{"version":3,"file":"noble_curves.min.mjs","sources":["../../node_modules/@noble/hashes/esm/hmac.js","../../node_modules/@noble/curves/esm/abstract/utils.js","../../node_modules/@noble/curves/esm/abstract/modular.js","../../node_modules/@noble/curves/esm/abstract/curve.js","../../node_modules/@noble/curves/esm/abstract/weierstrass.js","../../node_modules/@noble/curves/esm/_shortw_utils.js","../../node_modules/@noble/curves/esm/p256.js","../../node_modules/@noble/curves/esm/p384.js","../../node_modules/@noble/curves/esm/p521.js","../../node_modules/@noble/curves/esm/abstract/edwards.js","../../node_modules/@noble/curves/esm/abstract/montgomery.js","../../node_modules/@noble/curves/esm/ed448.js","../../node_modules/@noble/curves/esm/secp256k1.js","../../../../../src/crypto/public_key/elliptic/brainpool/brainpoolP256r1.ts","../../../../../src/crypto/public_key/elliptic/brainpool/brainpoolP384r1.ts","../../../../../src/crypto/public_key/elliptic/brainpool/brainpoolP512r1.ts","../../src/crypto/public_key/elliptic/noble_curves.js"],"sourcesContent":["import { hash as assertHash, bytes as assertBytes, exists as assertExists } from './_assert.js';\nimport { Hash, toBytes } from './utils.js';\n// HMAC (RFC 2104)\nexport class HMAC extends Hash {\n    constructor(hash, _key) {\n        super();\n        this.finished = false;\n        this.destroyed = false;\n        assertHash(hash);\n        const key = toBytes(_key);\n        this.iHash = hash.create();\n        if (typeof this.iHash.update !== 'function')\n            throw new Error('Expected instance of class which extends utils.Hash');\n        this.blockLen = this.iHash.blockLen;\n        this.outputLen = this.iHash.outputLen;\n        const blockLen = this.blockLen;\n        const pad = new Uint8Array(blockLen);\n        // blockLen can be bigger than outputLen\n        pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36;\n        this.iHash.update(pad);\n        // By doing update (processing of first block) of outer hash here we can re-use it between multiple calls via clone\n        this.oHash = hash.create();\n        // Undo internal XOR && apply outer XOR\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36 ^ 0x5c;\n        this.oHash.update(pad);\n        pad.fill(0);\n    }\n    update(buf) {\n        assertExists(this);\n        this.iHash.update(buf);\n        return this;\n    }\n    digestInto(out) {\n        assertExists(this);\n        assertBytes(out, this.outputLen);\n        this.finished = true;\n        this.iHash.digestInto(out);\n        this.oHash.update(out);\n        this.oHash.digestInto(out);\n        this.destroy();\n    }\n    digest() {\n        const out = new Uint8Array(this.oHash.outputLen);\n        this.digestInto(out);\n        return out;\n    }\n    _cloneInto(to) {\n        // Create new instance without calling constructor since key already in state and we don't know it.\n        to || (to = Object.create(Object.getPrototypeOf(this), {}));\n        const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;\n        to = to;\n        to.finished = finished;\n        to.destroyed = destroyed;\n        to.blockLen = blockLen;\n        to.outputLen = outputLen;\n        to.oHash = oHash._cloneInto(to.oHash);\n        to.iHash = iHash._cloneInto(to.iHash);\n        return to;\n    }\n    destroy() {\n        this.destroyed = true;\n        this.oHash.destroy();\n        this.iHash.destroy();\n    }\n}\n/**\n * HMAC: RFC2104 message authentication code.\n * @param hash - function that would be used e.g. sha256\n * @param key - message key\n * @param message - message data\n * @example\n * import { hmac } from '@noble/hashes/hmac';\n * import { sha256 } from '@noble/hashes/sha2';\n * const mac1 = hmac(sha256, 'key', 'message');\n */\nexport const hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();\nhmac.create = (hash, key) => new HMAC(hash, key);\n//# sourceMappingURL=hmac.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\n// 100 lines of code in the file are duplicated from noble-hashes (utils).\n// This is OK: `abstract` directory does not use noble-hashes.\n// User may opt-in into using different hashing library. This way, noble-hashes\n// won't be included into their bundle.\nconst _0n = /* @__PURE__ */ BigInt(0);\nconst _1n = /* @__PURE__ */ BigInt(1);\nconst _2n = /* @__PURE__ */ BigInt(2);\nexport function isBytes(a) {\n    return (a instanceof Uint8Array ||\n        (a != null && typeof a === 'object' && a.constructor.name === 'Uint8Array'));\n}\nexport function abytes(item) {\n    if (!isBytes(item))\n        throw new Error('Uint8Array expected');\n}\nexport function abool(title, value) {\n    if (typeof value !== 'boolean')\n        throw new Error(`${title} must be valid boolean, got \"${value}\".`);\n}\n// Array where index 0xf0 (240) is mapped to string 'f0'\nconst hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));\n/**\n * @example bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])) // 'cafe0123'\n */\nexport function bytesToHex(bytes) {\n    abytes(bytes);\n    // pre-caching improves the speed 6x\n    let hex = '';\n    for (let i = 0; i < bytes.length; i++) {\n        hex += hexes[bytes[i]];\n    }\n    return hex;\n}\nexport function numberToHexUnpadded(num) {\n    const hex = num.toString(16);\n    return hex.length & 1 ? `0${hex}` : hex;\n}\nexport function hexToNumber(hex) {\n    if (typeof hex !== 'string')\n        throw new Error('hex string expected, got ' + typeof hex);\n    // Big Endian\n    return BigInt(hex === '' ? '0' : `0x${hex}`);\n}\n// We use optimized technique to convert hex string to byte array\nconst asciis = { _0: 48, _9: 57, _A: 65, _F: 70, _a: 97, _f: 102 };\nfunction asciiToBase16(char) {\n    if (char >= asciis._0 && char <= asciis._9)\n        return char - asciis._0;\n    if (char >= asciis._A && char <= asciis._F)\n        return char - (asciis._A - 10);\n    if (char >= asciis._a && char <= asciis._f)\n        return char - (asciis._a - 10);\n    return;\n}\n/**\n * @example hexToBytes('cafe0123') // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])\n */\nexport function hexToBytes(hex) {\n    if (typeof hex !