holosphere 2.0.0-alpha5 → 2.0.0-alpha7

package/dist/{secp256k1-TcN6vWGh.cjs.map → secp256k1-BCAPF45D.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"secp256k1-TcN6vWGh.cjs","sources":["../node_modules/@noble/hashes/esm/hmac.js","../node_modules/@noble/curves/esm/utils.js","../node_modules/@noble/curves/esm/abstract/modular.js","../node_modules/@noble/curves/esm/abstract/curve.js","../node_modules/@noble/curves/esm/abstract/weierstrass.js","../node_modules/@noble/curves/esm/secp256k1.js","../node_modules/@noble/curves/esm/_shortw_utils.js"],"sourcesContent":["/**\n * HMAC: RFC2104 message authentication code.\n * @module\n */\nimport { abytes, aexists, ahash, clean, Hash, toBytes } from \"./utils.js\";\nexport class HMAC extends Hash {\n    constructor(hash, _key) {\n        super();\n        this.finished = false;\n        this.destroyed = false;\n        ahash(hash);\n        const key = toBytes(_key);\n        this.iHash = hash.create();\n        if (typeof this.iHash.update !== 'function')\n            throw new Error('Expected instance of class which extends utils.Hash');\n        this.blockLen = this.iHash.blockLen;\n        this.outputLen = this.iHash.outputLen;\n        const blockLen = this.blockLen;\n        const pad = new Uint8Array(blockLen);\n        // blockLen can be bigger than outputLen\n        pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36;\n        this.iHash.update(pad);\n        // By doing update (processing of first block) of outer hash here we can re-use it between multiple calls via clone\n        this.oHash = hash.create();\n        // Undo internal XOR && apply outer XOR\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36 ^ 0x5c;\n        this.oHash.update(pad);\n        clean(pad);\n    }\n    update(buf) {\n        aexists(this);\n        this.iHash.update(buf);\n        return this;\n    }\n    digestInto(out) {\n        aexists(this);\n        abytes(out, this.outputLen);\n        this.finished = true;\n        this.iHash.digestInto(out);\n        this.oHash.update(out);\n        this.oHash.digestInto(out);\n        this.destroy();\n    }\n    digest() {\n        const out = new Uint8Array(this.oHash.outputLen);\n        this.digestInto(out);\n        return out;\n    }\n    _cloneInto(to) {\n        // Create new instance without calling constructor since key already in state and we don't know it.\n        to || (to = Object.create(Object.getPrototypeOf(this), {}));\n        const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;\n        to = to;\n        to.finished = finished;\n        to.destroyed = destroyed;\n        to.blockLen = blockLen;\n        to.outputLen = outputLen;\n        to.oHash = oHash._cloneInto(to.oHash);\n        to.iHash = iHash._cloneInto(to.iHash);\n        return to;\n    }\n    clone() {\n        return this._cloneInto();\n    }\n    destroy() {\n        this.destroyed = true;\n        this.oHash.destroy();\n        this.iHash.destroy();\n    }\n}\n/**\n * HMAC: RFC2104 message authentication code.\n * @param hash - function that would be used e.g. sha256\n * @param key - message key\n * @param message - message data\n * @example\n * import { hmac } from '@noble/hashes/hmac';\n * import { sha256 } from '@noble/hashes/sha2';\n * const mac1 = hmac(sha256, 'key', 'message');\n */\nexport const hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();\nhmac.create = (hash, key) => new HMAC(hash, key);\n//# sourceMappingURL=hmac.js.map","/**\n * Hex, bytes and number utilities.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { abytes as abytes_, bytesToHex as bytesToHex_, concatBytes as concatBytes_, hexToBytes as hexToBytes_, isBytes as isBytes_, } from '@noble/hashes/utils.js';\nexport { abytes, anumber, bytesToHex, bytesToUtf8, concatBytes, hexToBytes, isBytes, randomBytes, utf8ToBytes, } from '@noble/hashes/utils.js';\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\nexport function abool(title, value) {\n    if (typeof value !== 'boolean')\n        throw new Error(title + ' boolean expected, got ' + value);\n}\n// tmp name until v2\nexport function _abool2(value, title = '') {\n    if (typeof value !== 'boolean') {\n        const prefix = title && `\"${title}\"`;\n        throw new Error(prefix + 'expected boolean, got type=' + typeof value);\n    }\n    return value;\n}\n// tmp name until v2\n/** Asserts something is Uint8Array. */\nexport function _abytes2(value, length, title = '') {\n    const bytes = isBytes_(value);\n    const len = value?.length;\n    const needsLen = length !== undefined;\n    if (!bytes || (needsLen && len !== length)) {\n        const prefix = title && `\"${title}\" `;\n        const ofLen = needsLen ? ` of length ${length}` : '';\n        const got = bytes ? `length=${len}` : `type=${typeof value}`;\n        throw new Error(prefix + 'expected Uint8Array' + ofLen + ', got ' + got);\n    }\n    return value;\n}\n// Used in weierstrass, der\nexport function numberToHexUnpadded(num) {\n    const hex = num.toString(16);\n    return hex.length & 1 ? '0' + hex : hex;\n}\nexport function hexToNumber(hex) {\n    if (typeof hex !== 'string')\n        throw new Error('hex string expected, got ' + typeof hex);\n    return hex === '' ? _0n : BigInt('0x' + hex); // Big Endian\n}\n// BE: Big Endian, LE: Little Endian\nexport function bytesToNumberBE(bytes) {\n    return hexToNumber(bytesToHex_(bytes));\n}\nexport function bytesToNumberLE(bytes) {\n    abytes_(bytes);\n    return hexToNumber(bytesToHex_(Uint8Array.from(bytes).reverse()));\n}\nexport function numberToBytesBE(n, len) {\n    return hexToBytes_(n.toString(16).padStart(len * 2, '0'));\n}\nexport function numberToBytesLE(n, len) {\n    return numberToBytesBE(n, len).reverse();\n}\n// Unpadded, rarely used\nexport function numberToVarBytesBE(n) {\n    return hexToBytes_(numberToHexUnpadded(n));\n}\n/**\n * Takes hex string or Uint8Array, converts to Uint8Array.\n * Validates output length.\n * Will throw error for other types.\n * @param title descriptive title for an error e.g. 'secret key'\n * @param hex hex string or Uint8Array\n * @param expectedLength optional, will compare to result array's length\n * @returns\n */\nexport function ensureBytes(title, hex, expectedLength) {\n    let res;\n    if (typeof hex === 'string') {\n        try {\n            res = hexToBytes_(hex);\n        }\n        catch (e) {\n            throw new Error(title + ' must be hex string or Uint8Array, cause: ' + e);\n        }\n    }\n    else if (isBytes_(hex)) {\n        // Uint8Array.from() instead of hash.slice() because node.js Buffer\n        // is instance of Uint8Array, and its slice() creates **mutable** copy\n        res = Uint8Array.from(hex);\n    }\n    else {\n        throw new Error(title + ' must be hex string or Uint8Array');\n    }\n    const len = res.length;\n    if (typeof expectedLength === 'number' && len !== expectedLength)\n        throw new Error(title + ' of length ' + expectedLength + ' expected, got ' + len);\n    return res;\n}\n// Compares 2 u8a-s in kinda constant time\nexport function equalBytes(a, b) {\n    if (a.length !== b.length)\n        return false;\n    let diff = 0;\n    for (let i = 0; i < a.length; i++)\n        diff |= a[i] ^ b[i];\n    return diff === 0;\n}\n/**\n * Copies Uint8Array. We can't use u8a.slice(), because u8a can be Buffer,\n * and Buffer#slice creates mutable copy. Never use Buffers!\n */\nexport function copyBytes(bytes) {\n    return Uint8Array.from(bytes);\n}\n/**\n * Decodes 7-bit ASCII string to Uint8Array, throws on non-ascii symbols\n * Should be safe to use for things expected to be ASCII.\n * Returns exact same result as utf8ToBytes for ASCII or throws.\n */\nexport function asciiToBytes(ascii) {\n    return Uint8Array.from(ascii, (c, i) => {\n        const charCode = c.charCodeAt(0);\n        if (c.length !== 1 || charCode > 127) {\n            throw new Error(`string contains non-ASCII character \"${ascii[i]}\" with code ${charCode} at position ${i}`);\n        }\n        return charCode;\n    });\n}\n/**\n * @example utf8ToBytes('abc') // new Uint8Array([97, 98, 99])\n */\n// export const utf8ToBytes: typeof utf8ToBytes_ = utf8ToBytes_;\n/**\n * Converts bytes to string using UTF8 encoding.\n * @example bytesToUtf8(Uint8Array.from([97, 98, 99])) // 'abc'\n */\n// export const bytesToUtf8: typeof bytesToUtf8_ = bytesToUtf8_;\n// Is positive bigint\nconst isPosBig = (n) => typeof n === 'bigint' && _0n <= n;\nexport function inRange(n, min, max) {\n    return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;\n}\n/**\n * Asserts min <= n < max. NOTE: It's < max and not <= max.\n * @example\n * aInRange('x', x, 1n, 256n); // would assume x is in (1n..255n)\n */\nexport function aInRange(title, n, min, max) {\n    // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)?\n    // consider P=256n, min=0n, max=P\n    // - a for min=0 would require -1:          `inRange('x', x, -1n, P)`\n    // - b would commonly require subtraction:  `inRange('x', x, 0n, P - 1n)`\n    // - our way is the cleanest:               `inRange('x', x, 0n, P)\n    if (!inRange(n, min, max))\n        throw new Error('expected valid ' + title + ': ' + min + ' <= n < ' + max + ', got ' + n);\n}\n// Bit operations\n/**\n * Calculates amount of bits in a bigint.\n * Same as `n.toString(2).length`\n * TODO: merge with nLength in modular\n */\nexport function bitLen(n) {\n    let len;\n    for (len = 0; n > _0n; n >>= _1n, len += 1)\n        ;\n    return len;\n}\n/**\n * Gets single bit at position.\n * NOTE: first bit position is 0 (same as arrays)\n * Same as `!!+Array.from(n.toString(2)).reverse()[pos]`\n */\nexport function bitGet(n, pos) {\n    return (n >> BigInt(pos)) & _1n;\n}\n/**\n * Sets single bit at position.\n */\nexport function bitSet(n, pos, value) {\n    return n | ((value ? _1n : _0n) << BigInt(pos));\n}\n/**\n * Calculate mask for N bits. Not using ** operator with bigints because of old engines.\n * Same as BigInt(`0b${Array(i).fill('1').join('')}`)\n */\nexport const bitMask = (n) => (_1n << BigInt(n)) - _1n;\n/**\n * Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n * @returns function that will call DRBG until 2nd arg returns something meaningful\n * @example\n *   const drbg = createHmacDRBG<Key>(32, 32, hmac);\n *   drbg(seed, bytesToKey); // bytesToKey must return Key or undefined\n */\nexport function createHmacDrbg(hashLen, qByteLen, hmacFn) {\n    if (typeof hashLen !== 'number' || hashLen < 2)\n        throw new Error('hashLen must be a number');\n    if (typeof qByteLen !== 'number' || qByteLen < 2)\n        throw new Error('qByteLen must be a number');\n    if (typeof hmacFn !== 'function')\n        throw new Error('hmacFn must be a function');\n    // Step B, Step C: set hashLen to 8*ceil(hlen/8)\n    const u8n = (len) => new Uint8Array(len); // creates Uint8Array\n    const u8of = (byte) => Uint8Array.of(byte); // another shortcut\n    let v = u8n(hashLen); // Minimal non-full-spec HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n    let k = u8n(hashLen); // Steps B and C of RFC6979 3.2: set hashLen, in our case always same\n    let i = 0; // Iterations counter, will throw when over 1000\n    const reset = () => {\n        v.fill(1);\n        k.fill(0);\n        i = 0;\n    };\n    const h = (...b) => hmacFn(k, v, ...b); // hmac(k)(v, ...values)\n    const reseed = (seed = u8n(0)) => {\n        // HMAC-DRBG reseed() function. Steps D-G\n        k = h(u8of(0x00), seed); // k = hmac(k || v || 0x00 || seed)\n        v = h(); // v = hmac(k || v)\n        if (seed.length === 0)\n            return;\n        k = h(u8of(0x01), seed); // k = hmac(k || v || 0x01 || seed)\n        v = h(); // v = hmac(k || v)\n    };\n    const gen = () => {\n        // HMAC-DRBG generate() function\n        if (i++ >= 1000)\n            throw new Error('drbg: tried 1000 values');\n        let len = 0;\n        const out = [];\n        while (len < qByteLen) {\n            v = h();\n            const sl = v.slice();\n            out.push(sl);\n            len += v.length;\n        }\n        return concatBytes_(...out);\n    };\n    const genUntil = (seed, pred) => {\n        reset();\n        reseed(seed); // Steps D-G\n        let res = undefined; // Step H: grind until k is in [1..n-1]\n        while (!(res = pred(gen())))\n            reseed();\n        reset();\n        return res;\n    };\n    return genUntil;\n}\n// Validating curves and fields\nconst validatorFns = {\n    bigint: (val) => typeof val === 'bigint',\n    function: (val) => typeof val === 'function',\n    boolean: (val) => typeof val === 'boolean',\n    string: (val) => typeof val === 'string',\n    stringOrUint8Array: (val) => typeof val === 'string' || isBytes_(val),\n    isSafeInteger: (val) => Number.isSafeInteger(val),\n    array: (val) => Array.isArray(val),\n    field: (val, object) => object.Fp.isValid(val),\n    hash: (val) => typeof val === 'function' && Number.isSafeInteger(val.outputLen),\n};\n// type Record<K extends string | number | symbol, T> = { [P in K]: T; }\nexport function validateObject(object, validators, optValidators = {}) {\n    const checkField = (fieldName, type, isOptional) => {\n        const checkVal = validatorFns[type];\n        if (typeof checkVal !== 'function')\n            throw new Error('invalid validator function');\n        const val = object[fieldName];\n        if (isOptional && val === undefined)\n            return;\n        if (!checkVal(val, object)) {\n            throw new Error('param ' + String(fieldName) + ' is invalid. Expected ' + type + ', got ' + val);\n        }\n    };\n    for (const [fieldName, type] of Object.entries(validators))\n        checkField(fieldName, type, false);\n    for (const [fieldName, type] of Object.entries(optValidators))\n        checkField(fieldName, type, true);\n    return object;\n}\n// validate type tests\n// const o: { a: number; b: number; c: number } = { a: 1, b: 5, c: 6 };\n// const z0 = validateObject(o, { a: 'isSafeInteger' }, { c: 'bigint' }); // Ok!\n// // Should fail type-check\n// const z1 = validateObject(o, { a: 'tmp' }, { c: 'zz' });\n// const z2 = validateObject(o, { a: 'isSafeInteger' }, { c: 'zz' });\n// const z3 = validateObject(o, { test: 'boolean', z: 'bug' });\n// const z4 = validateObject(o, { a: 'boolean', z: 'bug' });\nexport function isHash(val) {\n    return typeof val === 'function' && Number.isSafeInteger(val.outputLen);\n}\nexport function _validateObject(object, fields, optFields = {}) {\n    if (!object || typeof object !== 'object')\n        throw new Error('expected valid options object');\n    function checkField(fieldName, expectedType, isOpt) {\n        const val = object[fieldName];\n        if (isOpt && val === undefined)\n            return;\n        const current = typeof val;\n        if (current !== expectedType || val === null)\n            throw new Error(`param \"${fieldName}\" is invalid: expected ${expectedType}, got ${current}`);\n    }\n    Object.entries(fields).forEach(([k, v]) => checkField(k, v, false));\n    Object.entries(optFields).forEach(([k, v]) => checkField(k, v, true));\n}\n/**\n * throws not implemented error\n */\nexport const notImplemented = () => {\n    throw new Error('not implemented');\n};\n/**\n * Memoizes (caches) computation result.\n * Uses WeakMap: the value is going auto-cleaned by GC after last reference is removed.\n */\nexport function memoized(fn) {\n    const map = new WeakMap();\n    return (arg, ...args) => {\n        const val = map.get(arg);\n        if (val !== undefined)\n            return val;\n        const computed = fn(arg, ...args);\n        map.set(arg, computed);\n        return computed;\n    };\n}\n//# sourceMappingURL=utils.js.map","/**\n * Utils for modular division and fields.\n * Field over 11 is a finite (Galois) field is integer number operations `mod 11`.\n * There is no division: it is replaced by modular multiplicative inverse.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { _validateObject, anumber, bitMask, bytesToNumberBE, bytesToNumberLE, ensureBytes, numberToBytesBE, numberToBytesLE, } from \"../utils.js\";\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _3n = /* @__PURE__ */ BigInt(3);\n// prettier-ignore\nconst _4n = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5), _7n = /* @__PURE__ */ BigInt(7);\n// prettier-ignore\nconst _8n = /* @__PURE__ */ BigInt(8), _9n = /* @__PURE__ */ BigInt(9), _16n = /* @__PURE__ */ BigInt(16);\n// Calculates a modulo b\nexport function mod(a, b) {\n    const result = a % b;\n    return result >= _0n ? result : b + result;\n}\n/**\n * Efficiently raise num to power and do modular division.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * @example\n * pow(2n, 6n, 11n) // 64n % 11n == 9n\n */\nexport function pow(num, power, modulo) {\n    return FpPow(Field(modulo), num, power);\n}\n/** Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)` */\nexport function pow2(x, power, modulo) {\n    let res = x;\n    while (power-- > _0n) {\n        res *= res;\n        res %= modulo;\n    }\n    return res;\n}\n/**\n * Inverses number over modulo.\n * Implemented using [Euclidean GCD](https://brilliant.org/wiki/extended-euclidean-algorithm/).\n */\nexport function invert(number, modulo) {\n    if (number === _0n)\n        throw new Error('invert: expected non-zero number');\n    if (modulo <= _0n)\n        throw new Error('invert: expected positive modulus, got ' + modulo);\n    // Fermat's little theorem \"CT-like\" version inv(n) = n^(m-2) mod m is 30x slower.\n    let a = mod(number, modulo);\n    let b = modulo;\n    // prettier-ignore\n    let x = _0n, y = _1n, u = _1n, v = _0n;\n    while (a !== _0n) {\n        // JIT applies optimization if those two lines follow each other\n        const q = b / a;\n        const r = b % a;\n        const m = x - u * q;\n        const n = y - v * q;\n        // prettier-ignore\n        b = a, a = r, x = u, y = v, u = m, v = n;\n    }\n    const gcd = b;\n    if (gcd !== _1n)\n        throw new Error('invert: does not exist');\n    return mod(x, modulo);\n}\nfunction assertIsSquare(Fp, root, n) {\n    if (!Fp.eql(Fp.sqr(root), n))\n        throw new Error('Cannot find square root');\n}\n// Not all roots are possible! Example which will throw:\n// const NUM =\n// n = 72057594037927816n;\n// Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'));\nfunction sqrt3mod4(Fp, n) {\n    const p1div4 = (Fp.ORDER + _1n) / _4n;\n    const root = Fp.pow(n, p1div4);\n    assertIsSquare(Fp, root, n);\n    return root;\n}\nfunction sqrt5mod8(Fp, n) {\n    const p5div8 = (Fp.ORDER - _5n) / _8n;\n    const n2 = Fp.mul(n, _2n);\n    const v = Fp.pow(n2, p5div8);\n    const nv = Fp.mul(n, v);\n    const i = Fp.mul(Fp.mul(nv, _2n), v);\n    const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));\n    assertIsSquare(Fp, root, n);\n    return root;\n}\n// Based on RFC9380, Kong algorithm\n// prettier-ignore\nfunction sqrt9mod16(P) {\n    const Fp_ = Field(P);\n    const tn = tonelliShanks(P);\n    const c1 = tn(Fp_, Fp_.neg(Fp_.ONE)); //  1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F\n    const c2 = tn(Fp_, c1); //  2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F\n    const c3 = tn(Fp_, Fp_.neg(c1)); //  3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F\n    const c4 = (P + _7n) / _16n; //  4. c4 = (q + 7) / 16        # Integer arithmetic\n    return (Fp, n) => {\n        let tv1 = Fp.pow(n, c4); //  1. tv1 = x^c4\n        let tv2 = Fp.mul(tv1, c1); //  2. tv2 = c1 * tv1\n        const tv3 = Fp.mul(tv1, c2); //  3. tv3 = c2 * tv1\n        const tv4 = Fp.mul(tv1, c3); //  4. tv4 = c3 * tv1\n        const e1 = Fp.eql(Fp.sqr(tv2), n); //  5.  e1 = (tv2^2) == x\n        const e2 = Fp.eql(Fp.sqr(tv3), n); //  6.  e2 = (tv3^2) == x\n        tv1 = Fp.cmov(tv1, tv2, e1); //  7. tv1 = CMOV(tv1, tv2, e1)  # Select tv2 if (tv2^2) == x\n        tv2 = Fp.cmov(tv4, tv3, e2); //  8. tv2 = CMOV(tv4, tv3, e2)  # Select tv3 if (tv3^2) == x\n        const e3 = Fp.eql(Fp.sqr(tv2), n); //  9.  e3 = (tv2^2) == x\n        const root = Fp.cmov(tv1, tv2, e3); // 10.  z = CMOV(tv1, tv2, e3)   # Select sqrt from tv1 & tv2\n        assertIsSquare(Fp, root, n);\n        return root;\n    };\n}\n/**\n * Tonelli-Shanks square root search algorithm.\n * 1. https://eprint.iacr.org/2012/685.pdf (page 12)\n * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks\n * @param P field order\n * @returns function that takes field Fp (created from P) and number n\n */\nexport function tonelliShanks(P) {\n    // Initialization (precomputation).\n    // Caching initialization could boost perf by 7%.\n    if (P < _3n)\n        throw new Error('sqrt is not defined for small field');\n    // Factor P - 1 = Q * 2^S, where Q is odd\n    let Q = P - _1n;\n    let S = 0;\n    while (Q % _2n === _0n) {\n        Q /= _2n;\n        S++;\n    }\n    // Find the first quadratic non-residue Z >= 2\n    let Z = _2n;\n    const _Fp = Field(P);\n    while (FpLegendre(_Fp, Z) === 1) {\n        // Basic primality test for P. After x iterations, chance of\n        // not finding quadratic non-residue is 2^x, so 2^1000.\n        if (Z++ > 1000)\n            throw new Error('Cannot find square root: probably non-prime P');\n    }\n    // Fast-path; usually done before Z, but we do \"primality test\".\n    if (S === 1)\n        return sqrt3mod4;\n    // Slow-path\n    // TODO: test on Fp2 and others\n    let cc = _Fp.pow(Z, Q); // c = z^Q\n    const Q1div2 = (Q + _1n) / _2n;\n    return function tonelliSlow(Fp, n) {\n        if (Fp.is0(n))\n            return n;\n        // Check if n is a quadratic residue using Legendre symbol\n        if (FpLegendre(Fp, n) !== 1)\n            throw new Error('Cannot find square root');\n        // Initialize variables for the main loop\n        let M = S;\n        let c = Fp.mul(Fp.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp\n        let t = Fp.pow(n, Q); // t = n^Q, first guess at the fudge factor\n        let R = Fp.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root\n        // Main loop\n        // while t != 1\n        while (!Fp.eql(t, Fp.ONE)) {\n            if (Fp.is0(t))\n                return Fp.ZERO; // if t=0 return R=0\n            let i = 1;\n            // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P)\n            let t_tmp = Fp.sqr(t); // t^(2^1)\n            while (!Fp.eql(t_tmp, Fp.ONE)) {\n                i++;\n                t_tmp = Fp.sqr(t_tmp); // t^(2^2)...\n                if (i === M)\n                    throw new Error('Cannot find square root');\n            }\n            // Calculate the exponent for b: 2^(M - i - 1)\n            const exponent = _1n << BigInt(M - i - 1); // bigint is important\n            const b = Fp.pow(c, exponent); // b = 2^(M - i - 1)\n            // Update variables\n            M = i;\n            c = Fp.sqr(b); // c = b^2\n            t = Fp.mul(t, c); // t = (t * b^2)\n            R = Fp.mul(R, b); // R = R*b\n        }\n        return R;\n    };\n}\n/**\n * Square root for a finite field. Will try optimized versions first:\n *\n * 1. P ≡ 3 (mod 4)\n * 2. P ≡ 5 (mod 8)\n * 3. P ≡ 9 (mod 16)\n * 4. Tonelli-Shanks algorithm\n *\n * Different algorithms can give different roots, it is up to user to decide which one they want.\n * For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).\n */\nexport function FpSqrt(P) {\n    // P ≡ 3 (mod 4) => √n = n^((P+1)/4)\n    if (P % _4n === _3n)\n        return sqrt3mod4;\n    // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf\n    if (P % _8n === _5n)\n        return sqrt5mod8;\n    // P ≡ 9 (mod 16) => Kong algorithm, page 11 of https://eprint.iacr.org/2012/685.pdf (algorithm 4)\n    if (P % _16n === _9n)\n        return sqrt9mod16(P);\n    // Tonelli-Shanks algorithm\n    return tonelliShanks(P);\n}\n// Little-endian check for first LE bit (last BE bit);\nexport const isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n) === _1n;\n// prettier-ignore\nconst FIELD_FIELDS = [\n    'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',\n    'eql', 'add', 'sub', 'mul', 'pow', 'div',\n    'addN', 'subN', 'mulN', 'sqrN'\n];\nexport function validateField(field) {\n    const initial = {\n        ORDER: 'bigint',\n        MASK: 'bigint',\n        BYTES: 'number',\n        BITS: 'number',\n    };\n    const opts = FIELD_FIELDS.reduce((map, val) => {\n        map[val] = 'function';\n        return map;\n    }, initial);\n    _validateObject(field, opts);\n    // const max = 16384;\n    // if (field.BYTES < 1 || field.BYTES > max) throw new Error('invalid field');\n    // if (field.BITS < 1 || field.BITS > 8 * max) throw new Error('invalid field');\n    return field;\n}\n// Generic field functions\n/**\n * Same as `pow` but for Fp: non-constant-time.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n */\nexport function FpPow(Fp, num, power) {\n    if (power < _0n)\n        throw new Error('invalid exponent, negatives unsupported');\n    if (power === _0n)\n        return Fp.ONE;\n    if (power === _1n)\n        return num;\n    let p = Fp.ONE;\n    let d = num;\n    while (power > _0n) {\n        if (power & _1n)\n            p = Fp.mul(p, d);\n        d = Fp.sqr(d);\n        power >>= _1n;\n    }\n    return p;\n}\n/**\n * Efficiently invert an array of Field elements.\n * Exception-free. Will return `undefined` for 0 elements.\n * @param passZero map 0 to 0 (instead of undefined)\n */\nexport function FpInvertBatch(Fp, nums, passZero = false) {\n    const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : undefined);\n    // Walk from first to last, multiply them by each other MOD p\n    const multipliedAcc = nums.reduce((acc, num, i) => {\n        if (Fp.is0(num))\n            return acc;\n        inverted[i] = acc;\n        return Fp.mul(acc, num);\n    }, Fp.ONE);\n    // Invert last element\n    const invertedAcc = Fp.inv(multipliedAcc);\n    // Walk from last to first, multiply them by inverted each other MOD p\n    nums.reduceRight((acc, num, i) => {\n        if (Fp.is0(num))\n            return acc;\n        inverted[i] = Fp.mul(acc, inverted[i]);\n        return Fp.mul(acc, num);\n    }, invertedAcc);\n    return inverted;\n}\n// TODO: remove\nexport function FpDiv(Fp, lhs, rhs) {\n    return Fp.mul(lhs, typeof rhs === 'bigint' ? invert(rhs, Fp.ORDER) : Fp.inv(rhs));\n}\n/**\n * Legendre symbol.\n * Legendre constant is used to calculate Legendre symbol (a | p)\n * which denotes the value of a^((p-1)/2) (mod p).\n *\n * * (a | p) ≡ 1    if a is a square (mod p), quadratic residue\n * * (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue\n * * (a | p) ≡ 0    if a ≡ 0 (mod p)\n */\nexport function FpLegendre(Fp, n) {\n    // We can use 3rd argument as optional cache of this value\n    // but seems unneeded for now. The operation is very fast.\n    const p1mod2 = (Fp.ORDER - _1n) / _2n;\n    const powered = Fp.pow(n, p1mod2);\n    const yes = Fp.eql(powered, Fp.ONE);\n    const zero = Fp.eql(powered, Fp.ZERO);\n    const no = Fp.eql(powered, Fp.neg(Fp.ONE));\n    if (!yes && !zero && !no)\n        throw new Error('invalid Legendre symbol result');\n    return yes ? 1 : zero ? 0 : -1;\n}\n// This function returns True whenever the value x is a square in the field F.\nexport function FpIsSquare(Fp, n) {\n    const l = FpLegendre(Fp, n);\n    return l === 1;\n}\n// CURVE.n lengths\nexport function nLength(n, nBitLength) {\n    // Bit size, byte size of CURVE.n\n    if (nBitLength !== undefined)\n        anumber(nBitLength);\n    const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length;\n    const nByteLength = Math.ceil(_nBitLength / 8);\n    return { nBitLength: _nBitLength, nByteLength };\n}\n/**\n * Creates a finite field. Major performance optimizations:\n * * 1. Denormalized operations like mulN instead of mul.\n * * 2. Identical object shape: never add or remove keys.\n * * 3. `Object.freeze`.\n * Fragile: always run a benchmark on a change.\n * Security note: operations don't check 'isValid' for all elements for performance reasons,\n * it is caller responsibility to check this.\n * This is low-level code, please make sure you know what you're doing.\n *\n * Note about field properties:\n * * CHARACTERISTIC p = prime number, number of elements in main subgroup.\n * * ORDER q = similar to cofactor in curves, may be composite `q = p^m`.\n *\n * @param ORDER field order, probably prime, or could be composite\n * @param bitLen how many bits the field consumes\n * @param isLE (default: false) if encoding / decoding should be in little-endian\n * @param redef optional faster redefinitions of sqrt and other methods\n */\nexport function Field(ORDER, bitLenOrOpts, // TODO: use opts only in v2?\nisLE = false, opts = {}) {\n    if (ORDER <= _0n)\n        throw new Error('invalid field: expected ORDER > 0, got ' + ORDER);\n    let _nbitLength = undefined;\n    let _sqrt = undefined;\n    let modFromBytes = false;\n    let allowedLengths = undefined;\n    if (typeof bitLenOrOpts === 'object' && bitLenOrOpts != null) {\n        if (opts.sqrt || isLE)\n            throw new Error('cannot specify opts in two arguments');\n        const _opts = bitLenOrOpts;\n        if (_opts.BITS)\n            _nbitLength = _opts.BITS;\n        if (_opts.sqrt)\n            _sqrt = _opts.sqrt;\n        if (typeof _opts.isLE === 'boolean')\n            isLE = _opts.isLE;\n        if (typeof _opts.modFromBytes === 'boolean')\n            modFromBytes = _opts.modFromBytes;\n        allowedLengths = _opts.allowedLengths;\n    }\n    else {\n        if (typeof bitLenOrOpts === 'number')\n            _nbitLength = bitLenOrOpts;\n        if (opts.sqrt)\n            _sqrt = opts.sqrt;\n    }\n    const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, _nbitLength);\n    if (BYTES > 2048)\n        throw new Error('invalid field: expected ORDER of <= 2048 bytes');\n    let sqrtP; // cached sqrtP\n    const f = Object.freeze({\n        ORDER,\n        isLE,\n        BITS,\n        BYTES,\n        MASK: bitMask(BITS),\n        ZERO: _0n,\n        ONE: _1n,\n        allowedLengths: allowedLengths,\n        create: (num) => mod(num, ORDER),\n        isValid: (num) => {\n            if (typeof num !== 'bigint')\n                throw new Error('invalid field element: expected bigint, got ' + typeof num);\n            return _0n <= num && num < ORDER; // 0 is valid element, but it's not invertible\n        },\n        is0: (num) => num === _0n,\n        // is valid and invertible\n        isValidNot0: (num) => !f.is0(num) && f.isValid(num),\n        isOdd: (num) => (num & _1n) === _1n,\n        neg: (num) => mod(-num, ORDER),\n        eql: (lhs, rhs) => lhs === rhs,\n        sqr: (num) => mod(num * num, ORDER),\n        add: (lhs, rhs) => mod(lhs + rhs, ORDER),\n        sub: (lhs, rhs) => mod(lhs - rhs, ORDER),\n        mul: (lhs, rhs) => mod(lhs * rhs, ORDER),\n        pow: (num, power) => FpPow(f, num, power),\n        div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),\n        // Same as above, but doesn't normalize\n        sqrN: (num) => num * num,\n        addN: (lhs, rhs) => lhs + rhs,\n        subN: (lhs, rhs) => lhs - rhs,\n        mulN: (lhs, rhs) => lhs * rhs,\n        inv: (num) => invert(num, ORDER),\n        sqrt: _sqrt ||\n            ((n) => {\n                if (!sqrtP)\n                    sqrtP = FpSqrt(ORDER);\n                return sqrtP(f, n);\n            }),\n        toBytes: (num) => (isLE ? numberToBytesLE(num, BYTES) : numberToBytesBE(num, BYTES)),\n        fromBytes: (bytes, skipValidation = true) => {\n            if (allowedLengths) {\n                if (!allowedLengths.includes(bytes.length) || bytes.length > BYTES) {\n                    throw new Error('Field.fromBytes: expected ' + allowedLengths + ' bytes, got ' + bytes.length);\n                }\n                const padded = new Uint8Array(BYTES);\n                // isLE add 0 to right, !isLE to the left.\n                padded.set(bytes, isLE ? 0 : padded.length - bytes.length);\n                bytes = padded;\n            }\n            if (bytes.length !== BYTES)\n                throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);\n            let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n            if (modFromBytes)\n                scalar = mod(scalar, ORDER);\n            if (!skipValidation)\n                if (!f.isValid(scalar))\n                    throw new Error('invalid field element: outside of range 0..ORDER');\n            // NOTE: we don't validate scalar here, please use isValid. This done such way because some\n            // protocol may allow non-reduced scalar that reduced later or changed some other way.\n            return scalar;\n        },\n        // TODO: we don't need it here, move out to separate fn\n        invertBatch: (lst) => FpInvertBatch(f, lst),\n        // We can't move this out because Fp6, Fp12 implement it\n        // and it's unclear what to return in there.\n        cmov: (a, b, c) => (c ? b : a),\n    });\n    return Object.freeze(f);\n}\n// Generic random scalar, we can do same for other fields if via Fp2.mul(Fp2.ONE, Fp2.random)?\n// This allows unsafe methods like ignore bias or zero. These unsafe, but often used in different protocols (if deterministic RNG).\n// which mean we cannot force this via opts.\n// Not sure what to do with randomBytes, we can accept it inside opts if wanted.\n// Probably need to export getMinHashLength somewhere?\n// random(bytes?: Uint8Array, unsafeAllowZero = false, unsafeAllowBias = false) {\n//   const LEN = !unsafeAllowBias ? getMinHashLength(ORDER) : BYTES;\n//   if (bytes === undefined) bytes = randomBytes(LEN); // _opts.randomBytes?\n//   const num = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n//   // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n//   const reduced = unsafeAllowZero ? mod(num, ORDER) : mod(num, ORDER - _1n) + _1n;\n//   return reduced;\n// },\nexport function FpSqrtOdd(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? root : Fp.neg(root);\n}\nexport function FpSqrtEven(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? Fp.neg(root) : root;\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Same as mapKeyToField, but accepts less bytes (40 instead of 48 for 32-byte field).\n * Which makes it slightly more biased, less secure.\n * @deprecated use `mapKeyToField` instead\n */\nexport function hashToPrivateScalar(hash, groupOrder, isLE = false) {\n    hash = ensureBytes('privateHash', hash);\n    const hashLen = hash.length;\n    const minLen = nLength(groupOrder).nByteLength + 8;\n    if (minLen < 24 || hashLen < minLen || hashLen > 1024)\n        throw new Error('hashToPrivateScalar: expected ' + minLen + '-1024 bytes of input, got ' + hashLen);\n    const num = isLE ? bytesToNumberLE(hash) : bytesToNumberBE(hash);\n    return mod(num, groupOrder - _1n) + _1n;\n}\n/**\n * Returns total number of bytes consumed by the field element.\n * For example, 32 bytes for usual 256-bit weierstrass curve.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of field\n */\nexport function getFieldBytesLength(fieldOrder) {\n    if (typeof fieldOrder !== 'bigint')\n        throw new Error('field order must be bigint');\n    const bitLength = fieldOrder.toString(2).length;\n    return Math.ceil(bitLength / 8);\n}\n/**\n * Returns minimal amount of bytes that can be safely reduced\n * by field order.\n * Should be 2^-128 for 128-bit curve such as P256.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of target hash\n */\nexport function getMinHashLength(fieldOrder) {\n    const length = getFieldBytesLength(fieldOrder);\n    return length + Math.ceil(length / 2);\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF\n * and convert them into private scalar, with the modulo bias being negligible.\n * Needs at least 48 bytes of input for 32-byte private key.\n * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/\n * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final\n * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5\n * @param hash hash output from SHA3 or a similar function\n * @param groupOrder size of subgroup - (e.g. secp256k1.CURVE.n)\n * @param isLE interpret hash bytes as LE num\n * @returns valid private scalar\n */\nexport function mapHashToField(key, fieldOrder, isLE = false) {\n    const len = key.length;\n    const fieldLen = getFieldBytesLength(fieldOrder);\n    const minLen = getMinHashLength(fieldOrder);\n    // No small numbers: need to understand bias story. No huge numbers: easier to detect JS timings.\n    if (len < 16 || len < minLen || len > 1024)\n        throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);\n    const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);\n    // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n    const reduced = mod(num, fieldOrder - _1n) + _1n;\n    return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);\n}\n//# sourceMappingURL=modular.js.map","/**\n * Methods for elliptic curve multiplication by scalars.\n * Contains wNAF, pippenger.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { bitLen, bitMask, validateObject } from \"../utils.js\";\nimport { Field, FpInvertBatch, nLength, validateField } from \"./modular.js\";\nconst _0n = BigInt(0);\nconst _1n = BigInt(1);\nexport function negateCt(condition, item) {\n    const neg = item.negate();\n    return condition ? neg : item;\n}\n/**\n * Takes a bunch of Projective Points but executes only one\n * inversion on all of them. Inversion is very slow operation,\n * so this improves performance massively.\n * Optimization: converts a list of projective points to a list of identical points with Z=1.\n */\nexport function normalizeZ(c, points) {\n    const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));\n    return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));\n}\nfunction validateW(W, bits) {\n    if (!Number.isSafeInteger(W) || W <= 0 || W > bits)\n        throw new Error('invalid window size, expected [1..' + bits + '], got W=' + W);\n}\nfunction calcWOpts(W, scalarBits) {\n    validateW(W, scalarBits);\n    const windows = Math.ceil(scalarBits / W) + 1; // W=8 33. Not 32, because we skip zero\n    const windowSize = 2 ** (W - 1); // W=8 128. Not 256, because we skip zero\n    const maxNumber = 2 ** W; // W=8 256\n    const mask = bitMask(W); // W=8 255 == mask 0b11111111\n    const shiftBy = BigInt(W); // W=8 8\n    return { windows, windowSize, mask, maxNumber, shiftBy };\n}\nfunction calcOffsets(n, window, wOpts) {\n    const { windowSize, mask, maxNumber, shiftBy } = wOpts;\n    let wbits = Number(n & mask); // extract W bits.\n    let nextN = n >> shiftBy; // shift number by W bits.\n    // What actually happens here:\n    // const highestBit = Number(mask ^ (mask >> 1n));\n    // let wbits2 = wbits - 1; // skip zero\n    // if (wbits2 & highestBit) { wbits2 ^= Number(mask); // (~);\n    // split if bits > max: +224 => 256-32\n    if (wbits > windowSize) {\n        // we skip zero, which means instead of `>= size-1`, we do `> size`\n        wbits -= maxNumber; // -32, can be maxNumber - wbits, but then we need to set isNeg here.\n        nextN += _1n; // +256 (carry)\n    }\n    const offsetStart = window * windowSize;\n    const offset = offsetStart + Math.abs(wbits) - 1; // -1 because we skip zero\n    const isZero = wbits === 0; // is current window slice a 0?\n    const isNeg = wbits < 0; // is current window slice negative?\n    const isNegF = window % 2 !== 0; // fake random statement for noise\n    const offsetF = offsetStart; // fake offset for noise\n    return { nextN, offset, isZero, isNeg, isNegF, offsetF };\n}\nfunction validateMSMPoints(points, c) {\n    if (!Array.isArray(points))\n        throw new Error('array expected');\n    points.forEach((p, i) => {\n        if (!(p instanceof c))\n            throw new Error('invalid point at index ' + i);\n    });\n}\nfunction validateMSMScalars(scalars, field) {\n    if (!Array.isArray(scalars))\n        throw new Error('array of scalars expected');\n    scalars.forEach((s, i) => {\n        if (!field.isValid(s))\n            throw new Error('invalid scalar at index ' + i);\n    });\n}\n// Since points in different groups cannot be equal (different object constructor),\n// we can have single place to store precomputes.\n// Allows to make points frozen / immutable.\nconst pointPrecomputes = new WeakMap();\nconst pointWindowSizes = new WeakMap();\nfunction getW(P) {\n    // To disable precomputes:\n    // return 1;\n    return pointWindowSizes.get(P) || 1;\n}\nfunction assert0(n) {\n    if (n !== _0n)\n        throw new Error('invalid wNAF');\n}\n/**\n * Elliptic curve multiplication of Point by scalar. Fragile.\n * Table generation takes **30MB of ram and 10ms on high-end CPU**,\n * but may take much longer on slow devices. Actual generation will happen on\n * first call of `multiply()`. By default, `BASE` point is precomputed.\n *\n * Scalars should always be less than curve order: this should be checked inside of a curve itself.\n * Creates precomputation tables for fast multiplication:\n * - private scalar is split by fixed size windows of W bits\n * - every window point is collected from window's table & added to accumulator\n * - since windows are different, same point inside tables won't be accessed more than once per calc\n * - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)\n * - +1 window is neccessary for wNAF\n * - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication\n *\n * @todo Research returning 2d JS array of windows, instead of a single window.\n * This would allow windows to be in different memory locations\n */\nexport class wNAF {\n    // Parametrized with a given Point class (not individual point)\n    constructor(Point, bits) {\n        this.BASE = Point.BASE;\n        this.ZERO = Point.ZERO;\n        this.Fn = Point.Fn;\n        this.bits = bits;\n    }\n    // non-const time multiplication ladder\n    _unsafeLadder(elm, n, p = this.ZERO) {\n        let d = elm;\n        while (n > _0n) {\n            if (n & _1n)\n                p = p.add(d);\n            d = d.double();\n            n >>= _1n;\n        }\n        return p;\n    }\n    /**\n     * Creates a wNAF precomputation window. Used for caching.\n     * Default window size is set by `utils.precompute()` and is equal to 8.\n     * Number of precomputed points depends on the curve size:\n     * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:\n     * - 𝑊 is the window size\n     * - 𝑛 is the bitlength of the curve order.\n     * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.\n     * @param point Point instance\n     * @param W window size\n     * @returns precomputed point tables flattened to a single array\n     */\n    precomputeWindow(point, W) {\n        const { windows, windowSize } = calcWOpts(W, this.bits);\n        const points = [];\n        let p = point;\n        let base = p;\n        for (let window = 0; window < windows; window++) {\n            base = p;\n            points.push(base);\n            // i=1, bc we skip 0\n            for (let i = 1; i < windowSize; i++) {\n                base = base.add(p);\n                points.push(base);\n            }\n            p = base.double();\n        }\n        return points;\n    }\n    /**\n     * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.\n     * More compact implementation:\n     * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541\n     * @returns real and fake (for const-time) points\n     */\n    wNAF(W, precomputes, n) {\n        // Scalar should be smaller than field order\n        if (!this.Fn.isValid(n))\n            throw new Error('invalid scalar');\n        // Accumulators\n        let p = this.ZERO;\n        let f = this.BASE;\n        // This code was first written with assumption that 'f' and 'p' will never be infinity point:\n        // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,\n        // there is negate now: it is possible that negated element from low value\n        // would be the same as high element, which will create carry into next window.