only happen on wrong bases.\n // Also, the math inside is complex enough that this guard is worth keeping.\n const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n; // Half bits of N\n if (k1 < _0n || k1 >= MAX_NUM || k2 < _0n || k2 >= MAX_NUM) {\n throw new Error('splitScalar (endomorphism): failed for k');\n }\n return { k1neg, k1, k2neg, k2 };\n}\nfunction validateSigFormat(format) {\n if (!['compact', 'recovered', 'der'].includes(format))\n throw new Error('Signature format must be \"compact\", \"recovered\", or \"der\"');\n return format;\n}\nfunction validateSigOpts(opts, def) {\n validateObject(opts);\n const optsn = {};\n // Normalize only the declared option subset from `def`; unknown keys are\n // intentionally ignored so shared / superset option bags stay valid here too.\n // `extraEntropy` stays an opaque payload until the signing path consumes it.\n for (let optName of Object.keys(def)) {\n // @ts-ignore\n optsn[optName] = opts[optName] === undefined ? def[optName] : opts[optName];\n }\n abool(optsn.lowS, 'lowS');\n abool(optsn.prehash, 'prehash');\n if (optsn.format !== undefined)\n validateSigFormat(optsn.format);\n return optsn;\n}\n/**\n * @param m - Error message.\n * @example\n * Throw a DER-specific error when signature parsing encounters invalid bytes.\n *\n * ```ts\n * new DERErr('bad der');\n * ```\n */\nexport class DERErr extends Error {\n constructor(m = '') {\n super(m);\n }\n}\n/**\n * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:\n *\n * [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]\n *\n * Docs: {@link https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/ | Let's Encrypt ASN.1 guide} and\n * {@link https://luca.ntop.org/Teaching/Appunti/asn1.html | Luca Deri's ASN.1 notes}.\n * @example\n * ASN.1 DER encoding utilities.\n *\n * ```ts\n * const der = DER.hexFromSig({ r: 1n, s: 2n });\n * ```\n */\nexport const DER = {\n // asn.1 DER encoding utils\n Err: DERErr,\n // Basic building block is TLV (Tag-Length-Value)\n _tlv: {\n encode: (tag, data) => {\n const { Err: E } = DER;\n asafenumber(tag, 'tag');\n if (tag < 0 || tag > 255)\n throw new E('tlv.encode: wrong tag');\n if (typeof data !== 'string')\n throw new TypeError('\"data\" expected string, got type=' + typeof data);\n // Internal helper: callers hand this already-validated hex payload, so we only enforce\n // byte alignment here instead of re-validating every nibble.\n if (data.length & 1)\n throw new E('tlv.encode: unpadded data');\n const dataLen = data.length / 2;\n const len = numberToHexUnpadded(dataLen);\n if ((len.length / 2) & 0b1000_0000)\n throw new E('tlv.encode: long form length too big');\n // length of length with long form flag\n const lenLen = dataLen > 127 ? numberToHexUnpadded((len.length / 2) | 0b1000_0000) : '';\n const t = numberToHexUnpadded(tag);\n return t + lenLen + len + data;\n },\n // v - value, l - left bytes (unparsed)\n decode(tag, data) {\n const { Err: E } = DER;\n data = abytes(data, undefined, 'DER data');\n let pos = 0;\n if (tag < 0 || tag > 255)\n throw new E('tlv.encode: wrong tag');\n if (data.length < 2 || data[pos++] !== tag)\n throw new E('tlv.decode: wrong tlv');\n const first = data[pos++];\n // First bit of first length byte is the short/long form flag.\n const isLong = !!(first & 0b1000_0000);\n let length = 0;\n if (!isLong)\n length = first;\n else {\n // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]\n const lenLen = first & 0b0111_1111;\n if (!lenLen)\n throw new E('tlv.decode(long): indefinite length not supported');\n // This would overflow u32 in JS.\n if (lenLen > 4)\n throw new E('tlv.decode(long): byte length is too big');\n const lengthBytes = data.subarray(pos, pos + lenLen);\n if (lengthBytes.length !== lenLen)\n throw new E('tlv.decode: length bytes not complete');\n if (lengthBytes[0] === 0)\n throw new E('tlv.decode(long): zero leftmost byte');\n for (const b of lengthBytes)\n length = (length << 8) | b;\n pos += lenLen;\n if (length < 128)\n throw new E('tlv.decode(long): not minimal encoding');\n }\n const v = data.subarray(pos, pos + length);\n if (v.length !== length)\n throw new E('tlv.decode: wrong value length');\n return { v, l: data.subarray(pos + length) };\n },\n },\n // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,\n // since we always use positive integers here. It must always be empty:\n // - add zero byte if exists\n // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)\n _int: {\n encode(num) {\n const { Err: E } = DER;\n abignumber(num);\n if (num < _0n)\n throw new E('integer: negative integers are not allowed');\n let hex = numberToHexUnpadded(num);\n // Pad with zero byte if negative flag is present\n if (Number.parseInt(hex[0], 16) & 0b1000)\n hex = '00' + hex;\n if (hex.length & 1)\n throw new E('unexpected DER parsing assertion: unpadded hex');\n return hex;\n },\n decode(data) {\n const { Err: E } = DER;\n if (data.length < 1)\n throw new E('invalid signature integer: empty');\n if (data[0] & 0b1000_0000)\n throw new E('invalid signature integer: negative');\n // Single-byte zero `00` is the canonical DER INTEGER encoding for zero.\n if (data.length > 1 && data[0] === 0x00 && !(data[1] & 0b1000_0000))\n throw new E('invalid signature integer: unnecessary leading zero');\n return bytesToNumberBE(data);\n },\n },\n toSig(bytes) {\n // parse DER signature\n const { Err: E, _int: int, _tlv: tlv } = DER;\n const data = abytes(bytes, undefined, 'signature');\n const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);\n if (seqLeftBytes.length)\n throw new E('invalid signature: left bytes after parsing');\n const { v: rBytes, l: rLeftBytes } = tlv.decode(0x02, seqBytes);\n const { v: sBytes, l: sLeftBytes } = tlv.decode(0x02, rLeftBytes);\n if (sLeftBytes.length)\n throw new E('invalid signature: left bytes after parsing');\n return { r: int.decode(rBytes), s: int.decode(sBytes) };\n },\n hexFromSig(sig) {\n const { _tlv: tlv, _int: int } = DER;\n const rs = tlv.encode(0x02, int.encode(sig.r));\n const ss = tlv.encode(0x02, int.encode(sig.s));\n const seq = rs + ss;\n return tlv.encode(0x30, seq);\n },\n};\nObject.freeze(DER._tlv);\nObject.freeze(DER._int);\nObject.freeze(DER);\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _3n = /* @__PURE__ */ BigInt(3), _4n = /* @__PURE__ */ BigInt(4);\n/**\n * Creates weierstrass Point constructor, based on specified curve options.\n *\n * See {@link WeierstrassOpts}.\n * @param params - Curve parameters. See {@link WeierstrassOpts}.\n * @param extraOpts - Optional helpers and overrides. See {@link WeierstrassExtraOpts}.\n * @returns Weierstrass point constructor.\n * @throws If the curve parameters, overrides, or point codecs are invalid. {@link Error}\n *\n * @example\n * Construct a point type from explicit Weierstrass curve parameters.\n *\n * ```js\n * const opts = {\n * p: 0xfffffffffffffffffffffffffffffffeffffac73n,\n * n: 0x100000000000000000001b8fa16dfab9aca16b6b3n,\n * h: 1n,\n * a: 0n,\n * b: 7n,\n * Gx: 0x3b4c382ce37aa192a4019e763036f4f5dd4d7ebbn,\n * Gy: 0x938cf935318fdced6bc28286531733c3f03c4feen,\n * };\n * const secp160k1_Point = weierstrass(opts);\n * ```\n */\nexport function weierstrass(params, extraOpts = {}) {\n const validated = createCurveFields('weierstrass', params, extraOpts);\n const Fp = validated.Fp;\n const Fn = validated.Fn;\n let CURVE = validated.CURVE;\n const { h: cofactor, n: CURVE_ORDER } = CURVE;\n validateObject(extraOpts, {}, {\n allowInfinityPoint: 'boolean',\n clearCofactor: 'function',\n isTorsionFree: 'function',\n fromBytes: 'function',\n toBytes: 'function',\n endo: 'object',\n });\n // Snapshot constructor-time flags whose later mutation would otherwise change\n // validity semantics of an already-built point type.\n const { endo, allowInfinityPoint } = extraOpts;\n if (endo) {\n // validateObject(endo, { beta: 'bigint', splitScalar: 'function' });\n if (!Fp.is0(CURVE.a) || typeof endo.beta !== 'bigint' || !Array.isArray(endo.basises)) {\n throw new Error('invalid endo: expected \"beta\": bigint and \"basises\": array');\n }\n }\n const lengths = getWLengths(Fp, Fn);\n function assertCompressionIsSupported() {\n if (!Fp.isOdd)\n throw new Error('compression is not supported: Field does not have .isOdd()');\n }\n // Implements IEEE P1363 point encoding\n function pointToBytes(_c, point, isCompressed) {\n // SEC 1 v2.0 §2.3.3 encodes infinity as the single octet 0x00. Only curves\n // that opt into infinity as a public point value should expose that byte form.\n if (allowInfinityPoint && point.is0())\n return Uint8Array.of(0);\n const { x, y } = point.toAffine();\n const bx = Fp.toBytes(x);\n abool(isCompressed, 'isCompressed');\n if (isCompressed) {\n assertCompressionIsSupported();\n const hasEvenY = !Fp.isOdd(y);\n return concatBytes(pprefix(hasEvenY), bx);\n }\n else {\n return concatBytes(Uint8Array.of(0x04), bx, Fp.toBytes(y));\n }\n }\n function pointFromBytes(bytes) {\n abytes(bytes, undefined, 'Point');\n const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths; // e.g. for 32-byte: 33, 65\n const length = bytes.length;\n const head = bytes[0];\n const tail = bytes.subarray(1);\n if (allowInfinityPoint && length === 1 && head === 0x00)\n return { x: Fp.ZERO, y: Fp.ZERO };\n // SEC 1 v2.0 §2.3.4 decodes 0x00 as infinity, but §3.2.2 public-key validation\n // rejects infinity. We therefore keep 0x00 rejected by default because callers\n // reuse this parser as the strict public-key boundary, and only admit it when\n // the curve explicitly opts into infinity as a public point value. secp256k1\n // crosstests show OpenSSL raw point codecs accept 0x00 too.\n // No actual validation is done here: use .assertValidity()\n if (length === comp && (head === 0x02 || head === 0x03)) {\n const x = Fp.fromBytes(tail);\n if (!Fp.isValid(x))\n throw new Error('bad point: is not on curve, wrong x');\n const y2 = weierstrassEquation(x); // y² = x³ + ax + b\n let y;\n try {\n y = Fp.sqrt(y2); // y = y² ^ (p+1)/4\n }\n catch (sqrtError) {\n const err = sqrtError instanceof Error ? ': ' + sqrtError.message : '';\n throw new Error('bad point: is not on curve, sqrt error' + err);\n }\n assertCompressionIsSupported();\n const evenY = Fp.isOdd(y);\n const evenH = (head & 1) === 1; // ECDSA-specific\n if (evenH !== evenY)\n y = Fp.neg(y);\n return { x, y };\n }\n else if (length === uncomp && head === 0x04) {\n // TODO: more checks\n const L = Fp.BYTES;\n const x = Fp.fromBytes(tail.subarray(0, L));\n const y = Fp.fromBytes(tail.subarray(L, L * 2));\n if (!isValidXY(x, y))\n throw new Error('bad point: is not on curve');\n return { x, y };\n }\n else {\n throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);\n }\n }\n const encodePoint = extraOpts.toBytes === undefined ? pointToBytes : extraOpts.toBytes;\n const decodePoint = extraOpts.fromBytes === undefined ? pointFromBytes : extraOpts.fromBytes;\n function weierstrassEquation(x) {\n const x2 = Fp.sqr(x); // x * x\n const x3 = Fp.mul(x2, x); // x² * x\n return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b); // x³ + a * x + b\n }\n // TODO: move top-level\n /** Checks whether equation holds for given x, y: y² == x³ + ax + b */\n function isValidXY(x, y) {\n const left = Fp.sqr(y); // y²\n const right = weierstrassEquation(x); // x³ + ax + b\n return Fp.eql(left, right);\n }\n // Keep constructor-time generator validation cheap: callers are responsible for supplying the\n // correct prime-order base point, while eager subgroup checks here would slow heavy module imports.\n // Test 1: equation y² = x³ + ax + b should work for generator point.\n if (!isValidXY(CURVE.Gx, CURVE.Gy))\n throw new Error('bad curve params: generator point');\n // Test 2: discriminant Δ part should be non-zero: 4a³ + 27b² != 0.\n // Guarantees curve is genus-1, smooth (non-singular).\n const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);\n const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));\n if (Fp.is0(Fp.add(_4a3, _27b2)))\n throw new Error('bad curve params: a or b');\n /** Asserts coordinate is valid: 0 <= n < Fp.ORDER. */\n function acoord(title, n, banZero = false) {\n if (!Fp.isValid(n) || (banZero && Fp.is0(n)))\n throw new Error(`bad point coordinate ${title}`);\n return n;\n }\n function aprjpoint(other) {\n if (!(other instanceof Point))\n throw new Error('Weierstrass Point expected');\n }\n function splitEndoScalarN(k) {\n if (!endo || !endo.basises)\n throw new Error('no endo');\n return _splitEndoScalar(k, endo.basises, Fn.ORDER);\n }\n function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {\n k2p = new Point(Fp.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);\n k1p = negateCt(k1neg, k1p);\n k2p = negateCt(k2neg, k2p);\n return k1p.add(k2p);\n }\n /**\n * Projective Point works in 3d / projective (homogeneous) coordinates:(X, Y, Z) ∋ (x=X/Z, y=Y/Z).\n * Default Point works in 2d / affine coordinates: (x, y).\n * We're doing calculations in projective, because its operations don't require costly inversion.\n */\n class Point {\n // base / generator point\n static BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);\n // zero / infinity / identity point\n static ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO); // 0, 1, 0\n // math field\n static Fp = Fp;\n // scalar field\n static Fn = Fn;\n X;\n Y;\n Z;\n /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n constructor(X, Y, Z) {\n this.X = acoord('x', X);\n // This is not just about ZERO / infinity: ambient curves can have real\n // finite points with y=0. Those points are 2-torsion, so they cannot lie\n // in the odd prime-order subgroups this point type is meant to represent.\n this.Y = acoord('y', Y, true);\n this.Z = acoord('z', Z);\n Object.freeze(this);\n }\n static CURVE() {\n return CURVE;\n }\n /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n static fromAffine(p) {\n const { x, y } = p || {};\n if (!p || !Fp.isValid(x) || !Fp.isValid(y))\n throw new Error('invalid affine point');\n if (p instanceof Point)\n throw new Error('projective point not allowed');\n // (0, 0) would've produced (0, 0, 1) - instead, we need (0, 1, 0)\n if (Fp.is0(x) && Fp.is0(y))\n return Point.ZERO;\n return new Point(x, y, Fp.ONE);\n }\n static fromBytes(bytes) {\n const P = Point.fromAffine(decodePoint(abytes(bytes, undefined, 'point')));\n P.assertValidity();\n return P;\n }\n static fromHex(hex) {\n return Point.fromBytes(hexToBytes(hex));\n }\n get x() {\n return this.toAffine().x;\n }\n get y() {\n return this.toAffine().y;\n }\n /**\n *\n * @param windowSize\n * @param isLazy - true will defer table computation until the first multiplication\n * @returns\n */\n precompute(windowSize = 8, isLazy = true) {\n wnaf.createCache(this, windowSize);\n if (!isLazy)\n this.multiply(_3n); // random number\n return this;\n }\n // TODO: return `this`\n /** A point on curve is valid if it conforms to equation. */\n assertValidity() {\n const p = this;\n if (p.is0()) {\n // (0, 1, 0) aka ZERO is invalid in most contexts.\n // In BLS, ZERO can be serialized, so we allow it.\n // Keep the accepted infinity encoding canonical: projective-equivalent (X, Y, 0) points\n // like (1, 1, 0) compare equal to ZERO, but only (0, 1, 0) should pass this guard.\n if (extraOpts.allowInfinityPoint && Fp.is0(p.X) && Fp.eql(p.Y, Fp.ONE) && Fp.is0(p.Z))\n return;\n throw new Error('bad point: ZERO');\n }\n // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`\n const { x, y } = p.toAffine();\n if (!Fp.isValid(x) || !Fp.isValid(y))\n throw new Error('bad point: x or y not field elements');\n if (!isValidXY(x, y))\n throw new Error('bad point: equation left != right');\n if (!p.isTorsionFree())\n throw new Error('bad point: not in prime-order subgroup');\n }\n hasEvenY() {\n const { y } = this.toAffine();\n if (!Fp.isOdd)\n throw new Error(\"Field doesn't support isOdd\");\n return !Fp.isOdd(y);\n }\n /** Compare one point to another. */\n equals(other) {\n aprjpoint(other);\n const { X: X1, Y: Y1, Z: Z1 } = this;\n const { X: X2, Y: Y2, Z: Z2 } = other;\n const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));\n const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));\n return U1 && U2;\n }\n /** Flips point to one corresponding to (x, -y) in Affine coordinates. */\n negate() {\n return new Point(this.X, Fp.neg(this.Y), this.Z);\n }\n // Renes-Costello-Batina exception-free doubling formula.\n // There is 30% faster Jacobian formula, but it is not complete.\n // https://eprint.iacr.org/2015/1060, algorithm 3\n // Cost: 8M + 3S + 3*a + 2*b3 + 15add.\n double() {\n const { a, b } = CURVE;\n const b3 = Fp.mul(b, _3n);\n const { X: X1, Y: Y1, Z: Z1 } = this;\n let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n let t0 = Fp.mul(X1, X1); // step 1\n let t1 = Fp.mul(Y1, Y1);\n let t2 = Fp.mul(Z1, Z1);\n let t3 = Fp.mul(X1, Y1);\n t3 = Fp.add(t3, t3); // step 5\n Z3 = Fp.mul(X1, Z1);\n Z3 = Fp.add(Z3, Z3);\n X3 = Fp.mul(a, Z3);\n Y3 = Fp.mul(b3, t2);\n Y3 = Fp.add(X3, Y3); // step 10\n X3 = Fp.sub(t1, Y3);\n Y3 = Fp.add(t1, Y3);\n Y3 = Fp.mul(X3, Y3);\n X3 = Fp.mul(t3, X3);\n Z3 = Fp.mul(b3, Z3); // step 15\n t2 = Fp.mul(a, t2);\n t3 = Fp.sub(t0, t2);\n t3 = Fp.mul(a, t3);\n t3 = Fp.add(t3, Z3);\n Z3 = Fp.add(t0, t0); // step 20\n t0 = Fp.add(Z3, t0);\n t0 = Fp.add(t0, t2);\n t0 = Fp.mul(t0, t3);\n Y3 = Fp.add(Y3, t0);\n t2 = Fp.mul(Y1, Z1); // step 25\n t2 = Fp.add(t2, t2);\n t0 = Fp.mul(t2, t3);\n X3 = Fp.sub(X3, t0);\n Z3 = Fp.mul(t2, t1);\n Z3 = Fp.add(Z3, Z3); // step 30\n Z3 = Fp.add(Z3, Z3);\n return new Point(X3, Y3, Z3);\n }\n // Renes-Costello-Batina exception-free addition formula.\n // There is 30% faster Jacobian formula, but it is not complete.\n // https://eprint.iacr.org/2015/1060, algorithm 1\n // Cost: 12M + 0S + 3*a + 3*b3 + 23add.\n add(other) {\n aprjpoint(other);\n const { X: X1, Y: Y1, Z: Z1 } = this;\n const { X: X2, Y: Y2, Z: Z2 } = other;\n let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n const a = CURVE.a;\n const b3 = Fp.mul(CURVE.b, _3n);\n let t0 = Fp.mul(X1, X2); // step 1\n let t1 = Fp.mul(Y1, Y2);\n let t2 = Fp.mul(Z1, Z2);\n let t3 = Fp.add(X1, Y1);\n let t4 = Fp.add(X2, Y2); // step 5\n t3 = Fp.mul(t3, t4);\n t4 = Fp.add(t0, t1);\n t3 = Fp.sub(t3, t4);\n t4 = Fp.add(X1, Z1);\n let t5 = Fp.add(X2, Z2); // step 10\n t4 = Fp.mul(t4, t5);\n t5 = Fp.add(t0, t2);\n t4 = Fp.sub(t4, t5);\n t5 = Fp.add(Y1, Z1);\n X3 = Fp.add(Y2, Z2); // step 15\n t5 = Fp.mul(t5, X3);\n X3 = Fp.add(t1, t2);\n t5 = Fp.sub(t5, X3);\n Z3 = Fp.mul(a, t4);\n X3 = Fp.mul(b3, t2); // step 20\n Z3 = Fp.add(X3, Z3);\n X3 = Fp.sub(t1, Z3);\n Z3 = Fp.add(t1, Z3);\n Y3 = Fp.mul(X3, Z3);\n t1 = Fp.add(t0, t0); // step 25\n t1 = Fp.add(t1, t0);\n t2 = Fp.mul(a, t2);\n t4 = Fp.mul(b3, t4);\n t1 = Fp.add(t1, t2);\n t2 = Fp.sub(t0, t2); // step 30\n t2 = Fp.mul(a, t2);\n t4 = Fp.add(t4, t2);\n t0 = Fp.mul(t1, t4);\n Y3 = Fp.add(Y3, t0);\n t0 = Fp.mul(t5, t4); // step 35\n X3 = Fp.mul(t3, X3);\n X3 = Fp.sub(X3, t0);\n t0 = Fp.mul(t3, t1);\n Z3 = Fp.mul(t5, Z3);\n Z3 = Fp.add(Z3, t0); // step 40\n return new Point(X3, Y3, Z3);\n }\n subtract(other) {\n // Validate before calling `negate()` so wrong inputs fail with the point guard\n // instead of leaking a foreign `negate()` error.