== 'string')\n        throw new Error('hex string expected, got ' + typeof hex);\n    const hl = hex.length;\n    const al = hl / 2;\n    if (hl % 2)\n        throw new Error('padded hex string expected, got unpadded hex of length ' + hl);\n    const array = new Uint8Array(al);\n    for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {\n        const n1 = asciiToBase16(hex.charCodeAt(hi));\n        const n2 = asciiToBase16(hex.charCodeAt(hi + 1));\n        if (n1 === undefined || n2 === undefined) {\n            const char = hex[hi] + hex[hi + 1];\n            throw new Error('hex string expected, got non-hex character \"' + char + '\" at index ' + hi);\n        }\n        array[ai] = n1 * 16 + n2;\n    }\n    return array;\n}\n// BE: Big Endian, LE: Little Endian\nexport function bytesToNumberBE(bytes) {\n    return hexToNumber(bytesToHex(bytes));\n}\nexport function bytesToNumberLE(bytes) {\n    abytes(bytes);\n    return hexToNumber(bytesToHex(Uint8Array.from(bytes).reverse()));\n}\nexport function numberToBytesBE(n, len) {\n    return hexToBytes(n.toString(16).padStart(len * 2, '0'));\n}\nexport function numberToBytesLE(n, len) {\n    return numberToBytesBE(n, len).reverse();\n}\n// Unpadded, rarely used\nexport function numberToVarBytesBE(n) {\n    return hexToBytes(numberToHexUnpadded(n));\n}\n/**\n * Takes hex string or Uint8Array, converts to Uint8Array.\n * Validates output length.\n * Will throw error for other types.\n * @param title descriptive title for an error e.g. 'private key'\n * @param hex hex string or Uint8Array\n * @param expectedLength optional, will compare to result array's length\n * @returns\n */\nexport function ensureBytes(title, hex, expectedLength) {\n    let res;\n    if (typeof hex === 'string') {\n        try {\n            res = hexToBytes(hex);\n        }\n        catch (e) {\n            throw new Error(`${title} must be valid hex string, got \"${hex}\". Cause: ${e}`);\n        }\n    }\n    else if (isBytes(hex)) {\n        // Uint8Array.from() instead of hash.slice() because node.js Buffer\n        // is instance of Uint8Array, and its slice() creates **mutable** copy\n        res = Uint8Array.from(hex);\n    }\n    else {\n        throw new Error(`${title} must be hex string or Uint8Array`);\n    }\n    const len = res.length;\n    if (typeof expectedLength === 'number' && len !== expectedLength)\n        throw new Error(`${title} expected ${expectedLength} bytes, got ${len}`);\n    return res;\n}\n/**\n * Copies several Uint8Arrays into one.\n */\nexport function concatBytes(...arrays) {\n    let sum = 0;\n    for (let i = 0; i < arrays.length; i++) {\n        const a = arrays[i];\n        abytes(a);\n        sum += a.length;\n    }\n    const res = new Uint8Array(sum);\n    for (let i = 0, pad = 0; i < arrays.length; i++) {\n        const a = arrays[i];\n        res.set(a, pad);\n        pad += a.length;\n    }\n    return res;\n}\n// Compares 2 u8a-s in kinda constant time\nexport function equalBytes(a, b) {\n    if (a.length !== b.length)\n        return false;\n    let diff = 0;\n    for (let i = 0; i < a.length; i++)\n        diff |= a[i] ^ b[i];\n    return diff === 0;\n}\n/**\n * @example utf8ToBytes('abc') // new Uint8Array([97, 98, 99])\n */\nexport function utf8ToBytes(str) {\n    if (typeof str !== 'string')\n        throw new Error(`utf8ToBytes expected string, got ${typeof str}`);\n    return new Uint8Array(new TextEncoder().encode(str)); // https://bugzil.la/1681809\n}\n// Is positive bigint\nconst isPosBig = (n) => typeof n === 'bigint' && _0n <= n;\nexport function inRange(n, min, max) {\n    return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;\n}\n/**\n * Asserts min <= n < max. NOTE: It's < max and not <= max.\n * @example\n * aInRange('x', x, 1n, 256n); // would assume x is in (1n..255n)\n */\nexport function aInRange(title, n, min, max) {\n    // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)?\n    // consider P=256n, min=0n, max=P\n    // - a for min=0 would require -1:          `inRange('x', x, -1n, P)`\n    // - b would commonly require subtraction:  `inRange('x', x, 0n, P - 1n)`\n    // - our way is the cleanest:               `inRange('x', x, 0n, P)\n    if (!inRange(n, min, max))\n        throw new Error(`expected valid ${title}: ${min} <= n < ${max}, got ${typeof n} ${n}`);\n}\n// Bit operations\n/**\n * Calculates amount of bits in a bigint.\n * Same as `n.toString(2).length`\n */\nexport function bitLen(n) {\n    let len;\n    for (len = 0; n > _0n; n >>= _1n, len += 1)\n        ;\n    return len;\n}\n/**\n * Gets single bit at position.\n * NOTE: first bit position is 0 (same as arrays)\n * Same as `!!+Array.from(n.toString(2)).reverse()[pos]`\n */\nexport function bitGet(n, pos) {\n    return (n >> BigInt(pos)) & _1n;\n}\n/**\n * Sets single bit at position.\n */\nexport function bitSet(n, pos, value) {\n    return n | ((value ? _1n : _0n) << BigInt(pos));\n}\n/**\n * Calculate mask for N bits. Not using ** operator with bigints because of old engines.\n * Same as BigInt(`0b${Array(i).fill('1').join('')}`)\n */\nexport const bitMask = (n) => (_2n << BigInt(n - 1)) - _1n;\n// DRBG\nconst u8n = (data) => new Uint8Array(data); // creates Uint8Array\nconst u8fr = (arr) => Uint8Array.from(arr); // another shortcut\n/**\n * Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n * @returns function that will call DRBG until 2nd arg returns something meaningful\n * @example\n *   const drbg = createHmacDRBG<Key>(32, 32, hmac);\n *   drbg(seed, bytesToKey); // bytesToKey must return Key or undefined\n */\nexport function createHmacDrbg(hashLen, qByteLen, hmacFn) {\n    if (typeof hashLen !== 'number' || hashLen < 2)\n        throw new Error('hashLen must be a number');\n    if (typeof qByteLen !== 'number' || qByteLen < 2)\n        throw new Error('qByteLen must be a number');\n    if (typeof hmacFn !== 'function')\n        throw new Error('hmacFn must be a function');\n    // Step B, Step C: set hashLen to 8*ceil(hlen/8)\n    let v = u8n(hashLen); // Minimal non-full-spec HMAC-DRBG from NIST 800-90 for RFC6979 sigs.\n    let k = u8n(hashLen); // Steps B and C of RFC6979 3.2: set hashLen, in our case always same\n    let i = 0; // Iterations counter, will throw when over 1000\n    const reset = () => {\n        v.fill(1);\n        k.fill(0);\n        i = 0;\n    };\n    const h = (...b) => hmacFn(k, v, ...b); // hmac(k)(v, ...values)\n    const reseed = (seed = u8n()) => {\n        // HMAC-DRBG reseed() function. Steps D-G\n        k = h(u8fr([0x00]), seed); // k = hmac(k || v || 0x00 || seed)\n        v = h(); // v = hmac(k || v)\n        if (seed.length === 0)\n            return;\n        k = h(u8fr([0x01]), seed); // k = hmac(k || v || 0x01 || seed)\n        v = h(); // v = hmac(k || v)\n    };\n    const gen = () => {\n        // HMAC-DRBG generate() function\n        if (i++ >= 1000)\n            throw new Error('drbg: tried 1000 values');\n        let len = 0;\n        const out = [];\n        while (len < qByteLen) {\n            v = h();\n            const sl = v.slice();\n            out.push(sl);\n            len += v.length;\n        }\n        return concatBytes(...out);\n    };\n    const genUntil = (seed, pred) => {\n        reset();\n        reseed(seed); // Steps D-G\n        let res = undefined; // Step H: grind until k is in [1..n-1]\n        while (!