\n        // It's not obvious how this can fail, but still worth investigating later.\n        const wo = calcWOpts(W, this.bits);\n        for (let window = 0; window < wo.windows; window++) {\n            // (n === _0n) is handled and not early-exited. isEven and offsetF are used for noise\n            const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);\n            n = nextN;\n            if (isZero) {\n                // bits are 0: add garbage to fake point\n                // Important part for const-time getPublicKey: add random \"noise\" point to f.\n                f = f.add(negateCt(isNegF, precomputes[offsetF]));\n            }\n            else {\n                // bits are 1: add to result point\n                p = p.add(negateCt(isNeg, precomputes[offset]));\n            }\n        }\n        assert0(n);\n        // Return both real and fake points: JIT won't eliminate f.\n        // At this point there is a way to F be infinity-point even if p is not,\n        // which makes it less const-time: around 1 bigint multiply.\n        return { p, f };\n    }\n    /**\n     * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.\n     * @param acc accumulator point to add result of multiplication\n     * @returns point\n     */\n    wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {\n        const wo = calcWOpts(W, this.bits);\n        for (let window = 0; window < wo.windows; window++) {\n            if (n === _0n)\n                break; // Early-exit, skip 0 value\n            const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);\n            n = nextN;\n            if (isZero) {\n                // Window bits are 0: skip processing.\n                // Move to next window.\n                continue;\n            }\n            else {\n                const item = precomputes[offset];\n                acc = acc.add(isNeg ? item.negate() : item); // Re-using acc allows to save adds in MSM\n            }\n        }\n        assert0(n);\n        return acc;\n    }\n    getPrecomputes(W, point, transform) {\n        // Calculate precomputes on a first run, reuse them after\n        let comp = pointPrecomputes.get(point);\n        if (!comp) {\n            comp = this.precomputeWindow(point, W);\n            if (W !== 1) {\n                // Doing transform outside of if brings 15% perf hit\n                if (typeof transform === 'function')\n                    comp = transform(comp);\n                pointPrecomputes.set(point, comp);\n            }\n        }\n        return comp;\n    }\n    cached(point, scalar, transform) {\n        const W = getW(point);\n        return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);\n    }\n    unsafe(point, scalar, transform, prev) {\n        const W = getW(point);\n        if (W === 1)\n            return this._unsafeLadder(point, scalar, prev); // For W=1 ladder is ~x2 faster\n        return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);\n    }\n    // We calculate precomputes for elliptic curve point multiplication\n    // using windowed method. This specifies window size and\n    // stores precomputed values. Usually only base point would be precomputed.\n    createCache(P, W) {\n        validateW(W, this.bits);\n        pointWindowSizes.set(P, W);\n        pointPrecomputes.delete(P);\n    }\n    hasCache(elm) {\n        return getW(elm) !== 1;\n    }\n}\n/**\n * Endomorphism-specific multiplication for Koblitz curves.\n * Cost: 128 dbl, 0-256 adds.\n */\nexport function mulEndoUnsafe(Point, point, k1, k2) {\n    let acc = point;\n    let p1 = Point.ZERO;\n    let p2 = Point.ZERO;\n    while (k1 > _0n || k2 > _0n) {\n        if (k1 & _1n)\n            p1 = p1.add(acc);\n        if (k2 & _1n)\n            p2 = p2.add(acc);\n        acc = acc.double();\n        k1 >>= _1n;\n        k2 >>= _1n;\n    }\n    return { p1, p2 };\n}\n/**\n * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * 30x faster vs naive addition on L=4096, 10x faster than precomputes.\n * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.\n * Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.\n * @param c Curve Point constructor\n * @param fieldN field over CURVE.N - important that it's not over CURVE.P\n * @param points array of L curve points\n * @param scalars array of L scalars (aka secret keys / bigints)\n */\nexport function pippenger(c, fieldN, points, scalars) {\n    // If we split scalars by some window (let's say 8 bits), every chunk will only\n    // take 256 buckets even if there are 4096 scalars, also re-uses double.\n    // TODO:\n    // - https://eprint.iacr.org/2024/750.pdf\n    // - https://tches.iacr.org/index.php/TCHES/article/view/10287\n    // 0 is accepted in scalars\n    validateMSMPoints(points, c);\n    validateMSMScalars(scalars, fieldN);\n    const plength = points.length;\n    const slength = scalars.length;\n    if (plength !== slength)\n        throw new Error('arrays of points and scalars must have equal length');\n    // if (plength === 0) throw new Error('array must be of length >= 2');\n    const zero = c.ZERO;\n    const wbits = bitLen(BigInt(plength));\n    let windowSize = 1; // bits\n    if (wbits > 12)\n        windowSize = wbits - 3;\n    else if (wbits > 4)\n        windowSize = wbits - 2;\n    else if (wbits > 0)\n        windowSize = 2;\n    const MASK = bitMask(windowSize);\n    const buckets = new Array(Number(MASK) + 1).fill(zero); // +1 for zero array\n    const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;\n    let sum = zero;\n    for (let i = lastBits; i >= 0; i -= windowSize) {\n        buckets.fill(zero);\n        for (let j = 0; j < slength; j++) {\n            const scalar = scalars[j];\n            const wbits = Number((scalar >> BigInt(i)) & MASK);\n            buckets[wbits] = buckets[wbits].add(points[j]);\n        }\n        let resI = zero; // not using this will do small speed-up, but will lose ct\n        // Skip first bucket, because it is zero\n        for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {\n            sumI = sumI.add(buckets[j]);\n            resI = resI.add(sumI);\n        }\n        sum = sum.add(resI);\n        if (i !== 0)\n            for (let j = 0; j < windowSize; j++)\n                sum = sum.double();\n    }\n    return sum;\n}\n/**\n * Precomputed multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * @param c Curve Point constructor\n * @param fieldN field over CURVE.N - important that it's not over CURVE.P\n * @param points array of L curve points\n * @returns function which multiplies points with scaars\n */\nexport function precomputeMSMUnsafe(c, fieldN, points, windowSize) {\n    /**\n     * Performance Analysis of Window-based Precomputation\n     *\n     * Base Case (256-bit scalar, 8-bit window):\n     * - Standard precomputation requires:\n     *   - 31 additions per scalar × 256 scalars = 7,936 ops\n     *   - Plus 255 summary additions = 8,191 total ops\n     *   Note: Summary additions can be optimized via accumulator\n     *\n     * Chunked Precomputation Analysis:\n     * - Using 32 chunks requires:\n     *   - 255 additions per chunk\n     *   - 256 doublings\n     *   - Total: (255 × 32) + 256 = 8,416 ops\n     *\n     * Memory Usage Comparison:\n     * Window Size | Standard Points | Chunked Points\n     * ------------|-----------------|---------------\n     *     4-bit   |     520         |      15\n     *     8-bit   |    4,224        |     255\n     *    10-bit   |   13,824        |   1,023\n     *    16-bit   |  557,056        |  65,535\n     *\n     * Key Advantages:\n     * 1. Enables larger window sizes due to reduced memory overhead\n     * 2. More efficient for smaller scalar counts:\n     *    - 16 chunks: (16 × 255) + 256 = 4,336 ops\n     *    - ~2x faster than standard 8,191 ops\n     *\n     * Limitations:\n     * - Not suitable for plain precomputes (requires 256 constant doublings)\n     * - Performance degrades with larger scalar counts:\n     *   - Optimal for ~256 scalars\n     *   - Less efficient for 4096+ scalars (Pippenger preferred)\n     */\n    validateW(windowSize, fieldN.BITS);\n    validateMSMPoints(points, c);\n    const zero = c.ZERO;\n    const tableSize = 2 ** windowSize - 1; // table size (without zero)\n    const chunks = Math.ceil(fieldN.BITS / windowSize); // chunks of item\n    const MASK = bitMask(windowSize);\n    const tables = points.map((p) => {\n        const res = [];\n        for (let i = 0, acc = p; i < tableSize; i++) {\n            res.push(acc);\n            acc = acc.add(p);\n        }\n        return res;\n    });\n    return (scalars) => {\n        validateMSMScalars(scalars, fieldN);\n        if (scalars.length > points.length)\n            throw new Error('array of scalars must be smaller than array of points');\n        let res = zero;\n        for (let i = 0; i < chunks; i++) {\n            // No need to double if accumulator is still zero.\n            if (res !== zero)\n                for (let j = 0; j < windowSize; j++)\n                    res = res.double();\n            const shiftBy = BigInt(chunks * windowSize - (i + 1) * windowSize);\n            for (let j = 0; j < scalars.length; j++) {\n                const n = scalars[j];\n                const curr = Number((n >> shiftBy) & MASK);\n                if (!curr)\n                    continue; // skip zero scalars chunks\n                res = res.add(tables[j][curr - 1]);\n            }\n        }\n        return res;\n    };\n}\n// TODO: remove\n/** @deprecated */\nexport function validateBasic(curve) {\n    validateField(curve.Fp);\n    validateObject(curve, {\n        n: 'bigint',\n        h: 'bigint',\n        Gx: 'field',\n        Gy: 'field',\n    }, {\n        nBitLength: 'isSafeInteger',\n        nByteLength: 'isSafeInteger',\n    });\n    // Set defaults\n    return Object.freeze({\n        ...nLength(curve.n, curve.nBitLength),\n        ...curve,\n        ...{ p: curve.Fp.ORDER },\n    });\n}\nfunction createField(order, field, isLE) {\n    if (field) {\n        if (field.ORDER !== order)\n            throw new Error('Field.ORDER must match order: Fp == p, Fn == n');\n        validateField(field);\n        return field;\n    }\n    else {\n        return Field(order, { isLE });\n    }\n}\n/** Validates CURVE opts and creates fields */\nexport function _createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {\n    if (FpFnLE === undefined)\n        FpFnLE = type === 'edwards';\n    if (!CURVE || typeof CURVE !== 'object')\n        throw new Error(`expected valid ${type} CURVE object`);\n    for (const p of ['p', 'n', 'h']) {\n        const val = CURVE[p];\n        if (!(typeof val === 'bigint' && val > _0n))\n            throw new Error(`CURVE.${p} must be positive bigint`);\n    }\n    const Fp = createField(CURVE.p, curveOpts.Fp, FpFnLE);\n    const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);\n    const _b = type === 'weierstrass' ? 'b' : 'd';\n    const params = ['Gx', 'Gy', 'a', _b];\n    for (const p of params) {\n        // @ts-ignore\n        if (!Fp.isValid(CURVE[p]))\n            throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);\n    }\n    CURVE = Object.freeze(Object.assign({}, CURVE));\n    return { CURVE, Fp, Fn };\n}\n//# sourceMappingURL=curve.js.map","/**\n * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.\n *\n * ### Design rationale for types\n *\n * * Interaction between classes from different curves should fail:\n *   `k256.Point.BASE.add(p256.Point.BASE)`\n * * For this purpose we want to use `instanceof` operator, which is fast and works during runtime\n * * Different calls of `curve()` would return different classes -\n *   `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,\n *   it won't affect others\n *\n * TypeScript can't infer types for classes created inside a function. Classes is one instance\n * of nominative types in TypeScript and interfaces only check for shape, so it's hard to create\n * unique type for every function call.\n *\n * We can use generic types via some param, like curve opts, but that would:\n *     1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)\n *     which is hard to debug.\n *     2. Params can be generic and we can't enforce them to be constant value:\n *     if somebody creates curve from non-constant params,\n *     it would be allowed to interact with other curves with non-constant params\n *\n * @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { hmac as nobleHmac } from '@noble/hashes/hmac.js';\nimport { ahash } from '@noble/hashes/utils';\nimport { _validateObject, _abool2 as abool, _abytes2 as abytes, aInRange, bitLen, bitMask, bytesToHex, bytesToNumberBE, concatBytes, createHmacDrbg, ensureBytes, hexToBytes, inRange, isBytes, memoized, numberToHexUnpadded, randomBytes as randomBytesWeb, } from \"../utils.js\";\nimport { _createCurveFields, mulEndoUnsafe, negateCt, normalizeZ, pippenger, wNAF, } from \"./curve.js\";\nimport { Field, FpInvertBatch, getMinHashLength, mapHashToField, nLength, validateField, } from \"./modular.js\";\n// We construct basis in such way that den is always positive and equals n, but num sign depends on basis (not on secret value)\nconst divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n) / den;\n/**\n * Splits scalar for GLV endomorphism.\n */\nexport function _splitEndoScalar(k, basis, n) {\n    // Split scalar into two such that part is ~half bits: `abs(part) < sqrt(N)`\n    // Since part can be negative, we need to do this on point.\n    // TODO: verifyScalar function which consumes lambda\n    const [[a1, b1], [a2, b2]] = basis;\n    const c1 = divNearest(b2 * k, n);\n    const c2 = divNearest(-b1 * k, n);\n    // |k1|/|k2| is < sqrt(N), but can be negative.\n    // If we do `k1 mod N`, we'll get big scalar (`> sqrt(N)`): so, we do cheaper negation instead.\n    let k1 = k - c1 * a1 - c2 * a2;\n    let k2 = -c1 * b1 - c2 * b2;\n    const k1neg = k1 < _0n;\n    const k2neg = k2 < _0n;\n    if (k1neg)\n        k1 = -k1;\n    if (k2neg)\n        k2 = -k2;\n    // Double check that resulting scalar less than half bits of N: otherwise wNAF will fail.\n    // This should only happen on wrong basises. Also, math inside is too complex and I don't trust it.\n    const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n; // Half bits of N\n    if (k1 < _0n || k1 >= MAX_NUM || k2 < _0n || k2 >= MAX_NUM) {\n        throw new Error('splitScalar (endomorphism): failed, k=' + k);\n    }\n    return { k1neg, k1, k2neg, k2 };\n}\nfunction validateSigFormat(format) {\n    if (!['compact', 'recovered', 'der'].includes(format))\n        throw new Error('Signature format must be \"compact\", \"recovered\", or \"der\"');\n    return format;\n}\nfunction validateSigOpts(opts, def) {\n    const optsn = {};\n    for (let optName of Object.keys(def)) {\n        // @ts-ignore\n        optsn[optName] = opts[optName] === undefined ? def[optName] : opts[optName];\n    }\n    abool(optsn.lowS, 'lowS');\n    abool(optsn.prehash, 'prehash');\n    if (optsn.format !== undefined)\n        validateSigFormat(optsn.format);\n    return optsn;\n}\nexport class DERErr extends Error {\n    constructor(m = '') {\n        super(m);\n    }\n}\n/**\n * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:\n *\n *     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]\n *\n * Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html\n */\nexport const DER = {\n    // asn.1 DER encoding utils\n    Err: DERErr,\n    // Basic building block is TLV (Tag-Length-Value)\n    _tlv: {\n        encode: (tag, data) => {\n            const { Err: E } = DER;\n            if (tag < 0 || tag > 256)\n                throw new E('tlv.encode: wrong tag');\n            if (data.length & 1)\n                throw new E('tlv.encode: unpadded data');\n            const dataLen = data.length / 2;\n            const len = numberToHexUnpadded(dataLen);\n            if ((len.length / 2) & 128)\n                throw new E('tlv.encode: long form length too big');\n            // length of length with long form flag\n            const lenLen = dataLen > 127 ? numberToHexUnpadded((len.length / 2) | 128) : '';\n            const t = numberToHexUnpadded(tag);\n            return t + lenLen + len + data;\n        },\n        // v - value, l - left bytes (unparsed)\n        decode(tag, data) {\n            const { Err: E } = DER;\n            let pos = 0;\n            if (tag < 0 || tag > 256)\n                throw new E('tlv.encode: wrong tag');\n            if (data.length < 2 || data[pos++] !== tag)\n                throw new E('tlv.decode: wrong tlv');\n            const first = data[pos++];\n            const isLong = !!(first & 128); // First bit of first length byte is flag for short/long form\n            let length = 0;\n            if (!isLong)\n                length = first;\n            else {\n                // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]\n                const lenLen = first & 127;\n                if (!lenLen)\n                    throw new E('tlv.decode(long): indefinite length not supported');\n                if (lenLen > 4)\n                    throw new E('tlv.decode(long): byte length is too big'); // this will overflow u32 in js\n                const lengthBytes = data.subarray(pos, pos + lenLen);\n                if (lengthBytes.length !== lenLen)\n                    throw new E('tlv.decode: length bytes not complete');\n                if (lengthBytes[0] === 0)\n                    throw new E('tlv.decode(long): zero leftmost byte');\n                for (const b of lengthBytes)\n                    length = (length << 8) | b;\n                pos += lenLen;\n                if (length < 128)\n                    throw new E('tlv.decode(long): not minimal encoding');\n            }\n            const v = data.subarray(pos, pos + length);\n            if (v.length !== length)\n                throw new E('tlv.decode: wrong value length');\n            return { v, l: data.subarray(pos + length) };\n        },\n    },\n    // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,\n    // since we always use positive integers here. It must always be empty:\n    // - add zero byte if exists\n    // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)\n    _int: {\n        encode(num) {\n            const { Err: E } = DER;\n            if (num < _0n)\n                throw new E('integer: negative integers are not allowed');\n            let hex = numberToHexUnpadded(num);\n            // Pad with zero byte if negative flag is present\n            if (Number.parseInt(hex[0], 16) & 0b1000)\n                hex = '00' + hex;\n            if (hex.length & 1)\n                throw new E('unexpected DER parsing assertion: unpadded hex');\n            return hex;\n        },\n        decode(data) {\n            const { Err: E } = DER;\n            if (data[0] & 128)\n                throw new E('invalid signature integer: negative');\n            if (data[0] === 0x00 && !(data[1] & 128))\n                throw new E('invalid signature integer: unnecessary leading zero');\n            return bytesToNumberBE(data);\n        },\n    },\n    toSig(hex) {\n        // parse DER signature\n        const { Err: E, _int: int, _tlv: tlv } = DER;\n        const data = ensureBytes('signature', hex);\n        const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);\n        if (seqLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        const { v: rBytes, l: rLeftBytes } = tlv.decode(0x02, seqBytes);\n        const { v: sBytes, l: sLeftBytes } = tlv.decode(0x02, rLeftBytes);\n        if (sLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        return { r: int.decode(rBytes), s: int.decode(sBytes) };\n    },\n    hexFromSig(sig) {\n        const { _tlv: tlv, _int: int } = DER;\n        const rs = tlv.encode(0x02, int.encode(sig.r));\n        const ss = tlv.encode(0x02, int.encode(sig.s));\n        const seq = rs + ss;\n        return tlv.encode(0x30, seq);\n    },\n};\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);\nexport function _normFnElement(Fn, key) {\n    const { BYTES: expected } = Fn;\n    let num;\n    if (typeof key === 'bigint') {\n        num = key;\n    }\n    else {\n        let bytes = ensureBytes('private key', key);\n        try {\n            num = Fn.fromBytes(bytes);\n        }\n        catch (error) {\n            throw new Error(`invalid private key: expected ui8a of size ${expected}, got ${typeof key}`);\n        }\n    }\n    if (!Fn.isValidNot0(num))\n        throw new Error('invalid private key: out of range [1..N-1]');\n    return num;\n}\n/**\n * Creates weierstrass Point constructor, based on specified curve options.\n *\n * @example\n```js\nconst opts = {\n  p: BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff'),\n  n: BigInt('0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'),\n  h: BigInt(1),\n  a: BigInt('0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc'),\n  b: BigInt('0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b'),\n  Gx: BigInt('0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296'),\n  Gy: BigInt('0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5'),\n};\nconst p256_Point = weierstrass(opts);\n```\n */\nexport function weierstrassN(params, extraOpts = {}) {\n    const validated = _createCurveFields('weierstrass', params, extraOpts);\n    const { Fp, Fn } = validated;\n    let CURVE = validated.CURVE;\n    const { h: cofactor, n: CURVE_ORDER } = CURVE;\n    _validateObject(extraOpts, {}, {\n        allowInfinityPoint: 'boolean',\n        clearCofactor: 'function',\n        isTorsionFree: 'function',\n        fromBytes: 'function',\n        toBytes: 'function',\n        endo: 'object',\n        wrapPrivateKey: 'boolean',\n    });\n    const { endo } = extraOpts;\n    if (endo) {\n        // validateObject(endo, { beta: 'bigint', splitScalar: 'function' });\n        if (!Fp.is0(CURVE.a) || typeof endo.beta !== 'bigint' || !Array.isArray(endo.basises)) {\n            throw new Error('invalid endo: expected \"beta\": bigint and \"basises\": array');\n        }\n    }\n    const lengths = getWLengths(Fp, Fn);\n    function assertCompressionIsSupported() {\n        if (!Fp.isOdd)\n            throw new Error('compression is not supported: Field does not have .isOdd()');\n    }\n    // Implements IEEE P1363 point encoding\n    function pointToBytes(_c, point, isCompressed) {\n        const { x, y } = point.toAffine();\n        const bx = Fp.toBytes(x);\n        abool(isCompressed, 'isCompressed');\n        if (isCompressed) {\n            assertCompressionIsSupported();\n            const hasEvenY = !Fp.isOdd(y);\n            return concatBytes(pprefix(hasEvenY), bx);\n        }\n        else {\n            return concatBytes(Uint8Array.of(0x04), bx, Fp.toBytes(y));\n        }\n    }\n    function pointFromBytes(bytes) {\n        abytes(bytes, undefined, 'Point');\n        const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths; // e.g. for 32-byte: 33, 65\n        const length = bytes.length;\n        const head = bytes[0];\n        const tail = bytes.subarray(1);\n        // No actual validation is done here: use .assertValidity()\n        if (length === comp && (head === 0x02 || head === 0x03)) {\n            const x = Fp.fromBytes(tail);\n            if (!Fp.isValid(x))\n                throw new Error('bad point: is not on curve, wrong x');\n            const y2 = weierstrassEquation(x); // y² = x³ + ax + b\n            let y;\n            try {\n                y = Fp.sqrt(y2); // y = y² ^ (p+1)/4\n            }\n            catch (sqrtError) {\n                const err = sqrtError instanceof Error ? ': ' + sqrtError.message : '';\n                throw new Error('bad point: is not on curve, sqrt error' + err);\n            }\n            assertCompressionIsSupported();\n            const isYOdd = Fp.isOdd(y); // (y & _1n) === _1n;\n            const isHeadOdd = (head & 1) === 1; // ECDSA-specific\n            if (isHeadOdd !== isYOdd)\n                y = Fp.neg(y);\n            return { x, y };\n        }\n        else if (length === uncomp && head === 0x04) {\n            // TODO: more checks\n            const L = Fp.BYTES;\n            const x = Fp.fromBytes(tail.subarray(0, L));\n            const y = Fp.fromBytes(tail.subarray(L, L * 2));\n            if (!isValidXY(x, y))\n                throw new Error('bad point: is not on curve');\n            return { x, y };\n        }\n        else {\n            throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);\n        }\n    }\n    const encodePoint = extraOpts.toBytes || pointToBytes;\n    const decodePoint = extraOpts.fromBytes || pointFromBytes;\n    function weierstrassEquation(x) {\n        const x2 = Fp.sqr(x); // x * x\n        const x3 = Fp.mul(x2, x); // x² * x\n        return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b); // x³ + a * x + b\n    }\n    // TODO: move top-level\n    /** Checks whether equation holds for given x, y: y² == x³ + ax + b */\n    function isValidXY(x, y) {\n        const left = Fp.sqr(y); // y²\n        const right = weierstrassEquation(x); // x³ + ax + b\n        return Fp.eql(left, right);\n    }\n    // Validate whether the passed curve params are valid.\n    // Test 1: equation y² = x³ + ax + b should work for generator point.\n    if (!isValidXY(CURVE.Gx, CURVE.Gy))\n        throw new Error('bad curve params: generator point');\n    // Test 2: discriminant Δ part should be non-zero: 4a³ + 27b² != 0.\n    // Guarantees curve is genus-1, smooth (non-singular).\n    const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);\n    const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));\n    if (Fp.is0(Fp.add(_4a3, _27b2)))\n        throw new Error('bad curve params: a or b');\n    /** Asserts coordinate is valid: 0 <= n < Fp.ORDER. */\n    function acoord(title, n, banZero = false) {\n        if (!Fp.isValid(n) || (banZero && Fp.is0(n)))\n            throw new Error(`bad point coordinate ${title}`);\n        return n;\n    }\n    function aprjpoint(other) {\n        if (!(other instanceof Point))\n            throw new Error('ProjectivePoint expected');\n    }\n    function splitEndoScalarN(k) {\n        if (!endo || !endo.basises)\n            throw new Error('no endo');\n        return _splitEndoScalar(k, endo.basises, Fn.ORDER);\n    }\n    // Memoized toAffine / validity check. They are heavy. Points are immutable.\n    // Converts Projective point to affine (x, y) coordinates.\n    // Can accept precomputed Z^-1 - for example, from invertBatch.\n    // (X, Y, Z) ∋ (x=X/Z, y=Y/Z)\n    const toAffineMemo = memoized((p, iz) => {\n        const { X, Y, Z } = p;\n        // Fast-path for normalized points\n        if (Fp.eql(Z, Fp.ONE))\n            return { x: X, y: Y };\n        const is0 = p.is0();\n        // If invZ was 0, we return zero point. However we still want to execute\n        // all operations, so we replace invZ with a random number, 1.\n        if (iz == null)\n            iz = is0 ? Fp.ONE : Fp.inv(Z);\n        const x = Fp.mul(X, iz);\n        const y = Fp.mul(Y, iz);\n        const zz = Fp.mul(Z, iz);\n        if (is0)\n            return { x: Fp.ZERO, y: Fp.ZERO };\n        if (!Fp.eql(zz, Fp.ONE))\n            throw new Error('invZ was invalid');\n        return { x, y };\n    });\n    // NOTE: on exception this will crash 'cached' and no value will be set.\n    // Otherwise true will be return\n    const assertValidMemo = memoized((p) => {\n        if (p.is0()) {\n            // (0, 1, 0) aka ZERO is invalid in most contexts.\n            // In BLS, ZERO can be serialized, so we allow it.\n            // (0, 0, 0) is invalid representation of ZERO.\n            if (extraOpts.allowInfinityPoint && !Fp.is0(p.Y))\n                return;\n            throw new Error('bad point: ZERO');\n        }\n        // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`\n        const { x, y } = p.toAffine();\n        if (!Fp.isValid(x) || !Fp.isValid(y))\n            throw new Error('bad point: x or y not field elements');\n        if (!isValidXY(x, y))\n            throw new Error('bad point: equation left != right');\n        if (!p.isTorsionFree())\n            throw new Error('bad point: not in prime-order subgroup');\n        return true;\n    });\n    function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {\n        k2p = new Point(Fp.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);\n        k1p = negateCt(k1neg, k1p);\n        k2p = negateCt(k2neg, k2p);\n        return k1p.add(k2p);\n    }\n    /**\n     * Projective Point works in 3d / projective (homogeneous) coordinates:(X, Y, Z) ∋ (x=X/Z, y=Y/Z).\n     * Default Point works in 2d / affine coordinates: (x, y).\n     * We're doing calculations in projective, because its operations don't require costly inversion.\n     */\n    class Point {\n        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n        constructor(X, Y, Z) {\n            this.X = acoord('x', X);\n            this.Y = acoord('y', Y, true);\n            this.Z = acoord('z', Z);\n            Object.freeze(this);\n        }\n        static CURVE() {\n            return CURVE;\n        }\n        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n        static fromAffine(p) {\n            const { x, y } = p || {};\n            if (!p || !Fp.isValid(x) || !Fp.isValid(y))\n                throw new Error('invalid affine point');\n            if (p instanceof Point)\n                throw new Error('projective point not allowed');\n            // (0, 0) would've produced (0, 0, 1) - instead, we need (0, 1, 0)\n            if (Fp.is0(x) && Fp.is0(y))\n                return Point.ZERO;\n            return new Point(x, y, Fp.ONE);\n        }\n        static fromBytes(bytes) {\n            const P = Point.fromAffine(decodePoint(abytes(bytes, undefined, 'point')));\n            P.assertValidity();\n            return P;\n        }\n        static fromHex(hex) {\n            return Point.fromBytes(ensureBytes('pointHex', hex));\n        }\n        get x() {\n            return this.toAffine().x;\n        }\n        get y() {\n            return this.toAffine().y;\n        }\n        /**\n         *\n         * @param windowSize\n         * @param isLazy true will defer table computation until the first multiplication\n         * @returns\n         */\n        precompute(windowSize = 8, isLazy = true) {\n            wnaf.createCache(this, windowSize);\n            if (!isLazy)\n                this.multiply(_3n); // random number\n            return this;\n        }\n        // TODO: return `this`\n        /** A point on curve is valid if it conforms to equation. */\n        assertValidity() {\n            assertValidMemo(this);\n        }\n        hasEvenY() {\n            const { y } = this.toAffine();\n            if (!Fp.isOdd)\n                throw new Error(\"Field doesn't support isOdd\");\n            return !Fp.isOdd(y);\n        }\n        /** Compare one point to another. */\n        equals(other) {\n            aprjpoint(other);\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            const { X: X2, Y: Y2, Z: Z2 } = other;\n            const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));\n            const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));\n            return U1 && U2;\n        }\n        /** Flips point to one corresponding to (x, -y) in Affine coordinates. */\n        negate() {\n            return new Point(this.X, Fp.neg(this.Y), this.Z);\n        }\n        // Renes-Costello-Batina exception-free doubling formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 3\n        // Cost: 8M + 3S + 3*a + 2*b3 + 15add.\n        double() {\n            const { a, b } = CURVE;\n            const b3 = Fp.mul(b, _3n);\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            let t0 = Fp.mul(X1, X1); // step 1\n            let t1 = Fp.mul(Y1, Y1);\n            let t2 = Fp.mul(Z1, Z1);\n            let t3 = Fp.mul(X1, Y1);\n            t3 = Fp.add(t3, t3); // step 5\n            Z3 = Fp.mul(X1, Z1);\n            Z3 = Fp.add(Z3, Z3);\n            X3 = Fp.mul(a, Z3);\n            Y3 = Fp.mul(b3, t2);\n            Y3 = Fp.add(X3, Y3); // step 10\n            X3 = Fp.sub(t1, Y3);\n            Y3 = Fp.add(t1, Y3);\n            Y3 = Fp.mul(X3, Y3);\n            X3 = Fp.mul(t3, X3);\n            Z3 = Fp.mul(b3, Z3); // step 15\n            t2 = Fp.mul(a, t2);\n            t3 = Fp.sub(t0, t2);\n            t3 = Fp.mul(a, t3);\n            t3 = Fp.add(t3, Z3);\n            Z3 = Fp.add(t0, t0); // step 20\n            t0 = Fp.add(Z3, t0);\n            t0 = Fp.add(t0, t2);\n            t0 = Fp.mul(t0, t3);\n            Y3 = Fp.add(Y3, t0);\n            t2 = Fp.mul(Y1, Z1); // step 25\n            t2 = Fp.add(t2, t2);\n            t0 = Fp.mul(t2, t3);\n            X3 = Fp.sub(X3, t0);\n            Z3 = Fp.mul(t2, t1);\n            Z3 = Fp.add(Z3, Z3); // step 30\n            Z3 = Fp.add(Z3, Z3);\n            return new Point(X3, Y3, Z3);\n        }\n        // Renes-Costello-Batina exception-free addition formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 1\n        // Cost: 12M + 0S + 3*a + 3*b3 + 23add.\n        add(other) {\n            aprjpoint(other);\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            const { X: X2, Y: Y2, Z: Z2 } = other;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            const a = CURVE.a;\n            const b3 = Fp.mul(CURVE.b, _3n);\n            let t0 = Fp.mul(X1, X2); // step 1\n            let t1 = Fp.mul(Y1, Y2);\n            let t2 = Fp.mul(Z1, Z2);\n            let t3 = Fp.add(X1, Y1);\n            let t4 = Fp.add(X2, Y2); // step 5\n            t3 = Fp.mul(t3, t4);\n            t4 = Fp.add(t0, t1);\n            t3 = Fp.sub(t3, t4);\n            t4 = Fp.add(X1, Z1);\n            let t5 = Fp.add(X2, Z2); // step 10\n            t4 = Fp.mul(t4, t5);\n            t5 = Fp.add(t0, t2);\n            t4 = Fp.sub(t4, t5);\n            t5 = Fp.add(Y1, Z1);\n            X3 = Fp.add(Y2, Z2); // step 15\n            t5 = Fp.mul(t5, X3);\n            X3 = Fp.add(t1, t2);\n            t5 = Fp.sub(t5, X3);\n            Z3 = Fp.mul(a, t4);\n            X3 = Fp.mul(b3, t2); // step 20\n            Z3 = Fp.add(X3, Z3);\n            X3 = Fp.sub(t1, Z3);\n            Z3 = Fp.add(t1, Z3);\n            Y3 = Fp.mul(X3, Z3);\n            t1 = Fp.add(t0, t0); // step 25\n            t1 = Fp.add(t1, t0);\n            t2 = Fp.mul(a, t2);\n            t4 = Fp.mul(b3, t4);\n            t1 = Fp.add(t1, t2);\n            t2 = Fp.sub(t0, t2); // step 30\n            t2 = Fp.mul(a, t2);\n            t4 = Fp.add(t4, t2);\n            t0 = Fp.mul(t1, t4);\n            Y3 = Fp.add(Y3, t0);\n            t0 = Fp.mul(t5, t4); // step 35\n            X3 = Fp.mul(t3, X3);\n            X3 = Fp.sub(X3, t0);\n            t0 = Fp.mul(t3, t1);\n            Z3 = Fp.mul(t5, Z3);\n            Z3 = Fp.add(Z3, t0); // step 40\n            return new Point(X3, Y3, Z3);\n        }\n        subtract(other) {\n            return this.add(other.negate());\n        }\n        is0() {\n            return this.equals(Point.ZERO);\n        }\n        /**\n         * Constant time multiplication.\n         * Uses wNAF method. Windowed method may be 10% faster,\n         * but takes 2x longer to generate and consumes 2x memory.\n         * Uses precomputes when available.\n         * Uses endomorphism for Koblitz curves.\n         * @param scalar by which the point would be multiplied\n         * @returns New point\n         */\n        multiply(scalar) {\n            const { endo } = extraOpts;\n            if (!Fn.isValidNot0(scalar))\n                throw new Error('invalid scalar: out of range'); // 0 is invalid\n            let point, fake; // Fake point is used to const-time mult\n            const mul = (n) => wnaf.cached(this, n, (p) => normalizeZ(Point, p));\n            /** See docs for {@link EndomorphismOpts} */\n            if (endo) {\n                const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(scalar);\n                const { p: k1p, f: k1f } = mul(k1);\n                const { p: k2p, f: k2f } = mul(k2);\n                fake = k1f.add(k2f);\n                point = finishEndo(endo.beta, k1p, k2p, k1neg, k2neg);\n            }\n            else {\n                const { p, f } = mul(scalar);\n                point = p;\n                fake = f;\n            }\n            // Normalize `z` for both points, but return only real one\n            return normalizeZ(Point, [point, fake])[0];\n        }\n        /**\n         * Non-constant-time multiplication. Uses double-and-add algorithm.\n         * It's faster, but should only be used when you don't care about\n         * an exposed secret key e.g. sig verification, which works over *public* keys.\n         */\n        multiplyUnsafe(sc) {\n            const { endo } = extraOpts;\n            const p = this;\n            if (!Fn.isValid(sc))\n                throw new Error('invalid scalar: out of range'); // 0 is valid\n            if (sc === _0n || p.is0())\n                return Point.ZERO;\n            if (sc === _1n)\n                return p; // fast-path\n            if (wnaf.hasCache(this))\n                return this.multiply(sc);\n            if (endo) {\n                const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(sc);\n                const { p1, p2 } = mulEndoUnsafe(Point, p, k1, k2); // 30% faster vs wnaf.unsafe\n                return finishEndo(endo.beta, p1, p2, k1neg, k2neg);\n            }\n            else {\n                return wnaf.unsafe(p, sc);\n            }\n        }\n        multiplyAndAddUnsafe(Q, a, b) {\n            const sum = this.multiplyUnsafe(a).add(Q.multiplyUnsafe(b));\n            return sum.is0() ? undefined : sum;\n        }\n        /**\n         * Converts Projective point to affine (x, y) coordinates.\n         * @param invertedZ Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch\n         */\n        toAffine(invertedZ) {\n            return toAffineMemo(this, invertedZ);\n        }\n        /**\n         * Checks whether Point is free of torsion elements (is in prime subgroup).\n         * Always torsion-free for cofactor=1 curves.\n         */\n        isTorsionFree() {\n            const { isTorsionFree } = extraOpts;\n            if (cofactor === _1n)\n                return true;\n            if (isTorsionFree)\n                return isTorsionFree(Point, this);\n            return wnaf.unsafe(this, CURVE_ORDER).is0();\n        }\n        clearCofactor() {\n            const { clearCofactor } = extraOpts;\n            if (cofactor === _1n)\n                return this; // Fast-path\n            if (clearCofactor)\n                return clearCofactor(Point, this);\n            return this.multiplyUnsafe(cofactor);\n        }\n        isSmallOrder() {\n            // can we use this.clearCofactor()?\n            return this.multiplyUnsafe(cofactor).is0();\n        }\n        toBytes(isCompressed = true) {\n            abool(isCompressed, 'isCompressed');\n            this.assertValidity();\n            return encodePoint(Point, this, isCompressed);\n        }\n        toHex(isCompressed = true) {\n            return bytesToHex(this.toBytes(isCompressed));\n        }\n        toString() {\n            return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;\n        }\n        // TODO: remove\n        get px() {\n            return this.X;\n        }\n        get py() {\n            return this.X;\n        }\n        get pz() {\n            return this.Z;\n        }\n        toRawBytes(isCompressed = true) {\n            return this.toBytes(isCompressed);\n        }\n        _setWindowSize(windowSize) {\n            this.precompute(windowSize);\n        }\n        static normalizeZ(points) {\n            return normalizeZ(Point, points);\n        }\n        static msm(points, scalars) {\n            return pippenger(Point, Fn, points, scalars);\n        }\n        static fromPrivateKey(privateKey) {\n            return Point.BASE.multiply(_normFnElement(Fn, privateKey));\n        }\n    }\n    // base / generator point\n    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);\n    // zero / infinity / identity point\n    Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO); // 0, 1, 0\n    // math field\n    Point.Fp = Fp;\n    // scalar field\n    Point.Fn = Fn;\n    const bits = Fn.BITS;\n    const wnaf = new wNAF(Point, extraOpts.endo ? Math.ceil(bits / 2) : bits);\n    Point.BASE.precompute(8); // Enable precomputes. Slows down first publicKey computation by 20ms.\n    return Point;\n}\n// Points start with byte 0x02 when y is even; otherwise 0x03\nfunction pprefix(hasEvenY) {\n    return Uint8Array.of(hasEvenY ? 0x02 : 0x03);\n}\n/**\n * Implementation of the Shallue and van de Woestijne method for any weierstrass curve.\n * TODO: check if there is a way to merge this with uvRatio in Edwards; move to modular.\n * b = True and y = sqrt(u / v) if (u / v) is square in F, and\n * b = False and y = sqrt(Z * (u / v)) otherwise.\n * @param Fp\n * @param Z\n * @returns\n */\nexport function SWUFpSqrtRatio(Fp, Z) {\n    // Generic implementation\n    const q = Fp.ORDER;\n    let l = _0n;\n    for (let o = q - _1n; o % _2n === _0n; o /= _2n)\n        l += _1n;\n    const c1 = l; // 1. c1, the largest integer such that 2^c1 divides q - 1.\n    // We need 2n ** c1 and 2n ** (c1-1). We can't use **; but we can use <<.\n    // 2n ** c1 == 2n << (c1-1)\n    const _2n_pow_c1_1 = _2n << (c1 - _1n - _1n);\n    const _2n_pow_c1 = _2n_pow_c1_1 * _2n;\n    const c2 = (q - _1n) / _2n_pow_c1; // 2. c2 = (q - 1) / (2^c1)  # Integer arithmetic\n    const c3 = (c2 - _1n) / _2n; // 3. c3 = (c2 - 1) / 2            # Integer arithmetic\n    const c4 = _2n_pow_c1 - _1n; // 4. c4 = 2^c1 - 1                # Integer arithmetic\n    const c5 = _2n_pow_c1_1; // 5. c5 = 2^(c1 - 1)                  # Integer arithmetic\n    const c6 = Fp.pow(Z, c2); // 6. c6 = Z^c2\n    const c7 = Fp.pow(Z, (c2 + _1n) / _2n); // 7. c7 = Z^((c2 + 1) / 2)\n    let sqrtRatio = (u, v) => {\n        let tv1 = c6; // 1. tv1 = c6\n        let tv2 = Fp.pow(v, c4); // 2. tv2 = v^c4\n        let tv3 = Fp.sqr(tv2); // 3. tv3 = tv2^2\n        tv3 = Fp.mul(tv3, v); // 4. tv3 = tv3 * v\n        let tv5 = Fp.mul(u, tv3); // 5. tv5 = u * tv3\n        tv5 = Fp.pow(tv5, c3); // 6. tv5 = tv5^c3\n        tv5 = Fp.mul(tv5, tv2); // 7. tv5 = tv5 * tv2\n        tv2 = Fp.mul(tv5, v); // 8. tv2 = tv5 * v\n        tv3 = Fp.mul(tv5, u); // 9. tv3 = tv5 * u\n        let tv4 = Fp.mul(tv3, tv2); // 10. tv4 = tv3 * tv2\n        tv5 = Fp.pow(tv4, c5); // 11. tv5 = tv4^c5\n        let isQR = Fp.eql(tv5, Fp.ONE); // 12. isQR = tv5 == 1\n        tv2 = Fp.mul(tv3, c7); // 13. tv2 = tv3 * c7\n        tv5 = Fp.mul(tv4, tv1); // 14. tv5 = tv4 * tv1\n        tv3 = Fp.cmov(tv2, tv3, isQR); // 15. tv3 = CMOV(tv2, tv3, isQR)\n        tv4 = Fp.cmov(tv5, tv4, isQR); // 16. tv4 = CMOV(tv5, tv4, isQR)\n        // 17. for i in (c1, c1 - 1, ..., 2):\n        for (let i = c1; i > _1n; i--) {\n            let tv5 = i - _2n; // 18.    tv5 = i - 2\n            tv5 = _2n << (tv5 - _1n); // 19.    tv5 = 2^tv5\n            let tvv5 = Fp.pow(tv4, tv5); // 20.    tv5 = tv4^tv5\n            const e1 = Fp.eql(tvv5, Fp.ONE); // 21.    e1 = tv5 == 1\n            tv2 = Fp.mul(tv3, tv1); // 22.    tv2 = tv3 * tv1\n            tv1 = Fp.mul(tv1, tv1); // 23.    