\n aprjpoint(other);\n return this.add(other.negate());\n }\n is0() {\n return this.equals(Point.ZERO);\n }\n /**\n * Constant time multiplication.\n * Uses wNAF method. Windowed method may be 10% faster,\n * but takes 2x longer to generate and consumes 2x memory.\n * Uses precomputes when available.\n * Uses endomorphism for Koblitz curves.\n * @param scalar - by which the point would be multiplied\n * @returns New point\n */\n multiply(scalar) {\n const { endo } = extraOpts;\n // Keep the subgroup-scalar contract strict instead of reducing 0 / n to ZERO.\n // In key/signature-style callers, those values usually mean broken hash/scalar plumbing,\n // and failing closed is safer than silently producing the identity point.\n if (!Fn.isValidNot0(scalar))\n throw new RangeError('invalid scalar: out of range'); // 0 is invalid\n let point, fake; // Fake point is used to const-time mult\n const mul = (n) => wnaf.cached(this, n, (p) => normalizeZ(Point, p));\n /** See docs for {@link EndomorphismOpts} */\n if (endo) {\n const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(scalar);\n const { p: k1p, f: k1f } = mul(k1);\n const { p: k2p, f: k2f } = mul(k2);\n fake = k1f.add(k2f);\n point = finishEndo(endo.beta, k1p, k2p, k1neg, k2neg);\n }\n else {\n const { p, f } = mul(scalar);\n point = p;\n fake = f;\n }\n // Normalize `z` for both points, but return only real one\n return normalizeZ(Point, [point, fake])[0];\n }\n /**\n * Non-constant-time multiplication. Uses double-and-add algorithm.\n * It's faster, but should only be used when you don't care about\n * an exposed secret key e.g. sig verification, which works over *public* keys.\n */\n multiplyUnsafe(scalar) {\n const { endo } = extraOpts;\n const p = this;\n const sc = scalar;\n // Public-scalar callers may need 0, but n and larger values stay rejected here too.\n // Reducing them mod n would turn bad caller input into an accidental identity point.\n if (!Fn.isValid(sc))\n throw new RangeError('invalid scalar: out of range'); // 0 is valid\n if (sc === _0n || p.is0())\n return Point.ZERO; // 0\n if (sc === _1n)\n return p; // 1\n if (wnaf.hasCache(this))\n return this.multiply(sc); // precomputes\n // We don't have method for double scalar multiplication (aP + bQ):\n // Even with using Strauss-Shamir trick, it's 35% slower than naïve mul+add.\n if (endo) {\n const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(sc);\n const { p1, p2 } = mulEndoUnsafe(Point, p, k1, k2); // 30% faster vs wnaf.unsafe\n return finishEndo(endo.beta, p1, p2, k1neg, k2neg);\n }\n else {\n return wnaf.unsafe(p, sc);\n }\n }\n /**\n * Converts Projective point to affine (x, y) coordinates.\n * (X, Y, Z) ∋ (x=X/Z, y=Y/Z).\n * @param invertedZ - Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch\n */\n toAffine(invertedZ) {\n const p = this;\n let iz = invertedZ;\n const { X, Y, Z } = p;\n // Fast-path for normalized points\n if (Fp.eql(Z, Fp.ONE))\n return { x: X, y: Y };\n const is0 = p.is0();\n // If invZ was 0, we return zero point. However we still want to execute\n // all operations, so we replace invZ with a random number, 1.\n if (iz == null)\n iz = is0 ? Fp.ONE : Fp.inv(Z);\n const x = Fp.mul(X, iz);\n const y = Fp.mul(Y, iz);\n const zz = Fp.mul(Z, iz);\n if (is0)\n return { x: Fp.ZERO, y: Fp.ZERO };\n if (!Fp.eql(zz, Fp.ONE))\n throw new Error('invZ was invalid');\n return { x, y };\n }\n /**\n * Checks whether Point is free of torsion elements (is in prime subgroup).\n * Always torsion-free for cofactor=1 curves.\n */\n isTorsionFree() {\n const { isTorsionFree } = extraOpts;\n if (cofactor === _1n)\n return true;\n if (isTorsionFree)\n return isTorsionFree(Point, this);\n return wnaf.unsafe(this, CURVE_ORDER).is0();\n }\n clearCofactor() {\n const { clearCofactor } = extraOpts;\n if (cofactor === _1n)\n return this; // Fast-path\n if (clearCofactor)\n return clearCofactor(Point, this);\n // Default fallback assumes the cofactor fits the usual subgroup-scalar\n // multiplyUnsafe() contract. Curves with larger / structured cofactors\n // should define a clearCofactor override anyway (e.g. psi/Frobenius maps).\n return this.multiplyUnsafe(cofactor);\n }\n isSmallOrder() {\n if (cofactor === _1n)\n return this.is0(); // Fast-path\n return this.clearCofactor().is0();\n }\n toBytes(isCompressed = true) {\n abool(isCompressed, 'isCompressed');\n // Same policy as pointFromBytes(): keep ZERO out of the default byte surface because\n // callers use these encodings as public keys, where SEC 1 validation rejects infinity.\n this.assertValidity();\n return encodePoint(Point, this, isCompressed);\n }\n toHex(isCompressed = true) {\n return bytesToHex(this.toBytes(isCompressed));\n }\n toString() {\n return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;\n }\n }\n const bits = Fn.BITS;\n const wnaf = new wNAF(Point, extraOpts.endo ? Math.ceil(bits / 2) : bits);\n // Tiny toy curves can have scalar fields narrower than 8 bits. Skip the\n // eager W=8 cache there instead of rejecting an otherwise valid constructor.\n if (bits >= 8)\n Point.BASE.precompute(8); // Enable precomputes. Slows down first publicKey computation by 20ms.\n Object.freeze(Point.prototype);\n Object.freeze(Point);\n return Point;\n}\n// Points start with byte 0x02 when y is even; otherwise 0x03\nfunction pprefix(hasEvenY) {\n return Uint8Array.of(hasEvenY ? 0x02 : 0x03);\n}\n/**\n * Implementation of the Shallue and van de Woestijne method for any weierstrass curve.\n * TODO: check if there is a way to merge this with uvRatio in Edwards; move to modular.\n * b = True and y = sqrt(u / v) if (u / v) is square in F, and\n * b = False and y = sqrt(Z * (u / v)) otherwise.\n * RFC 9380 expects callers to provide `v != 0`; this helper does not enforce it.\n * @param Fp - Field implementation.\n * @param Z - Simplified SWU map parameter.\n * @returns Square-root ratio helper.\n * @example\n * Build the square-root ratio helper used by SWU map implementations.\n *\n * ```ts\n * import { SWUFpSqrtRatio } from '@noble/curves/abstract/weierstrass.js';\n * import { Field } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const sqrtRatio = SWUFpSqrtRatio(Fp, 3n);\n * const out = sqrtRatio(4n, 1n);\n * ```\n */\nexport function SWUFpSqrtRatio(Fp, Z) {\n // Fail with the usual field-shape error before touching pow/cmov on malformed field shims.\n const F = validateField(Fp);\n // Generic implementation\n const q = F.ORDER;\n let l = _0n;\n for (let o = q - _1n; o % _2n === _0n; o /= _2n)\n l += _1n;\n const c1 = l; // 1. c1, the largest integer such that 2^c1 divides q - 1.\n // We need 2n ** c1 and 2n ** (c1-1). We can't use **; but we can use <<.\n // 2n ** c1 == 2n << (c1-1)\n const _2n_pow_c1_1 = _2n << (c1 - _1n - _1n);\n const _2n_pow_c1 = _2n_pow_c1_1 * _2n;\n const c2 = (q - _1n) / _2n_pow_c1; // 2. c2 = (q - 1) / (2^c1) # Integer arithmetic\n const c3 = (c2 - _1n) / _2n; // 3. c3 = (c2 - 1) / 2 # Integer arithmetic\n const c4 = _2n_pow_c1 - _1n; // 4. c4 = 2^c1 - 1 # Integer arithmetic\n const c5 = _2n_pow_c1_1; // 5. c5 = 2^(c1 - 1) # Integer arithmetic\n const c6 = F.pow(Z, c2); // 6. c6 = Z^c2\n const c7 = F.pow(Z, (c2 + _1n) / _2n); // 7. c7 = Z^((c2 + 1) / 2)\n // RFC 9380 Appendix F.2.1.1 defines sqrt_ratio(u, v) only for v != 0.\n // We keep v=0 on the regular result path with isValid=false instead of\n // throwing so the helper stays closer to the RFC's fixed control flow.\n let sqrtRatio = (u, v) => {\n let tv1 = c6; // 1. tv1 = c6\n let tv2 = F.pow(v, c4); // 2. tv2 = v^c4\n let tv3 = F.sqr(tv2); // 3. tv3 = tv2^2\n tv3 = F.mul(tv3, v); // 4. tv3 = tv3 * v\n let tv5 = F.mul(u, tv3); // 5. tv5 = u * tv3\n tv5 = F.pow(tv5, c3); // 6. tv5 = tv5^c3\n tv5 = F.mul(tv5, tv2); // 7. tv5 = tv5 * tv2\n tv2 = F.mul(tv5, v); // 8. tv2 = tv5 * v\n tv3 = F.mul(tv5, u); // 9. tv3 = tv5 * u\n let tv4 = F.mul(tv3, tv2); // 10. tv4 = tv3 * tv2\n tv5 = F.pow(tv4, c5); // 11. tv5 = tv4^c5\n let isQR = F.eql(tv5, F.ONE); // 12. isQR = tv5 == 1\n tv2 = F.mul(tv3, c7); // 13. tv2 = tv3 * c7\n tv5 = F.mul(tv4, tv1); // 14. tv5 = tv4 * tv1\n tv3 = F.cmov(tv2, tv3, isQR); // 15. tv3 = CMOV(tv2, tv3, isQR)\n tv4 = F.cmov(tv5, tv4, isQR); // 16. tv4 = CMOV(tv5, tv4, isQR)\n // 17. for i in (c1, c1 - 1, ..., 2):\n for (let i = c1; i > _1n; i--) {\n let tv5 = i - _2n; // 18. tv5 = i - 2\n tv5 = _2n << (tv5 - _1n); // 19. tv5 = 2^tv5\n let tvv5 = F.pow(tv4, tv5); // 20. tv5 = tv4^tv5\n const e1 = F.eql(tvv5, F.ONE); // 21. e1 = tv5 == 1\n tv2 = F.mul(tv3, tv1); // 22. tv2 = tv3 * tv1\n tv1 = F.mul(tv1, tv1); // 23. tv1 = tv1 * tv1\n tvv5 = F.mul(tv4, tv1); // 24. tv5 = tv4 * tv1\n tv3 = F.cmov(tv2, tv3, e1); // 25. tv3 = CMOV(tv2, tv3, e1)\n tv4 = F.cmov(tvv5, tv4, e1); // 26. tv4 = CMOV(tv5, tv4, e1)\n }\n // RFC 9380 Appendix F.2.1.1 defines sqrt_ratio(u, v) for v != 0.\n // When u = 0 and v != 0, u / v = 0 is square and the computed root is\n // still 0, so widen only the final flag and keep the full control flow.\n return { isValid: !F.is0(v) && (isQR || F.is0(u)), value: tv3 };\n };\n if (F.ORDER % _4n === _3n) {\n // sqrt_ratio_3mod4(u, v)\n const c1 = (F.ORDER - _3n) / _4n; // 1. c1 = (q - 3) / 4 # Integer arithmetic\n const c2 = F.sqrt(F.neg(Z)); // 2. c2 = sqrt(-Z)\n sqrtRatio = (u, v) => {\n let tv1 = F.sqr(v); // 1. tv1 = v^2\n const tv2 = F.mul(u, v); // 2. tv2 = u * v\n tv1 = F.mul(tv1, tv2); // 3. tv1 = tv1 * tv2\n let y1 = F.pow(tv1, c1); // 4. y1 = tv1^c1\n y1 = F.mul(y1, tv2); // 5. y1 = y1 * tv2\n const y2 = F.mul(y1, c2); // 6. y2 = y1 * c2\n const tv3 = F.mul(F.sqr(y1), v); // 7. tv3 = y1^2; 8. tv3 = tv3 * v\n const isQR = F.eql(tv3, u); // 9. isQR = tv3 == u\n let y = F.cmov(y2, y1, isQR); // 10. y = CMOV(y2, y1, isQR)\n return { isValid: !F.is0(v) && isQR, value: y }; // 11. return (isQR, y) isQR ? y : y*c2\n };\n }\n // No curves uses that\n // if (Fp.ORDER % _8n === _5n) // sqrt_ratio_5mod8\n return sqrtRatio;\n}\n/**\n * Simplified Shallue-van de Woestijne-Ulas Method\n * See {@link https://www.rfc-editor.org/rfc/rfc9380#section-6.6.2 | RFC 9380 section 6.6.2}.\n * @param Fp - Field implementation.\n * @param opts - SWU parameters:\n * - `A`: Curve parameter `A`.\n * - `B`: Curve parameter `B`.\n * - `Z`: Simplified SWU map parameter.\n * @returns Deterministic map-to-curve function.\n * @throws If the SWU parameters are invalid or the field lacks the required helpers. {@link Error}\n * @example\n * Map one field element to a Weierstrass curve point with the SWU recipe.\n *\n * ```ts\n * import { mapToCurveSimpleSWU } from '@noble/curves/abstract/weierstrass.js';\n * import { Field } from '@noble/curves/abstract/modular.js';\n * const Fp = Field(17n);\n * const map = mapToCurveSimpleSWU(Fp, { A: 1n, B: 2n, Z: 3n });\n * const point = map(5n);\n * ```\n */\nexport function mapToCurveSimpleSWU(Fp, opts) {\n const F = validateField(Fp);\n const { A, B, Z } = opts;\n if (!F.isValidNot0(A) || !F.isValidNot0(B) || !F.isValid(Z))\n throw new Error('mapToCurveSimpleSWU: invalid opts');\n // RFC 9380 §6.6.2 and Appendix H.2 require:\n // 1. Z is non-square in F\n // 2. Z != -1 in F\n // 3. g(x) - Z is irreducible over F\n // 4. g(B / (Z * A)) is square in F\n // We can enforce 1, 2, and 4 with the current field API.\n // Criterion 3 is not checked here because generic `IField<T>` does not expose\n // polynomial-ring / irreducibility operations, and this helper is used for\n // both prime and extension fields.\n if (F.eql(Z, F.neg(F.ONE)) || FpIsSquare(F, Z))\n throw new Error('mapToCurveSimpleSWU: invalid opts');\n // RFC 9380 Appendix H.2 criterion 4: g(B / (Z * A)) is square in F.\n // x = B / (Z * A)\n const x = F.mul(B, F.inv(F.mul(Z, A)));\n // g(x) = x^3 + A*x + B\n const gx = F.add(F.add(F.mul(F.sqr(x), x), F.mul(A, x)), B);\n if (!FpIsSquare(F, gx))\n throw new Error('mapToCurveSimpleSWU: invalid opts');\n const sqrtRatio = SWUFpSqrtRatio(F, Z);\n if (!F.isOdd)\n throw new Error('Field does not have .isOdd()');\n // Input: u, an element of F.\n // Output: (x, y), a point on E.\n return (u) => {\n // prettier-ignore\n let tv1, tv2, tv3, tv4, tv5, tv6, x, y;\n tv1 = F.sqr(u); // 1. tv1 = u^2\n tv1 = F.mul(tv1, Z); // 2. tv1 = Z * tv1\n tv2 = F.sqr(tv1); // 3. tv2 = tv1^2\n tv2 = F.add(tv2, tv1); // 4. tv2 = tv2 + tv1\n tv3 = F.add(tv2, F.ONE); // 5. tv3 = tv2 + 1\n tv3 = F.mul(tv3, B); // 6. tv3 = B * tv3\n tv4 = F.cmov(Z, F.neg(tv2), !F.eql(tv2, F.ZERO)); // 7. tv4 = CMOV(Z, -tv2, tv2 != 0)\n tv4 = F.mul(tv4, A); // 8. tv4 = A * tv4\n tv2 = F.sqr(tv3); // 9. tv2 = tv3^2\n tv6 = F.sqr(tv4); // 10. tv6 = tv4^2\n tv5 = F.mul(tv6, A); // 11. tv5 = A * tv6\n tv2 = F.add(tv2, tv5); // 12. tv2 = tv2 + tv5\n tv2 = F.mul(tv2, tv3); // 13. tv2 = tv2 * tv3\n tv6 = F.mul(tv6, tv4); // 14. tv6 = tv6 * tv4\n tv5 = F.mul(tv6, B); // 15. tv5 = B * tv6\n tv2 = F.add(tv2, tv5); // 16. tv2 = tv2 + tv5\n x = F.mul(tv1, tv3); // 17. x = tv1 * tv3\n const { isValid, value } = sqrtRatio(tv2, tv6); // 18. (is_gx1_square, y1) = sqrt_ratio(tv2, tv6)\n y = F.mul(tv1, u); // 19. y = tv1 * u -> Z * u^3 * y1\n y = F.mul(y, value); // 20. y = y * y1\n x = F.cmov(x, tv3, isValid); // 21. x = CMOV(x, tv3, is_gx1_square)\n y = F.cmov(y, value, isValid); // 22. y = CMOV(y, y1, is_gx1_square)\n const e1 = F.isOdd(u) === F.isOdd(y); // 23. e1 = sgn0(u) == sgn0(y)\n y = F.cmov(F.neg(y), y, e1); // 24. y = CMOV(-y, y, e1)\n const tv4_inv = FpInvertBatch(F, [tv4], true)[0];\n x = F.mul(x, tv4_inv); // 25. x = x / tv4\n return { x, y };\n };\n}\nfunction getWLengths(Fp, Fn) {\n return {\n secretKey: Fn.BYTES,\n publicKey: 1 + Fp.BYTES,\n publicKeyUncompressed: 1 + 2 * Fp.BYTES,\n publicKeyHasPrefix: true,\n // Raw compact `(r || s)` signature width; DER and recovered signatures use\n // different lengths outside this helper.\n signature: 2 * Fn.BYTES,\n };\n}\n/**\n * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.\n * This helper ensures no signature functionality is present. Less code, smaller bundle size.\n * @param Point - Weierstrass point constructor.\n * @param ecdhOpts - Optional randomness helpers:\n * - `randomBytes` (optional): Optional RNG override.\n * @returns ECDH helper namespace.\n * @example\n * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.\n *\n * ```ts\n * import { ecdh } from '@noble/curves/abstract/weierstrass.js';\n * import { p256 } from '@noble/curves/nist.js';\n * const dh = ecdh(p256.Point);\n * const alice = dh.keygen();\n * const shared = dh.getSharedSecret(alice.secretKey, alice.publicKey);\n * ```\n */\nexport function ecdh(Point, ecdhOpts = {}) {\n const { Fn } = Point;\n const randomBytes_ = ecdhOpts.randomBytes === undefined ? wcRandomBytes : ecdhOpts.randomBytes;\n // Keep the advertised seed length aligned with mapHashToField(), which keeps a hard 16-byte\n // minimum even on toy curves.\n const lengths = Object.assign(getWLengths(Point.Fp, Fn), {\n seed: Math.max(getMinHashLength(Fn.ORDER), 16),\n });\n function isValidSecretKey(secretKey) {\n try {\n const num = Fn.fromBytes(secretKey);\n return Fn.isValidNot0(num);\n }\n catch (error) {\n return false;\n }\n }\n function isValidPublicKey(publicKey, isCompressed) {\n const { publicKey: comp, publicKeyUncompressed } = lengths;\n try {\n const l = publicKey.length;\n if (isCompressed === true && l !== comp)\n return false;\n if (isCompressed === false && l !== publicKeyUncompressed)\n return false;\n return !!Point.fromBytes(publicKey);\n }\n catch (error) {\n return false;\n }\n }\n /**\n * Produces cryptographically secure secret key from random of size\n * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.\n */\n function randomSecretKey(seed) {\n seed = seed === undefined ? randomBytes_(lengths.seed) : seed;\n return mapHashToField(abytes(seed, lengths.seed, 'seed'), Fn.ORDER);\n }\n /**\n * Computes public key for a secret key. Checks for validity of the secret key.\n * @param isCompressed - whether to return compact (default), or full key\n * @returns Public key, full when isCompressed=false; short when isCompressed=true\n */\n function getPublicKey(secretKey, isCompressed = true) {\n return Point.BASE.multiply(Fn.fromBytes(secretKey)).toBytes(isCompressed);\n }\n /**\n * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.\n */\n function isProbPub(item) {\n const { secretKey, publicKey, publicKeyUncompressed } = lengths;\n const allowedLengths = Fn._lengths;\n if (!isBytes(item))\n return undefined;\n const l = abytes(item, undefined, 'key').length;\n const isPub = l === publicKey || l === publicKeyUncompressed;\n const isSec = l === secretKey || !!allowedLengths?.includes(l);\n // P-521 accepts both 65- and 66-byte secret keys, so overlapping lengths stay ambiguous.\n if (isPub && isSec)\n return undefined;\n return isPub;\n }\n /**\n * ECDH (Elliptic Curve Diffie Hellman).\n * Computes encoded shared point from secret key A and public key B.\n * Checks: 1) secret key validity 2) shared key is on-curve.\n * Does NOT hash the result or expose the SEC 1 x-coordinate-only `z`.\n * Returns the encoded shared point on purpose: callers that need `x_P`\n * can derive it from the encoded point, but `x_P` alone cannot recover the\n * point/parity back.\n * This helper only exposes the fully validated public-key path, not cofactor DH.\n * @param isCompressed - whether to return compact (default), or full key\n * @returns shared point encoding\n */\n function getSharedSecret(secretKeyA, publicKeyB, isCompressed = true) {\n if (isProbPub(secretKeyA) === true)\n throw new Error('first arg must be private key');\n if (isProbPub(publicKeyB) === false)\n throw new Error('second arg must be public key');\n const s = Fn.fromBytes(secretKeyA);\n const b = Point.fromBytes(publicKeyB); // checks for being on-curve\n return b.multiply(s).toBytes(isCompressed);\n }\n const utils = {\n isValidSecretKey,\n isValidPublicKey,\n randomSecretKey,\n };\n const keygen = createKeygen(randomSecretKey, getPublicKey);\n Object.freeze(utils);\n Object.freeze(lengths);\n return Object.freeze({ getPublicKey, getSharedSecret, keygen, Point, utils, lengths });\n}\n/**\n * Creates ECDSA signing interface for given elliptic curve `Point` and `hash` function.