(res = pred(gen())))\n            reseed();\n        reset();\n        return res;\n    };\n    return genUntil;\n}\n// Validating curves and fields\nconst validatorFns = {\n    bigint: (val) => typeof val === 'bigint',\n    function: (val) => typeof val === 'function',\n    boolean: (val) => typeof val === 'boolean',\n    string: (val) => typeof val === 'string',\n    stringOrUint8Array: (val) => typeof val === 'string' || isBytes(val),\n    isSafeInteger: (val) => Number.isSafeInteger(val),\n    array: (val) => Array.isArray(val),\n    field: (val, object) => object.Fp.isValid(val),\n    hash: (val) => typeof val === 'function' && Number.isSafeInteger(val.outputLen),\n};\n// type Record<K extends string | number | symbol, T> = { [P in K]: T; }\nexport function validateObject(object, validators, optValidators = {}) {\n    const checkField = (fieldName, type, isOptional) => {\n        const checkVal = validatorFns[type];\n        if (typeof checkVal !== 'function')\n            throw new Error(`Invalid validator \"${type}\", expected function`);\n        const val = object[fieldName];\n        if (isOptional && val === undefined)\n            return;\n        if (!checkVal(val, object)) {\n            throw new Error(`Invalid param ${String(fieldName)}=${val} (${typeof val}), expected ${type}`);\n        }\n    };\n    for (const [fieldName, type] of Object.entries(validators))\n        checkField(fieldName, type, false);\n    for (const [fieldName, type] of Object.entries(optValidators))\n        checkField(fieldName, type, true);\n    return object;\n}\n// validate type tests\n// const o: { a: number; b: number; c: number } = { a: 1, b: 5, c: 6 };\n// const z0 = validateObject(o, { a: 'isSafeInteger' }, { c: 'bigint' }); // Ok!\n// // Should fail type-check\n// const z1 = validateObject(o, { a: 'tmp' }, { c: 'zz' });\n// const z2 = validateObject(o, { a: 'isSafeInteger' }, { c: 'zz' });\n// const z3 = validateObject(o, { test: 'boolean', z: 'bug' });\n// const z4 = validateObject(o, { a: 'boolean', z: 'bug' });\n/**\n * throws not implemented error\n */\nexport const notImplemented = () => {\n    throw new Error('not implemented');\n};\n/**\n * Memoizes (caches) computation result.\n * Uses WeakMap: the value is going auto-cleaned by GC after last reference is removed.\n */\nexport function memoized(fn) {\n    const map = new WeakMap();\n    return (arg, ...args) => {\n        const val = map.get(arg);\n        if (val !== undefined)\n            return val;\n        const computed = fn(arg, ...args);\n        map.set(arg, computed);\n        return computed;\n    };\n}\n//# sourceMappingURL=utils.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\n// Utilities for modular arithmetics and finite fields\nimport { bitMask, bytesToNumberBE, bytesToNumberLE, ensureBytes, numberToBytesBE, numberToBytesLE, validateObject, } from './utils.js';\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3);\n// prettier-ignore\nconst _4n = BigInt(4), _5n = BigInt(5), _8n = BigInt(8);\n// prettier-ignore\nconst _9n = BigInt(9), _16n = BigInt(16);\n// Calculates a modulo b\nexport function mod(a, b) {\n    const result = a % b;\n    return result >= _0n ? result : b + result;\n}\n/**\n * Efficiently raise num to power and do modular division.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n * @example\n * pow(2n, 6n, 11n) // 64n % 11n == 9n\n */\n// TODO: use field version && remove\nexport function pow(num, power, modulo) {\n    if (modulo <= _0n || power < _0n)\n        throw new Error('Expected power/modulo > 0');\n    if (modulo === _1n)\n        return _0n;\n    let res = _1n;\n    while (power > _0n) {\n        if (power & _1n)\n            res = (res * num) % modulo;\n        num = (num * num) % modulo;\n        power >>= _1n;\n    }\n    return res;\n}\n// Does x ^ (2 ^ power) mod p. pow2(30, 4) == 30 ^ (2 ^ 4)\nexport function pow2(x, power, modulo) {\n    let res = x;\n    while (power-- > _0n) {\n        res *= res;\n        res %= modulo;\n    }\n    return res;\n}\n// Inverses number over modulo\nexport function invert(number, modulo) {\n    if (number === _0n || modulo <= _0n) {\n        throw new Error(`invert: expected positive integers, got n=${number} mod=${modulo}`);\n    }\n    // Euclidean GCD https://brilliant.org/wiki/extended-euclidean-algorithm/\n    // Fermat's little theorem \"CT-like\" version inv(n) = n^(m-2) mod m is 30x slower.\n    let a = mod(number, modulo);\n    let b = modulo;\n    // prettier-ignore\n    let x = _0n, y = _1n, u = _1n, v = _0n;\n    while (a !== _0n) {\n        // JIT applies optimization if those two lines follow each other\n        const q = b / a;\n        const r = b % a;\n        const m = x - u * q;\n        const n = y - v * q;\n        // prettier-ignore\n        b = a, a = r, x = u, y = v, u = m, v = n;\n    }\n    const gcd = b;\n    if (gcd !== _1n)\n        throw new Error('invert: does not exist');\n    return mod(x, modulo);\n}\n/**\n * Tonelli-Shanks square root search algorithm.\n * 1. https://eprint.iacr.org/2012/685.pdf (page 12)\n * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks\n * Will start an infinite loop if field order P is not prime.\n * @param P field order\n * @returns function that takes field Fp (created from P) and number n\n */\nexport function tonelliShanks(P) {\n    // Legendre constant: used to calculate Legendre symbol (a | p),\n    // which denotes the value of a^((p-1)/2) (mod p).\n    // (a | p) ≡ 1    if a is a square (mod p)\n    // (a | p) ≡ -1   if a is not a square (mod p)\n    // (a | p) ≡ 0    if a ≡ 0 (mod p)\n    const legendreC = (P - _1n) / _2n;\n    let Q, S, Z;\n    // Step 1: By factoring out powers of 2 from p - 1,\n    // find q and s such that p - 1 = q*(2^s) with q odd\n    for (Q = P - _1n, S = 0; Q % _2n === _0n; Q /= _2n, S++)\n        ;\n    // Step 2: Select a non-square z such that (z | p) ≡ -1 and set c ≡ zq\n    for (Z = _2n; Z < P && pow(Z, legendreC, P) !