tv1 = tv1 * tv1\n            tvv5 = Fp.mul(tv4, tv1); // 24.    tv5 = tv4 * tv1\n            tv3 = Fp.cmov(tv2, tv3, e1); // 25.    tv3 = CMOV(tv2, tv3, e1)\n            tv4 = Fp.cmov(tvv5, tv4, e1); // 26.    tv4 = CMOV(tv5, tv4, e1)\n        }\n        return { isValid: isQR, value: tv3 };\n    };\n    if (Fp.ORDER % _4n === _3n) {\n        // sqrt_ratio_3mod4(u, v)\n        const c1 = (Fp.ORDER - _3n) / _4n; // 1. c1 = (q - 3) / 4     # Integer arithmetic\n        const c2 = Fp.sqrt(Fp.neg(Z)); // 2. c2 = sqrt(-Z)\n        sqrtRatio = (u, v) => {\n            let tv1 = Fp.sqr(v); // 1. tv1 = v^2\n            const tv2 = Fp.mul(u, v); // 2. tv2 = u * v\n            tv1 = Fp.mul(tv1, tv2); // 3. tv1 = tv1 * tv2\n            let y1 = Fp.pow(tv1, c1); // 4. y1 = tv1^c1\n            y1 = Fp.mul(y1, tv2); // 5. y1 = y1 * tv2\n            const y2 = Fp.mul(y1, c2); // 6. y2 = y1 * c2\n            const tv3 = Fp.mul(Fp.sqr(y1), v); // 7. tv3 = y1^2; 8. tv3 = tv3 * v\n            const isQR = Fp.eql(tv3, u); // 9. isQR = tv3 == u\n            let y = Fp.cmov(y2, y1, isQR); // 10. y = CMOV(y2, y1, isQR)\n            return { isValid: isQR, value: y }; // 11. return (isQR, y) isQR ? y : y*c2\n        };\n    }\n    // No curves uses that\n    // if (Fp.ORDER % _8n === _5n) // sqrt_ratio_5mod8\n    return sqrtRatio;\n}\n/**\n * Simplified Shallue-van de Woestijne-Ulas Method\n * https://www.rfc-editor.org/rfc/rfc9380#section-6.6.2\n */\nexport function mapToCurveSimpleSWU(Fp, opts) {\n    validateField(Fp);\n    const { A, B, Z } = opts;\n    if (!Fp.isValid(A) || !Fp.isValid(B) || !Fp.isValid(Z))\n        throw new Error('mapToCurveSimpleSWU: invalid opts');\n    const sqrtRatio = SWUFpSqrtRatio(Fp, Z);\n    if (!Fp.isOdd)\n        throw new Error('Field does not have .isOdd()');\n    // Input: u, an element of F.\n    // Output: (x, y), a point on E.\n    return (u) => {\n        // prettier-ignore\n        let tv1, tv2, tv3, tv4, tv5, tv6, x, y;\n        tv1 = Fp.sqr(u); // 1.  tv1 = u^2\n        tv1 = Fp.mul(tv1, Z); // 2.  tv1 = Z * tv1\n        tv2 = Fp.sqr(tv1); // 3.  tv2 = tv1^2\n        tv2 = Fp.add(tv2, tv1); // 4.  tv2 = tv2 + tv1\n        tv3 = Fp.add(tv2, Fp.ONE); // 5.  tv3 = tv2 + 1\n        tv3 = Fp.mul(tv3, B); // 6.  tv3 = B * tv3\n        tv4 = Fp.cmov(Z, Fp.neg(tv2), !Fp.eql(tv2, Fp.ZERO)); // 7.  tv4 = CMOV(Z, -tv2, tv2 != 0)\n        tv4 = Fp.mul(tv4, A); // 8.  tv4 = A * tv4\n        tv2 = Fp.sqr(tv3); // 9.  tv2 = tv3^2\n        tv6 = Fp.sqr(tv4); // 10. tv6 = tv4^2\n        tv5 = Fp.mul(tv6, A); // 11. tv5 = A * tv6\n        tv2 = Fp.add(tv2, tv5); // 12. tv2 = tv2 + tv5\n        tv2 = Fp.mul(tv2, tv3); // 13. tv2 = tv2 * tv3\n        tv6 = Fp.mul(tv6, tv4); // 14. tv6 = tv6 * tv4\n        tv5 = Fp.mul(tv6, B); // 15. tv5 = B * tv6\n        tv2 = Fp.add(tv2, tv5); // 16. tv2 = tv2 + tv5\n        x = Fp.mul(tv1, tv3); // 17.   x = tv1 * tv3\n        const { isValid, value } = sqrtRatio(tv2, tv6); // 18. (is_gx1_square, y1) = sqrt_ratio(tv2, tv6)\n        y = Fp.mul(tv1, u); // 19.   y = tv1 * u  -> Z * u^3 * y1\n        y = Fp.mul(y, value); // 20.   y = y * y1\n        x = Fp.cmov(x, tv3, isValid); // 21.   x = CMOV(x, tv3, is_gx1_square)\n        y = Fp.cmov(y, value, isValid); // 22.   y = CMOV(y, y1, is_gx1_square)\n        const e1 = Fp.isOdd(u) === Fp.isOdd(y); // 23.  e1 = sgn0(u) == sgn0(y)\n        y = Fp.cmov(Fp.neg(y), y, e1); // 24.   y = CMOV(-y, y, e1)\n        const tv4_inv = FpInvertBatch(Fp, [tv4], true)[0];\n        x = Fp.mul(x, tv4_inv); // 25.   x = x / tv4\n        return { x, y };\n    };\n}\nfunction getWLengths(Fp, Fn) {\n    return {\n        secretKey: Fn.BYTES,\n        publicKey: 1 + Fp.BYTES,\n        publicKeyUncompressed: 1 + 2 * Fp.BYTES,\n        publicKeyHasPrefix: true,\n        signature: 2 * Fn.BYTES,\n    };\n}\n/**\n * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.\n * This helper ensures no signature functionality is present. Less code, smaller bundle size.\n */\nexport function ecdh(Point, ecdhOpts = {}) {\n    const { Fn } = Point;\n    const randomBytes_ = ecdhOpts.randomBytes || randomBytesWeb;\n    const lengths = Object.assign(getWLengths(Point.Fp, Fn), { seed: getMinHashLength(Fn.ORDER) });\n    function isValidSecretKey(secretKey) {\n        try {\n            return !!_normFnElement(Fn, secretKey);\n        }\n        catch (error) {\n            return false;\n        }\n    }\n    function isValidPublicKey(publicKey, isCompressed) {\n        const { publicKey: comp, publicKeyUncompressed } = lengths;\n        try {\n            const l = publicKey.length;\n            if (isCompressed === true && l !== comp)\n                return false;\n            if (isCompressed === false && l !== publicKeyUncompressed)\n                return false;\n            return !!Point.fromBytes(publicKey);\n        }\n        catch (error) {\n            return false;\n        }\n    }\n    /**\n     * Produces cryptographically secure secret key from random of size\n     * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.\n     */\n    function randomSecretKey(seed = randomBytes_(lengths.seed)) {\n        return mapHashToField(abytes(seed, lengths.seed, 'seed'), Fn.ORDER);\n    }\n    /**\n     * Computes public key for a secret key. Checks for validity of the secret key.\n     * @param isCompressed whether to return compact (default), or full key\n     * @returns Public key, full when isCompressed=false; short when isCompressed=true\n     */\n    function getPublicKey(secretKey, isCompressed = true) {\n        return Point.BASE.multiply(_normFnElement(Fn, secretKey)).toBytes(isCompressed);\n    }\n    function keygen(seed) {\n        const secretKey = randomSecretKey(seed);\n        return { secretKey, publicKey: getPublicKey(secretKey) };\n    }\n    /**\n     * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.\n     */\n    function isProbPub(item) {\n        if (typeof item === 'bigint')\n            return false;\n        if (item instanceof Point)\n            return true;\n        const { secretKey, publicKey, publicKeyUncompressed } = lengths;\n        if (Fn.allowedLengths || secretKey === publicKey)\n            return undefined;\n        const l = ensureBytes('key', item).length;\n        return l === publicKey || l === publicKeyUncompressed;\n    }\n    /**\n     * ECDH (Elliptic Curve Diffie Hellman).\n     * Computes shared public key from secret key A and public key B.\n     * Checks: 1) secret key validity 2) shared key is on-curve.\n     * Does NOT hash the result.\n     * @param isCompressed whether to return compact (default), or full key\n     * @returns shared public key\n     */\n    function getSharedSecret(secretKeyA, publicKeyB, isCompressed = true) {\n        if (isProbPub(secretKeyA) === true)\n            throw new Error('first arg must be private key');\n        if (isProbPub(publicKeyB) === false)\n            throw new Error('second arg must be public key');\n        const s = _normFnElement(Fn, secretKeyA);\n        const b = Point.fromHex(publicKeyB); // checks for being on-curve\n        return b.multiply(s).toBytes(isCompressed);\n    }\n    const utils = {\n        isValidSecretKey,\n        isValidPublicKey,\n        randomSecretKey,\n        // TODO: remove\n        isValidPrivateKey: isValidSecretKey,\n        randomPrivateKey: randomSecretKey,\n        normPrivateKeyToScalar: (key) => _normFnElement(Fn, key),\n        precompute(windowSize = 8, point = Point.BASE) {\n            return point.precompute(windowSize, false);\n        },\n    };\n    return Object.freeze({ getPublicKey, getSharedSecret, keygen, Point, utils, lengths });\n}\n/**\n * Creates ECDSA signing interface for given elliptic curve `Point` and `hash` function.\n * We need `hash` for 2 features:\n * 1. Message prehash-ing. NOT used if `sign` / `verify` are called with `prehash: false`\n * 2. k generation in `sign`, using HMAC-drbg(hash)\n *\n * ECDSAOpts are only rarely needed.\n *\n * @example\n * ```js\n * const p256_Point = weierstrass(...);\n * const p256_sha256 = ecdsa(p256_Point, sha256);\n * const p256_sha224 = ecdsa(p256_Point, sha224);\n * const p256_sha224_r = ecdsa(p256_Point, sha224, { randomBytes: (length) => { ... } });\n * ```\n */\nexport function ecdsa(Point, hash, ecdsaOpts = {}) {\n    ahash(hash);\n    _validateObject(ecdsaOpts, {}, {\n        hmac: 'function',\n        lowS: 'boolean',\n        randomBytes: 'function',\n        bits2int: 'function',\n        bits2int_modN: 'function',\n    });\n    const randomBytes = ecdsaOpts.randomBytes || randomBytesWeb;\n    const hmac = ecdsaOpts.hmac ||\n        ((key, ...msgs) => nobleHmac(hash, key, concatBytes(...msgs)));\n    const { Fp, Fn } = Point;\n    const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;\n    const { keygen, getPublicKey, getSharedSecret, utils, lengths } = ecdh(Point, ecdsaOpts);\n    const defaultSigOpts = {\n        prehash: false,\n        lowS: typeof ecdsaOpts.lowS === 'boolean' ? ecdsaOpts.lowS : false,\n        format: undefined, //'compact' as ECDSASigFormat,\n        extraEntropy: false,\n    };\n    const defaultSigOpts_format = 'compact';\n    function isBiggerThanHalfOrder(number) {\n        const HALF = CURVE_ORDER >> _1n;\n        return number > HALF;\n    }\n    function validateRS(title, num) {\n        if (!Fn.isValidNot0(num))\n            throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);\n        return num;\n    }\n    function validateSigLength(bytes, format) {\n        validateSigFormat(format);\n        const size = lengths.signature;\n        const sizer = format === 'compact' ? size : format === 'recovered' ? size + 1 : undefined;\n        return abytes(bytes, sizer, `${format} signature`);\n    }\n    /**\n     * ECDSA signature with its (r, s) properties. Supports compact, recovered & DER representations.\n     */\n    class Signature {\n        constructor(r, s, recovery) {\n            this.r = validateRS('r', r); // r in [1..N-1];\n            this.s = validateRS('s', s); // s in [1..N-1];\n            if (recovery != null)\n                this.recovery = recovery;\n            Object.freeze(this);\n        }\n        static fromBytes(bytes, format = defaultSigOpts_format) {\n            validateSigLength(bytes, format);\n            let recid;\n            if (format === 'der') {\n                const { r, s } = DER.toSig(abytes(bytes));\n                return new Signature(r, s);\n            }\n            if (format === 'recovered') {\n                recid = bytes[0];\n                format = 'compact';\n                bytes = bytes.subarray(1);\n            }\n            const L = Fn.BYTES;\n            const r = bytes.subarray(0, L);\n            const s = bytes.subarray(L, L * 2);\n            return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);\n        }\n        static fromHex(hex, format) {\n            return this.fromBytes(hexToBytes(hex), format);\n        }\n        addRecoveryBit(recovery) {\n            return new Signature(this.r, this.s, recovery);\n        }\n        recoverPublicKey(messageHash) {\n            const FIELD_ORDER = Fp.ORDER;\n            const { r, s, recovery: rec } = this;\n            if (rec == null || ![0, 1, 2, 3].includes(rec))\n                throw new Error('recovery id invalid');\n            // ECDSA recovery is hard for cofactor > 1 curves.\n            // In sign, `r = q.x mod n`, and here we recover q.x from r.\n            // While recovering q.x >= n, we need to add r+n for cofactor=1 curves.\n            // However, for cofactor>1, r+n may not get q.x:\n            // r+n*i would need to be done instead where i is unknown.\n            // To easily get i, we either need to:\n            // a. increase amount of valid recid values (4, 5...); OR\n            // b. prohibit non-prime-order signatures (recid > 1).\n            const hasCofactor = CURVE_ORDER * _2n < FIELD_ORDER;\n            if (hasCofactor && rec > 1)\n                throw new Error('recovery id is ambiguous for h>1 curve');\n            const radj = rec === 2 || rec === 3 ? r + CURVE_ORDER : r;\n            if (!Fp.isValid(radj))\n                throw new Error('recovery id 2 or 3 invalid');\n            const x = Fp.toBytes(radj);\n            const R = Point.fromBytes(concatBytes(pprefix((rec & 1) === 0), x));\n            const ir = Fn.inv(radj); // r^-1\n            const h = bits2int_modN(ensureBytes('msgHash', messageHash)); // Truncate hash\n            const u1 = Fn.create(-h * ir); // -hr^-1\n            const u2 = Fn.create(s * ir); // sr^-1\n            // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1). unsafe is fine: there is no private data.\n            const Q = Point.BASE.multiplyUnsafe(u1).add(R.multiplyUnsafe(u2));\n            if (Q.is0())\n                throw new Error('point at infinify');\n            Q.assertValidity();\n            return Q;\n        }\n        // Signatures should be low-s, to prevent malleability.\n        hasHighS() {\n            return isBiggerThanHalfOrder(this.s);\n        }\n        toBytes(format = defaultSigOpts_format) {\n            validateSigFormat(format);\n            if (format === 'der')\n                return hexToBytes(DER.hexFromSig(this));\n            const r = Fn.toBytes(this.r);\n            const s = Fn.toBytes(this.s);\n            if (format === 'recovered') {\n                if (this.recovery == null)\n                    throw new Error('recovery bit must be present');\n                return concatBytes(Uint8Array.of(this.recovery), r, s);\n            }\n            return concatBytes(r, s);\n        }\n        toHex(format) {\n            return bytesToHex(this.toBytes(format));\n        }\n        // TODO: remove\n        assertValidity() { }\n        static fromCompact(hex) {\n            return Signature.fromBytes(ensureBytes('sig', hex), 'compact');\n        }\n        static fromDER(hex) {\n            return Signature.fromBytes(ensureBytes('sig', hex), 'der');\n        }\n        normalizeS() {\n            return this.hasHighS() ? new Signature(this.r, Fn.neg(this.s), this.recovery) : this;\n        }\n        toDERRawBytes() {\n            return this.toBytes('der');\n        }\n        toDERHex() {\n            return bytesToHex(this.toBytes('der'));\n        }\n        toCompactRawBytes() {\n            return this.toBytes('compact');\n        }\n        toCompactHex() {\n            return bytesToHex(this.toBytes('compact'));\n        }\n    }\n    // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.\n    // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.\n    // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.\n    // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors\n    const bits2int = ecdsaOpts.bits2int ||\n        function bits2int_def(bytes) {\n            // Our custom check \"just in case\", for protection against DoS\n            if (bytes.length > 8192)\n                throw new Error('input is too large');\n            // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)\n            // for some cases, since bytes.length * 8 is not actual bitLength.\n            const num = bytesToNumberBE(bytes); // check for == u8 done here\n            const delta = bytes.length * 8 - fnBits; // truncate to nBitLength leftmost bits\n            return delta > 0 ? num >> BigInt(delta) : num;\n        };\n    const bits2int_modN = ecdsaOpts.bits2int_modN ||\n        function bits2int_modN_def(bytes) {\n            return Fn.create(bits2int(bytes)); // can't use bytesToNumberBE here\n        };\n    // Pads output with zero as per spec\n    const ORDER_MASK = bitMask(fnBits);\n    /** Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`. */\n    function int2octets(num) {\n        // IMPORTANT: the check ensures working for case `Fn.BYTES != Fn.BITS * 8`\n        aInRange('num < 2^' + fnBits, num, _0n, ORDER_MASK);\n        return Fn.toBytes(num);\n    }\n    function validateMsgAndHash(message, prehash) {\n        abytes(message, undefined, 'message');\n        return prehash ? abytes(hash(message), undefined, 'prehashed message') : message;\n    }\n    /**\n     * Steps A, D of RFC6979 3.2.\n     * Creates RFC6979 seed; converts msg/privKey to numbers.\n     * Used only in sign, not in verify.\n     *\n     * Warning: we cannot assume here that message has same amount of bytes as curve order,\n     * this will be invalid at least for P521. Also it can be bigger for P224 + SHA256.\n     */\n    function prepSig(message, privateKey, opts) {\n        if (['recovered', 'canonical'].some((k) => k in opts))\n            throw new Error('sign() legacy options not supported');\n        const { lowS, prehash, extraEntropy } = validateSigOpts(opts, defaultSigOpts);\n        message = validateMsgAndHash(message, prehash); // RFC6979 3.2 A: h1 = H(m)\n        // We can't later call bits2octets, since nested bits2int is broken for curves\n        // with fnBits % 8 !== 0. Because of that, we unwrap it here as int2octets call.\n        // const bits2octets = (bits) => int2octets(bits2int_modN(bits))\n        const h1int = bits2int_modN(message);\n        const d = _normFnElement(Fn, privateKey); // validate secret key, convert to bigint\n        const seedArgs = [int2octets(d), int2octets(h1int)];\n        // extraEntropy. RFC6979 3.6: additional k' (optional).\n        if (extraEntropy != null && extraEntropy !== false) {\n            // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')\n            // gen random bytes OR pass as-is\n            const e = extraEntropy === true ? randomBytes(lengths.secretKey) : extraEntropy;\n            seedArgs.push(ensureBytes('extraEntropy', e)); // check for being bytes\n        }\n        const seed = concatBytes(...seedArgs); // Step D of RFC6979 3.2\n        const m = h1int; // NOTE: no need to call bits2int second time here, it is inside truncateHash!\n        // Converts signature params into point w r/s, checks result for validity.\n        // To transform k => Signature:\n        // q = k⋅G\n        // r = q.x mod n\n        // s = k^-1(m + rd) mod n\n        // Can use scalar blinding b^-1(bm + bdr) where b ∈ [1,q−1] according to\n        // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. We've decided against it:\n        // a) dependency on CSPRNG b) 15% slowdown c) doesn't really help since bigints are not CT\n        function k2sig(kBytes) {\n            // RFC 6979 Section 3.2, step 3: k = bits2int(T)\n            // Important: all mod() calls here must be done over N\n            const k = bits2int(kBytes); // mod n, not mod p\n            if (!Fn.isValidNot0(k))\n                return; // Valid scalars (including k) must be in 1..N-1\n            const ik = Fn.inv(k); // k^-1 mod n\n            const q = Point.BASE.multiply(k).toAffine(); // q = k⋅G\n            const r = Fn.create(q.x); // r = q.x mod n\n            if (r === _0n)\n                return;\n            const s = Fn.create(ik * Fn.create(m + r * d)); // Not using blinding here, see comment above\n            if (s === _0n)\n                return;\n            let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3, when q.x > n)\n            let normS = s;\n            if (lowS && isBiggerThanHalfOrder(s)) {\n                normS = Fn.neg(s); // if lowS was passed, ensure s is always\n                recovery ^= 1; // // in the bottom half of N\n            }\n            return new Signature(r, normS, recovery); // use normS, not s\n        }\n        return { seed, k2sig };\n    }\n    /**\n     * Signs message hash with a secret key.\n     *\n     * ```\n     * sign(m, d) where\n     *   k = rfc6979_hmac_drbg(m, d)\n     *   (x, y) = G × k\n     *   r = x mod n\n     *   s = (m + dr) / k mod n\n     * ```\n     */\n    function sign(message, secretKey, opts = {}) {\n        message = ensureBytes('message', message);\n        const { seed, k2sig } = prepSig(message, secretKey, opts); // Steps A, D of RFC6979 3.2.\n        const drbg = createHmacDrbg(hash.outputLen, Fn.BYTES, hmac);\n        const sig = drbg(seed, k2sig); // Steps B, C, D, E, F, G\n        return sig;\n    }\n    function tryParsingSig(sg) {\n        // Try to deduce format\n        let sig = undefined;\n        const isHex = typeof sg === 'string' || isBytes(sg);\n        const isObj = !isHex &&\n            sg !== null &&\n            typeof sg === 'object' &&\n            typeof sg.r === 'bigint' &&\n            typeof sg.s === 'bigint';\n        if (!isHex && !isObj)\n            throw new Error('invalid signature, expected Uint8Array, hex string or Signature instance');\n        if (isObj) {\n            sig = new Signature(sg.r, sg.s);\n        }\n        else if (isHex) {\n            try {\n                sig = Signature.fromBytes(ensureBytes('sig', sg), 'der');\n            }\n            catch (derError) {\n                if (!(derError instanceof DER.Err))\n                    throw derError;\n            }\n            if (!sig) {\n                try {\n                    sig = Signature.fromBytes(ensureBytes('sig', sg), 'compact');\n                }\n                catch (error) {\n                    return false;\n                }\n            }\n        }\n        if (!sig)\n            return false;\n        return sig;\n    }\n    /**\n     * Verifies a signature against message and public key.\n     * Rejects lowS signatures by default: see {@link ECDSAVerifyOpts}.\n     * Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:\n     *\n     * ```\n     * verify(r, s, h, P) where\n     *   u1 = hs^-1 mod n\n     *   u2 = rs^-1 mod n\n     *   R = u1⋅G + u2⋅P\n     *   mod(R.x, n) == r\n     * ```\n     */\n    function verify(signature, message, publicKey, opts = {}) {\n        const { lowS, prehash, format } = validateSigOpts(opts, defaultSigOpts);\n        publicKey = ensureBytes('publicKey', publicKey);\n        message = validateMsgAndHash(ensureBytes('message', message), prehash);\n        if ('strict' in opts)\n            throw new Error('options.strict was renamed to lowS');\n        const sig = format === undefined\n            ? tryParsingSig(signature)\n            : Signature.fromBytes(ensureBytes('sig', signature), format);\n        if (sig === false)\n            return false;\n        try {\n            const P = Point.fromBytes(publicKey);\n            if (lowS && sig.hasHighS())\n                return false;\n            const { r, s } = sig;\n            const h = bits2int_modN(message); // mod n, not mod p\n            const is = Fn.inv(s); // s^-1 mod n\n            const u1 = Fn.create(h * is); // u1 = hs^-1 mod n\n            const u2 = Fn.create(r * is); // u2 = rs^-1 mod n\n            const R = Point.BASE.multiplyUnsafe(u1).add(P.multiplyUnsafe(u2)); // u1⋅G + u2⋅P\n            if (R.is0())\n                return false;\n            const v = Fn.create(R.x); // v = r.x mod n\n            return v === r;\n        }\n        catch (e) {\n            return false;\n        }\n    }\n    function recoverPublicKey(signature, message, opts = {}) {\n        const { prehash } = validateSigOpts(opts, defaultSigOpts);\n        message = validateMsgAndHash(message, prehash);\n        return Signature.fromBytes(signature, 'recovered').recoverPublicKey(message).toBytes();\n    }\n    return Object.freeze({\n        keygen,\n        getPublicKey,\n        getSharedSecret,\n        utils,\n        lengths,\n        Point,\n        sign,\n        verify,\n        recoverPublicKey,\n        Signature,\n        hash,\n    });\n}\n/** @deprecated use `weierstrass` in newer releases */\nexport function weierstrassPoints(c) {\n    const { CURVE, curveOpts } = _weierstrass_legacy_opts_to_new(c);\n    const Point = weierstrassN(CURVE, curveOpts);\n    return _weierstrass_new_output_to_legacy(c, Point);\n}\nfunction _weierstrass_legacy_opts_to_new(c) {\n    const CURVE = {\n        a: c.a,\n        b: c.b,\n        p: c.Fp.ORDER,\n        n: c.n,\n        h: c.h,\n        Gx: c.Gx,\n        Gy: c.Gy,\n    };\n    const Fp = c.Fp;\n    let allowedLengths = c.allowedPrivateKeyLengths\n        ? Array.from(new Set(c.allowedPrivateKeyLengths.map((l) => Math.ceil(l / 2))))\n        : undefined;\n    const Fn = Field(CURVE.n, {\n        BITS: c.nBitLength,\n        allowedLengths: allowedLengths,\n        modFromBytes: c.wrapPrivateKey,\n    });\n    const curveOpts = {\n        Fp,\n        Fn,\n        allowInfinityPoint: c.allowInfinityPoint,\n        endo: c.endo,\n        isTorsionFree: c.isTorsionFree,\n        clearCofactor: c.clearCofactor,\n        fromBytes: c.fromBytes,\n        toBytes: c.toBytes,\n    };\n    return { CURVE, curveOpts };\n}\nfunction _ecdsa_legacy_opts_to_new(c) {\n    const { CURVE, curveOpts } = _weierstrass_legacy_opts_to_new(c);\n    const ecdsaOpts = {\n        hmac: c.hmac,\n        randomBytes: c.randomBytes,\n        lowS: c.lowS,\n        bits2int: c.bits2int,\n        bits2int_modN: c.bits2int_modN,\n    };\n    return { CURVE, curveOpts, hash: c.hash, ecdsaOpts };\n}\nexport function _legacyHelperEquat(Fp, a, b) {\n    /**\n     * y² = x³ + ax + b: Short weierstrass curve formula. Takes x, returns y².\n     * @returns y²\n     */\n    function weierstrassEquation(x) {\n        const x2 = Fp.sqr(x); // x * x\n        const x3 = Fp.mul(x2, x); // x² * x\n        return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x³ + a * x + b\n    }\n    return weierstrassEquation;\n}\nfunction _weierstrass_new_output_to_legacy(c, Point) {\n    const { Fp, Fn } = Point;\n    function isWithinCurveOrder(num) {\n        return inRange(num, _1n, Fn.ORDER);\n    }\n    const weierstrassEquation = _legacyHelperEquat(Fp, c.a, c.b);\n    return Object.assign({}, {\n        CURVE: c,\n        Point: Point,\n        ProjectivePoint: Point,\n        normPrivateKeyToScalar: (key) => _normFnElement(Fn, key),\n        weierstrassEquation,\n        isWithinCurveOrder,\n    });\n}\nfunction _ecdsa_new_output_to_legacy(c, _ecdsa) {\n    const Point = _ecdsa.Point;\n    return Object.assign({}, _ecdsa, {\n        ProjectivePoint: Point,\n        CURVE: Object.assign({}, c, nLength(Point.Fn.ORDER, Point.Fn.BITS)),\n    });\n}\n// _ecdsa_legacy\nexport function weierstrass(c) {\n    const { CURVE, curveOpts, hash, ecdsaOpts } = _ecdsa_legacy_opts_to_new(c);\n    const Point = weierstrassN(CURVE, curveOpts);\n    const signs = ecdsa(Point, hash, ecdsaOpts);\n    return _ecdsa_new_output_to_legacy(c, signs);\n}\n//# sourceMappingURL=weierstrass.js.map","/**\n * SECG secp256k1. See [pdf](https://www.secg.org/sec2-v2.pdf).\n *\n * Belongs to Koblitz curves: it has efficiently-computable GLV endomorphism ψ,\n * check out {@link EndomorphismOpts}. Seems to be rigid (not backdoored).\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha256 } from '@noble/hashes/sha2.js';\nimport { randomBytes } from '@noble/hashes/utils.js';\nimport { createCurve } from \"./_shortw_utils.js\";\nimport { createHasher, isogenyMap, } from \"./abstract/hash-to-curve.js\";\nimport { Field, mapHashToField, mod, pow2 } from \"./abstract/modular.js\";\nimport { _normFnElement, mapToCurveSimpleSWU, } from \"./abstract/weierstrass.js\";\nimport { bytesToNumberBE, concatBytes, ensureBytes, inRange, numberToBytesBE, utf8ToBytes, } from \"./utils.js\";\n// Seems like generator was produced from some seed:\n// `Point.BASE.multiply(Point.Fn.inv(2n, N)).toAffine().x`\n// // gives short x 0x3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63n\nconst secp256k1_CURVE = {\n    p: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f'),\n    n: BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141'),\n    h: BigInt(1),\n    a: BigInt(0),\n    b: BigInt(7),\n    Gx: BigInt('0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798'),\n    Gy: BigInt('0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8'),\n};\nconst secp256k1_ENDO = {\n    beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),\n    basises: [\n        [BigInt('0x3086d221a7d46bcde86c90e49284eb15'), -BigInt('0xe4437ed6010e88286f547fa90abfe4c3')],\n        [BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8'), BigInt('0x3086d221a7d46bcde86c90e49284eb15')],\n    ],\n};\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\nconst _2n = /* @__PURE__ */ BigInt(2);\n/**\n * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.\n * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]\n */\nfunction sqrtMod(y) {\n    const P = secp256k1_CURVE.p;\n    // prettier-ignore\n    const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);\n    // prettier-ignore\n    const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);\n    const b2 = (y * y * y) % P; // x^3, 11\n    const b3 = (b2 * b2 * y) % P; // x^7\n    const b6 = (pow2(b3, _3n, P) * b3) % P;\n    const b9 = (pow2(b6, _3n, P) * b3) % P;\n    const b11 = (pow2(b9, _2n, P) * b2) % P;\n    const b22 = (pow2(b11, _11n, P) * b11) % P;\n    const b44 = (pow2(b22, _22n, P) * b22) % P;\n    const b88 = (pow2(b44, _44n, P) * b44) % P;\n    const b176 = (pow2(b88, _88n, P) * b88) % P;\n    const b220 = (pow2(b176, _44n, P) * b44) % P;\n    const b223 = (pow2(b220, _3n, P) * b3) % P;\n    const t1 = (pow2(b223, _23n, P) * b22) % P;\n    const t2 = (pow2(t1, _6n, P) * b2) % P;\n    const root = pow2(t2, _2n, P);\n    if (!Fpk1.eql(Fpk1.sqr(root), y))\n        throw new Error('Cannot find square root');\n    return root;\n}\nconst Fpk1 = Field(secp256k1_CURVE.p, { sqrt: sqrtMod });\n/**\n * secp256k1 curve, ECDSA and ECDH methods.\n *\n * Field: `2n**256n - 2n**32n - 2n**9n - 2n**8n - 2n**7n - 2n**6n - 2n**4n - 1n`\n *\n * @example\n * ```js\n * import { secp256k1 } from '@noble/curves/secp256k1';\n * const { secretKey, publicKey } = secp256k1.keygen();\n * const msg = new TextEncoder().encode('hello');\n * const sig = secp256k1.sign(msg, secretKey);\n * const isValid = secp256k1.verify(sig, msg, publicKey) === true;\n * ```\n */\nexport const secp256k1 = createCurve({ ...secp256k1_CURVE, Fp: Fpk1, lowS: true, endo: secp256k1_ENDO }, sha256);\n// Schnorr signatures are superior to ECDSA from above. Below is Schnorr-specific BIP0340 code.\n// https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\n/** An object mapping tags to their tagged hash prefix of [SHA256(tag) | SHA256(tag)] */\nconst TAGGED_HASH_PREFIXES = {};\nfunction taggedHash(tag, ...messages) {\n    let tagP = TAGGED_HASH_PREFIXES[tag];\n    if (tagP === undefined) {\n        const tagH = sha256(utf8ToBytes(tag));\n        tagP = concatBytes(tagH, tagH);\n        TAGGED_HASH_PREFIXES[tag] = tagP;\n    }\n    return sha256(concatBytes(tagP, ...messages));\n}\n// ECDSA compact points are 33-byte. Schnorr is 32: we strip first byte 0x02 or 0x03\nconst pointToBytes = (point) => point.toBytes(true).slice(1);\nconst Pointk1 = /* @__PURE__ */ (() => secp256k1.Point)();\nconst hasEven = (y) => y % _2n === _0n;\n// Calculate point, scalar and bytes\nfunction schnorrGetExtPubKey(priv) {\n    const { Fn, BASE } = Pointk1;\n    const d_ = _normFnElement(Fn, priv);\n    const p = BASE.multiply(d_); // P = d'⋅G; 0 < d' < n check is done inside\n    const scalar = hasEven(p.y) ? d_ : Fn.neg(d_);\n    return { scalar, bytes: pointToBytes(p) };\n}\n/**\n * lift_x from BIP340. Convert 32-byte x coordinate to elliptic curve point.\n * @returns valid point checked for being on-curve\n */\nfunction lift_x(x) {\n    const Fp = Fpk1;\n    if (!Fp.isValidNot0(x))\n        throw new Error('invalid x: Fail if x ≥ p');\n    const xx = Fp.create(x * x);\n    const c = Fp.create(xx * x + BigInt(7)); // Let c = x³ + 7 mod p.\n    let y = Fp.sqrt(c); // Let y = c^(p+1)/4 mod p. Same as sqrt().\n    // Return the unique point P such that x(P) = x and\n    // y(P) = y if y mod 2 = 0 or y(P) = p-y otherwise.\n    if (!hasEven(y))\n        y = Fp.neg(y);\n    const p = Pointk1.fromAffine({ x, y });\n    p.assertValidity();\n    return p;\n}\nconst num = bytesToNumberBE;\n/**\n * Create tagged hash, convert it to bigint, reduce modulo-n.\n */\nfunction challenge(...args) {\n    return Pointk1.Fn.create(num(taggedHash('BIP0340/challenge', ...args)));\n}\n/**\n * Schnorr public key is just `x` coordinate of Point as per BIP340.\n */\nfunction schnorrGetPublicKey(secretKey) {\n    return schnorrGetExtPubKey(secretKey).bytes; // d'=int(sk). Fail if d'=0 or d'≥n. Ret bytes(d'⋅G)\n}\n/**\n * Creates Schnorr signature as per BIP340. Verifies itself before returning anything.\n * auxRand is optional and is not the sole source of k generation: bad CSPRNG won't be dangerous.\n */\nfunction schnorrSign(message, secretKey, auxRand = randomBytes(32)) {\n    const { Fn } = Pointk1;\n    const m = ensureBytes('message', message);\n    const { bytes: px, scalar: d } = schnorrGetExtPubKey(secretKey); // checks for isWithinCurveOrder\n    const a = ensureBytes('auxRand', auxRand, 32); // Auxiliary random data a: a 32-byte array\n    const t = Fn.toBytes(d ^ num(taggedHash('BIP0340/aux', a))); // Let t be the byte-wise xor of bytes(d) and hash/aux(a)\n    const rand = taggedHash('BIP0340/nonce', t, px, m); // Let rand = hash/nonce(t || bytes(P) || m)\n    // Let k' = int(rand) mod n. Fail if k' = 0. Let R = k'⋅G\n    const { bytes: rx, scalar: k } = schnorrGetExtPubKey(rand);\n    const e = challenge(rx, px, m); // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.\n    const sig = new Uint8Array(64); // Let sig = bytes(R) || bytes((k + ed) mod n).\n    sig.set(rx, 0);\n    sig.set(Fn.toBytes(Fn.create(k + e * d)), 32);\n    // If Verify(bytes(P), m, sig) (see below) returns failure, abort\n    if (!schnorrVerify(sig, m, px))\n        throw new Error('sign: Invalid signature produced');\n    return sig;\n}\n/**\n * Verifies Schnorr signature.\n * Will swallow errors & return false except for initial type validation of arguments.\n */\nfunction schnorrVerify(signature, message, publicKey) {\n    const { Fn, BASE } = Pointk1;\n    const sig = ensureBytes('signature', signature, 64);\n    const m = ensureBytes('message', message);\n    const pub = ensureBytes('publicKey', publicKey, 32);\n    try {\n        const P = lift_x(num(pub)); // P = lift_x(int(pk)); fail if that fails\n        const r = num(sig.subarray(0, 32)); // Let r = int(sig[0:32]); fail if r ≥ p.\n        if (!inRange(r, _1n, secp256k1_CURVE.p))\n            return false;\n        const s = num(sig.subarray(32, 64)); // Let s = int(sig[32:64]); fail if s ≥ n.\n        if (!inRange(s, _1n, secp256k1_CURVE.n))\n            return false;\n        // int(challenge(bytes(r)||bytes(P)||m))%n\n        const e = challenge(Fn.toBytes(r), pointToBytes(P), m);\n        // R = s⋅G - e⋅P, where -eP == (n-e)P\n        const R = BASE.multiplyUnsafe(s).add(P.multiplyUnsafe(Fn.neg(e)));\n        const { x, y } = R.toAffine();\n        // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.\n        if (R.is0() || !hasEven(y) || x !== r)\n            return false;\n        return true;\n    }\n    catch (error) {\n        return false;\n    }\n}\n/**\n * Schnorr signatures over secp256k1.\n * https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\n * @example\n * ```js\n * import { schnorr } from '@noble/curves/secp256k1';\n * const { secretKey, publicKey } = schnorr.keygen();\n * // const publicKey = schnorr.getPublicKey(secretKey);\n * const msg = new TextEncoder().encode('hello');\n * const sig = schnorr.sign(msg, secretKey);\n * const isValid = schnorr.verify(sig, msg, publicKey);\n * ```\n */\nexport const schnorr = /* @__PURE__ */ (() => {\n    const size = 32;\n    const seedLength = 48;\n    const randomSecretKey = (seed = randomBytes(seedLength)) => {\n        return mapHashToField(seed, secp256k1_CURVE.n);\n    };\n    // TODO: remove\n    secp256k1.utils.randomSecretKey;\n    function keygen(seed) {\n        const secretKey = randomSecretKey(seed);\n        return { secretKey, publicKey: schnorrGetPublicKey(secretKey) };\n    }\n    return {\n        keygen,\n        getPublicKey: schnorrGetPublicKey,\n        sign: schnorrSign,\n        verify: schnorrVerify,\n        Point: Pointk1,\n        utils: {\n            randomSecretKey: randomSecretKey,\n            randomPrivateKey: randomSecretKey,\n            taggedHash,\n            // TODO: remove\n            lift_x,\n            pointToBytes,\n            numberToBytesBE,\n            bytesToNumberBE,\n            mod,\n        },\n        lengths: {\n            secretKey: size,\n            publicKey: size,\n            publicKeyHasPrefix: false,\n            signature: size * 2,\n            seed: seedLength,\n        },\n    };\n})();\nconst isoMap = /* @__PURE__ */ (() => isogenyMap(Fpk1, [\n    // xNum\n    [\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7',\n        '0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581',\n        '0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262',\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c',\n    ],\n    // xDen\n    [\n        '0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b',\n        '0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n    // yNum\n    [\n        '0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c',\n        '0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3',\n        '0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931',\n        '0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84',\n    ],\n    // yDen\n    [\n        '0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b',\n        '0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573',\n        '0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n].map((i) => i.map((j) => BigInt(j)))))();\nconst mapSWU = /* @__PURE__ */ (() => mapToCurveSimpleSWU(Fpk1, {\n    A: BigInt('0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533'),\n    B: BigInt('1771'),\n    Z: Fpk1.create(BigInt('-11')),\n}))();\n/** Hashing / encoding to secp256k1 points / field. RFC 9380 methods. */\nexport const secp256k1_hasher = /* @__PURE__ */ (() => createHasher(secp256k1.Point, (scalars) => {\n    const { x, y } = mapSWU(Fpk1.create(scalars[0]));\n    return isoMap(x, y);\n}, {\n    DST: 'secp256k1_XMD:SHA-256_SSWU_RO_',\n    encodeDST: 'secp256k1_XMD:SHA-256_SSWU_NU_',\n    p: Fpk1.ORDER,\n    m: 1,\n    k: 128,\n    expand: 'xmd',\n    hash: sha256,\n}))();\n/** @deprecated use `import { secp256k1_hasher } from '@noble/curves/secp256k1.js';` */\nexport const hashToCurve = /* @__PURE__ */ (() => secp256k1_hasher.hashToCurve)();\n/** @deprecated use `import { secp256k1_hasher } from '@noble/curves/secp256k1.js';` */\nexport const encodeToCurve = /* @__PURE__ */ (() => secp256k1_hasher.encodeToCurve)();\n//# sourceMappingURL=secp256k1.js.map","/**\n * Utilities for short weierstrass curves, combined with noble-hashes.