\n *\n * @param Point - created using {@link weierstrass} function\n * @param hash - used for 1) message prehash-ing 2) k generation in `sign`, using hmac_drbg(hash)\n * @param ecdsaOpts - rarely needed, see {@link ECDSAOpts}:\n * - `lowS`: Default low-S policy.\n * - `hmac`: HMAC implementation used by RFC6979 DRBG.\n * - `randomBytes`: Optional RNG override.\n * - `bits2int`: Optional hash-to-int conversion override.\n * - `bits2int_modN`: Optional hash-to-int-mod-n conversion override.\n *\n * @returns ECDSA helper namespace.\n * @example\n * Create an ECDSA signer/verifier bundle for one curve implementation.\n *\n * ```ts\n * import { ecdsa } from '@noble/curves/abstract/weierstrass.js';\n * import { p256 } from '@noble/curves/nist.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * const p256ecdsa = ecdsa(p256.Point, sha256);\n * const { secretKey, publicKey } = p256ecdsa.keygen();\n * const msg = new TextEncoder().encode('hello noble');\n * const sig = p256ecdsa.sign(msg, secretKey);\n * const isValid = p256ecdsa.verify(sig, msg, publicKey);\n * ```\n */\nexport function ecdsa(Point, hash, ecdsaOpts = {}) {\n // Custom hash / bits2int hooks are treated as pure functions over validated caller-owned bytes.\n const hash_ = hash;\n ahash(hash_);\n validateObject(ecdsaOpts, {}, {\n hmac: 'function',\n lowS: 'boolean',\n randomBytes: 'function',\n bits2int: 'function',\n bits2int_modN: 'function',\n });\n ecdsaOpts = Object.assign({}, ecdsaOpts);\n const randomBytes = ecdsaOpts.randomBytes === undefined ? wcRandomBytes : ecdsaOpts.randomBytes;\n const hmac = ecdsaOpts.hmac === undefined\n ? (key, msg) => nobleHmac(hash_, key, msg)\n : ecdsaOpts.hmac;\n const { Fp, Fn } = Point;\n const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;\n const { keygen, getPublicKey, getSharedSecret, utils, lengths } = ecdh(Point, ecdsaOpts);\n const defaultSigOpts = {\n prehash: true,\n lowS: typeof ecdsaOpts.lowS === 'boolean' ? ecdsaOpts.lowS : true,\n format: 'compact',\n extraEntropy: false,\n };\n // SEC 1 4.1.6 public-key recovery tries x = r + jn for j = 0..h. Our recovered-signature\n // format only stores one overflow bit, so it can only distinguish q.x = r from q.x = r + n.\n // A third lift would have the form q.x = r + 2n. Since valid ECDSA r is in 1..n-1, the\n // smallest such lift is 1 + 2n, not 2n.\n const hasLargeRecoveryLifts = CURVE_ORDER * _2n + _1n < Fp.ORDER;\n function isBiggerThanHalfOrder(number) {\n const HALF = CURVE_ORDER >> _1n;\n return number > HALF;\n }\n function validateRS(title, num) {\n if (!Fn.isValidNot0(num))\n throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);\n return num;\n }\n function assertRecoverableCurve() {\n // ECDSA recovery only supports curves where the current recovery id can distinguish\n // q.x = r and q.x = r + n; larger lifts may need additional `r + n*i` branches.\n // SEC 1 4.1.6 recovers candidates via x = r + jn, but this format only encodes j = 0 or 1.\n // The next possible candidate is q.x = r + 2n, and its smallest valid value is 1 + 2n.\n // To easily get i, we either need to:\n // a. increase amount of valid recid values (4, 5...); OR\n // b. prohibit recovered signatures for those curves.\n if (hasLargeRecoveryLifts)\n throw new Error('\"recovered\" sig type is not supported for cofactor >2 curves');\n }\n function validateSigLength(bytes, format) {\n validateSigFormat(format);\n const size = lengths.signature;\n const sizer = format === 'compact' ? size : format === 'recovered' ? size + 1 : undefined;\n return abytes(bytes, sizer);\n }\n /**\n * ECDSA signature with its (r, s) properties. Supports compact, recovered & DER representations.\n */\n class Signature {\n r;\n s;\n recovery;\n constructor(r, s, recovery) {\n this.r = validateRS('r', r); // r in [1..N-1];\n this.s = validateRS('s', s); // s in [1..N-1];\n if (recovery != null) {\n assertRecoverableCurve();\n if (![0, 1, 2, 3].includes(recovery))\n throw new Error('invalid recovery id');\n this.recovery = recovery;\n }\n Object.freeze(this);\n }\n static fromBytes(bytes, format = defaultSigOpts.format) {\n validateSigLength(bytes, format);\n let recid;\n if (format === 'der') {\n const { r, s } = DER.toSig(abytes(bytes));\n return new Signature(r, s);\n }\n if (format === 'recovered') {\n recid = bytes[0];\n format = 'compact';\n bytes = bytes.subarray(1);\n }\n const L = lengths.signature / 2;\n const r = bytes.subarray(0, L);\n const s = bytes.subarray(L, L * 2);\n return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);\n }\n static fromHex(hex, format) {\n return this.fromBytes(hexToBytes(hex), format);\n }\n assertRecovery() {\n const { recovery } = this;\n if (recovery == null)\n throw new Error('invalid recovery id: must be present');\n return recovery;\n }\n addRecoveryBit(recovery) {\n return new Signature(this.r, this.s, recovery);\n }\n // Unlike the top-level helper below, this method expects a digest that has\n // already been hashed to the curve's message representative.\n recoverPublicKey(messageHash) {\n const { r, s } = this;\n const recovery = this.assertRecovery();\n const radj = recovery === 2 || recovery === 3 ? r + CURVE_ORDER : r;\n if (!Fp.isValid(radj))\n throw new Error('invalid recovery id: sig.r+curve.n != R.x');\n const x = Fp.toBytes(radj);\n const R = Point.fromBytes(concatBytes(pprefix((recovery & 1) === 0), x));\n const ir = Fn.inv(radj); // r^-1\n const h = bits2int_modN(abytes(messageHash, undefined, 'msgHash')); // Truncate hash\n const u1 = Fn.create(-h * ir); // -hr^-1\n const u2 = Fn.create(s * ir); // sr^-1\n // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1). unsafe is fine: there is no private data.\n const Q = Point.BASE.multiplyUnsafe(u1).add(R.multiplyUnsafe(u2));\n if (Q.is0())\n throw new Error('invalid recovery: point at infinify');\n Q.assertValidity();\n return Q;\n }\n // Signatures should be low-s, to prevent malleability.\n hasHighS() {\n return isBiggerThanHalfOrder(this.s);\n }\n toBytes(format = defaultSigOpts.format) {\n validateSigFormat(format);\n if (format === 'der')\n return hexToBytes(DER.hexFromSig(this));\n const { r, s } = this;\n const rb = Fn.toBytes(r);\n const sb = Fn.toBytes(s);\n if (format === 'recovered') {\n assertRecoverableCurve();\n return concatBytes(Uint8Array.of(this.assertRecovery()), rb, sb);\n }\n return concatBytes(rb, sb);\n }\n toHex(format) {\n return bytesToHex(this.toBytes(format));\n }\n }\n Object.freeze(Signature.prototype);\n Object.freeze(Signature);\n // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.\n // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.\n // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.\n // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors\n const bits2int = ecdsaOpts.bits2int === undefined\n ? function bits2int_def(bytes) {\n // Our custom check \"just in case\", for protection against DoS\n if (bytes.length > 8192)\n throw new Error('input is too large');\n // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)\n // for some cases, since bytes.length * 8 is not actual bitLength.\n const num = bytesToNumberBE(bytes); // check for == u8 done here\n const delta = bytes.length * 8 - fnBits; // truncate to nBitLength leftmost bits\n return delta > 0 ? num >> BigInt(delta) : num;\n }\n : ecdsaOpts.bits2int;\n const bits2int_modN = ecdsaOpts.bits2int_modN === undefined\n ? function bits2int_modN_def(bytes) {\n return Fn.create(bits2int(bytes)); // can't use bytesToNumberBE here\n }\n : ecdsaOpts.bits2int_modN;\n const ORDER_MASK = bitMask(fnBits);\n // Pads output with zero as per spec.\n /** Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`. */\n function int2octets(num) {\n aInRange('num < 2^' + fnBits, num, _0n, ORDER_MASK);\n return Fn.toBytes(num);\n }\n function validateMsgAndHash(message, prehash) {\n abytes(message, undefined, 'message');\n return (prehash ? abytes(hash_(message), undefined, 'prehashed message') : message);\n }\n /**\n * Steps A, D of RFC6979 3.2.\n * Creates RFC6979 seed; converts msg/privKey to numbers.\n * Used only in sign, not in verify.\n *\n * Warning: we cannot assume here that message has same amount of bytes as curve order,\n * this will be invalid at least for P521. Also it can be bigger for P224 + SHA256.\n */\n function prepSig(message, secretKey, opts) {\n const { lowS, prehash, extraEntropy } = validateSigOpts(opts, defaultSigOpts);\n message = validateMsgAndHash(message, prehash); // RFC6979 3.2 A: h1 = H(m)\n // We can't later call bits2octets, since nested bits2int is broken for curves\n // with fnBits % 8 !== 0. Because of that, we unwrap it here as int2octets call.\n // const bits2octets = (bits) => int2octets(bits2int_modN(bits))\n const h1int = bits2int_modN(message);\n const d = Fn.fromBytes(secretKey); // validate secret key, convert to bigint\n if (!Fn.isValidNot0(d))\n throw new Error('invalid private key');\n const seedArgs = [int2octets(d), int2octets(h1int)];\n // extraEntropy. RFC6979 3.6: additional k' (optional).\n if (extraEntropy != null && extraEntropy !== false) {\n // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')\n // gen random bytes OR pass as-is\n const e = extraEntropy === true ? randomBytes(lengths.secretKey) : extraEntropy;\n seedArgs.push(abytes(e, undefined, 'extraEntropy')); // check for being bytes\n }\n const seed = concatBytes(...seedArgs); // Step D of RFC6979 3.2\n const m = h1int; // no need to call bits2int second time here, it is inside truncateHash!\n // Converts signature params into point w r/s, checks result for validity.\n // To transform k => Signature:\n // q = k⋅G\n // r = q.x mod n\n // s = k^-1(m + rd) mod n\n // Can use scalar blinding b^-1(bm + bdr) where b ∈ [1,q−1] according to\n // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. We've decided against it:\n // a) dependency on CSPRNG b) 15% slowdown c) doesn't really help since bigints are not CT\n function k2sig(kBytes) {\n // RFC 6979 Section 3.2, step 3: k = bits2int(T)\n // Important: all mod() calls here must be done over N\n const k = bits2int(kBytes); // Cannot use fields methods, since it is group element\n if (!Fn.isValidNot0(k))\n return; // Valid scalars (including k) must be in 1..N-1\n const ik = Fn.inv(k); // k^-1 mod n\n const q = Point.BASE.multiply(k).toAffine(); // q = k⋅G\n const r = Fn.create(q.x); // r = q.x mod n\n if (r === _0n)\n return;\n const s = Fn.create(ik * Fn.create(m + r * d)); // s = k^-1(m + rd) mod n\n if (s === _0n)\n return;\n let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3 when q.x>n)\n let normS = s;\n if (lowS && isBiggerThanHalfOrder(s)) {\n normS = Fn.neg(s); // if lowS was passed, ensure s is always in the bottom half of N\n recovery ^= 1;\n }\n return new Signature(r, normS, hasLargeRecoveryLifts ? undefined : recovery);\n }\n return { seed, k2sig };\n }\n /**\n * Signs a message or message hash with a secret key.\n * With the default `prehash: true`, raw message bytes are hashed internally;\n * only `{ prehash: false }` expects a caller-supplied digest.\n *\n * ```\n * sign(m, d) where\n * k = rfc6979_hmac_drbg(m, d)\n * (x, y) = G × k\n * r = x mod n\n * s = (m + dr) / k mod n\n * ```\n */\n function sign(message, secretKey, opts = {}) {\n const { seed, k2sig } = prepSig(message, secretKey, opts); // Steps A, D of RFC6979 3.2.\n const drbg = createHmacDrbg(hash_.outputLen, Fn.BYTES, hmac);\n const sig = drbg(seed, k2sig); // Steps B, C, D, E, F, G\n return sig.toBytes(opts.format);\n }\n /**\n * Verifies a signature against message and public key.\n * Rejects lowS signatures by default: see {@link ECDSAVerifyOpts}.\n * Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:\n *\n * ```\n * verify(r, s, h, P) where\n * u1 = hs^-1 mod n\n * u2 = rs^-1 mod n\n * R = u1⋅G + u2⋅P\n * mod(R.x, n) == r\n * ```\n */\n function verify(signature, message, publicKey, opts = {}) {\n const { lowS, prehash, format } = validateSigOpts(opts, defaultSigOpts);\n publicKey = abytes(publicKey, undefined, 'publicKey');\n message = validateMsgAndHash(message, prehash);\n if (!isBytes(signature)) {\n const end = signature instanceof Signature ? ', use sig.toBytes()' : '';\n throw new Error('verify expects Uint8Array signature' + end);\n }\n validateSigLength(signature, format); // execute this twice because we want loud error\n try {\n const sig = Signature.fromBytes(signature, format);\n const P = Point.fromBytes(publicKey);\n if (lowS && sig.hasHighS())\n return false;\n const { r, s } = sig;\n const h = bits2int_modN(message); // mod n, not mod p\n const is = Fn.inv(s); // s^-1 mod n\n const u1 = Fn.create(h * is); // u1 = hs^-1 mod n\n const u2 = Fn.create(r * is); // u2 = rs^-1 mod n\n const R = Point.BASE.multiplyUnsafe(u1).add(P.multiplyUnsafe(u2)); // u1⋅G + u2⋅P\n if (R.is0())\n return false;\n const v = Fn.create(R.x); // v = r.x mod n\n return v === r;\n }\n catch (e) {\n return false;\n }\n }\n function recoverPublicKey(signature, message, opts = {}) {\n // Top-level recovery mirrors `sign()` / `verify()`: it hashes raw message\n // bytes first unless the caller passes `{ prehash: false }`.\n const { prehash } = validateSigOpts(opts, defaultSigOpts);\n message = validateMsgAndHash(message, prehash);\n return Signature.fromBytes(signature, 'recovered').recoverPublicKey(message).toBytes();\n }\n return Object.freeze({\n keygen,\n getPublicKey,\n getSharedSecret,\n utils,\n lengths,\n Point,\n sign,\n verify,\n recoverPublicKey,\n Signature,\n hash: hash_,\n });\n}\n//# sourceMappingURL=weierstrass.js.map","/**\n * SECG secp256k1. See [pdf](https://www.secg.org/sec2-v2.pdf).\n *\n * Belongs to Koblitz curves: it has efficiently-computable GLV endomorphism ψ,\n * check out {@link EndomorphismOpts}. Seems to be rigid (not backdoored).\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha256 } from '@noble/hashes/sha2.js';\nimport { randomBytes } from '@noble/hashes/utils.js';\nimport { createKeygen } from \"./abstract/curve.js\";\nimport { createFROST, } from \"./abstract/frost.js\";\nimport { createHasher, isogenyMap } from \"./abstract/hash-to-curve.js\";\nimport { Field, mapHashToField, pow2 } from \"./abstract/modular.js\";\nimport { ecdsa, mapToCurveSimpleSWU, weierstrass, } from \"./abstract/weierstrass.js\";\nimport { abytes, asciiToBytes, bytesToNumberBE, concatBytes, } from \"./utils.js\";\n// Seems like generator was produced from some seed:\n// `Pointk1.BASE.multiply(Pointk1.Fn.inv(2n, N)).toAffine().x`\n// // gives short x 0x3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63n\nconst secp256k1_CURVE = {\n p: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f'),\n n: BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141'),\n h: BigInt(1),\n a: BigInt(0),\n b: BigInt(7),\n Gx: BigInt('0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798'),\n Gy: BigInt('0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8'),\n};\nconst secp256k1_ENDO = {\n beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),\n basises: [\n [BigInt('0x3086d221a7d46bcde86c90e49284eb15'), -BigInt('0xe4437ed6010e88286f547fa90abfe4c3')],\n [BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8'), BigInt('0x3086d221a7d46bcde86c90e49284eb15')],\n ],\n};\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _2n = /* @__PURE__ */ BigInt(2);\n/**\n * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.\n * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]\n */\nfunction sqrtMod(y) {\n const P = secp256k1_CURVE.p;\n // prettier-ignore\n const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);\n // prettier-ignore\n const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);\n const b2 = (y * y * y) % P; // x^3, 11\n const b3 = (b2 * b2 * y) % P; // x^7\n const b6 = (pow2(b3, _3n, P) * b3) % P;\n const b9 = (pow2(b6, _3n, P) * b3) % P;\n const b11 = (pow2(b9, _2n, P) * b2) % P;\n const b22 = (pow2(b11, _11n, P) * b11) % P;\n const b44 = (pow2(b22, _22n, P) * b22) % P;\n const b88 = (pow2(b44, _44n, P) * b44) % P;\n const b176 = (pow2(b88, _88n, P) * b88) % P;\n const b220 = (pow2(b176, _44n, P) * b44) % P;\n const b223 = (pow2(b220, _3n, P) * b3) % P;\n const t1 = (pow2(b223, _23n, P) * b22) % P;\n const t2 = (pow2(t1, _6n, P) * b2) % P;\n const root = pow2(t2, _2n, P);\n if (!Fpk1.eql(Fpk1.sqr(root), y))\n throw new Error('Cannot find square root');\n return root;\n}\nconst Fpk1 = Field(secp256k1_CURVE.p, { sqrt: sqrtMod });\nconst Pointk1 = /* @__PURE__ */ weierstrass(secp256k1_CURVE, {\n Fp: Fpk1,\n endo: secp256k1_ENDO,\n});\n/**\n * secp256k1 curve: ECDSA and ECDH methods.\n *\n * Uses sha256 to hash messages. To use a different hash,\n * pass `{ prehash: false }` to sign / verify.\n *\n * @example\n * Generate one secp256k1 keypair, sign a message, and verify it.\n *\n * ```js\n * import { secp256k1 } from '@noble/curves/secp256k1.js';\n * const { secretKey, publicKey } = secp256k1.keygen();\n * // const publicKey = secp256k1.getPublicKey(secretKey);\n * const msg = new TextEncoder().encode('hello noble');\n * const sig = secp256k1.sign(msg, secretKey);\n * const isValid = secp256k1.verify(sig, msg, publicKey);\n * // const sigKeccak = secp256k1.sign(keccak256(msg), secretKey, { prehash: false });\n * ```\n */\nexport const secp256k1 = /* @__PURE__ */ ecdsa(Pointk1, sha256);\n// Schnorr signatures are superior to ECDSA from above. Below is Schnorr-specific BIP0340 code.\n// https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\n/** An object mapping tags to their tagged hash prefix of [SHA256(tag) | SHA256(tag)] */\nconst TAGGED_HASH_PREFIXES = {};\n// BIP-340 phrases tags as UTF-8, but all current standardized names here are 7-bit ASCII.\nfunction taggedHash(tag, ...messages) {\n let tagP = TAGGED_HASH_PREFIXES[tag];\n if (tagP === undefined) {\n const tagH = sha256(asciiToBytes(tag));\n tagP = concatBytes(tagH, tagH);\n TAGGED_HASH_PREFIXES[tag] = tagP;\n }\n return sha256(concatBytes(tagP, ...messages));\n}\n// ECDSA compact points are 33-byte. Schnorr is 32: we strip first byte 0x02 or 0x03\nconst pointToBytes = (point) => point.toBytes(true).slice(1);\nconst hasEven = (y) => y % _2n === _0n;\n// Calculate point, scalar and bytes\nfunction schnorrGetExtPubKey(priv) {\n const { Fn, BASE } = Pointk1;\n const d_ = Fn.fromBytes(priv);\n const p = BASE.multiply(d_); // P = d'⋅G; 0 < d' < n check is done inside\n const scalar = hasEven(p.y) ? d_ : Fn.neg(d_);\n return { scalar, bytes: pointToBytes(p) };\n}\n/**\n * lift_x from BIP340. Convert 32-byte x coordinate to elliptic curve point.