== P - _1n; Z++)\n        ;\n    // Fast-path\n    if (S === 1) {\n        const p1div4 = (P + _1n) / _4n;\n        return function tonelliFast(Fp, n) {\n            const root = Fp.pow(n, p1div4);\n            if (!Fp.eql(Fp.sqr(root), n))\n                throw new Error('Cannot find square root');\n            return root;\n        };\n    }\n    // Slow-path\n    const Q1div2 = (Q + _1n) / _2n;\n    return function tonelliSlow(Fp, n) {\n        // Step 0: Check that n is indeed a square: (n | p) should not be ≡ -1\n        if (Fp.pow(n, legendreC) === Fp.neg(Fp.ONE))\n            throw new Error('Cannot find square root');\n        let r = S;\n        // TODO: will fail at Fp2/etc\n        let g = Fp.pow(Fp.mul(Fp.ONE, Z), Q); // will update both x and b\n        let x = Fp.pow(n, Q1div2); // first guess at the square root\n        let b = Fp.pow(n, Q); // first guess at the fudge factor\n        while (!Fp.eql(b, Fp.ONE)) {\n            if (Fp.eql(b, Fp.ZERO))\n                return Fp.ZERO; // https://en.wikipedia.org/wiki/Tonelli%E2%80%93Shanks_algorithm (4. If t = 0, return r = 0)\n            // Find m such b^(2^m)==1\n            let m = 1;\n            for (let t2 = Fp.sqr(b); m < r; m++) {\n                if (Fp.eql(t2, Fp.ONE))\n                    break;\n                t2 = Fp.sqr(t2); // t2 *= t2\n            }\n            // NOTE: r-m-1 can be bigger than 32, need to convert to bigint before shift, otherwise there will be overflow\n            const ge = Fp.pow(g, _1n << BigInt(r - m - 1)); // ge = 2^(r-m-1)\n            g = Fp.sqr(ge); // g = ge * ge\n            x = Fp.mul(x, ge); // x *= ge\n            b = Fp.mul(b, g); // b *= g\n            r = m;\n        }\n        return x;\n    };\n}\nexport function FpSqrt(P) {\n    // NOTE: different algorithms can give different roots, it is up to user to decide which one they want.\n    // For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).\n    // P ≡ 3 (mod 4)\n    // √n = n^((P+1)/4)\n    if (P % _4n === _3n) {\n        // Not all roots possible!\n        // const ORDER =\n        //   0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaabn;\n        // const NUM = 72057594037927816n;\n        const p1div4 = (P + _1n) / _4n;\n        return function sqrt3mod4(Fp, n) {\n            const root = Fp.pow(n, p1div4);\n            // Throw if root**2 != n\n            if (!Fp.eql(Fp.sqr(root), n))\n                throw new Error('Cannot find square root');\n            return root;\n        };\n    }\n    // Atkin algorithm for q ≡ 5 (mod 8), https://eprint.iacr.org/2012/685.pdf (page 10)\n    if (P % _8n === _5n) {\n        const c1 = (P - _5n) / _8n;\n        return function sqrt5mod8(Fp, n) {\n            const n2 = Fp.mul(n, _2n);\n            const v = Fp.pow(n2, c1);\n            const nv = Fp.mul(n, v);\n            const i = Fp.mul(Fp.mul(nv, _2n), v);\n            const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));\n            if (!Fp.eql(Fp.sqr(root), n))\n                throw new Error('Cannot find square root');\n            return root;\n        };\n    }\n    // P ≡ 9 (mod 16)\n    if (P % _16n === _9n) {\n        // NOTE: tonelli is too slow for bls-Fp2 calculations even on start\n        // Means we cannot use sqrt for constants at all!\n        //\n        // const c1 = Fp.sqrt(Fp.negate(Fp.ONE)); //  1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F\n        // const c2 = Fp.sqrt(c1);                //  2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F\n        // const c3 = Fp.sqrt(Fp.negate(c1));     //  3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F\n        // const c4 = (P + _7n) / _16n;           //  4. c4 = (q + 7) / 16        # Integer arithmetic\n        // sqrt = (x) => {\n        //   let tv1 = Fp.pow(x, c4);             //  1. tv1 = x^c4\n        //   let tv2 = Fp.mul(c1, tv1);           //  2. tv2 = c1 * tv1\n        //   const tv3 = Fp.mul(c2, tv1);         //  3. tv3 = c2 * tv1\n        //   let tv4 = Fp.mul(c3, tv1);           //  4. tv4 = c3 * tv1\n        //   const e1 = Fp.equals(Fp.square(tv2), x); //  5.  e1 = (tv2^2) == x\n        //   const e2 = Fp.equals(Fp.square(tv3), x); //  6.  e2 = (tv3^2) == x\n        //   tv1 = Fp.cmov(tv1, tv2, e1); //  7. tv1 = CMOV(tv1, tv2, e1)  # Select tv2 if (tv2^2) == x\n        //   tv2 = Fp.cmov(tv4, tv3, e2); //  8. tv2 = CMOV(tv4, tv3, e2)  # Select tv3 if (tv3^2) == x\n        //   const e3 = Fp.equals(Fp.square(tv2), x); //  9.  e3 = (tv2^2) == x\n        //   return Fp.cmov(tv1, tv2, e3); //  10.  z = CMOV(tv1, tv2, e3)  # Select the sqrt from tv1 and tv2\n        // }\n    }\n    // Other cases: Tonelli-Shanks algorithm\n    return tonelliShanks(P);\n}\n// Little-endian check for first LE bit (last BE bit);\nexport const isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n) === _1n;\n// prettier-ignore\nconst FIELD_FIELDS = [\n    'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',\n    'eql', 'add', 'sub', 'mul', 'pow', 'div',\n    'addN', 'subN', 'mulN', 'sqrN'\n];\nexport function validateField(field) {\n    const initial = {\n        ORDER: 'bigint',\n        MASK: 'bigint',\n        BYTES: 'isSafeInteger',\n        BITS: 'isSafeInteger',\n    };\n    const opts = FIELD_FIELDS.reduce((map, val) => {\n        map[val] = 'function';\n        return map;\n    }, initial);\n    return validateObject(field, opts);\n}\n// Generic field functions\n/**\n * Same as `pow` but for Fp: non-constant-time.\n * Unsafe in some contexts: uses ladder, so can expose bigint bits.\n */\nexport function FpPow(f, num, power) {\n    // Should have same speed as pow for bigints\n    // TODO: benchmark!\n    if (power < _0n)\n        throw new Error('Expected power > 0');\n    if (power === _0n)\n        return f.ONE;\n    if (power === _1n)\n        return num;\n    let p = f.ONE;\n    let d = num;\n    while (power > _0n) {\n        if (power & _1n)\n            p = f.mul(p, d);\n        d = f.sqr(d);\n        power >>= _1n;\n    }\n    return p;\n}\n/**\n * Efficiently invert an array of Field elements.\n * `inv(0)` will return `undefined` here: make sure to throw an error.\n */\nexport function FpInvertBatch(f, nums) {\n    const tmp = new Array(nums.length);\n    // Walk from first to last, multiply them by each other MOD p\n    const lastMultiplied = nums.reduce((acc, num, i) => {\n        if (f.is0(num))\n            return acc;\n        tmp[i] = acc;\n        return f.mul(acc, num);\n    }, f.ONE);\n    // Invert last element\n    const inverted = f.inv(lastMultiplied);\n    // Walk from last to first, multiply them by inverted each other MOD p\n    nums.reduceRight((acc, num, i) => {\n        if (f.is0(num))\n            return acc;\n        tmp[i] = f.mul(acc, tmp[i]);\n        return f.mul(acc, num);\n    }, inverted);\n    return tmp;\n}\nexport function FpDiv(f, lhs, rhs) {\n    return f.mul(lhs, typeof rhs === 'bigint' ? invert(rhs, f.ORDER) : f.inv(rhs));\n}\nexport function FpLegendre(order) {\n    // (a | p) ≡ 1    if a is a square (mod p), quadratic residue\n    // (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue\n    // (a | p) ≡ 0    if a ≡ 0 (mod p)\n    const legendreConst = (order - _1n) / _2n; // Integer arithmetic\n    return (f, x) => f.pow(x, legendreConst);\n}\n// This function returns True whenever the value x is a square in the field F.