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { weierstrass } from \"./abstract/weierstrass.js\";\n/** connects noble-curves to noble-hashes */\nexport function getHash(hash) {\n    return { hash };\n}\n/** @deprecated use new `weierstrass()` and `ecdsa()` methods */\nexport function createCurve(curveDef, defHash) {\n    const create = (hash) => weierstrass({ ...curveDef, hash: hash });\n    return { ...create(defHash), create };\n}\n//# sourceMappingURL=_shortw_utils.js.map"],"names":["HMAC","Hash","constructor","hash","_key","super","this","finished","destroyed","ahash","key","toBytes","iHash","create","update","Error","blockLen","outputLen","pad","Uint8Array","set","length","digest","i","oHash","clean","buf","aexists","digestInto","out","abytes","destroy","_cloneInto","to","Object","getPrototypeOf","clone","hmac","message","_0n","_1n","_abool2","value","title","_abytes2","bytes","isBytes_","len","needsLen","numberToHexUnpadded","num","hex","toString","hexToNumber","BigInt","bytesToNumberBE","bytesToHex_","bytesToNumberLE","abytes_","from","reverse","numberToBytesBE","n","hexToBytes_","padStart","numberToBytesLE","ensureBytes","expectedLength","res","e","isPosBig","aInRange","min","max","inRange","bitLen","bitMask","_validateObject","object","fields","optFields","checkField","fieldName","expectedType","isOpt","val","current","entries","forEach","k","v","memoized","fn","map","WeakMap","arg","args","get","computed","_2n","_3n","_4n","_5n","_7n","_8n","_9n","_16n","mod","a","b","result","pow2","x","power","modulo","invert","number","u","r","m","assertIsSquare","Fp","root","eql","sqr","sqrt3mod4","p1div4","ORDER","pow","sqrt5mod8","p5div8","n2","mul","nv","sub","ONE","tonelliShanks","P","Q","S","Z","_Fp","Field","FpLegendre","cc","Q1div2","is0","M","c","t","R","ZERO","t_tmp","exponent","FpSqrt","Fp_","tn","c1","neg","c2","c3","c4","tv1","tv2","tv3","tv4","e1","e2","cmov","e3","sqrt9mod16","FIELD_FIELDS","FpInvertBatch","nums","passZero","inverted","Array","fill","multipliedAcc","reduce","acc","invertedAcc","inv","reduceRight","p1mod2","powered","yes","zero","no","nLength","nBitLength","anumber","_nBitLength","nByteLength","Math","ceil","bitLenOrOpts","isLE","opts","_nbitLength","_sqrt","allowedLengths","modFromBytes","sqrt","_opts","BITS","BYTES","sqrtP","f","freeze","MASK","isValid","isValidNot0","isOdd","lhs","rhs","add","p","d","FpPow","div","sqrN","addN","subN","mulN","fromBytes","skipValidation","includes","padded","scalar","invertBatch","lst","getFieldBytesLength","fieldOrder","bitLength","getMinHashLength","negateCt","condition","item","negate","normalizeZ","points","invertedZs","fromAffine","toAffine","validateW","W","bits","Number","isSafeInteger","calcWOpts","scalarBits","maxNumber","windows","windowSize","mask","shiftBy","calcOffsets","window","wOpts","wbits","nextN","offsetStart","offset","abs","isZero","isNeg","isNegF","offsetF","pointPrecomputes","pointWindowSizes","getW","assert0","wNAF","Point","BASE","Fn","_unsafeLadder","elm","double","precomputeWindow","point","base","push","precomputes","wo","wNAFUnsafe","getPrecomputes","transform","comp","cached","unsafe","prev","createCache","delete","hasCache","pippenger","fieldN","scalars","isArray","validateMSMPoints","field","s","validateMSMScalars","plength","slength","buckets","sum","floor","j","resI","sumI","createField","order","validateField","divNearest","den","validateSigFormat","format","validateSigOpts","def","optsn","optName","keys","abool","lowS","prehash","DERErr","DER","Err","_tlv","encode","tag","data","E","dataLen","lenLen","decode","pos","first","lengthBytes","subarray","l","_int","parseInt","toSig","int","tlv","seqBytes","seqLeftBytes","rBytes","rLeftBytes","sBytes","sLeftBytes","hexFromSig","sig","seq","_normFnElement","expected","error","weierstrassN","params","extraOpts","validated","type","CURVE","curveOpts","FpFnLE","assign","_createCurveFields","h","cofactor","CURVE_ORDER","allowInfinityPoint","clearCofactor","isTorsionFree","endo","wrapPrivateKey","beta","basises","lengths","getWLengths","assertCompressionIsSupported","encodePoint","_c","isCompressed","y","bx","hasEvenY","concatBytes","pprefix","of","decodePoint","publicKey","publicKeyUncompressed","uncomp","head","tail","L","isValidXY","y2","weierstrassEquation","sqrtError","err","x2","x3","left","right","Gx","Gy","_4a3","_27b2","acoord","banZero","aprjpoint","other","splitEndoScalarN","basis","a1","b1","a2","b2","k1","k2","k1neg","k2neg","MAX_NUM","_splitEndoScalar","toAffineMemo","iz","X","Y","zz","assertValidMemo","finishEndo","endoBeta","k1p","k2p","assertValidity","fromHex","precompute","isLazy","wnaf","multiply","equals","X1","Y1","Z1","X2","Y2","Z2","U1","U2","b3","X3","Y3","Z3","t0","t1","t2","t3","t4","t5","subtract","fake","k1f","k2f","multiplyUnsafe","sc","p1","p2","mulEndoUnsafe","multiplyAndAddUnsafe","invertedZ","isSmallOrder","toHex","bytesToHex","px","py","pz","toRawBytes","_setWindowSize","msm","fromPrivateKey","privateKey","secretKey","publicKeyHasPrefix","signature","ecdh","ecdhOpts","randomBytes_","randomBytes","randomBytesWeb","seed","isValidSecretKey","randomSecretKey","fieldLen","minLen","reduced","mapHashToField","getPublicKey","isProbPub","utils","isValidPublicKey","isValidPrivateKey","randomPrivateKey","normPrivateKeyToScalar","getSharedSecret","secretKeyA","publicKeyB","keygen","ecdsa","ecdsaOpts","bits2int","bits2int_modN","msgs","nobleHmac","fnBits","defaultSigOpts","extraEntropy","defaultSigOpts_format","isBiggerThanHalfOrder","validateRS","Signature","recovery","recid","size","validateSigLength","hexToBytes","addRecoveryBit","recoverPublicKey","messageHash","FIELD_ORDER","rec","radj","ir","u1","u2","hasHighS","fromCompact","fromDER","normalizeS","toDERRawBytes","toDERHex","toCompactRawBytes","toCompactHex","delta","ORDER_MASK","int2octets","validateMsgAndHash","sign","k2sig","some","h1int","seedArgs","kBytes","ik","q","normS","prepSig","hashLen","qByteLen","hmacFn","u8n","u8of","byte","reset","reseed","gen","sl","slice","concatBytes_","pred","createHmacDrbg","drbg","verify","sg","isHex","isBytes","isObj","derError","tryParsingSig","is","_ecdsa_legacy_opts_to_new","allowedPrivateKeyLengths","Set","_weierstrass_legacy_opts_to_new","weierstrass","_ecdsa","ProjectivePoint","_ecdsa_new_output_to_legacy","secp256k1_CURVE","secp256k1_ENDO","Fpk1","_6n","_11n","_22n","_23n","_44n","_88n","b6","b9","b11","b22","b44","b88","b176","b220","b223","secp256k1","curveDef","defHash","createCurve","sha256"],"mappings":"wHAKO,MAAMA,UAAaC,EAAAA,KACtB,WAAAC,CAAYC,EAAMC,GACdC,QACAC,KAAKC,UAAW,EAChBD,KAAKE,WAAY,EACjBC,EAAAA,MAAMN,GACN,MAAMO,EAAMC,EAAAA,QAAQP,GAEpB,GADAE,KAAKM,MAAQT,EAAKU,SACe,mBAAtBP,KAAKM,MAAME,OAClB,MAAM,IAAIC,MAAM,uDACpBT,KAAKU,SAAWV,KAAKM,MAAMI,SAC3BV,KAAKW,UAAYX,KAAKM,MAAMK,UAC5B,MAAMD,EAAWV,KAAKU,SAChBE,EAAM,IAAIC,WAAWH,GAE3BE,EAAIE,IAAIV,EAAIW,OAASL,EAAWb,EAAKU,SAASC,OAAOJ,GAAKY,SAAWZ,GACrE,IAAA,IAASa,EAAI,EAAGA,EAAIL,EAAIG,OAAQE,IAC5BL,EAAIK,IAAM,GACdjB,KAAKM,MAAME,OAAOI,GAElBZ,KAAKkB,MAAQrB,EAAKU,SAElB,IAAA,IAASU,EAAI,EAAGA,EAAIL,EAAIG,OAAQE,IAC5BL,EAAIK,IAAM,IACdjB,KAAKkB,MAAMV,OAAOI,GAClBO,EAAAA,MAAMP,EACV,CACA,MAAAJ,CAAOY,GAGH,OAFAC,EAAAA,QAAQrB,MACRA,KAAKM,MAAME,OAAOY,GACXpB,IACX,CACA,UAAAsB,CAAWC,GACPF,EAAAA,QAAQrB,MACRwB,SAAOD,EAAKvB,KAAKW,WACjBX,KAAKC,UAAW,EAChBD,KAAKM,MAAMgB,WAAWC,GACtBvB,KAAKkB,MAAMV,OAAOe,GAClBvB,KAAKkB,MAAMI,WAAWC,GACtBvB,KAAKyB,SACT,CACA,MAAAT,GACI,MAAMO,EAAM,IAAIV,WAAWb,KAAKkB,MAAMP,WAEtC,OADAX,KAAKsB,WAAWC,GACTA,CACX,CACA,UAAAG,CAAWC,GAEPA,IAAOA,EAAKC,OAAOrB,OAAOqB,OAAOC,eAAe7B,MAAO,CAAA,IACvD,MAAMkB,MAAEA,EAAAZ,MAAOA,EAAAL,SAAOA,YAAUC,EAAAQ,SAAWA,EAAAC,UAAUA,GAAcX,KAQnE,OANA2B,EAAG1B,SAAWA,EACd0B,EAAGzB,UAAYA,EACfyB,EAAGjB,SAAWA,EACdiB,EAAGhB,UAAYA,EACfgB,EAAGT,MAAQA,EAAMQ,WAAWC,EAAGT,OAC/BS,EAAGrB,MAAQA,EAAMoB,WAAWC,EAAGrB,OACxBqB,CACX,CACA,KAAAG,GACI,OAAO9B,KAAK0B,YAChB,CACA,OAAAD,GACIzB,KAAKE,WAAY,EACjBF,KAAKkB,MAAMO,UACXzB,KAAKM,MAAMmB,SACf,EAYG,MAAMM,EAAO,CAAClC,EAAMO,EAAK4B,IAAY,IAAItC,EAAKG,EAAMO,GAAKI,OAAOwB,GAAShB,SAChFe,EAAKxB,OAAS,CAACV,EAAMO,IAAQ,IAAIV,EAAKG,EAAMO;;AC7E5C,MAAM6B,SAA6B,GAC7BC,SAA6B,GAM5B,SAASC,EAAQC,EAAOC,EAAQ,IACnC,GAAqB,kBAAVD,EAAqB,CAE5B,MAAM,IAAI3B,OADK4B,GAAS,IAAIA,MACH,qCAAuCD,EACpE,CACA,OAAOA,CACX,CAGO,SAASE,EAASF,EAAOrB,EAAQsB,EAAQ,IAC5C,MAAME,EAAQC,EAAAA,QAASJ,GACjBK,EAAML,GAAOrB,OACb2B,OAAsB,IAAX3B,EACjB,IAAKwB,GAAUG,GAAYD,IAAQ1B,EAAS,CAIxC,MAAM,IAAIN,OAHK4B,GAAS,IAAIA,OAGH,uBAFXK,EAAW,cAAc3B,IAAW,IAEO,UAD7CwB,EAAQ,UAAUE,IAAQ,eAAeL,GAEzD,CACA,OAAOA,CACX,CAEO,SAASO,EAAoBC,GAChC,MAAMC,EAAMD,EAAIE,SAAS,IACzB,OAAoB,EAAbD,EAAI9B,OAAa,IAAM8B,EAAMA,CACxC,CACO,SAASE,EAAYF,GACxB,GAAmB,iBAARA,EACP,MAAM,IAAIpC,MAAM,mCAAqCoC,GACzD,MAAe,KAARA,EAAaZ,EAAMe,OAAO,KAAOH,EAC5C,CAEO,SAASI,EAAgBV,GAC5B,OAAOQ,EAAYG,aAAYX,GACnC,CACO,SAASY,EAAgBZ,GAE5B,OADAa,EAAAA,OAAQb,GACDQ,EAAYG,EAAAA,WAAYrC,WAAWwC,KAAKd,GAAOe,WAC1D,CACO,SAASC,EAAgBC,EAAGf,GAC/B,OAAOgB,EAAAA,WAAYD,EAAEV,SAAS,IAAIY,SAAe,EAANjB,EAAS,KACxD,CACO,SAASkB,EAAgBH,EAAGf,GAC/B,OAAOc,EAAgBC,EAAGf,GAAKa,SACnC,CAcO,SAASM,EAAYvB,EAAOQ,EAAKgB,GACpC,IAAIC,EACJ,GAAmB,iBAARjB,EACP,IACIiB,EAAML,EAAAA,WAAYZ,EACtB,OACOkB,GACH,MAAM,IAAItD,MAAM4B,EAAQ,6CAA+C0B,EAC3E,KACJ,KACSvB,EAAAA,QAASK,GAMd,MAAM,IAAIpC,MAAM4B,EAAQ,qCAHxByB,EAAMjD,WAAWwC,KAAKR,EAI1B,CAIA,OAHYiB,EAAI/C,OAGT+C,CACX,CAyCA,MAAME,EAAYR,GAAmB,iBAANA,GAAkBvB,GAAOuB,EASjD,SAASS,EAAS5B,EAAOmB,EAAGU,EAAKC,GAMpC,IAdG,SAAiBX,EAAGU,EAAKC,GAC5B,OAAOH,EAASR,IAAMQ,EAASE,IAAQF,EAASG,IAAQD,GAAOV,GAAKA,EAAIW,CAC5E,CAYSC,CAAQZ,EAAGU,EAAKC,GACjB,MAAM,IAAI1D,MAAM,kBAAoB4B,EAAQ,KAAO6B,EAAM,WAAaC,EAAM,SAAWX,EAC/F,CAOO,SAASa,EAAOb,GACnB,IAAIf,EACJ,IAAKA,EAAM,EAAGe,EAAIvB,EAAKuB,IAAMtB,EAAKO,GAAO,GAEzC,OAAOA,CACX,CAmBO,MAAM6B,EAAWd,IAAOtB,GAAOc,OAAOQ,IAAMtB,EAuG5C,SAASqC,EAAgBC,EAAQC,EAAQC,EAAY,CAAA,GACxD,IAAKF,GAA4B,iBAAXA,EAClB,MAAM,IAAI/D,MAAM,iCACpB,SAASkE,EAAWC,EAAWC,EAAcC,GACzC,MAAMC,EAAMP,EAAOI,GACnB,GAAIE,QAAiB,IAARC,EACT,OACJ,MAAMC,SAAiBD,EACvB,GAAIC,IAAYH,GAAwB,OAARE,EAC5B,MAAM,IAAItE,MAAM,UAAUmE,2BAAmCC,UAAqBG,IAC1F,CACApD,OAAOqD,QAAQR,GAAQS,QAAQ,EAAEC,EAAGC,KAAOT,EAAWQ,EAAGC,GAAG,IAC5DxD,OAAOqD,QAAQP,GAAWQ,QAAQ,EAAEC,EAAGC,KAAOT,EAAWQ,EAAGC,GAAG,GACnE,CAWO,SAASC,EAASC,GACrB,MAAMC,MAAUC,QAChB,MAAO,CAACC,KAAQC,KACZ,MAAMX,EAAMQ,EAAII,IAAIF,GACpB,QAAY,IAARV,EACA,OAAOA,EACX,MAAMa,EAAWN,EAAGG,KAAQC,GAE5B,OADAH,EAAIzE,IAAI2E,EAAKG,GACNA,EAEf;sECvTA,MAAM3D,EAAMe,OAAO,GAAId,EAAMc,OAAO,GAAI6C,EAAsB7C,OAAO,GAAI8C,SAA6B,GAEhGC,EAAsB/C,OAAO,GAAIgD,SAA6B,GAAIC,EAAsBjD,OAAO,GAE/FkD,EAAsBlD,OAAO,GAAImD,SAA6B,GAAIC,EAAuBpD,OAAO,IAE/F,SAASqD,EAAIC,EAAGC,GACnB,MAAMC,EAASF,EAAIC,EACnB,OAAOC,GAAUvE,EAAMuE,EAASD,EAAIC,CACxC,CAWO,SAASC,EAAKC,EAAGC,EAAOC,GAC3B,IAAI9C,EAAM4C,EACV,KAAOC,KAAU1E,GACb6B,GAAOA,EACPA,GAAO8C,EAEX,OAAO9C,CACX,CAKO,SAAS+C,EAAOC,EAAQF,GAC3B,GAAIE,IAAW7E,EACX,MAAM,IAAIxB,MAAM,oCACpB,GAAImG,GAAU3E,EACV,MAAM,IAAIxB,MAAM,0CAA4CmG,GAEhE,IAAIN,EAAID,EAAIS,EAAQF,GAChBL,EAAIK,EAEJF,EAAIzE,EAAc8E,EAAI7E,EAC1B,KAAOoE,IAAMrE,GAAK,CAEd,MACM+E,EAAIT,EAAID,EACRW,EAAIP,EAAIK,GAFJR,EAAID,GAKdC,EAAID,EAAGA,EAAIU,EAAGN,EAAIK,EAAUA,EAAIE,CACpC,CAEA,GADYV,IACArE,EACR,MAAM,IAAIzB,MAAM,0BACpB,OAAO4F,EAAIK,EAAGE,EAClB,CACA,SAASM,EAAeC,EAAIC,EAAM5D,GAC9B,IAAK2D,EAAGE,IAAIF,EAAGG,IAAIF,GAAO5D,GACtB,MAAM,IAAI/C,MAAM,0BACxB,CAKA,SAAS8G,EAAUJ,EAAI3D,GACnB,MAAMgE,GAAUL,EAAGM,MAAQvF,GAAO6D,EAC5BqB,EAAOD,EAAGO,IAAIlE,EAAGgE,GAEvB,OADAN,EAAeC,EAAIC,EAAM5D,GAClB4D,CACX,CACA,SAASO,EAAUR,EAAI3D,GACnB,MAAMoE,GAAUT,EAAGM,MAAQzB,GAAOE,EAC5B2B,EAAKV,EAAGW,IAAItE,EAAGqC,GACfT,EAAI+B,EAAGO,IAAIG,EAAID,GACfG,EAAKZ,EAAGW,IAAItE,EAAG4B,GACfnE,EAAIkG,EAAGW,IAAIX,EAAGW,IAAIC,EAAIlC,GAAMT,GAC5BgC,EAAOD,EAAGW,IAAIC,EAAIZ,EAAGa,IAAI/G,EAAGkG,EAAGc,MAErC,OADAf,EAAeC,EAAIC,EAAM5D,GAClB4D,CACX,CAgCO,SAASc,EAAcC,GAG1B,GAAIA,EAAIrC,EACJ,MAAM,IAAIrF,MAAM,uCAEpB,IAAI2H,EAAID,EAAIjG,EACRmG,EAAI,EACR,KAAOD,EAAIvC,IAAQ5D,GACfmG,GAAKvC,EACLwC,IAGJ,IAAIC,EAAIzC,EACR,MAAM0C,EAAMC,EAAML,GAClB,KAA8B,IAAvBM,EAAWF,EAAKD,IAGnB,GAAIA,IAAM,IACN,MAAM,IAAI7H,MAAM,iDAGxB,GAAU,IAAN4H,EACA,OAAOd,EAGX,IAAImB,EAAKH,EAAIb,IAAIY,EAAGF,GACpB,MAAMO,GAAUP,EAAIlG,GAAO2D,EAC3B,OAAO,SAAqBsB,EAAI3D,GAC5B,GAAI2D,EAAGyB,IAAIpF,GACP,OAAOA,EAEX,GAA0B,IAAtBiF,EAAWtB,EAAI3D,GACf,MAAM,IAAI/C,MAAM,2BAEpB,IAAIoI,EAAIR,EACJS,EAAI3B,EAAGW,IAAIX,EAAGc,IAAKS,GACnBK,EAAI5B,EAAGO,IAAIlE,EAAG4E,GACdY,EAAI7B,EAAGO,IAAIlE,EAAGmF,GAGlB,MAAQxB,EAAGE,IAAI0B,EAAG5B,EAAGc,MAAM,CACvB,GAAId,EAAGyB,IAAIG,GACP,OAAO5B,EAAG8B,KACd,IAAIhI,EAAI,EAEJiI,EAAQ/B,EAAGG,IAAIyB,GACnB,MAAQ5B,EAAGE,IAAI6B,EAAO/B,EAAGc,MAGrB,GAFAhH,IACAiI,EAAQ/B,EAAGG,IAAI4B,GACXjI,IAAM4H,EACN,MAAM,IAAIpI,MAAM,2BAGxB,MAAM0I,EAAWjH,GAAOc,OAAO6F,EAAI5H,EAAI,GACjCsF,EAAIY,EAAGO,IAAIoB,EAAGK,GAEpBN,EAAI5H,EACJ6H,EAAI3B,EAAGG,IAAIf,GACXwC,EAAI5B,EAAGW,IAAIiB,EAAGD,GACdE,EAAI7B,EAAGW,IAAIkB,EAAGzC,EAClB,CACA,OAAOyC,CACX,CACJ,CAYO,SAASI,EAAOjB,GAEnB,OAAIA,EAAIpC,IAAQD,EACLyB,EAEPY,EAAIjC,IAAQF,EACL2B,EAEPQ,EAAI/B,IAASD,EAjHrB,SAAoBgC,GAChB,MAAMkB,EAAMb,EAAML,GACZmB,EAAKpB,EAAcC,GACnBoB,EAAKD,EAAGD,EAAKA,EAAIG,IAAIH,EAAIpB,MACzBwB,EAAKH,EAAGD,EAAKE,GACbG,EAAKJ,EAAGD,EAAKA,EAAIG,IAAID,IACrBI,GAAMxB,EAAIlC,GAAOG,EACvB,MAAO,CAACe,EAAI3D,KACR,IAAIoG,EAAMzC,EAAGO,IAAIlE,EAAGmG,GAChBE,EAAM1C,EAAGW,IAAI8B,EAAKL,GACtB,MAAMO,EAAM3C,EAAGW,IAAI8B,EAAKH,GAClBM,EAAM5C,EAAGW,IAAI8B,EAAKF,GAClBM,EAAK7C,EAAGE,IAAIF,EAAGG,IAAIuC,GAAMrG,GACzByG,EAAK9C,EAAGE,IAAIF,EAAGG,IAAIwC,GAAMtG,GAC/BoG,EAAMzC,EAAG+C,KAAKN,EAAKC,EAAKG,GACxBH,EAAM1C,EAAG+C,KAAKH,EAAKD,EAAKG,GACxB,MAAME,EAAKhD,EAAGE,IAAIF,EAAGG,IAAIuC,GAAMrG,GACzB4D,EAAOD,EAAG+C,KAAKN,EAAKC,EAAKM,GAE/B,OADAjD,EAAeC,EAAIC,EAAM5D,GAClB4D,EAEf,CA6FegD,CAAWjC,GAEfD,EAAcC,EACzB,CAIA,MAAMkC,EAAe,CACjB,SAAU,UAAW,MAAO,MAAO,MAAO,OAAQ,MAClD,MAAO,MAAO,MAAO,MAAO,MAAO,MACnC,OAAQ,OAAQ,OAAQ,QA8CrB,SAASC,EAAcnD,EAAIoD,EAAMC,GAAW,GAC/C,MAAMC,EAAW,IAAIC,MAAMH,EAAKxJ,QAAQ4J,KAAKH,EAAWrD,EAAG8B,UAAO,GAE5D2B,EAAgBL,EAAKM,OAAO,CAACC,EAAKlI,EAAK3B,IACrCkG,EAAGyB,IAAIhG,GACAkI,GACXL,EAASxJ,GAAK6J,EACP3D,EAAGW,IAAIgD,EAAKlI,IACpBuE,EAAGc,KAEA8C,EAAc5D,EAAG6D,IAAIJ,GAQ3B,OANAL,EAAKU,YAAY,CAACH,EAAKlI,EAAK3B,IACpBkG,EAAGyB,IAAIhG,GACAkI,GACXL,EAASxJ,GAAKkG,EAAGW,IAAIgD,EAAKL,EAASxJ,IAC5BkG,EAAGW,IAAIgD,EAAKlI,IACpBmI,GACIN,CACX,CAcO,SAAShC,EAAWtB,EAAI3D,GAG3B,MAAM0H,GAAU/D,EAAGM,MAAQvF,GAAO2D,EAC5BsF,EAAUhE,EAAGO,IAAIlE,EAAG0H,GACpBE,EAAMjE,EAAGE,IAAI8D,EAAShE,EAAGc,KACzBoD,EAAOlE,EAAGE,IAAI8D,EAAShE,EAAG8B,MAC1BqC,EAAKnE,EAAGE,IAAI8D,EAAShE,EAAGqC,IAAIrC,EAAGc,MACrC,IAAKmD,IAAQC,IAASC,EAClB,MAAM,IAAI7K,MAAM,kCACpB,OAAO2K,EAAM,EAAIC,EAAO,GAAI,CAChC,CAOO,SAASE,EAAQ/H,EAAGgI,QAEJ,IAAfA,GACAC,EAAAA,QAAQD,GACZ,MAAME,OAA6B,IAAfF,EAA2BA,EAAahI,EAAEV,SAAS,GAAG/B,OAE1E,MAAO,CAAEyK,WAAYE,EAAaC,YADdC,KAAKC,KAAKH,EAAc,GAEhD,CAoBO,SAASlD,EAAMf,EAAOqE,EAC7BC,GAAO,EAAOC,EAAO,IACjB,GAAIvE,GAASxF,EACT,MAAM,IAAIxB,MAAM,0CAA4CgH,GAChE,IAAIwE,EACAC,EAEAC,EADAC,GAAe,EAEnB,GAA4B,iBAAjBN,GAA6C,MAAhBA,EAAsB,CAC1D,GAAIE,EAAKK,MAAQN,EACb,MAAM,IAAItL,MAAM,wCACpB,MAAM6L,EAAQR,EACVQ,EAAMC,OACNN,EAAcK,EAAMC,MACpBD,EAAMD,OACNH,EAAQI,EAAMD,MACQ,kBAAfC,EAAMP,OACbA,EAAOO,EAAMP,MACiB,kBAAvBO,EAAMF,eACbA,EAAeE,EAAMF,cACzBD,EAAiBG,EAAMH,cAC3B,KAEgC,iBAAjBL,IACPG,EAAcH,GACdE,EAAKK,OACLH,EAAQF,EAAKK,MAErB,MAAQb,WAAYe,EAAMZ,YAAaa,GAAUjB,EAAQ9D,EAAOwE,GAChE,GAAIO,EAAQ,KACR,MAAM,IAAI/L,MAAM,kDACpB,IAAIgM,EACJ,MAAMC,EAAI9K,OAAO+K,OAAO,CACpBlF,QACAsE,OACAQ,OACAC,QACAI,KAAMtI,EAAQiI,GACdtD,KAAMhH,EACNgG,IAAK/F,EACLiK,iBACA5L,OAASqC,GAAQyD,EAAIzD,EAAK6E,GAC1BoF,QAAUjK,IACN,GAAmB,iBAARA,EACP,MAAM,IAAInC,MAAM,sDAAwDmC,GAC5E,OAAOX,GAAOW,GAAOA,EAAM6E,GAE/BmB,IAAMhG,GAAQA,IAAQX,EAEtB6K,YAAclK,IAAS8J,EAAE9D,IAAIhG,IAAQ8J,EAAEG,QAAQjK,GAC/CmK,MAAQnK,IAASA,EAAMV,KAASA,EAChCsH,IAAM5G,GAAQyD,GAAKzD,EAAK6E,GACxBJ,IAAK,CAAC2F,EAAKC,IAAQD,IAAQC,EAC3B3F,IAAM1E,GAAQyD,EAAIzD,EAAMA,EAAK6E,GAC7ByF,IAAK,CAACF,EAAKC,IAAQ5G,EAAI2G,EAAMC,EAAKxF,GAClCO,IAAK,CAACgF,EAAKC,IAAQ5G,EAAI2G,EAAMC,EAAKxF,GAClCK,IAAK,CAACkF,EAAKC,IAAQ5G,EAAI2G,EAAMC,EAAKxF,GAClCC,IAAK,CAAC9E,EAAK+D,IA7JZ,SAAeQ,EAAIvE,EAAK+D,GAC3B,GAAIA,EAAQ1E,EACR,MAAM,IAAIxB,MAAM,2CACpB,GAAIkG,IAAU1E,EACV,OAAOkF,EAAGc,IACd,GAAItB,IAAUzE,EACV,OAAOU,EACX,IAAIuK,EAAIhG,EAAGc,IACPmF,EAAIxK,EACR,KAAO+D,EAAQ1E,GACP0E,EAAQzE,IACRiL,EAAIhG,EAAGW,IAAIqF,EAAGC,IAClBA,EAAIjG,EAAGG,IAAI8F,GACXzG,IAAUzE,EAEd,OAAOiL,CACX,CA6I6BE,CAAMX,EAAG9J,EAAK+D,GACnC2G,IAAK,CAACN,EAAKC,IAAQ5G,EAAI2G,EAAMnG,EAAOoG,EAAKxF,GAAQA,GAEjD8F,KAAO3K,GAAQA,EAAMA,EACrB4K,KAAM,CAACR,EAAKC,IAAQD,EAAMC,EAC1BQ,KAAM,CAACT,EAAKC,IAAQD,EAAMC,EAC1BS,KAAM,CAACV,EAAKC,IAAQD,EAAMC,EAC1BjC,IAAMpI,GAAQiE,EAAOjE,EAAK6E,GAC1B4E,KAAMH,GAAA,CACA1I,IACOiJ,IACDA,EAAQrD,EAAO3B,IACZgF,EAAMC,EAAGlJ,KAExBnD,QAAUuC,GAASmJ,EAAOpI,EAAgBf,EAAK4J,GAASjJ,EAAgBX,EAAK4J,GAC7EmB,UAAW,CAACpL,EAAOqL,GAAiB,KAChC,GAAIzB,EAAgB,CAChB,IAAKA,EAAe0B,SAAStL,EAAMxB,SAAWwB,EAAMxB,OAASyL,EACzD,MAAM,IAAI/L,MAAM,6BAA+B0L,EAAiB,eAAiB5J,EAAMxB,QAE3F,MAAM+M,EAAS,IAAIjN,WAAW2L,GAE9BsB,EAAOhN,IAAIyB,EAAOwJ,EAAO,EAAI+B,EAAO/M,OAASwB,EAAMxB,QACnDwB,EAAQuL,CACZ,CACA,GAAIvL,EAAMxB,SAAWyL,EACjB,MAAM,IAAI/L,MAAM,6BAA+B+L,EAAQ,eAAiBjK,EAAMxB,QAClF,IAAIgN,EAAShC,EAAO5I,EAAgBZ,GAASU,EAAgBV,GAG7D,GAFI6J,IACA2B,EAAS1H,EAAI0H,EAAQtG,KACpBmG,IACIlB,EAAEG,QAAQkB,GACX,MAAM,IAAItN,MAAM,oDAGxB,OAAOsN,GAGXC,YAAcC,GAAQ3D,EAAcoC,EAAGuB,GAGvC/D,KAAM,CAAC5D,EAAGC,EAAGuC,IAAOA,EAAIvC,EAAID,IAEhC,OAAO1E,OAAO+K,OAAOD,EACzB,CA+CO,SAASwB,EAAoBC,GAChC,GAA0B,iBAAfA,EACP,MAAM,IAAI1N,MAAM,8BACpB,MAAM2N,EAAYD,EAAWrL,SAAS,GAAG/B,OACzC,OAAO6K,KAAKC,KAAKuC,EAAY,EACjC,CAQO,SAASC,EAAiBF,GAC7B,MAAMpN,EAASmN,EAAoBC,GACnC,OAAOpN,EAAS6K,KAAKC,KAAK9K,EAAS,EACvC;;AC/eA,MAAMkB,EAAMe,OAAO,GACbd,EAAMc,OAAO,GACZ,SAASsL,EAASC,EAAWC,GAChC,MAAMhF,EAAMgF,EAAKC,SACjB,OAAOF,EAAY/E,EAAMgF,CAC7B,CAOO,SAASE,EAAW5F,EAAG6F,GAC1B,MAAMC,EAAatE,EAAcxB,EAAE3B,GAAIwH,EAAOpJ,IAAK4H,GAAMA,EAAE7E,IAC3D,OAAOqG,EAAOpJ,IAAI,CAAC4H,EAAGlM,IAAM6H,EAAE+F,WAAW1B,EAAE2B,SAASF,EAAW3N,KACnE,CACA,SAAS8N,EAAUC,EAAGC,GAClB,IAAKC,OAAOC,cAAcH,IAAMA,GAAK,GAAKA,EAAIC,EAC1C,MAAM,IAAIxO,MAAM,qCAAuCwO,EAAO,YAAcD,EACpF,CACA,SAASI,EAAUJ,EAAGK,GAClBN,EAAUC,EAAGK,GACb,MAEMC,EAAY,GAAKN,EAGvB,MAAO,CAAEO,QALO3D,KAAKC,KAAKwD,EAAaL,GAAK,EAK1BQ,WAJC,IAAMR,EAAI,GAICS,KAFjBnL,EAAQ0K,GAEeM,YAAWI,QAD/B1M,OAAOgM,GAE3B,CACA,SAASW,EAAYnM,EAAGoM,EAAQC,GAC5B,MAAML,WAAEA,EAAAC,KAAYA,EAAAH,UAAMA,EAAAI,QAAWA,GAAYG,EACjD,IAAIC,EAAQZ,OAAO1L,EAAIiM,GACnBM,EAAQvM,GAAKkM,EAMbI,EAAQN,IAERM,GAASR,EACTS,GAAS7N,GAEb,MAAM8N,EAAcJ,EAASJ,EAM7B,MAAO,CAAEO,QAAOE,OALDD,EAAcpE,KAAKsE,IAAIJ,GAAS,EAKvBK,OAJC,IAAVL,EAIiBM,MAHlBN,EAAQ,EAGiBO,OAFxBT,EAAS,GAAM,EAEiBU,QAD/BN,EAEpB,CAoBA,MAAMO,MAAuB/K,QACvBgL,MAAuBhL,QAC7B,SAASiL,GAAKtI,GAGV,OAAOqI,EAAiB7K,IAAIwC,IAAM,CACtC,CACA,SAASuI,GAAQlN,GACb,GAAIA,IAAMvB,EACN,MAAM,IAAIxB,MAAM,eACxB,CAmBO,MAAMkQ,GAET,WAAA/Q,CAAYgR,EAAO3B,GACfjP,KAAK6Q,KAAOD,EAAMC,KAClB7Q,KAAKiJ,KAAO2H,EAAM3H,KAClBjJ,KAAK8Q,GAAKF,EAAME,GAChB9Q,KAAKiP,KAAOA,CAChB,CAEA,aAAA8B,CAAcC,EAAKxN,EAAG2J,EAAInN,KAAKiJ,MAC3B,IAAImE,EAAI4D,EACR,KAAOxN,EAAIvB,GACHuB,EAAItB,IACJiL,EAAIA,EAAED,IAAIE,IACdA,EAAIA,EAAE6D,SACNzN,IAAMtB,EAEV,OAAOiL,CACX,CAaA,gBAAA+D,CAAiBC,EAAOnC,GACpB,MAAMO,QAAEA,EAAAC,WAASA,GAAeJ,EAAUJ,EAAGhP,KAAKiP,MAC5CN,EAAS,GACf,IAAIxB,EAAIgE,EACJC,EAAOjE,EACX,IAAA,IAASyC,EAAS,EAAGA,EAASL,EAASK,IAAU,CAC7CwB,EAAOjE,EACPwB,EAAO0C,KAAKD,GAEZ,IAAA,IAASnQ,EAAI,EAAGA,EAAIuO,EAAYvO,IAC5BmQ,EAAOA,EAAKlE,IAAIC,GAChBwB,EAAO0C,KAAKD,GAEhBjE,EAAIiE,EAAKH,QACb,CACA,OAAOtC,CACX,CAOA,IAAAgC,CAAK3B,EAAGsC,EAAa9N,GAEjB,IAAKxD,KAAK8Q,GAAGjE,QAAQrJ,GACjB,MAAM,IAAI/C,MAAM,kBAEpB,IAAI0M,EAAInN,KAAKiJ,KACTyD,EAAI1M,KAAK6Q,KAMb,MAAMU,EAAKnC,EAAUJ,EAAGhP,KAAKiP,MAC7B,IAAA,IAASW,EAAS,EAAGA,EAAS2B,EAAGhC,QAASK,IAAU,CAEhD,MAAMG,MAAEA,EAAAE,OAAOA,EAAAE,OAAQA,EAAAC,MAAQA,EAAAC,OAAOA,EAAAC,QAAQA,GAAYX,EAAYnM,EAAGoM,EAAQ2B,GACjF/N,EAAIuM,EACAI,EAGAzD,EAAIA,EAAEQ,IAAIoB,EAAS+B,EAAQiB,EAAYhB,KAIvCnD,EAAIA,EAAED,IAAIoB,EAAS8B,EAAOkB,EAAYrB,IAE9C,CAKA,OAJAS,GAAQlN,GAID,CAAE2J,IAAGT,IAChB,CAMA,UAAA8E,CAAWxC,EAAGsC,EAAa9N,EAAGsH,EAAM9K,KAAKiJ,MACrC,MAAMsI,EAAKnC,EAAUJ,EAAGhP,KAAKiP,MAC7B,IAAA,IAASW,EAAS,EAAGA,EAAS2B,EAAGhC,SACzB/L,IAAMvB,EAD4B2N,IAAU,CAGhD,MAAMG,MAAEA,SAAOE,EAAAE,OAAQA,EAAAC,MAAQA,GAAUT,EAAYnM,EAAGoM,EAAQ2B,GAEhE,GADA/N,EAAIuM,GACAI,EAKC,CACD,MAAM3B,EAAO8C,EAAYrB,GACzBnF,EAAMA,EAAIoC,IAAIkD,EAAQ5B,EAAKC,SAAWD,EAC1C,CACJ,CAEA,OADAkC,GAAQlN,GACDsH,CACX,CACA,cAAA2G,CAAezC,EAAGmC,EAAOO,GAErB,IAAIC,EAAOpB,EAAiB5K,IAAIwL,GAUhC,OATKQ,IACDA,EAAO3R,KAAKkR,iBAAiBC,EAAOnC,GAC1B,IAANA,IAEyB,mBAAd0C,IACPC,EAAOD,EAAUC,IACrBpB,EAAiBzP,IAAIqQ,EAAOQ,KAG7BA,CACX,CACA,MAAAC,CAAOT,EAAOpD,EAAQ2D,GAClB,MAAM1C,EAAIyB,GAAKU,GACf,OAAOnR,KAAK2Q,KAAK3B,EAAGhP,KAAKyR,eAAezC,EAAGmC,EAAOO,GAAY3D,EAClE,CACA,MAAA8D,CAAOV,EAAOpD,EAAQ2D,EAAWI,GAC7B,MAAM9C,EAAIyB,GAAKU,GACf,OAAU,IAANnC,EACOhP,KAAK+Q,cAAcI,EAAOpD,EAAQ+D,GACtC9R,KAAKwR,WAAWxC,EAAGhP,KAAKyR,eAAezC,EAAGmC,EAAOO,GAAY3D,EAAQ+D,EAChF,CAIA,WAAAC,CAAY5J,EAAG6G,GACXD,EAAUC,EAAGhP,KAAKiP,MAClBuB,EAAiB1P,IAAIqH,EAAG6G,GACxBuB,EAAiByB,OAAO7J,EAC5B,CACA,QAAA8J,CAASjB,GACL,OAAqB,IAAdP,GAAKO,EAChB,EA+BG,SAASkB,GAAUpJ,EAAGqJ,EAAQxD,EAAQyD,IAjO7C,SAA2BzD,EAAQ7F,GAC/B,IAAK4B,MAAM2H,QAAQ1D,GACf,MAAM,IAAIlO,MAAM,kBACpBkO,EAAOzJ,QAAQ,CAACiI,EAAGlM,KACf,KAAMkM,aAAarE,GACf,MAAM,IAAIrI,MAAM,0BAA4BQ,IAExD,CAiOIqR,CAAkB3D,EAAQ7F,GAhO9B,SAA4BsJ,EAASG,GACjC,IAAK7H,MAAM2H,QAAQD,GACf,MAAM,IAAI3R,MAAM,6BACpB2R,EAAQlN,QAAQ,CAACsN,EAAGvR,KAChB,IAAKsR,EAAM1F,QAAQ2F,GACf,MAAM,IAAI/R,MAAM,2BAA6BQ,IAEzD,CA0NIwR,CAAmBL,EAASD,GAC5B,MAAMO,EAAU/D,EAAO5N,OACjB4R,EAAUP,EAAQrR,OACxB,GAAI2R,IAAYC,EACZ,MAAM,IAAIlS,MAAM,uDAEpB,MAAM4K,EAAOvC,EAAEG,KACT6G,EAAQzL,EAAOrB,OAAO0P,IAC5B,IAAIlD,EAAa,EACbM,EAAQ,GACRN,EAAaM,EAAQ,EAChBA,EAAQ,EACbN,EAAaM,EAAQ,EAChBA,EAAQ,IACbN,EAAa,GACjB,MAAM5C,EAAOtI,EAAQkL,GACfoD,EAAU,IAAIlI,MAAMwE,OAAOtC,GAAQ,GAAGjC,KAAKU,GAEjD,IAAIwH,EAAMxH,EACV,IAAA,IAASpK,EAFQ2K,KAAKkH,OAAOX,EAAO5F,KAAO,GAAKiD,GAAcA,EAEvCvO,GAAK,EAAGA,GAAKuO,EAAY,CAC5CoD,EAAQjI,KAAKU,GACb,IAAA,IAAS0H,EAAI,EAAGA,EAAIJ,EAASI,IAAK,CAC9B,MAAMhF,EAASqE,EAAQW,GACjBjD,EAAQZ,OAAQnB,GAAU/K,OAAO/B,GAAM2L,GAC7CgG,EAAQ9C,GAAS8C,EAAQ9C,GAAO5C,IAAIyB,EAAOoE,GAC/C,CACA,IAAIC,EAAO3H,EAEX,IAAA,IAAS0H,EAAIH,EAAQ7R,OAAS,EAAGkS,EAAO5H,EAAM0H,EAAI,EAAGA,IACjDE,EAAOA,EAAK/F,IAAI0F,EAAQG,IACxBC,EAAOA,EAAK9F,IAAI+F,GAGpB,GADAJ,EAAMA,EAAI3F,IAAI8F,GACJ,IAAN/R,EACA,IAAA,IAAS8R,EAAI,EAAGA,EAAIvD,EAAYuD,IAC5BF,EAAMA,EAAI5B,QACtB,CACA,OAAO4B,CACX,CAoGA,SAASK,GAAYC,EAAOZ,EAAOxG,GAC/B,GAAIwG,EAAO,CACP,GAAIA,EAAM9K,QAAU0L,EAChB,MAAM,IAAI1S,MAAM,kDAEpB,OD1ND,SAAuB8R,GAW1BhO,EAAgBgO,EAJHlI,EAAaQ,OAAO,CAACtF,EAAKR,KACnCQ,EAAIR,GAAO,WACJQ,GARK,CACZkC,MAAO,SACPmF,KAAM,SACNJ,MAAO,SACPD,KAAM,WAWd,CCyMQ6G,CAAcb,GACPA,CACX,CAEI,OAAO/J,EAAM2K,EAAO,CAAEpH,QAE9B;;ACvZA,MAAMsH,GAAa,CAACzQ,EAAK0Q,KAAS1Q,GAAOA,GAAO,EAAI0Q,GAAOA,GAAOzN,IAAOyN,EA6BzE,SAASC,GAAkBC,GACvB,IAAK,CAAC,UAAW,YAAa,OAAO3F,SAAS2F,GAC1C,MAAM,IAAI/S,MAAM,6DACpB,OAAO+S,CACX,CACA,SAASC,GAAgBzH,EAAM0H,GAC3B,MAAMC,EAAQ,CAAA,EACd,IAAA,IAASC,KAAWhS,OAAOiS,KAAKH,GAE5BC,EAAMC,QAA6B,IAAlB5H,EAAK4H,GAAyBF,EAAIE,GAAW5H,EAAK4H,GAMvE,OAJAE,EAAMH,EAAMI,KAAM,QAClBD,EAAMH,EAAMK,QAAS,gBACA,IAAjBL,EAAMH,QACND,GAAkBI,EAAMH,QACrBG,CACX,CACO,MAAMM,WAAexT,MACxB,WAAAb,CAAYqH,EAAI,IACZlH,MAAMkH,EACV,EASG,MAAMiN,GAAM,CAEfC,IAAKF,GAELG,KAAM,CACFC,OAAQ,CAACC,EAAKC,KACV,MAAQJ,IAAKK,GAAMN,GACnB,GAAII,EAAM,GAAKA,EAAM,IACjB,MAAM,IAAIE,EAAE,yBAChB,GAAkB,EAAdD,EAAKxT,OACL,MAAM,IAAIyT,EAAE,6BAChB,MAAMC,EAAUF,EAAKxT,OAAS,EACxB0B,EAAME,EAAoB8R,GAChC,GAAKhS,EAAI1B,OAAS,EAAK,IACnB,MAAM,IAAIyT,EAAE,wCAEhB,MAAME,EAASD,EAAU,IAAM9R,EAAqBF,EAAI1B,OAAS,EAAK,KAAO,GAE7E,OADU4B,EAAoB2R,GACnBI,EAASjS,EAAM8R,GAG9B,MAAAI,CAAOL,EAAKC,GACR,MAAQJ,IAAKK,GAAMN,GACnB,IAAIU,EAAM,EACV,GAAIN,EAAM,GAAKA,EAAM,IACjB,MAAM,IAAIE,EAAE,yBAChB,GAAID,EAAKxT,OAAS,GAAKwT,EAAKK,OAAWN,EACnC,MAAM,IAAIE,EAAE,yBAChB,MAAMK,EAAQN,EAAKK,KAEnB,IAAI7T,EAAS,EACb,MAF0B,IAAR8T,GAIb,CAED,MAAMH,EAAiB,IAARG,EACf,IAAKH,EACD,MAAM,IAAIF,EAAE,qDAChB,GAAIE,EAAS,EACT,MAAM,IAAIF,EAAE,4CAChB,MAAMM,EAAcP,EAAKQ,SAASH,EAAKA,EAAMF,GAC7C,GAAII,EAAY/T,SAAW2T,EACvB,MAAM,IAAIF,EAAE,yCAChB,GAAuB,IAAnBM,EAAY,GACZ,MAAM,IAAIN,EAAE,wCAChB,IAAA,MAAWjO,KAAKuO,EACZ/T,EAAUA,GAAU,EAAKwF,EAE7B,GADAqO,GAAOF,EACH3T,EAAS,IACT,MAAM,IAAIyT,EAAE,yCACpB,MAlBIzT,EAAS8T,EAmBb,MAAMzP,EAAImP,EAAKQ,SAASH,EAAKA,EAAM7T,GACnC,GAAIqE,EAAErE,SAAWA,EACb,MAAM,IAAIyT,EAAE,kCAChB,MAAO,CAAEpP,IAAG4P,EAAGT,EAAKQ,SAASH,EAAM7T,GACvC,GAMJkU,KAAM,CACF,MAAAZ,CAAOzR,GACH,MAAQuR,IAAKK,GAAMN,GACnB,GAAItR,EAAMX,GACN,MAAM,IAAIuS,EAAE,8CAChB,IAAI3R,EAAMF,EAAoBC,GAI9B,GAFkC,EAA9BsM,OAAOgG,SAASrS,EAAI,GAAI,MACxBA,EAAM,KAAOA,GACA,EAAbA,EAAI9B,OACJ,MAAM,IAAIyT,EAAE,kDAChB,OAAO3R,CACX,EACA,MAAA8R,CAAOJ,GACH,MAAQJ,IAAKK,GAAMN,GACnB,GAAc,IAAVK,EAAK,GACL,MAAM,IAAIC,EAAE,uCAChB,GAAgB,IAAZD,EAAK,MAA2B,IAAVA,EAAK,IAC3B,MAAM,IAAIC,EAAE,uDAChB,OAAOvR,EAAgBsR,EAC3B,GAEJ,KAAAY,CAAMtS,GAEF,MAAQsR,IAAKK,EAAGS,KAAMG,EAAKhB,KAAMiB,GAAQnB,GACnCK,EAAO3Q,EAAY,YAAaf,IAC9BuC,EAAGkQ,EAAUN,EAAGO,GAAiBF,EAAIV,OAAO,GAAMJ,GAC1D,GAAIgB,EAAaxU,OACb,MAAM,IAAIyT,EAAE,+CAChB,MAAQpP,EAAGoQ,EAAQR,EAAGS,GAAeJ,EAAIV,OAAO,EAAMW,IAC9ClQ,EAAGsQ,EAAQV,EAAGW,GAAeN,EAAIV,OAAO,EAAMc,GACtD,GAAIE,EAAW5U,OACX,MAAM,IAAIyT,EAAE,+CAChB,MAAO,CAAExN,EAAGoO,EAAIT,OAAOa,GAAShD,EAAG4C,EAAIT,OAAOe,GAClD,EACA,UAAAE,CAAWC,GACP,MAAQzB,KAAMiB,EAAKJ,KAAMG,GAAQlB,GAG3B4B,EAFKT,EAAIhB,OAAO,EAAMe,EAAIf,OAAOwB,EAAI7O,IAChCqO,EAAIhB,OAAO,EAAMe,EAAIf,OAAOwB,EAAIrD,IAE3C,OAAO6C,EAAIhB,OAAO,GAAMyB,EAC5B,GAIE7T,GAAMe,OAAO,GAAId,GAAMc,OAAO,GAAI6C,GAAM7C,OAAO,GAAI8C,GAAM9C,OAAO,GAAI+C,GAAM/C,OAAO,GAChF,SAAS+S,GAAejF,EAAI1Q,GAC/B,MAAQoM,MAAOwJ,GAAalF,EAC5B,IAAIlO,EACJ,GAAmB,iBAARxC,EACPwC,EAAMxC,MAEL,CACD,IAAImC,EAAQqB,EAAY,cAAexD,GACvC,IACIwC,EAAMkO,EAAGnD,UAAUpL,EACvB,OACO0T,GACH,MAAM,IAAIxV,MAAM,8CAA8CuV,iBAAwB5V,IAC1F,CACJ,CACA,IAAK0Q,EAAGhE,YAAYlK,GAChB,MAAM,IAAInC,MAAM,8CACpB,OAAOmC,CACX,CAkBO,SAASsT,GAAaC,EAAQC,EAAY,IAC7C,MAAMC,ED+MH,SAA4BC,EAAMC,EAAOC,EAAY,CAAA,EAAIC,GAG5D,QAFe,IAAXA,IACAA,EAAkB,YAATH,IACRC,GAA0B,iBAAVA,EACjB,MAAM,IAAI9V,MAAM,kBAAkB6V,kBACtC,IAAA,MAAWnJ,IAAK,CAAC,IAAK,IAAK,KAAM,CAC7B,MAAMpI,EAAMwR,EAAMpJ,GAClB,KAAqB,iBAARpI,GAAoBA,EAAM9C,GACnC,MAAM,IAAIxB,MAAM,SAAS0M,4BACjC,CACA,MAAMhG,EAAK+L,GAAYqD,EAAMpJ,EAAGqJ,EAAUrP,GAAIsP,GACxC3F,EAAKoC,GAAYqD,EAAM/S,EAAGgT,EAAU1F,GAAI2F,GAExCN,EAAS,CAAC,KAAM,KAAM,IADQ,KAEpC,IAAA,MAAWhJ,KAAKgJ,EAEZ,IAAKhP,EAAG0F,QAAQ0J,EAAMpJ,IAClB,MAAM,IAAI1M,MAAM,SAAS0M,6CAGjC,MAAO,CAAEoJ,MADTA,EAAQ3U,OAAO+K,OAAO/K,OAAO8U,OAAO,CAAA,EAAIH,IACxBpP,KAAI2J,KACxB,CCpOsB6F,CAAmB,cAAeR,EAAQC,IACtDjP,GAAEA,EAAA2J,GAAIA,GAAOuF,EACnB,IAAIE,EAAQF,EAAUE,MACtB,MAAQK,EAAGC,EAAUrT,EAAGsT,GAAgBP,EACxChS,EAAgB6R,EAAW,GAAI,CAC3BW,mBAAoB,UACpBC,cAAe,WACfC,cAAe,WACftJ,UAAW,WACXtN,QAAS,WACT6W,KAAM,SACNC,eAAgB,YAEpB,MAAMD,KAAEA,GAASd,EACjB,GAAIc,KAEK/P,EAAGyB,IAAI2N,EAAMjQ,IAA2B,iBAAd4Q,EAAKE,OAAsB1M,MAAM2H,QAAQ6E,EAAKG,UACzE,MAAM,IAAI5W,MAAM,8DAGxB,MAAM6W,EAAUC,GAAYpQ,EAAI2J,GAChC,SAAS0G,IACL,IAAKrQ,EAAG4F,MACJ,MAAM,IAAItM,MAAM,6DACxB,CAuDA,MAAMgX,EAAcrB,EAAU/V,SArD9B,SAAsBqX,EAAIvG,EAAOwG,GAC7B,MAAMjR,EAAEA,EAAAkR,EAAGA,GAAMzG,EAAMrC,WACjB+I,EAAK1Q,EAAG9G,QAAQqG,GAEtB,GADAoN,EAAM6D,EAAc,gBAChBA,EAAc,CACdH,IACA,MAAMM,GAAY3Q,EAAG4F,MAAM6K,GAC3B,OAAOG,cAAYC,GAAQF,GAAWD,EAC1C,CAEI,OAAOE,EAAAA,YAAYlX,WAAWoX,GAAG,GAAOJ,EAAI1Q,EAAG9G,QAAQuX,GAE/D,EA0CMM,EAAc9B,EAAUzI,WAzC9B,SAAwBpL,GACpBf,EAAOe,OAAO,EAAW,SACzB,MAAQ4V,UAAWxG,EAAMyG,sBAAuBC,GAAWf,EACrDvW,EAASwB,EAAMxB,OACfuX,EAAO/V,EAAM,GACbgW,EAAOhW,EAAMwS,SAAS,GAE5B,GAAIhU,IAAW4Q,GAAkB,IAAT2G,GAA0B,IAATA,EAmBzC,IACSvX,IAAWsX,GAAmB,IAATC,EAAe,CAEzC,MAAME,EAAIrR,EAAGqF,MACP9F,EAAIS,EAAGwG,UAAU4K,EAAKxD,SAAS,EAAGyD,IAClCZ,EAAIzQ,EAAGwG,UAAU4K,EAAKxD,SAASyD,EAAO,EAAJA,IACxC,IAAKC,EAAU/R,EAAGkR,GACd,MAAM,IAAInX,MAAM,8BACpB,MAAO,CAAEiG,IAAGkR,IAChB,CAEI,MAAM,IAAInX,MAAM,yBAAyBM,0BAA+B4Q,qBAAwB0G,IACpG,CA/ByD,CACrD,MAAM3R,EAAIS,EAAGwG,UAAU4K,GACvB,IAAKpR,EAAG0F,QAAQnG,GACZ,MAAM,IAAIjG,MAAM,uCACpB,MAAMiY,EAAKC,EAAoBjS,GAC/B,IAAIkR,EACJ,IACIA,EAAIzQ,EAAGkF,KAAKqM,EAChB,OACOE,GACH,MAAMC,EAAMD,aAAqBnY,MAAQ,KAAOmY,EAAU5W,QAAU,GACpE,MAAM,IAAIvB,MAAM,yCAA2CoY,EAC/D,CACArB,IAKA,QAHiC,GAAdc,KADJnR,EAAG4F,MAAM6K,KAGpBA,EAAIzQ,EAAGqC,IAAIoO,IACR,CAAElR,IAAGkR,IAChB,CAaJ,EAGA,SAASe,EAAoBjS,GACzB,MAAMoS,EAAK3R,EAAGG,IAAIZ,GACZqS,EAAK5R,EAAGW,IAAIgR,EAAIpS,GACtB,OAAOS,EAAG+F,IAAI/F,EAAG+F,IAAI6L,EAAI5R,EAAGW,IAAIpB,EAAG6P,EAAMjQ,IAAKiQ,EAAMhQ,EACxD,CAGA,SAASkS,EAAU/R,EAAGkR,GAClB,MAAMoB,EAAO7R,EAAGG,IAAIsQ,GACdqB,EAAQN,EAAoBjS,GAClC,OAAOS,EAAGE,IAAI2R,EAAMC,EACxB,CAGA,IAAKR,EAAUlC,EAAM2C,GAAI3C,EAAM4C,IAC3B,MAAM,IAAI1Y,MAAM,qCAGpB,MAAM2Y,EAAOjS,EAAGW,IAAIX,EAAGO,IAAI6O,EAAMjQ,EAAGR,IAAMC,IACpCsT,EAAQlS,EAAGW,IAAIX,EAAGG,IAAIiP,EAAMhQ,GAAIvD,OAAO,KAC7C,GAAImE,EAAGyB,IAAIzB,EAAG+F,IAAIkM,EAAMC,IACpB,MAAM,IAAI5Y,MAAM,4BAEpB,SAAS6Y,EAAOjX,EAAOmB,EAAG+V,GAAU,GAChC,IAAKpS,EAAG0F,QAAQrJ,IAAO+V,GAAWpS,EAAGyB,IAAIpF,GACrC,MAAM,IAAI/C,MAAM,wBAAwB4B,KAC5C,OAAOmB,CACX,CACA,SAASgW,EAAUC,GACf,KAAMA,aAAiB7I,GACnB,MAAM,IAAInQ,MAAM,2BACxB,CACA,SAASiZ,EAAiBvU,GACtB,IAAK+R,IAASA,EAAKG,QACf,MAAM,IAAI5W,MAAM,WACpB,OA1TD,SAA0B0E,EAAGwU,EAAOnW,GAIvC,OAAQoW,EAAIC,IAAMC,EAAIC,IAAOJ,EACvBpQ,EAAK8J,GAAW0G,EAAK5U,EAAG3B,GACxBiG,EAAK4J,IAAYwG,EAAK1U,EAAG3B,GAG/B,IAAIwW,EAAK7U,EAAIoE,EAAKqQ,EAAKnQ,EAAKqQ,EACxBG,GAAM1Q,EAAKsQ,EAAKpQ,EAAKsQ,EACzB,MAAMG,EAAQF,EAAK/X,GACbkY,EAAQF,EAAKhY,GACfiY,IACAF,GAAMA,GACNG,IACAF,GAAMA,GAGV,MAAMG,EAAU9V,EAAQsH,KAAKC,KAAKxH,EAAOb,GAAK,IAAMtB,GACpD,GAAI8X,EAAK/X,IAAO+X,GAAMI,GAAWH,EAAKhY,IAAOgY,GAAMG,EAC/C,MAAM,IAAI3Z,MAAM,yCAA2C0E,GAE/D,MAAO,CAAE+U,QAAOF,KAAIG,QAAOF,KAC/B,CAkSeI,CAAiBlV,EAAG+R,EAAKG,QAASvG,EAAGrJ,MAChD,CAKA,MAAM6S,EAAejV,EAAS,CAAC8H,EAAGoN,KAC9B,MAAMC,EAAEA,EAAAC,EAAGA,EAAAnS,EAAGA,GAAM6E,EAEpB,GAAIhG,EAAGE,IAAIiB,EAAGnB,EAAGc,KACb,MAAO,CAAEvB,EAAG8T,EAAG5C,EAAG6C,GACtB,MAAM7R,EAAMuE,EAAEvE,MAGJ,MAAN2R,IACAA,EAAK3R,EAAMzB,EAAGc,IAAMd,EAAG6D,IAAI1C,IAC/B,MAAM5B,EAAIS,EAAGW,IAAI0S,EAAGD,GACd3C,EAAIzQ,EAAGW,IAAI2S,EAAGF,GACdG,EAAKvT,EAAGW,IAAIQ,EAAGiS,GACrB,GAAI3R,EACA,MAAO,CAAElC,EAAGS,EAAG8B,KAAM2O,EAAGzQ,EAAG8B,MAC/B,IAAK9B,EAAGE,IAAIqT,EAAIvT,EAAGc,KACf,MAAM,IAAIxH,MAAM,oBACpB,MAAO,CAAEiG,IAAGkR,OAIV+C,EAAkBtV,EAAU8H,IAC9B,GAAIA,EAAEvE,MAAO,CAIT,GAAIwN,EAAUW,qBAAuB5P,EAAGyB,IAAIuE,EAAEsN,GAC1C,OACJ,MAAM,IAAIha,MAAM,kBACpB,CAEA,MAAMiG,EAAEA,EAAAkR,EAAGA,GAAMzK,EAAE2B,WACnB,IAAK3H,EAAG0F,QAAQnG,KAAOS,EAAG0F,QAAQ+K,GAC9B,MAAM,IAAInX,MAAM,wCACpB,IAAKgY,EAAU/R,EAAGkR,GACd,MAAM,IAAInX,MAAM,qCACpB,IAAK0M,EAAE8J,gBACH,MAAM,IAAIxW,MAAM,0CACpB,OAAO,IAEX,SAASma,EAAWC,EAAUC,EAAKC,EAAKb,EAAOC,GAI3C,OAHAY,EAAM,IAAInK,EAAMzJ,EAAGW,IAAIiT,EAAIP,EAAGK,GAAWE,EAAIN,EAAGM,EAAIzS,GACpDwS,EAAMxM,EAAS4L,EAAOY,GACtBC,EAAMzM,EAAS6L,EAAOY,GACfD,EAAI5N,IAAI6N,EACnB,CAMA,MAAMnK,EAEF,WAAAhR,CAAY4a,EAAGC,EAAGnS,GACdtI,KAAKwa,EAAIlB,EAAO,IAAKkB,GACrBxa,KAAKya,EAAInB,EAAO,IAAKmB,GAAG,GACxBza,KAAKsI,EAAIgR,EAAO,IAAKhR,GACrB1G,OAAO+K,OAAO3M,KAClB,CACA,YAAOuW,GACH,OAAOA,CACX,CAEA,iBAAO1H,CAAW1B,GACd,MAAMzG,EAAEA,EAAAkR,EAAGA,GAAMzK,GAAK,CAAA,EACtB,IAAKA,IAAMhG,EAAG0F,QAAQnG,KAAOS,EAAG0F,QAAQ+K,GACpC,MAAM,IAAInX,MAAM,wBACpB,GAAI0M,aAAayD,EACb,MAAM,IAAInQ,MAAM,gCAEpB,OAAI0G,EAAGyB,IAAIlC,IAAMS,EAAGyB,IAAIgP,GACbhH,EAAM3H,KACV,IAAI2H,EAAMlK,EAAGkR,EAAGzQ,EAAGc,IAC9B,CACA,gBAAO0F,CAAUpL,GACb,MAAM4F,EAAIyI,EAAM/B,WAAWqJ,EAAY1W,EAAOe,OAAO,EAAW,WAEhE,OADA4F,EAAE6S,iBACK7S,CACX,CACA,cAAO8S,CAAQpY,GACX,OAAO+N,EAAMjD,UAAU/J,EAAY,WAAYf,GACnD,CACA,KAAI6D,GACA,OAAO1G,KAAK8O,WAAWpI,CAC3B,CACA,KAAIkR,GACA,OAAO5X,KAAK8O,WAAW8I,CAC3B,CAOA,UAAAsD,CAAW1L,EAAa,EAAG2L,GAAS,GAIhC,OAHAC,EAAKrJ,YAAY/R,KAAMwP,GAClB2L,GACDnb,KAAKqb,SAASvV,IACX9F,IACX,CAGA,cAAAgb,GACIL,EAAgB3a,KACpB,CACA,QAAA8X,GACI,MAAMF,EAAEA,GAAM5X,KAAK8O,WACnB,IAAK3H,EAAG4F,MACJ,MAAM,IAAItM,MAAM,+BACpB,OAAQ0G,EAAG4F,MAAM6K,EACrB,CAEA,MAAA0D,CAAO7B,GACHD,EAAUC,GACV,MAAQe,EAAGe,EAAId,EAAGe,EAAIlT,EAAGmT,GAAOzb,MACxBwa,EAAGkB,EAAIjB,EAAGkB,EAAIrT,EAAGsT,GAAOnC,EAC1BoC,EAAK1U,EAAGE,IAAIF,EAAGW,IAAIyT,EAAIK,GAAKzU,EAAGW,IAAI4T,EAAID,IACvCK,EAAK3U,EAAGE,IAAIF,EAAGW,IAAI0T,EAAII,GAAKzU,EAAGW,IAAI6T,EAAIF,IAC7C,OAAOI,GAAMC,CACjB,CAEA,MAAArN,GACI,OAAO,IAAImC,EAAM5Q,KAAKwa,EAAGrT,EAAGqC,IAAIxJ,KAAKya,GAAIza,KAAKsI,EAClD,CAKA,MAAA2I,GACI,MAAM3K,EAAEA,EAAAC,EAAGA,GAAMgQ,EACXwF,EAAK5U,EAAGW,IAAIvB,EAAGT,KACb0U,EAAGe,EAAId,EAAGe,EAAIlT,EAAGmT,GAAOzb,KAChC,IAAIgc,EAAK7U,EAAG8B,KAAMgT,EAAK9U,EAAG8B,KAAMiT,EAAK/U,EAAG8B,KACpCkT,EAAKhV,EAAGW,IAAIyT,EAAIA,GAChBa,EAAKjV,EAAGW,IAAI0T,EAAIA,GAChBa,EAAKlV,EAAGW,IAAI2T,EAAIA,GAChBa,EAAKnV,EAAGW,IAAIyT,EAAIC,GA4BpB,OA3BAc,EAAKnV,EAAG+F,IAAIoP,EAAIA,GAChBJ,EAAK/U,EAAGW,IAAIyT,EAAIE,GAChBS,EAAK/U,EAAG+F,IAAIgP,EAAIA,GAChBF,EAAK7U,EAAGW,IAAIxB,EAAG4V,GACfD,EAAK9U,EAAGW,IAAIiU,EAAIM,GAChBJ,EAAK9U,EAAG+F,IAAI8O,EAAIC,GAChBD,EAAK7U,EAAGa,IAAIoU,EAAIH,GAChBA,EAAK9U,EAAG+F,IAAIkP,EAAIH,GAChBA,EAAK9U,EAAGW,IAAIkU,EAAIC,GAChBD,EAAK7U,EAAGW,IAAIwU,EAAIN,GAChBE,EAAK/U,EAAGW,IAAIiU,EAAIG,GAChBG,EAAKlV,EAAGW,IAAIxB,EAAG+V,GACfC,EAAKnV,EAAGa,IAAImU,EAAIE,GAChBC,EAAKnV,EAAGW,IAAIxB,EAAGgW,GACfA,EAAKnV,EAAG+F,IAAIoP,EAAIJ,GAChBA,EAAK/U,EAAG+F,IAAIiP,EAAIA,GAChBA,EAAKhV,EAAG+F,IAAIgP,EAAIC,GAChBA,EAAKhV,EAAG+F,IAAIiP,EAAIE,GAChBF,EAAKhV,EAAGW,IAAIqU,EAAIG,GAChBL,EAAK9U,EAAG+F,IAAI+O,EAAIE,GAChBE,EAAKlV,EAAGW,IAAI0T,EAAIC,GAChBY,EAAKlV,EAAG+F,IAAImP,EAAIA,GAChBF,EAAKhV,EAAGW,IAAIuU,EAAIC,GAChBN,EAAK7U,EAAGa,IAAIgU,EAAIG,GAChBD,EAAK/U,EAAGW,IAAIuU,EAAID,GAChBF,EAAK/U,EAAG+F,IAAIgP,EAAIA,GAChBA,EAAK/U,EAAG+F,IAAIgP,EAAIA,GACT,IAAItL,EAAMoL,EAAIC,EAAIC,EAC7B,CAKA,GAAAhP,CAAIuM,GACAD,EAAUC,GACV,MAAQe,EAAGe,EAAId,EAAGe,EAAIlT,EAAGmT,GAAOzb,MACxBwa,EAAGkB,EAAIjB,EAAGkB,EAAIrT,EAAGsT,GAAOnC,EAChC,IAAIuC,EAAK7U,EAAG8B,KAAMgT,EAAK9U,EAAG8B,KAAMiT,EAAK/U,EAAG8B,KACxC,MAAM3C,EAAIiQ,EAAMjQ,EACVyV,EAAK5U,EAAGW,IAAIyO,EAAMhQ,EAAGT,IAC3B,IAAIqW,EAAKhV,EAAGW,IAAIyT,EAAIG,GAChBU,EAAKjV,EAAGW,IAAI0T,EAAIG,GAChBU,EAAKlV,EAAGW,IAAI2T,EAAIG,GAChBU,EAAKnV,EAAG+F,IAAIqO,EAAIC,GAChBe,EAAKpV,EAAG+F,IAAIwO,EAAIC,GACpBW,EAAKnV,EAAGW,IAAIwU,EAAIC,GAChBA,EAAKpV,EAAG+F,IAAIiP,EAAIC,GAChBE,EAAKnV,EAAGa,IAAIsU,EAAIC,GAChBA,EAAKpV,EAAG+F,IAAIqO,EAAIE,GAChB,IAAIe,EAAKrV,EAAG+F,IAAIwO,EAAIE,GA+BpB,OA9BAW,EAAKpV,EAAGW,IAAIyU,EAAIC,GAChBA,EAAKrV,EAAG+F,IAAIiP,EAAIE,GAChBE,EAAKpV,EAAGa,IAAIuU,EAAIC,GAChBA,EAAKrV,EAAG+F,IAAIsO,EAAIC,GAChBO,EAAK7U,EAAG+F,IAAIyO,EAAIC,GAChBY,EAAKrV,EAAGW,IAAI0U,EAAIR,GAChBA,EAAK7U,EAAG+F,IAAIkP,EAAIC,GAChBG,EAAKrV,EAAGa,IAAIwU,EAAIR,GAChBE,EAAK/U,EAAGW,IAAIxB,EAAGiW,GACfP,EAAK7U,EAAGW,IAAIiU,EAAIM,GAChBH,EAAK/U,EAAG+F,IAAI8O,EAAIE,GAChBF,EAAK7U,EAAGa,IAAIoU,EAAIF,GAChBA,EAAK/U,EAAG+F,IAAIkP,EAAIF,GAChBD,EAAK9U,EAAGW,IAAIkU,EAAIE,GAChBE,EAAKjV,EAAG+F,IAAIiP,EAAIA,GAChBC,EAAKjV,EAAG+F,IAAIkP,EAAID,GAChBE,EAAKlV,EAAGW,IAAIxB,EAAG+V,GACfE,EAAKpV,EAAGW,IAAIiU,EAAIQ,GAChBH,EAAKjV,EAAG+F,IAAIkP,EAAIC,GAChBA,EAAKlV,EAAGa,IAAImU,EAAIE,GAChBA,EAAKlV,EAAGW,IAAIxB,EAAG+V,GACfE,EAAKpV,EAAG+F,IAAIqP,EAAIF,GAChBF,EAAKhV,EAAGW,IAAIsU,EAAIG,GAChBN,EAAK9U,EAAG+F,IAAI+O,EAAIE,GAChBA,EAAKhV,EAAGW,IAAI0U,EAAID,GAChBP,EAAK7U,EAAGW,IAAIwU,EAAIN,GAChBA,EAAK7U,EAAGa,IAAIgU,EAAIG,GAChBA,EAAKhV,EAAGW,IAAIwU,EAAIF,GAChBF,EAAK/U,EAAGW,IAAI0U,EAAIN,GAChBA,EAAK/U,EAAG+F,IAAIgP,EAAIC,GACT,IAAIvL,EAAMoL,EAAIC,EAAIC,EAC7B,CACA,QAAAO,CAAShD,GACL,OAAOzZ,KAAKkN,IAAIuM,EAAMhL,SAC1B,CACA,GAAA7F,GACI,OAAO5I,KAAKsb,OAAO1K,EAAM3H,KAC7B,CAUA,QAAAoS,CAAStN,GACL,MAAQmJ,KAAAA,GAASd,EACjB,IAAKtF,EAAGhE,YAAYiB,GAChB,MAAM,IAAItN,MAAM,gCACpB,IAAI0Q,EAAOuL,EACX,MAAM5U,EAAOtE,GAAM4X,EAAKxJ,OAAO5R,KAAMwD,EAAI2J,GAAMuB,EAAWkC,EAAOzD,IAEjE,GAAI+J,EAAM,CACN,MAAMgD,MAAEA,EAAAF,GAAOA,EAAAG,MAAIA,KAAOF,GAAOP,EAAiB3L,IAC1CZ,EAAG2N,EAAKpO,EAAGiQ,GAAQ7U,EAAIkS,IACvB7M,EAAG4N,EAAKrO,EAAGkQ,GAAQ9U,EAAImS,GAC/ByC,EAAOC,EAAIzP,IAAI0P,GACfzL,EAAQyJ,EAAW1D,EAAKE,KAAM0D,EAAKC,EAAKb,EAAOC,EACnD,KACK,CACD,MAAMhN,EAAEA,EAAAT,EAAGA,GAAM5E,EAAIiG,GACrBoD,EAAQhE,EACRuP,EAAOhQ,CACX,CAEA,OAAOgC,EAAWkC,EAAO,CAACO,EAAOuL,IAAO,EAC5C,CAMA,cAAAG,CAAeC,GACX,MAAQ5F,KAAAA,GAASd,EACXjJ,EAAInN,KACV,IAAK8Q,EAAGjE,QAAQiQ,GACZ,MAAM,IAAIrc,MAAM,gCACpB,GAAIqc,IAAO7a,IAAOkL,EAAEvE,MAChB,OAAOgI,EAAM3H,KACjB,GAAI6T,IAAO5a,GACP,OAAOiL,EACX,GAAIiO,EAAKnJ,SAASjS,MACd,OAAOA,KAAKqb,SAASyB,GACzB,GAAI5F,EAAM,CACN,MAAMgD,MAAEA,EAAAF,GAAOA,EAAAG,MAAIA,KAAOF,GAAOP,EAAiBoD,IAC5CC,GAAEA,KAAIC,GDpXrB,SAAuBpM,EAAOO,EAAO6I,EAAIC,GAC5C,IAAInP,EAAMqG,EACN4L,EAAKnM,EAAM3H,KACX+T,EAAKpM,EAAM3H,KACf,KAAO+Q,EAAK/X,GAAOgY,EAAKhY,GAChB+X,EAAK9X,IACL6a,EAAKA,EAAG7P,IAAIpC,IACZmP,EAAK/X,IACL8a,EAAKA,EAAG9P,IAAIpC,IAChBA,EAAMA,EAAImG,SACV+I,IAAO9X,EACP+X,IAAO/X,EAEX,MAAO,CAAE6a,KAAIC,KACjB,CCsWmCC,CAAcrM,EAAOzD,EAAG6M,EAAIC,GAC/C,OAAOW,EAAW1D,EAAKE,KAAM2F,EAAIC,EAAI9C,EAAOC,EAChD,CAEI,OAAOiB,EAAKvJ,OAAO1E,EAAG2P,EAE9B,CACA,oBAAAI,CAAqB9U,EAAG9B,EAAGC,GACvB,MAAMsM,EAAM7S,KAAK6c,eAAevW,GAAG4G,IAAI9E,EAAEyU,eAAetW,IACxD,OAAOsM,EAAIjK,WAAQ,EAAYiK,CACnC,CAKA,QAAA/D,CAASqO,GACL,OAAO7C,EAAata,KAAMmd,EAC9B,CAKA,aAAAlG,GACI,MAAMA,cAAEA,GAAkBb,EAC1B,OAAIS,IAAa3U,KAEb+U,EACOA,EAAcrG,EAAO5Q,MACzBob,EAAKvJ,OAAO7R,KAAM8W,GAAalO,MAC1C,CACA,aAAAoO,GACI,MAAMA,cAAEA,GAAkBZ,EAC1B,OAAIS,IAAa3U,GACNlC,KACPgX,EACOA,EAAcpG,EAAO5Q,MACzBA,KAAK6c,eAAehG,EAC/B,CACA,YAAAuG,GAEI,OAAOpd,KAAK6c,eAAehG,GAAUjO,KACzC,CACA,OAAAvI,CAAQsX,GAAe,GAGnB,OAFA7D,EAAM6D,EAAc,gBACpB3X,KAAKgb,iBACEvD,EAAY7G,EAAO5Q,KAAM2X,EACpC,CACA,KAAA0F,CAAM1F,GAAe,GACjB,OAAO2F,aAAWtd,KAAKK,QAAQsX,GACnC,CACA,QAAA7U,GACI,MAAO,UAAU9C,KAAK4I,MAAQ,OAAS5I,KAAKqd,UAChD,CAEA,MAAIE,GACA,OAAOvd,KAAKwa,CAChB,CACA,MAAIgD,GACA,OAAOxd,KAAKwa,CAChB,CACA,MAAIiD,GACA,OAAOzd,KAAKsI,CAChB,CACA,UAAAoV,CAAW/F,GAAe,GACtB,OAAO3X,KAAKK,QAAQsX,EACxB,CACA,cAAAgG,CAAenO,GACXxP,KAAKkb,WAAW1L,EACpB,CACA,iBAAOd,CAAWC,GACd,OAAOD,EAAWkC,EAAOjC,EAC7B,CACA,UAAOiP,CAAIjP,EAAQyD,GACf,OAAOF,GAAUtB,EAAOE,EAAInC,EAAQyD,EACxC,CACA,qBAAOyL,CAAeC,GAClB,OAAOlN,EAAMC,KAAKwK,SAAStF,GAAejF,EAAIgN,GAClD,EAGJlN,EAAMC,KAAO,IAAID,EAAM2F,EAAM2C,GAAI3C,EAAM4C,GAAIhS,EAAGc,KAE9C2I,EAAM3H,KAAO,IAAI2H,EAAMzJ,EAAG8B,KAAM9B,EAAGc,IAAKd,EAAG8B,MAE3C2H,EAAMzJ,GAAKA,EAEXyJ,EAAME,GAAKA,EACX,MAAM7B,EAAO6B,EAAGvE,KACV6O,EAAO,IAAIzK,GAAKC,EAAOwF,EAAUc,KAAOtL,KAAKC,KAAKoD,EAAO,GAAKA,GAEpE,OADA2B,EAAMC,KAAKqK,WAAW,GACftK,CACX,CAEA,SAASoH,GAAQF,GACb,OAAOjX,WAAWoX,GAAGH,EAAW,EAAO,EAC3C,CA6HA,SAASP,GAAYpQ,EAAI2J,GACrB,MAAO,CACHiN,UAAWjN,EAAGtE,MACd2L,UAAW,EAAIhR,EAAGqF,MAClB4L,sBAAuB,EAAI,EAAIjR,EAAGqF,MAClCwR,oBAAoB,EACpBC,UAAW,EAAInN,EAAGtE,MAE1B,CAKO,SAAS0R,GAAKtN,EAAOuN,EAAW,IACnC,MAAMrN,GAAEA,GAAOF,EACTwN,EAAeD,EAASE,aAAeC,EAAAA,YACvChH,EAAU1V,OAAO8U,OAAOa,GAAY3G,EAAMzJ,GAAI2J,GAAK,CAAEyN,KAAMlQ,EAAiByC,EAAGrJ,SACrF,SAAS+W,EAAiBT,GACtB,IACI,QAAShI,GAAejF,EAAIiN,EAChC,OACO9H,GACH,OAAO,CACX,CACJ,CAmBA,SAASwI,EAAgBF,EAAOH,EAAa9G,EAAQiH,OACjD,OF1XD,SAAwBne,EAAK+N,EAAYpC,GAAO,GACnD,MAAMtJ,EAAMrC,EAAIW,OACV2d,EAAWxQ,EAAoBC,GAC/BwQ,EAAStQ,EAAiBF,GAEhC,GAAI1L,EAAM,IAAMA,EAAMkc,GAAUlc,EAAM,KAClC,MAAM,IAAIhC,MAAM,YAAcke,EAAS,6BAA+Blc,GAC1E,MAEMmc,EAAUvY,EAFJ0F,EAAO5I,EAAgB/C,GAAO6C,EAAgB7C,GAEjC+N,EAAajM,GAAOA,EAC7C,OAAO6J,EAAOpI,EAAgBib,EAASF,GAAYnb,EAAgBqb,EAASF,EAChF,CE+WeG,CAAerd,EAAO+c,EAAMjH,EAAQiH,KAAM,QAASzN,EAAGrJ,MACjE,CAMA,SAASqX,EAAaf,EAAWpG,GAAe,GAC5C,OAAO/G,EAAMC,KAAKwK,SAAStF,GAAejF,EAAIiN,IAAY1d,QAAQsX,EACtE,CAQA,SAASoH,EAAUvQ,GACf,GAAoB,iBAATA,EACP,OAAO,EACX,GAAIA,aAAgBoC,EAChB,OAAO,EACX,MAAMmN,UAAEA,EAAA5F,UAAWA,EAAAC,sBAAWA,GAA0Bd,EACxD,GAAIxG,EAAG3E,gBAAkB4R,IAAc5F,EACnC,OACJ,MAAMnD,EAAIpR,EAAY,MAAO4K,GAAMzN,OACnC,OAAOiU,IAAMmD,GAAanD,IAAMoD,CACpC,CAkBA,MAAM4G,EAAQ,CACVR,mBACAS,iBAlEJ,SAA0B9G,EAAWR,GACjC,MAAQQ,UAAWxG,EAAAyG,sBAAMA,GAA0Bd,EACnD,IACI,MAAMtC,EAAImD,EAAUpX,OACpB,QAAqB,IAAjB4W,GAAyB3C,IAAMrD,OAEd,IAAjBgG,GAA0B3C,IAAMoD,MAE3BxH,EAAMjD,UAAUwK,GAC7B,OACOlC,GACH,OAAO,CACX,CACJ,EAsDIwI,kBAEAS,kBAAmBV,EACnBW,iBAAkBV,EAClBW,uBAAyBhf,GAAQ2V,GAAejF,EAAI1Q,GACpD8a,WAAA,CAAW1L,EAAa,EAAG2B,EAAQP,EAAMC,OAC9BM,EAAM+J,WAAW1L,GAAY,IAG5C,OAAO5N,OAAO+K,OAAO,CAAEmS,eAAcO,gBArBrC,SAAyBC,EAAYC,EAAY5H,GAAe,GAC5D,IAA8B,IAA1BoH,EAAUO,GACV,MAAM,IAAI7e,MAAM,iCACpB,IAA8B,IAA1Bse,EAAUQ,GACV,MAAM,IAAI9e,MAAM,iCACpB,MAAM+R,EAAIuD,GAAejF,EAAIwO,GAE7B,OADU1O,EAAMqK,QAAQsE,GACflE,SAAS7I,GAAGnS,QAAQsX,EACjC,EAasD6H,OA/CtD,SAAgBjB,GACZ,MAAMR,EAAYU,EAAgBF,GAClC,MAAO,CAAER,YAAW5F,UAAW2G,EAAaf,GAChD,EA4C8DnN,QAAOoO,QAAO1H,WAChF,CAiBO,SAASmI,GAAM7O,EAAO/Q,EAAM6f,EAAY,CAAA,GAC3Cvf,EAAAA,MAAMN,GACN0E,EAAgBmb,EAAW,GAAI,CAC3B3d,KAAM,WACNgS,KAAM,UACNsK,YAAa,WACbsB,SAAU,WACVC,cAAe,aAEnB,MAAMvB,EAAcqB,EAAUrB,aAAeC,EAAAA,YACvCvc,EAAO2d,EAAU3d,MAAA,EACjB3B,KAAQyf,IAASC,EAAUjgB,EAAMO,EAAK2X,EAAAA,eAAe8H,MACrD1Y,GAAEA,EAAA2J,GAAIA,GAAOF,GACXnJ,MAAOqP,EAAavK,KAAMwT,GAAWjP,GACvC0O,OAAEA,eAAQV,EAAAO,gBAAcA,EAAAL,MAAiBA,UAAO1H,GAAY4G,GAAKtN,EAAO8O,GACxEM,EAAiB,CACnBhM,SAAS,EACTD,KAAgC,kBAAnB2L,EAAU3L,MAAqB2L,EAAU3L,KACtDP,YAAQ,EACRyM,cAAc,GAEZC,EAAwB,UAC9B,SAASC,EAAsBrZ,GAE3B,OAAOA,EADMgQ,GAAe5U,EAEhC,CACA,SAASke,EAAW/d,EAAOO,GACvB,IAAKkO,EAAGhE,YAAYlK,GAChB,MAAM,IAAInC,MAAM,qBAAqB4B,qCACzC,OAAOO,CACX,CAUA,MAAMyd,EACF,WAAAzgB,CAAYoH,EAAGwL,EAAG8N,GACdtgB,KAAKgH,EAAIoZ,EAAW,IAAKpZ,GACzBhH,KAAKwS,EAAI4N,EAAW,IAAK5N,GACT,MAAZ8N,IACAtgB,KAAKsgB,SAAWA,GACpB1e,OAAO+K,OAAO3M,KAClB,CACA,gBAAO2N,CAAUpL,EAAOiR,EAAS0M,GAE7B,IAAIK,EACJ,GApBR,SAA2Bhe,EAAOiR,GAC9BD,GAAkBC,GAClB,MAAMgN,EAAOlJ,EAAQ2G,UAEdzc,EAAOe,EADW,YAAXiR,EAAuBgN,EAAkB,cAAXhN,EAAyBgN,EAAO,OAAI,EACpD,GAAGhN,cACnC,CAaQiN,CAAkBle,EAAOiR,GAEV,QAAXA,EAAkB,CAClB,MAAQxM,EAAAA,EAAGwL,EAAAA,GAAM0B,GAAIiB,MAAM3T,EAAOe,IAClC,OAAO,IAAI8d,EAAUrZ,EAAGwL,EAC5B,CACe,cAAXgB,IACA+M,EAAQhe,EAAM,GACdiR,EAAS,UACTjR,EAAQA,EAAMwS,SAAS,IAE3B,MAAMyD,EAAI1H,EAAGtE,MACPxF,EAAIzE,EAAMwS,SAAS,EAAGyD,GACtBhG,EAAIjQ,EAAMwS,SAASyD,EAAO,EAAJA,GAC5B,OAAO,IAAI6H,EAAUvP,EAAGnD,UAAU3G,GAAI8J,EAAGnD,UAAU6E,GAAI+N,EAC3D,CACA,cAAOtF,CAAQpY,EAAK2Q,GAChB,OAAOxT,KAAK2N,UAAU+S,EAAAA,WAAW7d,GAAM2Q,EAC3C,CACA,cAAAmN,CAAeL,GACX,OAAO,IAAID,EAAUrgB,KAAKgH,EAAGhH,KAAKwS,EAAG8N,EACzC,CACA,gBAAAM,CAAiBC,GACb,MAAMC,EAAc3Z,EAAGM,OACjBT,EAAEA,EAAAwL,EAAGA,EAAG8N,SAAUS,GAAQ/gB,KAChC,GAAW,MAAP+gB,IAAgB,CAAC,EAAG,EAAG,EAAG,GAAGlT,SAASkT,GACtC,MAAM,IAAItgB,MAAM,uBAUpB,GADoBqW,EAAcjR,GAAMib,GACrBC,EAAM,EACrB,MAAM,IAAItgB,MAAM,0CACpB,MAAMugB,EAAe,IAARD,GAAqB,IAARA,EAAY/Z,EAAI8P,EAAc9P,EACxD,IAAKG,EAAG0F,QAAQmU,GACZ,MAAM,IAAIvgB,MAAM,8BACpB,MAAMiG,EAAIS,EAAG9G,QAAQ2gB,GACfhY,EAAI4H,EAAMjD,UAAUoK,cAAYC,KAAe,EAAN+I,IAAiBra,IAC1Dua,EAAKnQ,EAAG9F,IAAIgW,GACZpK,EAAIgJ,EAAchc,EAAY,UAAWid,IACzCK,EAAKpQ,EAAGvQ,QAAQqW,EAAIqK,GACpBE,EAAKrQ,EAAGvQ,OAAOiS,EAAIyO,GAEnB7Y,EAAIwI,EAAMC,KAAKgM,eAAeqE,GAAIhU,IAAIlE,EAAE6T,eAAesE,IAC7D,GAAI/Y,EAAEQ,MACF,MAAM,IAAInI,MAAM,qBAEpB,OADA2H,EAAE4S,iBACK5S,CACX,CAEA,QAAAgZ,GACI,OAAOjB,EAAsBngB,KAAKwS,EACtC,CACA,OAAAnS,CAAQmT,EAAS0M,GAEb,GADA3M,GAAkBC,GACH,QAAXA,EACA,OAAOkN,aAAWxM,GAAI0B,WAAW5V,OACrC,MAAMgH,EAAI8J,EAAGzQ,QAAQL,KAAKgH,GACpBwL,EAAI1B,EAAGzQ,QAAQL,KAAKwS,GAC1B,GAAe,cAAXgB,EAAwB,CACxB,GAAqB,MAAjBxT,KAAKsgB,SACL,MAAM,IAAI7f,MAAM,gCACpB,OAAOsX,EAAAA,YAAYlX,WAAWoX,GAAGjY,KAAKsgB,UAAWtZ,EAAGwL,EACxD,CACA,OAAOuF,EAAAA,YAAY/Q,EAAGwL,EAC1B,CACA,KAAA6K,CAAM7J,GACF,OAAO8J,aAAWtd,KAAKK,QAAQmT,GACnC,CAEA,cAAAwH,GAAmB,CACnB,kBAAOqG,CAAYxe,GACf,OAAOwd,EAAU1S,UAAU/J,EAAY,MAAOf,GAAM,UACxD,CACA,cAAOye,CAAQze,GACX,OAAOwd,EAAU1S,UAAU/J,EAAY,MAAOf,GAAM,MACxD,CACA,UAAA0e,GACI,OAAOvhB,KAAKohB,WAAa,IAAIf,EAAUrgB,KAAKgH,EAAG8J,EAAGtH,IAAIxJ,KAAKwS,GAAIxS,KAAKsgB,UAAYtgB,IACpF,CACA,aAAAwhB,GACI,OAAOxhB,KAAKK,QAAQ,MACxB,CACA,QAAAohB,GACI,OAAOnE,aAAWtd,KAAKK,QAAQ,OACnC,CACA,iBAAAqhB,GACI,OAAO1hB,KAAKK,QAAQ,UACxB,CACA,YAAAshB,GACI,OAAOrE,aAAWtd,KAAKK,QAAQ,WACnC,EAMJ,MAAMsf,EAAWD,EAAUC,UACvB,SAAsBpd,GAElB,GAAIA,EAAMxB,OAAS,KACf,MAAM,IAAIN,MAAM,sBAGpB,MAAMmC,EAAMK,EAAgBV,GACtBqf,EAAuB,EAAfrf,EAAMxB,OAAagf,EACjC,OAAO6B,EAAQ,EAAIhf,GAAOI,OAAO4e,GAAShf,CAC9C,EACEgd,EAAgBF,EAAUE,eAC5B,SAA2Brd,GACvB,OAAOuO,EAAGvQ,OAAOof,EAASpd,GAC9B,EAEEsf,EAAavd,EAAQyb,GAE3B,SAAS+B,EAAWlf,GAGhB,OADAqB,EAAS,WAAa8b,EAAQnd,EAAKX,GAAK4f,GACjC/Q,EAAGzQ,QAAQuC,EACtB,CACA,SAASmf,EAAmB/f,EAASgS,GAEjC,OADAxS,EAAOQ,OAAS,EAAW,WACpBgS,EAAUxS,EAAO3B,EAAKmC,QAAU,EAAW,qBAAuBA,CAC7E,CAkKA,OAAOJ,OAAO+K,OAAO,CACjB6S,SACAV,eACAO,kBACAL,QACA1H,UACA1G,QACAoR,KAjGJ,SAAchgB,EAAS+b,EAAW/R,EAAO,CAAA,GACrChK,EAAU4B,EAAY,UAAW5B,GACjC,MAAMuc,KAAEA,EAAA0D,MAAMA,GAjElB,SAAiBjgB,EAAS8b,EAAY9R,GAClC,GAAI,CAAC,YAAa,aAAakW,KAAM/c,GAAMA,KAAK6G,GAC5C,MAAM,IAAIvL,MAAM,uCACpB,MAAMsT,KAAEA,EAAAC,QAAMA,EAAAiM,aAASA,GAAiBxM,GAAgBzH,EAAMgU,GAC9Dhe,EAAU+f,EAAmB/f,EAASgS,GAItC,MAAMmO,EAAQvC,EAAc5d,GACtBoL,EAAI2I,GAAejF,EAAIgN,GACvBsE,EAAW,CAACN,EAAW1U,GAAI0U,EAAWK,IAE5C,GAAoB,MAAhBlC,IAAyC,IAAjBA,EAAwB,CAGhD,MAAMlc,GAAqB,IAAjBkc,EAAwB5B,EAAY/G,EAAQyG,WAAakC,EACnEmC,EAAS/Q,KAAKzN,EAAY,eAAgBG,GAC9C,CACA,MAAMwa,EAAOxG,EAAAA,eAAeqK,GACtBnb,EAAIkb,EA+BV,MAAO,CAAE5D,OAAM0D,MAtBf,SAAeI,GAGX,MAAMld,EAAIwa,EAAS0C,GACnB,IAAKvR,EAAGhE,YAAY3H,GAChB,OACJ,MAAMmd,EAAKxR,EAAG9F,IAAI7F,GACZod,EAAI3R,EAAMC,KAAKwK,SAASlW,GAAG2J,WAC3B9H,EAAI8J,EAAGvQ,OAAOgiB,EAAE7b,GACtB,GAAIM,IAAM/E,GACN,OACJ,MAAMuQ,EAAI1B,EAAGvQ,OAAO+hB,EAAKxR,EAAGvQ,OAAO0G,EAAID,EAAIoG,IAC3C,GAAIoF,IAAMvQ,GACN,OACJ,IAAIqe,GAAYiC,EAAE7b,IAAMM,EAAI,EAAI,GAAKkI,OAAOqT,EAAE3K,EAAI1V,IAC9CsgB,EAAQhQ,EAKZ,OAJIuB,GAAQoM,EAAsB3N,KAC9BgQ,EAAQ1R,EAAGtH,IAAIgJ,GACf8N,GAAY,GAET,IAAID,EAAUrZ,EAAGwb,EAAOlC,EACnC,EAEJ,CAc4BmC,CAAQzgB,EAAS+b,EAAW/R,GAGpD,OHzgCD,SAAwB0W,EAASC,EAAUC,GAC9C,GAAuB,iBAAZF,GAAwBA,EAAU,EACzC,MAAM,IAAIjiB,MAAM,4BACpB,GAAwB,iBAAbkiB,GAAyBA,EAAW,EAC3C,MAAM,IAAIliB,MAAM,6BACpB,GAAsB,mBAAXmiB,EACP,MAAM,IAAIniB,MAAM,6BAEpB,MAAMoiB,EAAOpgB,GAAQ,IAAI5B,WAAW4B,GAC9BqgB,EAAQC,GAASliB,WAAWoX,GAAG8K,GACrC,IAAI3d,EAAIyd,EAAIH,GACRvd,EAAI0d,EAAIH,GACRzhB,EAAI,EACR,MAAM+hB,EAAQ,KACV5d,EAAEuF,KAAK,GACPxF,EAAEwF,KAAK,GACP1J,EAAI,GAEF2V,EAAI,IAAIrQ,IAAMqc,EAAOzd,EAAGC,KAAMmB,GAC9B0c,EAAS,CAAC1E,EAAOsE,EAAI,MAEvB1d,EAAIyR,EAAEkM,EAAK,GAAOvE,GAClBnZ,EAAIwR,IACgB,IAAhB2H,EAAKxd,SAEToE,EAAIyR,EAAEkM,EAAK,GAAOvE,GAClBnZ,EAAIwR,MAEFsM,EAAM,KAER,GAAIjiB,KAAO,IACP,MAAM,IAAIR,MAAM,2BACpB,IAAIgC,EAAM,EACV,MAAMlB,EAAM,GACZ,KAAOkB,EAAMkgB,GAAU,CACnBvd,EAAIwR,IACJ,MAAMuM,EAAK/d,EAAEge,QACb7hB,EAAI8P,KAAK8R,GACT1gB,GAAO2C,EAAErE,MACb,CACA,OAAOsiB,EAAAA,eAAgB9hB,IAW3B,MATiB,CAACgd,EAAM+E,KAGpB,IAAIxf,EACJ,IAHAkf,IACAC,EAAO1E,KAEEza,EAAMwf,EAAKJ,OAChBD,IAEJ,OADAD,IACOlf,EAGf,CGm9BqByf,CAAe1jB,EAAKc,UAAWmQ,EAAGtE,MAAOzK,EAC1CyhB,CAAKjF,EAAM0D,EAE3B,EA4FIwB,OA3CJ,SAAgBxF,EAAWjc,EAASmW,EAAWnM,EAAO,CAAA,GAClD,MAAM+H,KAAEA,EAAAC,QAAMA,EAAAR,OAASA,GAAWC,GAAgBzH,EAAMgU,GAGxD,GAFA7H,EAAYvU,EAAY,YAAauU,GACrCnW,EAAU+f,EAAmBne,EAAY,UAAW5B,GAAUgS,GAC1D,WAAYhI,EACZ,MAAM,IAAIvL,MAAM,sCACpB,MAAMoV,OAAiB,IAAXrC,EAtDhB,SAAuBkQ,GAEnB,IAAI7N,EACJ,MAAM8N,EAAsB,iBAAPD,GAAmBE,EAAAA,QAAQF,GAC1CG,GAASF,GACJ,OAAPD,GACc,iBAAPA,GACS,iBAATA,EAAG1c,GACM,iBAAT0c,EAAGlR,EACd,IAAKmR,IAAUE,EACX,MAAM,IAAIpjB,MAAM,4EACpB,GAAIojB,EACAhO,EAAM,IAAIwK,EAAUqD,EAAG1c,EAAG0c,EAAGlR,WAExBmR,EAAO,CACZ,IACI9N,EAAMwK,EAAU1S,UAAU/J,EAAY,MAAO8f,GAAK,MACtD,OACOI,GACH,KAAMA,aAAoB5P,GAAIC,KAC1B,MAAM2P,CACd,CACA,IAAKjO,EACD,IACIA,EAAMwK,EAAU1S,UAAU/J,EAAY,MAAO8f,GAAK,UACtD,OACOzN,GACH,OAAO,CACX,CAER,CACA,OAAKJ,IACM,CAEf,CAqBUkO,CAAc9F,GACdoC,EAAU1S,UAAU/J,EAAY,MAAOqa,GAAYzK,GACzD,IAAY,IAARqC,EACA,OAAO,EACX,IACI,MAAM1N,EAAIyI,EAAMjD,UAAUwK,GAC1B,GAAIpE,GAAQ8B,EAAIuL,WACZ,OAAO,EACX,MAAMpa,EAAEA,EAAAwL,EAAGA,GAAMqD,EACXe,EAAIgJ,EAAc5d,GAClBgiB,EAAKlT,EAAG9F,IAAIwH,GACZ0O,EAAKpQ,EAAGvQ,OAAOqW,EAAIoN,GACnB7C,EAAKrQ,EAAGvQ,OAAOyG,EAAIgd,GACnBhb,EAAI4H,EAAMC,KAAKgM,eAAeqE,GAAIhU,IAAI/E,EAAE0U,eAAesE,IAC7D,GAAInY,EAAEJ,MACF,OAAO,EAEX,OADUkI,EAAGvQ,OAAOyI,EAAEtC,KACTM,CACjB,OACOjD,GACH,OAAO,CACX,CACJ,EAeI6c,iBAdJ,SAA0B3C,EAAWjc,EAASgK,EAAO,CAAA,GACjD,MAAMgI,QAAEA,GAAYP,GAAgBzH,EAAMgU,GAE1C,OADAhe,EAAU+f,EAAmB/f,EAASgS,GAC/BqM,EAAU1S,UAAUsQ,EAAW,aAAa2C,iBAAiB5e,GAAS3B,SACjF,EAWIggB,YACAxgB,QAER,CAsCA,SAASokB,GAA0Bnb,GAC/B,MAAMyN,MAAEA,EAAAC,UAAOA,GAhCnB,SAAyC1N,GACrC,MAAMyN,EAAQ,CACVjQ,EAAGwC,EAAExC,EACLC,EAAGuC,EAAEvC,EACL4G,EAAGrE,EAAE3B,GAAGM,MACRjE,EAAGsF,EAAEtF,EACLoT,EAAG9N,EAAE8N,EACLsC,GAAIpQ,EAAEoQ,GACNC,GAAIrQ,EAAEqQ,IAEJhS,EAAK2B,EAAE3B,GACb,IAAIgF,EAAiBrD,EAAEob,yBACjBxZ,MAAMrH,KAAK,IAAI8gB,IAAIrb,EAAEob,yBAAyB3e,IAAKyP,GAAMpJ,KAAKC,KAAKmJ,EAAI,WACvE,EAgBN,MAAO,CAAEuB,QAAOC,UAVE,CACdrP,KACA2J,GAPOtI,EAAM+N,EAAM/S,EAAG,CACtB+I,KAAMzD,EAAE0C,WACRW,iBACAC,aAActD,EAAEqO,iBAKhBJ,mBAAoBjO,EAAEiO,mBACtBG,KAAMpO,EAAEoO,KACRD,cAAenO,EAAEmO,cACjBD,cAAelO,EAAEkO,cACjBrJ,UAAW7E,EAAE6E,UACbtN,QAASyI,EAAEzI,SAGnB,CAEiC+jB,CAAgCtb,GACvD4W,EAAY,CACd3d,KAAM+G,EAAE/G,KACRsc,YAAavV,EAAEuV,YACftK,KAAMjL,EAAEiL,KACR4L,SAAU7W,EAAE6W,SACZC,cAAe9W,EAAE8W,eAErB,MAAO,CAAErJ,QAAOC,YAAW3W,KAAMiJ,EAAEjJ,KAAM6f,YAC7C,CAoCO,SAAS2E,GAAYvb,GACxB,MAAMyN,MAAEA,EAAAC,UAAOA,EAAA3W,KAAWA,YAAM6f,GAAcuE,GAA0Bnb,GAGxE,OAZJ,SAAqCA,EAAGwb,GACpC,MAAM1T,EAAQ0T,EAAO1T,MACrB,OAAOhP,OAAO8U,OAAO,CAAA,EAAI4N,EAAQ,CAC7BC,gBAAiB3T,EACjB2F,MAAO3U,OAAO8U,OAAO,CAAA,EAAI5N,EAAGyC,EAAQqF,EAAME,GAAGrJ,MAAOmJ,EAAME,GAAGvE,QAErE,CAMWiY,CAA4B1b,EADrB2W,GADAvJ,GAAaK,EAAOC,GACP3W,EAAM6f,GAErC;;;ACj3CA,MAAM+E,GAAkB,CACpBtX,EAAGnK,OAAO,sEACVQ,EAAGR,OAAO,sEACV4T,EAAG5T,OAAO,GACVsD,EAAGtD,OAAO,GACVuD,EAAGvD,OAAO,GACVkW,GAAIlW,OAAO,sEACXmW,GAAInW,OAAO,uEAET0hB,GAAiB,CACnBtN,KAAMpU,OAAO,sEACbqU,QAAS,CACL,CAACrU,OAAO,uCAAwCA,OAAO,uCACvD,CAACA,OAAO,uCAAwCA,OAAO,yCAKzD6C,UAA6B,GA6BnC,MAAM8e,GAAOnc,EAAMic,GAAgBtX,EAAG,CAAEd,KAxBxC,SAAiBuL,GACb,MAAMzP,EAAIsc,GAAgBtX,EAEpBrH,EAAM9C,OAAO,GAAI4hB,EAAM5hB,OAAO,GAAI6hB,EAAO7hB,OAAO,IAAK8hB,EAAO9hB,OAAO,IAEnE+hB,EAAO/hB,OAAO,IAAKgiB,EAAOhiB,OAAO,IAAKiiB,EAAOjiB,OAAO,IACpD+W,EAAMnC,EAAIA,EAAIA,EAAKzP,EACnB4T,EAAMhC,EAAKA,EAAKnC,EAAKzP,EACrB+c,EAAMze,EAAKsV,EAAIjW,EAAKqC,GAAK4T,EAAM5T,EAC/Bgd,EAAM1e,EAAKye,EAAIpf,EAAKqC,GAAK4T,EAAM5T,EAC/Bid,EAAO3e,EAAK0e,EAAItf,GAAKsC,GAAK4R,EAAM5R,EAChCkd,EAAO5e,EAAK2e,EAAKP,EAAM1c,GAAKid,EAAOjd,EACnCmd,EAAO7e,EAAK4e,EAAKP,EAAM3c,GAAKkd,EAAOld,EACnCod,EAAO9e,EAAK6e,EAAKN,EAAM7c,GAAKmd,EAAOnd,EACnCqd,EAAQ/e,EAAK8e,EAAKN,EAAM9c,GAAKod,EAAOpd,EACpCsd,EAAQhf,EAAK+e,EAAMR,EAAM7c,GAAKmd,EAAOnd,EACrCud,EAAQjf,EAAKgf,EAAM3f,EAAKqC,GAAK4T,EAAM5T,EACnCiU,EAAM3V,EAAKif,EAAMX,EAAM5c,GAAKkd,EAAOld,EACnCkU,EAAM5V,EAAK2V,EAAIwI,EAAKzc,GAAK4R,EAAM5R,EAC/Bf,EAAOX,EAAK4V,EAAIxW,GAAKsC,GAC3B,IAAKwc,GAAKtd,IAAIsd,GAAKrd,IAAIF,GAAOwQ,GAC1B,MAAM,IAAInX,MAAM,2BACpB,OAAO2G,CACX,IAgBaue,GCrEN,SAAqBC,EAAUC,GAClC,MAAMtlB,EAAUV,GAASwkB,GAAY,IAAKuB,EAAU/lB,SACpD,MAAO,IAAKU,EAAOslB,GAAUtlB,SACjC,CDkEyBulB,CAAY,IAAKrB,GAAiBtd,GAAIwd,GAAM5Q,MAAM,EAAMmD,KAAMwN,IAAkBqB,EAAAA","x_google_ignoreList":[0,1,2,3,4,5,6]}