\n * @returns valid point checked for being on-curve\n */\nfunction lift_x(x) {\n const Fp = Fpk1;\n if (!Fp.isValidNot0(x))\n throw new Error('invalid x: Fail if x ≥ p');\n const xx = Fp.create(x * x);\n const c = Fp.create(xx * x + BigInt(7)); // Let c = x³ + 7 mod p.\n let y = Fp.sqrt(c); // Let y = c^(p+1)/4 mod p. Same as sqrt().\n // Return the unique point P such that x(P) = x and\n // y(P) = y if y mod 2 = 0 or y(P) = p-y otherwise.\n if (!hasEven(y))\n y = Fp.neg(y);\n const p = Pointk1.fromAffine({ x, y });\n p.assertValidity();\n return p;\n}\n// BIP-340 callers still need to supply canonical 32-byte inputs where required; this alias only\n// parses big-endian bytes and does not enforce the fixed-width contract itself.\nconst num = bytesToNumberBE;\n/** Create tagged hash, convert it to bigint, reduce modulo-n. */\nfunction challenge(...args) {\n return Pointk1.Fn.create(num(taggedHash('BIP0340/challenge', ...args)));\n}\n/** Schnorr public key is just `x` coordinate of Point as per BIP340. */\nfunction schnorrGetPublicKey(secretKey) {\n return schnorrGetExtPubKey(secretKey).bytes; // d'=int(sk). Fail if d'=0 or d'≥n. Ret bytes(d'⋅G)\n}\n/**\n * Creates Schnorr signature as per BIP340. Verifies itself before returning anything.\n * `auxRand` is optional and is not the sole source of `k` generation: bad CSPRNG output will not\n * be catastrophic, but BIP-340 still recommends fresh auxiliary randomness when available to harden\n * deterministic signing against side-channel and fault-injection attacks.\n */\nfunction schnorrSign(message, secretKey, auxRand = randomBytes(32)) {\n const { Fn, BASE } = Pointk1;\n const m = abytes(message, undefined, 'message');\n const { bytes: px, scalar: d } = schnorrGetExtPubKey(secretKey); // checks for isWithinCurveOrder\n const a = abytes(auxRand, 32, 'auxRand'); // Auxiliary random data a: a 32-byte array\n // Let t be the byte-wise xor of bytes(d) and hash/aux(a).\n const t = Fn.toBytes(d ^ num(taggedHash('BIP0340/aux', a)));\n const rand = taggedHash('BIP0340/nonce', t, px, m); // Let rand = hash/nonce(t || bytes(P) || m)\n // BIP340 defines k' = int(rand) mod n. We can't reuse schnorrGetExtPubKey(rand)\n // here: that helper parses canonical secret keys and rejects rand >= n instead\n // of reducing the nonce hash modulo the group order.\n const k_ = Fn.create(num(rand));\n // BIP-340: \"Let k' = int(rand) mod n. Fail if k' = 0. Let R = k'⋅G.\"\n if (k_ === 0n)\n throw new Error('sign failed: k is zero');\n const p = BASE.multiply(k_); // Rejects zero; only the raw nonce hash needs reduction.\n const k = hasEven(p.y) ? k_ : Fn.neg(k_);\n const rx = pointToBytes(p);\n const e = challenge(rx, px, m); // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.\n const sig = new Uint8Array(64); // Let sig = bytes(R) || bytes((k + ed) mod n).\n sig.set(rx, 0);\n sig.set(Fn.toBytes(Fn.create(k + e * d)), 32);\n // If Verify(bytes(P), m, sig) (see below) returns failure, abort\n if (!schnorrVerify(sig, m, px))\n throw new Error('sign: Invalid signature produced');\n return sig;\n}\n/**\n * Verifies Schnorr signature.\n * Will swallow errors & return false except for initial type validation of arguments.\n */\nfunction schnorrVerify(signature, message, publicKey) {\n const { Fp, Fn, BASE } = Pointk1;\n const sig = abytes(signature, 64, 'signature');\n const m = abytes(message, undefined, 'message');\n const pub = abytes(publicKey, 32, 'publicKey');\n try {\n const P = lift_x(num(pub)); // P = lift_x(int(pk)); fail if that fails\n const r = num(sig.subarray(0, 32)); // Let r = int(sig[0:32]); fail if r ≥ p.\n if (!Fp.isValidNot0(r))\n return false;\n const s = num(sig.subarray(32, 64)); // Let s = int(sig[32:64]); fail if s ≥ n.\n // Stricter than BIP-340/libsecp256k1, which only reject s >= n. Honest signing reaches\n // s = 0 only with negligible probability (k + e*d ≡ 0 mod n), so treat zero-s inputs as\n // crafted edge cases and fail closed instead of carrying that extra verification surface.\n if (!Fn.isValidNot0(s))\n return false;\n // int(challenge(bytes(r) || bytes(P) || m)) % n\n const e = challenge(Fn.toBytes(r), pointToBytes(P), m);\n // R = s⋅G - e⋅P, where -eP == (n-e)P\n const R = BASE.multiplyUnsafe(s).add(P.multiplyUnsafe(Fn.neg(e)));\n const { x, y } = R.toAffine();\n // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.\n if (R.is0() || !hasEven(y) || x !== r)\n return false;\n return true;\n }\n catch (error) {\n return false;\n }\n}\nexport const __TEST = /* @__PURE__ */ Object.freeze({ lift_x });\n/**\n * Schnorr signatures over secp256k1.\n * See {@link https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki | BIP 340}.\n * @example\n * Generate one BIP340 Schnorr keypair, sign a message, and verify it.\n *\n * ```js\n * import { schnorr } from '@noble/curves/secp256k1.js';\n * const { secretKey, publicKey } = schnorr.keygen();\n * // const publicKey = schnorr.getPublicKey(secretKey);\n * const msg = new TextEncoder().encode('hello');\n * const sig = schnorr.sign(msg, secretKey);\n * const isValid = schnorr.verify(sig, msg, publicKey);\n * ```\n */\nexport const schnorr = /* @__PURE__ */ (() => {\n const size = 32;\n const seedLength = 48;\n const randomSecretKey = (seed) => {\n seed = seed === undefined ? randomBytes(seedLength) : seed;\n return mapHashToField(seed, secp256k1_CURVE.n);\n };\n return Object.freeze({\n keygen: createKeygen(randomSecretKey, schnorrGetPublicKey),\n getPublicKey: schnorrGetPublicKey,\n sign: schnorrSign,\n verify: schnorrVerify,\n Point: Pointk1,\n utils: Object.freeze({\n randomSecretKey,\n taggedHash,\n lift_x,\n pointToBytes,\n }),\n lengths: Object.freeze({\n secretKey: size,\n publicKey: size,\n publicKeyHasPrefix: false,\n signature: size * 2,\n seed: seedLength,\n }),\n });\n})();\n// RFC 9380 Appendix E.1 3-isogeny coefficients for secp256k1, stored in ascending degree order.\n// The final `1` in each denominator array is the explicit monic leading term.\nconst isoMap = /* @__PURE__ */ (() => isogenyMap(Fpk1, [\n // xNum\n [\n '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7',\n '0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581',\n '0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262',\n '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c',\n ],\n // xDen\n [\n '0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b',\n '0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14',\n '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n ],\n // yNum\n [\n '0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c',\n '0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3',\n '0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931',\n '0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84',\n ],\n // yDen\n [\n '0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b',\n '0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573',\n '0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f',\n '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n ],\n].map((i) => i.map((j) => BigInt(j)))))();\n// RFC 9380 §8.7 secp256k1 E' parameters for the SWU-to-isogeny pipeline below.\nlet mapSWU;\nconst getMapSWU = () => mapSWU ||\n (mapSWU = mapToCurveSimpleSWU(Fpk1, {\n // Building the SWU sqrt-ratio helper eagerly adds noticeable `secp256k1.js` import cost, so\n // defer it to first use; after that the cached mapper is reused directly.\n A: BigInt('0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533'),\n B: BigInt('1771'),\n Z: Fpk1.create(BigInt('-11')),\n }));\n/**\n * Hashing / encoding to secp256k1 points / field. RFC 9380 methods.\n * @example\n * Hash one message onto secp256k1.\n *\n * ```ts\n * const point = secp256k1_hasher.hashToCurve(new TextEncoder().encode('hello noble'));\n * ```\n */\nexport const secp256k1_hasher = /* @__PURE__ */ (() => createHasher(Pointk1, (scalars) => {\n const { x, y } = getMapSWU()(Fpk1.create(scalars[0]));\n return isoMap(x, y);\n}, {\n DST: 'secp256k1_XMD:SHA-256_SSWU_RO_',\n encodeDST: 'secp256k1_XMD:SHA-256_SSWU_NU_',\n p: Fpk1.ORDER,\n m: 1,\n k: 128,\n expand: 'xmd',\n hash: sha256,\n}))();\n/**\n * FROST threshold signatures over secp256k1. RFC 9591.\n * @example\n * Create one trusted-dealer package for 2-of-3 secp256k1 signing.\n *\n * ```ts\n * const alice = secp256k1_FROST.Identifier.derive('alice@example.com');\n * const bob = secp256k1_FROST.Identifier.derive('bob@example.com');\n * const carol = secp256k1_FROST.Identifier.derive('carol@example.com');\n * const deal = secp256k1_FROST.trustedDealer({ min: 2, max: 3 }, [alice, bob, carol]);\n * ```\n */\nexport const secp256k1_FROST = /* @__PURE__ */ (() => createFROST({\n name: 'FROST-secp256k1-SHA256-v1',\n Point: Pointk1,\n hashToScalar: secp256k1_hasher.hashToScalar,\n hash: sha256,\n}))();\n// Taproot utils\n// `undefined` means \"disable TapTweak entirely\"; callers that want the BIP-341/BIP-386 empty\n// merkle root must pass `new Uint8Array(0)` explicitly.\nfunction tweak(point, merkleRoot) {\n if (merkleRoot === undefined)\n return _0n;\n const x = pointToBytes(point);\n const t = bytesToNumberBE(taggedHash('TapTweak', x, merkleRoot));\n // BIP-341 taproot_tweak_pubkey/taproot_tweak_seckey: \"if t >= SECP256K1_ORDER:\n // raise ValueError\". TapTweak must reject overflow instead of reducing modulo n.\n if (!Pointk1.Fn.isValid(t))\n throw new Error('invalid TapTweak hash');\n return t;\n}\nfunction frostPubToEvenY(pub) {\n const VK = Pointk1.fromBytes(pub.commitments[0]);\n // Keep aliasing on the already-even path so wrapper callers can skip unnecessary cloning.\n if (hasEven(VK.y))\n return pub;\n return {\n signers: { min: pub.signers.min, max: pub.signers.max },\n commitments: pub.commitments.map((i) => Pointk1.fromBytes(i).negate().toBytes()),\n verifyingShares: Object.fromEntries(Object.entries(pub.verifyingShares).map(([k, v]) => [\n k,\n Pointk1.fromBytes(v).negate().toBytes(),\n ])),\n };\n}\nfunction frostSecretToEvenY(s, pub) {\n const VK = Pointk1.fromBytes(pub.commitments[0]);\n // Keep aliasing on the already-even path so wrapper callers can preserve package identity.\n if (hasEven(VK.y))\n return s;\n const Fn = Pointk1.Fn;\n return {\n ...s,\n signingShare: Fn.toBytes(Fn.neg(Fn.fromBytes(s.signingShare))),\n };\n}\nfunction frostNoncesToEvenY(PK, nonces) {\n if (hasEven(PK.y))\n return nonces;\n const Fn = Pointk1.Fn;\n return {\n binding: Fn.toBytes(Fn.neg(Fn.fromBytes(nonces.binding))),\n hiding: Fn.toBytes(Fn.neg(Fn.fromBytes(nonces.hiding))),\n };\n}\nfunction frostTweakSecret(s, pub, merkleRoot) {\n const Fn = Pointk1.Fn;\n const keyPackage = frostSecretToEvenY(s, pub);\n const evenPub = frostPubToEvenY(pub);\n const t = tweak(Pointk1.fromBytes(evenPub.commitments[0]), merkleRoot);\n const signingShare = Fn.toBytes(Fn.add(Fn.fromBytes(keyPackage.signingShare), t));\n return {\n identifier: keyPackage.identifier,\n signingShare,\n };\n}\nfunction frostTweakPublic(pub, merkleRoot) {\n const PKPackage = frostPubToEvenY(pub);\n const t = tweak(Pointk1.fromBytes(PKPackage.commitments[0]), merkleRoot);\n const tp = Pointk1.BASE.multiply(t);\n const commitments = PKPackage.commitments.map((c, i) => (i === 0 ? Pointk1.fromBytes(c).add(tp) : Pointk1.fromBytes(c)).toBytes());\n const verifyingShares = {};\n for (const k in PKPackage.verifyingShares) {\n verifyingShares[k] = Pointk1.fromBytes(PKPackage.verifyingShares[k]).add(tp).toBytes();\n }\n return {\n signers: { min: PKPackage.signers.min, max: PKPackage.signers.max },\n commitments,\n verifyingShares,\n };\n}\n/**\n * FROST threshold signatures over secp256k1-schnorr-taproot. RFC 9591.\n * DKG outputs are auto-tweaked with the empty Taproot merkle root for compatibility, while\n * `trustedDealer()` outputs stay untweaked unless callers apply the Taproot tweak themselves.\n * @example\n * Create one trusted-dealer package for Taproot-compatible FROST signing.\n *\n * ```ts\n * const alice = schnorr_FROST.Identifier.derive('alice@example.com');\n * const bob = schnorr_FROST.Identifier.derive('bob@example.com');\n * const carol = schnorr_FROST.Identifier.derive('carol@example.com');\n * const deal = schnorr_FROST.trustedDealer({ min: 2, max: 3 }, [alice, bob, carol]);\n * ```\n */\nexport const schnorr_FROST = /* @__PURE__ */ (() => createFROST({\n name: 'FROST-secp256k1-SHA256-TR-v1',\n Point: Pointk1,\n hashToScalar: secp256k1_hasher.hashToScalar,\n hash: sha256,\n // Taproot related hacks\n parsePublicKey(publicKey) {\n // External Taproot keys are x-only, but local key packages still use compressed points.\n if (publicKey.length === 32)\n return lift_x(bytesToNumberBE(publicKey));\n if (publicKey.length === 33)\n return Pointk1.fromBytes(publicKey);\n throw new Error(`expected x-only or compressed public key, got length=${publicKey.length}`);\n },\n adjustScalar(n) {\n const PK = Pointk1.BASE.multiply(n);\n return hasEven(PK.y) ? n : Pointk1.Fn.neg(n);\n },\n adjustPoint: (p) => (hasEven(p.y) ? p : p.negate()),\n challenge(R, PK, msg) {\n return challenge(pointToBytes(R), pointToBytes(PK), msg);\n },\n adjustNonces: frostNoncesToEvenY,\n adjustGroupCommitmentShare: (GC, GCShare) => (!hasEven(GC.y) ? GCShare.negate() : GCShare),\n adjustPublic: frostPubToEvenY,\n adjustSecret: frostSecretToEvenY,\n adjustTx: {\n // Compat with official implementation\n encode: (tx) => tx.subarray(1),\n decode: (tx) => concatBytes(Uint8Array.of(0x02), tx),\n },\n adjustDKG: (k) => {\n // Compatibility with frost-secp256k1-tr: DKG output is auto-tweaked with the\n // empty Taproot merkle root, while dealer-generated keys stay untweaked.\n const merkleRoot = new Uint8Array(0);\n return {\n public: frostTweakPublic(k.public, merkleRoot),\n secret: frostTweakSecret(k.secret, k.public, merkleRoot),\n };\n },\n}))();\n//# sourceMappingURL=secp256k1.js.map","/**\n\nSHA1 (RFC 3174), MD5 (RFC 1321), and RIPEMD160 legacy, weak hash functions.\nRFC 2286 only covers HMAC-RIPEMD160 wrapper material and test vectors,\nnot the base RIPEMD-160 compression spec.\nDon't use them in a new protocol. What \"weak\" means:\n\n- Collisions can be made with 2^18 effort in MD5, 2^60 in SHA1, 2^80 in RIPEMD160.\n- No practical pre-image attacks (only theoretical, 2^123.4)\n- HMAC seems kinda ok: https://www.rfc-editor.org/rfc/rfc6151\n * @module\n */\nimport { Chi, HashMD, Maj } from \"./_md.js\";\nimport { clean, createHasher, rotl } from \"./utils.js\";\n/** Initial SHA-1 state from RFC 3174 §6.1. */\nconst SHA1_IV = /* @__PURE__ */ Uint32Array.from([\n 0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0,\n]);\n// Reusable 80-word SHA-1 message schedule buffer.\nconst SHA1_W = /* @__PURE__ */ new Uint32Array(80);\n/** Internal SHA1 legacy hash class. */\nexport class _SHA1 extends HashMD {\n A = SHA1_IV[0] | 0;\n B = SHA1_IV[1] | 0;\n C = SHA1_IV[2] | 0;\n D = SHA1_IV[3] | 0;\n E = SHA1_IV[4] | 0;\n constructor() {\n super(64, 20, 8, false);\n }\n get() {\n const { A, B, C, D, E } = this;\n return [A, B, C, D, E];\n }\n set(A, B, C, D, E) {\n this.A = A | 0;\n this.B = B | 0;\n this.C = C | 0;\n this.D = D | 0;\n this.E = E | 0;\n }\n process(view, offset) {\n for (let i = 0; i < 16; i++, offset += 4)\n SHA1_W[i] = view.getUint32(offset, false);\n for (let i = 16; i < 80; i++)\n SHA1_W[i] = rotl(SHA1_W[i - 3] ^ SHA1_W[i - 8] ^ SHA1_W[i - 14] ^ SHA1_W[i - 16], 1);\n // Compression function main loop, 80 rounds\n let { A, B, C, D, E } = this;\n for (let i = 0; i < 80; i++) {\n let F, K;\n if (i < 20) {\n F = Chi(B, C, D);\n K = 0x5a827999;\n }\n else if (i < 40) {\n F = B ^ C ^ D;\n K = 0x6ed9eba1;\n }\n else if (i < 60) {\n F = Maj(B, C, D);\n K = 0x8f1bbcdc;\n }\n else {\n F = B ^ C ^ D;\n K = 0xca62c1d6;\n }\n const T = (rotl(A, 5) + F + E + K + SHA1_W[i]) | 0;\n E = D;\n D = C;\n C = rotl(B, 30);\n B = A;\n A = T;\n }\n // Add the compressed chunk to the current hash value\n A = (A + this.A) | 0;\n B = (B + this.B) | 0;\n C = (C + this.C) | 0;\n D = (D + this.D) | 0;\n E = (E + this.E) | 0;\n this.set(A, B, C, D, E);\n }\n roundClean() {\n clean(SHA1_W);\n }\n destroy() {\n // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves\n // update()/digest() callable on reused instances.\n this.destroyed = true;\n this.set(0, 0, 0, 0, 0);\n clean(this.buffer);\n }\n}\n/**\n * SHA1 (RFC 3174) legacy hash function. It was cryptographically broken.\n * @param msg - message bytes to hash\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA1.\n * ```ts\n * sha1(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha1 = /* @__PURE__ */ createHasher(() => new _SHA1());\n/** RFC 1321 `T[i]` uses `floor(2^32 * abs(sin(i)))`; this is the shared `2^32` scale factor. */\nconst p32 = /* @__PURE__ */ Math.pow(2, 32);\n/** RFC 1321 `T[1..64]` table. */\nconst K = /* @__PURE__ */ Array.from({ length: 64 }, (_, i) => Math.floor(p32 * Math.abs(Math.sin(i + 1))));\n/** MD5 initial state from RFC 1321, stored as 4 u32 words. */\nconst MD5_IV = /* @__PURE__ */ SHA1_IV.slice(0, 4);\n// Reusable 16-word MD5 message block buffer.\nconst MD5_W = /* @__PURE__ */ new Uint32Array(16);\n/** Internal MD5 legacy hash class. */\nexport class _MD5 extends HashMD {\n A = MD5_IV[0] | 0;\n B = MD5_IV[1] | 0;\n C = MD5_IV[2] | 0;\n D = MD5_IV[3] | 0;\n constructor() {\n super(64, 16, 8, true);\n }\n get() {\n const { A, B, C, D } = this;\n return [A, B, C, D];\n }\n set(A, B, C, D) {\n this.A = A | 0;\n this.B = B | 0;\n this.C = C | 0;\n this.D = D | 0;\n }\n process(view, offset) {\n for (let i = 0; i < 16; i++, offset += 4)\n MD5_W[i] = view.getUint32(offset, true);\n // Compression function main loop, 64 rounds\n let { A, B, C, D } = this;\n for (let i = 0; i < 64; i++) {\n let F, g, s;\n if (i < 16) {\n F = Chi(B, C, D);\n g = i;\n s = [7, 12, 17, 22];\n }\n else if (i < 32) {\n // RFC 1321 round 2 uses G(B,C,D) = (B & D) | (C & ~D), which is `Chi(D, B, C)`.\n F = Chi(D, B, C);\n g = (5 * i + 1) % 16;\n s = [5, 9, 14, 20];\n }\n else if (i < 48) {\n F = B ^ C ^ D;\n g = (3 * i + 5) % 16;\n s = [4, 11, 16, 23];\n }\n else {\n F = C ^ (B | ~D);\n g = (7 * i) % 16;\n s = [6, 10, 15, 21];\n }\n F = F + A + K[i] + MD5_W[g];\n A = D;\n D = C;\n C = B;\n B = B + rotl(F, s[i % 4]);\n }\n // Add the compressed chunk to the current hash value\n A = (A + this.A) | 0;\n B = (B + this.B) | 0;\n C = (C + this.C) | 0;\n D = (D + this.D) | 0;\n this.set(A, B, C, D);\n }\n roundClean() {\n clean(MD5_W);\n }\n destroy() {\n // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves\n // update()/digest() callable on reused instances.\n this.destroyed = true;\n this.set(0, 0, 0, 0);\n clean(this.buffer);\n }\n}\n/**\n * MD5 (RFC 1321) legacy hash function. It was cryptographically broken.