superstack-wallet-sdk 0.4.4 → 0.4.7

package/dist/esm/node_modules/viem/node_modules/@noble/curves/esm/abstract/weierstrass.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"weierstrass.js","sources":["../../../../../../../../../node_modules/viem/node_modules/@noble/curves/esm/abstract/weierstrass.js"],"sourcesContent":["/**\n * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.\n *\n * ### Parameters\n *\n * To initialize a weierstrass curve, one needs to pass following params:\n *\n * * a: formula param\n * * b: formula param\n * * Fp: finite field of prime characteristic P; may be complex (Fp2). Arithmetics is done in field\n * * n: order of prime subgroup a.k.a total amount of valid curve points\n * * Gx: Base point (x, y) aka generator point. Gx = x coordinate\n * * Gy: ...y coordinate\n * * h: cofactor, usually 1. h*n = curve group order (n is only subgroup order)\n * * lowS: whether to enable (default) or disable \"low-s\" non-malleable signatures\n *\n * ### Design rationale for types\n *\n * * Interaction between classes from different curves should fail:\n *   `k256.Point.BASE.add(p256.Point.BASE)`\n * * For this purpose we want to use `instanceof` operator, which is fast and works during runtime\n * * Different calls of `curve()` would return different classes -\n *   `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,\n *   it won't affect others\n *\n * TypeScript can't infer types for classes created inside a function. Classes is one instance\n * of nominative types in TypeScript and interfaces only check for shape, so it's hard to create\n * unique type for every function call.\n *\n * We can use generic types via some param, like curve opts, but that would:\n *     1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)\n *     which is hard to debug.\n *     2. Params can be generic and we can't enforce them to be constant value:\n *     if somebody creates curve from non-constant params,\n *     it would be allowed to interact with other curves with non-constant params\n *\n * @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\n// prettier-ignore\nimport { pippenger, validateBasic, wNAF } from \"./curve.js\";\n// prettier-ignore\nimport { Field, FpInvertBatch, getMinHashLength, invert, mapHashToField, mod, validateField } from \"./modular.js\";\n// prettier-ignore\nimport { aInRange, abool, bitMask, bytesToHex, bytesToNumberBE, concatBytes, createHmacDrbg, ensureBytes, hexToBytes, inRange, isBytes, memoized, numberToBytesBE, numberToHexUnpadded, validateObject } from \"./utils.js\";\nfunction validateSigVerOpts(opts) {\n    if (opts.lowS !== undefined)\n        abool('lowS', opts.lowS);\n    if (opts.prehash !== undefined)\n        abool('prehash', opts.prehash);\n}\nfunction validatePointOpts(curve) {\n    const opts = validateBasic(curve);\n    validateObject(opts, {\n        a: 'field',\n        b: 'field',\n    }, {\n        allowInfinityPoint: 'boolean',\n        allowedPrivateKeyLengths: 'array',\n        clearCofactor: 'function',\n        fromBytes: 'function',\n        isTorsionFree: 'function',\n        toBytes: 'function',\n        wrapPrivateKey: 'boolean',\n    });\n    const { endo, Fp, a } = opts;\n    if (endo) {\n        if (!Fp.eql(a, Fp.ZERO)) {\n            throw new Error('invalid endo: CURVE.a must be 0');\n        }\n        if (typeof endo !== 'object' ||\n            typeof endo.beta !== 'bigint' ||\n            typeof endo.splitScalar !== 'function') {\n            throw new Error('invalid endo: expected \"beta\": bigint and \"splitScalar\": function');\n        }\n    }\n    return Object.freeze({ ...opts });\n}\nexport class DERErr extends Error {\n    constructor(m = '') {\n        super(m);\n    }\n}\n/**\n * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:\n *\n *     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]\n *\n * Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html\n */\nexport const DER = {\n    // asn.1 DER encoding utils\n    Err: DERErr,\n    // Basic building block is TLV (Tag-Length-Value)\n    _tlv: {\n        encode: (tag, data) => {\n            const { Err: E } = DER;\n            if (tag < 0 || tag > 256)\n                throw new E('tlv.encode: wrong tag');\n            if (data.length & 1)\n                throw new E('tlv.encode: unpadded data');\n            const dataLen = data.length / 2;\n            const len = numberToHexUnpadded(dataLen);\n            if ((len.length / 2) & 128)\n                throw new E('tlv.encode: long form length too big');\n            // length of length with long form flag\n            const lenLen = dataLen > 127 ? numberToHexUnpadded((len.length / 2) | 128) : '';\n            const t = numberToHexUnpadded(tag);\n            return t + lenLen + len + data;\n        },\n        // v - value, l - left bytes (unparsed)\n        decode(tag, data) {\n            const { Err: E } = DER;\n            let pos = 0;\n            if (tag < 0 || tag > 256)\n                throw new E('tlv.encode: wrong tag');\n            if (data.length < 2 || data[pos++] !== tag)\n                throw new E('tlv.decode: wrong tlv');\n            const first = data[pos++];\n            const isLong = !!(first & 128); // First bit of first length byte is flag for short/long form\n            let length = 0;\n            if (!isLong)\n                length = first;\n            else {\n                // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]\n                const lenLen = first & 127;\n                if (!lenLen)\n                    throw new E('tlv.decode(long): indefinite length not supported');\n                if (lenLen > 4)\n                    throw new E('tlv.decode(long): byte length is too big'); // this will overflow u32 in js\n                const lengthBytes = data.subarray(pos, pos + lenLen);\n                if (lengthBytes.length !== lenLen)\n                    throw new E('tlv.decode: length bytes not complete');\n                if (lengthBytes[0] === 0)\n                    throw new E('tlv.decode(long): zero leftmost byte');\n                for (const b of lengthBytes)\n                    length = (length << 8) | b;\n                pos += lenLen;\n                if (length < 128)\n                    throw new E('tlv.decode(long): not minimal encoding');\n            }\n            const v = data.subarray(pos, pos + length);\n            if (v.length !== length)\n                throw new E('tlv.decode: wrong value length');\n            return { v, l: data.subarray(pos + length) };\n        },\n    },\n    // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,\n    // since we always use positive integers here. It must always be empty:\n    // - add zero byte if exists\n    // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)\n    _int: {\n        encode(num) {\n            const { Err: E } = DER;\n            if (num < _0n)\n                throw new E('integer: negative integers are not allowed');\n            let hex = numberToHexUnpadded(num);\n            // Pad with zero byte if negative flag is present\n            if (Number.parseInt(hex[0], 16) & 0b1000)\n                hex = '00' + hex;\n            if (hex.length & 1)\n                throw new E('unexpected DER parsing assertion: unpadded hex');\n            return hex;\n        },\n        decode(data) {\n            const { Err: E } = DER;\n            if (data[0] & 128)\n                throw new E('invalid signature integer: negative');\n            if (data[0] === 0x00 && !(data[1] & 128))\n                throw new E('invalid signature integer: unnecessary leading zero');\n            return bytesToNumberBE(data);\n        },\n    },\n    toSig(hex) {\n        // parse DER signature\n        const { Err: E, _int: int, _tlv: tlv } = DER;\n        const data = ensureBytes('signature', hex);\n        const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);\n        if (seqLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        const { v: rBytes, l: rLeftBytes } = tlv.decode(0x02, seqBytes);\n        const { v: sBytes, l: sLeftBytes } = tlv.decode(0x02, rLeftBytes);\n        if (sLeftBytes.length)\n            throw new E('invalid signature: left bytes after parsing');\n        return { r: int.decode(rBytes), s: int.decode(sBytes) };\n    },\n    hexFromSig(sig) {\n        const { _tlv: tlv, _int: int } = DER;\n        const rs = tlv.encode(0x02, int.encode(sig.r));\n        const ss = tlv.encode(0x02, int.encode(sig.s));\n        const seq = rs + ss;\n        return tlv.encode(0x30, seq);\n    },\n};\nfunction numToSizedHex(num, size) {\n    return bytesToHex(numberToBytesBE(num, size));\n}\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);\nexport function weierstrassPoints(opts) {\n    const CURVE = validatePointOpts(opts);\n    const { Fp } = CURVE; // All curves has same field / group length as for now, but they can differ\n    const Fn = Field(CURVE.n, CURVE.nBitLength);\n    const toBytes = CURVE.toBytes ||\n        ((_c, point, _isCompressed) => {\n            const a = point.toAffine();\n            return concatBytes(Uint8Array.from([0x04]), Fp.toBytes(a.x), Fp.toBytes(a.y));\n        });\n    const fromBytes = CURVE.fromBytes ||\n        ((bytes) => {\n            // const head = bytes[0];\n            const tail = bytes.subarray(1);\n            // if (head !== 0x04) throw new Error('Only non-compressed encoding is supported');\n            const x = Fp.fromBytes(tail.subarray(0, Fp.BYTES));\n            const y = Fp.fromBytes(tail.subarray(Fp.BYTES, 2 * Fp.BYTES));\n            return { x, y };\n        });\n    /**\n     * y² = x³ + ax + b: Short weierstrass curve formula. Takes x, returns y².\n     * @returns y²\n     */\n    function weierstrassEquation(x) {\n        const { a, b } = CURVE;\n        const x2 = Fp.sqr(x); // x * x\n        const x3 = Fp.mul(x2, x); // x² * x\n        return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x³ + a * x + b\n    }\n    function isValidXY(x, y) {\n        const left = Fp.sqr(y); // y²\n        const right = weierstrassEquation(x); // x³ + ax + b\n        return Fp.eql(left, right);\n    }\n    // Validate whether the passed curve params are valid.\n    // Test 1: equation y² = x³ + ax + b should work for generator point.\n    if (!isValidXY(CURVE.Gx, CURVE.Gy))\n        throw new Error('bad curve params: generator point');\n    // Test 2: discriminant Δ part should be non-zero: 4a³ + 27b² != 0.\n    // Guarantees curve is genus-1, smooth (non-singular).\n    const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);\n    const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));\n    if (Fp.is0(Fp.add(_4a3, _27b2)))\n        throw new Error('bad curve params: a or b');\n    // Valid group elements reside in range 1..n-1\n    function isWithinCurveOrder(num) {\n        return inRange(num, _1n, CURVE.n);\n    }\n    // Validates if priv key is valid and converts it to bigint.\n    // Supports options allowedPrivateKeyLengths and wrapPrivateKey.\n    function normPrivateKeyToScalar(key) {\n        const { allowedPrivateKeyLengths: lengths, nByteLength, wrapPrivateKey, n: N } = CURVE;\n        if (lengths && typeof key !== 'bigint') {\n            if (isBytes(key))\n                key = bytesToHex(key);\n            // Normalize to hex string, pad. E.g. P521 would norm 130-132 char hex to 132-char bytes\n            if (typeof key !