+{"version":3,"file":"secp256k1-BCAPF45D.cjs","sources":["../node_modules/@noble/hashes/esm/hmac.js","../node_modules/@noble/curves/esm/utils.js","../node_modules/@noble/curves/esm/abstract/modular.js","../node_modules/@noble/curves/esm/abstract/curve.js","../node_modules/@noble/curves/esm/abstract/weierstrass.js","../node_modules/@noble/curves/esm/secp256k1.js","../node_modules/@noble/curves/esm/_shortw_utils.js"],"sourcesContent":["/**\n * HMAC: RFC2104 message authentication code.\n * @module\n */\nimport { abytes, aexists, ahash, clean, Hash, toBytes } from \"./utils.js\";\nexport class HMAC extends Hash {\n    constructor(hash, _key) {\n        super();\n        this.finished = false;\n        this.destroyed = false;\n        ahash(hash);\n        const key = toBytes(_key);\n        this.iHash = hash.create();\n        if (typeof this.iHash.update !== 'function')\n            throw new Error('Expected instance of class which extends utils.Hash');\n        this.blockLen = this.iHash.blockLen;\n        this.outputLen = this.iHash.outputLen;\n        const blockLen = this.blockLen;\n        const pad = new Uint8Array(blockLen);\n        // blockLen can be bigger than outputLen\n        pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36;\n        this.iHash.update(pad);\n        // By doing update (processing of first block) of outer hash here we can re-use it between multiple calls via clone\n        this.oHash = hash.create();\n        // Undo internal XOR && apply outer XOR\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36 ^ 0x5c;\n        this.oHash.update(pad);\n        clean(pad);\n    }\n    update(buf) {\n        aexists(this);\n        this.iHash.update(buf);\n        return this;\n    }\n    digestInto(out) {\n        aexists(this);\n        abytes(out, this.outputLen);\n        this.finished = true;\n        this.iHash.digestInto(out);\n        this.oHash.update(out);\n        this.oHash.digestInto(out);\n        this.destroy();\n    }\n    digest() {\n        const out = new Uint8Array(this.oHash.outputLen);\n        this.digestInto(out);\n        return out;\n    }\n    _cloneInto(to) {\n        // Create new instance without calling constructor since key already in state and we don't know it.\n        to || (to = Object.create(Object.getPrototypeOf(this), {}));\n        const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;\n        to = to;\n        to.finished = finished;\n        to.destroyed = destroyed;\n        to.blockLen = blockLen;\n        to.outputLen = outputLen;\n        to.oHash = oHash._cloneInto(to.oHash);\n        to.iHash = iHash._cloneInto(to.iHash);\n        return to;\n    }\n    clone() {\n        return this._cloneInto();\n    }\n    destroy() {\n        this.destroyed = true;\n        this.oHash.destroy();\n        this.iHash.destroy();\n    }\n}\n/**\n * HMAC: RFC2104 message authentication code.\n * @param hash - function that would be used e.g. sha256\n * @param key - message key\n * @param message - message data\n * @example\n * import { hmac } from '@noble/hashes/hmac';\n * import { sha256 } from '@noble/hashes/sha2';\n * const mac1 = hmac(sha256, 'key', 'message');\n */\nexport const hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();\nhmac.create = (hash, key) => new HMAC(hash, key);\n//# sourceMappingURL=hmac.js.map","/**\n * Hex, bytes and number utilities.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { abytes as abytes_, bytesToHex as bytesToHex_, concatBytes as concatBytes_, hexToBytes as hexToBytes_, isBytes as isBytes_, } from '@noble/hashes/utils.js';\nexport { abytes, anumber, bytesToHex, bytesToUtf8, concatBytes, hexToBytes, isBytes, randomBytes, utf8ToBytes, } from '@noble/hashes/utils.js';\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\nexport function abool(title, value) {\n    if (typeof value !== 'boolean')\n        throw new Error(title + ' boolean expected, got ' + value);\n}\n// tmp name until v2\nexport function _abool2(value, title = '') {\n    if (typeof value !== 'boolean') {\n        const prefix = title && `\"${title}\"`;\n        throw new Error(prefix + 'expected boolean, got type=' + typeof value);\n    }\n    return value;\n}\n// tmp name until v2\n/** Asserts something is Uint8Array. */\nexport function _abytes2(value, length, title = '') {\n    const bytes = isBytes_(value);\n    const len = value?.length;\n    const needsLen = length !== undefined;\n    if (!bytes || (needsLen && len !== length)) {\n        const prefix = title && `\"${title}\" `;\n        const ofLen = needsLen ? ` of length ${length}` : '';\n        const got = bytes ? `length=${len}` : `type=${typeof value}`;\n        throw new Error(prefix + 'expected Uint8Array' + ofLen + ', got ' + got);\n    }\n    return value;\n}\n// Used in weierstrass, der\nexport function numberToHexUnpadded(num) {\n    const hex = num.toString(16);\n    return hex.length & 1 ? '0' + hex : hex;\n}\nexport function hexToNumber(hex) {\n    if (typeof hex !== 'string')\n        throw new Error('hex string expected, got ' + typeof hex);\n    return hex === '' ? _0n : BigInt('0x' + hex); // Big Endian\n}\n// BE: Big Endian, LE: Little Endian\nexport function bytesToNumberBE(bytes) {\n    return hexToNumber(bytesToHex_(bytes));\n}\nexport function bytesToNumberLE(bytes) {\n    abytes_(bytes);\n    return hexToNumber(bytesToHex_(Uint8Array.from(bytes).reverse()));\n}\nexport function numberToBytesBE(n, len) {\n    return hexToBytes_(n.toString(16).padStart(len * 2, '0'));\n}\nexport function numberToBytesLE(n, len) {\n    return numberToBytesBE(n, len).reverse();\n}\n// Unpadded, rarely used\nexport function numberToVarBytesBE(n) {\n    return hexToBytes_(numberToHexUnpadded(n));\n}\n/**\n * Takes hex string or Uint8Array, converts to Uint8Array.\n * Validates output length.\n * Will throw error for other types.\n * @param title descriptive title for an error e.g. 'secret key'\n * @param hex hex string or Uint8Array\n * @param expectedLength optional, will compare to result array's length\n * @returns\n */\nexport function ensureBytes(title, hex, expectedLength) {\n    let res;\n    if (typeof hex === 'string') {\n        try {\n            res = hexToBytes_(hex);\n        }\n        catch (e) {\n            throw new Error(title + ' must be hex string or Uint8Array, cause: ' + e);\n        }\n    }\n    else if (isBytes_(hex)) {\n        // Uint8Array.from() instead of hash.slice() because node.js Buffer\n        // is instance of Uint8Array, and its slice() creates **mutable** copy\n        res = Uint8Array.from(hex);\n    }\n    else {\n        throw new Error(title + ' must be hex string or Uint8Array');\n    }\n    const len = res.length;\n    if (typeof expectedLength === 'number' && len !== expectedLength)\n        throw new Error(title + ' of length ' + expectedLength + ' expected, got ' + len);\n    return res;\n}\n// Compares 2 u8a-s in kinda constant time\nexport function equalBytes(a, b) {\n    if (a.length !== b.length)\n        return false;\n    let diff = 0;\n    for (let i = 0; i < a.length; i++)\n        diff |= a[i] ^ b[i];\n    return diff === 0;\n}\n/**\n * Copies Uint8Array. We can't use u8a.slice(), because u8a can be Buffer,\n * and Buffer#slice creates mutable copy. Never use Buffers!\n */\nexport function copyBytes(bytes) {\n    return Uint8Array.from(bytes);\n}\n/**\n * Decodes 7-bit ASCII string to Uint8Array, throws on non-ascii symbols\n * Should be safe to use for things expected to be ASCII.\n * Returns exact same result as utf8ToBytes for ASCII or throws.\n */\nexport function asciiToBytes(ascii) {\n    return Uint8Array.from(ascii, (c, i) => {\n        const charCode = c.charCodeAt(0);\n        if (c.length !== 1 || charCode > 127) {\n            throw new Error(`string contains non-ASCII character \"${ascii[i]}\" with code ${charCode} at position ${i}`);\n        }\n        return charCode;\n    });\n}\n/**\n * @example utf8ToBytes('abc') // new Uint8Array([97, 98, 99])\n */\n// export const utf8ToBytes: typeof utf8ToBytes_ = utf8ToBytes_;\n/**\n * Converts bytes to string using UTF8 encoding.\n * @example bytesToUtf8(Uint8Array.from([97, 98, 99])) // 'abc'\n */\n// export const bytesToUtf8: typeof bytesToUtf8_ = bytesToUtf8_;\n// Is positive bigint\nconst isPosBig = (n) => typeof n === 'bigint' && _0n <= n;\nexport function inRange(n, min, max) {\n    return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;\n}\n/**\n * Asserts min <= n < max. NOTE: It's < max and not <= max.\n * @example\n * aInRange('x', x, 1n, 256n); // would assume x is in (1n..255n)\n */\nexport function aInRange(title, n, min, max) {\n    // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)?\n    // consider P=256n, min=0n, max=P\n    // - a for min=0 would require -1:          `inRange('x', x, -1n, P)`\n    // - b would commonly require subtraction:  `inRange('x', x, 0n, P - 1n)`\n    // - our way is the cleanest:               `inRange('x', x, 0n, P)\n    if (!inRange(n, min, max))\n        throw new Error('expected valid ' + title + ': ' + min + ' <= n < ' + max + ', got ' + n);\n}\n// Bit operations\n/**\n * Calculates amount of bits in a bigint.\n * Same as `n.toString(2).length`\n * TODO: merge with nLength in modular\n */\nexport function bitLen(n) {\n    let len;\n    for (len = 0; n > _0n; n >>= _1n, len += 1)\n        ;\n    return len;\n}\n/**\n * Gets single bit at position.\n * NOTE: first bit position is 0 (same as arrays)\n * Same as `!!+Array.from(n.toString(2)).reverse()[pos]`\n */\nexport function bitGet(n, pos) {\n    return (n >> BigInt(pos)) & _1n;\n}\n/**\n * Sets single bit at position.\n */\nexport function bitSet(n, pos, value) {\n    return n | ((value ? _1n : _0n) << BigInt(pos));\n}\n/**\n * Calculate mask for N bits. Not using ** operator with bigints because of old engines.\n * Same as BigInt(`0b${Array(i).fill('1').join('')}`)\n */\nexport const bitMask = (n) => (_1n << BigInt(n)) - _1n;\n/**\n * Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n * @returns function that will call DRBG until 2nd arg returns something meaningful\n * @example\n *   const drbg = createHmacDRBG<Key>(32, 32, hmac);\n *   drbg(seed, bytesToKey); // bytesToKey must return Key or undefined\n */\nexport function createHmacDrbg(hashLen, qByteLen, hmacFn) {\n    if (typeof hashLen !== 'number' || hashLen < 2)\n        throw new Error('hashLen must be a number');\n    if (typeof qByteLen !== 'number' || qByteLen < 2)\n        throw new Error('qByteLen must be a number');\n    if (typeof hmacFn !== 'function')\n        throw new Error('hmacFn must be a function');\n    // Step B, Step C: set hashLen to 8*ceil(hlen/8)\n    const u8n = (len) => new Uint8Array(len); // creates Uint8Array\n    const u8of = (byte) => Uint8Array.of(byte); // another shortcut\n    let v = u8n(hashLen); // Minimal non-full-spec HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n    let k = u8n(hashLen); // Steps B and C of RFC6979 3.2: set hashLen, in our case always same\n    let i = 0; // Iterations counter, will throw when over 1000\n    const reset = () => {\n        v.fill(1);\n        k.fill(0);\n        i = 0;\n    };\n    const h = (...b) => hmacFn(k, v, ...b); // hmac(k)(v, ...values)\n    const reseed = (seed = u8n(0)) => {\n        // HMAC-DRBG reseed() function. Steps D-G\n        k = h(u8of(0x00), seed); // k = hmac(k || v || 0x00 || seed)\n        v = h(); // v = hmac(k || v)\n        if (seed.length === 0)\n            return;\n        k = h(u8of(0x01), seed); // k = hmac(k || v || 0x01 || seed)\n        v = h(); // v = hmac(k || v)\n    };\n    const gen = () => {\n        // HMAC-DRBG generate() function\n        if (i++ >= 1000)\n            throw new Error('drbg: tried 1000 values');\n        let len = 0;\n        const out = [];\n        while (len < qByteLen) {\n            v = h();\n            const sl = v.slice();\n            out.push(sl);\n            len += v.length;\n        }\n        return concatBytes_(...out);\n    };\n    const genUntil = (seed, pred) => {\n        reset();\n        reseed(seed); // Steps D-G\n        let res = undefined; // Step H: grind until k is in [1..n-1]\n        while (!(res = pred(gen())))\n            reseed();\n        reset();\n        return res;\n    };\n    return genUntil;\n}\n// Validating curves and fields\nconst validatorFns = {\n    bigint: (val) => typeof val === 'bigint',\n    function: (val) => typeof val === 'function',\n    boolean: (val) => typeof val === 'boolean',\n    string: (val) => typeof val === 'string',\n    stringOrUint8Array: (val) => typeof val === 'string' || isBytes_(val),\n    isSafeInteger: (val) => Number.isSafeInteger(val),\n    array: (val) => Array.isArray(val),\n    field: (val, object) => object.Fp.isValid(val),\n    hash: (val) => typeof val === 'function' && Number.isSafeInteger(val.outputLen),\n};\n// type Record<K extends string | number | symbol, T> = { [P in K]: T; }\nexport function validateObject(object, validators, optValidators = {}) {\n    const checkField = (fieldName, type, isOptional) => {\n        const checkVal = validatorFns[type];\n        if (typeof checkVal !== 'function')\n            throw new Error('invalid validator function');\n        const val = object[fieldName];\n        if (isOptional && val === undefined)\n            return;\n        if (!checkVal(val, object)) {\n            throw new Error('param ' + String(fieldName) + ' is invalid. Expected ' + type + ', got ' + val);\n        }\n    };\n    for (const [fieldName, type] of Object.entries(validators))\n        checkField(fieldName, type, false);\n    for (const [fieldName, type] of Object.entries(optValidators))\n        checkField(fieldName, type, true);\n    return object;\n}\n// validate type tests\n// const o: { a: number; b: number; c: number } = { a: 1, b: 5, c: 6 };\n// const z0 = validateObject(o, { a: 'isSafeInteger' }, { c: 'bigint' }); // Ok!\n// // Should fail type-check\n// const z1 = validateObject(o, { a: 'tmp' }, { c: 'zz' });\n// const z2 = validateObject(o, { a: 'isSafeInteger' }, { c: 'zz' });\n// const z3 = validateObject(o, { test: 'boolean', z: 'bug' });\n// const z4 = validateObject(o, { a: 'boolean', z: 'bug' });\nexport function isHash(val) {\n    return typeof val === 'function' && Number.isSafeInteger(val.outputLen);\n}\nexport function _validateObject(object, fields, optFields = {}) {\n    if (!object || typeof object !== 'object')\n        throw new Error('expected valid options object');\n    function checkField(fieldName, expectedType, isOpt) {\n        const val = object[fieldName];\n        if (isOpt && val === undefined)\n            return;\n        const current = typeof val;\n        if (current !== expectedType || val === null)\n            throw new Error(`param \"${fieldName}\" is invalid: expected ${expectedType}, got ${current}`);\n    }\n    Object.entries(fields).forEach(([k, v]) => checkField(k, v, false));\n    Object.entries(optFields).forEach(([k, v]) => checkField(k, v, true));\n}\n/**\n * throws not implemented error\n */\nexport const notImplemented = () => {\n    throw new Error('not implemented');\n};\n/**\n * Memoizes (caches) computation result.\n * Uses WeakMap: the value is going auto-cleaned by GC after last reference is removed.\n */\nexport function memoized(fn) {\n    const map = new WeakMap();\n    return (arg, ...args) => {\n        const val = map.get(arg);\n        if (val !== undefined)\n            return val;\n        const computed = fn(arg, ...args);\n        map.set(arg, computed);\n        return computed;\n    };\n}\n//# sourceMappingURL=utils.js.map","/**\n * Utils for modular division and fields.\n * Field over 11 is a finite (Galois) field is integer number operations `mod 11`.\n * There is no division: it is replaced by modular multiplicative inverse.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { _validateObject, anumber, bitMask, bytesToNumberBE, bytesToNumberLE, ensureBytes, numberToBytesBE, numberToBytesLE, } from \"../utils.js\";\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _3n = /* @__PURE__ */ BigInt(3);\n// prettier-ignore\nconst _4n = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5), _7n = /* @__PURE__ */ BigInt(7);\n// prettier-ignore\nconst _8n = /* @__PURE__ */ BigInt(8), _9n = /* @__PURE__ */ BigInt(9), _16n = /* @__PURE__ */ BigInt(16);\n// Calculates a modulo b\nexport function mod(a, b) {\n    const result = a % b;\n    return result >= _0n ? result : b + result;\n}\n/**\n * Efficiently raise num to power and do modular division.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * @example\n * pow(2n, 6n, 11n) // 64n % 11n == 9n\n */\nexport function pow(num, power, modulo) {\n    return FpPow(Field(modulo), num, power);\n}\n/** Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)` */\nexport function pow2(x, power, modulo) {\n    let res = x;\n    while (power-- > _0n) {\n        res *= res;\n        res %= modulo;\n    }\n    return res;\n}\n/**\n * Inverses number over modulo.\n * Implemented using [Euclidean GCD](https://brilliant.org/wiki/extended-euclidean-algorithm/).\n */\nexport function invert(number, modulo) {\n    if (number === _0n)\n        throw new Error('invert: expected non-zero number');\n    if (modulo <= _0n)\n        throw new Error('invert: expected positive modulus, got ' + modulo);\n    // Fermat's little theorem \"CT-like\" version inv(n) = n^(m-2) mod m is 30x slower.\n    let a = mod(number, modulo);\n    let b = modulo;\n    // prettier-ignore\n    let x = _0n, y = _1n, u = _1n, v = _0n;\n    while (a !== _0n) {\n        // JIT applies optimization if those two lines follow each other\n        const q = b / a;\n        const r = b % a;\n        const m = x - u * q;\n        const n = y - v * q;\n        // prettier-ignore\n        b = a, a = r, x = u, y = v, u = m, v = n;\n    }\n    const gcd = b;\n    if (gcd !== _1n)\n        throw new Error('invert: does not exist');\n    return mod(x, modulo);\n}\nfunction assertIsSquare(Fp, root, n) {\n    if (!Fp.eql(Fp.sqr(root), n))\n        throw new Error('Cannot find square root');\n}\n// Not all roots are possible! Example which will throw:\n// const NUM =\n// n = 72057594037927816n;\n// Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'));\nfunction sqrt3mod4(Fp, n) {\n    const p1div4 = (Fp.ORDER + _1n) / _4n;\n    const root = Fp.pow(n, p1div4);\n    assertIsSquare(Fp, root, n);\n    return root;\n}\nfunction sqrt5mod8(Fp, n) {\n    const p5div8 = (Fp.ORDER - _5n) / _8n;\n    const n2 = Fp.mul(n, _2n);\n    const v = Fp.pow(n2, p5div8);\n    const nv = Fp.mul(n, v);\n    const i = Fp.mul(Fp.mul(nv, _2n), v);\n    const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));\n    assertIsSquare(Fp, root, n);\n    return root;\n}\n// Based on RFC9380, Kong algorithm\n// prettier-ignore\nfunction sqrt9mod16(P) {\n    const Fp_ = Field(P);\n    const tn = tonelliShanks(P);\n    const c1 = tn(Fp_, Fp_.neg(Fp_.ONE)); //  1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F\n    const c2 = tn(Fp_, c1); //  2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F\n    const c3 = tn(Fp_, Fp_.neg(c1)); //  3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F\n    const c4 = (P + _7n) / _16n; //  4. c4 = (q + 7) / 16        # Integer arithmetic\n    return (Fp, n) => {\n        let tv1 = Fp.pow(n, c4); //  1. tv1 = x^c4\n        let tv2 = Fp.mul(tv1, c1); //  2. tv2 = c1 * tv1\n        const tv3 = Fp.mul(tv1, c2); //  3. tv3 = c2 * tv1\n        const tv4 = Fp.mul(tv1, c3); //  4. tv4 = c3 * tv1\n        const e1 = Fp.eql(Fp.sqr(tv2), n); //  5.  e1 = (tv2^2) == x\n        const e2 = Fp.eql(Fp.sqr(tv3), n); //  6.  e2 = (tv3^2) == x\n        tv1 = Fp.cmov(tv1, tv2, e1); //  7. tv1 = CMOV(tv1, tv2, e1)  # Select tv2 if (tv2^2) == x\n        tv2 = Fp.cmov(tv4, tv3, e2); //  8. tv2 = CMOV(tv4, tv3, e2)  # Select tv3 if (tv3^2) == x\n        const e3 = Fp.eql(Fp.sqr(tv2), n); //  9.  e3 = (tv2^2) == x\n        const root = Fp.cmov(tv1, tv2, e3); // 10.  z = CMOV(tv1, tv2, e3)   # Select sqrt from tv1 & tv2\n        assertIsSquare(Fp, root, n);\n        return root;\n    };\n}\n/**\n * Tonelli-Shanks square root search algorithm.\n * 1. https://eprint.iacr.org/2012/685.pdf (page 12)\n * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks\n * @param P field order\n * @returns function that takes field Fp (created from P) and number n\n */\nexport function tonelliShanks(P) {\n    // Initialization (precomputation).\n    // Caching initialization could boost perf by 7%.\n    if (P < _3n)\n        throw new Error('sqrt is not defined for small field');\n    // Factor P - 1 = Q * 2^S, where Q is odd\n    let Q = P - _1n;\n    let S = 0;\n    while (Q % _2n === _0n) {\n        Q /= _2n;\n        S++;\n    }\n    // Find the first quadratic non-residue Z >= 2\n    let Z = _2n;\n    const _Fp = Field(P);\n    while (FpLegendre(_Fp, Z) === 1) {\n        // Basic primality test for P. After x iterations, chance of\n        // not finding quadratic non-residue is 2^x, so 2^1000.\n        if (Z++ > 1000)\n            throw new Error('Cannot find square root: probably non-prime P');\n    }\n    // Fast-path; usually done before Z, but we do \"primality test\".\n    if (S === 1)\n        return sqrt3mod4;\n    // Slow-path\n    // TODO: test on Fp2 and others\n    let cc = _Fp.pow(Z, Q); // c = z^Q\n    const Q1div2 = (Q + _1n) / _2n;\n    return function tonelliSlow(Fp, n) {\n        if (Fp.is0(n))\n            return n;\n        // Check if n is a quadratic residue using Legendre symbol\n        if (FpLegendre(Fp, n) !== 1)\n            throw new Error('Cannot find square root');\n        // Initialize variables for the main loop\n        let M = S;\n        let c = Fp.mul(Fp.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp\n        let t = Fp.pow(n, Q); // t = n^Q, first guess at the fudge factor\n        let R = Fp.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root\n        // Main loop\n        // while t != 1\n        while (!Fp.eql(t, Fp.ONE)) {\n            if (Fp.is0(t))\n                return Fp.ZERO; // if t=0 return R=0\n            let i = 1;\n            // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P)\n            let t_tmp = Fp.sqr(t); // t^(2^1)\n            while (!Fp.eql(t_tmp, Fp.ONE)) {\n                i++;\n                t_tmp = Fp.sqr(t_tmp); // t^(2^2)...\n                if (i === M)\n                    throw new Error('Cannot find square root');\n            }\n            // Calculate the exponent for b: 2^(M - i - 1)\n            const exponent = _1n << BigInt(M - i - 1); // bigint is important\n            const b = Fp.pow(c, exponent); // b = 2^(M - i - 1)\n            // Update variables\n            M = i;\n            c = Fp.sqr(b); // c = b^2\n            t = Fp.mul(t, c); // t = (t * b^2)\n            R = Fp.mul(R, b); // R = R*b\n        }\n        return R;\n    };\n}\n/**\n * Square root for a finite field. Will try optimized versions first:\n *\n * 1. P ≡ 3 (mod 4)\n * 2. P ≡ 5 (mod 8)\n * 3. P ≡ 9 (mod 16)\n * 4. Tonelli-Shanks algorithm\n *\n * Different algorithms can give different roots, it is up to user to decide which one they want.\n * For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).\n */\nexport function FpSqrt(P) {\n    // P ≡ 3 (mod 4) => √n = n^((P+1)/4)\n    if (P % _4n === _3n)\n        return sqrt3mod4;\n    // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf\n    if (P % _8n === _5n)\n        return sqrt5mod8;\n    // P ≡ 9 (mod 16) => Kong algorithm, page 11 of https://eprint.iacr.org/2012/685.pdf (algorithm 4)\n    if (P % _16n === _9n)\n        return sqrt9mod16(P);\n    // Tonelli-Shanks algorithm\n    return tonelliShanks(P);\n}\n// Little-endian check for first LE bit (last BE bit);\nexport const isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n) === _1n;\n// prettier-ignore\nconst FIELD_FIELDS = [\n    'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',\n    'eql', 'add', 'sub', 'mul', 'pow', 'div',\n    'addN', 'subN', 'mulN', 'sqrN'\n];\nexport function validateField(field) {\n    const initial = {\n        ORDER: 'bigint',\n        MASK: 'bigint',\n        BYTES: 'number',\n        BITS: 'number',\n    };\n    const opts = FIELD_FIELDS.reduce((map, val) => {\n        map[val] = 'function';\n        return map;\n    }, initial);\n    _validateObject(field, opts);\n    // const max = 16384;\n    // if (field.BYTES < 1 || field.BYTES > max) throw new Error('invalid field');\n    // if (field.BITS < 1 || field.BITS > 8 * max) throw new Error('invalid field');\n    return field;\n}\n// Generic field functions\n/**\n * Same as `pow` but for Fp: non-constant-time.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n */\nexport function FpPow(Fp, num, power) {\n    if (power < _0n)\n        throw new Error('invalid exponent, negatives unsupported');\n    if (power === _0n)\n        return Fp.ONE;\n    if (power === _1n)\n        return num;\n    let p = Fp.ONE;\n    let d = num;\n    while (power > _0n) {\n        if (power & _1n)\n            p = Fp.mul(p, d);\n        d = Fp.sqr(d);\n        power >>= _1n;\n    }\n    return p;\n}\n/**\n * Efficiently invert an array of Field elements.\n * Exception-free. Will return `undefined` for 0 elements.\n * @param passZero map 0 to 0 (instead of undefined)\n */\nexport function FpInvertBatch(Fp, nums, passZero = false) {\n    const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : undefined);\n    // Walk from first to last, multiply them by each other MOD p\n    const multipliedAcc = nums.reduce((acc, num, i) => {\n        if (Fp.is0(num))\n            return acc;\n        inverted[i] = acc;\n        return Fp.mul(acc, num);\n    }, Fp.ONE);\n    // Invert last element\n    const invertedAcc = Fp.inv(multipliedAcc);\n    // Walk from last to first, multiply them by inverted each other MOD p\n    nums.reduceRight((acc, num, i) => {\n        if (Fp.is0(num))\n            return acc;\n        inverted[i] = Fp.mul(acc, inverted[i]);\n        return Fp.mul(acc, num);\n    }, invertedAcc);\n    return inverted;\n}\n// TODO: remove\nexport function FpDiv(Fp, lhs, rhs) {\n    return Fp.mul(lhs, typeof rhs === 'bigint' ? invert(rhs, Fp.ORDER) : Fp.inv(rhs));\n}\n/**\n * Legendre symbol.\n * Legendre constant is used to calculate Legendre symbol (a | p)\n * which denotes the value of a^((p-1)/2) (mod p).\n *\n * * (a | p) ≡ 1    if a is a square (mod p), quadratic residue\n * * (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue\n * * (a | p) ≡ 0    if a ≡ 0 (mod p)\n */\nexport function FpLegendre(Fp, n) {\n    // We can use 3rd argument as optional cache of this value\n    // but seems unneeded for now. The operation is very fast.\n    const p1mod2 = (Fp.ORDER - _1n) / _2n;\n    const powered = Fp.pow(n, p1mod2);\n    const yes = Fp.eql(powered, Fp.ONE);\n    const zero = Fp.eql(powered, Fp.ZERO);\n    const no = Fp.eql(powered, Fp.neg(Fp.ONE));\n    if (!yes && !zero && !no)\n        throw new Error('invalid Legendre symbol result');\n    return yes ? 1 : zero ? 0 : -1;\n}\n// This function returns True whenever the value x is a square in the field F.\nexport function FpIsSquare(Fp, n) {\n    const l = FpLegendre(Fp, n);\n    return l === 1;\n}\n// CURVE.n lengths\nexport function nLength(n, nBitLength) {\n    // Bit size, byte size of CURVE.n\n    if (nBitLength !== undefined)\n        anumber(nBitLength);\n    const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length;\n    const nByteLength = Math.ceil(_nBitLength / 8);\n    return { nBitLength: _nBitLength, nByteLength };\n}\n/**\n * Creates a finite field. Major performance optimizations:\n * * 1. Denormalized operations like mulN instead of mul.\n * * 2. Identical object shape: never add or remove keys.\n * * 3. `Object.freeze`.\n * Fragile: always run a benchmark on a change.\n * Security note: operations don't check 'isValid' for all elements for performance reasons,\n * it is caller responsibility to check this.\n * This is low-level code, please make sure you know what you're doing.\n *\n * Note about field properties:\n * * CHARACTERISTIC p = prime number, number of elements in main subgroup.\n * * ORDER q = similar to cofactor in curves, may be composite `q = p^m`.\n *\n * @param ORDER field order, probably prime, or could be composite\n * @param bitLen how many bits the field consumes\n * @param isLE (default: false) if encoding / decoding should be in little-endian\n * @param redef optional faster redefinitions of sqrt and other methods\n */\nexport function Field(ORDER, bitLenOrOpts, // TODO: use opts only in v2?\nisLE = false, opts = {}) {\n    if (ORDER <= _0n)\n        throw new Error('invalid field: expected ORDER > 0, got ' + ORDER);\n    let _nbitLength = undefined;\n    let _sqrt = undefined;\n    let modFromBytes = false;\n    let allowedLengths = undefined;\n    if (typeof bitLenOrOpts === 'object' && bitLenOrOpts != null) {\n        if (opts.sqrt || isLE)\n            throw new Error('cannot specify opts in two arguments');\n        const _opts = bitLenOrOpts;\n        if (_opts.BITS)\n            _nbitLength = _opts.BITS;\n        if (_opts.sqrt)\n            _sqrt = _opts.sqrt;\n        if (typeof _opts.isLE === 'boolean')\n            isLE = _opts.isLE;\n        if (typeof _opts.modFromBytes === 'boolean')\n            modFromBytes = _opts.modFromBytes;\n        allowedLengths = _opts.allowedLengths;\n    }\n    else {\n        if (typeof bitLenOrOpts === 'number')\n            _nbitLength = bitLenOrOpts;\n        if (opts.sqrt)\n            _sqrt = opts.sqrt;\n    }\n    const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, _nbitLength);\n    if (BYTES > 2048)\n        throw new Error('invalid field: expected ORDER of <= 2048 bytes');\n    let sqrtP; // cached sqrtP\n    const f = Object.freeze({\n        ORDER,\n        isLE,\n        BITS,\n        BYTES,\n        MASK: bitMask(BITS),\n        ZERO: _0n,\n        ONE: _1n,\n        allowedLengths: allowedLengths,\n        create: (num) => mod(num, ORDER),\n        isValid: (num) => {\n            if (typeof num !== 'bigint')\n                throw new Error('invalid field element: expected bigint, got ' + typeof num);\n            return _0n <= num && num < ORDER; // 0 is valid element, but it's not invertible\n        },\n        is0: (num) => num === _0n,\n        // is valid and invertible\n        isValidNot0: (num) => !f.is0(num) && f.isValid(num),\n        isOdd: (num) => (num & _1n) === _1n,\n        neg: (num) => mod(-num, ORDER),\n        eql: (lhs, rhs) => lhs === rhs,\n        sqr: (num) => mod(num * num, ORDER),\n        add: (lhs, rhs) => mod(lhs + rhs, ORDER),\n        sub: (lhs, rhs) => mod(lhs - rhs, ORDER),\n        mul: (lhs, rhs) => mod(lhs * rhs, ORDER),\n        pow: (num, power) => FpPow(f, num, power),\n        div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),\n        // Same as above, but doesn't normalize\n        sqrN: (num) => num * num,\n        addN: (lhs, rhs) => lhs + rhs,\n        subN: (lhs, rhs) => lhs - rhs,\n        mulN: (lhs, rhs) => lhs * rhs,\n        inv: (num) => invert(num, ORDER),\n        sqrt: _sqrt ||\n            ((n) => {\n                if (!sqrtP)\n                    sqrtP = FpSqrt(ORDER);\n                return sqrtP(f, n);\n            }),\n        toBytes: (num) => (isLE ? numberToBytesLE(num, BYTES) : numberToBytesBE(num, BYTES)),\n        fromBytes: (bytes, skipValidation = true) => {\n            if (allowedLengths) {\n                if (!allowedLengths.includes(bytes.length) || bytes.length > BYTES) {\n                    throw new Error('Field.fromBytes: expected ' + allowedLengths + ' bytes, got ' + bytes.length);\n                }\n                const padded = new Uint8Array(BYTES);\n                // isLE add 0 to right, !isLE to the left.\n                padded.set(bytes, isLE ? 0 : padded.length - bytes.length);\n                bytes = padded;\n            }\n            if (bytes.length !== BYTES)\n                throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);\n            let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n            if (modFromBytes)\n                scalar = mod(scalar, ORDER);\n            if (!skipValidation)\n                if (!f.isValid(scalar))\n                    throw new Error('invalid field element: outside of range 0..ORDER');\n            // NOTE: we don't validate scalar here, please use isValid. This done such way because some\n            // protocol may allow non-reduced scalar that reduced later or changed some other way.\n            return scalar;\n        },\n        // TODO: we don't need it here, move out to separate fn\n        invertBatch: (lst) => FpInvertBatch(f, lst),\n        // We can't move this out because Fp6, Fp12 implement it\n        // and it's unclear what to return in there.\n        cmov: (a, b, c) => (c ? b : a),\n    });\n    return Object.freeze(f);\n}\n// Generic random scalar, we can do same for other fields if via Fp2.mul(Fp2.ONE, Fp2.random)?\n// This allows unsafe methods like ignore bias or zero. These unsafe, but often used in different protocols (if deterministic RNG).\n// which mean we cannot force this via opts.\n// Not sure what to do with randomBytes, we can accept it inside opts if wanted.\n// Probably need to export getMinHashLength somewhere?\n// random(bytes?: Uint8Array, unsafeAllowZero = false, unsafeAllowBias = false) {\n//   const LEN = !unsafeAllowBias ? getMinHashLength(ORDER) : BYTES;\n//   if (bytes === undefined) bytes = randomBytes(LEN); // _opts.randomBytes?\n//   const num = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n//   // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n//   const reduced = unsafeAllowZero ? mod(num, ORDER) : mod(num, ORDER - _1n) + _1n;\n//   return reduced;\n// },\nexport function FpSqrtOdd(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? root : Fp.neg(root);\n}\nexport function FpSqrtEven(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(\"Field doesn't have isOdd\");\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? Fp.neg(root) : root;\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Same as mapKeyToField, but accepts less bytes (40 instead of 48 for 32-byte field).\n * Which makes it slightly more biased, less secure.\n * @deprecated use `mapKeyToField` instead\n */\nexport function hashToPrivateScalar(hash, groupOrder, isLE = false) {\n    hash = ensureBytes('privateHash', hash);\n    const hashLen = hash.length;\n    const minLen = nLength(groupOrder).nByteLength + 8;\n    if (minLen < 24 || hashLen < minLen || hashLen > 1024)\n        throw new Error('hashToPrivateScalar: expected ' + minLen + '-1024 bytes of input, got ' + hashLen);\n    const num = isLE ? bytesToNumberLE(hash) : bytesToNumberBE(hash);\n    return mod(num, groupOrder - _1n) + _1n;\n}\n/**\n * Returns total number of bytes consumed by the field element.\n * For example, 32 bytes for usual 256-bit weierstrass curve.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of field\n */\nexport function getFieldBytesLength(fieldOrder) {\n    if (typeof fieldOrder !== 'bigint')\n        throw new Error('field order must be bigint');\n    const bitLength = fieldOrder.toString(2).length;\n    return Math.ceil(bitLength / 8);\n}\n/**\n * Returns minimal amount of bytes that can be safely reduced\n * by field order.\n * Should be 2^-128 for 128-bit curve such as P256.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of target hash\n */\nexport function getMinHashLength(fieldOrder) {\n    const length = getFieldBytesLength(fieldOrder);\n    return length + Math.ceil(length / 2);\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF\n * and convert them into private scalar, with the modulo bias being negligible.\n * Needs at least 48 bytes of input for 32-byte private key.\n * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/\n * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final\n * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5\n * @param hash hash output from SHA3 or a similar function\n * @param groupOrder size of subgroup - (e.g. secp256k1.CURVE.n)\n * @param isLE interpret hash bytes as LE num\n * @returns valid private scalar\n */\nexport function mapHashToField(key, fieldOrder, isLE = false) {\n    const len = key.length;\n    const fieldLen = getFieldBytesLength(fieldOrder);\n    const minLen = getMinHashLength(fieldOrder);\n    // No small numbers: need to understand bias story. No huge numbers: easier to detect JS timings.\n    if (len < 16 || len < minLen || len > 1024)\n        throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);\n    const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);\n    // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n    const reduced = mod(num, fieldOrder - _1n) + _1n;\n    return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);\n}\n//# sourceMappingURL=modular.js.map","/**\n * Methods for elliptic curve multiplication by scalars.\n * Contains wNAF, pippenger.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { bitLen, bitMask, validateObject } from \"../utils.js\";\nimport { Field, FpInvertBatch, nLength, validateField } from \"./modular.js\";\nconst _0n = BigInt(0);\nconst _1n = BigInt(1);\nexport function negateCt(condition, item) {\n    const neg = item.negate();\n    return condition ? neg : item;\n}\n/**\n * Takes a bunch of Projective Points but executes only one\n * inversion on all of them. Inversion is very slow operation,\n * so this improves performance massively.\n * Optimization: converts a list of projective points to a list of identical points with Z=1.\n */\nexport function normalizeZ(c, points) {\n    const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));\n    return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));\n}\nfunction validateW(W, bits) {\n    if (!Number.isSafeInteger(W) || W <= 0 || W > bits)\n        throw new Error('invalid window size, expected [1..' + bits + '], got W=' + W);\n}\nfunction calcWOpts(W, scalarBits) {\n    validateW(W, scalarBits);\n    const windows = Math.ceil(scalarBits / W) + 1; // W=8 33. Not 32, because we skip zero\n    const windowSize = 2 ** (W - 1); // W=8 128. Not 256, because we skip zero\n    const maxNumber = 2 ** W; // W=8 256\n    const mask = bitMask(W); // W=8 255 == mask 0b11111111\n    const shiftBy = BigInt(W); // W=8 8\n    return { windows, windowSize, mask, maxNumber, shiftBy };\n}\nfunction calcOffsets(n, window, wOpts) {\n    const { windowSize, mask, maxNumber, shiftBy } = wOpts;\n    let wbits = Number(n & mask); // extract W bits.\n    let nextN = n >> shiftBy; // shift number by W bits.\n    // What actually happens here:\n    // const highestBit = Number(mask ^ (mask >> 1n));\n    // let wbits2 = wbits - 1; // skip zero\n    // if (wbits2 & highestBit) { wbits2 ^= Number(mask); // (~);\n    // split if bits > max: +224 => 256-32\n    if (wbits > windowSize) {\n        // we skip zero, which means instead of `>= size-1`, we do `> size`\n        wbits -= maxNumber; // -32, can be maxNumber - wbits, but then we need to set isNeg here.\n        nextN += _1n; // +256 (carry)\n    }\n    const offsetStart = window * windowSize;\n    const offset = offsetStart + Math.abs(wbits) - 1; // -1 because we skip zero\n    const isZero = wbits === 0; // is current window slice a 0?\n    const isNeg = wbits < 0; // is current window slice negative?\n    const isNegF = window % 2 !== 0; // fake random statement for noise\n    const offsetF = offsetStart; // fake offset for noise\n    return { nextN, offset, isZero, isNeg, isNegF, offsetF };\n}\nfunction validateMSMPoints(points, c) {\n    if (!Array.isArray(points))\n        throw new Error('array expected');\n    points.forEach((p, i) => {\n        if (!(p instanceof c))\n            throw new Error('invalid point at index ' + i);\n    });\n}\nfunction validateMSMScalars(scalars, field) {\n    if (!Array.isArray(scalars))\n        throw new Error('array of scalars expected');\n    scalars.forEach((s, i) => {\n        if (!field.isValid(s))\n            throw new Error('invalid scalar at index ' + i);\n    });\n}\n// Since points in different groups cannot be equal (different object constructor),\n// we can have single place to store precomputes.\n// Allows to make points frozen / immutable.\nconst pointPrecomputes = new WeakMap();\nconst pointWindowSizes = new WeakMap();\nfunction getW(P) {\n    // To disable precomputes:\n    // return 1;\n    return pointWindowSizes.get(P) || 1;\n}\nfunction assert0(n) {\n    if (n !== _0n)\n        throw new Error('invalid wNAF');\n}\n/**\n * Elliptic curve multiplication of Point by scalar. Fragile.\n * Table generation takes **30MB of ram and 10ms on high-end CPU**,\n * but may take much longer on slow devices. Actual generation will happen on\n * first call of `multiply()`. By default, `BASE` point is precomputed.\n *\n * Scalars should always be less than curve order: this should be checked inside of a curve itself.\n * Creates precomputation tables for fast multiplication:\n * - private scalar is split by fixed size windows of W bits\n * - every window point is collected from window's table & added to accumulator\n * - since windows are different, same point inside tables won't be accessed more than once per calc\n * - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)\n * - +1 window is neccessary for wNAF\n * - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication\n *\n * @todo Research returning 2d JS array of windows, instead of a single window.\n * This would allow windows to be in different memory locations\n */\nexport class wNAF {\n    // Parametrized with a given Point class (not individual point)\n    constructor(Point, bits) {\n        this.BASE = Point.BASE;\n        this.ZERO = Point.ZERO;\n        this.Fn = Point.Fn;\n        this.bits = bits;\n    }\n    // non-const time multiplication ladder\n    _unsafeLadder(elm, n, p = this.ZERO) {\n        let d = elm;\n        while (n > _0n) {\n            if (n & _1n)\n                p = p.add(d);\n            d = d.double();\n            n >>= _1n;\n        }\n        return p;\n    }\n    /**\n     * Creates a wNAF precomputation window. Used for caching.\n     * Default window size is set by `utils.precompute()` and is equal to 8.\n     * Number of precomputed points depends on the curve size:\n     * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:\n     * - 𝑊 is the window size\n     * - 𝑛 is the bitlength of the curve order.\n     * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.\n     * @param point Point instance\n     * @param W window size\n     * @returns precomputed point tables flattened to a single array\n     */\n    precomputeWindow(point, W) {\n        const { windows, windowSize } = calcWOpts(W, this.bits);\n        const points = [];\n        let p = point;\n        let base = p;\n        for (let window = 0; window < windows; window++) {\n            base = p;\n            points.push(base);\n            // i=1, bc we skip 0\n            for (let i = 1; i < windowSize; i++) {\n                base = base.add(p);\n                points.push(base);\n            }\n            p = base.double();\n        }\n        return points;\n    }\n    /**\n     * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.\n     * More compact implementation:\n     * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541\n     * @returns real and fake (for const-time) points\n     */\n    wNAF(W, precomputes, n) {\n        // Scalar should be smaller than field order\n        if (!this.Fn.isValid(n))\n            throw new Error('invalid scalar');\n        // Accumulators\n        let p = this.ZERO;\n        let f = this.BASE;\n        // This code was first written with assumption that 'f' and 'p' will never be infinity point:\n        // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,\n        // there is negate now: it is possible that negated element from low value\n        // would be the same as high element, which will create carry into next window.