\n * MD5 architecture is similar to SHA1, with some differences:\n * - Reduced output length: 16 bytes (128 bit) instead of 20\n * - 64 rounds, instead of 80\n * - Little-endian: could be faster, but will require more code\n * - Non-linear index selection: huge speed-up for unroll\n * - Per round constants: more memory accesses, additional speed-up for unroll\n * @param msg - message bytes to hash\n * @returns Digest bytes.\n * @example\n * Hash a message with MD5.\n * ```ts\n * md5(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const md5 = /* @__PURE__ */ createHasher(() => new _MD5());\n// RIPEMD-160\n// Permutation repeatedly applied to derive the later RIPEMD-160 message-order tables.\nconst Rho160 = /* @__PURE__ */ Uint8Array.from([\n 7, 4, 13, 1, 10, 6, 15, 3, 12, 0, 9, 5, 2, 14, 11, 8,\n]);\nconst Id160 = /* @__PURE__ */ (() => Uint8Array.from(new Array(16).fill(0).map((_, i) => i)))();\nconst Pi160 = /* @__PURE__ */ (() => Id160.map((i) => (9 * i + 5) % 16))();\n// Five left/right message-word orderings for the RIPEMD-160 dual-lane rounds.\nconst idxLR = /* @__PURE__ */ (() => {\n const L = [Id160];\n const R = [Pi160];\n const res = [L, R];\n for (let i = 0; i < 4; i++)\n for (let j of res)\n j.push(j[i].map((k) => Rho160[k]));\n return res;\n})();\nconst idxL = /* @__PURE__ */ (() => idxLR[0])();\nconst idxR = /* @__PURE__ */ (() => idxLR[1])();\n// const [idxL, idxR] = idxLR;\n// Base per-group shift table before the left/right message-order permutations are applied.\nconst shifts160 = /* @__PURE__ */ [\n [11, 14, 15, 12, 5, 8, 7, 9, 11, 13, 14, 15, 6, 7, 9, 8],\n [12, 13, 11, 15, 6, 9, 9, 7, 12, 15, 11, 13, 7, 8, 7, 7],\n [13, 15, 14, 11, 7, 7, 6, 8, 13, 14, 13, 12, 5, 5, 6, 9],\n [14, 11, 12, 14, 8, 6, 5, 5, 15, 12, 15, 14, 9, 9, 8, 6],\n [15, 12, 13, 13, 9, 5, 8, 6, 14, 11, 12, 11, 8, 6, 5, 5],\n].map((i) => Uint8Array.from(i));\nconst shiftsL160 = /* @__PURE__ */ idxL.map((idx, i) => idx.map((j) => shifts160[i][j]));\nconst shiftsR160 = /* @__PURE__ */ idxR.map((idx, i) => idx.map((j) => shifts160[i][j]));\n// Five left-lane additive constants for RIPEMD-160.\nconst Kl160 = /* @__PURE__ */ Uint32Array.from([\n 0x00000000, 0x5a827999, 0x6ed9eba1, 0x8f1bbcdc, 0xa953fd4e,\n]);\n// Five right-lane additive constants for RIPEMD-160.\nconst Kr160 = /* @__PURE__ */ Uint32Array.from([\n 0x50a28be6, 0x5c4dd124, 0x6d703ef3, 0x7a6d76e9, 0x00000000,\n]);\n// Called `f()` in the spec; valid `group` values are 0..4, and out-of-range\n// inputs currently fall through to the group-4 branch.\nfunction ripemd_f(group, x, y, z) {\n if (group === 0)\n return x ^ y ^ z;\n if (group === 1)\n return (x & y) | (~x & z);\n if (group === 2)\n return (x | ~y) ^ z;\n if (group === 3)\n return (x & z) | (y & ~z);\n return x ^ (y | ~z);\n}\n// Reusable 16-word RIPEMD-160 message block buffer.\nconst BUF_160 = /* @__PURE__ */ new Uint32Array(16);\n/**\n * Internal RIPEMD-160 legacy hash class.\n * RFC 2286 only adds HMAC-RIPEMD160 material, not the core hash specification.\n */\nexport class _RIPEMD160 extends HashMD {\n h0 = 0x67452301 | 0;\n h1 = 0xefcdab89 | 0;\n h2 = 0x98badcfe | 0;\n h3 = 0x10325476 | 0;\n h4 = 0xc3d2e1f0 | 0;\n constructor() {\n super(64, 20, 8, true);\n }\n get() {\n const { h0, h1, h2, h3, h4 } = this;\n return [h0, h1, h2, h3, h4];\n }\n set(h0, h1, h2, h3, h4) {\n this.h0 = h0 | 0;\n this.h1 = h1 | 0;\n this.h2 = h2 | 0;\n this.h3 = h3 | 0;\n this.h4 = h4 | 0;\n }\n process(view, offset) {\n for (let i = 0; i < 16; i++, offset += 4)\n BUF_160[i] = view.getUint32(offset, true);\n // prettier-ignore\n let al = this.h0 | 0, ar = al, bl = this.h1 | 0, br = bl, cl = this.h2 | 0, cr = cl, dl = this.h3 | 0, dr = dl, el = this.h4 | 0, er = el;\n // Instead of iterating 0 to 80, we split it into 5 groups\n // And use the groups in constants, functions, etc. Much simpler\n for (let group = 0; group < 5; group++) {\n const rGroup = 4 - group;\n const hbl = Kl160[group], hbr = Kr160[group]; // prettier-ignore\n const rl = idxL[group], rr = idxR[group]; // prettier-ignore\n const sl = shiftsL160[group], sr = shiftsR160[group]; // prettier-ignore\n for (let i = 0; i < 16; i++) {\n const tl = (rotl(al + ripemd_f(group, bl, cl, dl) + BUF_160[rl[i]] + hbl, sl[i]) + el) | 0;\n al = el, el = dl, dl = rotl(cl, 10) | 0, cl = bl, bl = tl; // prettier-ignore\n }\n // 2 loops are 10% faster\n for (let i = 0; i < 16; i++) {\n const tr = (rotl(ar + ripemd_f(rGroup, br, cr, dr) + BUF_160[rr[i]] + hbr, sr[i]) + er) | 0;\n ar = er, er = dr, dr = rotl(cr, 10) | 0, cr = br, br = tr; // prettier-ignore\n }\n }\n // Add the compressed chunk to the current hash value\n // Final recombination cross-adds the left/right lane accumulators into the next h0..h4 order.\n this.set((this.h1 + cl + dr) | 0, (this.h2 + dl + er) | 0, (this.h3 + el + ar) | 0, (this.h4 + al + br) | 0, (this.h0 + bl + cr) | 0);\n }\n roundClean() {\n clean(BUF_160);\n }\n destroy() {\n this.destroyed = true;\n clean(this.buffer);\n this.set(0, 0, 0, 0, 0);\n }\n}\n/**\n * RIPEMD-160 - a legacy hash function from 1990s.\n * RFC 2286 only covers HMAC-RIPEMD160 test material; the links below point\n * at the base RIPEMD-160 references.\n * * {@link https://homes.esat.kuleuven.be/~bosselae/ripemd160.html}\n * * {@link https://homes.esat.kuleuven.be/~bosselae/ripemd160/pdf/AB-9601/AB-9601.pdf}\n * @param msg - message bytes to hash\n * @returns Digest bytes.\n * @example\n * Hash a message with RIPEMD-160.\n * ```ts\n * ripemd160(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const ripemd160 = /* @__PURE__ */ createHasher(() => new _RIPEMD160());\n//# sourceMappingURL=legacy.js.map","import { secp256k1 } from '@noble/curves/secp256k1.js';\nimport { ripemd160 } from '@noble/hashes/legacy.js';\nimport { sha256 } from '@noble/hashes/sha2.js';\nimport { randomBytes } from 'crypto';\nimport {\n DigiIDCallbackData,\n DigiIDError,\n DigiIDUriOptions,\n DigiIDVerificationResult,\n DigiIDVerifyOptions\n} from './types';\n\n/**\n * Base58 alphabet used for Bitcoin/DigiByte addresses\n */\nconst BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';\n\n/**\n * Decode a base58 string to bytes\n */\nfunction base58Decode(str: string): Uint8Array {\n const bytes: number[] = [0];\n for (let i = 0; i < str.length; i++) {\n const char = str[i];\n if (!char) continue;\n const value = BASE58_ALPHABET.indexOf(char);\n if (value === -1) throw new Error('Invalid base58 character');\n\n for (let j = 0; j < bytes.length; j++) {\n bytes[j]! *= 58;\n }\n bytes[0]! += value;\n\n let carry = 0;\n for (let j = 0; j < bytes.length; j++) {\n const byte = bytes[j]!;\n bytes[j] = byte + carry;\n carry = bytes[j]! >> 8;\n bytes[j]! &= 0xff;\n }\n while (carry > 0) {\n bytes.push(carry & 0xff);\n carry >>= 8;\n }\n }\n\n // Add leading zeros\n for (let i = 0; i < str.length && str[i] === '1'; i++) {\n bytes.push(0);\n }\n\n return new Uint8Array(bytes.reverse());\n}\n\n/**\n * Decode a bech32 address (simplified for verification purposes)\n */\nfunction decodeBech32(address: string): { version: number; program: Uint8Array } | null {\n const CHARSET = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';\n\n const lowerAddr = address.toLowerCase();\n const parts = lowerAddr.split('1');\n if (parts.length !== 2) return null;\n\n const hrp = parts[0];\n const data = parts[1];\n if (!hrp || !data) return null;\n if (hrp !== 'dgb') return null;\n\n const values: number[] = [];\n for (const char of data) {\n const val = CHARSET.indexOf(char);\n if (val === -1) return null;\n values.push(val);\n }\n\n // Remove checksum (last 6 chars)\n const payload = values.slice(0, -6);\n if (payload.length < 1) return null;\n\n const version = payload[0];\n if (version === undefined) return null;\n\n // Convert from 5-bit to 8-bit\n const converted = convertBits(payload.slice(1), 5, 8, false);\n if (!converted) return null;\n\n return { version, program: new Uint8Array(converted) };\n}\n\n/**\n * Convert bits between different bit groups\n */\nfunction convertBits(data: number[], fromBits: number, toBits: number, pad: boolean): number[] | null {\n let acc = 0;\n let bits = 0;\n const result: number[] = [];\n const maxv = (1 << toBits) - 1;\n\n for (const value of data) {\n if (value < 0 || value >> fromBits !== 0) return null;\n acc = (acc << fromBits) | value;\n bits += fromBits;\n while (bits >= toBits) {\n bits -= toBits;\n result.push((acc >> bits) & maxv);\n }\n }\n\n if (pad) {\n if (bits > 0) result.push((acc << (toBits - bits)) & maxv);\n } else if (bits >= fromBits || ((acc << (toBits - bits)) & maxv)) {\n return null;\n }\n\n return result;\n}\n\n/**\n * Hash message with Bitcoin/DigiByte message signing format\n */\nfunction hashMessage(message: string, messagePrefix: string): Uint8Array {\n // The messagePrefix already includes the length byte (e.g., '\\x19DigiByte Signed Message:\\n')\n // where \\x19 = 25 = length of \"DigiByte Signed Message:\\n\"\n const prefixBuffer = new TextEncoder().encode(messagePrefix);\n\n const messageBuffer = new TextEncoder().encode(message);\n const messageLengthBytes: number[] = [];\n let messageLength = messageBuffer.length;\n\n // Encode message length as variable-length integer\n if (messageLength < 0xfd) {\n messageLengthBytes.push(messageLength);\n } else if (messageLength <= 0xffff) {\n messageLengthBytes.push(0xfd, messageLength & 0xff, (messageLength >> 8) & 0xff);\n } else if (messageLength <= 0xffffffff) {\n messageLengthBytes.push(\n 0xfe,\n messageLength & 0xff,\n (messageLength >> 8) & 0xff,\n (messageLength >> 16) & 0xff,\n (messageLength >> 24) & 0xff\n );\n } else {\n throw new Error('Message too long');\n }\n\n const messageLengthBuffer = new Uint8Array(messageLengthBytes);\n\n // Concatenate: prefix + messageLengthBuffer + message\n const totalLength = prefixBuffer.length + messageLengthBuffer.length + messageBuffer.length;\n const combined = new Uint8Array(totalLength);\n let offset = 0;\n\n combined.set(prefixBuffer, offset);\n offset += prefixBuffer.length;\n combined.set(messageLengthBuffer, offset);\n offset += messageLengthBuffer.length;\n combined.set(messageBuffer, offset);\n\n // Double SHA256\n return sha256(sha256(combined));\n}\n\n/**\n * Recover public key from signature\n */\nfunction recoverPublicKey(messageHash: Uint8Array, signature: Uint8Array): Uint8Array[] {\n if (signature.length !== 65) {\n throw new Error('Invalid signature length');\n }\n\n const firstByte = signature[0];\n if (firstByte === undefined) throw new Error('Invalid signature');\n\n const r = signature.slice(1, 33);\n const s = signature.slice(33, 65);\n\n const results: Uint8Array[] = [];\n\n // Try all recovery IDs (0-3) to be thorough\n // Some implementations may encode the recovery ID differently\n for (let recId = 0; recId < 4; recId++) {\n try {\n // Create signature object\n const sig = new secp256k1.Signature(\n BigInt('0x' + Array.from(r).map(b => b.toString(16).padStart(2, '0')).join('')),\n BigInt('0x' + Array.from(s).map(b => b.toString(16).padStart(2, '0')).join(''))\n ).addRecoveryBit(recId);\n\n const point = sig.recoverPublicKey(messageHash);\n\n // Add both compressed and uncompressed versions\n const compressedBytes = point.toBytes(true);\n const uncompressedBytes = point.toBytes(false);\n\n // Add compressed first (more common for SegWit)\n results.push(compressedBytes);\n results.push(uncompressedBytes);\n } catch {\n // This recovery ID didn't work, try the next one\n continue;\n }\n }\n\n if (results.length === 0) {\n throw new Error('Failed to recover any public keys');\n }\n\n return results;\n}\n\n/**\n * Hash160: RIPEMD160(SHA256(data))\n */\nfunction hash160(buffer: Uint8Array): Uint8Array {\n return ripemd160(sha256(buffer));\n}\n\n/**\n * Verify address matches public key\n */\nfunction verifyAddress(address: string, publicKey: Uint8Array): boolean {\n // Legacy address (starts with D or S)\n if (address.startsWith('D') || address.startsWith('S')) {\n try {\n const decoded = base58Decode(address);\n if (decoded.length < 25) return false;\n\n const payload = decoded.slice(0, -4);\n const checksum = decoded.slice(-4);\n\n const hash = sha256(sha256(payload));\n const expectedChecksum = hash.slice(0, 4);\n\n // Verify checksum\n if (!checksum.every((byte, i) => byte === expectedChecksum[i])) {\n return false;\n }\n\n const pubKeyHash = payload.slice(1);\n const computedHash = hash160(publicKey);\n\n return pubKeyHash.every((byte, i) => byte === computedHash[i]);\n } catch {\n return false;\n }\n }\n\n // Bech32 address (starts with dgb1)\n if (address.toLowerCase().startsWith('dgb1')) {\n try {\n const decoded = decodeBech32(address);\n if (!decoded) return false;\n\n const { version, program } = decoded;\n\n if (version === 0) {\n // For witness v0 P2WPKH, use hash160 of compressed public key\n let pkToHash = publicKey;\n\n // If uncompressed (65 bytes), convert to compressed (33 bytes)\n if (publicKey.length === 65) {\n const isEven = publicKey[64]! % 2 === 0;\n pkToHash = new Uint8Array(33);\n pkToHash[0] = isEven ? 0x02 : 0x03;\n pkToHash.set(publicKey.slice(1, 33), 1);\n }\n\n const computedHash = hash160(pkToHash);\n return program.every((byte, i) => byte === computedHash[i]);\n }\n\n return false;\n } catch {\n return false;\n }\n }\n\n return false;\n}\n\n/**\n * INTERNAL: Verifies the signature using @noble/curves.\n * Exported primarily for testing purposes (mocking/spying).\n * @internal\n */\nexport async function _internalVerifySignature(\n uri: string,\n address: string,\n signature: string\n): Promise<boolean> {\n // DigiByte Message Prefix\n const messagePrefix = '\\x19DigiByte Signed Message:\\n';\n\n try {\n // Decode base64 signature\n const sigBytes = Uint8Array.from(globalThis.atob(signature), c => c.charCodeAt(0));\n\n if (sigBytes.length !== 65) {\n throw new Error('Invalid signature length');\n }\n\n // Hash the message\n const messageHash = hashMessage(uri, messagePrefix);\n\n // Recover public key from signature\n const publicKeys = recoverPublicKey(messageHash, sigBytes);\n\n // Verify that at least one recovered public key matches the address\n for (const pubKey of publicKeys) {\n if (verifyAddress(address, pubKey)) {\n return true;\n }\n }\n\n return false;\n } catch (e: unknown) {\n const errorMessage = e instanceof Error ? e.message : String(e);\n throw new DigiIDError(`Signature verification failed: ${errorMessage}`);\n }\n}\n\n/**\n * Generates a secure random nonce (hex string).\n * @param length - The number of bytes to generate (default: 16, resulting in 32 hex chars).\n * @returns A hex-encoded random string.\n */\nfunction generateNonce(length = 16): string {\n return randomBytes(length).toString('hex');\n}\n\n/**\n * Generates a DigiID authentication URI.\n *\n * @param options - Options for URI generation, including the callback URL.\n * @returns The generated DigiID URI string.\n * @throws {DigiIDError} If the callback URL is invalid or missing.\n */\nexport function generateDigiIDUri(options: DigiIDUriOptions): string {\n if (!options.callbackUrl) {\n throw new DigiIDError('Callback URL is required.');\n }\n\n let parsedUrl: URL;\n try {\n parsedUrl = new URL(options.callbackUrl);\n } catch (e) {\n throw new DigiIDError(`Invalid callback URL: ${(e as Error).message}`);\n }\n\n // DigiID spec requires stripping the scheme (http/https)\n const domainAndPath = parsedUrl.host + parsedUrl.pathname;\n\n const nonce = options.nonce || generateNonce();\n const unsecureFlag = options.unsecure ? '1' : '0'; // 1 for http, 0 for https\n\n // Validate scheme based on unsecure flag\n if (options.unsecure && parsedUrl.protocol !== 'http:') {\n throw new DigiIDError('Unsecure flag is true, but callback URL does not use http protocol.');\n }\n if (!options.unsecure && parsedUrl.protocol !== 'https:') {\n throw new DigiIDError('Callback URL must use https protocol unless unsecure flag is set to true.');\n }\n\n // Construct the URI\n // Example: digiid://example.com/callback?x=nonce_value&u=0\n const uri = `digiid://${domainAndPath}?x=${nonce}&u=${unsecureFlag}`;\n\n // Clean up potential trailing slash in path if no query params exist (though DigiID always has params)\n // This check might be redundant given DigiID structure, but good practice\n // const cleanedUri = uri.endsWith('/') && parsedUrl.search === '' ? uri.slice(0, -1) : uri;\n\n return uri;\n}\n\n/**\n * Verifies the signature and data received from a DigiID callback.\n *\n * @param callbackData - The data received from the wallet (address, uri, signature).\n * @param verifyOptions - Options for verification, including the expected callback URL and nonce.\n * @returns {Promise<DigiIDVerificationResult>} A promise that resolves with verification details if successful.\n * @throws {DigiIDError} If validation or signature verification fails.\n */\nexport async function verifyDigiIDCallback(\n callbackData: DigiIDCallbackData,\n verifyOptions: DigiIDVerifyOptions\n): Promise<DigiIDVerificationResult> {\n const { address, uri, signature } = callbackData;\n const { expectedCallbackUrl, expectedNonce } = verifyOptions;\n\n if (!address || !uri || !signature) {\n throw new DigiIDError('Missing required callback data: address, uri, or signature.');\n }\n\n // 1. Parse the received URI\n let parsedReceivedUri: URL;\n try {\n // Temporarily replace digiid:// with http:// for standard URL parsing\n const parsableUri = uri.replace(/^digiid:/, 'http:');\n parsedReceivedUri = new URL(parsableUri);\n } catch (e) {\n throw new DigiIDError(`Invalid URI received in callback: ${(e as Error).message}`);\n }\n\n const receivedNonce = parsedReceivedUri.searchParams.get('x');\n const receivedUnsecure = parsedReceivedUri.searchParams.get('u'); // 0 or 1\n const receivedDomainAndPath = parsedReceivedUri.host + parsedReceivedUri.pathname;\n\n if (receivedNonce === null || receivedUnsecure === null) {\n throw new DigiIDError('URI missing nonce (x) or unsecure (u) parameter.');\n }\n\n // 2. Validate Callback URL\n let parsedExpectedUrl: URL;\n try {\n // Allow expectedCallbackUrl to be a string or URL object\n parsedExpectedUrl = typeof expectedCallbackUrl === 'string' ? new URL(expectedCallbackUrl) : expectedCallbackUrl;\n } catch (e) {\n throw new DigiIDError(`Invalid expectedCallbackUrl provided: ${(e as Error).message}`);\n }\n\n const expectedDomainAndPath = parsedExpectedUrl.host + parsedExpectedUrl.pathname;\n\n if (receivedDomainAndPath !== expectedDomainAndPath) {\n throw new DigiIDError(`Callback URL mismatch: URI contained \"${receivedDomainAndPath}\", expected \"${expectedDomainAndPath}\"`);\n }\n\n // Validate scheme consistency\n const expectedScheme = parsedExpectedUrl.protocol;\n if (receivedUnsecure === '1' && expectedScheme !