== 'string' || !lengths.includes(key.length))\n                throw new Error('invalid private key');\n            key = key.padStart(nByteLength * 2, '0');\n        }\n        let num;\n        try {\n            num =\n                typeof key === 'bigint'\n                    ? key\n                    : bytesToNumberBE(ensureBytes('private key', key, nByteLength));\n        }\n        catch (error) {\n            throw new Error('invalid private key, expected hex or ' + nByteLength + ' bytes, got ' + typeof key);\n        }\n        if (wrapPrivateKey)\n            num = mod(num, N); // disabled by default, enabled for BLS\n        aInRange('private key', num, _1n, N); // num in range [1..N-1]\n        return num;\n    }\n    function aprjpoint(other) {\n        if (!(other instanceof Point))\n            throw new Error('ProjectivePoint expected');\n    }\n    // Memoized toAffine / validity check. They are heavy. Points are immutable.\n    // Converts Projective point to affine (x, y) coordinates.\n    // Can accept precomputed Z^-1 - for example, from invertBatch.\n    // (X, Y, Z) ∋ (x=X/Z, y=Y/Z)\n    const toAffineMemo = memoized((p, iz) => {\n        const { px: x, py: y, pz: z } = p;\n        // Fast-path for normalized points\n        if (Fp.eql(z, Fp.ONE))\n            return { x, y };\n        const is0 = p.is0();\n        // If invZ was 0, we return zero point. However we still want to execute\n        // all operations, so we replace invZ with a random number, 1.\n        if (iz == null)\n            iz = is0 ? Fp.ONE : Fp.inv(z);\n        const ax = Fp.mul(x, iz);\n        const ay = Fp.mul(y, iz);\n        const zz = Fp.mul(z, iz);\n        if (is0)\n            return { x: Fp.ZERO, y: Fp.ZERO };\n        if (!Fp.eql(zz, Fp.ONE))\n            throw new Error('invZ was invalid');\n        return { x: ax, y: ay };\n    });\n    // NOTE: on exception this will crash 'cached' and no value will be set.\n    // Otherwise true will be return\n    const assertValidMemo = memoized((p) => {\n        if (p.is0()) {\n            // (0, 1, 0) aka ZERO is invalid in most contexts.\n            // In BLS, ZERO can be serialized, so we allow it.\n            // (0, 0, 0) is invalid representation of ZERO.\n            if (CURVE.allowInfinityPoint && !Fp.is0(p.py))\n                return;\n            throw new Error('bad point: ZERO');\n        }\n        // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`\n        const { x, y } = p.toAffine();\n        // Check if x, y are valid field elements\n        if (!Fp.isValid(x) || !Fp.isValid(y))\n            throw new Error('bad point: x or y not FE');\n        if (!isValidXY(x, y))\n            throw new Error('bad point: equation left != right');\n        if (!p.isTorsionFree())\n            throw new Error('bad point: not in prime-order subgroup');\n        return true;\n    });\n    /**\n     * Projective Point works in 3d / projective (homogeneous) coordinates: (X, Y, Z) ∋ (x=X/Z, y=Y/Z)\n     * Default Point works in 2d / affine coordinates: (x, y)\n     * We're doing calculations in projective, because its operations don't require costly inversion.\n     */\n    class Point {\n        constructor(px, py, pz) {\n            if (px == null || !Fp.isValid(px))\n                throw new Error('x required');\n            if (py == null || !Fp.isValid(py) || Fp.is0(py))\n                throw new Error('y required');\n            if (pz == null || !Fp.isValid(pz))\n                throw new Error('z required');\n            this.px = px;\n            this.py = py;\n            this.pz = pz;\n            Object.freeze(this);\n        }\n        // Does not validate if the point is on-curve.\n        // Use fromHex instead, or call assertValidity() later.\n        static fromAffine(p) {\n            const { x, y } = p || {};\n            if (!p || !Fp.isValid(x) || !Fp.isValid(y))\n                throw new Error('invalid affine point');\n            if (p instanceof Point)\n                throw new Error('projective point not allowed');\n            const is0 = (i) => Fp.eql(i, Fp.ZERO);\n            // fromAffine(x:0, y:0) would produce (x:0, y:0, z:1), but we need (x:0, y:1, z:0)\n            if (is0(x) && is0(y))\n                return Point.ZERO;\n            return new Point(x, y, Fp.ONE);\n        }\n        get x() {\n            return this.toAffine().x;\n        }\n        get y() {\n            return this.toAffine().y;\n        }\n        /**\n         * Takes a bunch of Projective Points but executes only one\n         * inversion on all of them. Inversion is very slow operation,\n         * so this improves performance massively.\n         * Optimization: converts a list of projective points to a list of identical points with Z=1.\n         */\n        static normalizeZ(points) {\n            const toInv = FpInvertBatch(Fp, points.map((p) => p.pz));\n            return points.map((p, i) => p.toAffine(toInv[i])).map(Point.fromAffine);\n        }\n        /**\n         * Converts hash string or Uint8Array to Point.\n         * @param hex short/long ECDSA hex\n         */\n        static fromHex(hex) {\n            const P = Point.fromAffine(fromBytes(ensureBytes('pointHex', hex)));\n            P.assertValidity();\n            return P;\n        }\n        // Multiplies generator point by privateKey.\n        static fromPrivateKey(privateKey) {\n            return Point.BASE.multiply(normPrivateKeyToScalar(privateKey));\n        }\n        // Multiscalar Multiplication\n        static msm(points, scalars) {\n            return pippenger(Point, Fn, points, scalars);\n        }\n        // \"Private method\", don't use it directly\n        _setWindowSize(windowSize) {\n            wnaf.setWindowSize(this, windowSize);\n        }\n        // A point on curve is valid if it conforms to equation.\n        assertValidity() {\n            assertValidMemo(this);\n        }\n        hasEvenY() {\n            const { y } = this.toAffine();\n            if (Fp.isOdd)\n                return !Fp.isOdd(y);\n            throw new Error(\"Field doesn't support isOdd\");\n        }\n        /**\n         * Compare one point to another.\n         */\n        equals(other) {\n            aprjpoint(other);\n            const { px: X1, py: Y1, pz: Z1 } = this;\n            const { px: X2, py: Y2, pz: Z2 } = other;\n            const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));\n            const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));\n            return U1 && U2;\n        }\n        /**\n         * Flips point to one corresponding to (x, -y) in Affine coordinates.\n         */\n        negate() {\n            return new Point(this.px, Fp.neg(this.py), this.pz);\n        }\n        // Renes-Costello-Batina exception-free doubling formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 3\n        // Cost: 8M + 3S + 3*a + 2*b3 + 15add.\n        double() {\n            const { a, b } = CURVE;\n            const b3 = Fp.mul(b, _3n);\n            const { px: X1, py: Y1, pz: Z1 } = this;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            let t0 = Fp.mul(X1, X1); // step 1\n            let t1 = Fp.mul(Y1, Y1);\n            let t2 = Fp.mul(Z1, Z1);\n            let t3 = Fp.mul(X1, Y1);\n            t3 = Fp.add(t3, t3); // step 5\n            Z3 = Fp.mul(X1, Z1);\n            Z3 = Fp.add(Z3, Z3);\n            X3 = Fp.mul(a, Z3);\n            Y3 = Fp.mul(b3, t2);\n            Y3 = Fp.add(X3, Y3); // step 10\n            X3 = Fp.sub(t1, Y3);\n            Y3 = Fp.add(t1, Y3);\n            Y3 = Fp.mul(X3, Y3);\n            X3 = Fp.mul(t3, X3);\n            Z3 = Fp.mul(b3, Z3); // step 15\n            t2 = Fp.mul(a, t2);\n            t3 = Fp.sub(t0, t2);\n            t3 = Fp.mul(a, t3);\n            t3 = Fp.add(t3, Z3);\n            Z3 = Fp.add(t0, t0); // step 20\n            t0 = Fp.add(Z3, t0);\n            t0 = Fp.add(t0, t2);\n            t0 = Fp.mul(t0, t3);\n            Y3 = Fp.add(Y3, t0);\n            t2 = Fp.mul(Y1, Z1); // step 25\n            t2 = Fp.add(t2, t2);\n            t0 = Fp.mul(t2, t3);\n            X3 = Fp.sub(X3, t0);\n            Z3 = Fp.mul(t2, t1);\n            Z3 = Fp.add(Z3, Z3); // step 30\n            Z3 = Fp.add(Z3, Z3);\n            return new Point(X3, Y3, Z3);\n        }\n        // Renes-Costello-Batina exception-free addition formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 1\n        // Cost: 12M + 0S + 3*a + 3*b3 + 23add.\n        add(other) {\n            aprjpoint(other);\n            const { px: X1, py: Y1, pz: Z1 } = this;\n            const { px: X2, py: Y2, pz: Z2 } = other;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            const a = CURVE.a;\n            const b3 = Fp.mul(CURVE.b, _3n);\n            let t0 = Fp.mul(X1, X2); // step 1\n            let t1 = Fp.mul(Y1, Y2);\n            let t2 = Fp.mul(Z1, Z2);\n            let t3 = Fp.add(X1, Y1);\n            let t4 = Fp.add(X2, Y2); // step 5\n            t3 = Fp.mul(t3, t4);\n            t4 = Fp.add(t0, t1);\n            t3 = Fp.sub(t3, t4);\n            t4 = Fp.add(X1, Z1);\n            let t5 = Fp.add(X2, Z2); // step 10\n            t4 = Fp.mul(t4, t5);\n            t5 = Fp.add(t0, t2);\n            t4 = Fp.sub(t4, t5);\n            t5 = Fp.add(Y1, Z1);\n            X3 = Fp.add(Y2, Z2); // step 15\n            t5 = Fp.mul(t5, X3);\n            X3 = Fp.add(t1, t2);\n            t5 = Fp.sub(t5, X3);\n            Z3 = Fp.mul(a, t4);\n            X3 = Fp.mul(b3, t2); // step 20\n            Z3 = Fp.add(X3, Z3);\n            X3 = Fp.sub(t1, Z3);\n            Z3 = Fp.add(t1, Z3);\n            Y3 = Fp.mul(X3, Z3);\n            t1 = Fp.add(t0, t0); // step 25\n            t1 = Fp.add(t1, t0);\n            t2 = Fp.mul(a, t2);\n            t4 = Fp.mul(b3, t4);\n            t1 = Fp.add(t1, t2);\n            t2 = Fp.sub(t0, t2); // step 30\n            t2 = Fp.mul(a, t2);\n            t4 = Fp.add(t4, t2);\n            t0 = Fp.mul(t1, t4);\n            Y3 = Fp.add(Y3, t0);\n            t0 = Fp.mul(t5, t4); // step 35\n            X3 = Fp.mul(t3, X3);\n            X3 = Fp.sub(X3, t0);\n            t0 = Fp.mul(t3, t1);\n            Z3 = Fp.mul(t5, Z3);\n            Z3 = Fp.add(Z3, t0); // step 40\n            return new Point(X3, Y3, Z3);\n        }\n        subtract(other) {\n            return this.add(other.negate());\n        }\n        is0() {\n            return this.equals(Point.ZERO);\n        }\n        wNAF(n) {\n            return wnaf.wNAFCached(this, n, Point.normalizeZ);\n        }\n        /**\n         * Non-constant-time multiplication. Uses double-and-add algorithm.\n         * It's faster, but should only be used when you don't care about\n         * an exposed private key e.g. sig verification, which works over *public* keys.\n         */\n        multiplyUnsafe(sc) {\n            const { endo, n: N } = CURVE;\n            aInRange('scalar', sc, _0n, N);\n            const I = Point.ZERO;\n            if (sc === _0n)\n                return I;\n            if (this.is0() || sc === _1n)\n                return this;\n            // Case a: no endomorphism. Case b: has precomputes.