\n        // It's not obvious how this can fail, but still worth investigating later.\n        const wo = calcWOpts(W, this.bits);\n        for (let window = 0; window < wo.windows; window++) {\n            // (n === _0n) is handled and not early-exited. isEven and offsetF are used for noise\n            const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);\n            n = nextN;\n            if (isZero) {\n                // bits are 0: add garbage to fake point\n                // Important part for const-time getPublicKey: add random \"noise\" point to f.\n                f = f.add(negateCt(isNegF, precomputes[offsetF]));\n            }\n            else {\n                // bits are 1: add to result point\n                p = p.add(negateCt(isNeg, precomputes[offset]));\n            }\n        }\n        assert0(n);\n        // Return both real and fake points: JIT won't eliminate f.\n        // At this point there is a way to F be infinity-point even if p is not,\n        // which makes it less const-time: around 1 bigint multiply.\n        return { p, f };\n    }\n    /**\n     * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.\n     * @param acc accumulator point to add result of multiplication\n     * @returns point\n     */\n    wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {\n        const wo = calcWOpts(W, this.bits);\n        for (let window = 0; window < wo.windows; window++) {\n            if (n === _0n)\n                break; // Early-exit, skip 0 value\n            const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);\n            n = nextN;\n            if (isZero) {\n                // Window bits are 0: skip processing.\n                // Move to next window.\n                continue;\n            }\n            else {\n                const item = precomputes[offset];\n                acc = acc.add(isNeg ? item.negate() : item); // Re-using acc allows to save adds in MSM\n            }\n        }\n        assert0(n);\n        return acc;\n    }\n    getPrecomputes(W, point, transform) {\n        // Calculate precomputes on a first run, reuse them after\n        let comp = pointPrecomputes.get(point);\n        if (!comp) {\n            comp = this.precomputeWindow(point, W);\n            if (W !== 1) {\n                // Doing transform outside of if brings 15% perf hit\n                if (typeof transform === 'function')\n                    comp = transform(comp);\n                pointPrecomputes.set(point, comp);\n            }\n        }\n        return comp;\n    }\n    cached(point, scalar, transform) {\n        const W = getW(point);\n        return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);\n    }\n    unsafe(point, scalar, transform, prev) {\n        const W = getW(point);\n        if (W === 1)\n            return this._unsafeLadder(point, scalar, prev); // For W=1 ladder is ~x2 faster\n        return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);\n    }\n    // We calculate precomputes for elliptic curve point multiplication\n    // using windowed method. This specifies window size and\n    // stores precomputed values. Usually only base point would be precomputed.\n    createCache(P, W) {\n        validateW(W, this.bits);\n        pointWindowSizes.set(P, W);\n        pointPrecomputes.delete(P);\n    }\n    hasCache(elm) {\n        return getW(elm) !== 1;\n    }\n}\n/**\n * Endomorphism-specific multiplication for Koblitz curves.\n * Cost: 128 dbl, 0-256 adds.\n */\nexport function mulEndoUnsafe(Point, point, k1, k2) {\n    let acc = point;\n    let p1 = Point.ZERO;\n    let p2 = Point.ZERO;\n    while (k1 > _0n || k2 > _0n) {\n        if (k1 & _1n)\n            p1 = p1.add(acc);\n        if (k2 & _1n)\n            p2 = p2.add(acc);\n        acc = acc.double();\n        k1 >>= _1n;\n        k2 >>= _1n;\n    }\n    return { p1, p2 };\n}\n/**\n * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * 30x faster vs naive addition on L=4096, 10x faster than precomputes.\n * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.\n * Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.\n * @param c Curve Point constructor\n * @param fieldN field over CURVE.N - important that it's not over CURVE.P\n * @param points array of L curve points\n * @param scalars array of L scalars (aka secret keys / bigints)\n */\nexport function pippenger(c, fieldN, points, scalars) {\n    // If we split scalars by some window (let's say 8 bits), every chunk will only\n    // take 256 buckets even if there are 4096 scalars, also re-uses double.\n    // TODO:\n    // - https://eprint.iacr.org/2024/750.pdf\n    // - https://tches.iacr.org/index.php/TCHES/article/view/10287\n    // 0 is accepted in scalars\n    validateMSMPoints(points, c);\n    validateMSMScalars(scalars, fieldN);\n    const plength = points.length;\n    const slength = scalars.length;\n    if (plength !== slength)\n        throw new Error('arrays of points and scalars must have equal length');\n    // if (plength === 0) throw new Error('array must be of length >= 2');\n    const zero = c.ZERO;\n    const wbits = bitLen(BigInt(plength));\n    let windowSize = 1; // bits\n    if (wbits > 12)\n        windowSize = wbits - 3;\n    else if (wbits > 4)\n        windowSize = wbits - 2;\n    else if (wbits > 0)\n        windowSize = 2;\n    const MASK = bitMask(windowSize);\n    const buckets = new Array(Number(MASK) + 1).fill(zero); // +1 for zero array\n    const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;\n    let sum = zero;\n    for (let i = lastBits; i >= 0; i -= windowSize) {\n        buckets.fill(zero);\n        for (let j = 0; j < slength; j++) {\n            const scalar = scalars[j];\n            const wbits = Number((scalar >> BigInt(i)) & MASK);\n            buckets[wbits] = buckets[wbits].add(points[j]);\n        }\n        let resI = zero; // not using this will do small speed-up, but will lose ct\n        // Skip first bucket, because it is zero\n        for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {\n            sumI = sumI.add(buckets[j]);\n            resI = resI.add(sumI);\n        }\n        sum = sum.add(resI);\n        if (i !== 0)\n            for (let j = 0; j < windowSize; j++)\n                sum = sum.double();\n    }\n    return sum;\n}\n/**\n * Precomputed multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).\n * @param c Curve Point constructor\n * @param fieldN field over CURVE.N - important that it's not over CURVE.P\n * @param points array of L curve points\n * @returns function which multiplies points with scaars\n */\nexport function precomputeMSMUnsafe(c, fieldN, points, windowSize) {\n    /**\n     * Performance Analysis of Window-based Precomputation\n     *\n     * Base Case (256-bit scalar, 8-bit window):\n     * - Standard precomputation requires:\n     *   - 31 additions per scalar × 256 scalars = 7,936 ops\n     *   - Plus 255 summary additions = 8,191 total ops\n     *   Note: Summary additions can be optimized via accumulator\n     *\n     * Chunked Precomputation Analysis:\n     * - Using 32 chunks requires:\n     *   - 255 additions per chunk\n     *   - 256 doublings\n     *   - Total: (255 × 32) + 256 = 8,416 ops\n     *\n     * Memory Usage Comparison:\n     * Window Size | Standard Points | Chunked Points\n     * ------------|-----------------|---------------\n     *     4-bit   |     520         |      15\n     *     8-bit   |    4,224        |     255\n     *    10-bit   |   13,824        |   1,023\n     *    16-bit   |  557,056        |  65,535\n     *\n     * Key Advantages:\n     * 1. Enables larger window sizes due to reduced memory overhead\n     * 2. More efficient for smaller scalar counts:\n     *    - 16 chunks: (16 × 255) + 256 = 4,336 ops\n     *    - ~2x faster than standard 8,191 ops\n     *\n     * Limitations:\n     * - Not suitable for plain precomputes (requires 256 constant doublings)\n     * - Performance degrades with larger scalar counts:\n     *   - Optimal for ~256 scalars\n     *   - Less efficient for 4096+ scalars (Pippenger preferred)\n     */\n    validateW(windowSize, fieldN.BITS);\n    validateMSMPoints(points, c);\n    const zero = c.ZERO;\n    const tableSize = 2 ** windowSize - 1; // table size (without zero)\n    const chunks = Math.ceil(fieldN.BITS / windowSize); // chunks of item\n    const MASK = bitMask(windowSize);\n    const tables = points.map((p) => {\n        const res = [];\n        for (let i = 0, acc = p; i < tableSize; i++) {\n            res.push(acc);\n            acc = acc.add(p);\n        }\n        return res;\n    });\n    return (scalars) => {\n        validateMSMScalars(scalars, fieldN);\n        if (scalars.length > points.length)\n            throw new Error('array of scalars must be smaller than array of points');\n        let res = zero;\n        for (let i = 0; i < chunks; i++) {\n            // No need to double if accumulator is still zero.\n            if (res !== zero)\n                for (let j = 0; j < windowSize; j++)\n                    res = res.double();\n            const shiftBy = BigInt(chunks * windowSize - (i + 1) * windowSize);\n            for (let j = 0; j < scalars.length; j++) {\n                const n = scalars[j];\n                const curr = Number((n >> shiftBy) & MASK);\n                if (!curr)\n                    continue; // skip zero scalars chunks\n                res = res.add(tables[j][curr - 1]);\n            }\n        }\n        return res;\n    };\n}\n// TODO: remove\n/** @deprecated */\nexport function validateBasic(curve) {\n    validateField(curve.Fp);\n    validateObject(curve, {\n        n: 'bigint',\n        h: 'bigint',\n        Gx: 'field',\n        Gy: 'field',\n    }, {\n        nBitLength: 'isSafeInteger',\n        nByteLength: 'isSafeInteger',\n    });\n    // Set defaults\n    return Object.freeze({\n        ...nLength(curve.n, curve.nBitLength),\n        ...curve,\n        ...{ p: curve.Fp.ORDER },\n    });\n}\nfunction createField(order, field, isLE) {\n    if (field) {\n        if (field.ORDER !== order)\n            throw new Error('Field.ORDER must match order: Fp == p, Fn == n');\n        validateField(field);\n        return field;\n    }\n    else {\n        return Field(order, { isLE });\n    }\n}\n/** Validates CURVE opts and creates fields */\nexport function _createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {\n    if (FpFnLE === undefined)\n        FpFnLE = type === 'edwards';\n    if (!CURVE || typeof CURVE !== 'object')\n        throw new Error(`expected valid ${type} CURVE object`);\n    for (const p of ['p', 'n', 'h']) {\n        const val = CURVE[p];\n        if (!(typeof val === 'bigint' && val > _0n))\n            throw new Error(`CURVE.${p} must be positive bigint`);\n    }\n    const Fp = createField(CURVE.p, curveOpts.Fp, FpFnLE);\n    const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);\n    const _b = type === 'weierstrass' ? 'b' : 'd';\n    const params = ['Gx', 'Gy', 'a', _b];\n    for (const p of params) {\n        // @ts-ignore\n        if (!Fp.isValid(CURVE[p]))\n            throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);\n    }\n    CURVE = Object.freeze(Object.assign({}, CURVE));\n    return { CURVE, Fp, Fn };\n}\n//# sourceMappingURL=curve.js.map","/**\n * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.\n *\n * ### Design rationale for types\n *\n * * Interaction between classes from different curves should fail:\n *   `k256.Point.BASE.add(p256.Point.BASE)`\n * * For this purpose we want to use `instanceof` operator, which is fast and works during runtime\n * * Different calls of `curve()` would return different classes -\n *   `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,\n *   it won't affect others\n *\n * TypeScript can't infer types for classes created inside a function. Classes is one instance\n * of nominative types in TypeScript and interfaces only check for shape, so it's hard to create\n * unique type for every function call.\n *\n * We can use generic types via some param, like curve opts, but that would:\n *     1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)\n *     which is hard to debug.\n *     2. Params can be generic and we can't enforce them to be constant value:\n *     if somebody creates curve from non-constant params,\n *     it would be allowed to interact with other curves with non-constant params\n *\n * @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { hmac as nobleHmac } from '@noble/hashes/hmac.js';\nimport { ahash } from '@noble/hashes/utils';\nimport { _validateObject, _abool2 as abool, _abytes2 as abytes, aInRange, bitLen, bitMask, bytesToHex, bytesToNumberBE, concatBytes, createHmacDrbg, ensureBytes, hexToBytes, inRange, isBytes, memoized, numberToHexUnpadded, randomBytes as randomBytesWeb, } from \"../utils.js\";\nimport { _createCurveFields, mulEndoUnsafe, negateCt, normalizeZ, pippenger, wNAF, } from \"./curve.js\";\nimport { Field, FpInvertBatch, getMinHashLength, mapHashToField, nLength, validateField, } from \"./modular.js\";\n// We construct basis in such way that den is always positive and equals n, but num sign depends on basis (not on secret value)\nconst divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n) / den;\n/**\n * Splits scalar for GLV endomorphism.\n */\nexport function _splitEndoScalar(k, basis, n) {\n    // Split scalar into two such that part is ~half bits: `abs(part) < sqrt(N)`\n    // Since part can be negative, we need to do this on point.\n    // TODO: verifyScalar function which consumes lambda\n    const [[a1, b1], [a2, b2]] = basis;\n    const c1 = divNearest(b2 * k, n);\n    const c2 = divNearest(-b1 * k, n);\n    // |k1|/|k2| is < sqrt(N), but can be negative.\n    // If we do `k1 mod N`, we'll get big scalar (`> sqrt(N)`): so, we do cheaper negation instead.\n    let k1 = k - c1 * a1 - c2 * a2;\n    let k2 = -c1 * b1 - c2 * b2;\n    const k1neg = k1 < _0n;\n    const k2neg = k2 < _0n;\n    if (k1neg)\n        k1 = -k1;\n    if (k2neg)\n        k2 = -k2;\n    // Double check that resulting scalar less than half bits of N: otherwise wNAF will fail.\n    // This should only happen on wrong basises. Also, math inside is too complex and I don't trust it.\n    const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n; // Half bits of N\n    if (k1 < _0n || k1 >= MAX_NUM || k2 < _0n || k2 >= MAX_NUM) {\n        throw new Error('splitScalar (endomorphism): failed, k=' + k);\n    }\n    return { k1neg, k1, k2neg, k2 };\n}\nfunction validateSigFormat(format) {\n    if (!['compact', 'recovered', 'der'].includes(format))\n        throw new Error('Signature format must be \"compact\", \"recovered\", or \"der\"');\n    return format;\n}\nfunction validateSigOpts(opts, def) {\n    const optsn = {};\n    for (let optName of Object.keys(def)) {\n        // @ts-ignore\n        optsn[optName] = opts[optName] === undefined ? def[optName] : opts[optName];\n    }\n    abool(optsn.lowS, 'lowS');\n    abool(optsn.prehash, 'prehash');\n    if (optsn.format !== undefined)\n        validateSigFormat(optsn.format);\n    return optsn;\n}\nexport class DERErr extends Error {\n    constructor(m = '') {\n        super(m);\n    }\n}\n/**\n * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:\n *\n *     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]\n *\n * Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html\n */\nexport const DER = {\n    // asn.1 DER encoding utils\n    Err: DERErr,\n    // Basic building block is TLV (Tag-Length-Value)\n    _tlv: {\n        encode: (tag, data) => {\n            const { Err: E } = DER;\n            if (tag < 0 || tag > 256)\n                throw new E('tlv.encode: wrong tag');\n            if (data.length & 1)\n                throw new E('tlv.encode: unpadded data');\n            const dataLen = data.length / 2;\n            const len = numberToHexUnpadded(dataLen);\n            if ((len.length / 2) & 128)\n                throw new E('tlv.encode: long form length too big');\n            // length of length with long form flag\n            const lenLen = dataLen > 127 ? numberToHexUnpadded((len.length / 2) | 128) : '';\n            const t = numberToHexUnpadded(tag);\n            return t + lenLen + len + data;\n        },\n        // v - value, l - left bytes (unparsed)\n        decode(tag, data) {\n            const { Err: E } = DER;\n            let pos = 0;\n            if (tag < 0 || tag > 256)\n                throw new E('tlv.encode: wrong tag');\n            if (data.length < 2 || data[pos++] !== tag)\n                throw new E('tlv.decode: wrong tlv');\n            const first = data[pos++];\n            const isLong = !!(first & 128); // First bit of first length byte is flag for short/long form\n            let length = 0;\n            if (!isLong)\n                length = first;\n            else {\n                // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]\n                const lenLen = first & 127;\n                if (!lenLen)\n                    throw new E('tlv.decode(long): indefinite length not supported');\n                if (lenLen > 4)\n                    throw new E('tlv.decode(long): byte length is too big'); // this will overflow u32 in js\n                const lengthBytes = data.subarray(pos, pos + lenLen);\n                if (lengthBytes.length !== lenLen)\n                    throw new E('tlv.decode: length bytes not complete');\n                if (lengthBytes[0] === 0)\n                    throw new E('tlv.decode(long): zero leftmost byte');\n                for (const b of lengthBytes)\n                    length = (length << 8) | b;\n                pos += lenLen;\n                if (length < 128)\n                    throw new E('tlv.decode(long): not minimal encoding');\n            }\n            const v = data.subarray(pos, pos + length);\n            if (v.length !== length)\n                throw new E('tlv.decode: wrong value length');\n            return { v, l: data.subarray(pos + length) };\n        },\n    },\n    // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,\n    // since we always use positive integers here. It must always be empty:\n    // - add zero byte if exists\n    // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)\n    _int: {\n        encode(num) {\n            const { Err: E } = DER;\n            if (num < _0n)\n                throw new E('integer: negative integers are not allowed');\n            let hex = numberToHexUnpadded(num);\n            // Pad with zero byte if negative flag is present\n            if (Number.parseInt(hex[0], 16) & 0b1000)\n                hex = '00' + hex;\n            if (hex.length & 1)\n                throw new E('unexpected DER parsing assertion: unpadded hex');\n            return hex;\n        },\n        decode(data) {\n            const { Err: E } = DER;\n            if (data[0] & 128)\n                throw new E('invalid signature integer: negative');\n            if (data[0] === 0x00 && !(data[1] & 128))\n                throw new E('invalid signature integer: unnecessary leading zero');\n            return bytesToNumberBE(data);\n        },\n    },\n    toSig(hex) {\n        // parse DER signature\n        const { Err: E, _int: int, _tlv: tlv } = DER;\n        const data = ensureBytes('signature', hex);\n        const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);\n        if (seqLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        const { v: rBytes, l: rLeftBytes } = tlv.decode(0x02, seqBytes);\n        const { v: sBytes, l: sLeftBytes } = tlv.decode(0x02, rLeftBytes);\n        if (sLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        return { r: int.decode(rBytes), s: int.decode(sBytes) };\n    },\n    hexFromSig(sig) {\n        const { _tlv: tlv, _int: int } = DER;\n        const rs = tlv.encode(0x02, int.encode(sig.r));\n        const ss = tlv.encode(0x02, int.encode(sig.s));\n        const seq = rs + ss;\n        return tlv.encode(0x30, seq);\n    },\n};\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);\nexport function _normFnElement(Fn, key) {\n    const { BYTES: expected } = Fn;\n    let num;\n    if (typeof key === 'bigint') {\n        num = key;\n    }\n    else {\n        let bytes = ensureBytes('private key', key);\n        try {\n            num = Fn.fromBytes(bytes);\n        }\n        catch (error) {\n            throw new Error(`invalid private key: expected ui8a of size ${expected}, got ${typeof key}`);\n        }\n    }\n    if (!Fn.isValidNot0(num))\n        throw new Error('invalid private key: out of range [1..N-1]');\n    return num;\n}\n/**\n * Creates weierstrass Point constructor, based on specified curve options.\n *\n * @example\n```js\nconst opts = {\n  p: BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff'),\n  n: BigInt('0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'),\n  h: BigInt(1),\n  a: BigInt('0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc'),\n  b: BigInt('0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b'),\n  Gx: BigInt('0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296'),\n  Gy: BigInt('0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5'),\n};\nconst p256_Point = weierstrass(opts);\n```\n */\nexport function weierstrassN(params, extraOpts = {}) {\n    const validated = _createCurveFields('weierstrass', params, extraOpts);\n    const { Fp, Fn } = validated;\n    let CURVE = validated.CURVE;\n    const { h: cofactor, n: CURVE_ORDER } = CURVE;\n    _validateObject(extraOpts, {}, {\n        allowInfinityPoint: 'boolean',\n        clearCofactor: 'function',\n        isTorsionFree: 'function',\n        fromBytes: 'function',\n        toBytes: 'function',\n        endo: 'object',\n        wrapPrivateKey: 'boolean',\n    });\n    const { endo } = extraOpts;\n    if (endo) {\n        // validateObject(endo, { beta: 'bigint', splitScalar: 'function' });\n        if (!Fp.is0(CURVE.a) || typeof endo.beta !== 'bigint' || !Array.isArray(endo.basises)) {\n            throw new Error('invalid endo: expected \"beta\": bigint and \"basises\": array');\n        }\n    }\n    const lengths = getWLengths(Fp, Fn);\n    function assertCompressionIsSupported() {\n        if (!Fp.isOdd)\n            throw new Error('compression is not supported: Field does not have .isOdd()');\n    }\n    // Implements IEEE P1363 point encoding\n    function pointToBytes(_c, point, isCompressed) {\n        const { x, y } = point.toAffine();\n        const bx = Fp.toBytes(x);\n        abool(isCompressed, 'isCompressed');\n        if (isCompressed) {\n            assertCompressionIsSupported();\n            const hasEvenY = !Fp.isOdd(y);\n            return concatBytes(pprefix(hasEvenY), bx);\n        }\n        else {\n            return concatBytes(Uint8Array.of(0x04), bx, Fp.toBytes(y));\n        }\n    }\n    function pointFromBytes(bytes) {\n        abytes(bytes, undefined, 'Point');\n        const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths; // e.g. for 32-byte: 33, 65\n        const length = bytes.length;\n        const head = bytes[0];\n        const tail = bytes.subarray(1);\n        // No actual validation is done here: use .assertValidity()\n        if (length === comp && (head === 0x02 || head === 0x03)) {\n            const x = Fp.fromBytes(tail);\n            if (!Fp.isValid(x))\n                throw new Error('bad point: is not on curve, wrong x');\n            const y2 = weierstrassEquation(x); // y² = x³ + ax + b\n            let y;\n            try {\n                y = Fp.sqrt(y2); // y = y² ^ (p+1)/4\n            }\n            catch (sqrtError) {\n                const err = sqrtError instanceof Error ? ': ' + sqrtError.message : '';\n                throw new Error('bad point: is not on curve, sqrt error' + err);\n            }\n            assertCompressionIsSupported();\n            const isYOdd = Fp.isOdd(y); // (y & _1n) === _1n;\n            const isHeadOdd = (head & 1) === 1; // ECDSA-specific\n            if (isHeadOdd !== isYOdd)\n                y = Fp.neg(y);\n            return { x, y };\n        }\n        else if (length === uncomp && head === 0x04) {\n            // TODO: more checks\n            const L = Fp.BYTES;\n            const x = Fp.fromBytes(tail.subarray(0, L));\n            const y = Fp.fromBytes(tail.subarray(L, L * 2));\n            if (!isValidXY(x, y))\n                throw new Error('bad point: is not on curve');\n            return { x, y };\n        }\n        else {\n            throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);\n        }\n    }\n    const encodePoint = extraOpts.toBytes || pointToBytes;\n    const decodePoint = extraOpts.fromBytes || pointFromBytes;\n    function weierstrassEquation(x) {\n        const x2 = Fp.sqr(x); // x * x\n        const x3 = Fp.mul(x2, x); // x² * x\n        return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b); // x³ + a * x + b\n    }\n    // TODO: move top-level\n    /** Checks whether equation holds for given x, y: y² == x³ + ax + b */\n    function isValidXY(x, y) {\n        const left = Fp.sqr(y); // y²\n        const right = weierstrassEquation(x); // x³ + ax + b\n        return Fp.eql(left, right);\n    }\n    // Validate whether the passed curve params are valid.\n    // Test 1: equation y² = x³ + ax + b should work for generator point.\n    if (!isValidXY(CURVE.Gx, CURVE.Gy))\n        throw new Error('bad curve params: generator point');\n    // Test 2: discriminant Δ part should be non-zero: 4a³ + 27b² != 0.\n    // Guarantees curve is genus-1, smooth (non-singular).\n    const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);\n    const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));\n    if (Fp.is0(Fp.add(_4a3, _27b2)))\n        throw new Error('bad curve params: a or b');\n    /** Asserts coordinate is valid: 0 <= n < Fp.ORDER. */\n    function acoord(title, n, banZero = false) {\n        if (!Fp.isValid(n) || (banZero && Fp.is0(n)))\n            throw new Error(`bad point coordinate ${title}`);\n        return n;\n    }\n    function aprjpoint(other) {\n        if (!(other instanceof Point))\n            throw new Error('ProjectivePoint expected');\n    }\n    function splitEndoScalarN(k) {\n        if (!endo || !endo.basises)\n            throw new Error('no endo');\n        return _splitEndoScalar(k, endo.basises, Fn.ORDER);\n    }\n    // Memoized toAffine / validity check. They are heavy. Points are immutable.\n    // Converts Projective point to affine (x, y) coordinates.\n    // Can accept precomputed Z^-1 - for example, from invertBatch.\n    // (X, Y, Z) ∋ (x=X/Z, y=Y/Z)\n    const toAffineMemo = memoized((p, iz) => {\n        const { X, Y, Z } = p;\n        // Fast-path for normalized points\n        if (Fp.eql(Z, Fp.ONE))\n            return { x: X, y: Y };\n        const is0 = p.is0();\n        // If invZ was 0, we return zero point. However we still want to execute\n        // all operations, so we replace invZ with a random number, 1.\n        if (iz == null)\n            iz = is0 ? Fp.ONE : Fp.inv(Z);\n        const x = Fp.mul(X, iz);\n        const y = Fp.mul(Y, iz);\n        const zz = Fp.mul(Z, iz);\n        if (is0)\n            return { x: Fp.ZERO, y: Fp.ZERO };\n        if (!Fp.eql(zz, Fp.ONE))\n            throw new Error('invZ was invalid');\n        return { x, y };\n    });\n    // NOTE: on exception this will crash 'cached' and no value will be set.\n    // Otherwise true will be return\n    const assertValidMemo = memoized((p) => {\n        if (p.is0()) {\n            // (0, 1, 0) aka ZERO is invalid in most contexts.\n            // In BLS, ZERO can be serialized, so we allow it.\n            // (0, 0, 0) is invalid representation of ZERO.\n            if (extraOpts.allowInfinityPoint && !Fp.is0(p.Y))\n                return;\n            throw new Error('bad point: ZERO');\n        }\n        // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`\n        const { x, y } = p.toAffine();\n        if (!Fp.isValid(x) || !Fp.isValid(y))\n            throw new Error('bad point: x or y not field elements');\n        if (!isValidXY(x, y))\n            throw new Error('bad point: equation left != right');\n        if (!p.isTorsionFree())\n            throw new Error('bad point: not in prime-order subgroup');\n        return true;\n    });\n    function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {\n        k2p = new Point(Fp.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);\n        k1p = negateCt(k1neg, k1p);\n        k2p = negateCt(k2neg, k2p);\n        return k1p.add(k2p);\n    }\n    /**\n     * Projective Point works in 3d / projective (homogeneous) coordinates:(X, Y, Z) ∋ (x=X/Z, y=Y/Z).\n     * Default Point works in 2d / affine coordinates: (x, y).\n     * We're doing calculations in projective, because its operations don't require costly inversion.\n     */\n    class Point {\n        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n        constructor(X, Y, Z) {\n            this.X = acoord('x', X);\n            this.Y = acoord('y', Y, true);\n            this.Z = acoord('z', Z);\n            Object.freeze(this);\n        }\n        static CURVE() {\n            return CURVE;\n        }\n        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n        static fromAffine(p) {\n            const { x, y } = p || {};\n            if (!p || !Fp.isValid(x) || !Fp.isValid(y))\n                throw new Error('invalid affine point');\n            if (p instanceof Point)\n                throw new Error('projective point not allowed');\n            // (0, 0) would've produced (0, 0, 1) - instead, we need (0, 1, 0)\n            if (Fp.is0(x) && Fp.is0(y))\n                return Point.ZERO;\n            return new Point(x, y, Fp.ONE);\n        }\n        static fromBytes(bytes) {\n            const P = Point.fromAffine(decodePoint(abytes(bytes, undefined, 'point')));\n            P.assertValidity();\n            return P;\n        }\n        static fromHex(hex) {\n            return Point.fromBytes(ensureBytes('pointHex', hex));\n        }\n        get x() {\n            return this.toAffine().x;\n        }\n        get y() {\n            return this.toAffine().y;\n        }\n        /**\n         *\n         * @param windowSize\n         * @param isLazy true will defer table computation until the first multiplication\n         * @returns\n         */\n        precompute(windowSize = 8, isLazy = true) {\n            wnaf.createCache(this, windowSize);\n            if (!isLazy)\n                this.multiply(_3n); // random number\n            return this;\n        }\n        // TODO: return `this`\n        /** A point on curve is valid if it conforms to equation. */\n        assertValidity() {\n            assertValidMemo(this);\n        }\n        hasEvenY() {\n            const { y } = this.toAffine();\n            if (!Fp.isOdd)\n                throw new Error(\"Field doesn't support isOdd\");\n            return !Fp.isOdd(y);\n        }\n        /** Compare one point to another. */\n        equals(other) {\n            aprjpoint(other);\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            const { X: X2, Y: Y2, Z: Z2 } = other;\n            const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));\n            const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));\n            return U1 && U2;\n        }\n        /** Flips point to one corresponding to (x, -y) in Affine coordinates. */\n        negate() {\n            return new Point(this.X, Fp.neg(this.Y), this.Z);\n        }\n        // Renes-Costello-Batina exception-free doubling formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 3\n        // Cost: 8M + 3S + 3*a + 2*b3 + 15add.\n        double() {\n            const { a, b } = CURVE;\n            const b3 = Fp.mul(b, _3n);\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            let t0 = Fp.mul(X1, X1); // step 1\n            let t1 = Fp.mul(Y1, Y1);\n            let t2 = Fp.mul(Z1, Z1);\n            let t3 = Fp.mul(X1, Y1);\n            t3 = Fp.add(t3, t3); // step 5\n            Z3 = Fp.mul(X1, Z1);\n            Z3 = Fp.add(Z3, Z3);\n            X3 = Fp.mul(a, Z3);\n            Y3 = Fp.mul(b3, t2);\n            Y3 = Fp.add(X3, Y3); // step 10\n            X3 = Fp.sub(t1, Y3);\n            Y3 = Fp.add(t1, Y3);\n            Y3 = Fp.mul(X3, Y3);\n            X3 = Fp.mul(t3, X3);\n            Z3 = Fp.mul(b3, Z3); // step 15\n            t2 = Fp.mul(a, t2);\n            t3 = Fp.sub(t0, t2);\n            t3 = Fp.mul(a, t3);\n            t3 = Fp.add(t3, Z3);\n            Z3 = Fp.add(t0, t0); // step 20\n            t0 = Fp.add(Z3, t0);\n            t0 = Fp.add(t0, t2);\n            t0 = Fp.mul(t0, t3);\n            Y3 = Fp.add(Y3, t0);\n            t2 = Fp.mul(Y1, Z1); // step 25\n            t2 = Fp.add(t2, t2);\n            t0 = Fp.mul(t2, t3);\n            X3 = Fp.sub(X3, t0);\n            Z3 = Fp.mul(t2, t1);\n            Z3 = Fp.add(Z3, Z3); // step 30\n            Z3 = Fp.add(Z3, Z3);\n            return new Point(X3, Y3, Z3);\n        }\n        // Renes-Costello-Batina exception-free addition formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 1\n        // Cost: 12M + 0S + 3*a + 3*b3 + 23add.\n        add(other) {\n            aprjpoint(other);\n            const { X: X1, Y: Y1, Z: Z1 } = this;\n            const { X: X2, Y: Y2, Z: Z2 } = other;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            const a = CURVE.a;\n            const b3 = Fp.mul(CURVE.b, _3n);\n            let t0 = Fp.mul(X1, X2); // step 1\n            let t1 = Fp.mul(Y1, Y2);\n            let t2 = Fp.mul(Z1, Z2);\n            let t3 = Fp.add(X1, Y1);\n            let t4 = Fp.add(X2, Y2); // step 5\n            t3 = Fp.mul(t3, t4);\n            t4 = Fp.add(t0, t1);\n            t3 = Fp.sub(t3, t4);\n            t4 = Fp.add(X1, Z1);\n            let t5 = Fp.add(X2, Z2); // step 10\n            t4 = Fp.mul(t4, t5);\n            t5 = Fp.add(t0, t2);\n            t4 = Fp.sub(t4, t5);\n            t5 = Fp.add(Y1, Z1);\n            X3 = Fp.add(Y2, Z2); // step 15\n            t5 = Fp.mul(t5, X3);\n            X3 = Fp.add(t1, t2);\n            t5 = Fp.sub(t5, X3);\n            Z3 = Fp.mul(a, t4);\n            X3 = Fp.mul(b3, t2); // step 20\n            Z3 = Fp.add(X3, Z3);\n            X3 = Fp.sub(t1, Z3);\n            Z3 = Fp.add(t1, Z3);\n            Y3 = Fp.mul(X3, Z3);\n            t1 = Fp.add(t0, t0); // step 25\n            t1 = Fp.add(t1, t0);\n            t2 = Fp.mul(a, t2);\n            t4 = Fp.mul(b3, t4);\n            t1 = Fp.add(t1, t2);\n            t2 = Fp.sub(t0, t2); // step 30\n            t2 = Fp.mul(a, t2);\n            t4 = Fp.add(t4, t2);\n            t0 = Fp.mul(t1, t4);\n            Y3 = Fp.add(Y3, t0);\n            t0 = Fp.mul(t5, t4); // step 35\n            X3 = Fp.mul(t3, X3);\n            X3 = Fp.sub(X3, t0);\n            t0 = Fp.mul(t3, t1);\n            Z3 = Fp.mul(t5, Z3);\n            Z3 = Fp.add(Z3, t0); // step 40\n            return new Point(X3, Y3, Z3);\n        }\n        subtract(other) {\n            return this.add(other.negate());\n        }\n        is0() {\n            return this.equals(Point.ZERO);\n        }\n        /**\n         * Constant time multiplication.\n         * Uses wNAF method. Windowed method may be 10% faster,\n         * but takes 2x longer to generate and consumes 2x memory.\n         * Uses precomputes when available.\n         * Uses endomorphism for Koblitz curves.\n         * @param scalar by which the point would be multiplied\n         * @returns New point\n         */\n        multiply(scalar) {\n            const { endo } = extraOpts;\n            if (!Fn.isValidNot0(scalar))\n                throw new Error('invalid scalar: out of range'); // 0 is invalid\n            let point, fake; // Fake point is used to const-time mult\n            const mul = (n) => wnaf.cached(this, n, (p) => normalizeZ(Point, p));\n            /** See docs for {@link EndomorphismOpts} */\n            if (endo) {\n                const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(scalar);\n                const { p: k1p, f: k1f } = mul(k1);\n                const { p: k2p, f: k2f } = mul(k2);\n                fake = k1f.add(k2f);\n                point = finishEndo(endo.beta, k1p, k2p, k1neg, k2neg);\n            }\n            else {\n                const { p, f } = mul(scalar);\n                point = p;\n                fake = f;\n            }\n            // Normalize `z` for both points, but return only real one\n            return normalizeZ(Point, [point, fake])[0];\n        }\n        /**\n         * Non-constant-time multiplication. Uses double-and-add algorithm.\n         * It's faster, but should only be used when you don't care about\n         * an exposed secret key e.g. sig verification, which works over *public* keys.\n         */\n        multiplyUnsafe(sc) {\n            const { endo } = extraOpts;\n            const p = this;\n            if (!Fn.isValid(sc))\n                throw new Error('invalid scalar: out of range'); // 0 is valid\n            if (sc === _0n || p.is0())\n                return Point.ZERO;\n            if (sc === _1n)\n                return p; // fast-path\n            if (wnaf.hasCache(this))\n                return this.multiply(sc);\n            if (endo) {\n                const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(sc);\n                const { p1, p2 } = mulEndoUnsafe(Point, p, k1, k2); // 30% faster vs wnaf.unsafe\n                return finishEndo(endo.beta, p1, p2, k1neg, k2neg);\n            }\n            else {\n                return wnaf.unsafe(p, sc);\n            }\n        }\n        multiplyAndAddUnsafe(Q, a, b) {\n            const sum = this.multiplyUnsafe(a).add(Q.multiplyUnsafe(b));\n            return sum.is0() ? undefined : sum;\n        }\n        /**\n         * Converts Projective point to affine (x, y) coordinates.\n         * @param invertedZ Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch\n         */\n        toAffine(invertedZ) {\n            return toAffineMemo(this, invertedZ);\n        }\n        /**\n         * Checks whether Point is free of torsion elements (is in prime subgroup).\n         * Always torsion-free for cofactor=1 curves.\n         */\n        isTorsionFree() {\n            const { isTorsionFree } = extraOpts;\n            if (cofactor === _1n)\n                return true;\n            if (isTorsionFree)\n                return isTorsionFree(Point, this);\n            return wnaf.unsafe(this, CURVE_ORDER).is0();\n        }\n        clearCofactor() {\n            const { clearCofactor } = extraOpts;\n            if (cofactor === _1n)\n                return this; // Fast-path\n            if (clearCofactor)\n                return clearCofactor(Point, this);\n            return this.multiplyUnsafe(cofactor);\n        }\n        isSmallOrder() {\n            // can we use this.clearCofactor()?\n            return this.multiplyUnsafe(cofactor).is0();\n        }\n        toBytes(isCompressed = true) {\n            abool(isCompressed, 'isCompressed');\n            this.assertValidity();\n            return encodePoint(Point, this, isCompressed);\n        }\n        toHex(isCompressed = true) {\n            return bytesToHex(this.toBytes(isCompressed));\n        }\n        toString() {\n            return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;\n        }\n        // TODO: remove\n        get px() {\n            return this.X;\n        }\n        get py() {\n            return this.X;\n        }\n        get pz() {\n            return this.Z;\n        }\n        toRawBytes(isCompressed = true) {\n            return this.toBytes(isCompressed);\n        }\n        _setWindowSize(windowSize) {\n            this.precompute(windowSize);\n        }\n        static normalizeZ(points) {\n            return normalizeZ(Point, points);\n        }\n        static msm(points, scalars) {\n            return pippenger(Point, Fn, points, scalars);\n        }\n        static fromPrivateKey(privateKey) {\n            return Point.BASE.multiply(_normFnElement(Fn, privateKey));\n        }\n    }\n    // base / generator point\n    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);\n    // zero / infinity / identity point\n    Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO); // 0, 1, 0\n    // math field\n    Point.Fp = Fp;\n    // scalar field\n    Point.Fn = Fn;\n    const bits = Fn.BITS;\n    const wnaf = new wNAF(Point, extraOpts.endo ? Math.ceil(bits / 2) : bits);\n    Point.BASE.precompute(8); // Enable precomputes. Slows down first publicKey computation by 20ms.\n    return Point;\n}\n// Points start with byte 0x02 when y is even; otherwise 0x03\nfunction pprefix(hasEvenY) {\n    return Uint8Array.of(hasEvenY ? 0x02 : 0x03);\n}\n/**\n * Implementation of the Shallue and van de Woestijne method for any weierstrass curve.\n * TODO: check if there is a way to merge this with uvRatio in Edwards; move to modular.\n * b = True and y = sqrt(u / v) if (u / v) is square in F, and\n * b = False and y = sqrt(Z * (u / v)) otherwise.\n * @param Fp\n * @param Z\n * @returns\n */\nexport function SWUFpSqrtRatio(Fp, Z) {\n    // Generic implementation\n    const q = Fp.ORDER;\n    let l = _0n;\n    for (let o = q - _1n; o % _2n === _0n; o /= _2n)\n        l += _1n;\n    const c1 = l; // 1. c1, the largest integer such that 2^c1 divides q - 1.\n    // We need 2n ** c1 and 2n ** (c1-1). We can't use **; but we can use <<.\n    // 2n ** c1 == 2n << (c1-1)\n    const _2n_pow_c1_1 = _2n << (c1 - _1n - _1n);\n    const _2n_pow_c1 = _2n_pow_c1_1 * _2n;\n    const c2 = (q - _1n) / _2n_pow_c1; // 2. c2 = (q - 1) / (2^c1)  # Integer arithmetic\n    const c3 = (c2 - _1n) / _2n; // 3. c3 = (c2 - 1) / 2            # Integer arithmetic\n    const c4 = _2n_pow_c1 - _1n; // 4. c4 = 2^c1 - 1                # Integer arithmetic\n    const c5 = _2n_pow_c1_1; // 5. c5 = 2^(c1 - 1)                  # Integer arithmetic\n    const c6 = Fp.pow(Z, c2); // 6. c6 = Z^c2\n    const c7 = Fp.pow(Z, (c2 + _1n) / _2n); // 7. c7 = Z^((c2 + 1) / 2)\n    let sqrtRatio = (u, v) => {\n        let tv1 = c6; // 1. tv1 = c6\n        let tv2 = Fp.pow(v, c4); // 2. tv2 = v^c4\n        let tv3 = Fp.sqr(tv2); // 3. tv3 = tv2^2\n        tv3 = Fp.mul(tv3, v); // 4. tv3 = tv3 * v\n        let tv5 = Fp.mul(u, tv3); // 5. tv5 = u * tv3\n        tv5 = Fp.pow(tv5, c3); // 6. tv5 = tv5^c3\n        tv5 = Fp.mul(tv5, tv2); // 7. tv5 = tv5 * tv2\n        tv2 = Fp.mul(tv5, v); // 8. tv2 = tv5 * v\n        tv3 = Fp.mul(tv5, u); // 9. tv3 = tv5 * u\n        let tv4 = Fp.mul(tv3, tv2); // 10. tv4 = tv3 * tv2\n        tv5 = Fp.pow(tv4, c5); // 11. tv5 = tv4^c5\n        let isQR = Fp.eql(tv5, Fp.ONE); // 12. isQR = tv5 == 1\n        tv2 = Fp.mul(tv3, c7); // 13. tv2 = tv3 * c7\n        tv5 = Fp.mul(tv4, tv1); // 14. tv5 = tv4 * tv1\n        tv3 = Fp.cmov(tv2, tv3, isQR); // 15. tv3 = CMOV(tv2, tv3, isQR)\n        tv4 = Fp.cmov(tv5, tv4, isQR); // 16. tv4 = CMOV(tv5, tv4, isQR)\n        // 17. for i in (c1, c1 - 1, ..., 2):\n        for (let i = c1; i > _1n; i--) {\n            let tv5 = i - _2n; // 18.    tv5 = i - 2\n            tv5 = _2n << (tv5 - _1n); // 19.    tv5 = 2^tv5\n            let tvv5 = Fp.pow(tv4, tv5); // 20.    tv5 = tv4^tv5\n            const e1 = Fp.eql(tvv5, Fp.ONE); // 21.    e1 = tv5 == 1\n            tv2 = Fp.mul(tv3, tv1); // 22.    tv2 = tv3 * tv1\n            tv1 = Fp.mul(tv1, tv1); // 23.    tv1 = tv1 * tv1\n            tvv5 = Fp.mul(tv4, tv1); // 24.    