== 'http:') {\n throw new DigiIDError('URI indicates unsecure (u=1), but expectedCallbackUrl is not http.');\n }\n if (receivedUnsecure === '0' && expectedScheme !== 'https:') {\n throw new DigiIDError('URI indicates secure (u=0), but expectedCallbackUrl is not https.');\n }\n\n // 3. Validate Nonce (optional)\n if (expectedNonce && receivedNonce !== expectedNonce) {\n throw new DigiIDError(`Nonce mismatch: URI contained \"${receivedNonce}\", expected \"${expectedNonce}\". Possible replay attack.`);\n }\n\n // 4. Verify Signature using internal helper\n try {\n const isValidSignature = await _internalVerifySignature(uri, address, signature);\n if (!isValidSignature) {\n // If the helper returns false, throw the standard invalid signature error\n throw new DigiIDError('Invalid signature.');\n }\n } catch (error) {\n // If _internalVerifySignature throws (e.g., due to format/checksum errors from the lib, or our re-thrown error),\n // re-throw it. It should already be a DigiIDError.\n if (error instanceof DigiIDError) {\n throw error;\n } else {\n // Catch any unexpected errors and wrap them\n throw new DigiIDError(`Unexpected error during signature verification: ${(error as Error).message}`);\n }\n }\n\n // 5. Return successful result\n return {\n isValid: true,\n address: address,\n nonce: receivedNonce, // Return the nonce from the URI\n };\n}\n"],"x_google_ignoreList":[1,2,3,4,5,6,7,8,9,10],"mappings":";;AAiDA,IAAa,IAAb,cAAiC,MAAM;CACrC,YAAY,GAAiB;EAE3B,AADA,MAAM,CAAO,GACb,KAAK,OAAO;CACd;AACF;;;AC5CA,SAAgBA,EAAQ,GAAG;CAKvB,OAAQ,aAAa,cAChB,YAAY,OAAO,CAAC,KACjB,EAAE,YAAY,SAAS,gBACvB,uBAAuB,KACvB,EAAE,sBAAsB;AACpC;AAaA,SAAgBC,EAAQ,GAAG,IAAQ,IAAI;CACnC,IAAI,OAAO,KAAM,UAAU;EACvB,IAAM,IAAS,KAAS,IAAI,EAAM;EAClC,MAAU,UAAU,GAAG,EAAO,uBAAuB,OAAO,GAAG;CACnE;CACA,IAAI,CAAC,OAAO,cAAc,CAAC,KAAK,IAAI,GAAG;EACnC,IAAM,IAAS,KAAS,IAAI,EAAM;EAClC,MAAU,WAAW,GAAG,EAAO,6BAA6B,GAAG;CACnE;AACJ;AAeA,SAAgBC,EAAO,GAAO,GAAQ,IAAQ,IAAI;CAC9C,IAAM,IAAQF,EAAQ,CAAK,GACrB,IAAM,GAAO,QACb,IAAW,MAAW,KAAA;CAC5B,IAAI,CAAC,KAAU,KAAY,MAAQ,GAAS;EACxC,IAAM,IAAS,KAAS,IAAI,EAAM,KAC5B,IAAQ,IAAW,cAAc,MAAW,IAC5C,IAAM,IAAQ,UAAU,MAAQ,QAAQ,OAAO,KAC/C,IAAU,IAAS,wBAAwB,IAAQ,WAAW;EAGpE,MAFK,IAEK,WAAW,CAAO,IADd,UAAU,CAAO;CAEnC;CACA,OAAO;AACX;AAgCA,SAAgB,EAAM,GAAG;CACrB,IAAI,OAAO,KAAM,cAAc,OAAO,EAAE,UAAW,YAC/C,MAAU,UAAU,yCAAyC;CAKjE,IAJA,EAAQ,EAAE,SAAS,GACnB,EAAQ,EAAE,QAAQ,GAGd,EAAE,YAAY,GACd,MAAU,MAAM,4BAA0B;CAC9C,IAAI,EAAE,WAAW,GACb,MAAU,MAAM,2BAAyB;AACjD;AAeA,SAAgB,EAAQ,GAAU,IAAgB,IAAM;CACpD,IAAI,EAAS,WACT,MAAU,MAAM,kCAAkC;CACtD,IAAI,KAAiB,EAAS,UAC1B,MAAU,MAAM,uCAAuC;AAC/D;AAiBA,SAAgB,EAAQ,GAAK,GAAU;CACnC,EAAO,GAAK,KAAA,GAAW,qBAAqB;CAC5C,IAAM,IAAM,EAAS;CACrB,IAAI,EAAI,SAAS,GACb,MAAU,WAAW,wDAAsD,CAAG;AAEtF;AAsCA,SAAgB,EAAM,GAAG,GAAQ;CAC7B,KAAK,IAAI,IAAI,GAAG,IAAI,EAAO,QAAQ,KAC/B,EAAO,GAAG,KAAK,CAAC;AAExB;AAWA,SAAgB,EAAW,GAAK;CAC5B,OAAO,IAAI,SAAS,EAAI,QAAQ,EAAI,YAAY,EAAI,UAAU;AAClE;AAYA,SAAgB,EAAK,GAAM,GAAO;CAC9B,OAAQ,KAAS,KAAK,IAAW,MAAS;AAC9C;AAYA,SAAgB,EAAK,GAAM,GAAO;CAC9B,OAAQ,KAAQ,IAAW,MAAU,KAAK,MAAY;AAC1D;AA+DA,IAAM,IAEN,OAAO,WAAW,KAAK,CAAC,CAAC,EAAE,SAAU,cAAc,OAAO,WAAW,WAAY,YAE3E,IAAwB,sBAAM,KAAK,EAAE,QAAQ,IAAI,IAAI,GAAG,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAcnG,SAAgBG,EAAW,GAAO;CAG9B,IAFA,EAAO,CAAK,GAER,GACA,OAAO,EAAM,MAAM;CAEvB,IAAI,IAAM;CACV,KAAK,IAAI,IAAI,GAAG,IAAI,EAAM,QAAQ,KAC9B,KAAO,EAAM,EAAM;CAEvB,OAAO;AACX;AAEA,IAAM,IAAS;CAAE,IAAI;CAAI,IAAI;CAAI,GAAG;CAAI,GAAG;CAAI,GAAG;CAAI,GAAG;AAAI;AAC7D,SAAS,EAAc,GAAI;CACvB,IAAI,KAAM,EAAO,MAAM,KAAM,EAAO,IAChC,OAAO,IAAK,EAAO;CACvB,IAAI,KAAM,EAAO,KAAK,KAAM,EAAO,GAC/B,OAAO,KAAM,EAAO,IAAI;CAC5B,IAAI,KAAM,EAAO,KAAK,KAAM,EAAO,GAC/B,OAAO,KAAM,EAAO,IAAI;AAEhC;AAaA,SAAgBC,EAAW,GAAK;CAC5B,IAAI,OAAO,KAAQ,UACf,MAAU,UAAU,8BAA8B,OAAO,CAAG;CAChE,IAAI,GACA,IAAI;EACA,OAAO,WAAW,QAAQ,CAAG;CACjC,SACO,GAAO;EAGV,MAFI,aAAiB,cACP,WAAW,EAAM,OAAO,IAChC;CACV;CAEJ,IAAM,IAAK,EAAI,QACT,IAAK,IAAK;CAChB,IAAI,IAAK,GACL,MAAU,WAAW,qDAAqD,CAAE;CAChF,IAAM,IAAQ,IAAI,WAAW,CAAE;CAC/B,KAAK,IAAI,IAAK,GAAG,IAAK,GAAG,IAAK,GAAI,KAAM,KAAM,GAAG;EAC7C,IAAM,IAAK,EAAc,EAAI,WAAW,CAAE,CAAC,GACrC,IAAK,EAAc,EAAI,WAAW,IAAK,CAAC,CAAC;EAC/C,IAAI,MAAO,KAAA,KAAa,MAAO,KAAA,GAAW;GACtC,IAAM,IAAO,EAAI,KAAM,EAAI,IAAK;GAChC,MAAU,WAAW,kDAAiD,IAAO,iBAAgB,CAAE;EACnG;EACA,EAAM,KAAM,IAAK,KAAK;CAC1B;CACA,OAAO;AACX;AAmFA,SAAgBC,EAAY,GAAG,GAAQ;CACnC,IAAI,IAAM;CACV,KAAK,IAAI,IAAI,GAAG,IAAI,EAAO,QAAQ,KAAK;EACpC,IAAM,IAAI,EAAO;EAEjB,AADA,EAAO,CAAC,GACR,KAAO,EAAE;CACb;CACA,IAAM,IAAM,IAAI,WAAW,CAAG;CAC9B,KAAK,IAAI,IAAI,GAAG,IAAM,GAAG,IAAI,EAAO,QAAQ,KAAK;EAC7C,IAAM,IAAI,EAAO;EAEjB,AADA,EAAI,IAAI,GAAG,CAAG,GACd,KAAO,EAAE;CACb;CACA,OAAO;AACX;AAoCA,SAAgB,EAAa,GAAU,IAAO,CAAC,GAAG;CAC9C,IAAM,KAAS,GAAK,MAAS,EAAS,CAAI,EACrC,OAAO,CAAG,EACV,OAAO,GACN,IAAM,EAAS,KAAA,CAAS;CAM9B,OALA,EAAM,YAAY,EAAI,WACtB,EAAM,WAAW,EAAI,UACrB,EAAM,SAAS,EAAI,QACnB,EAAM,UAAU,MAAS,EAAS,CAAI,GACtC,OAAO,OAAO,GAAO,CAAI,GAClB,OAAO,OAAO,CAAK;AAC9B;AAiBA,SAAgBC,EAAY,IAAc,IAAI;CAE1C,EAAQ,GAAa,aAAa;CAClC,IAAM,IAAK,OAAO,cAAe,WAAW,WAAW,SAAS;CAChE,IAAI,OAAO,GAAI,mBAAoB,YAC/B,MAAU,MAAM,wCAAwC;CAM5D,IAAI,IAAc,OACd,MAAU,WAAW,wCAAwC,GAAa;CAC9E,OAAO,EAAG,gBAAgB,IAAI,WAAW,CAAW,CAAC;AACzD;AAaA,IAAa,KAAW,OAAY,EAGhC,KAAK,WAAW,KAAK;CAAC;CAAM;CAAM;CAAM;CAAM;CAAM;CAAM;CAAM;CAAM;CAAM;CAAM;AAAM,CAAC,EAC7F;;;AC5iBA,SAAgB,EAAI,GAAG,GAAG,GAAG;CACzB,OAAQ,IAAI,IAAM,CAAC,IAAI;AAC3B;AAcA,SAAgB,EAAI,GAAG,GAAG,GAAG;CACzB,OAAQ,IAAI,IAAM,IAAI,IAAM,IAAI;AACpC;AAmBA,IAAa,IAAb,MAAoB;CAChB;CACA;CACA,SAAS;CACT;CACA;CAEA;CACA;CACA,WAAW;CACX,SAAS;CACT,MAAM;CACN,YAAY;CACZ,YAAY,GAAU,GAAW,GAAW,GAAM;EAM9C,AALA,KAAK,WAAW,GAChB,KAAK,YAAY,GACjB,KAAK,YAAY,GACjB,KAAK,OAAO,GACZ,KAAK,SAAS,IAAI,WAAW,CAAQ,GACrC,KAAK,OAAO,EAAW,KAAK,MAAM;CACtC;CACA,OAAO,GAAM;EAET,AADA,EAAQ,IAAI,GACZ,EAAO,CAAI;EACX,IAAM,EAAE,SAAM,WAAQ,gBAAa,MAC7B,IAAM,EAAK;EACjB,KAAK,IAAI,IAAM,GAAG,IAAM,IAAM;GAC1B,IAAM,IAAO,KAAK,IAAI,IAAW,KAAK,KAAK,IAAM,CAAG;GAGpD,IAAI,MAAS,GAAU;IACnB,IAAM,IAAW,EAAW,CAAI;IAChC,OAAO,KAAY,IAAM,GAAK,KAAO,GACjC,KAAK,QAAQ,GAAU,CAAG;IAC9B;GACJ;GAIA,AAHA,EAAO,IAAI,EAAK,SAAS,GAAK,IAAM,CAAI,GAAG,KAAK,GAAG,GACnD,KAAK,OAAO,GACZ,KAAO,GACH,KAAK,QAAQ,MACb,KAAK,QAAQ,GAAM,CAAC,GACpB,KAAK,MAAM;EAEnB;EAGA,OAFA,KAAK,UAAU,EAAK,QACpB,KAAK,WAAW,GACT;CACX;CACA,WAAW,GAAK;EAGZ,AAFA,EAAQ,IAAI,GACZ,EAAQ,GAAK,IAAI,GACjB,KAAK,WAAW;EAIhB,IAAM,EAAE,WAAQ,SAAM,aAAU,YAAS,MACrC,EAAE,WAAQ;EAMd,AAJA,EAAO,OAAS,KAChB,EAAM,KAAK,OAAO,SAAS,CAAG,CAAC,GAG3B,KAAK,YAAY,IAAW,MAC5B,KAAK,QAAQ,GAAM,CAAC,GACpB,IAAM;EAGV,KAAK,IAAI,IAAI,GAAK,IAAI,GAAU,KAC5B,EAAO,KAAK;EAKhB,AADA,EAAK,aAAa,IAAW,GAAG,OAAO,KAAK,SAAS,CAAC,GAAG,CAAI,GAC7D,KAAK,QAAQ,GAAM,CAAC;EACpB,IAAM,IAAQ,EAAW,CAAG,GACtB,IAAM,KAAK;EAEjB,IAAI,IAAM,GACN,MAAU,MAAM,2CAA2C;EAC/D,IAAM,IAAS,IAAM,GACf,IAAQ,KAAK,IAAI;EACvB,IAAI,IAAS,EAAM,QACf,MAAU,MAAM,oCAAoC;EACxD,KAAK,IAAI,IAAI,GAAG,IAAI,GAAQ,KACxB,EAAM,UAAU,IAAI,GAAG,EAAM,IAAI,CAAI;CAC7C;CACA,SAAS;EACL,IAAM,EAAE,WAAQ,iBAAc;EAC9B,KAAK,WAAW,CAAM;EAGtB,IAAM,IAAM,EAAO,MAAM,GAAG,CAAS;EAErC,OADA,KAAK,QAAQ,GACN;CACX;CACA,WAAW,GAAI;EAEX,AADA,MAAO,IAAI,KAAK,YAAY,GAC5B,EAAG,IAAI,GAAG,KAAK,IAAI,CAAC;EACpB,IAAM,EAAE,aAAU,WAAQ,WAAQ,aAAU,cAAW,WAAQ;EAS/D,OARA,EAAG,YAAY,GACf,EAAG,WAAW,GACd,EAAG,SAAS,GACZ,EAAG,MAAM,GAGL,IAAS,KACT,EAAG,OAAO,IAAI,CAAM,GACjB;CACX;CACA,QAAQ;EACJ,OAAO,KAAK,WAAW;CAC3B;AACJ,GAQa,IAA4B,4BAAY,KAAK;CACtD;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;AACxF,CAAC,GCpKK,IAA2B,4BAAY,KAAK;CAC9C;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CACpF;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;CAAY;AACxF,CAAC,GAEK,oBAA2B,IAAI,YAAY,EAAE,GAE7C,KAAN,cAAuB,EAAO;CAC1B,YAAY,GAAW;EACnB,MAAM,IAAI,GAAW,GAAG,EAAK;CACjC;CACA,MAAM;EACF,IAAM,EAAE,MAAG,MAAG,MAAG,MAAG,MAAG,MAAG,MAAG,SAAM;EACnC,OAAO;GAAC;GAAG;GAAG;GAAG;GAAG;GAAG;GAAG;GAAG;EAAC;CAClC;CAEA,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG;EAQxB,AAPA,KAAK,IAAI,IAAI,GACb,KAAK,IAAI,IAAI,GACb,KAAK,IAAI,IAAI,GACb,KAAK,IAAI,IAAI,GACb,KAAK,IAAI,IAAI,GACb,KAAK,IAAI,IAAI,GACb,KAAK,IAAI,IAAI,GACb,KAAK,IAAI,IAAI;CACjB;CACA,QAAQ,GAAM,GAAQ;EAElB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,KAAU,GACnC,EAAS,KAAK,EAAK,UAAU,GAAQ,EAAK;EAC9C,KAAK,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK;GAC1B,IAAM,IAAM,EAAS,IAAI,KACnB,IAAK,EAAS,IAAI,IAClB,IAAK,EAAK,GAAK,CAAC,IAAI,EAAK,GAAK,EAAE,IAAK,MAAQ;GAEnD,EAAS,MADE,EAAK,GAAI,EAAE,IAAI,EAAK,GAAI,EAAE,IAAK,MAAO,MAC7B,EAAS,IAAI,KAAK,IAAK,EAAS,IAAI,MAAO;EACnE;EAEA,IAAI,EAAE,MAAG,MAAG,MAAG,MAAG,MAAG,MAAG,MAAG,SAAM;EACjC,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;GACzB,IAAM,IAAS,EAAK,GAAG,CAAC,IAAI,EAAK,GAAG,EAAE,IAAI,EAAK,GAAG,EAAE,GAC9C,IAAM,IAAI,IAAS,EAAI,GAAG,GAAG,CAAC,IAAI,EAAS,KAAK,EAAS,KAAM,GAE/D,KADS,EAAK,GAAG,CAAC,IAAI,EAAK,GAAG,EAAE,IAAI,EAAK,GAAG,EAAE,KAC/B,EAAI,GAAG,GAAG,CAAC,IAAK;GAQrC,AAPA,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAK,IAAI,IAAM,GACf,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAK,IAAK,IAAM;EACpB;EAUA,AARA,IAAK,IAAI,KAAK,IAAK,GACnB,IAAK,IAAI,KAAK,IAAK,GACnB,IAAK,IAAI,KAAK,IAAK,GACnB,IAAK,IAAI,KAAK,IAAK,GACnB,IAAK,IAAI,KAAK,IAAK,GACnB,IAAK,IAAI,KAAK,IAAK,GACnB,IAAK,IAAI,KAAK,IAAK,GACnB,IAAK,IAAI,KAAK,IAAK,GACnB,KAAK,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;CACnC;CACA,aAAa;EACT,EAAM,CAAQ;CAClB;CACA,UAAU;EAKN,AAFA,KAAK,YAAY,IACjB,KAAK,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,GAC/B,EAAM,KAAK,MAAM;CACrB;AACJ,GAEa,KAAb,cAA6B,GAAS;CAGlC,IAAI,EAAU,KAAK;CACnB,IAAI,EAAU,KAAK;CACnB,IAAI,EAAU,KAAK;CACnB,IAAI,EAAU,KAAK;CACnB,IAAI,EAAU,KAAK;CACnB,IAAI,EAAU,KAAK;CACnB,IAAI,EAAU,KAAK;CACnB,IAAI,EAAU,KAAK;CACnB,cAAc;EACV,MAAM,EAAE;CACZ;AACJ,GA0Ra,IAAyB,wBAAmB,IAAI,GAAQ,GACrD,kBAAQ,CAAI,CAAC,GCvXhB,KAAU,GAAO,GAAQ,MAAUC,EAAQ,GAAO,GAAQ,CAAK,GAY/D,IAAUC,GAYV,KAAaC,GAYb,KAAe,GAAG,MAAWC,EAAa,GAAG,CAAM,GAYnD,KAAc,MAAQC,EAAY,CAAG,GAYrC,KAAUC,GAYVC,MAAe,MAAgBC,EAAa,CAAW,GAC9DC,IAAsB,uBAAO,CAAC,GAC9BC,IAAsB,uBAAO,CAAC;AAcpC,SAAgB,EAAM,GAAO,IAAQ,IAAI;CACrC,IAAI,OAAO,KAAU,WAAW;EAC5B,IAAM,IAAS,KAAS,IAAI,EAAM;EAClC,MAAU,UAAU,IAAS,gCAAgC,OAAO,CAAK;CAC7E;CACA,OAAO;AACX;AAaA,SAAgB,GAAW,GAAG;CAC1B,IAAI,OAAO,KAAM;MACT,CAAC,EAAS,CAAC,GACX,MAAU,WAAW,mCAAmC,CAAC;CAAA,OAG7D,EAAQ,CAAC;CACb,OAAO;AACX;AAcA,SAAgB,GAAY,GAAO,IAAQ,IAAI;CAC3C,IAAI,OAAO,KAAU,UAAU;EAC3B,IAAM,IAAS,KAAS,IAAI,EAAM;EAClC,MAAU,UAAU,IAAS,+BAA+B,OAAO,CAAK;CAC5E;CACA,IAAI,CAAC,OAAO,cAAc,CAAK,GAAG;EAC9B,IAAM,IAAS,KAAS,IAAI,EAAM;EAClC,MAAU,WAAW,IAAS,gCAAgC,CAAK;CACvE;AACJ;AAeA,SAAgB,EAAoB,GAAK;CACrC,IAAM,IAAM,GAAW,CAAG,EAAE,SAAS,EAAE;CACvC,OAAO,EAAI,SAAS,IAAI,MAAM,IAAM;AACxC;AAeA,SAAgB,GAAY,GAAK;CAC7B,IAAI,OAAO,KAAQ,UACf,MAAU,UAAU,8BAA8B,OAAO,CAAG;CAChE,OAAO,MAAQ,KAAKD,IAAM,OAAO,OAAO,CAAG;AAC/C;AAcA,SAAgB,EAAgB,GAAO;CACnC,OAAO,GAAYN,EAAY,CAAK,CAAC;AACzC;AAaA,SAAgB,GAAgB,GAAO;CACnC,OAAO,GAAYA,EAAY,GAAUF,EAAQ,CAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AACvE;AAcA,SAAgB,GAAgB,GAAG,GAAK;CAEpC,IADA,EAAS,CAAG,GACR,MAAQ,GACR,MAAU,WAAW,aAAa;CACtC,IAAI,GAAW,CAAC;CAChB,IAAM,IAAM,EAAE,SAAS,EAAE;CAEzB,IAAI,EAAI,SAAS,IAAM,GACnB,MAAU,WAAW,kBAAkB;CAC3C,OAAOI,EAAY,EAAI,SAAS,IAAM,GAAG,GAAG,CAAC;AACjD;AAcA,SAAgB,GAAgB,GAAG,GAAK;CACpC,OAAO,GAAgB,GAAG,CAAG,EAAE,QAAQ;AAC3C;AAoDA,SAAgB,GAAU,GAAO;CAG7B,OAAO,WAAW,KAAK,EAAO,CAAK,CAAC;AACxC;AA2BA,IAAM,KAAY,MAAM,OAAO,KAAM,YAAYI,KAAO;AAcxD,SAAgB,GAAQ,GAAG,GAAK,GAAK;CACjC,OAAO,EAAS,CAAC,KAAK,EAAS,CAAG,KAAK,EAAS,CAAG,KAAK,KAAO,KAAK,IAAI;AAC5E;AAiBA,SAAgB,GAAS,GAAO,GAAG,GAAK,GAAK;CAMzC,IAAI,CAAC,GAAQ,GAAG,GAAK,CAAG,GACpB,MAAU,WAAW,oBAAoB,IAAQ,OAAO,IAAM,aAAa,IAAM,WAAW,CAAC;AACrG;AAgBA,SAAgB,GAAO,GAAG;CAGtB,IAAI,IAAIA,GACJ,MAAU,MAAM,uCAAuC,CAAC;CAC5D,IAAI;CACJ,KAAK,IAAM,GAAG,IAAIA,GAAK,MAAMC,GAAK,KAAO;CAEzC,OAAO;AACX;AAoDA,IAAa,MAAW,OAAOA,KAAO,OAAO,CAAC,KAAKA;AAsBnD,SAAgB,GAAe,GAAS,GAAU,GAAQ;CAGtD,IAFA,EAAS,GAAS,SAAS,GAC3B,EAAS,GAAU,UAAU,GACzB,OAAO,KAAW,YAClB,MAAU,UAAU,2BAA2B;CAEnD,IAAM,KAAO,MAAQ,IAAI,WAAW,CAAG,GACjC,IAAO,WAAW,GAAG,GACrB,IAAQ,WAAW,GAAG,CAAI,GAC1B,IAAQ,WAAW,GAAG,CAAI,GAI5B,IAAI,EAAI,CAAO,GAEf,IAAI,EAAI,CAAO,GACf,IAAI,GACF,UAAc;EAGhB,AAFA,EAAE,KAAK,CAAC,GACR,EAAE,KAAK,CAAC,GACR,IAAI;CACR,GAEM,KAAK,GAAG,MAAS,EAAO,GAAG,EAAY,GAAG,GAAG,CAAI,CAAC,GAClD,KAAU,IAAO,MAAS;EAE5B,IAAI,EAAE,GAAO,CAAI,GACjB,IAAI,EAAE,GACF,EAAK,WAAW,MAEpB,IAAI,EAAE,GAAO,CAAI,GACjB,IAAI,EAAE;CACV,GACM,UAAY;EAEd,IAAI,OAAO,KACP,MAAU,MAAM,sCAAsC;EAC1D,IAAI,IAAM,GACJ,IAAM,CAAC;EACb,OAAO,IAAM,IAAU;GACnB,IAAI,EAAE;GACN,IAAM,IAAK,EAAE,MAAM;GAEnB,AADA,EAAI,KAAK,CAAE,GACX,KAAO,EAAE;EACb;EACA,OAAO,EAAY,GAAG,CAAG;CAC7B;CAWA,QAVkB,GAAM,MAAS;EAE7B,AADA,EAAM,GACN,EAAO,CAAI;EACX,IAAI;EAEJ,QAAQ,IAAM,EAAK,EAAI,CAAC,OAAO,KAAA,IAC3B,EAAO;EAEX,OADA,EAAM,GACC;CACX;AAEJ;AAgBA,SAAgB,EAAe,GAAQ,IAAS,CAAC,GAAG,IAAY,CAAC,GAAG;CAChE,IAAI,OAAO,UAAU,SAAS,KAAK,CAAM,MAAM,mBAC3C,MAAU,UAAU,+BAA+B;CACvD,SAAS,EAAW,GAAW,GAAc,GAAO;EAGhD,IAAI,CAAC,KAAS,MAAiB,cAAc,CAAC,OAAO,OAAO,GAAQ,CAAS,GACzE,MAAU,UAAU,UAAU,EAAU,oCAAoC;EAChF,IAAM,IAAM,EAAO;EACnB,IAAI,KAAS,MAAQ,KAAA,GACjB;EACJ,IAAM,IAAU,OAAO;EACvB,IAAI,MAAY,KAAgB,MAAQ,MACpC,MAAU,UAAU,UAAU,EAAU,yBAAyB,EAAa,QAAQ,GAAS;CACvG;CACA,IAAM,KAAQ,GAAG,MAAU,OAAO,QAAQ,CAAC,EAAE,SAAS,CAAC,GAAG,OAAO,EAAW,GAAG,GAAG,CAAK,CAAC;CAExF,AADA,EAAK,GAAQ,EAAK,GAClB,EAAK,GAAW,EAAI;AACxB;;;AC1jBA,IAAMC,IAAsB,uBAAO,CAAC,GAAGC,IAAsB,uBAAO,CAAC,GAAGC,IAAsB,uBAAO,CAAC,GAEhGC,KAAsB,uBAAO,CAAC,GAAGC,KAAsB,uBAAO,CAAC,GAAG,KAAsB,uBAAO,CAAC,GAEhG,KAAsB,uBAAO,CAAC,GAAG,KAAsB,uBAAO,CAAC,GAAG,KAAsB,uBAAO,CAAC,GAChG,KAAuB,uBAAO,EAAE;AAatC,SAAgB,EAAI,GAAG,GAAG;CACtB,IAAI,KAAKJ,GACL,MAAU,MAAM,yCAAyC,CAAC;CAC9D,IAAM,IAAS,IAAI;CACnB,OAAO,KAAUA,IAAM,IAAS,IAAI;AACxC;AAqCA,SAAgB,EAAK,GAAG,GAAO,GAAQ;CACnC,IAAI,IAAQA,GACR,MAAU,MAAM,+CAA+C,CAAK;CACxE,IAAI,IAAM;CACV,OAAO,MAAUA,IAEb,AADA,KAAO,GACP,KAAO;CAEX,OAAO;AACX;AAeA,SAAgB,GAAO,GAAQ,GAAQ;CACnC,IAAI,MAAWA,GACX,MAAU,MAAM,kCAAkC;CACtD,IAAI,KAAUA,GACV,MAAU,MAAM,4CAA4C,CAAM;CAEtE,IAAI,IAAI,EAAI,GAAQ,CAAM,GACtB,IAAI,GAEJ,IAAIA,GAAK,IAAIC,GAAK,IAAIA,GAAK,IAAID;CACnC,OAAO,MAAMA,IAAK;EACd,IAAM,IAAI,IAAI,GACR,IAAI,IAAI,IAAI,GACZ,IAAI,IAAI,IAAI,GACZ,IAAI,IAAI,IAAI;EAElB,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI;CAC3C;CAEA,IAAIK,MAAQJ,GACR,MAAU,MAAM,wBAAwB;CAC5C,OAAO,EAAI,GAAG,CAAM;AACxB;AACA,SAAS,GAAe,GAAI,GAAM,GAAG;CACjC,IAAM,IAAI;CACV,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAI,GAAG,CAAC,GACrB,MAAU,MAAM,yBAAyB;AACjD;AAKA,SAAS,GAAU,GAAI,GAAG;CACtB,IAAM,IAAI,GACJ,KAAU,EAAE,QAAQA,KAAOG,IAC3B,IAAO,EAAE,IAAI,GAAG,CAAM;CAE5B,OADA,GAAe,GAAG,GAAM,CAAC,GAClB;AACX;AAGA,SAAS,GAAU,GAAI,GAAG;CACtB,IAAM,IAAI,GACJ,KAAU,EAAE,QAAQ,MAAO,IAC3B,IAAK,EAAE,IAAI,GAAGF,CAAG,GACjB,IAAI,EAAE,IAAI,GAAI,CAAM,GACpB,IAAK,EAAE,IAAI,GAAG,CAAC,GACf,IAAI,EAAE,IAAI,EAAE,IAAI,GAAIA,CAAG,GAAG,CAAC,GAC3B,IAAO,EAAE,IAAI,GAAI,EAAE,IAAI,GAAG,EAAE,GAAG,CAAC;CAEtC,OADA,GAAe,GAAG,GAAM,CAAC,GAClB;AACX;AAGA,SAAS,GAAW,GAAG;CACnB,IAAM,IAAM,EAAM,CAAC,GACb,IAAK,GAAc,CAAC,GACpB,IAAK,EAAG,GAAK,EAAI,IAAI,EAAI,GAAG,CAAC,GAC7B,IAAK,EAAG,GAAK,CAAE,GACf,IAAK,EAAG,GAAK,EAAI,IAAI,CAAE,CAAC,GACxB,KAAM,IAAI,MAAO;CACvB,SAAS,GAAI,MAAM;EACf,IAAM,IAAI,GACN,IAAM,EAAE,IAAI,GAAG,CAAE,GACjB,IAAM,EAAE,IAAI,GAAK,CAAE,GACjB,IAAM,EAAE,IAAI,GAAK,CAAE,GACnB,IAAM,EAAE,IAAI,GAAK,CAAE,GACnB,IAAK,EAAE,IAAI,EAAE,IAAI,CAAG,GAAG,CAAC,GACxB,IAAK,EAAE,IAAI,EAAE,IAAI,CAAG,GAAG,CAAC;EAE9B,AADA,IAAM,EAAE,KAAK,GAAK,GAAK,CAAE,GACzB,IAAM,EAAE,KAAK,GAAK,GAAK,CAAE;EACzB,IAAM,IAAK,EAAE,IAAI,EAAE,IAAI,CAAG,GAAG,CAAC,GACxB,IAAO,EAAE,KAAK,GAAK,GAAK,CAAE;EAEhC,OADA,GAAe,GAAG,GAAM,CAAC,GAClB;CACX;AACJ;AAmBA,SAAgB,GAAc,GAAG;CAG7B,IAAI,IAAIC,IACJ,MAAU,MAAM,qCAAqC;CAEzD,IAAI,IAAI,IAAIF,GACR,IAAI;CACR,OAAO,IAAIC,MAAQF,IAEf,AADA,KAAKE,GACL;CAGJ,IAAI,IAAIA,GACF,IAAM,EAAM,CAAC;CACnB,OAAO,GAAW,GAAK,CAAC,MAAM,IAG1B,IAAI,MAAM,KACN,MAAU,MAAM,+CAA+C;CAGvE,IAAI,MAAM,GACN,OAAO;CAGX,IAAI,IAAK,EAAI,IAAI,GAAG,CAAC,GACf,KAAU,IAAID,KAAOC;CAC3B,OAAO,SAAqB,GAAI,GAAG;EAC/B,IAAM,IAAI;EACV,IAAI,EAAE,IAAI,CAAC,GACP,OAAO;EAEX,IAAI,GAAW,GAAG,CAAC,MAAM,GACrB,MAAU,MAAM,yBAAyB;EAE7C,IAAI,IAAI,GACJ,IAAI,EAAE,IAAI,EAAE,KAAK,CAAE,GACnB,IAAI,EAAE,IAAI,GAAG,CAAC,GACd,IAAI,EAAE,IAAI,GAAG,CAAM;EAGvB,OAAO,CAAC,EAAE,IAAI,GAAG,EAAE,GAAG,IAAG;GACrB,IAAI,EAAE,IAAI,CAAC,GACP,OAAO,EAAE;GACb,IAAI,IAAI,GAEJ,IAAQ,EAAE,IAAI,CAAC;GACnB,OAAO,CAAC,EAAE,IAAI,GAAO,EAAE,GAAG,IAGtB,IAFA,KACA,IAAQ,EAAE,IAAI,CAAK,GACf,MAAM,GACN,MAAU,MAAM,yBAAyB;GAGjD,IAAM,IAAWD,KAAO,OAAO,IAAI,IAAI,CAAC,GAClC,IAAI,EAAE,IAAI,GAAG,CAAQ;GAK3B,AAHA,IAAI,GACJ,IAAI,EAAE,IAAI,CAAC,GACX,IAAI,EAAE,IAAI,GAAG,CAAC,GACd,IAAI,EAAE,IAAI,GAAG,CAAC;EAClB;EACA,OAAO;CACX;AACJ;AAyBA,SAAgB,GAAO,GAAG;CAWtB,OATI,IAAIG,OAAQD,KACL,KAEP,IAAI,OAAQ,KACL,KAEP,IAAI,OAAS,KACN,GAAW,CAAC,IAEhB,GAAc,CAAC;AAC1B;AAkBA,IAAM,KAAe;CACjB;CAAU;CAAW;CAAO;CAAO;CAAO;CAAQ;CAClD;CAAO;CAAO;CAAO;CAAO;CAAO;CACnC;CAAQ;CAAQ;CAAQ;AAC5B;AAeA,SAAgB,GAAc,GAAO;CAiBjC,IAPA,EAAe,GAJF,GAAa,QAAQ,GAAK,OACnC,EAAI,KAAO,YACJ,IACR;EAPC,OAAO;EACP,OAAO;EACP,MAAM;CAKD,CACgB,CAAC,GAG1B,GAAY,EAAM,OAAO,OAAO,GAChC,GAAY,EAAM,MAAM,MAAM,GAG1B,EAAM,QAAQ,KAAK,EAAM,OAAO,GAChC,MAAU,MAAM,wCAAwC;CAC5D,IAAI,EAAM,SAASF,GACf,MAAU,MAAM,4CAA4C,EAAM,KAAK;CAC3E,OAAO;AACX;AAmBA,SAAgB,GAAM,GAAI,GAAK,GAAO;CAClC,IAAM,IAAI;CACV,IAAI,IAAQD,GACR,MAAU,MAAM,yCAAyC;CAC7D,IAAI,MAAUA,GACV,OAAO,EAAE;CACb,IAAI,MAAUC,GACV,OAAO;CACX,IAAI,IAAI,EAAE,KACN,IAAI;CACR,OAAO,IAAQD,IAIX,AAHI,IAAQC,MACR,IAAI,EAAE,IAAI,GAAG,CAAC,IAClB,IAAI,EAAE,IAAI,CAAC,GACX,MAAUA;CAEd,OAAO;AACX;AAiBA,SAAgB,GAAc,GAAI,GAAM,IAAW,IAAO;CACtD,IAAM,IAAI,GACJ,IAAe,MAAM,EAAK,MAAM,EAAE,KAAK,IAAW,EAAE,OAAO,KAAA,CAAS,GAEpE,IAAgB,EAAK,QAAQ,GAAK,GAAK,MACrC,EAAE,IAAI,CAAG,IACF,KACX,EAAS,KAAK,GACP,EAAE,IAAI,GAAK,CAAG,IACtB,EAAE,GAAG,GAEF,IAAc,EAAE,IAAI,CAAa;CAQvC,OANA,EAAK,aAAa,GAAK,GAAK,MACpB,EAAE,IAAI,CAAG,IACF,KACX,EAAS,KAAK,EAAE,IAAI,GAAK,EAAS,EAAE,GAC7B,EAAE,IAAI,GAAK,CAAG,IACtB,CAAW,GACP;AACX;AAyCA,SAAgB,GAAW,GAAI,GAAG;CAC9B,IAAM,IAAI,GAGJ,KAAU,EAAE,QAAQA,KAAOC,GAC3B,IAAU,EAAE,IAAI,GAAG,CAAM,GACzB,IAAM,EAAE,IAAI,GAAS,EAAE,GAAG,GAC1B,IAAO,EAAE,IAAI,GAAS,EAAE,IAAI,GAC5B,IAAK,EAAE,IAAI,GAAS,EAAE,IAAI,EAAE,GAAG,CAAC;CACtC,IAAI,CAAC,KAAO,CAAC,KAAQ,CAAC,GAClB,MAAU,MAAM,gCAAgC;CACpD,OAAO,IAAM,IAAI,IAAO,IAAI;AAChC;AAkCA,SAAgB,GAAQ,GAAG,GAAY;CAInC,IAFI,MAAe,KAAA,KACf,EAAQ,CAAU,GAClB,KAAKF,GACL,MAAU,MAAM,gDAAgD,CAAC;CACrE,IAAI,MAAe,KAAA,KAAa,IAAa,GACzC,MAAU,MAAM,yDAAyD,CAAU;CACvF,IAAM,IAAO,GAAO,CAAC;CAGrB,IAAI,MAAe,KAAA,KAAa,IAAa,GACzC,MAAU,MAAM,0CAA0C,EAAK,iBAAiB,EAAW,EAAE;CACjG,IAAM,IAAc,MAAe,KAAA,IAAyB,IAAb;CAE/C,OAAO;EAAE,YAAY;EAAa,aADd,KAAK,KAAK,IAAc,CACA;CAAE;AAClD;AAGA,IAAM,qBAAa,IAAI,QAAQ,GACzB,KAAN,MAAa;CACT;CACA;CACA;CACA;CACA,OAAOA;CACP,MAAMC;CACN;CACA;CACA,YAAY,GAAO,IAAO,CAAC,GAAG;EAG1B,IAAI,KAASA,GACT,MAAU,MAAM,4CAA4C,CAAK;EACrE,IAAI;EAEJ,AADA,KAAK,OAAO,IACQ,OAAO,KAAS,YAAhC,MAEI,OAAO,EAAK,QAAS,aACrB,IAAc,EAAK,OACnB,OAAO,EAAK,QAAS,cAGrB,OAAO,eAAe,MAAM,QAAQ;GAAE,OAAO,EAAK;GAAM,YAAY;EAAK,CAAC,GAC1E,OAAO,EAAK,QAAS,cACrB,KAAK,OAAO,EAAK,OACjB,EAAK,mBACL,KAAK,WAAW,OAAO,OAAO,EAAK,eAAe,MAAM,CAAC,IACzD,OAAO,EAAK,gBAAiB,cAC7B,KAAK,OAAO,EAAK;EAEzB,IAAM,EAAE,eAAY,mBAAgB,GAAQ,GAAO,CAAW;EAC9D,IAAI,IAAc,MACd,MAAU,MAAM,gDAAgD;EAIpE,