\n            if (!endo || wnaf.hasPrecomputes(this))\n                return wnaf.wNAFCachedUnsafe(this, sc, Point.normalizeZ);\n            // Case c: endomorphism\n            /** See docs for {@link EndomorphismOpts} */\n            let { k1neg, k1, k2neg, k2 } = endo.splitScalar(sc);\n            let k1p = I;\n            let k2p = I;\n            let d = this;\n            while (k1 > _0n || k2 > _0n) {\n                if (k1 & _1n)\n                    k1p = k1p.add(d);\n                if (k2 & _1n)\n                    k2p = k2p.add(d);\n                d = d.double();\n                k1 >>= _1n;\n                k2 >>= _1n;\n            }\n            if (k1neg)\n                k1p = k1p.negate();\n            if (k2neg)\n                k2p = k2p.negate();\n            k2p = new Point(Fp.mul(k2p.px, endo.beta), k2p.py, k2p.pz);\n            return k1p.add(k2p);\n        }\n        /**\n         * Constant time multiplication.\n         * Uses wNAF method. Windowed method may be 10% faster,\n         * but takes 2x longer to generate and consumes 2x memory.\n         * Uses precomputes when available.\n         * Uses endomorphism for Koblitz curves.\n         * @param scalar by which the point would be multiplied\n         * @returns New point\n         */\n        multiply(scalar) {\n            const { endo, n: N } = CURVE;\n            aInRange('scalar', scalar, _1n, N);\n            let point, fake; // Fake point is used to const-time mult\n            /** See docs for {@link EndomorphismOpts} */\n            if (endo) {\n                const { k1neg, k1, k2neg, k2 } = endo.splitScalar(scalar);\n                let { p: k1p, f: f1p } = this.wNAF(k1);\n                let { p: k2p, f: f2p } = this.wNAF(k2);\n                k1p = wnaf.constTimeNegate(k1neg, k1p);\n                k2p = wnaf.constTimeNegate(k2neg, k2p);\n                k2p = new Point(Fp.mul(k2p.px, endo.beta), k2p.py, k2p.pz);\n                point = k1p.add(k2p);\n                fake = f1p.add(f2p);\n            }\n            else {\n                const { p, f } = this.wNAF(scalar);\n                point = p;\n                fake = f;\n            }\n            // Normalize `z` for both points, but return only real one\n            return Point.normalizeZ([point, fake])[0];\n        }\n        /**\n         * Efficiently calculate `aP + bQ`. Unsafe, can expose private key, if used incorrectly.\n         * Not using Strauss-Shamir trick: precomputation tables are faster.\n         * The trick could be useful if both P and Q are not G (not in our case).\n         * @returns non-zero affine point\n         */\n        multiplyAndAddUnsafe(Q, a, b) {\n            const G = Point.BASE; // No Strauss-Shamir trick: we have 10% faster G precomputes\n            const mul = (P, a // Select faster multiply() method\n            ) => (a === _0n || a === _1n || !P.equals(G) ? P.multiplyUnsafe(a) : P.multiply(a));\n            const sum = mul(this, a).add(mul(Q, b));\n            return sum.is0() ? undefined : sum;\n        }\n        // Converts Projective point to affine (x, y) coordinates.\n        // Can accept precomputed Z^-1 - for example, from invertBatch.\n        // (x, y, z) ∋ (x=x/z, y=y/z)\n        toAffine(iz) {\n            return toAffineMemo(this, iz);\n        }\n        isTorsionFree() {\n            const { h: cofactor, isTorsionFree } = CURVE;\n            if (cofactor === _1n)\n                return true; // No subgroups, always torsion-free\n            if (isTorsionFree)\n                return isTorsionFree(Point, this);\n            throw new Error('isTorsionFree() has not been declared for the elliptic curve');\n        }\n        clearCofactor() {\n            const { h: cofactor, clearCofactor } = CURVE;\n            if (cofactor === _1n)\n                return this; // Fast-path\n            if (clearCofactor)\n                return clearCofactor(Point, this);\n            return this.multiplyUnsafe(CURVE.h);\n        }\n        toRawBytes(isCompressed = true) {\n            abool('isCompressed', isCompressed);\n            this.assertValidity();\n            return toBytes(Point, this, isCompressed);\n        }\n        toHex(isCompressed = true) {\n            abool('isCompressed', isCompressed);\n            return bytesToHex(this.toRawBytes(isCompressed));\n        }\n    }\n    // base / generator point\n    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);\n    // zero / infinity / identity point\n    Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO); // 0, 1, 0\n    const { endo, nBitLength } = CURVE;\n    const wnaf = wNAF(Point, endo ? Math.ceil(nBitLength / 2) : nBitLength);\n    return {\n        CURVE,\n        ProjectivePoint: Point,\n        normPrivateKeyToScalar,\n        weierstrassEquation,\n        isWithinCurveOrder,\n    };\n}\nfunction validateOpts(curve) {\n    const opts = validateBasic(curve);\n    validateObject(opts, {\n        hash: 'hash',\n        hmac: 'function',\n        randomBytes: 'function',\n    }, {\n        bits2int: 'function',\n        bits2int_modN: 'function',\n        lowS: 'boolean',\n    });\n    return Object.freeze({ lowS: true, ...opts });\n}\n/**\n * Creates short weierstrass curve and ECDSA signature methods for it.\n * @example\n * import { Field } from '@noble/curves/abstract/modular';\n * // Before that, define BigInt-s: a, b, p, n, Gx, Gy\n * const curve = weierstrass({ a, b, Fp: Field(p), n, Gx, Gy, h: 1n })\n */\nexport function weierstrass(curveDef) {\n    const CURVE = validateOpts(curveDef);\n    const { Fp, n: CURVE_ORDER, nByteLength, nBitLength } = CURVE;\n    const compressedLen = Fp.BYTES + 1; // e.g. 33 for 32\n    const uncompressedLen = 2 * Fp.BYTES + 1; // e.g. 65 for 32\n    function modN(a) {\n        return mod(a, CURVE_ORDER);\n    }\n    function invN(a) {\n        return invert(a, CURVE_ORDER);\n    }\n    const { ProjectivePoint: Point, normPrivateKeyToScalar, weierstrassEquation, isWithinCurveOrder, } = weierstrassPoints({\n        ...CURVE,\n        toBytes(_c, point, isCompressed) {\n            const a = point.toAffine();\n            const x = Fp.toBytes(a.x);\n            const cat = concatBytes;\n            abool('isCompressed', isCompressed);\n            if (isCompressed) {\n                return cat(Uint8Array.from([point.hasEvenY() ? 0x02 : 0x03]), x);\n            }\n            else {\n                return cat(Uint8Array.from([0x04]), x, Fp.toBytes(a.y));\n            }\n        },\n        fromBytes(bytes) {\n            const len = bytes.length;\n            const head = bytes[0];\n            const tail = bytes.subarray(1);\n            // this.assertValidity() is done inside of fromHex\n            if (len === compressedLen && (head === 0x02 || head === 0x03)) {\n                const x = bytesToNumberBE(tail);\n                if (!inRange(x, _1n, Fp.ORDER))\n                    throw new Error('Point is not on curve');\n                const y2 = weierstrassEquation(x); // y² = x³ + ax + b\n                let y;\n                try {\n                    y = Fp.sqrt(y2); // y = y² ^ (p+1)/4\n                }\n                catch (sqrtError) {\n                    const suffix = sqrtError instanceof Error ? ': ' + sqrtError.message : '';\n                    throw new Error('Point is not on curve' + suffix);\n                }\n                const isYOdd = (y & _1n) === _1n;\n                // ECDSA\n                const isHeadOdd = (head & 1) === 1;\n                if (isHeadOdd !== isYOdd)\n                    y = Fp.neg(y);\n                return { x, y };\n            }\n            else if (len === uncompressedLen && head === 0x04) {\n                const x = Fp.fromBytes(tail.subarray(0, Fp.BYTES));\n                const y = Fp.fromBytes(tail.subarray(Fp.BYTES, 2 * Fp.BYTES));\n                return { x, y };\n            }\n            else {\n                const cl = compressedLen;\n                const ul = uncompressedLen;\n                throw new Error('invalid Point, expected length of ' + cl + ', or uncompressed ' + ul + ', got ' + len);\n            }\n        },\n    });\n    function isBiggerThanHalfOrder(number) {\n        const HALF = CURVE_ORDER >> _1n;\n        return number > HALF;\n    }\n    function normalizeS(s) {\n        return isBiggerThanHalfOrder(s) ? modN(-s) : s;\n    }\n    // slice bytes num\n    const slcNum = (b, from, to) => bytesToNumberBE(b.slice(from, to));\n    /**\n     * ECDSA signature with its (r, s) properties. Supports DER & compact representations.\n     */\n    class Signature {\n        constructor(r, s, recovery) {\n            aInRange('r', r, _1n, CURVE_ORDER); // r in [1..N]\n            aInRange('s', s, _1n, CURVE_ORDER); // s in [1..N]\n            this.r = r;\n            this.s = s;\n            if (recovery != null)\n                this.recovery = recovery;\n            Object.freeze(this);\n        }\n        // pair (bytes of r, bytes of s)\n        static fromCompact(hex) {\n            const l = nByteLength;\n            hex = ensureBytes('compactSignature', hex, l * 2);\n            return new Signature(slcNum(hex, 0, l), slcNum(hex, l, 2 * l));\n        }\n        // DER encoded ECDSA signature\n        // https://bitcoin.stackexchange.com/questions/57644/what-are-the-parts-of-a-bitcoin-transaction-input-script\n        static fromDER(hex) {\n            const { r, s } = DER.toSig(ensureBytes('DER', hex));\n            return new Signature(r, s);\n        }\n        /**\n         * @todo remove\n         * @deprecated\n         */\n        assertValidity() { }\n        addRecoveryBit(recovery) {\n            return new Signature(this.r, this.s, recovery);\n        }\n        recoverPublicKey(msgHash) {\n            const { r, s, recovery: rec } = this;\n            const h = bits2int_modN(ensureBytes('msgHash', msgHash)); // Truncate hash\n            if (rec == null || ![0, 1, 2, 3].includes(rec))\n                throw new Error('recovery id invalid');\n            const radj = rec === 2 || rec === 3 ? r + CURVE.n : r;\n            if (radj >= Fp.ORDER)\n                throw new Error('recovery id 2 or 3 invalid');\n            const prefix = (rec & 1) === 0 ? '02' : '03';\n            const R = Point.fromHex(prefix + numToSizedHex(radj, Fp.BYTES));\n            const ir = invN(radj); // r^-1\n            const u1 = modN(-h * ir); // -hr^-1\n            const u2 = modN(s * ir); // sr^-1\n            const Q = Point.BASE.multiplyAndAddUnsafe(R, u1, u2); // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1)\n            if (!Q)\n                throw new Error('point at infinify'); // unsafe is fine: no priv data leaked\n            Q.assertValidity();\n            return Q;\n        }\n        // Signatures should be low-s, to prevent malleability.\n        hasHighS() {\n            return isBiggerThanHalfOrder(this.s);\n        }\n        normalizeS() {\n            return this.hasHighS() ? new Signature(this.r, modN(-this.s), this.recovery) : this;\n        }\n        // DER-encoded\n        toDERRawBytes() {\n            return hexToBytes(this.toDERHex());\n        }\n        toDERHex() {\n            return DER.hexFromSig(this);\n        }\n        // padded bytes of r, then padded bytes of s\n        toCompactRawBytes() {\n            return hexToBytes(this.toCompactHex());\n        }\n        toCompactHex() {\n            const l = nByteLength;\n            return numToSizedHex(this.r, l) + numToSizedHex(this.s, l);\n        }\n    }\n    const utils = {\n        isValidPrivateKey(privateKey) {\n            try {\n                normPrivateKeyToScalar(privateKey);\n                return true;\n            }\n            catch (error) {\n                return false;\n            }\n        },\n        normPrivateKeyToScalar: normPrivateKeyToScalar,\n        /**\n         * Produces cryptographically secure private key from random of size\n         * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.