tv5 = tv4 * tv1\n            tv3 = Fp.cmov(tv2, tv3, e1); // 25.    tv3 = CMOV(tv2, tv3, e1)\n            tv4 = Fp.cmov(tvv5, tv4, e1); // 26.    tv4 = CMOV(tv5, tv4, e1)\n        }\n        return { isValid: isQR, value: tv3 };\n    };\n    if (Fp.ORDER % _4n === _3n) {\n        // sqrt_ratio_3mod4(u, v)\n        const c1 = (Fp.ORDER - _3n) / _4n; // 1. c1 = (q - 3) / 4     # Integer arithmetic\n        const c2 = Fp.sqrt(Fp.neg(Z)); // 2. c2 = sqrt(-Z)\n        sqrtRatio = (u, v) => {\n            let tv1 = Fp.sqr(v); // 1. tv1 = v^2\n            const tv2 = Fp.mul(u, v); // 2. tv2 = u * v\n            tv1 = Fp.mul(tv1, tv2); // 3. tv1 = tv1 * tv2\n            let y1 = Fp.pow(tv1, c1); // 4. y1 = tv1^c1\n            y1 = Fp.mul(y1, tv2); // 5. y1 = y1 * tv2\n            const y2 = Fp.mul(y1, c2); // 6. y2 = y1 * c2\n            const tv3 = Fp.mul(Fp.sqr(y1), v); // 7. tv3 = y1^2; 8. tv3 = tv3 * v\n            const isQR = Fp.eql(tv3, u); // 9. isQR = tv3 == u\n            let y = Fp.cmov(y2, y1, isQR); // 10. y = CMOV(y2, y1, isQR)\n            return { isValid: isQR, value: y }; // 11. return (isQR, y) isQR ? y : y*c2\n        };\n    }\n    // No curves uses that\n    // if (Fp.ORDER % _8n === _5n) // sqrt_ratio_5mod8\n    return sqrtRatio;\n}\n/**\n * Simplified Shallue-van de Woestijne-Ulas Method\n * https://www.rfc-editor.org/rfc/rfc9380#section-6.6.2\n */\nexport function mapToCurveSimpleSWU(Fp, opts) {\n    validateField(Fp);\n    const { A, B, Z } = opts;\n    if (!Fp.isValid(A) || !Fp.isValid(B) || !Fp.isValid(Z))\n        throw new Error('mapToCurveSimpleSWU: invalid opts');\n    const sqrtRatio = SWUFpSqrtRatio(Fp, Z);\n    if (!Fp.isOdd)\n        throw new Error('Field does not have .isOdd()');\n    // Input: u, an element of F.\n    // Output: (x, y), a point on E.\n    return (u) => {\n        // prettier-ignore\n        let tv1, tv2, tv3, tv4, tv5, tv6, x, y;\n        tv1 = Fp.sqr(u); // 1.  tv1 = u^2\n        tv1 = Fp.mul(tv1, Z); // 2.  tv1 = Z * tv1\n        tv2 = Fp.sqr(tv1); // 3.  tv2 = tv1^2\n        tv2 = Fp.add(tv2, tv1); // 4.  tv2 = tv2 + tv1\n        tv3 = Fp.add(tv2, Fp.ONE); // 5.  tv3 = tv2 + 1\n        tv3 = Fp.mul(tv3, B); // 6.  tv3 = B * tv3\n        tv4 = Fp.cmov(Z, Fp.neg(tv2), !Fp.eql(tv2, Fp.ZERO)); // 7.  tv4 = CMOV(Z, -tv2, tv2 != 0)\n        tv4 = Fp.mul(tv4, A); // 8.  tv4 = A * tv4\n        tv2 = Fp.sqr(tv3); // 9.  tv2 = tv3^2\n        tv6 = Fp.sqr(tv4); // 10. tv6 = tv4^2\n        tv5 = Fp.mul(tv6, A); // 11. tv5 = A * tv6\n        tv2 = Fp.add(tv2, tv5); // 12. tv2 = tv2 + tv5\n        tv2 = Fp.mul(tv2, tv3); // 13. tv2 = tv2 * tv3\n        tv6 = Fp.mul(tv6, tv4); // 14. tv6 = tv6 * tv4\n        tv5 = Fp.mul(tv6, B); // 15. tv5 = B * tv6\n        tv2 = Fp.add(tv2, tv5); // 16. tv2 = tv2 + tv5\n        x = Fp.mul(tv1, tv3); // 17.   x = tv1 * tv3\n        const { isValid, value } = sqrtRatio(tv2, tv6); // 18. (is_gx1_square, y1) = sqrt_ratio(tv2, tv6)\n        y = Fp.mul(tv1, u); // 19.   y = tv1 * u  -> Z * u^3 * y1\n        y = Fp.mul(y, value); // 20.   y = y * y1\n        x = Fp.cmov(x, tv3, isValid); // 21.   x = CMOV(x, tv3, is_gx1_square)\n        y = Fp.cmov(y, value, isValid); // 22.   y = CMOV(y, y1, is_gx1_square)\n        const e1 = Fp.isOdd(u) === Fp.isOdd(y); // 23.  e1 = sgn0(u) == sgn0(y)\n        y = Fp.cmov(Fp.neg(y), y, e1); // 24.   y = CMOV(-y, y, e1)\n        const tv4_inv = FpInvertBatch(Fp, [tv4], true)[0];\n        x = Fp.mul(x, tv4_inv); // 25.   x = x / tv4\n        return { x, y };\n    };\n}\nfunction getWLengths(Fp, Fn) {\n    return {\n        secretKey: Fn.BYTES,\n        publicKey: 1 + Fp.BYTES,\n        publicKeyUncompressed: 1 + 2 * Fp.BYTES,\n        publicKeyHasPrefix: true,\n        signature: 2 * Fn.BYTES,\n    };\n}\n/**\n * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.\n * This helper ensures no signature functionality is present. Less code, smaller bundle size.\n */\nexport function ecdh(Point, ecdhOpts = {}) {\n    const { Fn } = Point;\n    const randomBytes_ = ecdhOpts.randomBytes || randomBytesWeb;\n    const lengths = Object.assign(getWLengths(Point.Fp, Fn), { seed: getMinHashLength(Fn.ORDER) });\n    function isValidSecretKey(secretKey) {\n        try {\n            return !!_normFnElement(Fn, secretKey);\n        }\n        catch (error) {\n            return false;\n        }\n    }\n    function isValidPublicKey(publicKey, isCompressed) {\n        const { publicKey: comp, publicKeyUncompressed } = lengths;\n        try {\n            const l = publicKey.length;\n            if (isCompressed === true && l !== comp)\n                return false;\n            if (isCompressed === false && l !== publicKeyUncompressed)\n                return false;\n            return !!Point.fromBytes(publicKey);\n        }\n        catch (error) {\n            return false;\n        }\n    }\n    /**\n     * Produces cryptographically secure secret key from random of size\n     * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.\n     */\n    function randomSecretKey(seed = randomBytes_(lengths.seed)) {\n        return mapHashToField(abytes(seed, lengths.seed, 'seed'), Fn.ORDER);\n    }\n    /**\n     * Computes public key for a secret key. Checks for validity of the secret key.\n     * @param isCompressed whether to return compact (default), or full key\n     * @returns Public key, full when isCompressed=false; short when isCompressed=true\n     */\n    function getPublicKey(secretKey, isCompressed = true) {\n        return Point.BASE.multiply(_normFnElement(Fn, secretKey)).toBytes(isCompressed);\n    }\n    function keygen(seed) {\n        const secretKey = randomSecretKey(seed);\n        return { secretKey, publicKey: getPublicKey(secretKey) };\n    }\n    /**\n     * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.\n     */\n    function isProbPub(item) {\n        if (typeof item === 'bigint')\n            return false;\n        if (item instanceof Point)\n            return true;\n        const { secretKey, publicKey, publicKeyUncompressed } = lengths;\n        if (Fn.allowedLengths || secretKey === publicKey)\n            return undefined;\n        const l = ensureBytes('key', item).length;\n        return l === publicKey || l === publicKeyUncompressed;\n    }\n    /**\n     * ECDH (Elliptic Curve Diffie Hellman).\n     * Computes shared public key from secret key A and public key B.\n     * Checks: 1) secret key validity 2) shared key is on-curve.\n     * Does NOT hash the result.\n     * @param isCompressed whether to return compact (default), or full key\n     * @returns shared public key\n     */\n    function getSharedSecret(secretKeyA, publicKeyB, isCompressed = true) {\n        if (isProbPub(secretKeyA) === true)\n            throw new Error('first arg must be private key');\n        if (isProbPub(publicKeyB) === false)\n            throw new Error('second arg must be public key');\n        const s = _normFnElement(Fn, secretKeyA);\n        const b = Point.fromHex(publicKeyB); // checks for being on-curve\n        return b.multiply(s).toBytes(isCompressed);\n    }\n    const utils = {\n        isValidSecretKey,\n        isValidPublicKey,\n        randomSecretKey,\n        // TODO: remove\n        isValidPrivateKey: isValidSecretKey,\n        randomPrivateKey: randomSecretKey,\n        normPrivateKeyToScalar: (key) => _normFnElement(Fn, key),\n        precompute(windowSize = 8, point = Point.BASE) {\n            return point.precompute(windowSize, false);\n        },\n    };\n    return Object.freeze({ getPublicKey, getSharedSecret, keygen, Point, utils, lengths });\n}\n/**\n * Creates ECDSA signing interface for given elliptic curve `Point` and `hash` function.\n * We need `hash` for 2 features:\n * 1. Message prehash-ing. NOT used if `sign` / `verify` are called with `prehash: false`\n * 2. k generation in `sign`, using HMAC-drbg(hash)\n *\n * ECDSAOpts are only rarely needed.\n *\n * @example\n * ```js\n * const p256_Point = weierstrass(...);\n * const p256_sha256 = ecdsa(p256_Point, sha256);\n * const p256_sha224 = ecdsa(p256_Point, sha224);\n * const p256_sha224_r = ecdsa(p256_Point, sha224, { randomBytes: (length) => { ... } });\n * ```\n */\nexport function ecdsa(Point, hash, ecdsaOpts = {}) {\n    ahash(hash);\n    _validateObject(ecdsaOpts, {}, {\n        hmac: 'function',\n        lowS: 'boolean',\n        randomBytes: 'function',\n        bits2int: 'function',\n        bits2int_modN: 'function',\n    });\n    const randomBytes = ecdsaOpts.randomBytes || randomBytesWeb;\n    const hmac = ecdsaOpts.hmac ||\n        ((key, ...msgs) => nobleHmac(hash, key, concatBytes(...msgs)));\n    const { Fp, Fn } = Point;\n    const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;\n    const { keygen, getPublicKey, getSharedSecret, utils, lengths } = ecdh(Point, ecdsaOpts);\n    const defaultSigOpts = {\n        prehash: false,\n        lowS: typeof ecdsaOpts.lowS === 'boolean' ? ecdsaOpts.lowS : false,\n        format: undefined, //'compact' as ECDSASigFormat,\n        extraEntropy: false,\n    };\n    const defaultSigOpts_format = 'compact';\n    function isBiggerThanHalfOrder(number) {\n        const HALF = CURVE_ORDER >> _1n;\n        return number > HALF;\n    }\n    function validateRS(title, num) {\n        if (!Fn.isValidNot0(num))\n            throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);\n        return num;\n    }\n    function validateSigLength(bytes, format) {\n        validateSigFormat(format);\n        const size = lengths.signature;\n        const sizer = format === 'compact' ? size : format === 'recovered' ? size + 1 : undefined;\n        return abytes(bytes, sizer, `${format} signature`);\n    }\n    /**\n     * ECDSA signature with its (r, s) properties. Supports compact, recovered & DER representations.\n     */\n    class Signature {\n        constructor(r, s, recovery) {\n            this.r = validateRS('r', r); // r in [1..N-1];\n            this.s = validateRS('s', s); // s in [1..N-1];\n            if (recovery != null)\n                this.recovery = recovery;\n            Object.freeze(this);\n        }\n        static fromBytes(bytes, format = defaultSigOpts_format) {\n            validateSigLength(bytes, format);\n            let recid;\n            if (format === 'der') {\n                const { r, s } = DER.toSig(abytes(bytes));\n                return new Signature(r, s);\n            }\n            if (format === 'recovered') {\n                recid = bytes[0];\n                format = 'compact';\n                bytes = bytes.subarray(1);\n            }\n            const L = Fn.BYTES;\n            const r = bytes.subarray(0, L);\n            const s = bytes.subarray(L, L * 2);\n            return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);\n        }\n        static fromHex(hex, format) {\n            return this.fromBytes(hexToBytes(hex), format);\n        }\n        addRecoveryBit(recovery) {\n            return new Signature(this.r, this.s, recovery);\n        }\n        recoverPublicKey(messageHash) {\n            const FIELD_ORDER = Fp.ORDER;\n            const { r, s, recovery: rec } = this;\n            if (rec == null || ![0, 1, 2, 3].includes(rec))\n                throw new Error('recovery id invalid');\n            // ECDSA recovery is hard for cofactor > 1 curves.\n            // In sign, `r = q.x mod n`, and here we recover q.x from r.\n            // While recovering q.x >= n, we need to add r+n for cofactor=1 curves.\n            // However, for cofactor>1, r+n may not get q.x:\n            // r+n*i would need to be done instead where i is unknown.\n            // To easily get i, we either need to:\n            // a. increase amount of valid recid values (4, 5...); OR\n            // b. prohibit non-prime-order signatures (recid > 1).\n            const hasCofactor = CURVE_ORDER * _2n < FIELD_ORDER;\n            if (hasCofactor && rec > 1)\n                throw new Error('recovery id is ambiguous for h>1 curve');\n            const radj = rec === 2 || rec === 3 ? r + CURVE_ORDER : r;\n            if (!Fp.isValid(radj))\n                throw new Error('recovery id 2 or 3 invalid');\n            const x = Fp.toBytes(radj);\n            const R = Point.fromBytes(concatBytes(pprefix((rec & 1) === 0), x));\n            const ir = Fn.inv(radj); // r^-1\n            const h = bits2int_modN(ensureBytes('msgHash', messageHash)); // Truncate hash\n            const u1 = Fn.create(-h * ir); // -hr^-1\n            const u2 = Fn.create(s * ir); // sr^-1\n            // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1). unsafe is fine: there is no private data.\n            const Q = Point.BASE.multiplyUnsafe(u1).add(R.multiplyUnsafe(u2));\n            if (Q.is0())\n                throw new Error('point at infinify');\n            Q.assertValidity();\n            return Q;\n        }\n        // Signatures should be low-s, to prevent malleability.\n        hasHighS() {\n            return isBiggerThanHalfOrder(this.s);\n        }\n        toBytes(format = defaultSigOpts_format) {\n            validateSigFormat(format);\n            if (format === 'der')\n                return hexToBytes(DER.hexFromSig(this));\n            const r = Fn.toBytes(this.r);\n            const s = Fn.toBytes(this.s);\n            if (format === 'recovered') {\n                if (this.recovery == null)\n                    throw new Error('recovery bit must be present');\n                return concatBytes(Uint8Array.of(this.recovery), r, s);\n            }\n            return concatBytes(r, s);\n        }\n        toHex(format) {\n            return bytesToHex(this.toBytes(format));\n        }\n        // TODO: remove\n        assertValidity() { }\n        static fromCompact(hex) {\n            return Signature.fromBytes(ensureBytes('sig', hex), 'compact');\n        }\n        static fromDER(hex) {\n            return Signature.fromBytes(ensureBytes('sig', hex), 'der');\n        }\n        normalizeS() {\n            return this.hasHighS() ? new Signature(this.r, Fn.neg(this.s), this.recovery) : this;\n        }\n        toDERRawBytes() {\n            return this.toBytes('der');\n        }\n        toDERHex() {\n            return bytesToHex(this.toBytes('der'));\n        }\n        toCompactRawBytes() {\n            return this.toBytes('compact');\n        }\n        toCompactHex() {\n            return bytesToHex(this.toBytes('compact'));\n        }\n    }\n    // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.\n    // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.\n    // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.\n    // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors\n    const bits2int = ecdsaOpts.bits2int ||\n        function bits2int_def(bytes) {\n            // Our custom check \"just in case\", for protection against DoS\n            if (bytes.length > 8192)\n                throw new Error('input is too large');\n            // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)\n            // for some cases, since bytes.length * 8 is not actual bitLength.\n            const num = bytesToNumberBE(bytes); // check for == u8 done here\n            const delta = bytes.length * 8 - fnBits; // truncate to nBitLength leftmost bits\n            return delta > 0 ? num >> BigInt(delta) : num;\n        };\n    const bits2int_modN = ecdsaOpts.bits2int_modN ||\n        function bits2int_modN_def(bytes) {\n            return Fn.create(bits2int(bytes)); // can't use bytesToNumberBE here\n        };\n    // Pads output with zero as per spec\n    const ORDER_MASK = bitMask(fnBits);\n    /** Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`. */\n    function int2octets(num) {\n        // IMPORTANT: the check ensures working for case `Fn.BYTES != Fn.BITS * 8`\n        aInRange('num < 2^' + fnBits, num, _0n, ORDER_MASK);\n        return Fn.toBytes(num);\n    }\n    function validateMsgAndHash(message, prehash) {\n        abytes(message, undefined, 'message');\n        return prehash ? abytes(hash(message), undefined, 'prehashed message') : message;\n    }\n    /**\n     * Steps A, D of RFC6979 3.2.\n     * Creates RFC6979 seed; converts msg/privKey to numbers.\n     * Used only in sign, not in verify.\n     *\n     * Warning: we cannot assume here that message has same amount of bytes as curve order,\n     * this will be invalid at least for P521. Also it can be bigger for P224 + SHA256.\n     */\n    function prepSig(message, privateKey, opts) {\n        if (['recovered', 'canonical'].some((k) => k in opts))\n            throw new Error('sign() legacy options not supported');\n        const { lowS, prehash, extraEntropy } = validateSigOpts(opts, defaultSigOpts);\n        message = validateMsgAndHash(message, prehash); // RFC6979 3.2 A: h1 = H(m)\n        // We can't later call bits2octets, since nested bits2int is broken for curves\n        // with fnBits % 8 !== 0. Because of that, we unwrap it here as int2octets call.\n        // const bits2octets = (bits) => int2octets(bits2int_modN(bits))\n        const h1int = bits2int_modN(message);\n        const d = _normFnElement(Fn, privateKey); // validate secret key, convert to bigint\n        const seedArgs = [int2octets(d), int2octets(h1int)];\n        // extraEntropy. RFC6979 3.6: additional k' (optional).\n        if (extraEntropy != null && extraEntropy !== false) {\n            // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')\n            // gen random bytes OR pass as-is\n            const e = extraEntropy === true ? randomBytes(lengths.secretKey) : extraEntropy;\n            seedArgs.push(ensureBytes('extraEntropy', e)); // check for being bytes\n        }\n        const seed = concatBytes(...seedArgs); // Step D of RFC6979 3.2\n        const m = h1int; // NOTE: no need to call bits2int second time here, it is inside truncateHash!\n        // Converts signature params into point w r/s, checks result for validity.\n        // To transform k => Signature:\n        // q = k⋅G\n        // r = q.x mod n\n        // s = k^-1(m + rd) mod n\n        // Can use scalar blinding b^-1(bm + bdr) where b ∈ [1,q−1] according to\n        // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. We've decided against it:\n        // a) dependency on CSPRNG b) 15% slowdown c) doesn't really help since bigints are not CT\n        function k2sig(kBytes) {\n            // RFC 6979 Section 3.2, step 3: k = bits2int(T)\n            // Important: all mod() calls here must be done over N\n            const k = bits2int(kBytes); // mod n, not mod p\n            if (!Fn.isValidNot0(k))\n                return; // Valid scalars (including k) must be in 1..N-1\n            const ik = Fn.inv(k); // k^-1 mod n\n            const q = Point.BASE.multiply(k).toAffine(); // q = k⋅G\n            const r = Fn.create(q.x); // r = q.x mod n\n            if (r === _0n)\n                return;\n            const s = Fn.create(ik * Fn.create(m + r * d)); // Not using blinding here, see comment above\n            if (s === _0n)\n                return;\n            let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3, when q.x > n)\n            let normS = s;\n            if (lowS && isBiggerThanHalfOrder(s)) {\n                normS = Fn.neg(s); // if lowS was passed, ensure s is always\n                recovery ^= 1; // // in the bottom half of N\n            }\n            return new Signature(r, normS, recovery); // use normS, not s\n        }\n        return { seed, k2sig };\n    }\n    /**\n     * Signs message hash with a secret key.\n     *\n     * ```\n     * sign(m, d) where\n     *   k = rfc6979_hmac_drbg(m, d)\n     *   (x, y) = G × k\n     *   r = x mod n\n     *   s = (m + dr) / k mod n\n     * ```\n     */\n    function sign(message, secretKey, opts = {}) {\n        message = ensureBytes('message', message);\n        const { seed, k2sig } = prepSig(message, secretKey, opts); // Steps A, D of RFC6979 3.2.\n        const drbg = createHmacDrbg(hash.outputLen, Fn.BYTES, hmac);\n        const sig = drbg(seed, k2sig); // Steps B, C, D, E, F, G\n        return sig;\n    }\n    function tryParsingSig(sg) {\n        // Try to deduce format\n        let sig = undefined;\n        const isHex = typeof sg === 'string' || isBytes(sg);\n        const isObj = !isHex &&\n            sg !== null &&\n            typeof sg === 'object' &&\n            typeof sg.r === 'bigint' &&\n            typeof sg.s === 'bigint';\n        if (!isHex && !isObj)\n            throw new Error('invalid signature, expected Uint8Array, hex string or Signature instance');\n        if (isObj) {\n            sig = new Signature(sg.r, sg.s);\n        }\n        else if (isHex) {\n            try {\n                sig = Signature.fromBytes(ensureBytes('sig', sg), 'der');\n            }\n            catch (derError) {\n                if (!(derError instanceof DER.Err))\n                    throw derError;\n            }\n            if (!sig) {\n                try {\n                    sig = Signature.fromBytes(ensureBytes('sig', sg), 'compact');\n                }\n                catch (error) {\n                    return false;\n                }\n            }\n        }\n        if (!sig)\n            return false;\n        return sig;\n    }\n    /**\n     * Verifies a signature against message and public key.\n     * Rejects lowS signatures by default: see {@link ECDSAVerifyOpts}.\n     * Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:\n     *\n     * ```\n     * verify(r, s, h, P) where\n     *   u1 = hs^-1 mod n\n     *   u2 = rs^-1 mod n\n     *   R = u1⋅G + u2⋅P\n     *   mod(R.x, n) == r\n     * ```\n     */\n    function verify(signature, message, publicKey, opts = {}) {\n        const { lowS, prehash, format } = validateSigOpts(opts, defaultSigOpts);\n        publicKey = ensureBytes('publicKey', publicKey);\n        message = validateMsgAndHash(ensureBytes('message', message), prehash);\n        if ('strict' in opts)\n            throw new Error('options.strict was renamed to lowS');\n        const sig = format === undefined\n            ? tryParsingSig(signature)\n            : Signature.fromBytes(ensureBytes('sig', signature), format);\n        if (sig === false)\n            return false;\n        try {\n            const P = Point.fromBytes(publicKey);\n            if (lowS && sig.hasHighS())\n                return false;\n            const { r, s } = sig;\n            const h = bits2int_modN(message); // mod n, not mod p\n            const is = Fn.inv(s); // s^-1 mod n\n            const u1 = Fn.create(h * is); // u1 = hs^-1 mod n\n            const u2 = Fn.create(r * is); // u2 = rs^-1 mod n\n            const R = Point.BASE.multiplyUnsafe(u1).add(P.multiplyUnsafe(u2)); // u1⋅G + u2⋅P\n            if (R.is0())\n                return false;\n            const v = Fn.create(R.x); // v = r.x mod n\n            return v === r;\n        }\n        catch (e) {\n            return false;\n        }\n    }\n    function recoverPublicKey(signature, message, opts = {}) {\n        const { prehash } = validateSigOpts(opts, defaultSigOpts);\n        message = validateMsgAndHash(message, prehash);\n        return Signature.fromBytes(signature, 'recovered').recoverPublicKey(message).toBytes();\n    }\n    return Object.freeze({\n        keygen,\n        getPublicKey,\n        getSharedSecret,\n        utils,\n        lengths,\n        Point,\n        sign,\n        verify,\n        recoverPublicKey,\n        Signature,\n        hash,\n    });\n}\n/** @deprecated use `weierstrass` in newer releases */\nexport function weierstrassPoints(c) {\n    const { CURVE, curveOpts } = _weierstrass_legacy_opts_to_new(c);\n    const Point = weierstrassN(CURVE, curveOpts);\n    return _weierstrass_new_output_to_legacy(c, Point);\n}\nfunction _weierstrass_legacy_opts_to_new(c) {\n    const CURVE = {\n        a: c.a,\n        b: c.b,\n        p: c.Fp.ORDER,\n        n: c.n,\n        h: c.h,\n        Gx: c.Gx,\n        Gy: c.Gy,\n    };\n    const Fp = c.Fp;\n    let allowedLengths = c.allowedPrivateKeyLengths\n        ? Array.from(new Set(c.allowedPrivateKeyLengths.map((l) => Math.ceil(l / 2))))\n        : undefined;\n    const Fn = Field(CURVE.n, {\n        BITS: c.nBitLength,\n        allowedLengths: allowedLengths,\n        modFromBytes: c.wrapPrivateKey,\n    });\n    const curveOpts = {\n        Fp,\n        Fn,\n        allowInfinityPoint: c.allowInfinityPoint,\n        endo: c.endo,\n        isTorsionFree: c.isTorsionFree,\n        clearCofactor: c.clearCofactor,\n        fromBytes: c.fromBytes,\n        toBytes: c.toBytes,\n    };\n    return { CURVE, curveOpts };\n}\nfunction _ecdsa_legacy_opts_to_new(c) {\n    const { CURVE, curveOpts } = _weierstrass_legacy_opts_to_new(c);\n    const ecdsaOpts = {\n        hmac: c.hmac,\n        randomBytes: c.randomBytes,\n        lowS: c.lowS,\n        bits2int: c.bits2int,\n        bits2int_modN: c.bits2int_modN,\n    };\n    return { CURVE, curveOpts, hash: c.hash, ecdsaOpts };\n}\nexport function _legacyHelperEquat(Fp, a, b) {\n    /**\n     * y² = x³ + ax + b: Short weierstrass curve formula. Takes x, returns y².\n     * @returns y²\n     */\n    function weierstrassEquation(x) {\n        const x2 = Fp.sqr(x); // x * x\n        const x3 = Fp.mul(x2, x); // x² * x\n        return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x³ + a * x + b\n    }\n    return weierstrassEquation;\n}\nfunction _weierstrass_new_output_to_legacy(c, Point) {\n    const { Fp, Fn } = Point;\n    function isWithinCurveOrder(num) {\n        return inRange(num, _1n, Fn.ORDER);\n    }\n    const weierstrassEquation = _legacyHelperEquat(Fp, c.a, c.b);\n    return Object.assign({}, {\n        CURVE: c,\n        Point: Point,\n        ProjectivePoint: Point,\n        normPrivateKeyToScalar: (key) => _normFnElement(Fn, key),\n        weierstrassEquation,\n        isWithinCurveOrder,\n    });\n}\nfunction _ecdsa_new_output_to_legacy(c, _ecdsa) {\n    const Point = _ecdsa.Point;\n    return Object.assign({}, _ecdsa, {\n        ProjectivePoint: Point,\n        CURVE: Object.assign({}, c, nLength(Point.Fn.ORDER, Point.Fn.BITS)),\n    });\n}\n// _ecdsa_legacy\nexport function weierstrass(c) {\n    const { CURVE, curveOpts, hash, ecdsaOpts } = _ecdsa_legacy_opts_to_new(c);\n    const Point = weierstrassN(CURVE, curveOpts);\n    const signs = ecdsa(Point, hash, ecdsaOpts);\n    return _ecdsa_new_output_to_legacy(c, signs);\n}\n//# sourceMappingURL=weierstrass.js.map","/**\n * SECG secp256k1. See [pdf](https://www.secg.org/sec2-v2.pdf).\n *\n * Belongs to Koblitz curves: it has efficiently-computable GLV endomorphism ψ,\n * check out {@link EndomorphismOpts}. Seems to be rigid (not backdoored).\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha256 } from '@noble/hashes/sha2.js';\nimport { randomBytes } from '@noble/hashes/utils.js';\nimport { createCurve } from \"./_shortw_utils.js\";\nimport { createHasher, isogenyMap, } from \"./abstract/hash-to-curve.js\";\nimport { Field, mapHashToField, mod, pow2 } from \"./abstract/modular.js\";\nimport { _normFnElement, mapToCurveSimpleSWU, } from \"./abstract/weierstrass.js\";\nimport { bytesToNumberBE, concatBytes, ensureBytes, inRange, numberToBytesBE, utf8ToBytes, } from \"./utils.js\";\n// Seems like generator was produced from some seed:\n// `Point.BASE.multiply(Point.Fn.inv(2n, N)).toAffine().x`\n// // gives short x 0x3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63n\nconst secp256k1_CURVE = {\n    p: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f'),\n    n: BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141'),\n    h: BigInt(1),\n    a: BigInt(0),\n    b: BigInt(7),\n    Gx: BigInt('0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798'),\n    Gy: BigInt('0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8'),\n};\nconst secp256k1_ENDO = {\n    beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),\n    basises: [\n        [BigInt('0x3086d221a7d46bcde86c90e49284eb15'), -BigInt('0xe4437ed6010e88286f547fa90abfe4c3')],\n        [BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8'), BigInt('0x3086d221a7d46bcde86c90e49284eb15')],\n    ],\n};\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\nconst _2n = /* @__PURE__ */ BigInt(2);\n/**\n * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.\n * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]\n */\nfunction sqrtMod(y) {\n    const P = secp256k1_CURVE.p;\n    // prettier-ignore\n    const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);\n    // prettier-ignore\n    const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);\n    const b2 = (y * y * y) % P; // x^3, 11\n    const b3 = (b2 * b2 * y) % P; // x^7\n    const b6 = (pow2(b3, _3n, P) * b3) % P;\n    const b9 = (pow2(b6, _3n, P) * b3) % P;\n    const b11 = (pow2(b9, _2n, P) * b2) % P;\n    const b22 = (pow2(b11, _11n, P) * b11) % P;\n    const b44 = (pow2(b22, _22n, P) * b22) % P;\n    const b88 = (pow2(b44, _44n, P) * b44) % P;\n    const b176 = (pow2(b88, _88n, P) * b88) % P;\n    const b220 = (pow2(b176, _44n, P) * b44) % P;\n    const b223 = (pow2(b220, _3n, P) * b3) % P;\n    const t1 = (pow2(b223, _23n, P) * b22) % P;\n    const t2 = (pow2(t1, _6n, P) * b2) % P;\n    const root = pow2(t2, _2n, P);\n    if (!Fpk1.eql(Fpk1.sqr(root), y))\n        throw new Error('Cannot find square root');\n    return root;\n}\nconst Fpk1 = Field(secp256k1_CURVE.p, { sqrt: sqrtMod });\n/**\n * secp256k1 curve, ECDSA and ECDH methods.\n *\n * Field: `2n**256n - 2n**32n - 2n**9n - 2n**8n - 2n**7n - 2n**6n - 2n**4n - 1n`\n *\n * @example\n * ```js\n * import { secp256k1 } from '@noble/curves/secp256k1';\n * const { secretKey, publicKey } = secp256k1.keygen();\n * const msg = new TextEncoder().encode('hello');\n * const sig = secp256k1.sign(msg, secretKey);\n * const isValid = secp256k1.verify(sig, msg, publicKey) === true;\n * ```\n */\nexport const secp256k1 = createCurve({ ...secp256k1_CURVE, Fp: Fpk1, lowS: true, endo: secp256k1_ENDO }, sha256);\n// Schnorr signatures are superior to ECDSA from above. Below is Schnorr-specific BIP0340 code.\n// https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\n/** An object mapping tags to their tagged hash prefix of [SHA256(tag) | SHA256(tag)] */\nconst TAGGED_HASH_PREFIXES = {};\nfunction taggedHash(tag, ...messages) {\n    let tagP = TAGGED_HASH_PREFIXES[tag];\n    if (tagP === undefined) {\n        const tagH = sha256(utf8ToBytes(tag));\n        tagP = concatBytes(tagH, tagH);\n        TAGGED_HASH_PREFIXES[tag] = tagP;\n    }\n    return sha256(concatBytes(tagP, ...messages));\n}\n// ECDSA compact points are 33-byte. Schnorr is 32: we strip first byte 0x02 or 0x03\nconst pointToBytes = (point) => point.toBytes(true).slice(1);\nconst Pointk1 = /* @__PURE__ */ (() => secp256k1.Point)();\nconst hasEven = (y) => y % _2n === _0n;\n// Calculate point, scalar and bytes\nfunction schnorrGetExtPubKey(priv) {\n    const { Fn, BASE } = Pointk1;\n    const d_ = _normFnElement(Fn, priv);\n    const p = BASE.multiply(d_); // P = d'⋅G; 0 < d' < n check is done inside\n    const scalar = hasEven(p.y) ? d_ : Fn.neg(d_);\n    return { scalar, bytes: pointToBytes(p) };\n}\n/**\n * lift_x from BIP340. Convert 32-byte x coordinate to elliptic curve point.\n * @returns valid point checked for being on-curve\n */\nfunction lift_x(x) {\n    const Fp = Fpk1;\n    if (!Fp.isValidNot0(x))\n        throw new Error('invalid x: Fail if x ≥ p');\n    const xx = Fp.create(x * x);\n    const c = Fp.create(xx * x + BigInt(7)); // Let c = x³ + 7 mod p.\n    let y = Fp.sqrt(c); // Let y = c^(p+1)/4 mod p. Same as sqrt().\n    // Return the unique point P such that x(P) = x and\n    // y(P) = y if y mod 2 = 0 or y(P) = p-y otherwise.\n    if (!hasEven(y))\n        y = Fp.neg(y);\n    const p = Pointk1.fromAffine({ x, y });\n    p.assertValidity();\n    return p;\n}\nconst num = bytesToNumberBE;\n/**\n * Create tagged hash, convert it to bigint, reduce modulo-n.\n */\nfunction challenge(...args) {\n    return Pointk1.Fn.create(num(taggedHash('BIP0340/challenge', ...args)));\n}\n/**\n * Schnorr public key is just `x` coordinate of Point as per BIP340.\n */\nfunction schnorrGetPublicKey(secretKey) {\n    return schnorrGetExtPubKey(secretKey).bytes; // d'=int(sk). Fail if d'=0 or d'≥n. Ret bytes(d'⋅G)\n}\n/**\n * Creates Schnorr signature as per BIP340. Verifies itself before returning anything.\n * auxRand is optional and is not the sole source of k generation: bad CSPRNG won't be dangerous.\n */\nfunction schnorrSign(message, secretKey, auxRand = randomBytes(32)) {\n    const { Fn } = Pointk1;\n    const m = ensureBytes('message', message);\n    const { bytes: px, scalar: d } = schnorrGetExtPubKey(secretKey); // checks for isWithinCurveOrder\n    const a = ensureBytes('auxRand', auxRand, 32); // Auxiliary random data a: a 32-byte array\n    const t = Fn.toBytes(d ^ num(taggedHash('BIP0340/aux', a))); // Let t be the byte-wise xor of bytes(d) and hash/aux(a)\n    const rand = taggedHash('BIP0340/nonce', t, px, m); // Let rand = hash/nonce(t || bytes(P) || m)\n    // Let k' = int(rand) mod n. Fail if k' = 0. Let R = k'⋅G\n    const { bytes: rx, scalar: k } = schnorrGetExtPubKey(rand);\n    const e = challenge(rx, px, m); // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.\n    const sig = new Uint8Array(64); // Let sig = bytes(R) || bytes((k + ed) mod n).\n    sig.set(rx, 0);\n    sig.set(Fn.toBytes(Fn.create(k + e * d)), 32);\n    // If Verify(bytes(P), m, sig) (see below) returns failure, abort\n    if (!schnorrVerify(sig, m, px))\n        throw new Error('sign: Invalid signature produced');\n    return sig;\n}\n/**\n * Verifies Schnorr signature.\n * Will swallow errors & return false except for initial type validation of arguments.\n */\nfunction schnorrVerify(signature, message, publicKey) {\n    const { Fn, BASE } = Pointk1;\n    const sig = ensureBytes('signature', signature, 64);\n    const m = ensureBytes('message', message);\n    const pub = ensureBytes('publicKey', publicKey, 32);\n    try {\n        const P = lift_x(num(pub)); // P = lift_x(int(pk)); fail if that fails\n        const r = num(sig.subarray(0, 32)); // Let r = int(sig[0:32]); fail if r ≥ p.\n        if (!inRange(r, _1n, secp256k1_CURVE.p))\n            return false;\n        const s = num(sig.subarray(32, 64)); // Let s = int(sig[32:64]); fail if s ≥ n.\n        if (!inRange(s, _1n, secp256k1_CURVE.n))\n            return false;\n        // int(challenge(bytes(r)||bytes(P)||m))%n\n        const e = challenge(Fn.toBytes(r), pointToBytes(P), m);\n        // R = s⋅G - e⋅P, where -eP == (n-e)P\n        const R = BASE.multiplyUnsafe(s).add(P.multiplyUnsafe(Fn.neg(e)));\n        const { x, y } = R.toAffine();\n        // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.\n        if (R.is0() || !hasEven(y) || x !== r)\n            return false;\n        return true;\n    }\n    catch (error) {\n        return false;\n    }\n}\n/**\n * Schnorr signatures over secp256k1.\n * https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\n * @example\n * ```js\n * import { schnorr } from '@noble/curves/secp256k1';\n * const { secretKey, publicKey } = schnorr.keygen();\n * // const publicKey = schnorr.getPublicKey(secretKey);\n * const msg = new TextEncoder().encode('hello');\n * const sig = schnorr.sign(msg, secretKey);\n * const isValid = schnorr.verify(sig, msg, publicKey);\n * ```\n */\nexport const schnorr = /* @__PURE__ */ (() => {\n    const size = 32;\n    const seedLength = 48;\n    const randomSecretKey = (seed = randomBytes(seedLength)) => {\n        return mapHashToField(seed, secp256k1_CURVE.n);\n    };\n    // TODO: remove\n    secp256k1.utils.randomSecretKey;\n    function keygen(seed) {\n        const secretKey = randomSecretKey(seed);\n        return { secretKey, publicKey: schnorrGetPublicKey(secretKey) };\n    }\n    return {\n        keygen,\n        getPublicKey: schnorrGetPublicKey,\n        sign: schnorrSign,\n        verify: schnorrVerify,\n        Point: Pointk1,\n        utils: {\n            randomSecretKey: randomSecretKey,\n            randomPrivateKey: randomSecretKey,\n            taggedHash,\n            // TODO: remove\n            lift_x,\n            pointToBytes,\n            numberToBytesBE,\n            bytesToNumberBE,\n            mod,\n        },\n        lengths: {\n            secretKey: size,\n            publicKey: size,\n            publicKeyHasPrefix: false,\n            signature: size * 2,\n            seed: seedLength,\n        },\n    };\n})();\nconst isoMap = /* @__PURE__ */ (() => isogenyMap(Fpk1, [\n    // xNum\n    [\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7',\n        '0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581',\n        '0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262',\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c',\n    ],\n    // xDen\n    [\n        '0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b',\n        '0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n    // yNum\n    [\n        '0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c',\n        '0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3',\n        '0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931',\n        '0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84',\n    ],\n    // yDen\n    [\n        '0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b',\n        '0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573',\n        '0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n].map((i) => i.map((j) => BigInt(j)))))();\nconst mapSWU = /* @__PURE__ */ (() => mapToCurveSimpleSWU(Fpk1, {\n    A: BigInt('0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533'),\n    B: BigInt('1771'),\n    Z: Fpk1.create(BigInt('-11')),\n}))();\n/** Hashing / encoding to secp256k1 points / field. RFC 9380 methods. */\nexport const secp256k1_hasher = /* @__PURE__ */ (() => createHasher(secp256k1.Point, (scalars) => {\n    const { x, y } = mapSWU(Fpk1.create(scalars[0]));\n    return isoMap(x, y);\n}, {\n    DST: 'secp256k1_XMD:SHA-256_SSWU_RO_',\n    encodeDST: 'secp256k1_XMD:SHA-256_SSWU_NU_',\n    p: Fpk1.ORDER,\n    m: 1,\n    k: 128,\n    expand: 'xmd',\n    hash: sha256,\n}))();\n/** @deprecated use `import { secp256k1_hasher } from '@noble/curves/secp256k1.js';` */\nexport const hashToCurve = /* @__PURE__ */ (() => secp256k1_hasher.hashToCurve)();\n/** @deprecated use `import { secp256k1_hasher } from '@noble/curves/secp256k1.js';` */\nexport const encodeToCurve = /* @__PURE__ */ (() => secp256k1_hasher.encodeToCurve)();\n//# sourceMappingURL=secp256k1.js.map","/**\n * Utilities for short weierstrass curves, combined with noble-hashes.