\nexport function FpIsSquare(f) {\n    const legendre = FpLegendre(f.ORDER);\n    return (x) => {\n        const p = legendre(f, x);\n        return f.eql(p, f.ZERO) || f.eql(p, f.ONE);\n    };\n}\n// CURVE.n lengths\nexport function nLength(n, nBitLength) {\n    // Bit size, byte size of CURVE.n\n    const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length;\n    const nByteLength = Math.ceil(_nBitLength / 8);\n    return { nBitLength: _nBitLength, nByteLength };\n}\n/**\n * Initializes a finite field over prime. **Non-primes are not supported.**\n * Do not init in loop: slow. Very fragile: always run a benchmark on a change.\n * Major performance optimizations:\n * * a) denormalized operations like mulN instead of mul\n * * b) same object shape: never add or remove keys\n * * c) Object.freeze\n * NOTE: operations don't check 'isValid' for all elements for performance reasons,\n * it is caller responsibility to check this.\n * This is low-level code, please make sure you know what you doing.\n * @param ORDER prime positive bigint\n * @param bitLen how many bits the field consumes\n * @param isLE (def: false) if encoding / decoding should be in little-endian\n * @param redef optional faster redefinitions of sqrt and other methods\n */\nexport function Field(ORDER, bitLen, isLE = false, redef = {}) {\n    if (ORDER <= _0n)\n        throw new Error(`Expected Field ORDER > 0, got ${ORDER}`);\n    const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, bitLen);\n    if (BYTES > 2048)\n        throw new Error('Field lengths over 2048 bytes are not supported');\n    const sqrtP = FpSqrt(ORDER);\n    const f = Object.freeze({\n        ORDER,\n        BITS,\n        BYTES,\n        MASK: bitMask(BITS),\n        ZERO: _0n,\n        ONE: _1n,\n        create: (num) => mod(num, ORDER),\n        isValid: (num) => {\n            if (typeof num !== 'bigint')\n                throw new Error(`Invalid field element: expected bigint, got ${typeof num}`);\n            return _0n <= num && num < ORDER; // 0 is valid element, but it's not invertible\n        },\n        is0: (num) => num === _0n,\n        isOdd: (num) => (num & _1n) === _1n,\n        neg: (num) => mod(-num, ORDER),\n        eql: (lhs, rhs) => lhs === rhs,\n        sqr: (num) => mod(num * num, ORDER),\n        add: (lhs, rhs) => mod(lhs + rhs, ORDER),\n        sub: (lhs, rhs) => mod(lhs - rhs, ORDER),\n        mul: (lhs, rhs) => mod(lhs * rhs, ORDER),\n        pow: (num, power) => FpPow(f, num, power),\n        div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),\n        // Same as above, but doesn't normalize\n        sqrN: (num) => num * num,\n        addN: (lhs, rhs) => lhs + rhs,\n        subN: (lhs, rhs) => lhs - rhs,\n        mulN: (lhs, rhs) => lhs * rhs,\n        inv: (num) => invert(num, ORDER),\n        sqrt: redef.sqrt || ((n) => sqrtP(f, n)),\n        invertBatch: (lst) => FpInvertBatch(f, lst),\n        // TODO: do we really need constant cmov?\n        // We don't have const-time bigints anyway, so probably will be not very useful\n        cmov: (a, b, c) => (c ? b : a),\n        toBytes: (num) => (isLE ? numberToBytesLE(num, BYTES) : numberToBytesBE(num, BYTES)),\n        fromBytes: (bytes) => {\n            if (bytes.length !== BYTES)\n                throw new Error(`Fp.fromBytes: expected ${BYTES}, got ${bytes.length}`);\n            return isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);\n        },\n    });\n    return Object.freeze(f);\n}\nexport function FpSqrtOdd(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(`Field doesn't have isOdd`);\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? root : Fp.neg(root);\n}\nexport function FpSqrtEven(Fp, elm) {\n    if (!Fp.isOdd)\n        throw new Error(`Field doesn't have isOdd`);\n    const root = Fp.sqrt(elm);\n    return Fp.isOdd(root) ? Fp.neg(root) : root;\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Same as mapKeyToField, but accepts less bytes (40 instead of 48 for 32-byte field).\n * Which makes it slightly more biased, less secure.\n * @deprecated use mapKeyToField instead\n */\nexport function hashToPrivateScalar(hash, groupOrder, isLE = false) {\n    hash = ensureBytes('privateHash', hash);\n    const hashLen = hash.length;\n    const minLen = nLength(groupOrder).nByteLength + 8;\n    if (minLen < 24 || hashLen < minLen || hashLen > 1024)\n        throw new Error(`hashToPrivateScalar: expected ${minLen}-1024 bytes of input, got ${hashLen}`);\n    const num = isLE ? bytesToNumberLE(hash) : bytesToNumberBE(hash);\n    return mod(num, groupOrder - _1n) + _1n;\n}\n/**\n * Returns total number of bytes consumed by the field element.\n * For example, 32 bytes for usual 256-bit weierstrass curve.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of field\n */\nexport function getFieldBytesLength(fieldOrder) {\n    if (typeof fieldOrder !== 'bigint')\n        throw new Error('field order must be bigint');\n    const bitLength = fieldOrder.toString(2).length;\n    return Math.ceil(bitLength / 8);\n}\n/**\n * Returns minimal amount of bytes that can be safely reduced\n * by field order.\n * Should be 2^-128 for 128-bit curve such as P256.\n * @param fieldOrder number of field elements, usually CURVE.n\n * @returns byte length of target hash\n */\nexport function getMinHashLength(fieldOrder) {\n    const length = getFieldBytesLength(fieldOrder);\n    return length + Math.ceil(length / 2);\n}\n/**\n * \"Constant-time\" private key generation utility.\n * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF\n * and convert them into private scalar, with the modulo bias being negligible.\n * Needs at least 48 bytes of input for 32-byte private key.\n * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/\n * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final\n * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5\n * @param hash hash output from SHA3 or a similar function\n * @param groupOrder size of subgroup - (e.g. secp256k1.CURVE.n)\n * @param isLE interpret hash bytes as LE num\n * @returns valid private scalar\n */\nexport function mapHashToField(key, fieldOrder, isLE = false) {\n    const len = key.length;\n    const fieldLen = getFieldBytesLength(fieldOrder);\n    const minLen = getMinHashLength(fieldOrder);\n    // No small numbers: need to understand bias story. No huge numbers: easier to detect JS timings.