\n         */\n        randomPrivateKey: () => {\n            const length = getMinHashLength(CURVE.n);\n            return mapHashToField(CURVE.randomBytes(length), CURVE.n);\n        },\n        /**\n         * Creates precompute table for an arbitrary EC point. Makes point \"cached\".\n         * Allows to massively speed-up `point.multiply(scalar)`.\n         * @returns cached point\n         * @example\n         * const fast = utils.precompute(8, ProjectivePoint.fromHex(someonesPubKey));\n         * fast.multiply(privKey); // much faster ECDH now\n         */\n        precompute(windowSize = 8, point = Point.BASE) {\n            point._setWindowSize(windowSize);\n            point.multiply(BigInt(3)); // 3 is arbitrary, just need any number here\n            return point;\n        },\n    };\n    /**\n     * Computes public key for a private key. Checks for validity of the private key.\n     * @param privateKey private key\n     * @param isCompressed whether to return compact (default), or full key\n     * @returns Public key, full when isCompressed=false; short when isCompressed=true\n     */\n    function getPublicKey(privateKey, isCompressed = true) {\n        return Point.fromPrivateKey(privateKey).toRawBytes(isCompressed);\n    }\n    /**\n     * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.\n     */\n    function isProbPub(item) {\n        if (typeof item === 'bigint')\n            return false;\n        if (item instanceof Point)\n            return true;\n        const arr = ensureBytes('key', item);\n        const len = arr.length;\n        const fpl = Fp.BYTES;\n        const compLen = fpl + 1; // e.g. 33 for 32\n        const uncompLen = 2 * fpl + 1; // e.g. 65 for 32\n        if (CURVE.allowedPrivateKeyLengths || nByteLength === compLen) {\n            return undefined;\n        }\n        else {\n            return len === compLen || len === uncompLen;\n        }\n    }\n    /**\n     * ECDH (Elliptic Curve Diffie Hellman).\n     * Computes shared public key from private key and public key.\n     * Checks: 1) private key validity 2) shared key is on-curve.\n     * Does NOT hash the result.\n     * @param privateA private key\n     * @param publicB different public key\n     * @param isCompressed whether to return compact (default), or full key\n     * @returns shared public key\n     */\n    function getSharedSecret(privateA, publicB, isCompressed = true) {\n        if (isProbPub(privateA) === true)\n            throw new Error('first arg must be private key');\n        if (isProbPub(publicB) === false)\n            throw new Error('second arg must be public key');\n        const b = Point.fromHex(publicB); // check for being on-curve\n        return b.multiply(normPrivateKeyToScalar(privateA)).toRawBytes(isCompressed);\n    }\n    // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.\n    // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.\n    // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.\n    // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors\n    const bits2int = CURVE.bits2int ||\n        function (bytes) {\n            // Our custom check \"just in case\", for protection against DoS\n            if (bytes.length > 8192)\n                throw new Error('input is too large');\n            // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)\n            // for some cases, since bytes.length * 8 is not actual bitLength.\n            const num = bytesToNumberBE(bytes); // check for == u8 done here\n            const delta = bytes.length * 8 - nBitLength; // truncate to nBitLength leftmost bits\n            return delta > 0 ? num >> BigInt(delta) : num;\n        };\n    const bits2int_modN = CURVE.bits2int_modN ||\n        function (bytes) {\n            return modN(bits2int(bytes)); // can't use bytesToNumberBE here\n        };\n    // NOTE: pads output with zero as per spec\n    const ORDER_MASK = bitMask(nBitLength);\n    /**\n     * Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`.\n     */\n    function int2octets(num) {\n        aInRange('num < 2^' + nBitLength, num, _0n, ORDER_MASK);\n        // works with order, can have different size than numToField!\n        return numberToBytesBE(num, nByteLength);\n    }\n    // Steps A, D of RFC6979 3.2\n    // Creates RFC6979 seed; converts msg/privKey to numbers.\n    // Used only in sign, not in verify.\n    // NOTE: we cannot assume here that msgHash has same amount of bytes as curve order,\n    // this will be invalid at least for P521. Also it can be bigger for P224 + SHA256\n    function prepSig(msgHash, privateKey, opts = defaultSigOpts) {\n        if (['recovered', 'canonical'].some((k) => k in opts))\n            throw new Error('sign() legacy options not supported');\n        const { hash, randomBytes } = CURVE;\n        let { lowS, prehash, extraEntropy: ent } = opts; // generates low-s sigs by default\n        if (lowS == null)\n            lowS = true; // RFC6979 3.2: we skip step A, because we already provide hash\n        msgHash = ensureBytes('msgHash', msgHash);\n        validateSigVerOpts(opts);\n        if (prehash)\n            msgHash = ensureBytes('prehashed msgHash', hash(msgHash));\n        // We can't later call bits2octets, since nested bits2int is broken for curves\n        // with nBitLength % 8 !== 0. Because of that, we unwrap it here as int2octets call.\n        // const bits2octets = (bits) => int2octets(bits2int_modN(bits))\n        const h1int = bits2int_modN(msgHash);\n        const d = normPrivateKeyToScalar(privateKey); // validate private key, convert to bigint\n        const seedArgs = [int2octets(d), int2octets(h1int)];\n        // extraEntropy. RFC6979 3.6: additional k' (optional).\n        if (ent != null && ent !== false) {\n            // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')\n            const e = ent === true ? randomBytes(Fp.BYTES) : ent; // generate random bytes OR pass as-is\n            seedArgs.push(ensureBytes('extraEntropy', e)); // check for being bytes\n        }\n        const seed = concatBytes(...seedArgs); // Step D of RFC6979 3.2\n        const m = h1int; // NOTE: no need to call bits2int second time here, it is inside truncateHash!\n        // Converts signature params into point w r/s, checks result for validity.\n        function k2sig(kBytes) {\n            // RFC 6979 Section 3.2, step 3: k = bits2int(T)\n            const k = bits2int(kBytes); // Cannot use fields methods, since it is group element\n            if (!isWithinCurveOrder(k))\n                return; // Important: all mod() calls here must be done over N\n            const ik = invN(k); // k^-1 mod n\n            const q = Point.BASE.multiply(k).toAffine(); // q = Gk\n            const r = modN(q.x); // r = q.x mod n\n            if (r === _0n)\n                return;\n            // Can use scalar blinding b^-1(bm + bdr) where b ∈ [1,q−1] according to\n            // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. We've decided against it:\n            // a) dependency on CSPRNG b) 15% slowdown c) doesn't really help since bigints are not CT\n            const s = modN(ik * modN(m + r * d)); // Not using blinding here\n            if (s === _0n)\n                return;\n            let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3, when q.x > n)\n            let normS = s;\n            if (lowS && isBiggerThanHalfOrder(s)) {\n                normS = normalizeS(s); // if lowS was passed, ensure s is always\n                recovery ^= 1; // // in the bottom half of N\n            }\n            return new Signature(r, normS, recovery); // use normS, not s\n        }\n        return { seed, k2sig };\n    }\n    const defaultSigOpts = { lowS: CURVE.lowS, prehash: false };\n    const defaultVerOpts = { lowS: CURVE.lowS, prehash: false };\n    /**\n     * Signs message hash with a private key.\n     * ```\n     * sign(m, d, k) where\n     *   (x, y) = G × k\n     *   r = x mod n\n     *   s = (m + dr)/k mod n\n     * ```\n     * @param msgHash NOT message. msg needs to be hashed to `msgHash`, or use `prehash`.\n     * @param privKey private key\n     * @param opts lowS for non-malleable sigs. extraEntropy for mixing randomness into k. prehash will hash first arg.\n     * @returns signature with recovery param\n     */\n    function sign(msgHash, privKey, opts = defaultSigOpts) {\n        const { seed, k2sig } = prepSig(msgHash, privKey, opts); // Steps A, D of RFC6979 3.2.\n        const C = CURVE;\n        const drbg = createHmacDrbg(C.hash.outputLen, C.nByteLength, C.hmac);\n        return drbg(seed, k2sig); // Steps B, C, D, E, F, G\n    }\n    // Enable precomputes. Slows down first publicKey computation by 20ms.\n    Point.BASE._setWindowSize(8);\n    // utils.precompute(8, ProjectivePoint.BASE)\n    /**\n     * Verifies a signature against message hash and public key.\n     * Rejects lowS signatures by default: to override,\n     * specify option `{lowS: false}`. Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:\n     *\n     * ```\n     * verify(r, s, h, P) where\n     *   U1 = hs^-1 mod n\n     *   U2 = rs^-1 mod n\n     *   R = U1⋅G - U2⋅P\n     *   mod(R.x, n) == r\n     * ```\n     */\n    function verify(signature, msgHash, publicKey, opts = defaultVerOpts) {\n        const sg = signature;\n        msgHash = ensureBytes('msgHash', msgHash);\n        publicKey = ensureBytes('publicKey', publicKey);\n        const { lowS, prehash, format } = opts;\n        // Verify opts, deduce signature format\n        validateSigVerOpts(opts);\n        if ('strict' in opts)\n            throw new Error('options.strict was renamed to lowS');\n        if (format !== undefined && format !== 'compact' && format !== 'der')\n            throw new Error('format must be compact or der');\n        const isHex = typeof sg === 'string' || isBytes(sg);\n        const isObj = !isHex &&\n            !format &&\n            typeof sg === 'object' &&\n            sg !== null &&\n            typeof sg.r === 'bigint' &&\n            typeof sg.s === 'bigint';\n        if (!isHex && !isObj)\n            throw new Error('invalid signature, expected Uint8Array, hex string or Signature instance');\n        let _sig = undefined;\n        let P;\n        try {\n            if (isObj)\n                _sig = new Signature(sg.r, sg.s);\n            if (isHex) {\n                // Signature can be represented in 2 ways: compact (2*nByteLength) & DER (variable-length).\n                // Since DER can also be 2*nByteLength bytes, we check for it first.\n                try {\n                    if (format !== 'compact')\n                        _sig = Signature.fromDER(sg);\n                }\n                catch (derError) {\n                    if (!(derError instanceof DER.Err))\n                        throw derError;\n                }\n                if (!_sig && format !== 'der')\n                    _sig = Signature.fromCompact(sg);\n            }\n            P = Point.fromHex(publicKey);\n        }\n        catch (error) {\n            return false;\n        }\n        if (!