AAHA,KAAK,QAAQ,GACb,KAAK,OAAO,GACZ,KAAK,QAAQ,GACb,OAAO,OAAO,IAAI;CACtB;CACA,OAAO,GAAK;EACR,OAAO,EAAI,GAAK,KAAK,KAAK;CAC9B;CACA,QAAQ,GAAK;EACT,IAAI,OAAO,KAAQ,UACf,MAAU,UAAU,iDAAiD,OAAO,CAAG;EACnF,OAAOD,KAAO,KAAO,IAAM,KAAK;CACpC;CACA,IAAI,GAAK;EACL,OAAO,MAAQA;CACnB;CAEA,YAAY,GAAK;EACb,OAAO,CAAC,KAAK,IAAI,CAAG,KAAK,KAAK,QAAQ,CAAG;CAC7C;CACA,MAAM,GAAK;EACP,QAAQ,IAAMC,OAASA;CAC3B;CACA,IAAI,GAAK;EACL,OAAO,EAAI,CAAC,GAAK,KAAK,KAAK;CAC/B;CACA,IAAI,GAAK,GAAK;EACV,OAAO,MAAQ;CACnB;CACA,IAAI,GAAK;EACL,OAAO,EAAI,IAAM,GAAK,KAAK,KAAK;CACpC;CACA,IAAI,GAAK,GAAK;EACV,OAAO,EAAI,IAAM,GAAK,KAAK,KAAK;CACpC;CACA,IAAI,GAAK,GAAK;EACV,OAAO,EAAI,IAAM,GAAK,KAAK,KAAK;CACpC;CACA,IAAI,GAAK,GAAK;EACV,OAAO,EAAI,IAAM,GAAK,KAAK,KAAK;CACpC;CACA,IAAI,GAAK,GAAO;EACZ,OAAO,GAAM,MAAM,GAAK,CAAK;CACjC;CACA,IAAI,GAAK,GAAK;EACV,OAAO,EAAI,IAAM,GAAO,GAAK,KAAK,KAAK,GAAG,KAAK,KAAK;CACxD;CAEA,KAAK,GAAK;EACN,OAAO,IAAM;CACjB;CACA,KAAK,GAAK,GAAK;EACX,OAAO,IAAM;CACjB;CACA,KAAK,GAAK,GAAK;EACX,OAAO,IAAM;CACjB;CACA,KAAK,GAAK,GAAK;EACX,OAAO,IAAM;CACjB;CACA,IAAI,GAAK;EACL,OAAO,GAAO,GAAK,KAAK,KAAK;CACjC;CACA,KAAK,GAAK;EAGN,IAAI,IAAO,GAAW,IAAI,IAAI;EAG9B,OAFK,KACD,GAAW,IAAI,MAAO,IAAO,GAAO,KAAK,KAAK,CAAE,GAC7C,EAAK,MAAM,CAAG;CACzB;CACA,QAAQ,GAAK;EAIT,OAAO,KAAK,OAAO,GAAgB,GAAK,KAAK,KAAK,IAAI,GAAgB,GAAK,KAAK,KAAK;CACzF;CACA,UAAU,GAAO,IAAiB,IAAO;EACrC,EAAO,CAAK;EACZ,IAAM,EAAE,UAAU,GAAgB,UAAO,SAAM,UAAO,MAAM,MAAiB;EAC7E,IAAI,GAAgB;GAGhB,IAAI,EAAM,SAAS,KAAK,CAAC,EAAe,SAAS,EAAM,MAAM,KAAK,EAAM,SAAS,GAC7E,MAAU,MAAM,+BAA+B,IAAiB,iBAAiB,EAAM,MAAM;GAEjG,IAAM,IAAS,IAAI,WAAW,CAAK;GAGnC,AADA,EAAO,IAAI,GAAO,IAAO,IAAI,EAAO,SAAS,EAAM,MAAM,GACzD,IAAQ;EACZ;EACA,IAAI,EAAM,WAAW,GACjB,MAAU,MAAM,+BAA+B,IAAQ,iBAAiB,EAAM,MAAM;EACxF,IAAI,IAAS,IAAO,GAAgB,CAAK,IAAI,EAAgB,CAAK;EAGlE,IAFI,MACA,IAAS,EAAI,GAAQ,CAAK,IAC1B,CAAC,KACG,CAAC,KAAK,QAAQ,CAAM,GACpB,MAAU,MAAM,kDAAkD;EAG1E,OAAO;CACX;CAEA,YAAY,GAAK;EACb,OAAO,GAAc,MAAM,CAAG;CAClC;CAGA,KAAK,GAAG,GAAG,GAAW;EAIlB,OADA,EAAM,GAAW,WAAW,GACrB,IAAY,IAAI;CAC3B;AACJ;AAGA,OAAO,OAAO,GAAO,SAAS;AA2B9B,SAAgB,EAAM,GAAO,IAAO,CAAC,GAAG;CACpC,OAAO,IAAI,GAAO,GAAO,CAAI;AACjC;AAuEA,SAAgB,GAAoB,GAAY;CAC5C,IAAI,OAAO,KAAe,UACtB,MAAU,MAAM,4BAA4B;CAEhD,IAAI,KAAcA,GACd,MAAU,MAAM,oCAAoC;CAExD,IAAM,IAAY,GAAO,IAAaA,CAAG;CACzC,OAAO,KAAK,KAAK,IAAY,CAAC;AAClC;AAiBA,SAAgB,GAAiB,GAAY;CACzC,IAAM,IAAS,GAAoB,CAAU;CAC7C,OAAO,IAAS,KAAK,KAAK,IAAS,CAAC;AACxC;AAwBA,SAAgB,GAAe,GAAK,GAAY,IAAO,IAAO;CAC1D,EAAO,CAAG;CACV,IAAM,IAAM,EAAI,QACV,IAAW,GAAoB,CAAU,GACzC,IAAS,KAAK,IAAI,GAAiB,CAAU,GAAG,EAAE;CAGxD,IAAI,IAAM,KAAU,IAAM,MACtB,MAAU,MAAM,cAAc,IAAS,+BAA+B,CAAG;CAG7E,IAAM,IAAU,EAFJ,IAAO,GAAgB,CAAG,IAAI,EAAgB,CAAG,GAEpC,IAAaA,CAAG,IAAIA;CAC7C,OAAO,IAAO,GAAgB,GAAS,CAAQ,IAAI,GAAgB,GAAS,CAAQ;AACxF;;;ACx0BA,IAAMK,IAAsB,uBAAO,CAAC,GAC9BC,IAAsB,uBAAO,CAAC;AAoDpC,SAAgB,EAAS,GAAW,GAAM;CACtC,IAAM,IAAM,EAAK,OAAO;CACxB,OAAO,IAAY,IAAM;AAC7B;AAmBA,SAAgB,GAAW,GAAG,GAAQ;CAClC,IAAM,IAAa,GAAc,EAAE,IAAI,EAAO,KAAK,MAAM,EAAE,CAAC,CAAC;CAC7D,OAAO,EAAO,KAAK,GAAG,MAAM,EAAE,WAAW,EAAE,SAAS,EAAW,EAAE,CAAC,CAAC;AACvE;AACA,SAAS,GAAU,GAAG,GAAM;CACxB,IAAI,CAAC,OAAO,cAAc,CAAC,KAAK,KAAK,KAAK,IAAI,GAC1C,MAAU,MAAM,uCAAuC,IAAO,cAAc,CAAC;AACrF;AACA,SAAS,GAAU,GAAG,GAAY;CAC9B,GAAU,GAAG,CAAU;CACvB,IAAM,IAAU,KAAK,KAAK,IAAa,CAAC,IAAI,GACtC,IAAa,MAAM,IAAI,IACvB,IAAY,KAAK;CAGvB,OAAO;EAAE;EAAS;EAAY,MAFjB,GAAQ,CAEY;EAAG;EAAW,SAD/B,OAAO,CAC8B;CAAE;AAC3D;AACA,SAAS,GAAY,GAAG,GAAQ,GAAO;CACnC,IAAM,EAAE,eAAY,SAAM,cAAW,eAAY,GAC7C,IAAQ,OAAO,IAAI,CAAI,GACvB,IAAQ,KAAK;CAMjB,AAAI,IAAQ,MAER,KAAS,GACT,KAASA;CAEb,IAAM,IAAc,IAAS,GACvB,IAAS,IAAc,KAAK,IAAI,CAAK,IAAI,GACzC,IAAS,MAAU,GACnB,IAAQ,IAAQ,GAChB,IAAS,IAAS,KAAM;CAE9B,OAAO;EAAE;EAAO;EAAQ;EAAQ;EAAO;EAAQ,SAAA;CAAQ;AAC3D;AAoBA,IAAM,qBAAmB,IAAI,QAAQ,GAC/B,qBAAmB,IAAI,QAAQ;AACrC,SAAS,GAAK,GAAG;CAIb,OAAO,GAAiB,IAAI,CAAC,KAAK;AACtC;AACA,SAAS,GAAQ,GAAG;CAGhB,IAAI,MAAMD,GACN,MAAU,MAAM,cAAc;AACtC;AA6BA,IAAa,KAAb,MAAkB;CACd;CACA;CACA;CACA;CAEA,YAAY,GAAO,GAAM;EAIrB,AAHA,KAAK,OAAO,EAAM,MAClB,KAAK,OAAO,EAAM,MAClB,KAAK,KAAK,EAAM,IAChB,KAAK,OAAO;CAChB;CAEA,cAAc,GAAK,GAAG,IAAI,KAAK,MAAM;EACjC,IAAI,IAAI;EACR,OAAO,IAAIA,IAIP,AAHI,IAAIC,MACJ,IAAI,EAAE,IAAI,CAAC,IACf,IAAI,EAAE,OAAO,GACb,MAAMA;EAEV,OAAO;CACX;CAaA,iBAAiB,GAAO,GAAG;EACvB,IAAM,EAAE,YAAS,kBAAe,GAAU,GAAG,KAAK,IAAI,GAChD,IAAS,CAAC,GACZ,IAAI,GACJ,IAAO;EACX,KAAK,IAAI,IAAS,GAAG,IAAS,GAAS,KAAU;GAE7C,AADA,IAAO,GACP,EAAO,KAAK,CAAI;GAEhB,KAAK,IAAI,IAAI,GAAG,IAAI,GAAY,KAE5B,AADA,IAAO,EAAK,IAAI,CAAC,GACjB,EAAO,KAAK,CAAI;GAEpB,IAAI,EAAK,OAAO;EACpB;EACA,OAAO;CACX;CAOA,KAAK,GAAG,GAAa,GAAG;EAEpB,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,GAClB,MAAU,MAAM,gBAAgB;EAEpC,IAAI,IAAI,KAAK,MACT,IAAI,KAAK,MAMP,IAAK,GAAU,GAAG,KAAK,IAAI;EACjC,KAAK,IAAI,IAAS,GAAG,IAAS,EAAG,SAAS,KAAU;GAEhD,IAAM,EAAE,UAAO,WAAQ,WAAQ,UAAO,WAAQ,eAAY,GAAY,GAAG,GAAQ,CAAE;GAEnF,AADA,IAAI,GACA,IAGA,IAAI,EAAE,IAAI,EAAS,GAAQ,EAAY,EAAQ,CAAC,IAIhD,IAAI,EAAE,IAAI,EAAS,GAAO,EAAY,EAAO,CAAC;EAEtD;EAKA,OAJA,GAAQ,CAAC,GAIF;GAAE;GAAG;EAAE;CAClB;CAOA,WAAW,GAAG,GAAa,GAAG,IAAM,KAAK,MAAM;EAC3C,IAAM,IAAK,GAAU,GAAG,KAAK,IAAI;EACjC,KAAK,IAAI,IAAS,GAAG,IAAS,EAAG,WACzB,MAAMD,GAD4B,KAAU;GAGhD,IAAM,EAAE,UAAO,WAAQ,WAAQ,aAAU,GAAY,GAAG,GAAQ,CAAE;GAClE,QAAI,GACA,IAKC;IACD,IAAM,IAAO,EAAY;IACzB,IAAM,EAAI,IAAI,IAAQ,EAAK,OAAO,IAAI,CAAI;GAC9C;EACJ;EAEA,OADA,GAAQ,CAAC,GACF;CACX;CACA,eAAe,GAAG,GAAO,GAAW;EAGhC,IAAI,IAAO,GAAiB,IAAI,CAAK;EAUrC,OATK,MACD,IAAO,KAAK,iBAAiB,GAAO,CAAC,GACjC,MAAM,MAEF,OAAO,KAAc,eACrB,IAAO,EAAU,CAAI,IACzB,GAAiB,IAAI,GAAO,CAAI,KAGjC;CACX;CACA,OAAO,GAAO,GAAQ,GAAW;EAC7B,IAAM,IAAI,GAAK,CAAK;EACpB,OAAO,KAAK,KAAK,GAAG,KAAK,eAAe,GAAG,GAAO,CAAS,GAAG,CAAM;CACxE;CACA,OAAO,GAAO,GAAQ,GAAW,GAAM;EACnC,IAAM,IAAI,GAAK,CAAK;EAGpB,OAFI,MAAM,IACC,KAAK,cAAc,GAAO,GAAQ,CAAI,IAC1C,KAAK,WAAW,GAAG,KAAK,eAAe,GAAG,GAAO,CAAS,GAAG,GAAQ,CAAI;CACpF;CAIA,YAAY,GAAG,GAAG;EAGd,AAFA,GAAU,GAAG,KAAK,IAAI,GACtB,GAAiB,IAAI,GAAG,CAAC,GACzB,GAAiB,OAAO,CAAC;CAC7B;CACA,SAAS,GAAK;EACV,OAAO,GAAK,CAAG,MAAM;CACzB;AACJ;AAkBA,SAAgB,GAAc,GAAO,GAAO,GAAI,GAAI;CAChD,IAAI,IAAM,GACN,IAAK,EAAM,MACX,IAAK,EAAM;CACf,OAAO,IAAKA,KAAO,IAAKA,IAOpB,AANI,IAAKC,MACL,IAAK,EAAG,IAAI,CAAG,IACf,IAAKA,MACL,IAAK,EAAG,IAAI,CAAG,IACnB,IAAM,EAAI,OAAO,GACjB,MAAOA,GACP,MAAOA;CAEX,OAAO;EAAE;EAAI;CAAG;AACpB;AA+JA,SAAS,GAAY,GAAO,GAAO,GAAM;CACrC,IAAI,GAAO;EAIP,IAAI,EAAM,UAAU,GAChB,MAAU,MAAM,gDAAgD;EAEpE,OADA,GAAc,CAAK,GACZ;CACX,OAEI,OAAO,EAAM,GAAO,EAAE,QAAK,CAAC;AAEpC;AA4BA,SAAgB,GAAkB,GAAM,GAAO,IAAY,CAAC,GAAG,GAAQ;CAGnE,IAFI,MAAW,KAAA,MACX,IAAS,MAAS,YAClB,CAAC,KAAS,OAAO,KAAU,UAC3B,MAAU,MAAM,kBAAkB,EAAK,cAAc;CACzD,KAAK,IAAM,KAAK;EAAC;EAAK;EAAK;CAAG,GAAG;EAC7B,IAAM,IAAM,EAAM;EAClB,IAAI,EAAE,OAAO,KAAQ,YAAY,IAAMD,IACnC,MAAU,MAAM,SAAS,EAAE,yBAAyB;CAC5D;CACA,IAAM,IAAK,GAAY,EAAM,GAAG,EAAU,IAAI,CAAM,GAC9C,IAAK,GAAY,EAAM,GAAG,EAAU,IAAI,CAAM,GAE9C,IAAS;EAAC;EAAM;EAAM;EADjB,MAAS,gBAAgB,MAAM;CACP;CACnC,KAAK,IAAM,KAAK,GAEZ,IAAI,CAAC,EAAG,QAAQ,EAAM,EAAE,GACpB,MAAU,MAAM,SAAS,EAAE,yCAAyC;CAG5E,OADA,IAAQ,OAAO,OAAO,OAAO,OAAO,CAAC,GAAG,CAAK,CAAC,GACvC;EAAE;EAAO;EAAI;CAAG;AAC3B;AAeA,SAAgB,GAAa,GAAiB,GAAc;CACxD,OAAO,SAAgB,GAAM;EACzB,IAAM,IAAY,EAAgB,CAAI;EACtC,OAAO;GAAE;GAAW,WAAW,EAAa,CAAS;EAAE;CAC3D;AACJ;;;ACvlBA,IAAa,KAAb,MAAmB;CACf;CACA;CACA;CACA;CACA,SAAS;CACT,WAAW;CACX,YAAY;CACZ,YAAY,GAAM,GAAK;EAInB,IAHA,EAAM,CAAI,GACV,EAAO,GAAK,KAAA,GAAW,KAAK,GAC5B,KAAK,QAAQ,EAAK,OAAO,GACrB,OAAO,KAAK,MAAM,UAAW,YAC7B,MAAU,MAAM,qDAAqD;EAEzE,AADA,KAAK,WAAW,KAAK,MAAM,UAC3B,KAAK,YAAY,KAAK,MAAM;EAC5B,IAAM,IAAW,KAAK,UAChB,IAAM,IAAI,WAAW,CAAQ;EAEnC,EAAI,IAAI,EAAI,SAAS,IAAW,EAAK,OAAO,EAAE,OAAO,CAAG,EAAE,OAAO,IAAI,CAAG;EACxE,KAAK,IAAI,IAAI,GAAG,IAAI,EAAI,QAAQ,KAC5B,EAAI,MAAM;EAId,AAHA,KAAK,MAAM,OAAO,CAAG,GAGrB,KAAK,QAAQ,EAAK,OAAO;EAEzB,KAAK,IAAI,IAAI,GAAG,IAAI,EAAI,QAAQ,KAC5B,EAAI,MAAM;EAEd,AADA,KAAK,MAAM,OAAO,CAAG,GACrB,EAAM,CAAG;CACb;CACA,OAAO,GAAK;EAGR,OAFA,EAAQ,IAAI,GACZ,KAAK,MAAM,OAAO,CAAG,GACd;CACX;CACA,WAAW,GAAK;EAGZ,AAFA,EAAQ,IAAI,GACZ,EAAQ,GAAK,IAAI,GACjB,KAAK,WAAW;EAChB,IAAM,IAAM,EAAI,SAAS,GAAG,KAAK,SAAS;EAM1C,AAHA,KAAK,MAAM,WAAW,CAAG,GACzB,KAAK,MAAM,OAAO,CAAG,GACrB,KAAK,MAAM,WAAW,CAAG,GACzB,KAAK,QAAQ;CACjB;CACA,SAAS;EACL,IAAM,IAAM,IAAI,WAAW,KAAK,MAAM,SAAS;EAE/C,OADA,KAAK,WAAW,CAAG,GACZ;CACX;CACA,WAAW,GAAI;EAGX,MAAO,OAAO,OAAO,OAAO,eAAe,IAAI,GAAG,CAAC,CAAC;EACpD,IAAM,EAAE,UAAO,UAAO,aAAU,cAAW,aAAU,iBAAc;EAQnE,OAPA,IAAK,GACL,EAAG,WAAW,GACd,EAAG,YAAY,GACf,EAAG,WAAW,GACd,EAAG,YAAY,GACf,EAAG,QAAQ,EAAM,WAAW,EAAG,KAAK,GACpC,EAAG,QAAQ,EAAM,WAAW,EAAG,KAAK,GAC7B;CACX;CACA,QAAQ;EACJ,OAAO,KAAK,WAAW;CAC3B;CACA,UAAU;EAGN,AAFA,KAAK,YAAY,IACjB,KAAK,MAAM,QAAQ,GACnB,KAAK,MAAM,QAAQ;CACvB;AACJ,GACa,KAAuB,uBAAO;CACvC,IAAM,MAAU,GAAM,GAAK,MAAY,IAAI,GAAM,GAAM,CAAG,EAAE,OAAO,CAAO,EAAE,OAAO;CAEnF,OADA,EAAM,UAAU,GAAM,MAAQ,IAAI,GAAM,GAAM,CAAG,GAC1C;AACX,GAAG,GCvDG,MAAc,GAAK,OAAS,KAAO,KAAO,IAAI,IAAM,CAAC,KAAOE,MAAO;AAEzE,SAAgB,GAAiB,GAAG,GAAO,GAAG;CAM1C,GAAS,UAAU,GAAG,GAAK,CAAC;CAE5B,IAAM,CAAC,CAAC,GAAI,IAAK,CAAC,GAAI,MAAO,GACvB,IAAK,GAAW,IAAK,GAAG,CAAC,GACzB,IAAK,GAAW,CAAC,IAAK,GAAG,CAAC,GAG5B,IAAK,IAAI,IAAK,IAAK,IAAK,GACxB,IAAK,CAAC,IAAK,IAAK,IAAK,GACnB,IAAQ,IAAK,GACb,IAAQ,IAAK;CAGnB,AAFI,MACA,IAAK,CAAC,IACN,MACA,IAAK,CAAC;CAIV,IAAM,IAAU,GAAQ,KAAK,KAAK,GAAO,CAAC,IAAI,CAAC,CAAC,IAAI;CACpD,IAAI,IAAK,KAAO,KAAM,KAAW,IAAK,KAAO,KAAM,GAC/C,MAAU,MAAM,0CAA0C;CAE9D,OAAO;EAAE;EAAO;EAAI;EAAO;CAAG;AAClC;AACA,SAAS,GAAkB,GAAQ;CAC/B,IAAI,CAAC;EAAC;EAAW;EAAa;CAAK,EAAE,SAAS,CAAM,GAChD,MAAU,MAAM,iEAA2D;CAC/E,OAAO;AACX;AACA,SAAS,GAAgB,GAAM,GAAK;CAChC,EAAe,CAAI;CACnB,IAAM,IAAQ,CAAC;CAIf,KAAK,IAAI,KAAW,OAAO,KAAK,CAAG,GAE/B,EAAM,KAAW,EAAK,OAAa,KAAA,IAAY,EAAI,KAAW,EAAK;CAMvE,OAJA,EAAM,EAAM,MAAM,MAAM,GACxB,EAAM,EAAM,SAAS,SAAS,GAC1B,EAAM,WAAW,KAAA,KACjB,GAAkB,EAAM,MAAM,GAC3B;AACX;AA6BA,IAAa,IAAM;CAEf,KAAK,cArBmB,MAAM;EAC9B,YAAY,IAAI,IAAI;GAChB,MAAM,CAAC;EACX;CACJ;CAmBI,MAAM;EACF,SAAS,GAAK,MAAS;GACnB,IAAM,EAAE,KAAK,MAAM;GAEnB,IADA,GAAY,GAAK,KAAK,GAClB,IAAM,KAAK,IAAM,KACjB,MAAM,IAAI,EAAE,uBAAuB;GACvC,IAAI,OAAO,KAAS,UAChB,MAAU,UAAU,wCAAsC,OAAO,CAAI;GAGzE,IAAI,EAAK,SAAS,GACd,MAAM,IAAI,EAAE,2BAA2B;GAC3C,IAAM,IAAU,EAAK,SAAS,GACxB,IAAM,EAAoB,CAAO;GACvC,IAAK,EAAI,SAAS,IAAK,KACnB,MAAM,IAAI,EAAE,sCAAsC;GAEtD,IAAM,IAAS,IAAU,MAAM,EAAqB,EAAI,SAAS,IAAK,GAAW,IAAI;GAErF,OADU,EAAoB,CACvB,IAAI,IAAS,IAAM;EAC9B;EAEA,OAAO,GAAK,GAAM;GACd,IAAM,EAAE,KAAK,MAAM;GACnB,IAAO,EAAO,GAAM,KAAA,GAAW,UAAU;GACzC,IAAI,IAAM;GACV,IAAI,IAAM,KAAK,IAAM,KACjB,MAAM,IAAI,EAAE,uBAAuB;GACvC,IAAI,EAAK,SAAS,KAAK,EAAK,SAAW,GACnC,MAAM,IAAI,EAAE,uBAAuB;GACvC,IAAM,IAAQ,EAAK,MAEb,IAAS,CAAC,EAAE,IAAQ,MACtB,IAAS;GACb,IAAI,CAAC,GACD,IAAS;QACR;IAED,IAAM,IAAS,IAAQ;IACvB,IAAI,CAAC,GACD,MAAM,IAAI,EAAE,mDAAmD;IAEnE,IAAI,IAAS,GACT,MAAM,IAAI,EAAE,0CAA0C;IAC1D,IAAM,IAAc,EAAK,SAAS,GAAK,IAAM,CAAM;IACnD,IAAI,EAAY,WAAW,GACvB,MAAM,IAAI,EAAE,uCAAuC;IACvD,IAAI,EAAY,OAAO,GACnB,MAAM,IAAI,EAAE,sCAAsC;IACtD,KAAK,IAAM,KAAK,GACZ,IAAU,KAAU,IAAK;IAE7B,IADA,KAAO,GACH,IAAS,KACT,MAAM,IAAI,EAAE,wCAAwC;GAC5D;GACA,IAAM,IAAI,EAAK,SAAS,GAAK,IAAM,CAAM;GACzC,IAAI,EAAE,WAAW,GACb,MAAM,IAAI,EAAE,gCAAgC;GAChD,OAAO;IAAE;IAAG,GAAG,EAAK,SAAS,IAAM,CAAM;GAAE;EAC/C;CACJ;CAKA,MAAM;EACF,OAAO,GAAK;GACR,IAAM,EAAE,KAAK,MAAM;GAEnB,IADA,GAAW,CAAG,GACV,IAAM,GACN,MAAM,IAAI,EAAE,4CAA4C;GAC5D,IAAI,IAAM,EAAoB,CAAG;GAIjC,IAFI,OAAO,SAAS,EAAI,IAAI,EAAE,IAAI,MAC9B,IAAM,OAAO,IACb,EAAI,SAAS,GACb,MAAM,IAAI,EAAE,gDAAgD;GAChE,OAAO;EACX;EACA,OAAO,GAAM;GACT,IAAM,EAAE,KAAK,MAAM;GACnB,IAAI,EAAK,SAAS,GACd,MAAM,IAAI,EAAE,kCAAkC;GAClD,IAAI,EAAK,KAAK,KACV,MAAM,IAAI,EAAE,qCAAqC;GAErD,IAAI,EAAK,SAAS,KAAK,EAAK,OAAO,KAAQ,EAAE,EAAK,KAAK,MACnD,MAAM,IAAI,EAAE,qDAAqD;GACrE,OAAO,EAAgB,CAAI;EAC/B;CACJ;CACA,MAAM,GAAO;EAET,IAAM,EAAE,KAAK,GAAG,MAAM,GAAK,MAAM,MAAQ,GACnC,IAAO,EAAO,GAAO,KAAA,GAAW,WAAW,GAC3C,EAAE,GAAG,GAAU,GAAG,MAAiB,EAAI,OAAO,IAAM,CAAI;EAC9D,IAAI,EAAa,QACb,MAAM,IAAI,EAAE,6CAA6C;EAC7D,IAAM,EAAE,GAAG,GAAQ,GAAG,MAAe,EAAI,OAAO,GAAM,CAAQ,GACxD,EAAE,GAAG,GAAQ,GAAG,MAAe,EAAI,OAAO,GAAM,CAAU;EAChE,IAAI,EAAW,QACX,MAAM,IAAI,EAAE,6CAA6C;EAC7D,OAAO;GAAE,GAAG,EAAI,OAAO,CAAM;GAAG,GAAG,EAAI,OAAO,CAAM;EAAE;CAC1D;CACA,WAAW,GAAK;EACZ,IAAM,EAAE,MAAM,GAAK,MAAM,MAAQ,GAG3B,IAFK,EAAI,OAAO,GAAM,EAAI,OAAO,EAAI,CAAC,CAE/B,IADF,EAAI,OAAO,GAAM,EAAI,OAAO,EAAI,CAAC,CAC1B;EAClB,OAAO,EAAI,OAAO,IAAM,CAAG;CAC/B;AACJ;AACA,OAAO,OAAO,EAAI,IAAI,GACtB,OAAO,OAAO,EAAI,IAAI,GACtB,OAAO,OAAO,CAAG;AAGjB,IAAM,IAAsB,uBAAO,CAAC,GAAG,IAAsB,uBAAO,CAAC,GAAGA,KAAsB,uBAAO,CAAC,GAAG,IAAsB,uBAAO,CAAC,GAAG,KAAsB,uBAAO,CAAC;AA0BxK,SAAgB,GAAY,GAAQ,IAAY,CAAC,GAAG;CAChD,IAAM,IAAY,GAAkB,eAAe,GAAQ,CAAS,GAC9D,IAAK,EAAU,IACf,IAAK,EAAU,IACjB,IAAQ,EAAU,OAChB,EAAE,GAAG,GAAU,GAAG,MAAgB;CACxC,EAAe,GAAW,CAAC,GAAG;EAC1B,oBAAoB;EACpB,eAAe;EACf,eAAe;EACf,WAAW;EACX,SAAS;EACT,MAAM;CACV,CAAC;CAGD,IAAM,EAAE,SAAM,0BAAuB;CACrC,IAAI,MAEI,CAAC,EAAG,IAAI,EAAM,CAAC,KAAK,OAAO,EAAK,QAAS,YAAY,CAAC,MAAM,QAAQ,EAAK,OAAO,IAChF,MAAU,MAAM,gEAA4D;CAGpF,IAAM,IAAU,GAAY,GAAI,CAAE;CAClC,SAAS,IAA+B;EACpC,IAAI,CAAC,EAAG,OACJ,MAAU,MAAM,4DAA4D;CACpF;CAEA,SAAS,EAAa,GAAI,GAAO,GAAc;EAG3C,IAAI,KAAsB,EAAM,IAAI,GAChC,OAAO,WAAW,GAAG,CAAC;EAC1B,IAAM,EAAE,MAAG,SAAM,EAAM,SAAS,GAC1B,IAAK,EAAG,QAAQ,CAAC;EAQnB,OAPJ,EAAM,GAAc,cAAc,GAC9B,KACA,EAA6B,GAEtB,EAAY,GAAQ,CADT,EAAG,MAAM,CAAC,CACO,GAAG,CAAE,KAGjC,EAAY,WAAW,GAAG,CAAI,GAAG,GAAI,EAAG,QAAQ,CAAC,CAAC;CAEjE;CACA,SAAS,EAAe,GAAO;EAC3B,EAAO,GAAO,KAAA,GAAW,OAAO;EAChC,IAAM,EAAE,WAAW,GAAM,uBAAuB,MAAW,GACrD,IAAS,EAAM,QACf,IAAO,EAAM,IACb,IAAO,EAAM,SAAS,CAAC;EAC7B,IAAI,KAAsB,MAAW,KAAK,MAAS,GAC/C,OAAO;GAAE,GAAG,EAAG;GAAM,GAAG,EAAG;EAAK;EAOpC,IAAI,MAAW,MAAS,MAAS,KAAQ,MAAS,IAAO;GACrD,IAAM,IAAI,EAAG,UAAU,CAAI;GAC3B,IAAI,CAAC,EAAG,QAAQ,CAAC,GACb,MAAU,MAAM,qCAAqC;GACzD,IAAM,IAAK,EAAoB,CAAC,GAC5B;GACJ,IAAI;IACA,IAAI,EAAG,KAAK,CAAE;GAClB,SACO,GAAW;IACd,IAAM,IAAM,aAAqB,QAAQ,OAAO,EAAU,UAAU;IACpE,MAAU,MAAM,2CAA2C,CAAG;GAClE;GACA,EAA6B;GAC7B,IAAM,IAAQ,EAAG,MAAM,CAAC;GAIxB,QAHe,IAAO,MAAO,MACf,MACV,IAAI,EAAG,IAAI,CAAC,IACT;IAAE;IAAG;GAAE;EAClB,OACK,IAAI,MAAW,KAAU,MAAS,GAAM;GAEzC,IAAM,IAAI,EAAG,OACP,IAAI,EAAG,UAAU,EAAK,SAAS,GAAG,CAAC,CAAC,GACpC,IAAI,EAAG,UAAU,EAAK,SAAS,GAAG,IAAI,CAAC,CAAC;GAC9C,IAAI,CAAC,EAAU,GAAG,CAAC,GACf,MAAU,MAAM,4BAA4B;GAChD,OAAO;IAAE;IAAG;GAAE;EAClB,OAEI,MAAU,MAAM,yBAAyB,EAAO,wBAAwB,EAAK,mBAAmB,GAAQ;CAEhH;CACA,IAAM,IAAc,EAAU,YAAY,KAAA,IAAY,IAAe,EAAU,SACzE,IAAc,EAAU,cAAc,KAAA,IAAY,IAAiB,EAAU;CACnF,SAAS,EAAoB,GAAG;EAC5B,IAAM,IAAK,EAAG,IAAI,CAAC,GACb,IAAK,EAAG,IAAI,GAAI,CAAC;EACvB,OAAO,EAAG,IAAI,EAAG,IAAI,GAAI,EAAG,IAAI,GAAG,EAAM,CAAC,CAAC,GAAG,EAAM,CAAC;CACzD;CAGA,SAAS,EAAU,GAAG,GAAG;EACrB,IAAM,IAAO,EAAG,IAAI,CAAC,GACf,IAAQ,EAAoB,CAAC;EACnC,OAAO,EAAG,IAAI,GAAM,CAAK;CAC7B;CAIA,IAAI,CAAC,EAAU,EAAM,IAAI,EAAM,EAAE,GAC7B,MAAU,MAAM,mCAAmC;CAGvD,IAAM,IAAO,EAAG,IAAI,EAAG,IAAI,EAAM,GAAG,CAAG,GAAG,EAAG,GACvC,IAAQ,EAAG,IAAI,EAAG,IAAI,EAAM,CAAC,GAAG,OAAO,EAAE,CAAC;CAChD,IAAI,EAAG,IAAI,EAAG,IAAI,GAAM,CAAK,CAAC,GAC1B,MAAU,MAAM,0BAA0B;CAE9C,SAAS,EAAO,GAAO,GAAG,IAAU,IAAO;EACvC,IAAI,CAAC,EAAG,QAAQ,CAAC,KAAM,KAAW,EAAG,IAAI,CAAC,GACtC,MAAU,MAAM,wBAAwB,GAAO;EACnD,OAAO;CACX;CACA,SAAS,EAAU,GAAO;EACtB,IAAI,EAAE,aAAiB,IACnB,MAAU,MAAM,4BAA4B;CACpD;CACA,SAAS,EAAiB,GAAG;EACzB,IAAI,CAAC,KAAQ,CAAC,EAAK,SACf,MAAU,MAAM,SAAS;EAC7B,OAAO,GAAiB,GAAG,EAAK,SAAS,EAAG,KAAK;CACrD;CACA,SAAS,EAAW,GAAU,GAAK,GAAK,GAAO,GAAO;EAIlD,OAHA,IAAM,IAAI,EAAM,EAAG,IAAI,EAAI,GAAG,CAAQ,GAAG,EAAI,GAAG,EAAI,CAAC,GACrD,IAAM,EAAS,GAAO,CAAG,GACzB,IAAM,EAAS,GAAO,CAAG,GAClB,EAAI,IAAI,CAAG;CACtB;CAMA,MAAM,EAAM;EAER,OAAO,OAAO,IAAI,EAAM,EAAM,IAAI,EAAM,IAAI,EAAG,GAAG;EAElD,OAAO,OAAO,IAAI,EAAM,EAAG,MAAM,EAAG,KAAK,EAAG,IAAI;EAEhD,OAAO,KAAK;EAEZ,OAAO,KAAK;EACZ;EACA;EACA;EAEA,YAAY,GAAG,GAAG,GAAG;GAOjB,AANA,KAAK,IAAI,EAAO,KAAK,CAAC,GAItB,KAAK,IAAI,EAAO,KAAK,GAAG,EAAI,GAC5B,KAAK,IAAI,EAAO,KAAK,CAAC,GACtB,OAAO,OAAO,IAAI;EACtB;EACA,OAAO,QAAQ;GACX,OAAO;EACX;EAEA,OAAO,WAAW,GAAG;GACjB,IAAM,EAAE,MAAG,SAAM,KAAK,CAAC;GACvB,IAAI,CAAC,KAAK,CAAC,EAAG,QAAQ,CAAC,KAAK,CAAC,EAAG,QAAQ,CAAC,GACrC,MAAU,MAAM,sBAAsB;GAC1C,IAAI,aAAa,GACb,MAAU,MAAM,8BAA8B;GAIlD,OAFI,EAAG,IAAI,CAAC,KAAK,EAAG,IAAI,CAAC,IACd,EAAM,OACV,IAAI,EAAM,GAAG,GAAG,EAAG,GAAG;EACjC;EACA,OAAO,UAAU,GAAO;GACpB,IAAM,IAAI,EAAM,WAAW,EAAY,EAAO,GAAO,KAAA,GAAW,OAAO,CAAC,CAAC;GAEzE,OADA,EAAE,eAAe,GACV;EACX;EACA,OAAO,QAAQ,GAAK;GAChB,OAAO,EAAM,UAAU,EAAW,CAAG,CAAC;EAC1C;EACA,IAAI,IAAI;GACJ,OAAO,KAAK,SAAS,EAAE;EAC3B;EACA,IAAI,IAAI;GACJ,OAAO,KAAK,SAAS,EAAE;EAC3B;EAOA,WAAW,IAAa,GAAG,IAAS,IAAM;GAItC,OAHA,EAAK,YAAY,MAAM,CAAU,GAC5B,KACD,KAAK,SAAS,CAAG,GACd;EACX;EAGA,iBAAiB;GACb,IAAM,IAAI;GACV,IAAI,EAAE,IAAI,GAAG;IAKT,IAAI,EAAU,sBAAsB,EAAG,IAAI,EAAE,CAAC,KAAK,EAAG,IAAI,EAAE,GAAG,EAAG,GAAG,KAAK,EAAG,IAAI,EAAE,CAAC,GAChF;IACJ,MAAU,MAAM,iBAAiB;GACrC;GAEA,IAAM,EAAE,MAAG,SAAM,EAAE,SAAS;GAC5B,IAAI,CAAC,EAAG,QAAQ,CAAC,KAAK,CAAC,EAAG,QAAQ,CAAC,GAC/B,MAAU,MAAM,sCAAsC;GAC1D,IAAI,CAAC,EAAU,GAAG,CAAC,GACf,MAAU,MAAM,mCAAmC;GACvD,IAAI,CAAC,EAAE,cAAc,GACjB,MAAU,MAAM,wCAAwC;EAChE;EACA,WAAW;GACP,IAAM,EAAE,SAAM,KAAK,SAAS;GAC5B,IAAI,CAAC,EAAG,OACJ,MAAU,MAAM,6BAA6B;GACjD,OAAO,CAAC,EAAG,MAAM,CAAC;EACtB;EAEA,OAAO,GAAO;GACV,EAAU,CAAK;GACf,IAAM,EAAE,GAAG,GAAI,GAAG,GAAI,GAAG,MAAO,MAC1B,EAAE,GAAG,GAAI,GAAG,GAAI,GAAG,MAAO,GAC1B,IAAK,EAAG,IAAI,EAAG,IAAI,GAAI,CAAE,GAAG,EAAG,IAAI,GAAI,CAAE,CAAC,GAC1C,IAAK,EAAG,IAAI,EAAG,IAAI,GAAI,CAAE,GAAG,EAAG,IAAI,GAAI,CAAE,CAAC;GAChD,OAAO,KAAM;EACjB;EAEA,SAAS;GACL,OAAO,IAAI,EAAM,KAAK,GAAG,EAAG,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC;EACnD;EAKA,SAAS;GACL,IAAM,EAAE,MAAG,SAAM,GACX,IAAK,EAAG,IAAI,GAAG,CAAG,GAClB,EAAE,GAAG,GAAI,GAAG,GAAI,GAAG,MAAO,MAC5B,IAAK,EAAG,MAAM,IAAK,EAAG,MAAM,IAAK,EAAG,MACpC,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE;GA4BtB,OA3BA,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAG,CAAE,GACjB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAG,CAAE,GACjB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAG,CAAE,GACjB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GACX,IAAI,EAAM,GAAI,GAAI,CAAE;EAC/B;EAKA,IAAI,GAAO;GACP,EAAU,CAAK;GACf,IAAM,EAAE,GAAG,GAAI,GAAG,GAAI,GAAG,MAAO,MAC1B,EAAE,GAAG,GAAI,GAAG,GAAI,GAAG,MAAO,GAC5B,IAAK,EAAG,MAAM,IAAK,EAAG,MAAM,IAAK,EAAG,MAClC,IAAI,EAAM,GACV,IAAK,EAAG,IAAI,EAAM,GAAG,CAAG,GAC1B,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE;GAItB,AAHA,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE;GAClB,IAAI,IAAK,EAAG,IAAI,GAAI,CAAE;GA+BtB,OA9BA,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAG,CAAE,GACjB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAG,CAAE,GACjB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAG,CAAE,GACjB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GAClB,IAAK,EAAG,IAAI,GAAI,CAAE,GACX,IAAI,EAAM,GAAI,GAAI,CAAE;EAC/B;EACA,SAAS,GAAO;GAIZ,OADA,EAAU,CAAK,GACR,KAAK,IAAI,EAAM,OAAO,CAAC;EAClC;EACA,MAAM;GACF,OAAO,KAAK,OAAO,EAAM,IAAI;EACjC;EAUA,SAAS,GAAQ;GACb,IAAM,EAAE,YAAS;GAIjB,IAAI,CAAC,EAAG,YAAY,CAAM,GACtB,MAAU,WAAW,8BAA8B;GACvD,IAAI,GAAO,GACL,KAAO,MAAM,EAAK,OAAO,MAAM,IAAI,MAAM,GAAW,GAAO,CAAC,CAAC;GAEnE,IAAI,GAAM;IACN,IAAM,EAAE,UAAO,OAAI,UAAO,UAAO,EAAiB,CAAM,GAClD,EAAE,GAAG,GAAK,GAAG,MAAQ,EAAI,CAAE,GAC3B,EAAE,GAAG,GAAQ,MAAQ,EAAI,CAAE;IAEjC,AADA,IAAO,EAAI,IAAI,CAAG,GAClB,IAAQ,EAAW,EAAK,MAAM,GAAK,GAAK,GAAO,CAAK;GACxD,OACK;IACD,IAAM,EAAE,MAAG,SAAM,EAAI,CAAM;IAE3B,AADA,IAAQ,GACR,IAAO;GACX;GAEA,OAAO,GAAW,GAAO,CAAC,GAAO,CAAI,CAAC,EAAE;EAC5C;EAMA,eAAe,GAAQ;GACnB