\n    if (len < 16 || len < minLen || len > 1024)\n        throw new Error(`expected ${minLen}-1024 bytes of input, got ${len}`);\n    const num = isLE ? bytesToNumberBE(key) : bytesToNumberLE(key);\n    // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0\n    const reduced = mod(num, fieldOrder - _1n) + _1n;\n    return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);\n}\n//# sourceMappingURL=modular.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\n// Abelian group utilities\nimport { validateField, nLength } from './modular.js';\nimport { validateObject, bitLen } from './utils.js';\nconst _0n = BigInt(0);\nconst _1n = BigInt(1);\n// Since points in different groups cannot be equal (different object constructor),\n// we can have single place to store precomputes\nconst pointPrecomputes = new WeakMap();\nconst pointWindowSizes = new WeakMap(); // This allows use make points immutable (nothing changes inside)\n// Elliptic curve multiplication of Point by scalar. Fragile.\n// Scalars should always be less than curve order: this should be checked inside of a curve itself.\n// Creates precomputation tables for fast multiplication:\n// - private scalar is split by fixed size windows of W bits\n// - every window point is collected from window's table & added to accumulator\n// - since windows are different, same point inside tables won't be accessed more than once per calc\n// - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)\n// - +1 window is neccessary for wNAF\n// - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication\n// TODO: Research returning 2d JS array of windows, instead of a single window. This would allow\n// windows to be in different memory locations\nexport function wNAF(c, bits) {\n    const constTimeNegate = (condition, item) => {\n        const neg = item.negate();\n        return condition ? neg : item;\n    };\n    const validateW = (W) => {\n        if (!Number.isSafeInteger(W) || W <= 0 || W > bits)\n            throw new Error(`Wrong window size=${W}, should be [1..${bits}]`);\n    };\n    const opts = (W) => {\n        validateW(W);\n        const windows = Math.ceil(bits / W) + 1; // +1, because\n        const windowSize = 2 ** (W - 1); // -1 because we skip zero\n        return { windows, windowSize };\n    };\n    return {\n        constTimeNegate,\n        // non-const time multiplication ladder\n        unsafeLadder(elm, n) {\n            let p = c.ZERO;\n            let d = elm;\n            while (n > _0n) {\n                if (n & _1n)\n                    p = p.add(d);\n                d = d.double();\n                n >>= _1n;\n            }\n            return p;\n        },\n        /**\n         * Creates a wNAF precomputation window. Used for caching.\n         * Default window size is set by `utils.precompute()` and is equal to 8.\n         * Number of precomputed points depends on the curve size:\n         * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:\n         * - 𝑊 is the window size\n         * - 𝑛 is the bitlength of the curve order.\n         * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.\n         * @returns precomputed point tables flattened to a single array\n         */\n        precomputeWindow(elm, W) {\n            const { windows, windowSize } = opts(W);\n            const points = [];\n            let p = elm;\n            let base = p;\n            for (let window = 0; window < windows; window++) {\n                base = p;\n                points.push(base);\n                // =1, because we skip zero\n                for (let i = 1; i < windowSize; i++) {\n                    base = base.add(p);\n                    points.push(base);\n                }\n                p = base.double();\n            }\n            return points;\n        },\n        /**\n         * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.\n         * @param W window size\n         * @param precomputes precomputed tables\n         * @param n scalar (we don't check here, but should be less than curve order)\n         * @returns real and fake (for const-time) points\n         */\n        wNAF(W, precomputes, n) {\n            // TODO: maybe check that scalar is less than group order? wNAF behavious is undefined otherwise\n            // But need to carefully remove other checks before wNAF. ORDER == bits here\n            const { windows, windowSize } = opts(W);\n            let p = c.ZERO;\n            let f = c.BASE;\n            const mask = BigInt(2 ** W - 1); // Create mask with W ones: 0b1111 for W=4 etc.\n            const maxNumber = 2 ** W;\n            const shiftBy = BigInt(W);\n            for (let window = 0; window < windows; window++) {\n                const offset = window * windowSize;\n                // Extract W bits.\n                let wbits = Number(n & mask);\n                // Shift number by W bits.\n                n >>= shiftBy;\n                // If the bits are bigger than max size, we'll split those.\n                // +224 => 256 - 32\n                if (wbits > windowSize) {\n                    wbits -= maxNumber;\n                    n += _1n;\n                }\n                // This code was first written with assumption that 'f' and 'p' will never be infinity point:\n                // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,\n                // there is negate now: it is possible that negated element from low value\n                // would be the same as high element, which will create carry into next window.\n                // It's not obvious how this can fail, but still worth investigating later.\n                // Check if we're onto Zero point.\n                // Add random point inside current window to f.\n                const offset1 = offset;\n                const offset2 = offset + Math.abs(wbits) - 1; // -1 because we skip zero\n                const cond1 = window % 2 !== 0;\n                const cond2 = wbits < 0;\n                if (wbits === 0) {\n                    // The most important part for const-time getPublicKey\n                    f = f.add(constTimeNegate(cond1, precomputes[offset1]));\n                }\n                else {\n                    p = p.add(constTimeNegate(cond2, precomputes[offset2]));\n                }\n            }\n            // JIT-compiler should not eliminate f here, since it will later be used in normalizeZ()\n            // Even if the variable is still unused, there are some checks which will\n            // throw an exception, so compiler needs to prove they won't happen, which is hard.\n            // At this point there is a way to F be infinity-point even if p is not,\n            // which makes it less const-time: around 1 bigint multiply.