_sig)\n            return false;\n        if (lowS && _sig.hasHighS())\n            return false;\n        if (prehash)\n            msgHash = CURVE.hash(msgHash);\n        const { r, s } = _sig;\n        const h = bits2int_modN(msgHash); // Cannot use fields methods, since it is group element\n        const is = invN(s); // s^-1\n        const u1 = modN(h * is); // u1 = hs^-1 mod n\n        const u2 = modN(r * is); // u2 = rs^-1 mod n\n        const R = Point.BASE.multiplyAndAddUnsafe(P, u1, u2)?.toAffine(); // R = u1⋅G + u2⋅P\n        if (!R)\n            return false;\n        const v = modN(R.x);\n        return v === r;\n    }\n    return {\n        CURVE,\n        getPublicKey,\n        getSharedSecret,\n        sign,\n        verify,\n        ProjectivePoint: Point,\n        Signature,\n        utils,\n    };\n}\n/**\n * Implementation of the Shallue and van de Woestijne method for any weierstrass curve.\n * TODO: check if there is a way to merge this with uvRatio in Edwards; move to modular.\n * b = True and y = sqrt(u / v) if (u / v) is square in F, and\n * b = False and y = sqrt(Z * (u / v)) otherwise.\n * @param Fp\n * @param Z\n * @returns\n */\nexport function SWUFpSqrtRatio(Fp, Z) {\n    // Generic implementation\n    const q = Fp.ORDER;\n    let l = _0n;\n    for (let o = q - _1n; o % _2n === _0n; o /= _2n)\n        l += _1n;\n    const c1 = l; // 1. c1, the largest integer such that 2^c1 divides q - 1.\n    // We need 2n ** c1 and 2n ** (c1-1). We can't use **; but we can use <<.\n    // 2n ** c1 == 2n << (c1-1)\n    const _2n_pow_c1_1 = _2n << (c1 - _1n - _1n);\n    const _2n_pow_c1 = _2n_pow_c1_1 * _2n;\n    const c2 = (q - _1n) / _2n_pow_c1; // 2. c2 = (q - 1) / (2^c1)  # Integer arithmetic\n    const c3 = (c2 - _1n) / _2n; // 3. c3 = (c2 - 1) / 2            # Integer arithmetic\n    const c4 = _2n_pow_c1 - _1n; // 4. c4 = 2^c1 - 1                # Integer arithmetic\n    const c5 = _2n_pow_c1_1; // 5. c5 = 2^(c1 - 1)                  # Integer arithmetic\n    const c6 = Fp.pow(Z, c2); // 6. c6 = Z^c2\n    const c7 = Fp.pow(Z, (c2 + _1n) / _2n); // 7. c7 = Z^((c2 + 1) / 2)\n    let sqrtRatio = (u, v) => {\n        let tv1 = c6; // 1. tv1 = c6\n        let tv2 = Fp.pow(v, c4); // 2. tv2 = v^c4\n        let tv3 = Fp.sqr(tv2); // 3. tv3 = tv2^2\n        tv3 = Fp.mul(tv3, v); // 4. tv3 = tv3 * v\n        let tv5 = Fp.mul(u, tv3); // 5. tv5 = u * tv3\n        tv5 = Fp.pow(tv5, c3); // 6. tv5 = tv5^c3\n        tv5 = Fp.mul(tv5, tv2); // 7. tv5 = tv5 * tv2\n        tv2 = Fp.mul(tv5, v); // 8. tv2 = tv5 * v\n        tv3 = Fp.mul(tv5, u); // 9. tv3 = tv5 * u\n        let tv4 = Fp.mul(tv3, tv2); // 10. tv4 = tv3 * tv2\n        tv5 = Fp.pow(tv4, c5); // 11. tv5 = tv4^c5\n        let isQR = Fp.eql(tv5, Fp.ONE); // 12. isQR = tv5 == 1\n        tv2 = Fp.mul(tv3, c7); // 13. tv2 = tv3 * c7\n        tv5 = Fp.mul(tv4, tv1); // 14. tv5 = tv4 * tv1\n        tv3 = Fp.cmov(tv2, tv3, isQR); // 15. tv3 = CMOV(tv2, tv3, isQR)\n        tv4 = Fp.cmov(tv5, tv4, isQR); // 16. tv4 = CMOV(tv5, tv4, isQR)\n        // 17. for i in (c1, c1 - 1, ..., 2):\n        for (let i = c1; i > _1n; i--) {\n            let tv5 = i - _2n; // 18.    tv5 = i - 2\n            tv5 = _2n << (tv5 - _1n); // 19.    tv5 = 2^tv5\n            let tvv5 = Fp.pow(tv4, tv5); // 20.    tv5 = tv4^tv5\n            const e1 = Fp.eql(tvv5, Fp.ONE); // 21.    e1 = tv5 == 1\n            tv2 = Fp.mul(tv3, tv1); // 22.    tv2 = tv3 * tv1\n            tv1 = Fp.mul(tv1, tv1); // 23.    tv1 = tv1 * tv1\n            tvv5 = Fp.mul(tv4, tv1); // 24.    tv5 = tv4 * tv1\n            tv3 = Fp.cmov(tv2, tv3, e1); // 25.    tv3 = CMOV(tv2, tv3, e1)\n            tv4 = Fp.cmov(tvv5, tv4, e1); // 26.    tv4 = CMOV(tv5, tv4, e1)\n        }\n        return { isValid: isQR, value: tv3 };\n    };\n    if (Fp.ORDER % _4n === _3n) {\n        // sqrt_ratio_3mod4(u, v)\n        const c1 = (Fp.ORDER - _3n) / _4n; // 1. c1 = (q - 3) / 4     # Integer arithmetic\n        const c2 = Fp.sqrt(Fp.neg(Z)); // 2. c2 = sqrt(-Z)\n        sqrtRatio = (u, v) => {\n            let tv1 = Fp.sqr(v); // 1. tv1 = v^2\n            const tv2 = Fp.mul(u, v); // 2. tv2 = u * v\n            tv1 = Fp.mul(tv1, tv2); // 3. tv1 = tv1 * tv2\n            let y1 = Fp.pow(tv1, c1); // 4. y1 = tv1^c1\n            y1 = Fp.mul(y1, tv2); // 5. y1 = y1 * tv2\n            const y2 = Fp.mul(y1, c2); // 6. y2 = y1 * c2\n            const tv3 = Fp.mul(Fp.sqr(y1), v); // 7. tv3 = y1^2; 8. tv3 = tv3 * v\n            const isQR = Fp.eql(tv3, u); // 9. isQR = tv3 == u\n            let y = Fp.cmov(y2, y1, isQR); // 10. y = CMOV(y2, y1, isQR)\n            return { isValid: isQR, value: y }; // 11. return (isQR, y) isQR ? y : y*c2\n        };\n    }\n    // No curves uses that\n    // if (Fp.ORDER % _8n === _5n) // sqrt_ratio_5mod8\n    return sqrtRatio;\n}\n/**\n * Simplified Shallue-van de Woestijne-Ulas Method\n * https://www.rfc-editor.org/rfc/rfc9380#section-6.6.2\n */\nexport function mapToCurveSimpleSWU(Fp, opts) {\n    validateField(Fp);\n    if (!Fp.isValid(opts.A) || !Fp.isValid(opts.B) || !Fp.isValid(opts.Z))\n        throw new Error('mapToCurveSimpleSWU: invalid opts');\n    const sqrtRatio = SWUFpSqrtRatio(Fp, opts.Z);\n    if (!Fp.isOdd)\n        throw new Error('Fp.isOdd is not implemented!');\n    // Input: u, an element of F.\n    // Output: (x, y), a point on E.\n    return (u) => {\n        // prettier-ignore\n        let tv1, tv2, tv3, tv4, tv5, tv6, x, y;\n        tv1 = Fp.sqr(u); // 1.  tv1 = u^2\n        tv1 = Fp.mul(tv1, opts.Z); // 2.  tv1 = Z * tv1\n        tv2 = Fp.sqr(tv1); // 3.  tv2 = tv1^2\n        tv2 = Fp.add(tv2, tv1); // 4.  tv2 = tv2 + tv1\n        tv3 = Fp.add(tv2, Fp.ONE); // 5.  tv3 = tv2 + 1\n        tv3 = Fp.mul(tv3, opts.B); // 6.  tv3 = B * tv3\n        tv4 = Fp.cmov(opts.Z, Fp.neg(tv2), !Fp.eql(tv2, Fp.ZERO)); // 7.  tv4 = CMOV(Z, -tv2, tv2 != 0)\n        tv4 = Fp.mul(tv4, opts.A); // 8.  tv4 = A * tv4\n        tv2 = Fp.sqr(tv3); // 9.  tv2 = tv3^2\n        tv6 = Fp.sqr(tv4); // 10. tv6 = tv4^2\n        tv5 = Fp.mul(tv6, opts.A); // 11. tv5 = A * tv6\n        tv2 = Fp.add(tv2, tv5); // 12. tv2 = tv2 + tv5\n        tv2 = Fp.mul(tv2, tv3); // 13. tv2 = tv2 * tv3\n        tv6 = Fp.mul(tv6, tv4); // 14. tv6 = tv6 * tv4\n        tv5 = Fp.mul(tv6, opts.B); // 15. tv5 = B * tv6\n        tv2 = Fp.add(tv2, tv5); // 16. tv2 = tv2 + tv5\n        x = Fp.mul(tv1, tv3); // 17.   x = tv1 * tv3\n        const { isValid, value } = sqrtRatio(tv2, tv6); // 18. (is_gx1_square, y1) = sqrt_ratio(tv2, tv6)\n        y = Fp.mul(tv1, u); // 19.   y = tv1 * u  -> Z * u^3 * y1\n        y = Fp.mul(y, value); // 20.   y = y * y1\n        x = Fp.cmov(x, tv3, isValid); // 21.   x = CMOV(x, tv3, is_gx1_square)\n        y = Fp.cmov(y, value, isValid); // 22.   y = CMOV(y, y1, is_gx1_square)\n        const e1 = Fp.isOdd(u) === Fp.isOdd(y); // 23.  e1 = sgn0(u) == sgn0(y)\n        y = Fp.cmov(Fp.neg(y), y, e1); // 24.   y = CMOV(-y, y, e1)\n        const tv4_inv = FpInvertBatch(Fp, [tv4], true)[0];\n        x = Fp.mul(x, tv4_inv); // 25.   x = x / tv4\n        return { x, y };\n    };\n}\n//# sourceMappingURL=weierstrass.js.map"],"names":["validateSigVerOpts","opts","undefined","lowS","abool","prehash","DERErr","Error","constructor","m","super","DER","Err","_tlv","encode","tag","data","E","length","dataLen","len","numberToHexUnpadded","lenLen","decode","pos","first","lengthBytes","subarray","b","v","l","_int","num","_0n","hex","Number","parseInt","bytesToNumberBE","toSig","int","tlv","ensureBytes","seqBytes","seqLeftBytes","rBytes","rLeftBytes","sBytes","sLeftBytes","r","s","hexFromSig","sig","seq","numToSizedHex","size","bytesToHex","numberToBytesBE","BigInt","_1n","_3n","_4n","weierstrassPoints","CURVE","curve","validateBasic","validateObject","a","allowInfinityPoint","allowedPrivateKeyLengths","clearCofactor","fromBytes","isTorsionFree","toBytes","wrapPrivateKey","endo","Fp","eql","ZERO","beta","splitScalar","Object","freeze","validatePointOpts","Fn","Field","n","nBitLength","_c","point","_isCompressed","toAffine","concatBytes","Uint8Array","from","x","y","bytes","tail","BYTES","weierstrassEquation","x2","sqr","x3","mul","add","isValidXY","left","right","Gx","Gy","_4a3","pow","_27b2","is0","normPrivateKeyToScalar","key","lengths","nByteLength","N","isBytes","includes","padStart","error","mod","aInRange","aprjpoint","other","Point","toAffineMemo","memoized","p","iz","px","py","pz","z","ONE","inv","ax","ay","zz","assertValidMemo","isValid","this","fromAffine","i","normalizeZ","points","toInv","FpInvertBatch","map","fromHex","P","assertValidity","fromPrivateKey","privateKey","BASE","multiply","msm","scalars","pippenger","_setWindowSize","windowSize","wnaf","setWindowSize","hasEvenY","isOdd","equals","X1","Y1","Z1","X2","Y2","Z2","U1","U2","negate","neg","double","b3","X3","Y3","Z3","t0","t1","t2","t3","sub","t4","t5","subtract","wNAF","wNAFCached","multiplyUnsafe","sc","I","hasPrecomputes","wNAFCachedUnsafe","k1neg","k1","k2neg","k2","k1p","k2p","d","scalar","fake","f","f1p","f2p","constTimeNegate","multiplyAndAddUnsafe","Q","G","sum","h","cofactor","toRawBytes","isCompressed","toHex","Math","ceil","ProjectivePoint","isWithinCurveOrder","inRange","weierstrass","curveDef","hash","hmac","randomBytes","bits2int","bits2int_modN","validateOpts","CURVE_ORDER","compressedLen","uncompressedLen","modN","invN","invert","cat","head","ORDER","y2","sqrt","sqrtError","suffix","message","isBiggerThanHalfOrder","number","slcNum","to","slice","Signature","recovery","fromCompact","fromDER","addRecoveryBit","recoverPublicKey","msgHash","rec","radj","prefix","R","ir","u1","u2","hasHighS","normalizeS","toDERRawBytes","hexToBytes","toDERHex","toCompactRawBytes","toCompactHex","utils","isValidPrivateKey","randomPrivateKey","getMinHashLength","mapHashToField","precompute","isProbPub","item","fpl","compLen","uncompLen","delta","ORDER_MASK","bitMask","int2octets","prepSig","defaultSigOpts","some","k","extraEntropy","ent","h1int","seedArgs","e","push","seed","k2sig","kBytes","ik","q","normS","defaultVerOpts","getPublicKey","getSharedSecret","privateA","publicB","sign","privKey","C","createHmacDrbg","outputLen","drbg","verify","signature","publicKey","sg","format","isHex","isObj","_sig","derError","is"],"mappings":";;AA8CA,SAASA,EAAmBC,QACNC,IAAdD,EAAKE,MACLC,EAAM,OAAQH,EAAKE,WACFD,IAAjBD,EAAKI,SACLD,EAAM,UAAWH,EAAKI,QAC9B,CA4BO,MAAMC,UAAeC,MACxB,WAAAC,CAAYC,EAAI,IACZC,MAAMD,EACV,EASQ,MAACE,EAAM,CAEfC,IAAKN,EAELO,KAAM,CACFC,OAAQ,CAACC,EAAKC,KACV,MAAQJ,IAAKK,GAAMN,EACnB,GAAII,EAAM,GAAKA,EAAM,IACjB,MAAM,IAAIE,EAAE,yBAChB,GAAkB,EAAdD,EAAKE,OACL,MAAM,IAAID,EAAE,6BAChB,MAAME,EAAUH,EAAKE,OAAS,EACxBE,EAAMC,EAAoBF,GAChC,GAAKC,EAAIF,OAAS,EAAK,IACnB,MAAM,IAAID,EAAE,wCAEhB,MAAMK,EAASH,EAAU,IAAME,EAAqBD,EAAIF,OAAS,EAAK,KAAO,GAE7E,OADUG,EAAoBN,GACnBO,EAASF,EAAMJ,GAG9B,MAAAO,CAAOR,EAAKC,GACR,MAAQJ,IAAKK,GAAMN,EACnB,IAAIa,EAAM,EACV,GAAIT,EAAM,GAAKA,EAAM,IACjB,MAAM,IAAIE,EAAE,yBAChB,GAAID,EAAKE,OAAS,GAAKF,EAAKQ,OAAWT,EACnC,MAAM,IAAIE,EAAE,yBAChB,MAAMQ,EAAQT,EAAKQ,KAEnB,IAAIN,EAAS,EACb,MAF0B,IAARO,GAIb,CAED,MAAMH,EAAiB,IAARG,EACf,IAAKH,EACD,MAAM,IAAIL,EAAE,qDAChB,GAAIK,EAAS,EACT,MAAM,IAAIL,EAAE,4CAChB,MAAMS,EAAcV,EAAKW,SAASH,EAAKA,EAAMF,GAC7C,GAAII,EAAYR,SAAWI,EACvB,MAAM,IAAIL,EAAE,yCAChB,GAAuB,IAAnBS,EAAY,GACZ,MAAM,IAAIT,EAAE,wCAChB,IAAK,MAAMW,KAAKF,EACZR,EAAUA,GAAU,EAAKU,EAE7B,GADAJ,GAAOF,EACHJ,EAAS,IACT,MAAM,IAAID,EAAE,yCACpB,MAlBIC,EAASO,EAmBb,MAAMI,EAAIb,EAAKW,SAASH,EAAKA,EAAMN,GACnC,GAAIW,EAAEX,SAAWA,EACb,MAAM,IAAID,EAAE,kCAChB,MAAO,CAAEY,IAAGC,EAAGd,EAAKW,SAASH,EAAMN,GACvC,GAMJa,KAAM,CACF,MAAAjB,CAAOkB,GACH,MAAQpB,IAAKK,GAAMN,EACnB,GAAIqB,EAAMC,EACN,MAAM,IAAIhB,EAAE,8CAChB,IAAIiB,EAAMb,EAAoBW,GAI9B,GAFkC,EAA9BG,OAAOC,SAASF,EAAI,GAAI,MACxBA,EAAM,KAAOA,GACA,EAAbA,EAAIhB,OACJ,MAAM,IAAID,EAAE,kDAChB,OAAOiB,CACX,EACA,MAAAX,CAAOP,GACH,MAAQJ,IAAKK,GAAMN,EACnB,GAAc,IAAVK,EAAK,GACL,MAAM,IAAIC,EAAE,uCAChB,GAAgB,IAAZD,EAAK,MAA2B,IAAVA,EAAK,IAC3B,MAAM,IAAIC,EAAE,uDAChB,OAAOoB,EAAgBrB,EAC3B,GAEJ,KAAAsB,CAAMJ,GAEF,MAAQtB,IAAKK,EAAGc,KAAMQ,EAAK1B,KAAM2B,GAAQ7B,EACnCK,EAAOyB,EAAY,YAAaP,IAC9BL,EAAGa,EAAUZ,EAAGa,GAAiBH,EAAIjB,OAAO,GAAMP,GAC1D,GAAI2B,EAAazB,OACb,MAAM,IAAID,EAAE,+CAChB,MAAQY,EAAGe,EAAQd,EAAGe,GAAeL,EAAIjB,OAAO,EAAMmB,IAC9Cb,EAAGiB,EAAQhB,EAAGiB,GAAeP,EAAIjB,OAAO,EAAMsB,GACtD,GAAIE,EAAW7B,OACX,MAAM,IAAID,EAAE,+CAChB,MAAO,CAAE+B,EAAGT,EAAIhB,OAAOqB,GAASK,EAAGV,EAAIhB,OAAOuB,GAClD,EACA,UAAAI,CAAWC,GACP,MAAQtC,KAAM2B,EAAKT,KAAMQ,GAAQ5B,EAG3ByC,EAFKZ,EAAI1B,OAAO,EAAMyB,EAAIzB,OAAOqC,EAAIH,IAChCR,EAAI1B,OAAO,EAAMyB,EAAIzB,OAAOqC,EAAIF,IAE3C,OAAOT,EAAI1B,OAAO,GAAMsC,EAC5B,GAEJ,SAASC,EAAcrB,EAAKsB,GACxB,OAAOC,EAAWC,EAAgBxB,EAAKsB,GAC3C,CAGK,MAACrB,EAAMwB,OAAO,GAAIC,EAAMD,OAAO,GAAUA,OAAO,GAAG,MAACE,EAAMF,OAAO,GAAIG,EAAMH,OAAO,GAChF,SAASI,EAAkB5D,GAC9B,MAAM6D,EAtJV,SAA2BC,GACvB,MAAM9D,EAAO+D,EAAcD,GAC3BE,EAAehE,EAAM,CACjBiE,EAAG,QACHtC,EAAG,SACJ,CACCuC,mBAAoB,UACpBC,yBAA0B,QAC1BC,cAAe,WACfC,UAAW,WACXC,cAAe,WACfC,QAAS,WACTC,eAAgB,YAEpB,MAAMC,KAAEA,EAAIC,GAAEA,EAAET,EAAEA,GAAMjE,EACxB,GAAIyE,EAAM,CACN,IAAKC,EAAGC,IAAIV,EAAGS,EAAGE,MACd,MAAM,IAAItE,MAAM,mCAEpB,GAAoB,iBAATmE,GACc,iBAAdA,EAAKI,MACgB,mBAArBJ,EAAKK,YACZ,MAAM,IAAIxE,MAAM,oEAExB,CACA,OAAOyE,OAAOC,OAAO,IAAKhF,GAC9B,CA4HkBiF,CAAkBjF,IAC1B0E,GAAEA,GAAOb,EACTqB,EAAKC,EAAMtB,EAAMuB,EAAGvB,EAAMwB,YAC1Bd,EAAUV,EAAMU,SAC1B,EAAUe,EAAIC,EAAOC,KACT,MAAMvB,EAAIsB,EAAME,WAChB,OAAOC,EAAYC,WAAWC,KAAK,CAAC,IAAQlB,EAAGH,QAAQN,EAAE4B,GAAInB,EAAGH,QAAQN,EAAE6B,GAC7E,GACCzB,EAAYR,EAAMQ,WAC5B,CAAU0B,IAEE,MAAMC,EAAOD,EAAMrE,SAAS,GAI5B,MAAO,CAAEmE,EAFCnB,EAAGL,UAAU2B,EAAKtE,SAAS,EAAGgD,EAAGuB,QAE/BH,EADFpB,EAAGL,UAAU2B,EAAKtE,SAASgD,EAAGuB,MAAO,EAAIvB,EAAGuB,QAEzD,GAKL,SAASC,EAAoBL,GACzB,MAAM5B,EAAEA,EAACtC,EAAEA,GAAMkC,EACXsC,EAAKzB,EAAG0B,IAAIP,GACZQ,EAAK3B,EAAG4B,IAAIH,EAAIN,GACtB,OAAOnB,EAAG6B,IAAI7B,EAAG6B,IAAIF,EAAI3B,EAAG4B,IAAIT,EAAG5B,IAAKtC,EAC5C,CACA,SAAS6E,EAAUX,EAAGC,GAClB,MAAMW,EAAO/B,EAAG0B,IAAIN,GACdY,EAAQR,EAAoBL,GAClC,OAAOnB,EAAGC,IAAI8B,EAAMC,EACxB,CAGA,IAAKF,EAAU3C,EAAM8C,GAAI9C,EAAM+C,IAC3B,MAAM,IAAItG,MAAM,qCAGpB,MAAMuG,EAAOnC,EAAG4B,IAAI5B,EAAGoC,IAAIjD,EAAMI,EAAGP,GAAMC,GACpCoD,EAAQrC,EAAG4B,IAAI5B,EAAG0B,IAAIvC,EAAMlC,GAAI6B,OAAO,KAC7C,GAAIkB,EAAGsC,IAAItC,EAAG6B,IAAIM,EAAME,IACpB,MAAM,IAAIzG,MAAM,4BAOpB,SAAS2G,EAAuBC,GAC5B,MAAQ/C,yBAA0BgD,EAAOC,YAAEA,EAAW5C,eAAEA,EAAgBY,EAAGiC,GAAMxD,EACjF,GAAIsD,GAA0B,iBAARD,EAAkB,CAIpC,GAHII,EAAQJ,KACRA,EAAM5D,EAAW4D,IAEF,iBAARA,IAAqBC,EAAQI,SAASL,EAAIjG,QACjD,MAAM,IAAIX,MAAM,uBACpB4G,EAAMA,EAAIM,SAAuB,EAAdJ,EAAiB,IACxC,CACA,IAAIrF,EACJ,IACIA,EACmB,iBAARmF,EACDA,EACA9E,EAAgBI,EAAY,cAAe0E,EAAKE,GAC9D,CACA,MAAOK,GACH,MAAM,IAAInH,MAAM,wCAA0C8G,EAAc,sBAAwBF,EACpG,CAIA,OAHI1C,IACAzC,EAAM2F,EAAI3F,EAAKsF,IACnBM,EAAS,cAAe5F,EAAK0B,EAAK4D,GAC3BtF,CACX,CACA,SAAS6F,EAAUC,GACf,KAAMA,aAAiBC,GACnB,MAAM,IAAIxH,MAAM,2BACxB,CAKA,MAAMyH,EAAeC,EAAS,CAACC,EAAGC,KAC9B,MAAQC,GAAItC,EAAGuC,GAAItC,EAAGuC,GAAIC,GAAML,EAEhC,GAAIvD,EAAGC,IAAI2D,EAAG5D,EAAG6D,KACb,MAAO,CAAE1C,IAAGC,KAChB,MAAMkB,EAAMiB,EAAEjB,MAGJ,MAANkB,IACAA,EAAKlB,EAAMtC,EAAG6D,IAAM7D,EAAG8D,IAAIF,IAC/B,MAAMG,EAAK/D,EAAG4B,IAAIT,EAAGqC,GACfQ,EAAKhE,EAAG4B,IAAIR,EAAGoC,GACfS,EAAKjE,EAAG4B,IAAIgC,EAAGJ,GACrB,GAAIlB,EACA,MAAO,CAAEnB,EAAGnB,EAAGE,KAAMkB,EAAGpB,EAAGE,MAC/B,IAAKF,EAAGC,IAAIgE,EAAIjE,EAAG6D,KACf,MAAM,IAAIjI,MAAM,oBACpB,MAAO,CAAEuF,EAAG4C,EAAI3C,EAAG4C,KAIjBE,EAAkBZ,EAAUC,IAC9B,GAAIA,EAAEjB,MAAO,CAIT,GAAInD,EAAMK,qBAAuBQ,EAAGsC,IAAIiB,EAAEG,IACtC,OACJ,MAAM,IAAI9H,MAAM,kBACpB,CAEA,MAAMuF,EAAEA,EAACC,EAAEA,GAAMmC,EAAExC,WAEnB,IAAKf,EAAGmE,QAAQhD,KAAOnB,EAAGmE,QAAQ/C,GAC9B,MAAM,IAAIxF,MAAM,4BACpB,IAAKkG,EAAUX,EAAGC,GACd,MAAM,IAAIxF,MAAM,qCACpB,IAAK2H,EAAE3D,gBACH,MAAM,IAAIhE,MAAM,0CACpB,OAAO,IAOX,MAAMwH,EACF,WAAAvH,CAAY4H,EAAIC,EAAIC,GAChB,GAAU,MAANF,IAAezD,EAAGmE,QAAQV,GAC1B,MAAM,IAAI7H,MAAM,cACpB,GAAU,MAAN8H,IAAe1D,EAAGmE,QAAQT,IAAO1D,EAAGsC,IAAIoB,GACxC,MAAM,IAAI9H,MAAM,cACpB,GAAU,MAAN+H,IAAe3D,EAAGmE,QAAQR,GAC1B,MAAM,IAAI/H,MAAM,cACpBwI,KAAKX,GAAKA,EACVW,KAAKV,GAAKA,EACVU,KAAKT,GAAKA,EACVtD,OAAOC,OAAO8D,KAClB,CAGA,iBAAOC,CAAWd,GACd,MAAMpC,EAAEA,EAACC,EAAEA,GAAMmC,GAAK,CAAA,EACtB,IAAKA,IAAMvD,EAAGmE,QAAQhD,KAAOnB,EAAGmE,QAAQ/C,GACpC,MAAM,IAAIxF,MAAM,wBACpB,GAAI2H,aAAaH,EACb,MAAM,IAAIxH,MAAM,gCACpB,MAAM0G,EAAOgC,GAAMtE,EAAGC,IAAIqE,EAAGtE,EAAGE,MAEhC,OAAIoC,EAAInB,IAAMmB,EAAIlB,GACPgC,EAAMlD,KACV,IAAIkD,EAAMjC,EAAGC,EAAGpB,EAAG6D,IAC9B,CACA,KAAI1C,GACA,OAAOiD,KAAKrD,WAAWI,CAC3B,CACA,KAAIC,GACA,OAAOgD,KAAKrD,WAAWK,CAC3B,CAOA,iBAAOmD,CAAWC,GACd,MAAMC,EAAQC,EAAc1E,EAAIwE,EAAOG,IAAKpB,GAAMA,EAAEI,KACpD,OAAOa,EAAOG,IAAI,CAACpB,EAAGe,IAAMf,EAAExC,SAAS0D,EAAMH,KAAKK,IAAIvB,EAAMiB,WAChE,CAKA,cAAOO,CAAQrH,GACX,MAAMsH,EAAIzB,EAAMiB,WAAW1E,EAAU7B,EAAY,WAAYP,KAE7D,OADAsH,EAAEC,iBACKD,CACX,CAEA,qBAAOE,CAAeC,GAClB,OAAO5B,EAAM6B,KAAKC,SAAS3C,EAAuByC,GACtD,CAEA,UAAOG,CAAIX,EAAQY,GACf,OAAOC,EAAUjC,EAAO5C,EAAIgE,EAAQY,EACxC,CAEA,cAAAE,CAAeC,GACXC,EAAKC,cAAcrB,KAAMmB,EAC7B,CAEA,cAAAT,GACIZ,EAAgBE,KACpB,CACA,QAAAsB,GACI,MAAMtE,EAAEA,GAAMgD,KAAKrD,WACnB,GAAIf,EAAG2F,MACH,OAAQ3F,EAAG2F,MAAMvE,GACrB,MAAM,IAAIxF,MAAM,8BACpB,CAIA,MAAAgK,CAAOzC,GACHD,EAAUC,GACV,MAAQM,GAAIoC,EAAInC,GAAIoC,EAAInC,GAAIoC,GAAO3B,MAC3BX,GAAIuC,EAAItC,GAAIuC,EAAItC,GAAIuC,GAAO/C,EAC7BgD,EAAKnG,EAAGC,IAAID,EAAG4B,IAAIiE,EAAIK,GAAKlG,EAAG4B,IAAIoE,EAAID,IACvCK,EAAKpG,EAAGC,IAAID,EAAG4B,IAAIkE,EAAII,GAAKlG,EAAG4B,IAAIqE,EAAIF,IAC7C,OAAOI,GAAMC,CACjB,CAIA,MAAAC,GACI,OAAO,IAAIjD,EAAMgB,KAAKX,GAAIzD,EAAGsG,IAAIlC,KAAKV,IAAKU,KAAKT,GACpD,CAKA,MAAA4C,GACI,MAAMhH,EAAEA,EAACtC,EAAEA,GAAMkC,EACXqH,EAAKxG,EAAG4B,IAAI3E,EAAG+B,IACbyE,GAAIoC,EAAInC,GAAIoC,EAAInC,GAAIoC,GAAO3B,KACnC,IAAIqC,EAAKzG,EAAGE,KAAMwG,EAAK1G,EAAGE,KAAMyG,EAAK3G,EAAGE,KACpC0G,EAAK5G,EAAG4B,IAAIiE,EAAIA,GAChBgB,EAAK7G,EAAG4B,IAAIkE,EAAIA,GAChBgB,EAAK9G,EAAG4B,IAAImE,EAAIA,GAChBgB,EAAK/G,EAAG4B,IAAIiE,EAAIC,GA4BpB,OA3BAiB,EAAK/G,EAAG6B,IAAIkF,EAAIA,GAChBJ,EAAK3G,EAAG4B,IAAIiE,EAAIE,GAChBY,EAAK3G,EAAG6B,IAAI8E,EAAIA,GAChBF,EAAKzG,EAAG4B,IAAIrC,EAAGoH,GACfD,EAAK1G,EAAG4B,IAAI4E,EAAIM,GAChBJ,EAAK1G,EAAG6B,IAAI4E,EAAIC,GAChBD,EAAKzG,EAAGgH,IAAIH,EAAIH,GAChBA,EAAK1G,EAAG6B,IAAIgF,EAAIH,GAChBA,EAAK1G,EAAG4B,IAAI6E,EAAIC,GAChBD,EAAKzG,EAAG4B,IAAImF,EAAIN,GAChBE,EAAK3G,EAAG4B,IAAI4E,EAAIG,GAChBG,EAAK9G,EAAG4B,IAAIrC,EAAGuH,GACfC,EAAK/G,EAAGgH,IAAIJ,EAAIE,GAChBC,EAAK/G,EAAG4B,IAAIrC,EAAGwH,GACfA,EAAK/G,EAAG6B,IAAIkF,EAAIJ,GAChBA,EAAK3G,EAAG6B,IAAI+E,EAAIA,GAChBA,EAAK5G,EAAG6B,IAAI8E,EAAIC,GAChBA,EAAK5G,EAAG6B,IAAI+E,EAAIE,GAChBF,EAAK5G,EAAG4B,IAAIgF,EAAIG,GAChBL,EAAK1G,EAAG6B,IAAI6E,EAAIE,GAChBE,EAAK9G,EAAG4B,IAAIkE,EAAIC,GAChBe,EAAK9G,EAAG6B,IAAIiF,EAAIA,GAChBF,EAAK5G,EAAG4B,IAAIkF,EAAIC,GAChBN,EAAKzG,EAAGgH,IAAIP,EAAIG,GAChBD,EAAK3G,EAAG4B,IAAIkF,EAAID,GAChBF,EAAK3G,EAAG6B,IAAI8E,EAAIA,GAChBA,EAAK3G,EAAG6B,IAAI8E,EAAIA,GACT,IAAIvD,EAAMqD,EAAIC,EAAIC,EAC7B,CAKA,GAAA9E,CAAIsB,GACAD,EAAUC,GACV,MAAQM,GAAIoC,EAAInC,GAAIoC,EAAInC,GAAIoC,GAAO3B,MAC3BX,GAAIuC,EAAItC,GAAIuC,EAAItC,GAAIuC,GAAO/C,EACnC,IAAIsD,EAAKzG,EAAGE,KAAMwG,EAAK1G,EAAGE,KAAMyG,EAAK3G,EAAGE,KACxC,MAAMX,EAAIJ,EAAMI,EACViH,EAAKxG,EAAG4B,IAAIzC,EAAMlC,EAAG+B,GAC3B,IAAI4H,EAAK5G,EAAG4B,IAAIiE,EAAIG,GAChBa,EAAK7G,EAAG4B,IAAIkE,EAAIG,GAChBa,EAAK9G,EAAG4B,IAAImE,EAAIG,GAChBa,EAAK/G,EAAG6B,IAAIgE,EAAIC,GAChBmB,EAAKjH,EAAG6B,IAAImE,EAAIC,GACpBc,EAAK/G,EAAG4B,IAAImF,EAAIE,GAChBA,EAAKjH,EAAG6B,IAAI+E,EAAIC,GAChBE,EAAK/G,EAAGgH,IAAID,EAAIE,GAChBA,EAAKjH,EAAG6B,IAAIgE,EAAIE,GAChB,IAAImB,EAAKlH,EAAG6B,IAAImE,EAAIE,GA+BpB,OA9BAe,EAAKjH,EAAG4B,IAAIqF,EAAIC,GAChBA,EAAKlH,EAAG6B,IAAI+E,EAAIE,GAChBG,EAAKjH,EAAGgH,IAAIC,EAAIC,GAChBA,EAAKlH,EAAG6B,IAAIiE,EAAIC,GAChBU,EAAKzG,EAAG6B,IAAIoE,EAAIC,GAChBgB,EAAKlH,EAAG4B,IAAIsF,EAAIT,GAChBA,EAAKzG,EAAG6B,IAAIgF,EAAIC,GAChBI,EAAKlH,EAAGgH,IAAIE,EAAIT,GAChBE,EAAK3G,EAAG4B,IAAIrC,EAAG0H,GACfR,EAAKzG,EAAG4B,IAAI4E,EAAIM,GAChBH,EAAK3G,EAAG6B,IAAI4E,EAAIE,GAChBF,EAAKzG,EAAGgH,IAAIH,EAAIF,GAChBA,EAAK3G,EAAG6B,IAAIgF,EAAIF,GAChBD,EAAK1G,EAAG4B,IAAI6E,EAAIE,GAChBE,EAAK7G,EAAG6B,IAAI+E,EAAIA,GAChBC,EAAK7G,EAAG6B,IAAIgF,EAAID,GAChBE,EAAK9G,EAAG4B,IAAIrC,EAAGuH,GACfG,EAAKjH,EAAG4B,IAAI4E,EAAIS,GAChBJ,EAAK7G,EAAG6B,IAAIgF,EAAIC,GAChBA,EAAK9G,EAAGgH,IAAIJ,EAAIE,GAChBA,EAAK9G,EAAG4B,IAAIrC,EAAGuH,GACfG,EAAKjH,EAAG6B,IAAIoF,EAAIH,GAChBF,EAAK5G,EAAG4B,IAAIiF,EAAII,GAChBP,EAAK1G,EAAG6B,IAAI6E,EAAIE,GAChBA,EAAK5G,EAAG4B,IAAIsF,EAAID,GAChBR,EAAKzG,EAAG4B,IAAImF,EAAIN,GAChBA,EAAKzG,EAAGgH,IAAIP,EAAIG,GAChBA,EAAK5G,EAAG4B,IAAImF,EAAIF,GAChBF,EAAK3G,EAAG4B,IAAIsF,EAAIP,GAChBA,EAAK3G,EAAG6B,IAAI8E,EAAIC,GACT,IAAIxD,EAAMqD,EAAIC,EAAIC,EAC7B,CACA,QAAAQ,CAAShE,GACL,OAAOiB,KAAKvC,IAAIsB,EAAMkD,SAC1B,CACA,GAAA/D,GACI,OAAO8B,KAAKwB,OAAOxC,EAAMlD,KAC7B,CACA,IAAAkH,CAAK1G,GACD,OAAO8E,EAAK6B,WAAWjD,KAAM1D,EAAG0C,EAAMmB,WAC1C,CAMA,cAAA+C,CAAeC,GACX,MAAMxH,KAAEA,EAAMW,EAAGiC,GAAMxD,EACvB8D,EAAS,SAAUsE,EAAIjK,EAAKqF,GAC5B,MAAM6E,EAAIpE,EAAMlD,KAChB,GAAIqH,IAAOjK,EACP,OAAOkK,EACX,GAAIpD,KAAK9B,OAASiF,IAAOxI,EACrB,OAAOqF,KAEX,IAAKrE,GAAQyF,EAAKiC,eAAerD,MAC7B,OAAOoB,EAAKkC,iBAAiBtD,KAAMmD,EAAInE,EAAMmB,YAGjD,IAAIoD,MAAEA,EAAKC,GAAEA,EAAEC,MAAEA,EAAKC,GAAEA,GAAO/H,EAAKK,YAAYmH,GAC5CQ,EAAMP,EACNQ,EAAMR,EACNS,EAAI7D,KACR,KAAOwD,EAAKtK,GAAOwK,EAAKxK,GAChBsK,EAAK7I,IACLgJ,EAAMA,EAAIlG,IAAIoG,IACdH,EAAK/I,IACLiJ,EAAMA,EAAInG,IAAIoG,IAClBA,EAAIA,EAAE1B,SACNqB,IAAO7I,EACP+I,IAAO/I,EAOX,OALI4I,IACAI,EAAMA,EAAI1B,UACVwB,IACAG,EAAMA,EAAI3B,UACd2B,EAAM,IAAI5E,EAAMpD,EAAG4B,IAAIoG,EAAIvE,GAAI1D,EAAKI,MAAO6H,EAAItE,GAAIsE,EAAIrE,IAChDoE,EAAIlG,IAAImG,EACnB,CAUA,QAAA9C,CAASgD,GACL,MAAMnI,KAAEA,EAAMW,EAAGiC,GAAMxD,EAEvB,IAAI0B,EAAOsH,EAEX,GAHAlF,EAAS,SAAUiF,EAAQnJ,EAAK4D,GAG5B5C,EAAM,CACN,MAAM4H,MAAEA,EAAKC,GAAEA,EAAEC,MAAEA,EAAKC,GAAEA,GAAO/H,EAAKK,YAAY8H,GAClD,IAAM3E,EAAGwE,EAAKK,EAAGC,GAAQjE,KAAKgD,KAAKQ,IAC7BrE,EAAGyE,EAAKI,EAAGE,GAAQlE,KAAKgD,KAAKU,GACnCC,EAAMvC,EAAK+C,gBAAgBZ,EAAOI,GAClCC,EAAMxC,EAAK+C,gBAAgBV,EAAOG,GAClCA,EAAM,IAAI5E,EAAMpD,EAAG4B,IAAIoG,EAAIvE,GAAI1D,EAAKI,MAAO6H,EAAItE,GAAIsE,EAAIrE,IACvD9C,EAAQkH,EAAIlG,IAAImG,GAChBG,EAAOE,EAAIxG,IAAIyG,EACnB,KACK,CACD,MAAM/E,EAAEA,EAAC6E,EAAEA,GAAMhE,KAAKgD,KAAKc,GAC3BrH,EAAQ0C,EACR4E,EAAOC,CACX,CAEA,OAAOhF,EAAMmB,WAAW,CAAC1D,EAAOsH,IAAO,EAC3C,CAOA,oBAAAK,CAAqBC,EAAGlJ,EAAGtC,GACvB,MAAMyL,EAAItF,EAAM6B,KACVrD,EAAM,CAACiD,EAAGtF,IACVA,IAAMjC,GAAOiC,IAAMR,GAAQ8F,EAAEe,OAAO8C,GAA2B7D,EAAEK,SAAS3F,GAAjCsF,EAAEyC,eAAe/H,GAC1DoJ,EAAM/G,EAAIwC,KAAM7E,GAAGsC,IAAID,EAAI6G,EAAGxL,IACpC,OAAO0L,EAAIrG,WAAQ/G,EAAYoN,CACnC,CAIA,QAAA5H,CAASyC,GACL,OAAOH,EAAae,KAAMZ,EAC9B,CACA,aAAA5D,GACI,MAAQgJ,EAAGC,EAAQjJ,cAAEA,GAAkBT,EACvC,GAAI0J,IAAa9J,EACb,OAAO,EACX,GAAIa,EACA,OAAOA,EAAcwD,EAAOgB,MAChC,MAAM,IAAIxI,MAAM,+DACpB,CACA,aAAA8D,GACI,MAAQkJ,EAAGC,EAAQnJ,cAAEA,GAAkBP,EACvC,OAAI0J,IAAa9J,EACNqF,KACP1E,EACOA,EAAc0D,EAAOgB,MACzBA,KAAKkD,eAAenI,EAAMyJ,EACrC,CACA,UAAAE,CAAWC,GAAe,GAGtB,OAFAtN,EAAM,eAAgBsN,GACtB3E,KAAKU,iBACEjF,EAAQuD,EAAOgB,KAAM2E,EAChC,CACA,KAAAC,CAAMD,GAAe,GAEjB,OADAtN,EAAM,eAAgBsN,GACfnK,EAAWwF,KAAK0E,WAAWC,GACtC,EAGJ3F,EAAM6B,KAAO,IAAI7B,EAAMjE,EAAM8C,GAAI9C,EAAM+C,GAAIlC,EAAG6D,KAE9CT,EAAMlD,KAAO,IAAIkD,EAAMpD,EAAGE,KAAMF,EAAG6D,IAAK7D,EAAGE,MAC3C,MAAMH,KAAEA,EAAIY,WAAEA,GAAexB,EACvBqG,EAAO4B,EAAKhE,EAAOrD,EAAOkJ,KAAKC,KAAKvI,EAAa,GAAKA,GAC5D,MAAO,CACHxB,QACAgK,gBAAiB/F,EACjBb,yBACAf,sBACA4H,mBArZJ,SAA4B/L,GACxB,OAAOgM,EAAQhM,EAAK0B,EAAKI,EAAMuB,EACnC,EAqZJ,CAqBO,SAAS4I,EAAYC,GACxB,MAAMpK,EArBV,SAAsBC,GAClB,MAAM9D,EAAO+D,EAAcD,GAU3B,OATAE,EAAehE,EAAM,CACjBkO,KAAM,OACNC,KAAM,WACNC,YAAa,YACd,CACCC,SAAU,WACVC,cAAe,WACfpO,KAAM,YAEH6E,OAAOC,OAAO,CAAE9E,MAAM,KAASF,GAC1C,CASkBuO,CAAaN,IACrBvJ,GAAEA,EAAIU,EAAGoJ,EAAWpH,YAAEA,EAAW/B,WAAEA,GAAexB,EAClD4K,EAAgB/J,EAAGuB,MAAQ,EAC3ByI,EAAkB,EAAIhK,EAAGuB,MAAQ,EACvC,SAAS0I,EAAK1K,GACV,OAAOyD,EAAIzD,EAAGuK,EAClB,CACA,SAASI,EAAK3K,GACV,OAAO4K,EAAO5K,EAAGuK,EACrB,CACA,MAAQX,gBAAiB/F,EAAKb,uBAAEA,EAAsBf,oBAAEA,EAAmB4H,mBAAEA,GAAwBlK,EAAkB,IAChHC,EACH,OAAAU,CAAQe,EAAIC,EAAOkI,GACf,MAAMxJ,EAAIsB,EAAME,WACVI,EAAInB,EAAGH,QAAQN,EAAE4B,GACjBiJ,EAAMpJ,EAEZ,OADAvF,EAAM,eAAgBsN,GAClBA,EACOqB,EAAInJ,WAAWC,KAAK,CAACL,EAAM6E,WAAa,EAAO,IAAQvE,GAGvDiJ,EAAInJ,WAAWC,KAAK,CAAC,IAAQC,EAAGnB,EAAGH,QAAQN,EAAE6B,GAE5D,EACA,SAAAzB,CAAU0B,GACN,MAAM5E,EAAM4E,EAAM9E,OACZ8N,EAAOhJ,EAAM,GACbC,EAAOD,EAAMrE,SAAS,GAE5B,GAAIP,IAAQsN,GAA2B,IAATM,GAA0B,IAATA,EAoB1C,IAAI5N,IAAQuN,GAA4B,IAATK,EAAe,CAG/C,MAAO,CAAElJ,EAFCnB,EAAGL,UAAU2B,EAAKtE,SAAS,EAAGgD,EAAGuB,QAE/BH,EADFpB,EAAGL,UAAU2B,EAAKtE,SAASgD,EAAGuB,MAAO,EAAIvB,EAAGuB,QAE1D,CAII,MAAM,IAAI3F,MAAM,qCAFLmO,EAEiD,qBADjDC,EAC6E,SAAWvN,EACvG,CA7B+D,CAC3D,MAAM0E,EAAIzD,EAAgB4D,GAC1B,IAAK+H,EAAQlI,EAAGpC,EAAKiB,EAAGsK,OACpB,MAAM,IAAI1O,MAAM,yBACpB,MAAM2O,EAAK/I,EAAoBL,GAC/B,IAAIC,EACJ,IACIA,EAAIpB,EAAGwK,KAAKD,EAChB,CACA,MAAOE,GACH,MAAMC,EAASD,aAAqB7O,MAAQ,KAAO6O,EAAUE,QAAU,GACvE,MAAM,IAAI/O,MAAM,wBAA0B8O,EAC9C,CAMA,QAHiC,GAAdL,OAFHjJ,EAAIrC,KAASA,KAIzBqC,EAAIpB,EAAGsG,IAAIlF,IACR,CAAED,IAAGC,IAChB,CAWJ,IAEJ,SAASwJ,EAAsBC,GAE3B,OAAOA,EADMf,GAAe/K,CAEhC,CAKA,MAAM+L,EAAS,CAAC7N,EAAGiE,EAAM6J,IAAOrN,EAAgBT,EAAE+N,MAAM9J,EAAM6J,IAI9D,MAAME,EACF,WAAApP,CAAYwC,EAAGC,EAAG4M,GACdjI,EAAS,IAAK5E,EAAGU,EAAK+K,GACtB7G,EAAS,IAAK3E,EAAGS,EAAK+K,GACtB1F,KAAK/F,EAAIA,EACT+F,KAAK9F,EAAIA,EACO,MAAZ4M,IACA9G,KAAK8G,SAAWA,GACpB7K,OAAOC,OAAO8D,KAClB,CAEA,kBAAO+G,CAAY5N,GACf,MAAMJ,EAAIuF,EAEV,OADAnF,EAAMO,EAAY,mBAAoBP,EAAS,EAAJJ,GACpC,IAAI8N,EAAUH,EAAOvN,EAAK,EAAGJ,GAAI2N,EAAOvN,EAAKJ,EAAG,EAAIA,GAC/D,CAGA,cAAOiO,CAAQ7N,GACX,MAAMc,EAAEA,EAACC,EAAEA,GAAMtC,EAAI2B,MAAMG,EAAY,MAAOP,IAC9C,OAAO,IAAI0N,EAAU5M,EAAGC,EAC5B,CAKA,cAAAwG,GAAmB,CACnB,cAAAuG,CAAeH,GACX,OAAO,IAAID,EAAU7G,KAAK/F,EAAG+F,KAAK9F,EAAG4M,EACzC,CACA,gBAAAI,CAAiBC,GACb,MAAMlN,EAAEA,EAACC,EAAEA,EAAG4M,SAAUM,GAAQpH,KAC1BwE,EAAIgB,EAAc9L,EAAY,UAAWyN,IAC/C,GAAW,MAAPC,IAAgB,CAAC,EAAG,EAAG,EAAG,GAAG3I,SAAS2I,GACtC,MAAM,IAAI5P,MAAM,uBACpB,MAAM6P,EAAe,IAARD,GAAqB,IAARA,EAAYnN,EAAIc,EAAMuB,EAAIrC,EACpD,GAAIoN,GAAQzL,EAAGsK,MACX,MAAM,IAAI1O,MAAM,8BACpB,MAAM8P,EAAgB,EAANF,EAAwB,KAAP,KAC3BG,EAAIvI,EAAMwB,QAAQ8G,EAAShN,EAAc+M,EAAMzL,EAAGuB,QAClDqK,EAAK1B,EAAKuB,GACVI,EAAK5B,GAAMrB,EAAIgD,GACfE,EAAK7B,EAAK3L,EAAIsN,GACdnD,EAAIrF,EAAM6B,KAAKuD,qBAAqBmD,EAAGE,EAAIC,GACjD,IAAKrD,EACD,MAAM,IAAI7M,MAAM,qBAEpB,OADA6M,EAAE3D,iBACK2D,CACX,CAEA,QAAAsD,GACI,OAAOnB,EAAsBxG,KAAK9F,EACtC,CACA,UAAA0N,GACI,OAAO5H,KAAK2H,WAAa,IAAId,EAAU7G,KAAK/F,EAAG4L,GAAM7F,KAAK9F,GAAI8F,KAAK8G,UAAY9G,IACnF,CAEA,aAAA6H,GACI,OAAOC,EAAW9H,KAAK+H,WAC3B,CACA,QAAAA,GACI,OAAOnQ,EAAIuC,WAAW6F,KAC1B,CAEA,iBAAAgI,GACI,OAAOF,EAAW9H,KAAKiI,eAC3B,CACA,YAAAA,GACI,MAAMlP,EAAIuF,EACV,OAAOhE,EAAc0F,KAAK/F,EAAGlB,GAAKuB,EAAc0F,KAAK9F,EAAGnB,EAC5D,EAEJ,MAAMmP,EAAQ,CACV,iBAAAC,CAAkBvH,GACd,IAEI,OADAzC,EAAuByC,IAChB,CACX,CACA,MAAOjC,GACH,OAAO,CACX,CACJ,EACAR,uBAAwBA,EAKxBiK,iBAAkB,KACd,MAAMjQ,EAASkQ,EAAiBtN,EAAMuB,GACtC,OAAOgM,EAAevN,EAAMuK,YAAYnN,GAAS4C,EAAMuB,IAU3DiM,WAAU,CAACpH,EAAa,EAAG1E,EAAQuC,EAAM6B,QACrCpE,EAAMyE,eAAeC,GACrB1E,EAAMqE,SAASpG,OAAO,IACf+B,IAef,SAAS+L,EAAUC,GACf,GAAoB,iBAATA,EACP,OAAO,EACX,GAAIA,aAAgBzJ,EAChB,OAAO,EACX,MACM3G,EADMqB,EAAY,MAAO+O,GACftQ,OACVuQ,EAAM9M,EAAGuB,MACTwL,EAAUD,EAAM,EAChBE,EAAY,EAAIF,EAAM,EAC5B,OAAI3N,EAAMM,0BAA4BiD,IAAgBqK,OAClD,EAGOtQ,IAAQsQ,GAAWtQ,IAAQuQ,CAE1C,CAuBA,MAAMrD,EAAWxK,EAAMwK,UACnB,SAAUtI,GAEN,GAAIA,EAAM9E,OAAS,KACf,MAAM,IAAIX,MAAM,sBAGpB,MAAMyB,EAAMK,EAAgB2D,GACtB4L,EAAuB,EAAf5L,EAAM9E,OAAaoE,EACjC,OAAOsM,EAAQ,EAAI5P,GAAOyB,OAAOmO,GAAS5P,CAC9C,EACEuM,EAAgBzK,EAAMyK,eACxB,SAAUvI,GACN,OAAO4I,EAAKN,EAAStI,GACzB,EAEE6L,EAAaC,EAAQxM,GAI3B,SAASyM,EAAW/P,GAGhB,OAFA4F,EAAS,WAAatC,EAAYtD,EAAKC,EAAK4P,GAErCrO,EAAgBxB,EAAKqF,EAChC,CAMA,SAAS2K,EAAQ9B,EAASvG,EAAY1J,EAAOgS,GACzC,GAAI,CAAC,YAAa,aAAaC,KAAMC,GAAMA,KAAKlS,GAC5C,MAAM,IAAIM,MAAM,uCACpB,MAAM4N,KAAEA,EAAIE,YAAEA,GAAgBvK,EAC9B,IAAI3D,KAAEA,EAAIE,QAAEA,EAAS+R,aAAcC,GAAQpS,EAC/B,MAARE,IACAA,GAAO,GACX+P,EAAUzN,EAAY,UAAWyN,GACjClQ,EAAmBC,GACfI,IACA6P,EAAUzN,EAAY,oBAAqB0L,EAAK+B,KAIpD,MAAMoC,EAAQ/D,EAAc2B,GACtBtD,EAAI1F,EAAuByC,GAC3B4I,EAAW,CAACR,EAAWnF,GAAImF,EAAWO,IAE5C,GAAW,MAAPD,IAAuB,IAARA,EAAe,CAE9B,MAAMG,GAAY,IAARH,EAAehE,EAAY1J,EAAGuB,OAASmM,EACjDE,EAASE,KAAKhQ,EAAY,eAAgB+P,GAC9C,CACA,MAAME,EAAO/M,KAAe4M,GACtB9R,EAAI6R,EA0BV,MAAO,CAAEI,OAAMC,MAxBf,SAAeC,GAEX,MAAMT,EAAI7D,EAASsE,GACnB,IAAK7E,EAAmBoE,GACpB,OACJ,MAAMU,EAAKhE,EAAKsD,GACVW,EAAI/K,EAAM6B,KAAKC,SAASsI,GAAGzM,WAC3B1C,EAAI4L,EAAKkE,EAAEhN,GACjB,GAAI9C,IAAMf,EACN,OAIJ,MAAMgB,EAAI2L,EAAKiE,EAAKjE,EAAKnO,EAAIuC,EAAI4J,IACjC,GAAI3J,IAAMhB,EACN,OACJ,IAAI4N,GAAYiD,EAAEhN,IAAM9C,EAAI,EAAI,GAAKb,OAAO2Q,EAAE/M,EAAIrC,GAC9CqP,EAAQ9P,EAKZ,OAJI9C,GAAQoP,EAAsBtM,KAC9B8P,EA/OZ,SAAoB9P,GAChB,OAAOsM,EAAsBtM,GAAK2L,GAAM3L,GAAKA,CACjD,CA6OoB0N,CAAW1N,GACnB4M,GAAY,GAET,IAAID,EAAU5M,EAAG+P,EAAOlD,EACnC,EAEJ,CACA,MAAMoC,EAAiB,CAAE9R,KAAM2D,EAAM3D,KAAME,SAAS,GAC9C2S,EAAiB,CAAE7S,KAAM2D,EAAM3D,KAAME,SAAS,GAiGpD,OA5EA0H,EAAM6B,KAAKK,eAAe,GA4EnB,CACHnG,QACAmP,aAnOJ,SAAsBtJ,EAAY+D,GAAe,GAC7C,OAAO3F,EAAM2B,eAAeC,GAAY8D,WAAWC,EACvD,EAkOIwF,gBAnMJ,SAAyBC,EAAUC,EAAS1F,GAAe,GACvD,IAA4B,IAAxB6D,EAAU4B,GACV,MAAM,IAAI5S,MAAM,iCACpB,IAA2B,IAAvBgR,EAAU6B,GACV,MAAM,IAAI7S,MAAM,iCAEpB,OADUwH,EAAMwB,QAAQ6J,GACfvJ,SAAS3C,EAAuBiM,IAAW1F,WAAWC,EACnE,EA6LI2F,KAvFJ,SAAcnD,EAASoD,EAASrT,EAAOgS,GACnC,MAAMS,KAAEA,EAAIC,MAAEA,GAAUX,EAAQ9B,EAASoD,EAASrT,GAC5CsT,EAAIzP,EAEV,OADa0P,EAAeD,EAAEpF,KAAKsF,UAAWF,EAAElM,YAAakM,EAAEnF,KACxDsF,CAAKhB,EAAMC,EACtB,EAmFIgB,OAlEJ,SAAgBC,EAAW1D,EAAS2D,EAAW5T,EAAO+S,GAClD,MAAMc,EAAKF,EACX1D,EAAUzN,EAAY,UAAWyN,GACjC2D,EAAYpR,EAAY,YAAaoR,GACrC,MAAM1T,KAAEA,EAAIE,QAAEA,EAAO0T,OAAEA,GAAW9T,EAGlC,GADAD,EAAmBC,GACf,WAAYA,EACZ,MAAM,IAAIM,MAAM,sCACpB,QAAeL,IAAX6T,GAAmC,YAAXA,GAAmC,QAAXA,EAChD,MAAM,IAAIxT,MAAM,iCACpB,MAAMyT,EAAsB,iBAAPF,GAAmBvM,EAAQuM,GAC1CG,GAASD,IACVD,GACa,iBAAPD,GACA,OAAPA,GACgB,iBAATA,EAAG9Q,GACM,iBAAT8Q,EAAG7Q,EACd,IAAK+Q,IAAUC,EACX,MAAM,IAAI1T,MAAM,4EACpB,IAAI2T,EACA1K,EACJ,IAGI,GAFIyK,IACAC,EAAO,IAAItE,EAAUkE,EAAG9Q,EAAG8Q,EAAG7Q,IAC9B+Q,EAAO,CAGP,IACmB,YAAXD,IACAG,EAAOtE,EAAUG,QAAQ+D,GACjC,CACA,MAAOK,GACH,KAAMA,aAAoBxT,EAAIC,KAC1B,MAAMuT,CACd,CACKD,GAAmB,QAAXH,IACTG,EAAOtE,EAAUE,YAAYgE,GACrC,CACAtK,EAAIzB,EAAMwB,QAAQsK,EACtB,CACA,MAAOnM,GACH,OAAO,CACX,CACA,IAAKwM,EACD,OAAO,EACX,GAAI/T,GAAQ+T,EAAKxD,WACb,OAAO,EACPrQ,IACA6P,EAAUpM,EAAMqK,KAAK+B,IACzB,MAAMlN,EAAEA,EAACC,EAAEA,GAAMiR,EACX3G,EAAIgB,EAAc2B,GAClBkE,EAAKvF,EAAK5L,GACVuN,EAAK5B,EAAKrB,EAAI6G,GACd3D,EAAK7B,EAAK5L,EAAIoR,GACd9D,EAAIvI,EAAM6B,KAAKuD,qBAAqB3D,EAAGgH,EAAIC,IAAK/K,WACtD,QAAK4K,GAEK1B,EAAK0B,EAAExK,KACJ9C,CACjB,EAOI8K,gBAAiB/F,EACjB6H,YACAqB,QAER","x_google_ignoreList":[0]}

package/dist/esm/node_modules/viem/node_modules/@noble/curves/esm/secp256k1.js

@@ -1,3 +0,0 @@
-import{sha256 as f}from"../../../../../@noble/hashes/esm/sha2.js";import{createCurve as t}from"./_shortw_utils.js";import{Field as n,mod as e,pow2 as i}from"./abstract/modular.js";
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */const o=BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f"),r=BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"),a=BigInt(0),c=BigInt(1),g=BigInt(2),s=(f,t)=>(f+t/g)/t;const B=n(o,void 0,void 0,{sqrt:function(f){const t=o,n=BigInt(3),e=BigInt(6),r=BigInt(11),a=BigInt(22),c=BigInt(23),s=BigInt(44),I=BigInt(88),d=f*f*f%t,b=d*d*f%t,l=i(b,n,t)*b%t,m=i(l,n,t)*b%t,x=i(m,g,t)*d%t,h=i(x,r,t)*x%t,p=i(h,a,t)*h%t,u=i(p,s,t)*p%t,w=i(u,I,t)*u%t,k=i(w,s,t)*p%t,q=i(k,n,t)*b%t,j=i(q,c,t)*h%t,E=i(j,e,t)*d%t,S=i(E,g,t);if(!B.eql(B.sqr(S),f))throw new Error("Cannot find square root");return S}}),I=t({a:a,b:BigInt(7),Fp:B,n:r,Gx:BigInt("55066263022277343669578718895168534326250603453777594175500187360389116729240"),Gy:BigInt("32670510020758816978083085130507043184471273380659243275938904335757337482424"),h:BigInt(1),lowS:!0,endo:{beta:BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),splitScalar:f=>{const t=r,n=BigInt("0x3086d221a7d46bcde86c90e49284eb15"),i=-c*BigInt("0xe4437ed6010e88286f547fa90abfe4c3"),o=BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"),a=n,g=BigInt("0x100000000000000000000000000000000"),B=s(a*f,t),I=s(-i*f,t);let d=e(f-B*n-I*o,t),b=e(-B*i-I*a,t);const l=d>g,m=b>g;if(l&&(d=t-d),m&&(b=t-b),d>g||b>g)throw new Error("splitScalar: Endomorphism failed, k="+f);return{k1neg:l,k1:d,k2neg:m,k2:b}}}},f);export{I as secp256k1};
-//# sourceMappingURL=secp256k1.js.map

package/dist/esm/node_modules/viem/node_modules/@noble/curves/esm/secp256k1.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secp256k1.js","sources":["../../../../../../../../node_modules/viem/node_modules/@noble/curves/esm/secp256k1.js"],"sourcesContent":["/**\n * NIST secp256k1. See [pdf](https://www.secg.org/sec2-v2.pdf).\n *\n * Seems to be rigid (not backdoored)\n * [as per discussion](https://bitcointalk.org/index.php?topic=289795.msg3183975#msg3183975).\n *\n * secp256k1 belongs to Koblitz curves: it has efficiently computable endomorphism.\n * Endomorphism uses 2x less RAM, speeds up precomputation by 2x and ECDH / key recovery by 20%.\n * For precomputed wNAF it trades off 1/2 init time & 1/3 ram for 20% perf hit.\n * [See explanation](https://gist.github.com/paulmillr/eb670806793e84df628a7c434a873066).\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha256 } from '@noble/hashes/sha2';\nimport { randomBytes } from '@noble/hashes/utils';\nimport { createCurve } from \"./_shortw_utils.js\";\nimport { createHasher, isogenyMap } from \"./abstract/hash-to-curve.js\";\nimport { Field, mod, pow2 } from \"./abstract/modular.js\";\nimport { aInRange, bytesToNumberBE, concatBytes, ensureBytes, inRange, numberToBytesBE, } from \"./abstract/utils.js\";\nimport { mapToCurveSimpleSWU } from \"./abstract/weierstrass.js\";\nconst secp256k1P = BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f');\nconst secp256k1N = BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141');\nconst _0n = BigInt(0);\nconst _1n = BigInt(1);\nconst _2n = BigInt(2);\nconst divNearest = (a, b) => (a + b / _2n) / b;\n/**\n * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.\n * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]\n */\nfunction sqrtMod(y) {\n    const P = secp256k1P;\n    // prettier-ignore\n    const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);\n    // prettier-ignore\n    const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);\n    const b2 = (y * y * y) % P; // x^3, 11\n    const b3 = (b2 * b2 * y) % P; // x^7\n    const b6 = (pow2(b3, _3n, P) * b3) % P;\n    const b9 = (pow2(b6, _3n, P) * b3) % P;\n    const b11 = (pow2(b9, _2n, P) * b2) % P;\n    const b22 = (pow2(b11, _11n, P) * b11) % P;\n    const b44 = (pow2(b22, _22n, P) * b22) % P;\n    const b88 = (pow2(b44, _44n, P) * b44) % P;\n    const b176 = (pow2(b88, _88n, P) * b88) % P;\n    const b220 = (pow2(b176, _44n, P) * b44) % P;\n    const b223 = (pow2(b220, _3n, P) * b3) % P;\n    const t1 = (pow2(b223, _23n, P) * b22) % P;\n    const t2 = (pow2(t1, _6n, P) * b2) % P;\n    const root = pow2(t2, _2n, P);\n    if (!Fpk1.eql(Fpk1.sqr(root), y))\n        throw new Error('Cannot find square root');\n    return root;\n}\nconst Fpk1 = Field(secp256k1P, undefined, undefined, { sqrt: sqrtMod });\n/**\n * secp256k1 curve, ECDSA and ECDH methods.