\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { weierstrass } from \"./abstract/weierstrass.js\";\n/** connects noble-curves to noble-hashes */\nexport function getHash(hash) {\n    return { hash };\n}\n/** @deprecated use new `weierstrass()` and `ecdsa()` methods */\nexport function createCurve(curveDef, defHash) {\n    const create = (hash) => weierstrass({ ...curveDef, hash: hash });\n    return { ...create(defHash), create };\n}\n//# sourceMappingURL=_shortw_utils.js.map"],"names":["HMAC","Hash","constructor","hash","_key","super","this","finished","destroyed","ahash","key","toBytes","iHash","create","update","Error","blockLen","outputLen","pad","Uint8Array","set","length","digest","i","oHash","clean","buf","aexists","digestInto","out","abytes","destroy","_cloneInto","to","Object","getPrototypeOf","clone","hmac","message","_0n","_1n","_abool2","value","title","_abytes2","bytes","isBytes_","len","needsLen","numberToHexUnpadded","num","hex","toString","hexToNumber","BigInt","bytesToNumberBE","bytesToHex_","bytesToNumberLE","abytes_","from","reverse","numberToBytesBE","n","hexToBytes_","padStart","numberToBytesLE","ensureBytes","expectedLength","res","e","isPosBig","aInRange","min","max","inRange","bitLen","bitMask","_validateObject","object","fields","optFields","checkField","fieldName","expectedType","isOpt","val","current","entries","forEach","k","v","memoized","fn","map","WeakMap","arg","args","get","computed","_2n","_3n","_4n","_5n","_7n","_8n","_9n","_16n","mod","a","b","result","pow2","x","power","modulo","invert","number","u","r","m","assertIsSquare","Fp","root","eql","sqr","sqrt3mod4","p1div4","ORDER","pow","sqrt5mod8","p5div8","n2","mul","nv","sub","ONE","tonelliShanks","P","Q","S","Z","_Fp","Field","FpLegendre","cc","Q1div2","is0","M","c","t","R","ZERO","t_tmp","exponent","FpSqrt","Fp_","tn","c1","neg","c2","c3","c4","tv1","tv2","tv3","tv4","e1","e2","cmov","e3","sqrt9mod16","FIELD_FIELDS","FpInvertBatch","nums","passZero","inverted","Array","fill","multipliedAcc","reduce","acc","invertedAcc","inv","reduceRight","p1mod2","powered","yes","zero","no","nLength","nBitLength","anumber","_nBitLength","nByteLength","Math","ceil","bitLenOrOpts","isLE","opts","_nbitLength","_sqrt","allowedLengths","modFromBytes","sqrt","_opts","BITS","BYTES","sqrtP","f","freeze","MASK","isValid","isValidNot0","isOdd","lhs","rhs","add","p","d","FpPow","div","sqrN","addN","subN","mulN","fromBytes","skipValidation","includes","padded","scalar","invertBatch","lst","getFieldBytesLength","fieldOrder","bitLength","getMinHashLength","negateCt","condition","item","negate","normalizeZ","points","invertedZs","fromAffine","toAffine","validateW","W","bits","Number","isSafeInteger","calcWOpts","scalarBits","maxNumber","windows","windowSize","mask","shiftBy","calcOffsets","window","wOpts","wbits","nextN","offsetStart","offset","abs","isZero","isNeg","isNegF","offsetF","pointPrecomputes","pointWindowSizes","getW","assert0","wNAF","Point","BASE","Fn","_unsafeLadder","elm","double","precomputeWindow","point","base","push","precomputes","wo","wNAFUnsafe","getPrecomputes","transform","comp","cached","unsafe","prev","createCache","delete","hasCache","pippenger","fieldN","scalars","isArray","validateMSMPoints","field","s","validateMSMScalars","plength","slength","buckets","sum","floor","j","resI","sumI","createField","order","validateField","divNearest","den","validateSigFormat","format","validateSigOpts","def","optsn","optName","keys","abool","lowS","prehash","DERErr","DER","Err","_tlv","encode","tag","data","E","dataLen","lenLen","decode","pos","first","lengthBytes","subarray","l","_int","parseInt","toSig","int","tlv","seqBytes","seqLeftBytes","rBytes","rLeftBytes","sBytes","sLeftBytes","hexFromSig","sig","seq","_normFnElement","expected","error","weierstrassN","params","extraOpts","validated","type","CURVE","curveOpts","FpFnLE","assign","_createCurveFields","h","cofactor","CURVE_ORDER","allowInfinityPoint","clearCofactor","isTorsionFree","endo","wrapPrivateKey","beta","basises","lengths","getWLengths","assertCompressionIsSupported","encodePoint","_c","isCompressed","y","bx","hasEvenY","concatBytes","pprefix","of","decodePoint","publicKey","publicKeyUncompressed","uncomp","head","tail","L","isValidXY","y2","weierstrassEquation","sqrtError","err","x2","x3","left","right","Gx","Gy","_4a3","_27b2","acoord","banZero","aprjpoint","other","splitEndoScalarN","basis","a1","b1","a2","b2","k1","k2","k1neg","k2neg","MAX_NUM","_splitEndoScalar","toAffineMemo","iz","X","Y","zz","assertValidMemo","finishEndo","endoBeta","k1p","k2p","assertValidity","fromHex","precompute","isLazy","wnaf","multiply","equals","X1","Y1","Z1","X2","Y2","Z2","U1","U2","b3","X3","Y3","Z3","t0","t1","t2","t3","t4","t5","subtract","fake","k1f","k2f","multiplyUnsafe","sc","p1","p2","mulEndoUnsafe","multiplyAndAddUnsafe","invertedZ","isSmallOrder","toHex","bytesToHex","px","py","pz","toRawBytes","_setWindowSize","msm","fromPrivateKey","privateKey","secretKey","publicKeyHasPrefix","signature","ecdh","ecdhOpts","randomBytes_","randomBytes","randomBytesWeb","seed","isValidSecretKey","randomSecretKey","fieldLen","minLen","reduced","mapHashToField","getPublicKey","isProbPub","utils","isValidPublicKey","isValidPrivateKey","randomPrivateKey","normPrivateKeyToScalar","getSharedSecret","secretKeyA","publicKeyB","keygen","ecdsa","ecdsaOpts","bits2int","bits2int_modN","msgs","nobleHmac","fnBits","defaultSigOpts","extraEntropy","defaultSigOpts_format","isBiggerThanHalfOrder","validateRS","Signature","recovery","recid","size","validateSigLength","hexToBytes","addRecoveryBit","recoverPublicKey","messageHash","FIELD_ORDER","rec","radj","ir","u1","u2","hasHighS","fromCompact","fromDER","normalizeS","toDERRawBytes","toDERHex","toCompactRawBytes","toCompactHex","delta","ORDER_MASK","int2octets","validateMsgAndHash","sign","k2sig","some","h1int","seedArgs","kBytes","ik","q","normS","prepSig","hashLen","qByteLen","hmacFn","u8n","u8of","byte","reset","reseed","gen","sl","slice","concatBytes_","pred","createHmacDrbg","drbg","verify","sg","isHex","isBytes","isObj","derError","tryParsingSig","is","_ecdsa_legacy_opts_to_new","allowedPrivateKeyLengths","Set","_weierstrass_legacy_opts_to_new","weierstrass","_ecdsa","ProjectivePoint","_ecdsa_new_output_to_legacy","secp256k1_CURVE","secp256k1_ENDO","Fpk1","_6n","_11n","_22n","_23n","_44n","_88n","b6","b9","b11","b22","b44","b88","b176","b220","b223","secp256k1","curveDef","defHash","createCurve","sha256"],"mappings":"wHAKO,MAAMA,UAAaC,EAAAA,KACtB,WAAAC,CAAYC,EAAMC,GACdC,QACAC,KAAKC,UAAW,EAChBD,KAAKE,WAAY,EACjBC,EAAAA,MAAMN,GACN,MAAMO,EAAMC,EAAAA,QAAQP,GAEpB,GADAE,KAAKM,MAAQT,EAAKU,SACe,mBAAtBP,KAAKM,MAAME,OAClB,MAAM,IAAIC,MAAM,uDACpBT,KAAKU,SAAWV,KAAKM,MAAMI,SAC3BV,KAAKW,UAAYX,KAAKM,MAAMK,UAC5B,MAAMD,EAAWV,KAAKU,SAChBE,EAAM,IAAIC,WAAWH,GAE3BE,EAAIE,IAAIV,EAAIW,OAASL,EAAWb,EAAKU,SAASC,OAAOJ,GAAKY,SAAWZ,GACrE,IAAA,IAASa,EAAI,EAAGA,EAAIL,EAAIG,OAAQE,IAC5BL,EAAIK,IAAM,GACdjB,KAAKM,MAAME,OAAOI,GAElBZ,KAAKkB,MAAQrB,EAAKU,SAElB,IAAA,IAASU,EAAI,EAAGA,EAAIL,EAAIG,OAAQE,IAC5BL,EAAIK,IAAM,IACdjB,KAAKkB,MAAMV,OAAOI,GAClBO,EAAAA,MAAMP,EACV,CACA,MAAAJ,CAAOY,GAGH,OAFAC,EAAAA,QAAQrB,MACRA,KAAKM,MAAME,OAAOY,GACXpB,IACX,CACA,UAAAsB,CAAWC,GACPF,EAAAA,QAAQrB,MACRwB,SAAOD,EAAKvB,KAAKW,WACjBX,KAAKC,UAAW,EAChBD,KAAKM,MAAMgB,WAAWC,GACtBvB,KAAKkB,MAAMV,OAAOe,GAClBvB,KAAKkB,MAAMI,WAAWC,GACtBvB,KAAKyB,SACT,CACA,MAAAT,GACI,MAAMO,EAAM,IAAIV,WAAWb,KAAKkB,MAAMP,WAEtC,OADAX,KAAKsB,WAAWC,GACTA,CACX,CACA,UAAAG,CAAWC,GAEPA,IAAOA,EAAKC,OAAOrB,OAAOqB,OAAOC,eAAe7B,MAAO,CAAA,IACvD,MAAMkB,MAAEA,EAAAZ,MAAOA,EAAAL,SAAOA,YAAUC,EAAAQ,SAAWA,EAAAC,UAAUA,GAAcX,KAQnE,OANA2B,EAAG1B,SAAWA,EACd0B,EAAGzB,UAAYA,EACfyB,EAAGjB,SAAWA,EACdiB,EAAGhB,UAAYA,EACfgB,EAAGT,MAAQA,EAAMQ,WAAWC,EAAGT,OAC/BS,EAAGrB,MAAQA,EAAMoB,WAAWC,EAAGrB,OACxBqB,CACX,CACA,KAAAG,GACI,OAAO9B,KAAK0B,YAChB,CACA,OAAAD,GACIzB,KAAKE,WAAY,EACjBF,KAAKkB,MAAMO,UACXzB,KAAKM,MAAMmB,SACf,EAYG,MAAMM,EAAO,CAAClC,EAAMO,EAAK4B,IAAY,IAAItC,EAAKG,EAAMO,GAAKI,OAAOwB,GAAShB,SAChFe,EAAKxB,OAAS,CAACV,EAAMO,IAAQ,IAAIV,EAAKG,EAAMO;;AC7E5C,MAAM6B,SAA6B,GAC7BC,SAA6B,GAM5B,SAASC,EAAQC,EAAOC,EAAQ,IACnC,GAAqB,kBAAVD,EAAqB,CAE5B,MAAM,IAAI3B,OADK4B,GAAS,IAAIA,MACH,qCAAuCD,EACpE,CACA,OAAOA,CACX,CAGO,SAASE,EAASF,EAAOrB,EAAQsB,EAAQ,IAC5C,MAAME,EAAQC,EAAAA,QAASJ,GACjBK,EAAML,GAAOrB,OACb2B,OAAsB,IAAX3B,EACjB,IAAKwB,GAAUG,GAAYD,IAAQ1B,EAAS,CAIxC,MAAM,IAAIN,OAHK4B,GAAS,IAAIA,OAGH,uBAFXK,EAAW,cAAc3B,IAAW,IAEO,UAD7CwB,EAAQ,UAAUE,IAAQ,eAAeL,GAEzD,CACA,OAAOA,CACX,CAEO,SAASO,EAAoBC,GAChC,MAAMC,EAAMD,EAAIE,SAAS,IACzB,OAAoB,EAAbD,EAAI9B,OAAa,IAAM8B,EAAMA,CACxC,CACO,SAASE,EAAYF,GACxB,GAAmB,iBAARA,EACP,MAAM,IAAIpC,MAAM,mCAAqCoC,GACzD,MAAe,KAARA,EAAaZ,EAAMe,OAAO,KAAOH,EAC5C,CAEO,SAASI,EAAgBV,GAC5B,OAAOQ,EAAYG,aAAYX,GACnC,CACO,SAASY,EAAgBZ,GAE5B,OADAa,EAAAA,OAAQb,GACDQ,EAAYG,EAAAA,WAAYrC,WAAWwC,KAAKd,GAAOe,WAC1D,CACO,SAASC,EAAgBC,EAAGf,GAC/B,OAAOgB,EAAAA,WAAYD,EAAEV,SAAS,IAAIY,SAAe,EAANjB,EAAS,KACxD,CACO,SAASkB,EAAgBH,EAAGf,GAC/B,OAAOc,EAAgBC,EAAGf,GAAKa,SACnC,CAcO,SAASM,EAAYvB,EAAOQ,EAAKgB,GACpC,IAAIC,EACJ,GAAmB,iBAARjB,EACP,IACIiB,EAAML,EAAAA,WAAYZ,EACtB,OACOkB,GACH,MAAM,IAAItD,MAAM4B,EAAQ,6CAA+C0B,EAC3E,KACJ,KACSvB,EAAAA,QAASK,GAMd,MAAM,IAAIpC,MAAM4B,EAAQ,qCAHxByB,EAAMjD,WAAWwC,KAAKR,EAI1B,CAIA,OAHYiB,EAAI/C,OAGT+C,CACX,CAyCA,MAAME,EAAYR,GAAmB,iBAANA,GAAkBvB,GAAOuB,EASjD,SAASS,EAAS5B,EAAOmB,EAAGU,EAAKC,GAMpC,IAdG,SAAiBX,EAAGU,EAAKC,GAC5B,OAAOH,EAASR,IAAMQ,EAASE,IAAQF,EAASG,IAAQD,GAAOV,GAAKA,EAAIW,CAC5E,CAYSC,CAAQZ,EAAGU,EAAKC,GACjB,MAAM,IAAI1D,MAAM,kBAAoB4B,EAAQ,KAAO6B,EAAM,WAAaC,EAAM,SAAWX,EAC/F,CAOO,SAASa,EAAOb,GACnB,IAAIf,EACJ,IAAKA,EAAM,EAAGe,EAAIvB,EAAKuB,IAAMtB,EAAKO,GAAO,GAEzC,OAAOA,CACX,CAmBO,MAAM6B,EAAWd,IAAOtB,GAAOc,OAAOQ,IAAMtB,EAuG5C,SAASqC,EAAgBC,EAAQC,EAAQC,EAAY,CAAA,GACxD,IAAKF,GAA4B,iBAAXA,EAClB,MAAM,IAAI/D,MAAM,iCACpB,SAASkE,EAAWC,EAAWC,EAAcC,GACzC,MAAMC,EAAMP,EAAOI,GACnB,GAAIE,QAAiB,IAARC,EACT,OACJ,MAAMC,SAAiBD,EACvB,GAAIC,IAAYH,GAAwB,OAARE,EAC5B,MAAM,IAAItE,MAAM,UAAUmE,2BAAmCC,UAAqBG,IAC1F,CACApD,OAAOqD,QAAQR,GAAQS,QAAQ,EAAEC,EAAGC,KAAOT,EAAWQ,EAAGC,GAAG,IAC5DxD,OAAOqD,QAAQP,GAAWQ,QAAQ,EAAEC,EAAGC,KAAOT,EAAWQ,EAAGC,GAAG,GACnE,CAWO,SAASC,EAASC,GACrB,MAAMC,MAAUC,QAChB,MAAO,CAACC,KAAQC,KACZ,MAAMX,EAAMQ,EAAII,IAAIF,GACpB,QAAY,IAARV,EACA,OAAOA,EACX,MAAMa,EAAWN,EAAGG,KAAQC,GAE5B,OADAH,EAAIzE,IAAI2E,EAAKG,GACNA,EAEf;sECvTA,MAAM3D,EAAMe,OAAO,GAAId,EAAMc,OAAO,GAAI6C,EAAsB7C,OAAO,GAAI8C,SAA6B,GAEhGC,EAAsB/C,OAAO,GAAIgD,SAA6B,GAAIC,EAAsBjD,OAAO,GAE/FkD,EAAsBlD,OAAO,GAAImD,SAA6B,GAAIC,EAAuBpD,OAAO,IAE/F,SAASqD,EAAIC,EAAGC,GACnB,MAAMC,EAASF,EAAIC,EACnB,OAAOC,GAAUvE,EAAMuE,EAASD,EAAIC,CACxC,CAWO,SAASC,EAAKC,EAAGC,EAAOC,GAC3B,IAAI9C,EAAM4C,EACV,KAAOC,KAAU1E,GACb6B,GAAOA,EACPA,GAAO8C,EAEX,OAAO9C,CACX,CAKO,SAAS+C,EAAOC,EAAQF,GAC3B,GAAIE,IAAW7E,EACX,MAAM,IAAIxB,MAAM,oCACpB,GAAImG,GAAU3E,EACV,MAAM,IAAIxB,MAAM,0CAA4CmG,GAEhE,IAAIN,EAAID,EAAIS,EAAQF,GAChBL,EAAIK,EAEJF,EAAIzE,EAAc8E,EAAI7E,EAC1B,KAAOoE,IAAMrE,GAAK,CAEd,MACM+E,EAAIT,EAAID,EACRW,EAAIP,EAAIK,GAFJR,EAAID,GAKdC,EAAID,EAAGA,EAAIU,EAAGN,EAAIK,EAAUA,EAAIE,CACpC,CAEA,GADYV,IACArE,EACR,MAAM,IAAIzB,MAAM,0BACpB,OAAO4F,EAAIK,EAAGE,EAClB,CACA,SAASM,EAAeC,EAAIC,EAAM5D,GAC9B,IAAK2D,EAAGE,IAAIF,EAAGG,IAAIF,GAAO5D,GACtB,MAAM,IAAI/C,MAAM,0BACxB,CAKA,SAAS8G,EAAUJ,EAAI3D,GACnB,MAAMgE,GAAUL,EAAGM,MAAQvF,GAAO6D,EAC5BqB,EAAOD,EAAGO,IAAIlE,EAAGgE,GAEvB,OADAN,EAAeC,EAAIC,EAAM5D,GAClB4D,CACX,CACA,SAASO,EAAUR,EAAI3D,GACnB,MAAMoE,GAAUT,EAAGM,MAAQzB,GAAOE,EAC5B2B,EAAKV,EAAGW,IAAItE,EAAGqC,GACfT,EAAI+B,EAAGO,IAAIG,EAAID,GACfG,EAAKZ,EAAGW,IAAItE,EAAG4B,GACfnE,EAAIkG,EAAGW,IAAIX,EAAGW,IAAIC,EAAIlC,GAAMT,GAC5BgC,EAAOD,EAAGW,IAAIC,EAAIZ,EAAGa,IAAI/G,EAAGkG,EAAGc,MAErC,OADAf,EAAeC,EAAIC,EAAM5D,GAClB4D,CACX,CAgCO,SAASc,EAAcC,GAG1B,GAAIA,EAAIrC,EACJ,MAAM,IAAIrF,MAAM,uCAEpB,IAAI2H,EAAID,EAAIjG,EACRmG,EAAI,EACR,KAAOD,EAAIvC,IAAQ5D,GACfmG,GAAKvC,EACLwC,IAGJ,IAAIC,EAAIzC,EACR,MAAM0C,EAAMC,EAAML,GAClB,KAA8B,IAAvBM,EAAWF,EAAKD,IAGnB,GAAIA,IAAM,IACN,MAAM,IAAI7H,MAAM,iDAGxB,GAAU,IAAN4H,EACA,OAAOd,EAGX,IAAImB,EAAKH,EAAIb,IAAIY,EAAGF,GACpB,MAAMO,GAAUP,EAAIlG,GAAO2D,EAC3B,OAAO,SAAqBsB,EAAI3D,GAC5B,GAAI2D,EAAGyB,IAAIpF,GACP,OAAOA,EAEX,GAA0B,IAAtBiF,EAAWtB,EAAI3D,GACf,MAAM,IAAI/C,MAAM,2BAEpB,IAAIoI,EAAIR,EACJS,EAAI3B,EAAGW,IAAIX,EAAGc,IAAKS,GACnBK,EAAI5B,EAAGO,IAAIlE,EAAG4E,GACdY,EAAI7B,EAAGO,IAAIlE,EAAGmF,GAGlB,MAAQxB,EAAGE,IAAI0B,EAAG5B,EAAGc,MAAM,CACvB,GAAId,EAAGyB,IAAIG,GACP,OAAO5B,EAAG8B,KACd,IAAIhI,EAAI,EAEJiI,EAAQ/B,EAAGG,IAAIyB,GACnB,MAAQ5B,EAAGE,IAAI6B,EAAO/B,EAAGc,MAGrB,GAFAhH,IACAiI,EAAQ/B,EAAGG,IAAI4B,GACXjI,IAAM4H,EACN,MAAM,IAAIpI,MAAM,2BAGxB,MAAM0I,EAAWjH,GAAOc,OAAO6F,EAAI5H,EAAI,GACjCsF,EAAIY,EAAGO,IAAIoB,EAAGK,GAEpBN,EAAI5H,EACJ6H,EAAI3B,EAAGG,IAAIf,GACXwC,EAAI5B,EAAGW,IAAIiB,EAAGD,GACdE,EAAI7B,EAAGW,IAAIkB,EAAGzC,EAClB,CACA,OAAOyC,CACX,CACJ,CAYO,SAASI,EAAOjB,GAEnB,OAAIA,EAAIpC,IAAQD,EACLyB,EAEPY,EAAIjC,IAAQF,EACL2B,EAEPQ,EAAI/B,IAASD,EAjHrB,SAAoBgC,GAChB,MAAMkB,EAAMb,EAAML,GACZmB,EAAKpB,EAAcC,GACnBoB,EAAKD,EAAGD,EAAKA,EAAIG,IAAIH,EAAIpB,MACzBwB,EAAKH,EAAGD,EAAKE,GACbG,EAAKJ,EAAGD,EAAKA,EAAIG,IAAID,IACrBI,GAAMxB,EAAIlC,GAAOG,EACvB,MAAO,CAACe,EAAI3D,KACR,IAAIoG,EAAMzC,EAAGO,IAAIlE,EAAGmG,GAChBE,EAAM1C,EAAGW,IAAI8B,EAAKL,GACtB,MAAMO,EAAM3C,EAAGW,IAAI8B,EAAKH,GAClBM,EAAM5C,EAAGW,IAAI8B,EAAKF,GAClBM,EAAK7C,EAAGE,IAAIF,EAAGG,IAAIuC,GAAMrG,GACzByG,EAAK9C,EAAGE,IAAIF,EAAGG,IAAIwC,GAAMtG,GAC/BoG,EAAMzC,EAAG+C,KAAKN,EAAKC,EAAKG,GACxBH,EAAM1C,EAAG+C,KAAKH,EAAKD,EAAKG,GACxB,MAAME,EAAKhD,EAAGE,IAAIF,EAAGG,IAAIuC,GAAMrG,GACzB4D,EAAOD,EAAG+C,KAAKN,EAAKC,EAAKM,GAE/B,OADAjD,EAAeC,EAAIC,EAAM5D,GAClB4D,EAEf,CA6FegD,CAAWjC,GAEfD,EAAcC,EACzB,CAIA,MAAMkC,EAAe,CACjB,SAAU,UAAW,MAAO,MAAO,MAAO,OAAQ,MAClD,MAAO,MAAO,MAAO,MAAO,MAAO,MACnC,OAAQ,OAAQ,OAAQ,QA8CrB,SAASC,EAAcnD,EAAIoD,EAAMC,GAAW,GAC/C,MAAMC,EAAW,IAAIC,MAAMH,EAAKxJ,QAAQ4J,KAAKH,EAAWrD,EAAG8B,UAAO,GAE5D2B,EAAgBL,EAAKM,OAAO,CAACC,EAAKlI,EAAK3B,IACrCkG,EAAGyB,IAAIhG,GACAkI,GACXL,EAASxJ,GAAK6J,EACP3D,EAAGW,IAAIgD,EAAKlI,IACpBuE,EAAGc,KAEA8C,EAAc5D,EAAG6D,IAAIJ,GAQ3B,OANAL,EAAKU,YAAY,CAACH,EAAKlI,EAAK3B,IACpBkG,EAAGyB,IAAIhG,GACAkI,GACXL,EAASxJ,GAAKkG,EAAGW,IAAIgD,EAAKL,EAASxJ,IAC5BkG,EAAGW,IAAIgD,EAAKlI,IACpBmI,GACIN,CACX,CAcO,SAAShC,EAAWtB,EAAI3D,GAG3B,MAAM0H,GAAU/D,EAAGM,MAAQvF,GAAO2D,EAC5BsF,EAAUhE,EAAGO,IAAIlE,EAAG0H,GACpBE,EAAMjE,EAAGE,IAAI8D,EAAShE,EAAGc,KACzBoD,EAAOlE,EAAGE,IAAI8D,EAAShE,EAAG8B,MAC1BqC,EAAKnE,EAAGE,IAAI8D,EAAShE,EAAGqC,IAAIrC,EAAGc,MACrC,IAAKmD,IAAQC,IAASC,EAClB,MAAM,IAAI7K,MAAM,kCACpB,OAAO2K,EAAM,EAAIC,EAAO,GAAI,CAChC,CAOO,SAASE,EAAQ/H,EAAGgI,QAEJ,IAAfA,GACAC,EAAAA,QAAQD,GACZ,MAAME,OAA6B,IAAfF,EAA2BA,EAAahI,EAAEV,SAAS,GAAG/B,OAE1E,MAAO,CAAEyK,WAAYE,EAAaC,YADdC,KAAKC,KAAKH,EAAc,GAEhD,CAoBO,SAASlD,EAAMf,EAAOqE,EAC7BC,GAAO,EAAOC,EAAO,IACjB,GAAIvE,GAASxF,EACT,MAAM,IAAIxB,MAAM,0CAA4CgH,GAChE,IAAIwE,EACAC,EAEAC,EADAC,GAAe,EAEnB,GAA4B,iBAAjBN,GAA6C,MAAhBA,EAAsB,CAC1D,GAAIE,EAAKK,MAAQN,EACb,MAAM,IAAItL,MAAM,wCACpB,MAAM6L,EAAQR,EACVQ,EAAMC,OACNN,EAAcK,EAAMC,MACpBD,EAAMD,OACNH,EAAQI,EAAMD,MACQ,kBAAfC,EAAMP,OACbA,EAAOO,EAAMP,MACiB,kBAAvBO,EAAMF,eACbA,EAAeE,EAAMF,cACzBD,EAAiBG,EAAMH,cAC3B,KAEgC,iBAAjBL,IACPG,EAAcH,GACdE,EAAKK,OACLH,EAAQF,EAAKK,MAErB,MAAQb,WAAYe,EAAMZ,YAAaa,GAAUjB,EAAQ9D,EAAOwE,GAChE,GAAIO,EAAQ,KACR,MAAM,IAAI/L,MAAM,kDACpB,IAAIgM,EACJ,MAAMC,EAAI9K,OAAO+K,OAAO,CACpBlF,QACAsE,OACAQ,OACAC,QACAI,KAAMtI,EAAQiI,GACdtD,KAAMhH,EACNgG,IAAK/F,EACLiK,iBACA5L,OAASqC,GAAQyD,EAAIzD,EAAK6E,GAC1BoF,QAAUjK,IACN,GAAmB,iBAARA,EACP,MAAM,IAAInC,MAAM,sDAAwDmC,GAC5E,OAAOX,GAAOW,GAAOA,EAAM6E,GAE/BmB,IAAMhG,GAAQA,IAAQX,EAEtB6K,YAAclK,IAAS8J,EAAE9D,IAAIhG,IAAQ8J,EAAEG,QAAQjK,GAC/CmK,MAAQnK,IAASA,EAAMV,KAASA,EAChCsH,IAAM5G,GAAQyD,GAAKzD,EAAK6E,GACxBJ,IAAK,CAAC2F,EAAKC,IAAQD,IAAQC,EAC3B3F,IAAM1E,GAAQyD,EAAIzD,EAAMA,EAAK6E,GAC7ByF,IAAK,CAACF,EAAKC,IAAQ5G,EAAI2G,EAAMC,EAAKxF,GAClCO,IAAK,CAACgF,EAAKC,IAAQ5G,EAAI2G,EAAMC,EAAKxF,GAClCK,IAAK,CAACkF,EAAKC,IAAQ5G,EAAI2G,EAAMC,EAAKxF,GAClCC,IAAK,CAAC9E,EAAK+D,IA7JZ,SAAeQ,EAAIvE,EAAK+D,GAC3B,GAAIA,EAAQ1E,EACR,MAAM,IAAIxB,MAAM,2CACpB,GAAIkG,IAAU1E,EACV,OAAOkF,EAAGc,IACd,GAAItB,IAAUzE,EACV,OAAOU,EACX,IAAIuK,EAAIhG,EAAGc,IACPmF,EAAIxK,EACR,KAAO+D,EAAQ1E,GACP0E,EAAQzE,IACRiL,EAAIhG,EAAGW,IAAIqF,EAAGC,IAClBA,EAAIjG,EAAGG,IAAI8F,GACXzG,IAAUzE,EAEd,OAAOiL,CACX,CA6I6BE,CAAMX,EAAG9J,EAAK+D,GACnC2G,IAAK,CAACN,EAAKC,IAAQ5G,EAAI2G,EAAMnG,EAAOoG,EAAKxF,GAAQA,GAEjD8F,KAAO3K,GAAQA,EAAMA,EACrB4K,KAAM,CAACR,EAAKC,IAAQD,EAAMC,EAC1BQ,KAAM,CAACT,EAAKC,IAAQD,EAAMC,EAC1BS,KAAM,CAACV,EAAKC,IAAQD,EAAMC,EAC1BjC,IAAMpI,GAAQiE,EAAOjE,EAAK6E,GAC1B4E,KAAMH,GAAA,CACA1I,IACOiJ,IACDA,EAAQrD,EAAO3B,IACZgF,EAAMC,EAAGlJ,KAExBnD,QAAUuC,GAASmJ,EAAOpI,EAAgBf,EAAK4J,GAASjJ,EAAgBX,EAAK4J,GAC7EmB,UAAW,CAACpL,EAAOqL,GAAiB,KAChC,GAAIzB,EAAgB,CAChB,IAAKA,EAAe0B,SAAStL,EAAMxB,SAAWwB,EAAMxB,OAASyL,EACzD,MAAM,IAAI/L,MAAM,6BAA+B0L,EAAiB,eAAiB5J,EAAMxB,QAE3F,MAAM+M,EAAS,IAAIjN,WAAW2L,GAE9BsB,EAAOhN,IAAIyB,EAAOwJ,EAAO,EAAI+B,EAAO/M,OAASwB,EAAMxB,QACnDwB,EAAQuL,CACZ,CACA,GAAIvL,EAAMxB,SAAWyL,EACjB,MAAM,IAAI/L,MAAM,6BAA+B+L,EAAQ,eAAiBjK,EAAMxB,QAClF,IAAIgN,EAAShC,EAAO5I,EAAgBZ,GAASU,EAAgBV,GAG7D,GAFI6J,IACA2B,EAAS1H,EAAI0H,EAAQtG,KACpBmG,IACIlB,EAAEG,QAAQkB,GACX,MAAM,IAAItN,MAAM,oDAGxB,OAAOsN,GAGXC,YAAcC,GAAQ3D,EAAcoC,EAAGuB,GAGvC/D,KAAM,CAAC5D,EAAGC,EAAGuC,IAAOA,EAAIvC,EAAID,IAEhC,OAAO1E,OAAO+K,OAAOD,EACzB,CA+CO,SAASwB,EAAoBC,GAChC,GAA0B,iBAAfA,EACP,MAAM,IAAI1N,MAAM,8BACpB,MAAM2N,EAAYD,EAAWrL,SAAS,GAAG/B,OACzC,OAAO6K,KAAKC,KAAKuC,EAAY,EACjC,CAQO,SAASC,EAAiBF,GAC7B,MAAMpN,EAASmN,EAAoBC,GACnC,OAAOpN,EAAS6K,KAAKC,KAAK9K,EAAS,EACvC;;AC/eA,MAAMkB,EAAMe,OAAO,GACbd,EAAMc,OAAO,GACZ,SAASsL,EAASC,EAAWC,GAChC,MAAMhF,EAAMgF,EAAKC,SACjB,OAAOF,EAAY/E,EAAMgF,CAC7B,CAOO,SAASE,EAAW5F,EAAG6F,GAC1B,MAAMC,EAAatE,EAAcxB,EAAE3B,GAAIwH,EAAOpJ,IAAK4H,GAAMA,EAAE7E,IAC3D,OAAOqG,EAAOpJ,IAAI,CAAC4H,EAAGlM,IAAM6H,EAAE+F,WAAW1B,EAAE2B,SAASF,EAAW3N,KACnE,CACA,SAAS8N,EAAUC,EAAGC,GAClB,IAAKC,OAAOC,cAAcH,IAAMA,GAAK,GAAKA,EAAIC,EAC1C,MAAM,IAAIxO,MAAM,qCAAuCwO,EAAO,YAAcD,EACpF,CACA,SAASI,EAAUJ,EAAGK,GAClBN,EAAUC,EAAGK,GACb,MAEMC,EAAY,GAAKN,EAGvB,MAAO,CAAEO,QALO3D,KAAKC,KAAKwD,EAAaL,GAAK,EAK1BQ,WAJC,IAAMR,EAAI,GAICS,KAFjBnL,EAAQ0K,GAEeM,YAAWI,QAD/B1M,OAAOgM,GAE3B,CACA,SAASW,EAAYnM,EAAGoM,EAAQC,GAC5B,MAAML,WAAEA,EAAAC,KAAYA,EAAAH,UAAMA,EAAAI,QAAWA,GAAYG,EACjD,IAAIC,EAAQZ,OAAO1L,EAAIiM,GACnBM,EAAQvM,GAAKkM,EAMbI,EAAQN,IAERM,GAASR,EACTS,GAAS7N,GAEb,MAAM8N,EAAcJ,EAASJ,EAM7B,MAAO,CAAEO,QAAOE,OALDD,EAAcpE,KAAKsE,IAAIJ,GAAS,EAKvBK,OAJC,IAAVL,EAIiBM,MAHlBN,EAAQ,EAGiBO,OAFxBT,EAAS,GAAM,EAEiBU,QAD/BN,EAEpB,CAoBA,MAAMO,MAAuB/K,QACvBgL,MAAuBhL,QAC7B,SAASiL,GAAKtI,GAGV,OAAOqI,EAAiB7K,IAAIwC,IAAM,CACtC,CACA,SAASuI,GAAQlN,GACb,GAAIA,IAAMvB,EACN,MAAM,IAAIxB,MAAM,eACxB,CAmBO,MAAMkQ,GAET,WAAA/Q,CAAYgR,EAAO3B,GACfjP,KAAK6Q,KAAOD,EAAMC,KAClB7Q,KAAKiJ,KAAO2H,EAAM3H,KAClBjJ,KAAK8Q,GAAKF,EAAME,GAChB9Q,KAAKiP,KAAOA,CAChB,CAEA,aAAA8B,CAAcC,EAAKxN,EAAG2J,EAAInN,KAAKiJ,MAC3B,IAAImE,EAAI4D,EACR,KAAOxN,EAAIvB,GACHuB,EAAItB,IACJiL,EAAIA,EAAED,IAAIE,IACdA,EAAIA,EAAE6D,SACNzN,IAAMtB,EAEV,OAAOiL,CACX,CAaA,gBAAA+D,CAAiBC,EAAOnC,GACpB,MAAMO,QAAEA,EAAAC,WAASA,GAAeJ,EAAUJ,EAAGhP,KAAKiP,MAC5CN,EAAS,GACf,IAAIxB,EAAIgE,EACJC,EAAOjE,EACX,IAAA,IAASyC,EAAS,EAAGA,EAASL,EAASK,IAAU,CAC7CwB,EAAOjE,EACPwB,EAAO0C,KAAKD,GAEZ,IAAA,IAASnQ,EAAI,EAAGA,EAAIuO,EAAYvO,IAC5BmQ,EAAOA,EAAKlE,IAAIC,GAChBwB,EAAO0C,KAAKD,GAEhBjE,EAAIiE,EAAKH,QACb,CACA,OAAOtC,CACX,CAOA,IAAAgC,CAAK3B,EAAGsC,EAAa9N,GAEjB,IAAKxD,KAAK8Q,GAAGjE,QAAQrJ,GACjB,MAAM,IAAI/C,MAAM,kBAEpB,IAAI0M,EAAInN,KAAKiJ,KACTyD,EAAI1M,KAAK6Q,KAMb,MAAMU,EAAKnC,EAAUJ,EAAGhP,KAAKiP,MAC7B,IAAA,IAASW,EAAS,EAAGA,EAAS2B,EAAGhC,QAASK,IAAU,CAEhD,MAAMG,MAAEA,EAAAE,OAAOA,EAAAE,OAAQA,EAAAC,MAAQA,EAAAC,OAAOA,EAAAC,QAAQA,GAAYX,EAAYnM,EAAGoM,EAAQ2B,GACjF/N,EAAIuM,EACAI,EAGAzD,EAAIA,EAAEQ,IAAIoB,EAAS+B,EAAQiB,EAAYhB,KAIvCnD,EAAIA,EAAED,IAAIoB,EAAS8B,EAAOkB,EAAYrB,IAE9C,CAKA,OAJAS,GAAQlN,GAID,CAAE2J,IAAGT,IAChB,CAMA,UAAA8E,CAAWxC,EAAGsC,EAAa9N,EAAGsH,EAAM9K,KAAKiJ,MACrC,MAAMsI,EAAKnC,EAAUJ,EAAGhP,KAAKiP,MAC7B,IAAA,IAASW,EAAS,EAAGA,EAAS2B,EAAGhC,SACzB/L,IAAMvB,EAD4B2N,IAAU,CAGhD,MAAMG,MAAEA,SAAOE,EAAAE,OAAQA,EAAAC,MAAQA,GAAUT,EAAYnM,EAAGoM,EAAQ2B,GAEhE,GADA/N,EAAIuM,GACAI,EAKC,CACD,MAAM3B,EAAO8C,EAAYrB,GACzBnF,EAAMA,EAAIoC,IAAIkD,EAAQ5B,EAAKC,SAAWD,EAC1C,CACJ,CAEA,OADAkC,GAAQlN,GACDsH,CACX,CACA,cAAA2G,CAAezC,EAAGmC,EAAOO,GAErB,IAAIC,EAAOpB,EAAiB5K,IAAIwL,GAUhC,OATKQ,IACDA,EAAO3R,KAAKkR,iBAAiBC,EAAOnC,GAC1B,IAANA,IAEyB,mBAAd0C,IACPC,EAAOD,EAAUC,IACrBpB,EAAiBzP,IAAIqQ,EAAOQ,KAG7BA,CACX,CACA,MAAAC,CAAOT,EAAOpD,EAAQ2D,GAClB,MAAM1C,EAAIyB,GAAKU,GACf,OAAOnR,KAAK2Q,KAAK3B,EAAGhP,KAAKyR,eAAezC,EAAGmC,EAAOO,GAAY3D,EAClE,CACA,MAAA8D,CAAOV,EAAOpD,EAAQ2D,EAAWI,GAC7B,MAAM9C,EAAIyB,GAAKU,GACf,OAAU,IAANnC,EACOhP,KAAK+Q,cAAcI,EAAOpD,EAAQ+D,GACtC9R,KAAKwR,WAAWxC,EAAGhP,KAAKyR,eAAezC,EAAGmC,EAAOO,GAAY3D,EAAQ+D,EAChF,CAIA,WAAAC,CAAY5J,EAAG6G,GACXD,EAAUC,EAAGhP,KAAKiP,MAClBuB,EAAiB1P,IAAIqH,EAAG6G,GACxBuB,EAAiByB,OAAO7J,EAC5B,CACA,QAAA8J,CAASjB,GACL,OAAqB,IAAdP,GAAKO,EAChB,EA+BG,SAASkB,GAAUpJ,EAAGqJ,EAAQxD,EAAQyD,IAjO7C,SAA2BzD,EAAQ7F,GAC/B,IAAK4B,MAAM2H,QAAQ1D,GACf,MAAM,IAAIlO,MAAM,kBACpBkO,EAAOzJ,QAAQ,CAACiI,EAAGlM,KACf,KAAMkM,aAAarE,GACf,MAAM,IAAIrI,MAAM,0BAA4BQ,IAExD,CAiOIqR,CAAkB3D,EAAQ7F,GAhO9B,SAA4BsJ,EAASG,GACjC,IAAK7H,MAAM2H,QAAQD,GACf,MAAM,IAAI3R,MAAM,6BACpB2R,EAAQlN,QAAQ,CAACsN,EAAGvR,KAChB,IAAKsR,EAAM1F,QAAQ2F,GACf,MAAM,IAAI/R,MAAM,2BAA6BQ,IAEzD,CA0NIwR,CAAmBL,EAASD,GAC5B,MAAMO,EAAU/D,EAAO5N,OACjB4R,EAAUP,EAAQrR,OACxB,GAAI2R,IAAYC,EACZ,MAAM,IAAIlS,MAAM,uDAEpB,MAAM4K,EAAOvC,EAAEG,KACT6G,EAAQzL,EAAOrB,OAAO0P,IAC5B,IAAIlD,EAAa,EACbM,EAAQ,GACRN,EAAaM,EAAQ,EAChBA,EAAQ,EACbN,EAAaM,EAAQ,EAChBA,EAAQ,IACbN,EAAa,GACjB,MAAM5C,EAAOtI,EAAQkL,GACfoD,EAAU,IAAIlI,MAAMwE,OAAOtC,GAAQ,GAAGjC,KAAKU,GAEjD,IAAIwH,EAAMxH,EACV,IAAA,IAASpK,EAFQ2K,KAAKkH,OAAOX,EAAO5F,KAAO,GAAKiD,GAAcA,EAEvCvO,GAAK,EAAGA,GAAKuO,EAAY,CAC5CoD,EAAQjI,KAAKU,GACb,IAAA,IAAS0H,EAAI,EAAGA,EAAIJ,EAASI,IAAK,CAC9B,MAAMhF,EAASqE,EAAQW,GACjBjD,EAAQZ,OAAQnB,GAAU/K,OAAO/B,GAAM2L,GAC7CgG,EAAQ9C,GAAS8C,EAAQ9C,GAAO5C,IAAIyB,EAAOoE,GAC/C,CACA,IAAIC,EAAO3H,EAEX,IAAA,IAAS0H,EAAIH,EAAQ7R,OAAS,EAAGkS,EAAO5H,EAAM0H,EAAI,EAAGA,IACjDE,EAAOA,EAAK/F,IAAI0F,EAAQG,IACxBC,EAAOA,EAAK9F,IAAI+F,GAGpB,GADAJ,EAAMA,EAAI3F,IAAI8F,GACJ,IAAN/R,EACA,IAAA,IAAS8R,EAAI,EAAGA,EAAIvD,EAAYuD,IAC5BF,EAAMA,EAAI5B,QACtB,CACA,OAAO4B,CACX,CAoGA,SAASK,GAAYC,EAAOZ,EAAOxG,GAC/B,GAAIwG,EAAO,CACP,GAAIA,EAAM9K,QAAU0L,EAChB,MAAM,IAAI1S,MAAM,kDAEpB,OD1ND,SAAuB8R,GAW1BhO,EAAgBgO,EAJHlI,EAAaQ,OAAO,CAACtF,EAAKR,KACnCQ,EAAIR,GAAO,WACJQ,GARK,CACZkC,MAAO,SACPmF,KAAM,SACNJ,MAAO,SACPD,KAAM,WAWd,CCyMQ6G,CAAcb,GACPA,CACX,CAEI,OAAO/J,EAAM2K,EAAO,CAAEpH,QAE9B;;ACvZA,MAAMsH,GAAa,CAACzQ,EAAK0Q,KAAS1Q,GAAOA,GAAO,EAAI0Q,GAAOA,GAAOzN,IAAOyN,EA6BzE,SAASC,GAAkBC,GACvB,IAAK,CAAC,UAAW,YAAa,OAAO3F,SAAS2F,GAC1C,MAAM,IAAI/S,MAAM,6DACpB,OAAO+S,CACX,CACA,SAASC,GAAgBzH,EAAM0H,GAC3B,MAAMC,EAAQ,CAAA,EACd,IAAA,IAASC,KAAWhS,OAAOiS,KAAKH,GAE5BC,EAAMC,QAA6B,IAAlB5H,EAAK4H,GAAyBF,EAAIE,GAAW5H,EAAK4H,GAMvE,OAJAE,EAAMH,EAAMI,KAAM,QAClBD,EAAMH,EAAMK,QAAS,gBACA,IAAjBL,EAAMH,QACND,GAAkBI,EAAMH,QACrBG,CACX,CACO,MAAMM,WAAexT,MACxB,WAAAb,CAAYqH,EAAI,IACZlH,MAAMkH,EACV,EASG,MAAMiN,GAAM,CAEfC,IAAKF,GAELG,KAAM,CACFC,OAAQ,CAACC,EAAKC,KACV,MAAQJ,IAAKK,GAAMN,GACnB,GAAII,EAAM,GAAKA,EAAM,IACjB,MAAM,IAAIE,EAAE,yBAChB,GAAkB,EAAdD,EAAKxT,OACL,MAAM,IAAIyT,EAAE,6BAChB,MAAMC,EAAUF,EAAKxT,OAAS,EACxB0B,EAAME,EAAoB8R,GAChC,GAAKhS,EAAI1B,OAAS,EAAK,IACnB,MAAM,IAAIyT,EAAE,wCAEhB,MAAME,EAASD,EAAU,IAAM9R,EAAqBF,EAAI1B,OAAS,EAAK,KAAO,GAE7E,OADU4B,EAAoB2R,GACnBI,EAASjS,EAAM8R,GAG9B,MAAAI,CAAOL,EAAKC,GACR,MAAQJ,IAAKK,GAAMN,GACnB,IAAIU,EAAM,EACV,GAAIN,EAAM,GAAKA,EAAM,IACjB,MAAM,IAAIE,EAAE,yBAChB,GAAID,EAAKxT,OAAS,GAAKwT,EAAKK,OAAWN,EACnC,MAAM,IAAIE,EAAE,yBAChB,MAAMK,EAAQN,EAAKK,KAEnB,IAAI7T,EAAS,EACb,MAF0B,IAAR8T,GAIb,CAED,MAAMH,EAAiB,IAARG,EACf,IAAKH,EACD,MAAM,IAAIF,EAAE,qDAChB,GAAIE,EAAS,EACT,MAAM,IAAIF,EAAE,4CAChB,MAAMM,EAAcP,EAAKQ,SAASH,EAAKA,EAAMF,GAC7C,GAAII,EAAY/T,SAAW2T,EACvB,MAAM,IAAIF,EAAE,yCAChB,GAAuB,IAAnBM,EAAY,GACZ,MAAM,IAAIN,EAAE,wCAChB,IAAA,MAAWjO,KAAKuO,EACZ/T,EAAUA,GAAU,EAAKwF,EAE7B,GADAqO,GAAOF,EACH3T,EAAS,IACT,MAAM,IAAIyT,EAAE,yCACpB,MAlBIzT,EAAS8T,EAmBb,MAAMzP,EAAImP,EAAKQ,SAASH,EAAKA,EAAM7T,GACnC,GAAIqE,EAAErE,SAAWA,EACb,MAAM,IAAIyT,EAAE,kCAChB,MAAO,CAAEpP,IAAG4P,EAAGT,EAAKQ,SAASH,EAAM7T,GACvC,GAMJkU,KAAM,CACF,MAAAZ,CAAOzR,GACH,MAAQuR,IAAKK,GAAMN,GACnB,GAAItR,EAAMX,GACN,MAAM,IAAIuS,EAAE,8CAChB,IAAI3R,EAAMF,EAAoBC,GAI9B,GAFkC,EAA9BsM,OAAOgG,SAASrS,EAAI,GAAI,MACxBA,EAAM,KAAOA,GACA,EAAbA,EAAI9B,OACJ,MAAM,IAAIyT,EAAE,kDAChB,OAAO3R,CACX,EACA,MAAA8R,CAAOJ,GACH,MAAQJ,IAAKK,GAAMN,GACnB,GAAc,IAAVK,EAAK,GACL,MAAM,IAAIC,EAAE,uCAChB,GAAgB,IAAZD,EAAK,MAA2B,IAAVA,EAAK,IAC3B,MAAM,IAAIC,EAAE,uDAChB,OAAOvR,EAAgBsR,EAC3B,GAEJ,KAAAY,CAAMtS,GAEF,MAAQsR,IAAKK,EAAGS,KAAMG,EAAKhB,KAAMiB,GAAQnB,GACnCK,EAAO3Q,EAAY,YAAaf,IAC9BuC,EAAGkQ,EAAUN,EAAGO,GAAiBF,EAAIV,OAAO,GAAMJ,GAC1D,GAAIgB,EAAaxU,OACb,MAAM,IAAIyT,EAAE,+CAChB,MAAQpP,EAAGoQ,EAAQR,EAAGS,GAAeJ,EAAIV,OAAO,EAAMW,IAC9ClQ,EAAGsQ,EAAQV,EAAGW,GAAeN,EAAIV,OAAO,EAAMc,GACtD,GAAIE,EAAW5U,OACX,MAAM,IAAIyT,EAAE,+CAChB,MAAO,CAAExN,EAAGoO,EAAIT,OAAOa,GAAShD,EAAG4C,EAAIT,OAAOe,GAClD,EACA,UAAAE,CAAWC,GACP,MAAQzB,KAAMiB,EAAKJ,KAAMG,GAAQlB,GAG3B4B,EAFKT,EAAIhB,OAAO,EAAMe,EAAIf,OAAOwB,EAAI7O,IAChCqO,EAAIhB,OAAO,EAAMe,EAAIf,OAAOwB,EAAIrD,IAE3C,OAAO6C,EAAIhB,OAAO,GAAMyB,EAC5B,GAIE7T,GAAMe,OAAO,GAAId,GAAMc,OAAO,GAAI6C,GAAM7C,OAAO,GAAI8C,GAAM9C,OAAO,GAAI+C,GAAM/C,OAAO,GAChF,SAAS+S,GAAejF,EAAI1Q,GAC/B,MAAQoM,MAAOwJ,GAAalF,EAC5B,IAAIlO,EACJ,GAAmB,iBAARxC,EACPwC,EAAMxC,MAEL,CACD,IAAImC,EAAQqB,EAAY,cAAexD,GACvC,IACIwC,EAAMkO,EAAGnD,UAAUpL,EACvB,OACO0T,GACH,MAAM,IAAIxV,MAAM,8CAA8CuV,iBAAwB5V,IAC1F,CACJ,CACA,IAAK0Q,EAAGhE,YAAYlK,GAChB,MAAM,IAAInC,MAAM,8CACpB,OAAOmC,CACX,CAkBO,SAASsT,GAAaC,EAAQC,EAAY,IAC7C,MAAMC,ED+MH,SAA4BC,EAAMC,EAAOC,EAAY,CAAA,EAAIC,GAG5D,QAFe,IAAXA,IACAA,EAAkB,YAATH,IACRC,GAA0B,iBAAVA,EACjB,MAAM,IAAI9V,MAAM,kBAAkB6V,kBACtC,IAAA,MAAWnJ,IAAK,CAAC,IAAK,IAAK,KAAM,CAC7B,MAAMpI,EAAMwR,EAAMpJ,GAClB,KAAqB,iBAARpI,GAAoBA,EAAM9C,GACnC,MAAM,IAAIxB,MAAM,SAAS0M,4BACjC,CACA,MAAMhG,EAAK+L,GAAYqD,EAAMpJ,EAAGqJ,EAAUrP,GAAIsP,GACxC3F,EAAKoC,GAAYqD,EAAM/S,EAAGgT,EAAU1F,GAAI2F,GAExCN,EAAS,CAAC,KAAM,KAAM,IADQ,KAEpC,IAAA,MAAWhJ,KAAKgJ,EAEZ,IAAKhP,EAAG0F,QAAQ0J,EAAMpJ,IAClB,MAAM,IAAI1M,MAAM,SAAS0M,6CAGjC,MAAO,CAAEoJ,MADTA,EAAQ3U,OAAO+K,OAAO/K,OAAO8U,OAAO,CAAA,EAAIH,IACxBpP,KAAI2J,KACxB,CCpOsB6F,CAAmB,cAAeR,EAAQC,IACtDjP,GAAEA,EAAA2J,GAAIA,GAAOuF,EACnB,IAAIE,EAAQF,EAAUE,MACtB,MAAQK,EAAGC,EAAUrT,EAAGsT,GAAgBP,EACxChS,EAAgB6R,EAAW,GAAI,CAC3BW,mBAAoB,UACpBC,cAAe,WACfC,cAAe,WACftJ,UAAW,WACXtN,QAAS,WACT6W,KAAM,SACNC,eAAgB,YAEpB,MAAMD,KAAEA,GAASd,EACjB,GAAIc,KAEK/P,EAAGyB,IAAI2N,EAAMjQ,IAA2B,iBAAd4Q,EAAKE,OAAsB1M,MAAM2H,QAAQ6E,EAAKG,UACzE,MAAM,IAAI5W,MAAM,8DAGxB,MAAM6W,EAAUC,GAAYpQ,EAAI2J,GAChC,SAAS0G,IACL,IAAKrQ,EAAG4F,MACJ,MAAM,IAAItM,MAAM,6DACxB,CAuDA,MAAMgX,EAAcrB,EAAU/V,SArD9B,SAAsBqX,EAAIvG,EAAOwG,GAC7B,MAAMjR,EAAEA,EAAAkR,EAAGA,GAAMzG,EAAMrC,WACjB+I,EAAK1Q,EAAG9G,QAAQqG,GAEtB,GADAoN,EAAM6D,EAAc,gBAChBA,EAAc,CACdH,IACA,MAAMM,GAAY3Q,EAAG4F,MAAM6K,GAC3B,OAAOG,cAAYC,GAAQF,GAAWD,EAC1C,CAEI,OAAOE,EAAAA,YAAYlX,WAAWoX,GAAG,GAAOJ,EAAI1Q,EAAG9G,QAAQuX,GAE/D,EA0CMM,EAAc9B,EAAUzI,WAzC9B,SAAwBpL,GACpBf,EAAOe,OAAO,EAAW,SACzB,MAAQ4V,UAAWxG,EAAMyG,sBAAuBC,GAAWf,EACrDvW,EAASwB,EAAMxB,OACfuX,EAAO/V,EAAM,GACbgW,EAAOhW,EAAMwS,SAAS,GAE5B,GAAIhU,IAAW4Q,GAAkB,IAAT2G,GAA0B,IAATA,EAmBzC,IACSvX,IAAWsX,GAAmB,IAATC,EAAe,CAEzC,MAAME,EAAIrR,EAAGqF,MACP9F,EAAIS,EAAGwG,UAAU4K,EAAKxD,SAAS,EAAGyD,IAClCZ,EAAIzQ,EAAGwG,UAAU4K,EAAKxD,SAASyD,EAAO,EAAJA,IACxC,IAAKC,EAAU/R,EAAGkR,GACd,MAAM,IAAInX,MAAM,8BACpB,MAAO,CAAEiG,IAAGkR,IAChB,CAEI,MAAM,IAAInX,MAAM,yBAAyBM,0BAA+B4Q,qBAAwB0G,IACpG,CA/ByD,CACrD,MAAM3R,EAAIS,EAAGwG,UAAU4K,GACvB,IAAKpR,EAAG0F,QAAQnG,GACZ,MAAM,IAAIjG,MAAM,uCACpB,MAAMiY,EAAKC,EAAoBjS,GAC/B,IAAIkR,EACJ,IACIA,EAAIzQ,EAAGkF,KAAKqM,EAChB,OACOE,GACH,MAAMC,EAAMD,aAAqBnY,MAAQ,KAAOmY,EAAU5W,QAAU,GACpE,MAAM,IAAIvB,MAAM,yCAA2CoY,EAC/D,CACArB,IAKA,QAHiC,GAAdc,KADJnR,EAAG4F,MAAM6K,KAGpBA,EAAIzQ,EAAGqC,IAAIoO,IACR,CAAElR,IAAGkR,IAChB,CAaJ,EAGA,SAASe,EAAoBjS,GACzB,MAAMoS,EAAK3R,EAAGG,IAAIZ,GACZqS,EAAK5R,EAAGW,IAAIgR,EAAIpS,GACtB,OAAOS,EAAG+F,IAAI/F,EAAG+F,IAAI6L,EAAI5R,EAAGW,IAAIpB,EAAG6P,EAAMjQ,IAAKiQ,EAAMhQ,EACxD,CAGA,SAASkS,EAAU/R,EAAGkR,GAClB,MAAMoB,EAAO7R,EAAGG,IAAIsQ,GACdqB,EAAQN,EAAoBjS,GAClC,OAAOS,EAAGE,IAAI2R,EAAMC,EACxB,CAGA,IAAKR,EAAUlC,EAAM2C,GAAI3C,EAAM4C,IAC3B,MAAM,IAAI1Y,MAAM,qCAGpB,MAAM2Y,EAAOjS,EAAGW,IAAIX,EAAGO,IAAI6O,EAAMjQ,EAAGR,IAAMC,IACpCsT,EAAQlS,EAAGW,IAAIX,EAAGG,IAAIiP,EAAMhQ,GAAIvD,OAAO,KAC7C,GAAImE,EAAGyB,IAAIzB,EAAG+F,IAAIkM,EAAMC,IACpB,MAAM,IAAI5Y,MAAM,4BAEpB,SAAS6Y,EAAOjX,EAAOmB,EAAG+V,GAAU,GAChC,IAAKpS,EAAG0F,QAAQrJ,IAAO+V,GAAWpS,EAAGyB,IAAIpF,GACrC,MAAM,IAAI/C,MAAM,wBAAwB4B,KAC5C,OAAOmB,CACX,CACA,SAASgW,EAAUC,GACf,KAAMA,aAAiB7I,GACnB,MAAM,IAAInQ,MAAM,2BACxB,CACA,SAASiZ,EAAiBvU,GACtB,IAAK+R,IAASA,EAAKG,QACf,MAAM,IAAI5W,MAAM,WACpB,OA1TD,SAA0B0E,EAAGwU,EAAOnW,GAIvC,OAAQoW,EAAIC,IAAMC,EAAIC,IAAOJ,EACvBpQ,EAAK8J,GAAW0G,EAAK5U,EAAG3B,GACxBiG,EAAK4J,IAAYwG,EAAK1U,EAAG3B,GAG/B,IAAIwW,EAAK7U,EAAIoE,EAAKqQ,EAAKnQ,EAAKqQ,EACxBG,GAAM1Q,EAAKsQ,EAAKpQ,EAAKsQ,EACzB,MAAMG,EAAQF,EAAK/X,GACbkY,EAAQF,EAAKhY,GACfiY,IACAF,GAAMA,GACNG,IACAF,GAAMA,GAGV,MAAMG,EAAU9V,EAAQsH,KAAKC,KAAKxH,EAAOb,GAAK,IAAMtB,GACpD,GAAI8X,EAAK/X,IAAO+X,GAAMI,GAAWH,EAAKhY,IAAOgY,GAAMG,EAC/C,MAAM,IAAI3Z,MAAM,yCAA2C0E,GAE/D,MAAO,CAAE+U,QAAOF,KAAIG,QAAOF,KAC/B,CAkSeI,CAAiBlV,EAAG+R,EAAKG,QAASvG,EAAGrJ,MAChD,CAKA,MAAM6S,EAAejV,EAAS,CAAC8H,EAAGoN,KAC9B,MAAMC,EAAEA,EAAAC,EAAGA,EAAAnS,EAAGA,GAAM6E,EAEpB,GAAIhG,EAAGE,IAAIiB,EAAGnB,EAAGc,KACb,MAAO,CAAEvB,EAAG8T,EAAG5C,EAAG6C,GACtB,MAAM7R,EAAMuE,EAAEvE,MAGJ,MAAN2R,IACAA,EAAK3R,EAAMzB,EAAGc,IAAMd,EAAG6D,IAAI1C,IAC/B,MAAM5B,EAAIS,EAAGW,IAAI0S,EAAGD,GACd3C,EAAIzQ,EAAGW,IAAI2S,EAAGF,GACdG,EAAKvT,EAAGW,IAAIQ,EAAGiS,GACrB,GAAI3R,EACA,MAAO,CAAElC,EAAGS,EAAG8B,KAAM2O,EAAGzQ,EAAG8B,MAC/B,IAAK9B,EAAGE,IAAIqT,EAAIvT,EAAGc,KACf,MAAM,IAAIxH,MAAM,oBACpB,MAAO,CAAEiG,IAAGkR,OAIV+C,EAAkBtV,EAAU8H,IAC9B,GAAIA,EAAEvE,MAAO,CAIT,GAAIwN,EAAUW,qBAAuB5P,EAAGyB,IAAIuE,EAAEsN,GAC1C,OACJ,MAAM,IAAIha,MAAM,kBACpB,CAEA,MAAMiG,EAAEA,EAAAkR,EAAGA,GAAMzK,EAAE2B,WACnB,IAAK3H,EAAG0F,QAAQnG,KAAOS,EAAG0F,QAAQ+K,GAC9B,MAAM,IAAInX,MAAM,wCACpB,IAAKgY,EAAU/R,EAAGkR,GACd,MAAM,IAAInX,MAAM,qCACpB,IAAK0M,EAAE8J,gBACH,MAAM,IAAIxW,MAAM,0CACpB,OAAO,IAEX,SAASma,EAAWC,EAAUC,EAAKC,EAAKb,EAAOC,GAI3C,OAHAY,EAAM,IAAInK,EAAMzJ,EAAGW,IAAIiT,EAAIP,EAAGK,GAAWE,EAAIN,EAAGM,EAAIzS,GACpDwS,EAAMxM,EAAS4L,EAAOY,GACtBC,EAAMzM,EAAS6L,EAAOY,GACfD,EAAI5N,IAAI6N,EACnB,CAMA,MAAMnK,EAEF,WAAAhR,CAAY4a,EAAGC,EAAGnS,GACdtI,KAAKwa,EAAIlB,EAAO,IAAKkB,GACrBxa,KAAKya,EAAInB,EAAO,IAAKmB,GAAG,GACxBza,KAAKsI,EAAIgR,EAAO,IAAKhR,GACrB1G,OAAO+K,OAAO3M,KAClB,CACA,YAAOuW,GACH,OAAOA,CACX,CAEA,iBAAO1H,CAAW1B,GACd,MAAMzG,EAAEA,EAAAkR,EAAGA,GAAMzK,GAAK,CAAA,EACtB,IAAKA,IAAMhG,EAAG0F,QAAQnG,KAAOS,EAAG0F,QAAQ+K,GACpC,MAAM,IAAInX,MAAM,wBACpB,GAAI0M,aAAayD,EACb,MAAM,IAAInQ,MAAM,gCAEpB,OAAI0G,EAAGyB,IAAIlC,IAAMS,EAAGyB,IAAIgP,GACbhH,EAAM3H,KACV,IAAI2H,EAAMlK,EAAGkR,EAAGzQ,EAAGc,IAC9B,CACA,gBAAO0F,CAAUpL,GACb,MAAM4F,EAAIyI,EAAM/B,WAAWqJ,EAAY1W,EAAOe,OAAO,EAAW,WAEhE,OADA4F,EAAE6S,iBACK7S,CACX,CACA,cAAO8S,CAAQpY,GACX,OAAO+N,EAAMjD,UAAU/J,EAAY,WAAYf,GACnD,CACA,KAAI6D,GACA,OAAO1G,KAAK8O,WAAWpI,CAC3B,CACA,KAAIkR,GACA,OAAO5X,KAAK8O,WAAW8I,CAC3B,CAOA,UAAAsD,CAAW1L,EAAa,EAAG2L,GAAS,GAIhC,OAHAC,EAAKrJ,YAAY/R,KAAMwP,GAClB2L,GACDnb,KAAKqb,SAASvV,IACX9F,IACX,CAGA,cAAAgb,GACIL,EAAgB3a,KACpB,CACA,QAAA8X,GACI,MAAMF,EAAEA,GAAM5X,KAAK8O,WACnB,IAAK3H,EAAG4F,MACJ,MAAM,IAAItM,MAAM,+BACpB,OAAQ0G,EAAG4F,MAAM6K,EACrB,CAEA,MAAA0D,CAAO7B,GACHD,EAAUC,GACV,MAAQe,EAAGe,EAAId,EAAGe,EAAIlT,EAAGmT,GAAOzb,MACxBwa,EAAGkB,EAAIjB,EAAGkB,EAAIrT,EAAGsT,GAAOnC,EAC1BoC,EAAK1U,EAAGE,IAAIF,EAAGW,IAAIyT,EAAIK,GAAKzU,EAAGW,IAAI4T,EAAID,IACvCK,EAAK3U,EAAGE,IAAIF,EAAGW,IAAI0T,EAAII,GAAKzU,EAAGW,IAAI6T,EAAIF,IAC7C,OAAOI,GAAMC,CACjB,CAEA,MAAArN,GACI,OAAO,IAAImC,EAAM5Q,KAAKwa,EAAGrT,EAAGqC,IAAIxJ,KAAKya,GAAIza,KAAKsI,EAClD,CAKA,MAAA2I,GACI,MAAM3K,EAAEA,EAAAC,EAAGA,GAAMgQ,EACXwF,EAAK5U,EAAGW,IAAIvB,EAAGT,KACb0U,EAAGe,EAAId,EAAGe,EAAIlT,EAAGmT,GAAOzb,KAChC,IAAIgc,EAAK7U,EAAG8B,KAAMgT,EAAK9U,EAAG8B,KAAMiT,EAAK/U,EAAG8B,KACpCkT,EAAKhV,EAAGW,IAAIyT,EAAIA,GAChBa,EAAKjV,EAAGW,IAAI0T,EAAIA,GAChBa,EAAKlV,EAAGW,IAAI2T,EAAIA,GAChBa,EAAKnV,EAAGW,IAAIyT,EAAIC,GA4BpB,OA3BAc,EAAKnV,EAAG+F,IAAIoP,EAAIA,GAChBJ,EAAK/U,EAAGW,IAAIyT,EAAIE,GAChBS,EAAK/U,EAAG+F,IAAIgP,EAAIA,GAChBF,EAAK7U,EAAGW,IAAIxB,EAAG4V,GACfD,EAAK9U,EAAGW,IAAIiU,EAAIM,GAChBJ,EAAK9U,EAAG+F,IAAI8O,EAAIC,GAChBD,EAAK7U,EAAGa,IAAIoU,EAAIH,GAChBA,EAAK9U,EAAG+F,IAAIkP,EAAIH,GAChBA,EAAK9U,EAAGW,IAAIkU,EAAIC,GAChBD,EAAK7U,EAAGW,IAAIwU,EAAIN,GAChBE,EAAK/U,EAAGW,IAAIiU,EAAIG,GAChBG,EAAKlV,EAAGW,IAAIxB,EAAG+V,GACfC,EAAKnV,EAAGa,IAAImU,EAAIE,GAChBC,EAAKnV,EAAGW,IAAIxB,EAAGgW,GACfA,EAAKnV,EAAG+F,IAAIoP,EAAIJ,GAChBA,EAAK/U,EAAG+F,IAAIiP,EAAIA,GAChBA,EAAKhV,EAAG+F,IAAIgP,EAAIC,GAChBA,EAAKhV,EAAG+F,IAAIiP,EAAIE,GAChBF,EAAKhV,EAAGW,IAAIqU,EAAIG,GAChBL,EAAK9U,EAAG+F,IAAI+O,EAAIE,GAChBE,EAAKlV,EAAGW,IAAI0T,EAAIC,GAChBY,EAAKlV,EAAG+F,IAAImP,EAAIA,GAChBF,EAAKhV,EAAGW,IAAIuU,EAAIC,GAChBN,EAAK7U,EAAGa,IAAIgU,EAAIG,GAChBD,EAAK/U,EAAGW,IAAIuU,EAAID,GAChBF,EAAK/U,EAAG+F,IAAIgP,EAAIA,GAChBA,EAAK/U,EAAG+F,IAAIgP,EAAIA,GACT,IAAItL,EAAMoL,EAAIC,EAAIC,EAC7B,CAKA,GAAAhP,CAAIuM,GACAD,EAAUC,GACV,MAAQe,EAAGe,EAAId,EAAGe,EAAIlT,EAAGmT,GAAOzb,MACxBwa,EAAGkB,EAAIjB,EAAGkB,EAAIrT,EAAGsT,GAAOnC,EAChC,IAAIuC,EAAK7U,EAAG8B,KAAMgT,EAAK9U,EAAG8B,KAAMiT,EAAK/U,EAAG8B,KACxC,MAAM3C,EAAIiQ,EAAMjQ,EACVyV,EAAK5U,EAAGW,IAAIyO,EAAMhQ,EAAGT,IAC3B,IAAIqW,EAAKhV,EAAGW,IAAIyT,EAAIG,GAChBU,EAAKjV,EAAGW,IAAI0T,EAAIG,GAChBU,EAAKlV,EAAGW,IAAI2T,EAAIG,GAChBU,EAAKnV,EAAG+F,IAAIqO,EAAIC,GAChBe,EAAKpV,EAAG+F,IAAIwO,EAAIC,GACpBW,EAAKnV,EAAGW,IAAIwU,EAAIC,GAChBA,EAAKpV,EAAG+F,IAAIiP,EAAIC,GAChBE,EAAKnV,EAAGa,IAAIsU,EAAIC,GAChBA,EAAKpV,EAAG+F,IAAIqO,EAAIE,GAChB,IAAIe,EAAKrV,EAAG+F,IAAIwO,EAAIE,GA+BpB,OA9BAW,EAAKpV,EAAGW,IAAIyU,EAAIC,GAChBA,EAAKrV,EAAG+F,IAAIiP,EAAIE,GAChBE,EAAKpV,EAAGa,IAAIuU,EAAIC,GAChBA,EAAKrV,EAAG+F,IAAIsO,EAAIC,GAChBO,EAAK7U,EAAG+F,IAAIyO,EAAIC,GAChBY,EAAKrV,EAAGW,IAAI0U,EAAIR,GAChBA,EAAK7U,EAAG+F,IAAIkP,EAAIC,GAChBG,EAAKrV,EAAGa,IAAIwU,EAAIR,GAChBE,EAAK/U,EAAGW,IAAIxB,EAAGiW,GACfP,EAAK7U,EAAGW,IAAIiU,EAAIM,GAChBH,EAAK/U,EAAG+F,IAAI8O,EAAIE,GAChBF,EAAK7U,EAAGa,IAAIoU,EAAIF,GAChBA,EAAK/U,EAAG+F,IAAIkP,EAAIF,GAChBD,EAAK9U,EAAGW,IAAIkU,EAAIE,GAChBE,EAAKjV,EAAG+F,IAAIiP,EAAIA,GAChBC,EAAKjV,EAAG+F,IAAIkP,EAAID,GAChBE,EAAKlV,EAAGW,IAAIxB,EAAG+V,GACfE,EAAKpV,EAAGW,IAAIiU,EAAIQ,GAChBH,EAAKjV,EAAG+F,IAAIkP,EAAIC,GAChBA,EAAKlV,EAAGa,IAAImU,EAAIE,GAChBA,EAAKlV,EAAGW,IAAIxB,EAAG+V,GACfE,EAAKpV,EAAG+F,IAAIqP,EAAIF,GAChBF,EAAKhV,EAAGW,IAAIsU,EAAIG,GAChBN,EAAK9U,EAAG+F,IAAI+O,EAAIE,GAChBA,EAAKhV,EAAGW,IAAI0U,EAAID,GAChBP,EAAK7U,EAAGW,IAAIwU,EAAIN,GAChBA,EAAK7U,EAAGa,IAAIgU,EAAIG,GAChBA,EAAKhV,EAAGW,IAAIwU,EAAIF,GAChBF,EAAK/U,EAAGW,IAAI0U,EAAIN,GAChBA,EAAK/U,EAAG+F,IAAIgP,EAAIC,GACT,IAAIvL,EAAMoL,EAAIC,EAAIC,EAC7B,CACA,QAAAO,CAAShD,GACL,OAAOzZ,KAAKkN,IAAIuM,EAAMhL,SAC1B,CACA,GAAA7F,GACI,OAAO5I,KAAKsb,OAAO1K,EAAM3H,KAC7B,CAUA,QAAAoS,CAAStN,GACL,MAAQmJ,KAAAA,GAASd,EACjB,IAAKtF,EAAGhE,YAAYiB,GAChB,MAAM,IAAItN,MAAM,gCACpB,IAAI0Q,EAAOuL,EACX,MAAM5U,EAAOtE,GAAM4X,EAAKxJ,OAAO5R,KAAMwD,EAAI2J,GAAMuB,EAAWkC,EAAOzD,IAEjE,GAAI+J,EAAM,CACN,MAAMgD,MAAEA,EAAAF,GAAOA,EAAAG,MAAIA,KAAOF,GAAOP,EAAiB3L,IAC1CZ,EAAG2N,EAAKpO,EAAGiQ,GAAQ7U,EAAIkS,IACvB7M,EAAG4N,EAAKrO,EAAGkQ,GAAQ9U,EAAImS,GAC/ByC,EAAOC,EAAIzP,IAAI0P,GACfzL,EAAQyJ,EAAW1D,EAAKE,KAAM0D,EAAKC,EAAKb,EAAOC,EACnD,KACK,CACD,MAAMhN,EAAEA,EAAAT,EAAGA,GAAM5E,EAAIiG,GACrBoD,EAAQhE,EACRuP,EAAOhQ,CACX,CAEA,OAAOgC,EAAWkC,EAAO,CAACO,EAAOuL,IAAO,EAC5C,CAMA,cAAAG,CAAeC,GACX,MAAQ5F,KAAAA,GAASd,EACXjJ,EAAInN,KACV,IAAK8Q,EAAGjE,QAAQiQ,GACZ,MAAM,IAAIrc,MAAM,gCACpB,GAAIqc,IAAO7a,IAAOkL,EAAEvE,MAChB,OAAOgI,EAAM3H,KACjB,GAAI6T,IAAO5a,GACP,OAAOiL,EACX,GAAIiO,EAAKnJ,SAASjS,MACd,OAAOA,KAAKqb,SAASyB,GACzB,GAAI5F,EAAM,CACN,MAAMgD,MAAEA,EAAAF,GAAOA,EAAAG,MAAIA,KAAOF,GAAOP,EAAiBoD,IAC5CC,GAAEA,KAAIC,GDpXrB,SAAuBpM,EAAOO,EAAO6I,EAAIC,GAC5C,IAAInP,EAAMqG,EACN4L,EAAKnM,EAAM3H,KACX+T,EAAKpM,EAAM3H,KACf,KAAO+Q,EAAK/X,GAAOgY,EAAKhY,GAChB+X,EAAK9X,IACL6a,EAAKA,EAAG7P,IAAIpC,IACZmP,EAAK/X,IACL8a,EAAKA,EAAG9P,IAAIpC,IAChBA,EAAMA,EAAImG,SACV+I,IAAO9X,EACP+X,IAAO/X,EAEX,MAAO,CAAE6a,KAAIC,KACjB,CCsWmCC,CAAcrM,EAAOzD,EAAG6M,EAAIC,GAC/C,OAAOW,EAAW1D,EAAKE,KAAM2F,EAAIC,EAAI9C,EAAOC,EAChD,CAEI,OAAOiB,EAAKvJ,OAAO1E,EAAG2P,EAE9B,CACA,oBAAAI,CAAqB9U,EAAG9B,EAAGC,GACvB,MAAMsM,EAAM7S,KAAK6c,eAAevW,GAAG4G,IAAI9E,EAAEyU,eAAetW,IACxD,OAAOsM,EAAIjK,WAAQ,EAAYiK,CACnC,CAKA,QAAA/D,CAASqO,GACL,OAAO7C,EAAata,KAAMmd,EAC9B,CAKA,aAAAlG,GACI,MAAMA,cAAEA,GAAkBb,EAC1B,OAAIS,IAAa3U,KAEb+U,EACOA,EAAcrG,EAAO5Q,MACzBob,EAAKvJ,OAAO7R,KAAM8W,GAAalO,MAC1C,CACA,aAAAoO,GACI,MAAMA,cAAEA,GAAkBZ,EAC1B,OAAIS,IAAa3U,GACNlC,KACPgX,EACOA,EAAcpG,EAAO5Q,MACzBA,KAAK6c,eAAehG,EAC/B,CACA,YAAAuG,GAEI,OAAOpd,KAAK6c,eAAehG,GAAUjO,KACzC,CACA,OAAAvI,CAAQsX,GAAe,GAGnB,OAFA7D,EAAM6D,EAAc,gBACpB3X,KAAKgb,iBACEvD,EAAY7G,EAAO5Q,KAAM2X,EACpC,CACA,KAAA0F,CAAM1F,GAAe,GACjB,OAAO2F,aAAWtd,KAAKK,QAAQsX,GACnC,CACA,QAAA7U,GACI,MAAO,UAAU9C,KAAK4I,MAAQ,OAAS5I,KAAKqd,UAChD,CAEA,MAAIE,GACA,OAAOvd,KAAKwa,CAChB,CACA,MAAIgD,GACA,OAAOxd,KAAKwa,CAChB,CACA,MAAIiD,GACA,OAAOzd,KAAKsI,CAChB,CACA,UAAAoV,CAAW/F,GAAe,GACtB,OAAO3X,KAAKK,QAAQsX,EACxB,CACA,cAAAgG,CAAenO,GACXxP,KAAKkb,WAAW1L,EACpB,CACA,iBAAOd,CAAWC,GACd,OAAOD,EAAWkC,EAAOjC,EAC7B,CACA,UAAOiP,CAAIjP,EAAQyD,GACf,OAAOF,GAAUtB,EAAOE,EAAInC,EAAQyD,EACxC,CACA,qBAAOyL,CAAeC,GAClB,OAAOlN,EAAMC,KAAKwK,SAAStF,GAAejF,EAAIgN,GAClD,EAGJlN,EAAMC,KAAO,IAAID,EAAM2F,EAAM2C,GAAI3C,EAAM4C,GAAIhS,EAAGc,KAE9C2I,EAAM3H,KAAO,IAAI2H,EAAMzJ,EAAG8B,KAAM9B,EAAGc,IAAKd,EAAG8B,MAE3C2H,EAAMzJ,GAAKA,EAEXyJ,EAAME,GAAKA,EACX,MAAM7B,EAAO6B,EAAGvE,KACV6O,EAAO,IAAIzK,GAAKC,EAAOwF,EAAUc,KAAOtL,KAAKC,KAAKoD,EAAO,GAAKA,GAEpE,OADA2B,EAAMC,KAAKqK,WAAW,GACftK,CACX,CAEA,SAASoH,GAAQF,GACb,OAAOjX,WAAWoX,GAAGH,EAAW,EAAO,EAC3C,CA6HA,SAASP,GAAYpQ,EAAI2J,GACrB,MAAO,CACHiN,UAAWjN,EAAGtE,MACd2L,UAAW,EAAIhR,EAAGqF,MAClB4L,sBAAuB,EAAI,EAAIjR,EAAGqF,MAClCwR,oBAAoB,EACpBC,UAAW,EAAInN,EAAGtE,MAE1B,CAKO,SAAS0R,GAAKtN,EAAOuN,EAAW,IACnC,MAAMrN,GAAEA,GAAOF,EACTwN,EAAeD,EAASE,aAAeC,EAAAA,YACvChH,EAAU1V,OAAO8U,OAAOa,GAAY3G,EAAMzJ,GAAI2J,GAAK,CAAEyN,KAAMlQ,EAAiByC,EAAGrJ,SACrF,SAAS+W,EAAiBT,GACtB,IACI,QAAShI,GAAejF,EAAIiN,EAChC,OACO9H,GACH,OAAO,CACX,CACJ,CAmBA,SAASwI,EAAgBF,EAAOH,EAAa9G,EAAQiH,OACjD,OF1XD,SAAwBne,EAAK+N,EAAYpC,GAAO,GACnD,MAAMtJ,EAAMrC,EAAIW,OACV2d,EAAWxQ,EAAoBC,GAC/BwQ,EAAStQ,EAAiBF,GAEhC,GAAI1L,EAAM,IAAMA,EAAMkc,GAAUlc,EAAM,KAClC,MAAM,IAAIhC,MAAM,YAAcke,EAAS,6BAA+Blc,GAC1E,MAEMmc,EAAUvY,EAFJ0F,EAAO5I,EAAgB/C,GAAO6C,EAAgB7C,GAEjC+N,EAAajM,GAAOA,EAC7C,OAAO6J,EAAOpI,EAAgBib,EAASF,GAAYnb,EAAgBqb,EAASF,EAChF,CE+WeG,CAAerd,EAAO+c,EAAMjH,EAAQiH,KAAM,QAASzN,EAAGrJ,MACjE,CAMA,SAASqX,EAAaf,EAAWpG,GAAe,GAC5C,OAAO/G,EAAMC,KAAKwK,SAAStF,GAAejF,EAAIiN,IAAY1d,QAAQsX,EACtE,CAQA,SAASoH,EAAUvQ,GACf,GAAoB,iBAATA,EACP,OAAO,EACX,GAAIA,aAAgBoC,EAChB,OAAO,EACX,MAAMmN,UAAEA,EAAA5F,UAAWA,EAAAC,sBAAWA,GAA0Bd,EACxD,GAAIxG,EAAG3E,gBAAkB4R,IAAc5F,EACnC,OACJ,MAAMnD,EAAIpR,EAAY,MAAO4K,GAAMzN,OACnC,OAAOiU,IAAMmD,GAAanD,IAAMoD,CACpC,CAkBA,MAAM4G,EAAQ,CACVR,mBACAS,iBAlEJ,SAA0B9G,EAAWR,GACjC,MAAQQ,UAAWxG,EAAAyG,sBAAMA,GAA0Bd,EACnD,IACI,MAAMtC,EAAImD,EAAUpX,OACpB,QAAqB,IAAjB4W,GAAyB3C,IAAMrD,OAEd,IAAjBgG,GAA0B3C,IAAMoD,MAE3BxH,EAAMjD,UAAUwK,GAC7B,OACOlC,GACH,OAAO,CACX,CACJ,EAsDIwI,kBAEAS,kBAAmBV,EACnBW,iBAAkBV,EAClBW,uBAAyBhf,GAAQ2V,GAAejF,EAAI1Q,GACpD8a,WAAA,CAAW1L,EAAa,EAAG2B,EAAQP,EAAMC,OAC9BM,EAAM+J,WAAW1L,GAAY,IAG5C,OAAO5N,OAAO+K,OAAO,CAAEmS,eAAcO,gBArBrC,SAAyBC,EAAYC,EAAY5H,GAAe,GAC5D,IAA8B,IAA1BoH,EAAUO,GACV,MAAM,IAAI7e,MAAM,iCACpB,IAA8B,IAA1Bse,EAAUQ,GACV,MAAM,IAAI9e,MAAM,iCACpB,MAAM+R,EAAIuD,GAAejF,EAAIwO,GAE7B,OADU1O,EAAMqK,QAAQsE,GACflE,SAAS7I,GAAGnS,QAAQsX,EACjC,EAasD6H,OA/CtD,SAAgBjB,GACZ,MAAMR,EAAYU,EAAgBF,GAClC,MAAO,CAAER,YAAW5F,UAAW2G,EAAaf,GAChD,EA4C8DnN,QAAOoO,QAAO1H,WAChF,CAiBO,SAASmI,GAAM7O,EAAO/Q,EAAM6f,EAAY,CAAA,GAC3Cvf,EAAAA,MAAMN,GACN0E,EAAgBmb,EAAW,GAAI,CAC3B3d,KAAM,WACNgS,KAAM,UACNsK,YAAa,WACbsB,SAAU,WACVC,cAAe,aAEnB,MAAMvB,EAAcqB,EAAUrB,aAAeC,EAAAA,YACvCvc,EAAO2d,EAAU3d,MAAA,EACjB3B,KAAQyf,IAASC,EAAUjgB,EAAMO,EAAK2X,EAAAA,eAAe8H,MACrD1Y,GAAEA,EAAA2J,GAAIA,GAAOF,GACXnJ,MAAOqP,EAAavK,KAAMwT,GAAWjP,GACvC0O,OAAEA,eAAQV,EAAAO,gBAAcA,EAAAL,MAAiBA,UAAO1H,GAAY4G,GAAKtN,EAAO8O,GACxEM,EAAiB,CACnBhM,SAAS,EACTD,KAAgC,kBAAnB2L,EAAU3L,MAAqB2L,EAAU3L,KACtDP,YAAQ,EACRyM,cAAc,GAEZC,EAAwB,UAC9B,SAASC,EAAsBrZ,GAE3B,OAAOA,EADMgQ,GAAe5U,EAEhC,CACA,SAASke,EAAW/d,EAAOO,GACvB,IAAKkO,EAAGhE,YAAYlK,GAChB,MAAM,IAAInC,MAAM,qBAAqB4B,qCACzC,OAAOO,CACX,CAUA,MAAMyd,EACF,WAAAzgB,CAAYoH,EAAGwL,EAAG8N,GACdtgB,KAAKgH,EAAIoZ,EAAW,IAAKpZ,GACzBhH,KAAKwS,EAAI4N,EAAW,IAAK5N,GACT,MAAZ8N,IACAtgB,KAAKsgB,SAAWA,GACpB1e,OAAO+K,OAAO3M,KAClB,CACA,gBAAO2N,CAAUpL,EAAOiR,EAAS0M,GAE7B,IAAIK,EACJ,GApBR,SAA2Bhe,EAAOiR,GAC9BD,GAAkBC,GAClB,MAAMgN,EAAOlJ,EAAQ2G,UAEdzc,EAAOe,EADW,YAAXiR,EAAuBgN,EAAkB,cAAXhN,EAAyBgN,EAAO,OAAI,EACpD,GAAGhN,cACnC,CAaQiN,CAAkBle,EAAOiR,GAEV,QAAXA,EAAkB,CAClB,MAAQxM,EAAAA,EAAGwL,EAAAA,GAAM0B,GAAIiB,MAAM3T,EAAOe,IAClC,OAAO,IAAI8d,EAAUrZ,EAAGwL,EAC5B,CACe,cAAXgB,IACA+M,EAAQhe,EAAM,GACdiR,EAAS,UACTjR,EAAQA,EAAMwS,SAAS,IAE3B,MAAMyD,EAAI1H,EAAGtE,MACPxF,EAAIzE,EAAMwS,SAAS,EAAGyD,GACtBhG,EAAIjQ,EAAMwS,SAASyD,EAAO,EAAJA,GAC5B,OAAO,IAAI6H,EAAUvP,EAAGnD,UAAU3G,GAAI8J,EAAGnD,UAAU6E,GAAI+N,EAC3D,CACA,cAAOtF,CAAQpY,EAAK2Q,GAChB,OAAOxT,KAAK2N,UAAU+S,EAAAA,WAAW7d,GAAM2Q,EAC3C,CACA,cAAAmN,CAAeL,GACX,OAAO,IAAID,EAAUrgB,KAAKgH,EAAGhH,KAAKwS,EAAG8N,EACzC,CACA,gBAAAM,CAAiBC,GACb,MAAMC,EAAc3Z,EAAGM,OACjBT,EAAEA,EAAAwL,EAAGA,EAAG8N,SAAUS,GAAQ/gB,KAChC,GAAW,MAAP+gB,IAAgB,CAAC,EAAG,EAAG,EAAG,GAAGlT,SAASkT,GACtC,MAAM,IAAItgB,MAAM,uBAUpB,GADoBqW,EAAcjR,GAAMib,GACrBC,EAAM,EACrB,MAAM,IAAItgB,MAAM,0CACpB,MAAMugB,EAAe,IAARD,GAAqB,IAARA,EAAY/Z,EAAI8P,EAAc9P,EACxD,IAAKG,EAAG0F,QAAQmU,GACZ,MAAM,IAAIvgB,MAAM,8BACpB,MAAMiG,EAAIS,EAAG9G,QAAQ2gB,GACfhY,EAAI4H,EAAMjD,UAAUoK,cAAYC,KAAe,EAAN+I,IAAiBra,IAC1Dua,EAAKnQ,EAAG9F,IAAIgW,GACZpK,EAAIgJ,EAAchc,EAAY,UAAWid,IACzCK,EAAKpQ,EAAGvQ,QAAQqW,EAAIqK,GACpBE,EAAKrQ,EAAGvQ,OAAOiS,EAAIyO,GAEnB7Y,EAAIwI,EAAMC,KAAKgM,eAAeqE,GAAIhU,IAAIlE,EAAE6T,eAAesE,IAC7D,GAAI/Y,EAAEQ,MACF,MAAM,IAAInI,MAAM,qBAEpB,OADA2H,EAAE4S,iBACK5S,CACX,CAEA,QAAAgZ,GACI,OAAOjB,EAAsBngB,KAAKwS,EACtC,CACA,OAAAnS,CAAQmT,EAAS0M,GAEb,GADA3M,GAAkBC,GACH,QAAXA,EACA,OAAOkN,aAAWxM,GAAI0B,WAAW5V,OACrC,MAAMgH,EAAI8J,EAAGzQ,QAAQL,KAAKgH,GACpBwL,EAAI1B,EAAGzQ,QAAQL,KAAKwS,GAC1B,GAAe,cAAXgB,EAAwB,CACxB,GAAqB,MAAjBxT,KAAKsgB,SACL,MAAM,IAAI7f,MAAM,gCACpB,OAAOsX,EAAAA,YAAYlX,WAAWoX,GAAGjY,KAAKsgB,UAAWtZ,EAAGwL,EACxD,CACA,OAAOuF,EAAAA,YAAY/Q,EAAGwL,EAC1B,CACA,KAAA6K,CAAM7J,GACF,OAAO8J,aAAWtd,KAAKK,QAAQmT,GACnC,CAEA,cAAAwH,GAAmB,CACnB,kBAAOqG,CAAYxe,GACf,OAAOwd,EAAU1S,UAAU/J,EAAY,MAAOf,GAAM,UACxD,CACA,cAAOye,CAAQze,GACX,OAAOwd,EAAU1S,UAAU/J,EAAY,MAAOf,GAAM,MACxD,CACA,UAAA0e,GACI,OAAOvhB,KAAKohB,WAAa,IAAIf,EAAUrgB,KAAKgH,EAAG8J,EAAGtH,IAAIxJ,KAAKwS,GAAIxS,KAAKsgB,UAAYtgB,IACpF,CACA,aAAAwhB,GACI,OAAOxhB,KAAKK,QAAQ,MACxB,CACA,QAAAohB,GACI,OAAOnE,aAAWtd,KAAKK,QAAQ,OACnC,CACA,iBAAAqhB,GACI,OAAO1hB,KAAKK,QAAQ,UACxB,CACA,YAAAshB,GACI,OAAOrE,aAAWtd,KAAKK,QAAQ,WACnC,EAMJ,MAAMsf,EAAWD,EAAUC,UACvB,SAAsBpd,GAElB,GAAIA,EAAMxB,OAAS,KACf,MAAM,IAAIN,MAAM,sBAGpB,MAAMmC,EAAMK,EAAgBV,GACtBqf,EAAuB,EAAfrf,EAAMxB,OAAagf,EACjC,OAAO6B,EAAQ,EAAIhf,GAAOI,OAAO4e,GAAShf,CAC9C,EACEgd,EAAgBF,EAAUE,eAC5B,SAA2Brd,GACvB,OAAOuO,EAAGvQ,OAAOof,EAASpd,GAC9B,EAEEsf,EAAavd,EAAQyb,GAE3B,SAAS+B,EAAWlf,GAGhB,OADAqB,EAAS,WAAa8b,EAAQnd,EAAKX,GAAK4f,GACjC/Q,EAAGzQ,QAAQuC,EACtB,CACA,SAASmf,EAAmB/f,EAASgS,GAEjC,OADAxS,EAAOQ,OAAS,EAAW,WACpBgS,EAAUxS,EAAO3B,EAAKmC,QAAU,EAAW,qBAAuBA,CAC7E,CAkKA,OAAOJ,OAAO+K,OAAO,CACjB6S,SACAV,eACAO,kBACAL,QACA1H,UACA1G,QACAoR,KAjGJ,SAAchgB,EAAS+b,EAAW/R,EAAO,CAAA,GACrChK,EAAU4B,EAAY,UAAW5B,GACjC,MAAMuc,KAAEA,EAAA0D,MAAMA,GAjElB,SAAiBjgB,EAAS8b,EAAY9R,GAClC,GAAI,CAAC,YAAa,aAAakW,KAAM/c,GAAMA,KAAK6G,GAC5C,MAAM,IAAIvL,MAAM,uCACpB,MAAMsT,KAAEA,EAAAC,QAAMA,EAAAiM,aAASA,GAAiBxM,GAAgBzH,EAAMgU,GAC9Dhe,EAAU+f,EAAmB/f,EAASgS,GAItC,MAAMmO,EAAQvC,EAAc5d,GACtBoL,EAAI2I,GAAejF,EAAIgN,GACvBsE,EAAW,CAACN,EAAW1U,GAAI0U,EAAWK,IAE5C,GAAoB,MAAhBlC,IAAyC,IAAjBA,EAAwB,CAGhD,MAAMlc,GAAqB,IAAjBkc,EAAwB5B,EAAY/G,EAAQyG,WAAakC,EACnEmC,EAAS/Q,KAAKzN,EAAY,eAAgBG,GAC9C,CACA,MAAMwa,EAAOxG,EAAAA,eAAeqK,GACtBnb,EAAIkb,EA+BV,MAAO,CAAE5D,OAAM0D,MAtBf,SAAeI,GAGX,MAAMld,EAAIwa,EAAS0C,GACnB,IAAKvR,EAAGhE,YAAY3H,GAChB,OACJ,MAAMmd,EAAKxR,EAAG9F,IAAI7F,GACZod,EAAI3R,EAAMC,KAAKwK,SAASlW,GAAG2J,WAC3B9H,EAAI8J,EAAGvQ,OAAOgiB,EAAE7b,GACtB,GAAIM,IAAM/E,GACN,OACJ,MAAMuQ,EAAI1B,EAAGvQ,OAAO+hB,EAAKxR,EAAGvQ,OAAO0G,EAAID,EAAIoG,IAC3C,GAAIoF,IAAMvQ,GACN,OACJ,IAAIqe,GAAYiC,EAAE7b,IAAMM,EAAI,EAAI,GAAKkI,OAAOqT,EAAE3K,EAAI1V,IAC9CsgB,EAAQhQ,EAKZ,OAJIuB,GAAQoM,EAAsB3N,KAC9BgQ,EAAQ1R,EAAGtH,IAAIgJ,GACf8N,GAAY,GAET,IAAID,EAAUrZ,EAAGwb,EAAOlC,EACnC,EAEJ,CAc4BmC,CAAQzgB,EAAS+b,EAAW/R,GAGpD,OHzgCD,SAAwB0W,EAASC,EAAUC,GAC9C,GAAuB,iBAAZF,GAAwBA,EAAU,EACzC,MAAM,IAAIjiB,MAAM,4BACpB,GAAwB,iBAAbkiB,GAAyBA,EAAW,EAC3C,MAAM,IAAIliB,MAAM,6BACpB,GAAsB,mBAAXmiB,EACP,MAAM,IAAIniB,MAAM,6BAEpB,MAAMoiB,EAAOpgB,GAAQ,IAAI5B,WAAW4B,GAC9BqgB,EAAQC,GAASliB,WAAWoX,GAAG8K,GACrC,IAAI3d,EAAIyd,EAAIH,GACRvd,EAAI0d,EAAIH,GACRzhB,EAAI,EACR,MAAM+hB,EAAQ,KACV5d,EAAEuF,KAAK,GACPxF,EAAEwF,KAAK,GACP1J,EAAI,GAEF2V,EAAI,IAAIrQ,IAAMqc,EAAOzd,EAAGC,KAAMmB,GAC9B0c,EAAS,CAAC1E,EAAOsE,EAAI,MAEvB1d,EAAIyR,EAAEkM,EAAK,GAAOvE,GAClBnZ,EAAIwR,IACgB,IAAhB2H,EAAKxd,SAEToE,EAAIyR,EAAEkM,EAAK,GAAOvE,GAClBnZ,EAAIwR,MAEFsM,EAAM,KAER,GAAIjiB,KAAO,IACP,MAAM,IAAIR,MAAM,2BACpB,IAAIgC,EAAM,EACV,MAAMlB,EAAM,GACZ,KAAOkB,EAAMkgB,GAAU,CACnBvd,EAAIwR,IACJ,MAAMuM,EAAK/d,EAAEge,QACb7hB,EAAI8P,KAAK8R,GACT1gB,GAAO2C,EAAErE,MACb,CACA,OAAOsiB,EAAAA,eAAgB9hB,IAW3B,MATiB,CAACgd,EAAM+E,KAGpB,IAAIxf,EACJ,IAHAkf,IACAC,EAAO1E,KAEEza,EAAMwf,EAAKJ,OAChBD,IAEJ,OADAD,IACOlf,EAGf,CGm9BqByf,CAAe1jB,EAAKc,UAAWmQ,EAAGtE,MAAOzK,EAC1CyhB,CAAKjF,EAAM0D,EAE3B,EA4FIwB,OA3CJ,SAAgBxF,EAAWjc,EAASmW,EAAWnM,EAAO,CAAA,GAClD,MAAM+H,KAAEA,EAAAC,QAAMA,EAAAR,OAASA,GAAWC,GAAgBzH,EAAMgU,GAGxD,GAFA7H,EAAYvU,EAAY,YAAauU,GACrCnW,EAAU+f,EAAmBne,EAAY,UAAW5B,GAAUgS,GAC1D,WAAYhI,EACZ,MAAM,IAAIvL,MAAM,sCACpB,MAAMoV,OAAiB,IAAXrC,EAtDhB,SAAuBkQ,GAEnB,IAAI7N,EACJ,MAAM8N,EAAsB,iBAAPD,GAAmBE,EAAAA,QAAQF,GAC1CG,GAASF,GACJ,OAAPD,GACc,iBAAPA,GACS,iBAATA,EAAG1c,GACM,iBAAT0c,EAAGlR,EACd,IAAKmR,IAAUE,EACX,MAAM,IAAIpjB,MAAM,4EACpB,GAAIojB,EACAhO,EAAM,IAAIwK,EAAUqD,EAAG1c,EAAG0c,EAAGlR,WAExBmR,EAAO,CACZ,IACI9N,EAAMwK,EAAU1S,UAAU/J,EAAY,MAAO8f,GAAK,MACtD,OACOI,GACH,KAAMA,aAAoB5P,GAAIC,KAC1B,MAAM2P,CACd,CACA,IAAKjO,EACD,IACIA,EAAMwK,EAAU1S,UAAU/J,EAAY,MAAO8f,GAAK,UACtD,OACOzN,GACH,OAAO,CACX,CAER,CACA,OAAKJ,IACM,CAEf,CAqBUkO,CAAc9F,GACdoC,EAAU1S,UAAU/J,EAAY,MAAOqa,GAAYzK,GACzD,IAAY,IAARqC,EACA,OAAO,EACX,IACI,MAAM1N,EAAIyI,EAAMjD,UAAUwK,GAC1B,GAAIpE,GAAQ8B,EAAIuL,WACZ,OAAO,EACX,MAAMpa,EAAEA,EAAAwL,EAAGA,GAAMqD,EACXe,EAAIgJ,EAAc5d,GAClBgiB,EAAKlT,EAAG9F,IAAIwH,GACZ0O,EAAKpQ,EAAGvQ,OAAOqW,EAAIoN,GACnB7C,EAAKrQ,EAAGvQ,OAAOyG,EAAIgd,GACnBhb,EAAI4H,EAAMC,KAAKgM,eAAeqE,GAAIhU,IAAI/E,EAAE0U,eAAesE,IAC7D,GAAInY,EAAEJ,MACF,OAAO,EAEX,OADUkI,EAAGvQ,OAAOyI,EAAEtC,KACTM,CACjB,OACOjD,GACH,OAAO,CACX,CACJ,EAeI6c,iBAdJ,SAA0B3C,EAAWjc,EAASgK,EAAO,CAAA,GACjD,MAAMgI,QAAEA,GAAYP,GAAgBzH,EAAMgU,GAE1C,OADAhe,EAAU+f,EAAmB/f,EAASgS,GAC/BqM,EAAU1S,UAAUsQ,EAAW,aAAa2C,iBAAiB5e,GAAS3B,SACjF,EAWIggB,YACAxgB,QAER,CAsCA,SAASokB,GAA0Bnb,GAC/B,MAAMyN,MAAEA,EAAAC,UAAOA,GAhCnB,SAAyC1N,GACrC,MAAMyN,EAAQ,CACVjQ,EAAGwC,EAAExC,EACLC,EAAGuC,EAAEvC,EACL4G,EAAGrE,EAAE3B,GAAGM,MACRjE,EAAGsF,EAAEtF,EACLoT,EAAG9N,EAAE8N,EACLsC,GAAIpQ,EAAEoQ,GACNC,GAAIrQ,EAAEqQ,IAEJhS,EAAK2B,EAAE3B,GACb,IAAIgF,EAAiBrD,EAAEob,yBACjBxZ,MAAMrH,KAAK,IAAI8gB,IAAIrb,EAAEob,yBAAyB3e,IAAKyP,GAAMpJ,KAAKC,KAAKmJ,EAAI,WACvE,EAgBN,MAAO,CAAEuB,QAAOC,UAVE,CACdrP,KACA2J,GAPOtI,EAAM+N,EAAM/S,EAAG,CACtB+I,KAAMzD,EAAE0C,WACRW,iBACAC,aAActD,EAAEqO,iBAKhBJ,mBAAoBjO,EAAEiO,mBACtBG,KAAMpO,EAAEoO,KACRD,cAAenO,EAAEmO,cACjBD,cAAelO,EAAEkO,cACjBrJ,UAAW7E,EAAE6E,UACbtN,QAASyI,EAAEzI,SAGnB,CAEiC+jB,CAAgCtb,GACvD4W,EAAY,CACd3d,KAAM+G,EAAE/G,KACRsc,YAAavV,EAAEuV,YACftK,KAAMjL,EAAEiL,KACR4L,SAAU7W,EAAE6W,SACZC,cAAe9W,EAAE8W,eAErB,MAAO,CAAErJ,QAAOC,YAAW3W,KAAMiJ,EAAEjJ,KAAM6f,YAC7C,CAoCO,SAAS2E,GAAYvb,GACxB,MAAMyN,MAAEA,EAAAC,UAAOA,EAAA3W,KAAWA,YAAM6f,GAAcuE,GAA0Bnb,GAGxE,OAZJ,SAAqCA,EAAGwb,GACpC,MAAM1T,EAAQ0T,EAAO1T,MACrB,OAAOhP,OAAO8U,OAAO,CAAA,EAAI4N,EAAQ,CAC7BC,gBAAiB3T,EACjB2F,MAAO3U,OAAO8U,OAAO,CAAA,EAAI5N,EAAGyC,EAAQqF,EAAME,GAAGrJ,MAAOmJ,EAAME,GAAGvE,QAErE,CAMWiY,CAA4B1b,EADrB2W,GADAvJ,GAAaK,EAAOC,GACP3W,EAAM6f,GAErC;;;ACj3CA,MAAM+E,GAAkB,CACpBtX,EAAGnK,OAAO,sEACVQ,EAAGR,OAAO,sEACV4T,EAAG5T,OAAO,GACVsD,EAAGtD,OAAO,GACVuD,EAAGvD,OAAO,GACVkW,GAAIlW,OAAO,sEACXmW,GAAInW,OAAO,uEAET0hB,GAAiB,CACnBtN,KAAMpU,OAAO,sEACbqU,QAAS,CACL,CAACrU,OAAO,uCAAwCA,OAAO,uCACvD,CAACA,OAAO,uCAAwCA,OAAO,yCAKzD6C,UAA6B,GA6BnC,MAAM8e,GAAOnc,EAAMic,GAAgBtX,EAAG,CAAEd,KAxBxC,SAAiBuL,GACb,MAAMzP,EAAIsc,GAAgBtX,EAEpBrH,EAAM9C,OAAO,GAAI4hB,EAAM5hB,OAAO,GAAI6hB,EAAO7hB,OAAO,IAAK8hB,EAAO9hB,OAAO,IAEnE+hB,EAAO/hB,OAAO,IAAKgiB,EAAOhiB,OAAO,IAAKiiB,EAAOjiB,OAAO,IACpD+W,EAAMnC,EAAIA,EAAIA,EAAKzP,EACnB4T,EAAMhC,EAAKA,EAAKnC,EAAKzP,EACrB+c,EAAMze,EAAKsV,EAAIjW,EAAKqC,GAAK4T,EAAM5T,EAC/Bgd,EAAM1e,EAAKye,EAAIpf,EAAKqC,GAAK4T,EAAM5T,EAC/Bid,EAAO3e,EAAK0e,EAAItf,GAAKsC,GAAK4R,EAAM5R,EAChCkd,EAAO5e,EAAK2e,EAAKP,EAAM1c,GAAKid,EAAOjd,EACnCmd,EAAO7e,EAAK4e,EAAKP,EAAM3c,GAAKkd,EAAOld,EACnCod,EAAO9e,EAAK6e,EAAKN,EAAM7c,GAAKmd,EAAOnd,EACnCqd,EAAQ/e,EAAK8e,EAAKN,EAAM9c,GAAKod,EAAOpd,EACpCsd,EAAQhf,EAAK+e,EAAMR,EAAM7c,GAAKmd,EAAOnd,EACrCud,EAAQjf,EAAKgf,EAAM3f,EAAKqC,GAAK4T,EAAM5T,EACnCiU,EAAM3V,EAAKif,EAAMX,EAAM5c,GAAKkd,EAAOld,EACnCkU,EAAM5V,EAAK2V,EAAIwI,EAAKzc,GAAK4R,EAAM5R,EAC/Bf,EAAOX,EAAK4V,EAAIxW,GAAKsC,GAC3B,IAAKwc,GAAKtd,IAAIsd,GAAKrd,IAAIF,GAAOwQ,GAC1B,MAAM,IAAInX,MAAM,2BACpB,OAAO2G,CACX,IAgBaue,GCrEN,SAAqBC,EAAUC,GAClC,MAAMtlB,EAAUV,GAASwkB,GAAY,IAAKuB,EAAU/lB,SACpD,MAAO,IAAKU,EAAOslB,GAAUtlB,SACjC,CDkEyBulB,CAAY,IAAKrB,GAAiBtd,GAAIwd,GAAM5Q,MAAM,EAAMmD,KAAMwN,IAAkBqB,EAAAA","x_google_ignoreList":[0,1,2,3,4,5,6]}