\n            return { p, f };\n        },\n        wNAFCached(P, n, transform) {\n            const W = pointWindowSizes.get(P) || 1;\n            // Calculate precomputes on a first run, reuse them after\n            let comp = pointPrecomputes.get(P);\n            if (!comp) {\n                comp = this.precomputeWindow(P, W);\n                if (W !== 1)\n                    pointPrecomputes.set(P, transform(comp));\n            }\n            return this.wNAF(W, comp, n);\n        },\n        // We calculate precomputes for elliptic curve point multiplication\n        // using windowed method. This specifies window size and\n        // stores precomputed values. Usually only base point would be precomputed.\n        setWindowSize(P, W) {\n            validateW(W);\n            pointWindowSizes.set(P, W);\n            pointPrecomputes.delete(P);\n        },\n    };\n}\n/**\n * Pippenger algorithm for multi-scalar multiplication (MSM).\n * MSM is basically (Pa + Qb + Rc + ...).\n * 30x faster vs naive addition on L=4096, 10x faster with precomputes.\n * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.\n * Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.\n * @param c Curve Point constructor\n * @param field field over CURVE.N - important that it's not over CURVE.P\n * @param points array of L curve points\n * @param scalars array of L scalars (aka private keys / bigints)\n */\nexport function pippenger(c, field, points, scalars) {\n    // If we split scalars by some window (let's say 8 bits), every chunk will only\n    // take 256 buckets even if there are 4096 scalars, also re-uses double.\n    // TODO:\n    // - https://eprint.iacr.org/2024/750.pdf\n    // - https://tches.iacr.org/index.php/TCHES/article/view/10287\n    // 0 is accepted in scalars\n    if (!Array.isArray(points) || !Array.isArray(scalars) || scalars.length !== points.length)\n        throw new Error('arrays of points and scalars must have equal length');\n    scalars.forEach((s, i) => {\n        if (!field.isValid(s))\n            throw new Error(`wrong scalar at index ${i}`);\n    });\n    points.forEach((p, i) => {\n        if (!(p instanceof c))\n            throw new Error(`wrong point at index ${i}`);\n    });\n    const wbits = bitLen(BigInt(points.length));\n    const windowSize = wbits > 12 ? wbits - 3 : wbits > 4 ? wbits - 2 : wbits ? 2 : 1; // in bits\n    const MASK = (1 << windowSize) - 1;\n    const buckets = new Array(MASK + 1).fill(c.ZERO); // +1 for zero array\n    const lastBits = Math.floor((field.BITS - 1) / windowSize) * windowSize;\n    let sum = c.ZERO;\n    for (let i = lastBits; i >= 0; i -= windowSize) {\n        buckets.fill(c.ZERO);\n        for (let j = 0; j < scalars.length; j++) {\n            const scalar = scalars[j];\n            const wbits = Number((scalar >> BigInt(i)) & BigInt(MASK));\n            buckets[wbits] = buckets[wbits].add(points[j]);\n        }\n        let resI = c.ZERO; // not using this will do small speed-up, but will lose ct\n        // Skip first bucket, because it is zero\n        for (let j = buckets.length - 1, sumI = c.ZERO; j > 0; j--) {\n            sumI = sumI.add(buckets[j]);\n            resI = resI.add(sumI);\n        }\n        sum = sum.add(resI);\n        if (i !== 0)\n            for (let j = 0; j < windowSize; j++)\n                sum = sum.double();\n    }\n    return sum;\n}\nexport function validateBasic(curve) {\n    validateField(curve.Fp);\n    validateObject(curve, {\n        n: 'bigint',\n        h: 'bigint',\n        Gx: 'field',\n        Gy: 'field',\n    }, {\n        nBitLength: 'isSafeInteger',\n        nByteLength: 'isSafeInteger',\n    });\n    // Set defaults\n    return Object.freeze({\n        ...nLength(curve.n, curve.nBitLength),\n        ...curve,\n        ...{ p: curve.Fp.ORDER },\n    });\n}\n//# sourceMappingURL=curve.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\n// Short Weierstrass curve. The formula is: y² = x³ + ax + b\nimport { validateBasic, wNAF, pippenger, } from './curve.js';\nimport * as mod from './modular.js';\nimport * as ut from './utils.js';\nimport { ensureBytes, memoized, abool } from './utils.js';\nfunction validateSigVerOpts(opts) {\n    if (opts.lowS !== undefined)\n        abool('lowS', opts.lowS);\n    if (opts.prehash !== undefined)\n        abool('prehash', opts.prehash);\n}\nfunction validatePointOpts(curve) {\n    const opts = validateBasic(curve);\n    ut.validateObject(opts, {\n        a: 'field',\n        b: 'field',\n    }, {\n        allowedPrivateKeyLengths: 'array',\n        wrapPrivateKey: 'boolean',\n        isTorsionFree: 'function',\n        clearCofactor: 'function',\n        allowInfinityPoint: 'boolean',\n        fromBytes: 'function',\n        toBytes: 'function',\n    });\n    const { endo, Fp, a } = opts;\n    if (endo) {\n        if (!Fp.eql(a, Fp.ZERO)) {\n            throw new Error('Endomorphism can only be defined for Koblitz curves that have a=0');\n        }\n        if (typeof endo !== 'object' ||\n            typeof endo.beta !== 'bigint' ||\n            typeof endo.splitScalar !== 'function') {\n            throw new Error('Expected endomorphism with beta: bigint and splitScalar: function');\n        }\n    }\n    return Object.freeze({ ...opts });\n}\nconst { bytesToNumberBE: b2n, hexToBytes: h2b } = ut;\n/**\n * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:\n *\n *     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]\n *\n * Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html\n */\nexport const DER = {\n    // asn.1 DER encoding utils\n    Err: class DERErr extends Error {\n        constructor(m = '') {\n            super(m);\n        }\n    },\n    // Basic building block is TLV (Tag-Length-Value)\n    _tlv: {\n        encode: (tag, data) => {\n            const { Err: E } = DER;\n            if (tag < 0 || tag > 256)\n                throw new E('tlv.encode: wrong tag');\n            if (data.length & 1)\n                throw new E('tlv.encode: unpadded data');\n            const dataLen = data.length / 2;\n            const len = ut.numberToHexUnpadded(dataLen);\n            if ((len.length / 2) & 128)\n                throw new E('tlv.encode: long form length too big');\n            // length of length with long form flag\n            const lenLen = dataLen > 127 ? ut.numberToHexUnpadded((len.length / 2) | 128) : '';\n            return `${ut.numberToHexUnpadded(tag)}${lenLen}${len}${data}`;\n        },\n        // v - value, l - left bytes (unparsed)\n        decode(tag, data) {\n            const { Err: E } = DER;\n            let pos = 0;\n            if (tag < 0 || tag > 256)\n                throw new E('tlv.encode: wrong tag');\n            if (data.length < 2 || data[pos++] !