\n *\n * Field: `2n**256n - 2n**32n - 2n**9n - 2n**8n - 2n**7n - 2n**6n - 2n**4n - 1n`\n *\n * @example\n * ```js\n * import { secp256k1 } from '@noble/curves/secp256k1';\n * const priv = secp256k1.utils.randomPrivateKey();\n * const pub = secp256k1.getPublicKey(priv);\n * const msg = new Uint8Array(32).fill(1); // message hash (not message) in ecdsa\n * const sig = secp256k1.sign(msg, priv); // `{prehash: true}` option is available\n * const isValid = secp256k1.verify(sig, msg, pub) === true;\n * ```\n */\nexport const secp256k1 = createCurve({\n    a: _0n,\n    b: BigInt(7),\n    Fp: Fpk1,\n    n: secp256k1N,\n    Gx: BigInt('55066263022277343669578718895168534326250603453777594175500187360389116729240'),\n    Gy: BigInt('32670510020758816978083085130507043184471273380659243275938904335757337482424'),\n    h: BigInt(1),\n    lowS: true, // Allow only low-S signatures by default in sign() and verify()\n    endo: {\n        // Endomorphism, see above\n        beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),\n        splitScalar: (k) => {\n            const n = secp256k1N;\n            const a1 = BigInt('0x3086d221a7d46bcde86c90e49284eb15');\n            const b1 = -_1n * BigInt('0xe4437ed6010e88286f547fa90abfe4c3');\n            const a2 = BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8');\n            const b2 = a1;\n            const POW_2_128 = BigInt('0x100000000000000000000000000000000'); // (2n**128n).toString(16)\n            const c1 = divNearest(b2 * k, n);\n            const c2 = divNearest(-b1 * k, n);\n            let k1 = mod(k - c1 * a1 - c2 * a2, n);\n            let k2 = mod(-c1 * b1 - c2 * b2, n);\n            const k1neg = k1 > POW_2_128;\n            const k2neg = k2 > POW_2_128;\n            if (k1neg)\n                k1 = n - k1;\n            if (k2neg)\n                k2 = n - k2;\n            if (k1 > POW_2_128 || k2 > POW_2_128) {\n                throw new Error('splitScalar: Endomorphism failed, k=' + k);\n            }\n            return { k1neg, k1, k2neg, k2 };\n        },\n    },\n}, sha256);\n// Schnorr signatures are superior to ECDSA from above. Below is Schnorr-specific BIP0340 code.\n// https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\n/** An object mapping tags to their tagged hash prefix of [SHA256(tag) | SHA256(tag)] */\nconst TAGGED_HASH_PREFIXES = {};\nfunction taggedHash(tag, ...messages) {\n    let tagP = TAGGED_HASH_PREFIXES[tag];\n    if (tagP === undefined) {\n        const tagH = sha256(Uint8Array.from(tag, (c) => c.charCodeAt(0)));\n        tagP = concatBytes(tagH, tagH);\n        TAGGED_HASH_PREFIXES[tag] = tagP;\n    }\n    return sha256(concatBytes(tagP, ...messages));\n}\n// ECDSA compact points are 33-byte. Schnorr is 32: we strip first byte 0x02 or 0x03\nconst pointToBytes = (point) => point.toRawBytes(true).slice(1);\nconst numTo32b = (n) => numberToBytesBE(n, 32);\nconst modP = (x) => mod(x, secp256k1P);\nconst modN = (x) => mod(x, secp256k1N);\nconst Point = /* @__PURE__ */ (() => secp256k1.ProjectivePoint)();\nconst GmulAdd = (Q, a, b) => Point.BASE.multiplyAndAddUnsafe(Q, a, b);\n// Calculate point, scalar and bytes\nfunction schnorrGetExtPubKey(priv) {\n    let d_ = secp256k1.utils.normPrivateKeyToScalar(priv); // same method executed in fromPrivateKey\n    let p = Point.fromPrivateKey(d_); // P = d'⋅G; 0 < d' < n check is done inside\n    const scalar = p.hasEvenY() ? d_ : modN(-d_);\n    return { scalar: scalar, bytes: pointToBytes(p) };\n}\n/**\n * lift_x from BIP340. Convert 32-byte x coordinate to elliptic curve point.\n * @returns valid point checked for being on-curve\n */\nfunction lift_x(x) {\n    aInRange('x', x, _1n, secp256k1P); // Fail if x ≥ p.\n    const xx = modP(x * x);\n    const c = modP(xx * x + BigInt(7)); // Let c = x³ + 7 mod p.\n    let y = sqrtMod(c); // Let y = c^(p+1)/4 mod p.\n    if (y % _2n !== _0n)\n        y = modP(-y); // Return the unique point P such that x(P) = x and\n    const p = new Point(x, y, _1n); // y(P) = y if y mod 2 = 0 or y(P) = p-y otherwise.\n    p.assertValidity();\n    return p;\n}\nconst num = bytesToNumberBE;\n/**\n * Create tagged hash, convert it to bigint, reduce modulo-n.\n */\nfunction challenge(...args) {\n    return modN(num(taggedHash('BIP0340/challenge', ...args)));\n}\n/**\n * Schnorr public key is just `x` coordinate of Point as per BIP340.\n */\nfunction schnorrGetPublicKey(privateKey) {\n    return schnorrGetExtPubKey(privateKey).bytes; // d'=int(sk). Fail if d'=0 or d'≥n. Ret bytes(d'⋅G)\n}\n/**\n * Creates Schnorr signature as per BIP340. Verifies itself before returning anything.\n * auxRand is optional and is not the sole source of k generation: bad CSPRNG won't be dangerous.\n */\nfunction schnorrSign(message, privateKey, auxRand = randomBytes(32)) {\n    const m = ensureBytes('message', message);\n    const { bytes: px, scalar: d } = schnorrGetExtPubKey(privateKey); // checks for isWithinCurveOrder\n    const a = ensureBytes('auxRand', auxRand, 32); // Auxiliary random data a: a 32-byte array\n    const t = numTo32b(d ^ num(taggedHash('BIP0340/aux', a))); // Let t be the byte-wise xor of bytes(d) and hash/aux(a)\n    const rand = taggedHash('BIP0340/nonce', t, px, m); // Let rand = hash/nonce(t || bytes(P) || m)\n    const k_ = modN(num(rand)); // Let k' = int(rand) mod n\n    if (k_ === _0n)\n        throw new Error('sign failed: k is zero'); // Fail if k' = 0.\n    const { bytes: rx, scalar: k } = schnorrGetExtPubKey(k_); // Let R = k'⋅G.\n    const e = challenge(rx, px, m); // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.\n    const sig = new Uint8Array(64); // Let sig = bytes(R) || bytes((k + ed) mod n).\n    sig.set(rx, 0);\n    sig.set(numTo32b(modN(k + e * d)), 32);\n    // If Verify(bytes(P), m, sig) (see below) returns failure, abort\n    if (!schnorrVerify(sig, m, px))\n        throw new Error('sign: Invalid signature produced');\n    return sig;\n}\n/**\n * Verifies Schnorr signature.\n * Will swallow errors & return false except for initial type validation of arguments.\n */\nfunction schnorrVerify(signature, message, publicKey) {\n    const sig = ensureBytes('signature', signature, 64);\n    const m = ensureBytes('message', message);\n    const pub = ensureBytes('publicKey', publicKey, 32);\n    try {\n        const P = lift_x(num(pub)); // P = lift_x(int(pk)); fail if that fails\n        const r = num(sig.subarray(0, 32)); // Let r = int(sig[0:32]); fail if r ≥ p.\n        if (!inRange(r, _1n, secp256k1P))\n            return false;\n        const s = num(sig.subarray(32, 64)); // Let s = int(sig[32:64]); fail if s ≥ n.\n        if (!inRange(s, _1n, secp256k1N))\n            return false;\n        const e = challenge(numTo32b(r), pointToBytes(P), m); // int(challenge(bytes(r)||bytes(P)||m))%n\n        const R = GmulAdd(P, s, modN(-e)); // R = s⋅G - e⋅P\n        if (!R || !R.hasEvenY() || R.toAffine().x !== r)\n            return false; // -eP == (n-e)P\n        return true; // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.\n    }\n    catch (error) {\n        return false;\n    }\n}\n/**\n * Schnorr signatures over secp256k1.\n * https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\n * @example\n * ```js\n * import { schnorr } from '@noble/curves/secp256k1';\n * const priv = schnorr.utils.randomPrivateKey();\n * const pub = schnorr.getPublicKey(priv);\n * const msg = new TextEncoder().encode('hello');\n * const sig = schnorr.sign(msg, priv);\n * const isValid = schnorr.verify(sig, msg, pub);\n * ```\n */\nexport const schnorr = /* @__PURE__ */ (() => ({\n    getPublicKey: schnorrGetPublicKey,\n    sign: schnorrSign,\n    verify: schnorrVerify,\n    utils: {\n        randomPrivateKey: secp256k1.utils.randomPrivateKey,\n        lift_x,\n        pointToBytes,\n        numberToBytesBE,\n        bytesToNumberBE,\n        taggedHash,\n        mod,\n    },\n}))();\nconst isoMap = /* @__PURE__ */ (() => isogenyMap(Fpk1, [\n    // xNum\n    [\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7',\n        '0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581',\n        '0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262',\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c',\n    ],\n    // xDen\n    [\n        '0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b',\n        '0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n    // yNum\n    [\n        '0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c',\n        '0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3',\n        '0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931',\n        '0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84',\n    ],\n    // yDen\n    [\n        '0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b',\n        '0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573',\n        '0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n].map((i) => i.map((j) => BigInt(j)))))();\nconst mapSWU = /* @__PURE__ */ (() => mapToCurveSimpleSWU(Fpk1, {\n    A: BigInt('0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533'),\n    B: BigInt('1771'),\n    Z: Fpk1.create(BigInt('-11')),\n}))();\n/** Hashing / encoding to secp256k1 points / field. RFC 9380 methods. */\nexport const secp256k1_hasher = /* @__PURE__ */ (() => createHasher(secp256k1.ProjectivePoint, (scalars) => {\n    const { x, y } = mapSWU(Fpk1.create(scalars[0]));\n    return isoMap(x, y);\n}, {\n    DST: 'secp256k1_XMD:SHA-256_SSWU_RO_',\n    encodeDST: 'secp256k1_XMD:SHA-256_SSWU_NU_',\n    p: Fpk1.ORDER,\n    m: 1,\n    k: 128,\n    expand: 'xmd',\n    hash: sha256,\n}))();\nexport const hashToCurve = /* @__PURE__ */ (() => secp256k1_hasher.hashToCurve)();\nexport const encodeToCurve = /* @__PURE__ */ (() => secp256k1_hasher.encodeToCurve)();\n//# sourceMappingURL=secp256k1.js.map"],"names":["secp256k1P","BigInt","secp256k1N","_0n","_1n","_2n","divNearest","a","b","Fpk1","Field","undefined","sqrt","y","P","_3n","_6n","_11n","_22n","_23n","_44n","_88n","b2","b3","b6","pow2","b9","b11","b22","b44","b88","b176","b220","b223","t1","t2","root","eql","sqr","Error","secp256k1","createCurve","Fp","n","Gx","Gy","h","lowS","endo","beta","splitScalar","k","a1","b1","a2","POW_2_128","c1","c2","k1","mod","k2","k1neg","k2neg","sha256"],"mappings":";sEAoBA,MAAMA,EAAaC,OAAO,sEACpBC,EAAaD,OAAO,sEACpBE,EAAMF,OAAO,GACbG,EAAMH,OAAO,GACbI,EAAMJ,OAAO,GACbK,EAAa,CAACC,EAAGC,KAAOD,EAAIC,EAAIH,GAAOG,EA6B7C,MAAMC,EAAOC,EAAMV,OAAYW,OAAWA,EAAW,CAAEC,KAxBvD,SAAiBC,GACb,MAAMC,EAAId,EAEJe,EAAMd,OAAO,GAAIe,EAAMf,OAAO,GAAIgB,EAAOhB,OAAO,IAAKiB,EAAOjB,OAAO,IAEnEkB,EAAOlB,OAAO,IAAKmB,EAAOnB,OAAO,IAAKoB,EAAOpB,OAAO,IACpDqB,EAAMT,EAAIA,EAAIA,EAAKC,EACnBS,EAAMD,EAAKA,EAAKT,EAAKC,EACrBU,EAAMC,EAAKF,EAAIR,EAAKD,GAAKS,EAAMT,EAC/BY,EAAMD,EAAKD,EAAIT,EAAKD,GAAKS,EAAMT,EAC/Ba,EAAOF,EAAKC,EAAIrB,EAAKS,GAAKQ,EAAMR,EAChCc,EAAOH,EAAKE,EAAKV,EAAMH,GAAKa,EAAOb,EACnCe,EAAOJ,EAAKG,EAAKV,EAAMJ,GAAKc,EAAOd,EACnCgB,EAAOL,EAAKI,EAAKT,EAAMN,GAAKe,EAAOf,EACnCiB,EAAQN,EAAKK,EAAKT,EAAMP,GAAKgB,EAAOhB,EACpCkB,EAAQP,EAAKM,EAAMX,EAAMN,GAAKe,EAAOf,EACrCmB,EAAQR,EAAKO,EAAMjB,EAAKD,GAAKS,EAAMT,EACnCoB,EAAMT,EAAKQ,EAAMd,EAAML,GAAKc,EAAOd,EACnCqB,EAAMV,EAAKS,EAAIlB,EAAKF,GAAKQ,EAAMR,EAC/BsB,EAAOX,EAAKU,EAAI9B,EAAKS,GAC3B,IAAKL,EAAK4B,IAAI5B,EAAK6B,IAAIF,GAAOvB,GAC1B,MAAM,IAAI0B,MAAM,2BACpB,OAAOH,CACX,IAiBaI,EAAYC,EAAY,CACjClC,EAAGJ,EACHK,EAAGP,OAAO,GACVyC,GAAIjC,EACJkC,EAAGzC,EACH0C,GAAI3C,OAAO,iFACX4C,GAAI5C,OAAO,iFACX6C,EAAG7C,OAAO,GACV8C,MAAM,EACNC,KAAM,CAEFC,KAAMhD,OAAO,sEACbiD,YAAcC,IACV,MAAMR,EAAIzC,EACJkD,EAAKnD,OAAO,sCACZoD,GAAMjD,EAAMH,OAAO,sCACnBqD,EAAKrD,OAAO,uCACZqB,EAAK8B,EACLG,EAAYtD,OAAO,uCACnBuD,EAAKlD,EAAWgB,EAAK6B,EAAGR,GACxBc,EAAKnD,GAAY+C,EAAKF,EAAGR,GAC/B,IAAIe,EAAKC,EAAIR,EAAIK,EAAKJ,EAAKK,EAAKH,EAAIX,GAChCiB,EAAKD,GAAKH,EAAKH,EAAKI,EAAKnC,EAAIqB,GACjC,MAAMkB,EAAQH,EAAKH,EACbO,EAAQF,EAAKL,EAKnB,GAJIM,IACAH,EAAKf,EAAIe,GACTI,IACAF,EAAKjB,EAAIiB,GACTF,EAAKH,GAAaK,EAAKL,EACvB,MAAM,IAAIhB,MAAM,uCAAyCY,GAE7D,MAAO,CAAEU,QAAOH,KAAII,QAAOF,SAGpCG","x_google_ignoreList":[0]}