,IAAM,EAAE,YAAS,GACX,IAAI,MACJ,IAAK;GAGX,IAAI,CAAC,EAAG,QAAQ,CAAE,GACd,MAAU,WAAW,8BAA8B;GACvD,IAAI,MAAO,KAAO,EAAE,IAAI,GACpB,OAAO,EAAM;GACjB,IAAI,MAAO,GACP,OAAO;GACX,IAAI,EAAK,SAAS,IAAI,GAClB,OAAO,KAAK,SAAS,CAAE;GAG3B,IAAI,GAAM;IACN,IAAM,EAAE,UAAO,OAAI,UAAO,UAAO,EAAiB,CAAE,GAC9C,EAAE,OAAI,UAAO,GAAc,GAAO,GAAG,GAAI,CAAE;IACjD,OAAO,EAAW,EAAK,MAAM,GAAI,GAAI,GAAO,CAAK;GACrD,OAEI,OAAO,EAAK,OAAO,GAAG,CAAE;EAEhC;EAMA,SAAS,GAAW;GAChB,IAAM,IAAI,MACN,IAAK,GACH,EAAE,MAAG,MAAG,SAAM;GAEpB,IAAI,EAAG,IAAI,GAAG,EAAG,GAAG,GAChB,OAAO;IAAE,GAAG;IAAG,GAAG;GAAE;GACxB,IAAM,IAAM,EAAE,IAAI;GAGlB,AACI,MAAK,IAAM,EAAG,MAAM,EAAG,IAAI,CAAC;GAChC,IAAM,IAAI,EAAG,IAAI,GAAG,CAAE,GAChB,IAAI,EAAG,IAAI,GAAG,CAAE,GAChB,IAAK,EAAG,IAAI,GAAG,CAAE;GACvB,IAAI,GACA,OAAO;IAAE,GAAG,EAAG;IAAM,GAAG,EAAG;GAAK;GACpC,IAAI,CAAC,EAAG,IAAI,GAAI,EAAG,GAAG,GAClB,MAAU,MAAM,kBAAkB;GACtC,OAAO;IAAE;IAAG;GAAE;EAClB;EAKA,gBAAgB;GACZ,IAAM,EAAE,qBAAkB;GAK1B,OAJI,MAAa,IACN,KACP,IACO,EAAc,GAAO,IAAI,IAC7B,EAAK,OAAO,MAAM,CAAW,EAAE,IAAI;EAC9C;EACA,gBAAgB;GACZ,IAAM,EAAE,qBAAkB;GAQ1B,OAPI,MAAa,IACN,OACP,IACO,EAAc,GAAO,IAAI,IAI7B,KAAK,eAAe,CAAQ;EACvC;EACA,eAAe;GAGX,OAFI,MAAa,IACN,KAAK,IAAI,IACb,KAAK,cAAc,EAAE,IAAI;EACpC;EACA,QAAQ,IAAe,IAAM;GAKzB,OAJA,EAAM,GAAc,cAAc,GAGlC,KAAK,eAAe,GACb,EAAY,GAAO,MAAM,CAAY;EAChD;EACA,MAAM,IAAe,IAAM;GACvB,OAAO,GAAW,KAAK,QAAQ,CAAY,CAAC;EAChD;EACA,WAAW;GACP,OAAO,UAAU,KAAK,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE;EACxD;CACJ;CACA,IAAM,IAAO,EAAG,MACV,IAAO,IAAI,GAAK,GAAO,EAAU,OAAO,KAAK,KAAK,IAAO,CAAC,IAAI,CAAI;CAOxE,OAJI,KAAQ,KACR,EAAM,KAAK,WAAW,CAAC,GAC3B,OAAO,OAAO,EAAM,SAAS,GAC7B,OAAO,OAAO,CAAK,GACZ;AACX;AAEA,SAAS,GAAQ,GAAU;CACvB,OAAO,WAAW,GAAG,IAAW,IAAO,CAAI;AAC/C;AAmLA,SAAS,GAAY,GAAI,GAAI;CACzB,OAAO;EACH,WAAW,EAAG;EACd,WAAW,IAAI,EAAG;EAClB,uBAAuB,IAAI,IAAI,EAAG;EAClC,oBAAoB;EAGpB,WAAW,IAAI,EAAG;CACtB;AACJ;AAmBA,SAAgB,GAAK,GAAO,IAAW,CAAC,GAAG;CACvC,IAAM,EAAE,UAAO,GACT,IAAe,EAAS,gBAAgB,KAAA,IAAYC,KAAgB,EAAS,aAG7E,IAAU,OAAO,OAAO,GAAY,EAAM,IAAI,CAAE,GAAG,EACrD,MAAM,KAAK,IAAI,GAAiB,EAAG,KAAK,GAAG,EAAE,EACjD,CAAC;CACD,SAAS,EAAiB,GAAW;EACjC,IAAI;GACA,IAAM,IAAM,EAAG,UAAU,CAAS;GAClC,OAAO,EAAG,YAAY,CAAG;EAC7B,QACc;GACV,OAAO;EACX;CACJ;CACA,SAAS,EAAiB,GAAW,GAAc;EAC/C,IAAM,EAAE,WAAW,GAAM,6BAA0B;EACnD,IAAI;GACA,IAAM,IAAI,EAAU;GAKpB,OAJI,MAAiB,MAAQ,MAAM,KAE/B,MAAiB,MAAS,MAAM,IACzB,KACJ,CAAC,CAAC,EAAM,UAAU,CAAS;EACtC,QACc;GACV,OAAO;EACX;CACJ;CAKA,SAAS,EAAgB,GAAM;EAE3B,OADA,IAAO,MAAS,KAAA,IAAY,EAAa,EAAQ,IAAI,IAAI,GAClD,GAAe,EAAO,GAAM,EAAQ,MAAM,MAAM,GAAG,EAAG,KAAK;CACtE;CAMA,SAAS,EAAa,GAAW,IAAe,IAAM;EAClD,OAAO,EAAM,KAAK,SAAS,EAAG,UAAU,CAAS,CAAC,EAAE,QAAQ,CAAY;CAC5E;CAIA,SAAS,EAAU,GAAM;EACrB,IAAM,EAAE,cAAW,cAAW,6BAA0B,GAClD,IAAiB,EAAG;EAC1B,IAAI,CAAC,GAAQ,CAAI,GACb;EACJ,IAAM,IAAI,EAAO,GAAM,KAAA,GAAW,KAAK,EAAE,QACnC,IAAQ,MAAM,KAAa,MAAM,GACjC,IAAQ,MAAM,KAAa,CAAC,CAAC,GAAgB,SAAS,CAAC;EAEzD,WAAS,IAEb,OAAO;CACX;CAaA,SAAS,EAAgB,GAAY,GAAY,IAAe,IAAM;EAClE,IAAI,EAAU,CAAU,MAAM,IAC1B,MAAU,MAAM,+BAA+B;EACnD,IAAI,EAAU,CAAU,MAAM,IAC1B,MAAU,MAAM,+BAA+B;EACnD,IAAM,IAAI,EAAG,UAAU,CAAU;EAEjC,OADU,EAAM,UAAU,CACnB,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAY;CAC7C;CACA,IAAM,IAAQ;EACV;EACA;EACA;CACJ,GACM,IAAS,GAAa,GAAiB,CAAY;CAGzD,OAFA,OAAO,OAAO,CAAK,GACnB,OAAO,OAAO,CAAO,GACd,OAAO,OAAO;EAAE;EAAc;EAAiB;EAAQ;EAAO;EAAO;CAAQ,CAAC;AACzF;AA4BA,SAAgB,GAAM,GAAO,GAAM,IAAY,CAAC,GAAG;CAE/C,IAAM,IAAQ;CASd,AARA,EAAM,CAAK,GACX,EAAe,GAAW,CAAC,GAAG;EAC1B,MAAM;EACN,MAAM;EACN,aAAa;EACb,UAAU;EACV,eAAe;CACnB,CAAC,GACD,IAAY,OAAO,OAAO,CAAC,GAAG,CAAS;CACvC,IAAM,IAAc,EAAU,gBAAgB,KAAA,IAAYA,KAAgB,EAAU,aAC9EC,IAAO,EAAU,SAAS,KAAA,KACzB,GAAK,MAAQC,GAAU,GAAO,GAAK,CAAG,IACvC,EAAU,MACV,EAAE,OAAI,UAAO,GACb,EAAE,OAAO,GAAa,MAAM,MAAW,GACvC,EAAE,WAAQ,iBAAc,oBAAiB,UAAO,eAAY,GAAK,GAAO,CAAS,GACjF,IAAiB;EACnB,SAAS;EACT,MAAM,OAAO,EAAU,QAAS,YAAY,EAAU,OAAO;EAC7D,QAAQ;EACR,cAAc;CAClB,GAKM,IAAwB,IAAcH,KAAM,IAAM,EAAG;CAC3D,SAAS,EAAsB,GAAQ;EAEnC,OAAO,IADM,KAAe;CAEhC;CACA,SAAS,EAAW,GAAO,GAAK;EAC5B,IAAI,CAAC,EAAG,YAAY,CAAG,GACnB,MAAU,MAAM,qBAAqB,EAAM,iCAAiC;EAChF,OAAO;CACX;CACA,SAAS,IAAyB;EAQ9B,IAAI,GACA,MAAU,MAAM,gEAA8D;CACtF;CACA,SAAS,EAAkB,GAAO,GAAQ;EACtC,GAAkB,CAAM;EACxB,IAAM,IAAO,EAAQ;EAErB,OAAO,EAAO,GADA,MAAW,YAAY,IAAO,MAAW,cAAc,IAAO,IAAI,KAAA,CACtD;CAC9B;CAIA,MAAM,EAAU;EACZ;EACA;EACA;EACA,YAAY,GAAG,GAAG,GAAU;GAGxB,IAFA,KAAK,IAAI,EAAW,KAAK,CAAC,GAC1B,KAAK,IAAI,EAAW,KAAK,CAAC,GACtB,KAAY,MAAM;IAElB,IADA,EAAuB,GACnB,CAAC;KAAC;KAAG;KAAG;KAAG;IAAC,EAAE,SAAS,CAAQ,GAC/B,MAAU,MAAM,qBAAqB;IACzC,KAAK,WAAW;GACpB;GACA,OAAO,OAAO,IAAI;EACtB;EACA,OAAO,UAAU,GAAO,IAAS,EAAe,QAAQ;GACpD,EAAkB,GAAO,CAAM;GAC/B,IAAI;GACJ,IAAI,MAAW,OAAO;IAClB,IAAM,EAAE,MAAG,SAAM,EAAI,MAAM,EAAO,CAAK,CAAC;IACxC,OAAO,IAAI,EAAU,GAAG,CAAC;GAC7B;GACA,AAAI,MAAW,gBACX,IAAQ,EAAM,IACd,IAAS,WACT,IAAQ,EAAM,SAAS,CAAC;GAE5B,IAAM,IAAI,EAAQ,YAAY,GACxB,IAAI,EAAM,SAAS,GAAG,CAAC,GACvB,IAAI,EAAM,SAAS,GAAG,IAAI,CAAC;GACjC,OAAO,IAAI,EAAU,EAAG,UAAU,CAAC,GAAG,EAAG,UAAU,CAAC,GAAG,CAAK;EAChE;EACA,OAAO,QAAQ,GAAK,GAAQ;GACxB,OAAO,KAAK,UAAU,EAAW,CAAG,GAAG,CAAM;EACjD;EACA,iBAAiB;GACb,IAAM,EAAE,gBAAa;GACrB,IAAI,KAAY,MACZ,MAAU,MAAM,sCAAsC;GAC1D,OAAO;EACX;EACA,eAAe,GAAU;GACrB,OAAO,IAAI,EAAU,KAAK,GAAG,KAAK,GAAG,CAAQ;EACjD;EAGA,iBAAiB,GAAa;GAC1B,IAAM,EAAE,MAAG,SAAM,MACX,IAAW,KAAK,eAAe,GAC/B,IAAO,MAAa,KAAK,MAAa,IAAI,IAAI,IAAc;GAClE,IAAI,CAAC,EAAG,QAAQ,CAAI,GAChB,MAAU,MAAM,2CAA2C;GAC/D,IAAM,IAAI,EAAG,QAAQ,CAAI,GACnB,IAAI,EAAM,UAAU,EAAY,IAAS,IAAW,MAAO,CAAC,GAAG,CAAC,CAAC,GACjE,IAAK,EAAG,IAAI,CAAI,GAChB,IAAI,EAAc,EAAO,GAAa,KAAA,GAAW,SAAS,CAAC,GAC3D,IAAK,EAAG,OAAO,CAAC,IAAI,CAAE,GACtB,IAAK,EAAG,OAAO,IAAI,CAAE,GAErB,IAAI,EAAM,KAAK,eAAe,CAAE,EAAE,IAAI,EAAE,eAAe,CAAE,CAAC;GAChE,IAAI,EAAE,IAAI,GACN,MAAU,MAAM,qCAAqC;GAEzD,OADA,EAAE,eAAe,GACV;EACX;EAEA,WAAW;GACP,OAAO,EAAsB,KAAK,CAAC;EACvC;EACA,QAAQ,IAAS,EAAe,QAAQ;GAEpC,IADA,GAAkB,CAAM,GACpB,MAAW,OACX,OAAO,EAAW,EAAI,WAAW,IAAI,CAAC;GAC1C,IAAM,EAAE,MAAG,SAAM,MACX,IAAK,EAAG,QAAQ,CAAC,GACjB,IAAK,EAAG,QAAQ,CAAC;GAKvB,OAJI,MAAW,eACX,EAAuB,GAChB,EAAY,WAAW,GAAG,KAAK,eAAe,CAAC,GAAG,GAAI,CAAE,KAE5D,EAAY,GAAI,CAAE;EAC7B;EACA,MAAM,GAAQ;GACV,OAAO,GAAW,KAAK,QAAQ,CAAM,CAAC;EAC1C;CACJ;CAEA,AADA,OAAO,OAAO,EAAU,SAAS,GACjC,OAAO,OAAO,CAAS;CAKvB,IAAM,IAAW,EAAU,aAAa,KAAA,IAClC,SAAsB,GAAO;EAE3B,IAAI,EAAM,SAAS,MACf,MAAU,MAAM,oBAAoB;EAGxC,IAAM,IAAM,EAAgB,CAAK,GAC3B,IAAQ,EAAM,SAAS,IAAI;EACjC,OAAO,IAAQ,IAAI,KAAO,OAAO,CAAK,IAAI;CAC9C,IACE,EAAU,UACV,IAAgB,EAAU,kBAAkB,KAAA,IAC5C,SAA2B,GAAO;EAChC,OAAO,EAAG,OAAO,EAAS,CAAK,CAAC;CACpC,IACE,EAAU,eACV,IAAa,GAAQ,CAAM;CAGjC,SAAS,EAAW,GAAK;EAErB,OADA,GAAS,aAAa,GAAQ,GAAK,GAAK,CAAU,GAC3C,EAAG,QAAQ,CAAG;CACzB;CACA,SAAS,EAAmB,GAAS,GAAS;EAE1C,OADA,EAAO,GAAS,KAAA,GAAW,SAAS,GAC5B,IAAU,EAAO,EAAM,CAAO,GAAG,KAAA,GAAW,mBAAmB,IAAI;CAC/E;CASA,SAAS,GAAQ,GAAS,GAAW,GAAM;EACvC,IAAM,EAAE,SAAM,YAAS,oBAAiB,GAAgB,GAAM,CAAc;EAC5E,IAAU,EAAmB,GAAS,CAAO;EAI7C,IAAM,IAAQ,EAAc,CAAO,GAC7B,IAAI,EAAG,UAAU,CAAS;EAChC,IAAI,CAAC,EAAG,YAAY,CAAC,GACjB,MAAU,MAAM,qBAAqB;EACzC,IAAM,IAAW,CAAC,EAAW,CAAC,GAAG,EAAW,CAAK,CAAC;EAElD,IAAI,KAAgB,QAAQ,MAAiB,IAAO;GAGhD,IAAM,IAAI,MAAiB,KAAO,EAAY,EAAQ,SAAS,IAAI;GACnE,EAAS,KAAK,EAAO,GAAG,KAAA,GAAW,cAAc,CAAC;EACtD;EACA,IAAM,IAAO,EAAY,GAAG,CAAQ,GAC9B,IAAI;EASV,SAAS,EAAM,GAAQ;GAGnB,IAAM,IAAI,EAAS,CAAM;GACzB,IAAI,CAAC,EAAG,YAAY,CAAC,GACjB;GACJ,IAAM,IAAK,EAAG,IAAI,CAAC,GACb,IAAI,EAAM,KAAK,SAAS,CAAC,EAAE,SAAS,GACpC,IAAI,EAAG,OAAO,EAAE,CAAC;GACvB,IAAI,MAAM,GACN;GACJ,IAAM,IAAI,EAAG,OAAO,IAAK,EAAG,OAAO,IAAI,IAAI,CAAC,CAAC;GAC7C,IAAI,MAAM,GACN;GACJ,IAAI,KAAY,EAAE,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,IAAI,CAAG,GACjD,IAAQ;GAKZ,OAJI,KAAQ,EAAsB,CAAC,MAC/B,IAAQ,EAAG,IAAI,CAAC,GAChB,KAAY,IAET,IAAI,EAAU,GAAG,GAAO,IAAwB,KAAA,IAAY,CAAQ;EAC/E;EACA,OAAO;GAAE;GAAM;EAAM;CACzB;CAcA,SAAS,GAAK,GAAS,GAAW,IAAO,CAAC,GAAG;EACzC,IAAM,EAAE,SAAM,aAAU,GAAQ,GAAS,GAAW,CAAI;EAGxD,OAFa,GAAe,EAAM,WAAW,EAAG,OAAOE,CACxC,EAAE,GAAM,CACd,EAAE,QAAQ,EAAK,MAAM;CAClC;CAcA,SAAS,EAAO,GAAW,GAAS,GAAW,IAAO,CAAC,GAAG;EACtD,IAAM,EAAE,SAAM,YAAS,cAAW,GAAgB,GAAM,CAAc;EAGtE,IAFA,IAAY,EAAO,GAAW,KAAA,GAAW,WAAW,GACpD,IAAU,EAAmB,GAAS,CAAO,GACzC,CAAC,GAAQ,CAAS,GAAG;GACrB,IAAM,IAAM,aAAqB,IAAY,wBAAwB;GACrE,MAAU,MAAM,wCAAwC,CAAG;EAC/D;EACA,EAAkB,GAAW,CAAM;EACnC,IAAI;GACA,IAAM,IAAM,EAAU,UAAU,GAAW,CAAM,GAC3C,IAAI,EAAM,UAAU,CAAS;GACnC,IAAI,KAAQ,EAAI,SAAS,GACrB,OAAO;GACX,IAAM,EAAE,MAAG,SAAM,GACX,IAAI,EAAc,CAAO,GACzB,IAAK,EAAG,IAAI,CAAC,GACb,IAAK,EAAG,OAAO,IAAI,CAAE,GACrB,IAAK,EAAG,OAAO,IAAI,CAAE,GACrB,IAAI,EAAM,KAAK,eAAe,CAAE,EAAE,IAAI,EAAE,eAAe,CAAE,CAAC;GAIhE,OAHI,EAAE,IAAI,IACC,KACD,EAAG,OAAO,EAAE,CACf,MAAM;EACjB,QACU;GACN,OAAO;EACX;CACJ;CACA,SAAS,EAAiB,GAAW,GAAS,IAAO,CAAC,GAAG;EAGrD,IAAM,EAAE,eAAY,GAAgB,GAAM,CAAc;EAExD,OADA,IAAU,EAAmB,GAAS,CAAO,GACtC,EAAU,UAAU,GAAW,WAAW,EAAE,iBAAiB,CAAO,EAAE,QAAQ;CACzF;CACA,OAAO,OAAO,OAAO;EACjB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,MAAM;CACV,CAAC;AACL;;;AC/2CA,IAAM,KAAkB;CACpB,GAAG,OAAO,oEAAoE;CAC9E,GAAG,OAAO,oEAAoE;CAC9E,GAAG,OAAO,CAAC;CACX,GAAG,OAAO,CAAC;CACX,GAAG,OAAO,CAAC;CACX,IAAI,OAAO,oEAAoE;CAC/E,IAAI,OAAO,oEAAoE;AACnF,GACM,KAAiB;CACnB,MAAM,OAAO,oEAAoE;CACjF,SAAS,CACL,CAAC,OAAO,oCAAoC,GAAG,CAAC,OAAO,oCAAoC,CAAC,GAC5F,CAAC,OAAO,qCAAqC,GAAG,OAAO,oCAAoC,CAAC,CAChG;AACJ,GAEM,KAAsB,uBAAO,CAAC;AAKpC,SAAS,GAAQ,GAAG;CAChB,IAAM,IAAI,GAAgB,GAEpB,IAAM,OAAO,CAAC,GAAG,IAAM,OAAO,CAAC,GAAG,IAAO,OAAO,EAAE,GAAG,IAAO,OAAO,EAAE,GAErE,IAAO,OAAO,EAAE,GAAG,IAAO,OAAO,EAAE,GAAG,IAAO,OAAO,EAAE,GACtD,IAAM,IAAI,IAAI,IAAK,GACnB,IAAM,IAAK,IAAK,IAAK,GAGrB,IAAO,EADD,EADA,EAAK,GAAI,GAAK,CAAC,IAAI,IAAM,GAChB,GAAK,CAAC,IAAI,IAAM,GACf,IAAK,CAAC,IAAI,IAAM,GAChC,IAAO,EAAK,GAAK,GAAM,CAAC,IAAI,IAAO,GACnC,IAAO,EAAK,GAAK,GAAM,CAAC,IAAI,IAAO,GACnC,IAAO,EAAK,GAAK,GAAM,CAAC,IAAI,IAAO,GAMnC,IAAO,EADD,EADA,EADE,EADA,EADA,EAAK,GAAK,GAAM,CAAC,IAAI,IAAO,GACjB,GAAM,CAAC,IAAI,IAAO,GAClB,GAAK,CAAC,IAAI,IAAM,GAClB,GAAM,CAAC,IAAI,IAAO,GACpB,GAAK,CAAC,IAAI,IAAM,GACf,IAAK,CAAC;CAC5B,IAAI,CAAC,GAAK,IAAI,GAAK,IAAI,CAAI,GAAG,CAAC,GAC3B,MAAU,MAAM,yBAAyB;CAC7C,OAAO;AACX;AACA,IAAM,KAAO,EAAM,GAAgB,GAAG,EAAE,MAAM,GAAQ,CAAC,GAwB1C,KAA4B,mBAAM,gBAvBf,GAAY,IAAiB;CACzD,IAAI;CACJ,MAAM;AACV,CAoB+C,GAAS,CAAM,GCgHxD,KAAyB,2BAAW,KAAK;CAC3C;CAAG;CAAG;CAAI;CAAG;CAAI;CAAG;CAAI;CAAG;CAAI;CAAG;CAAG;CAAG;CAAG;CAAI;CAAI;AACvD,CAAC,GACK,KAA+B,2BAAW,KAAS,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC,GACrF,KAA+B,mBAAM,KAAK,OAAO,IAAI,IAAI,KAAK,EAAE,GAEhE,KAAwB,uBAAO;CAGjC,IAAM,IAAM,CAAC,CAFF,EAEE,GAAG,CADL,EACK,CAAC;CACjB,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KACnB,KAAK,IAAI,KAAK,GACV,EAAE,KAAK,EAAE,GAAG,KAAK,MAAM,GAAO,EAAE,CAAC;CACzC,OAAO;AACX,GAAG,GACG,KAA8B,GAAM,IACpC,KAA8B,GAAM,IAGpC,KAA4B;CAC9B;EAAC;EAAI;EAAI;EAAI;EAAI;EAAG;EAAG;EAAG;EAAG;EAAI;EAAI;EAAI;EAAI;EAAG;EAAG;EAAG;CAAC;CACvD;EAAC;EAAI;EAAI;EAAI;EAAI;EAAG;EAAG;EAAG;EAAG;EAAI;EAAI;EAAI;EAAI;EAAG;EAAG;EAAG;CAAC;CACvD;EAAC;EAAI;EAAI;EAAI;EAAI;EAAG;EAAG;EAAG;EAAG;EAAI;EAAI;EAAI;EAAI;EAAG;EAAG;EAAG;CAAC;CACvD;EAAC;EAAI;EAAI;EAAI;EAAI;EAAG;EAAG;EAAG;EAAG;EAAI;EAAI;EAAI;EAAI;EAAG;EAAG;EAAG;CAAC;CACvD;EAAC;EAAI;EAAI;EAAI;EAAI;EAAG;EAAG;EAAG;EAAG;EAAI;EAAI;EAAI;EAAI;EAAG;EAAG;EAAG;CAAC;AAC3D,EAAE,KAAK,MAAM,WAAW,KAAK,CAAC,CAAC,GACzB,KAA6B,mBAAK,KAAK,GAAK,MAAM,EAAI,KAAK,MAAM,GAAU,GAAG,EAAE,CAAC,GACjF,KAA6B,mBAAK,KAAK,GAAK,MAAM,EAAI,KAAK,MAAM,GAAU,GAAG,EAAE,CAAC,GAEjF,KAAwB,4BAAY,KAAK;CAC3C;CAAY;CAAY;CAAY;CAAY;AACpD,CAAC,GAEK,KAAwB,4BAAY,KAAK;CAC3C;CAAY;CAAY;CAAY;CAAY;AACpD,CAAC;AAGD,SAAS,GAAS,GAAO,GAAG,GAAG,GAAG;CAS9B,OARI,MAAU,IACH,IAAI,IAAI,IACf,MAAU,IACF,IAAI,IAAM,CAAC,IAAI,IACvB,MAAU,KACF,IAAI,CAAC,KAAK,IAClB,MAAU,IACF,IAAI,IAAM,IAAI,CAAC,IACpB,KAAK,IAAI,CAAC;AACrB;AAEA,IAAM,oBAA0B,IAAI,YAAY,EAAE,GAKrC,KAAb,cAAgC,EAAO;CACnC,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,cAAc;EACV,MAAM,IAAI,IAAI,GAAG,EAAI;CACzB;CACA,MAAM;EACF,IAAM,EAAE,OAAI,OAAI,OAAI,OAAI,UAAO;EAC/B,OAAO;GAAC;GAAI;GAAI;GAAI;GAAI;EAAE;CAC9B;CACA,IAAI,GAAI,GAAI,GAAI,GAAI,GAAI;EAKpB,AAJA,KAAK,KAAK,IAAK,GACf,KAAK,KAAK,IAAK,GACf,KAAK,KAAK,IAAK,GACf,KAAK,KAAK,IAAK,GACf,KAAK,KAAK,IAAK;CACnB;CACA,QAAQ,GAAM,GAAQ;EAClB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,KAAU,GACnC,EAAQ,KAAK,EAAK,UAAU,GAAQ,EAAI;EAE5C,IAAI,IAAK,KAAK,KAAK,GAAG,IAAK,GAAI,IAAK,KAAK,KAAK,GAAG,IAAK,GAAI,IAAK,KAAK,KAAK,GAAG,IAAK,GAAI,IAAK,KAAK,KAAK,GAAG,IAAK,GAAI,IAAK,KAAK,KAAK,GAAG,IAAK;EAGvI,KAAK,IAAI,IAAQ,GAAG,IAAQ,GAAG,KAAS;GACpC,IAAM,IAAS,IAAI,GACb,IAAM,GAAM,IAAQ,IAAM,GAAM,IAChC,IAAK,GAAK,IAAQ,IAAK,GAAK,IAC5B,IAAK,GAAW,IAAQ,IAAK,GAAW;GAC9C,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;IACzB,IAAM,IAAM,EAAK,IAAK,GAAS,GAAO,GAAI,GAAI,CAAE,IAAI,EAAQ,EAAG,MAAM,GAAK,EAAG,EAAE,IAAI,IAAM;IACzF,IAAK,GAAI,IAAK,GAAI,IAAK,EAAK,GAAI,EAAE,IAAI,GAAG,IAAK,GAAI,IAAK;GAC3D;GAEA,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;IACzB,IAAM,IAAM,EAAK,IAAK,GAAS,GAAQ,GAAI,GAAI,CAAE,IAAI,EAAQ,EAAG,MAAM,GAAK,EAAG,EAAE,IAAI,IAAM;IAC1F,IAAK,GAAI,IAAK,GAAI,IAAK,EAAK,GAAI,EAAE,IAAI,GAAG,IAAK,GAAI,IAAK;GAC3D;EACJ;EAGA,KAAK,IAAK,KAAK,KAAK,IAAK,IAAM,GAAI,KAAK,KAAK,IAAK,IAAM,GAAI,KAAK,KAAK,IAAK,IAAM,GAAI,KAAK,KAAK,IAAK,IAAM,GAAI,KAAK,KAAK,IAAK,IAAM,CAAC;CACxI;CACA,aAAa;EACT,EAAM,CAAO;CACjB;CACA,UAAU;EAGN,AAFA,KAAK,YAAY,IACjB,EAAM,KAAK,MAAM,GACjB,KAAK,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC;CAC1B;AACJ,GAea,KAA4B,wBAAmB,IAAI,GAAW,CAAC,GCtTtE,KAAkB;AAKxB,SAAS,GAAa,GAAyB;CAC7C,IAAM,IAAkB,CAAC,CAAC;CAC1B,KAAK,IAAI,IAAI,GAAG,IAAI,EAAI,QAAQ,KAAK;EACnC,IAAM,IAAO,EAAI;EACjB,IAAI,CAAC,GAAM;EACX,IAAM,IAAQ,GAAgB,QAAQ,CAAI;EAC1C,IAAI,MAAU,IAAI,MAAU,MAAM,0BAA0B;EAE5D,KAAK,IAAI,IAAI,GAAG,IAAI,EAAM,QAAQ,KAChC,EAAM,MAAO;EAEf,EAAM,MAAO;EAEb,IAAI,IAAQ;EACZ,KAAK,IAAI,IAAI,GAAG,IAAI,EAAM,QAAQ,KAIhC,AAFA,EAAM,KADO,EAAM,KACD,GAClB,IAAQ,EAAM,MAAO,GACrB,EAAM,MAAO;EAEf,OAAO,IAAQ,IAEb,AADA,EAAM,KAAK,IAAQ,GAAI,GACvB,MAAU;CAEd;CAGA,KAAK,IAAI,IAAI,GAAG,IAAI,EAAI,UAAU,EAAI,OAAO,KAAK,KAChD,EAAM,KAAK,CAAC;CAGd,OAAO,IAAI,WAAW,EAAM,QAAQ,CAAC;AACvC;AAKA,SAAS,GAAa,GAAkE;CACtF,IAGM,IADY,EAAQ,YACZ,EAAU,MAAM,GAAG;CACjC,IAAI,EAAM,WAAW,GAAG,OAAO;CAE/B,IAAM,IAAM,EAAM,IACZ,IAAO,EAAM;CAEnB,IADI,CAAC,KAAO,CAAC,KACT,MAAQ,OAAO,OAAO;CAE1B,IAAM,IAAmB,CAAC;CAC1B,KAAK,IAAM,KAAQ,GAAM;EACvB,IAAM,IAAM,mCAAQ,QAAQ,CAAI;EAChC,IAAI,MAAQ,IAAI,OAAO;EACvB,EAAO,KAAK,CAAG;CACjB;CAGA,IAAM,IAAU,EAAO,MAAM,GAAG,EAAE;CAClC,IAAI,EAAQ,SAAS,GAAG,OAAO;CAE/B,IAAM,IAAU,EAAQ;CACxB,IAAI,MAAY,KAAA,GAAW,OAAO;CAGlC,IAAM,IAAY,GAAY,EAAQ,MAAM,CAAC,GAAG,GAAG,GAAG,EAAK;CAG3D,OAFK,IAEE;EAAE;EAAS,SAAS,IAAI,WAAW,CAAS;CAAE,IAF9B;AAGzB;AAKA,SAAS,GAAY,GAAgB,GAAkB,GAAgB,GAA+B;CACpG,IAAI,IAAM,GACN,IAAO,GACL,IAAmB,CAAC,GACpB,KAAQ,KAAK,KAAU;CAE7B,KAAK,IAAM,KAAS,GAAM;EACxB,IAAI,IAAQ,KAAK,KAAS,MAAa,GAAG,OAAO;EAGjD,KAFA,IAAO,KAAO,IAAY,GAC1B,KAAQ,GACD,KAAQ,IAEb,AADA,KAAQ,GACR,EAAO,KAAM,KAAO,IAAQ,CAAI;CAEpC;CAEA,IAAI,GACE,IAAO,KAAG,EAAO,KAAM,KAAQ,IAAS,IAAS,CAAI;MACpD,IAAI,KAAQ,KAAc,KAAQ,IAAS,IAAS,GACzD,OAAO;CAGT,OAAO;AACT;AAKA,SAAS,GAAY,GAAiB,GAAmC;CAGvE,IAAM,IAAe,IAAI,YAAY,EAAE,OAAO,CAAa,GAErD,IAAgB,IAAI,YAAY,EAAE,OAAO,CAAO,GAChD,IAA+B,CAAC,GAClC,IAAgB,EAAc;CAGlC,IAAI,IAAgB,KAClB,EAAmB,KAAK,CAAa;MAChC,IAAI,KAAiB,OAC1B,EAAmB,KAAK,KAAM,IAAgB,KAAO,KAAiB,IAAK,GAAI;MAC1E,IAAI,KAAiB,YAC1B,EAAmB,KACjB,KACA,IAAgB,KACf,KAAiB,IAAK,KACtB,KAAiB,KAAM,KACvB,KAAiB,KAAM,GAC1B;MAEA,MAAU,MAAM,kBAAkB;CAGpC,IAAM,IAAsB,IAAI,WAAW,CAAkB,GAGvD,IAAc,EAAa,SAAS,EAAoB,SAAS,EAAc,QAC/E,IAAW,IAAI,WAAW,CAAW,GACvC,IAAS;CASb,OAPA,EAAS,IAAI,GAAc,CAAM,GACjC,KAAU,EAAa,QACvB,EAAS,IAAI,GAAqB,CAAM,GACxC,KAAU,EAAoB,QAC9B,EAAS,IAAI,GAAe,CAAM,GAG3B,EAAO,EAAO,CAAQ,CAAC;AAChC;AAKA,SAAS,GAAiB,GAAyB,GAAqC;CACtF,IAAI,EAAU,WAAW,IACvB,MAAU,MAAM,0BAA0B;CAI5C,IADkB,EAAU,OACV,KAAA,GAAW,MAAU,MAAM,mBAAmB;CAEhE,IAAM,IAAI,EAAU,MAAM,GAAG,EAAE,GACzB,IAAI,EAAU,MAAM,IAAI,EAAE,GAE1B,IAAwB,CAAC;CAI/B,KAAK,IAAI,IAAQ,GAAG,IAAQ,GAAG,KAC7B,IAAI;EAOF,IAAM,IALM,IAAI,GAAU,UACxB,OAAO,OAAO,MAAM,KAAK,CAAC,EAAE,KAAI,MAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,GAC9E,OAAO,OAAO,MAAM,KAAK,CAAC,EAAE,KAAI,MAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAChF,EAAE,eAAe,CAEH,EAAI,iBAAiB,CAAW,GAGxC,IAAkB,EAAM,QAAQ,EAAI,GACpC,IAAoB,EAAM,QAAQ,EAAK;EAI7C,AADA,EAAQ,KAAK,CAAe,GAC5B,EAAQ,KAAK,CAAiB;CAChC,QAAQ;EAEN;CACF;CAGF,IAAI,EAAQ,WAAW,GACrB,MAAU,MAAM,mCAAmC;CAGrD,OAAO;AACT;AAKA,SAAS,GAAQ,GAAgC;CAC/C,OAAO,GAAU,EAAO,CAAM,CAAC;AACjC;AAKA,SAAS,GAAc,GAAiB,GAAgC;CAEtE,IAAI,EAAQ,WAAW,GAAG,KAAK,EAAQ,WAAW,GAAG,GACnD,IAAI;EACF,IAAM,IAAU,GAAa,CAAO;EACpC,IAAI,EAAQ,SAAS,IAAI,OAAO;EAEhC,IAAM,IAAU,EAAQ,MAAM,GAAG,EAAE,GAC7B,IAAW,EAAQ,MAAM,EAAE,GAG3B,IADO,EAAO,EAAO,CAAO,CACT,EAAK,MAAM,GAAG,CAAC;EAGxC,IAAI,CAAC,EAAS,OAAO,GAAM,MAAM,MAAS,EAAiB,EAAE,GAC3D,OAAO;EAGT,IAAM,IAAa,EAAQ,MAAM,CAAC,GAC5B,IAAe,GAAQ,CAAS;EAEtC,OAAO,EAAW,OAAO,GAAM,MAAM,MAAS,EAAa,EAAE;CAC/D,QAAQ;EACN,OAAO;CACT;CAIF,IAAI,EAAQ,YAAY,EAAE,WAAW,MAAM,GACzC,IAAI;EACF,IAAM,IAAU,GAAa,CAAO;EACpC,IAAI,CAAC,GAAS,OAAO;EAErB,IAAM,EAAE,YAAS,eAAY;EAE7B,IAAI,MAAY,GAAG;GAEjB,IAAI,IAAW;GAGf,IAAI,EAAU,WAAW,IAAI;IAC3B,IAAM,IAAS,EAAU,MAAO,KAAM;IAGtC,AAFA,IAAW,IAAI,WAAW,EAAE,GAC5B,EAAS,KAAK,IAAS,IAAO,GAC9B,EAAS,IAAI,EAAU,MAAM,GAAG,EAAE,GAAG,CAAC;GACxC;GAEA,IAAM,IAAe,GAAQ,CAAQ;GACrC,OAAO,EAAQ,OAAO,GAAM,MAAM,MAAS,EAAa,EAAE;EAC5D;EAEA,OAAO;CACT,QAAQ;EACN,OAAO;CACT;CAGF,OAAO;AACT;AAOA,eAAsB,GACpB,GACA,GACA,GACkB;CAIlB,IAAI;EAEF,IAAM,IAAW,WAAW,KAAK,WAAW,KAAK,CAAS,IAAG,MAAK,EAAE,WAAW,CAAC,CAAC;EAEjF,IAAI,EAAS,WAAW,IACtB,MAAU,MAAM,0BAA0B;EAO5C,IAAM,IAAa,GAHC,GAAY,GAAK,6BAGD,GAAa,CAAQ;EAGzD,KAAK,IAAM,KAAU,GACnB,IAAI,GAAc,GAAS,CAAM,GAC/B,OAAO;EAIX,OAAO;CACT,SAAS,GAAY;EAEnB,MAAM,IAAI,EAAY,kCADD,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,GACQ;CACxE;AACF;AAOA,SAAS,GAAc,IAAS,IAAY;CAC1C,OAAO,EAAY,CAAM,EAAE,SAAS,KAAK;AAC3C;AASA,SAAgB,GAAkB,GAAmC;CACnE,IAAI,CAAC,EAAQ,aACX,MAAM,IAAI,EAAY,2BAA2B;CAGnD,IAAI;CACJ,IAAI;EACF,IAAY,IAAI,IAAI,EAAQ,WAAW;CACzC,SAAS,GAAG;EACV,MAAM,IAAI,EAAY,yBAA0B,EAAY,SAAS;CACvE;CAGA,IAAM,IAAgB,EAAU,OAAO,EAAU,UAE3C,IAAQ,EAAQ,SAAS,GAAc,GACvC,IAAe,EAAQ,WAAW,MAAM;CAG9C,IAAI,EAAQ,YAAY,EAAU,aAAa,SAC7C,MAAM,IAAI,EAAY,qEAAqE;CAE7F,IAAI,CAAC,EAAQ,YAAY,EAAU,aAAa,UAC9C,MAAM,IAAI,EAAY,2EAA2E;CAWnG,OAAO,YANiB,EAAc,KAAK,EAAM,KAAK;AAOxD;AAUA,eAAsB,GACpB,GACA,GACmC;CACnC,IAAM,EAAE,YAAS,QAAK,iBAAc,GAC9B,EAAE,wBAAqB,qBAAkB;CAE/C,IAAI,CAAC,KAAW,CAAC,KAAO,CAAC,GACvB,MAAM,IAAI,EAAY,6DAA6D;CAIrF,IAAI;CACJ,IAAI;EAEF,IAAM,IAAc,EAAI,QAAQ,YAAY,OAAO;EACnD,IAAoB,IAAI,IAAI,CAAW;CACzC,SAAS,GAAG;EACV,MAAM,IAAI,EAAY,qCAAsC,EAAY,SAAS;CACnF;CAEA,IAAM,IAAgB,EAAkB,aAAa,IAAI,GAAG,GACtD,IAAmB,EAAkB,aAAa,IAAI,GAAG,GACzD,IAAwB,EAAkB,OAAO,EAAkB;CAEzE,IAAI,MAAkB,QAAQ,MAAqB,MACjD,MAAM,IAAI,EAAY,kDAAkD;CAI1E,IAAI;CACJ,IAAI;EAEF,IAAoB,OAAO,KAAwB,WAAW,IAAI,IAAI,CAAmB,IAAI;CAC/F,SAAS,GAAG;EACV,MAAM,IAAI,EAAY,yCAA0C,EAAY,SAAS;CACvF;CAEA,IAAM,IAAwB,EAAkB,OAAO,EAAkB;CAEzE,IAAI,MAA0B,GAC5B,MAAM,IAAI,EAAY,yCAAyC,EAAsB,eAAe,EAAsB,EAAE;CAI9H,IAAM,IAAiB,EAAkB;CACzC,IAAI,MAAqB,OAAO,MAAmB,SACjD,MAAM,IAAI,EAAY,oEAAoE;CAE5F,IAAI,MAAqB,OAAO,MAAmB,UACjD,MAAM,IAAI,EAAY,mEAAmE;CAI3F,IAAI,KAAiB,MAAkB,GACrC,MAAM,IAAI,EAAY,kCAAkC,EAAc,eAAe,EAAc,2BAA2B;CAIhI,IAAI;EAEF,IAAI,CAAC,MAD0B,GAAyB,GAAK,GAAS,CAAS,GAG7E,MAAM,IAAI,EAAY,oBAAoB;CAE9C,SAAS,GAAO;EAOZ,MAJE,aAAiB,IACb,IAGA,IAAI,EAAY,mDAAoD,EAAgB,SAAS;CAEvG;CAGA,OAAO;EACL,SAAS;EACA;EACT,OAAO;CACT;AACF"}