== tag)\n                throw new E('tlv.decode: wrong tlv');\n            const first = data[pos++];\n            const isLong = !!(first & 128); // First bit of first length byte is flag for short/long form\n            let length = 0;\n            if (!isLong)\n                length = first;\n            else {\n                // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]\n                const lenLen = first & 127;\n                if (!lenLen)\n                    throw new E('tlv.decode(long): indefinite length not supported');\n                if (lenLen > 4)\n                    throw new E('tlv.decode(long): byte length is too big'); // this will overflow u32 in js\n                const lengthBytes = data.subarray(pos, pos + lenLen);\n                if (lengthBytes.length !== lenLen)\n                    throw new E('tlv.decode: length bytes not complete');\n                if (lengthBytes[0] === 0)\n                    throw new E('tlv.decode(long): zero leftmost byte');\n                for (const b of lengthBytes)\n                    length = (length << 8) | b;\n                pos += lenLen;\n                if (length < 128)\n                    throw new E('tlv.decode(long): not minimal encoding');\n            }\n            const v = data.subarray(pos, pos + length);\n            if (v.length !== length)\n                throw new E('tlv.decode: wrong value length');\n            return { v, l: data.subarray(pos + length) };\n        },\n    },\n    // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,\n    // since we always use positive integers here. It must always be empty:\n    // - add zero byte if exists\n    // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)\n    _int: {\n        encode(num) {\n            const { Err: E } = DER;\n            if (num < _0n)\n                throw new E('integer: negative integers are not allowed');\n            let hex = ut.numberToHexUnpadded(num);\n            // Pad with zero byte if negative flag is present\n            if (Number.parseInt(hex[0], 16) & 0b1000)\n                hex = '00' + hex;\n            if (hex.length & 1)\n                throw new E('unexpected assertion');\n            return hex;\n        },\n        decode(data) {\n            const { Err: E } = DER;\n            if (data[0] & 128)\n                throw new E('Invalid signature integer: negative');\n            if (data[0] === 0x00 && !(data[1] & 128))\n                throw new E('Invalid signature integer: unnecessary leading zero');\n            return b2n(data);\n        },\n    },\n    toSig(hex) {\n        // parse DER signature\n        const { Err: E, _int: int, _tlv: tlv } = DER;\n        const data = typeof hex === 'string' ? h2b(hex) : hex;\n        ut.abytes(data);\n        const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);\n        if (seqLeftBytes.length)\n            throw new E('Invalid signature: left bytes after parsing');\n        const { v: rBytes, l: rLeftBytes } = tlv.decode(0x02, seqBytes);\n        const { v: sBytes, l: sLeftBytes } = tlv.decode(0x02, rLeftBytes);\n        if (sLeftBytes.length)\n            throw new E('Invalid signature: left bytes after parsing');\n        return { r: int.decode(rBytes), s: int.decode(sBytes) };\n    },\n    hexFromSig(sig) {\n        const { _tlv: tlv, _int: int } = DER;\n        const seq = `${tlv.encode(0x02, int.encode(sig.r))}${tlv.encode(0x02, int.encode(sig.s))}`;\n        return tlv.encode(0x30, seq);\n    },\n};\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);\nexport function weierstrassPoints(opts) {\n    const CURVE = validatePointOpts(opts);\n    const { Fp } = CURVE; // All curves has same field / group length as for now, but they can differ\n    const Fn = mod.Field(CURVE.n, CURVE.nBitLength);\n    const toBytes = CURVE.toBytes ||\n        ((_c, point, _isCompressed) => {\n            const a = point.toAffine();\n            return ut.concatBytes(Uint8Array.from([0x04]), Fp.toBytes(a.x), Fp.toBytes(a.y));\n        });\n    const fromBytes = CURVE.fromBytes ||\n        ((bytes) => {\n            // const head = bytes[0];\n            const tail = bytes.subarray(1);\n            // if (head !== 0x04) throw new Error('Only non-compressed encoding is supported');\n            const x = Fp.fromBytes(tail.subarray(0, Fp.BYTES));\n            const y = Fp.fromBytes(tail.subarray(Fp.BYTES, 2 * Fp.BYTES));\n            return { x, y };\n        });\n    /**\n     * y² = x³ + ax + b: Short weierstrass curve formula\n     * @returns y²\n     */\n    function weierstrassEquation(x) {\n        const { a, b } = CURVE;\n        const x2 = Fp.sqr(x); // x * x\n        const x3 = Fp.mul(x2, x); // x2 * x\n        return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x3 + a * x + b\n    }\n    // Validate whether the passed curve params are valid.\n    // We check if curve equation works for generator point.\n    // `assertValidity()` won't work: `isTorsionFree()` is not available at this point in bls12-381.\n    // ProjectivePoint class has not been initialized yet.\n    if (!Fp.eql(Fp.sqr(CURVE.Gy), weierstrassEquation(CURVE.Gx)))\n        throw new Error('bad generator point: equation left != right');\n    // Valid group elements reside in range 1..n-1\n    function isWithinCurveOrder(num) {\n        return ut.inRange(num, _1n, CURVE.n);\n    }\n    // Validates if priv key is valid and converts it to bigint.\n    // Supports options allowedPrivateKeyLengths and wrapPrivateKey.\n    function normPrivateKeyToScalar(key) {\n        const { allowedPrivateKeyLengths: lengths, nByteLength, wrapPrivateKey, n: N } = CURVE;\n        if (lengths && typeof key !== 'bigint') {\n            if (ut.isBytes(key))\n                key = ut.bytesToHex(key);\n            // Normalize to hex string, pad. E.g. P521 would norm 130-132 char hex to 132-char bytes\n            if (typeof key !== 'string' || !lengths.includes(key.length))\n                throw new Error('Invalid key');\n            key = key.padStart(nByteLength * 2, '0');\n        }\n        let num;\n        try {\n            num =\n                typeof key === 'bigint'\n                    ? key\n                    : ut.bytesToNumberBE(ensureBytes('private key', key, nByteLength));\n        }\n        catch (error) {\n            throw new Error(`private key must be ${nByteLength} bytes, hex or bigint, not ${typeof key}`);\n        }\n        if (wrapPrivateKey)\n            num = mod.mod(num, N); // disabled by default, enabled for BLS\n        ut.aInRange('private key', num, _1n, N); // num in range [1..N-1]\n        return num;\n    }\n    function assertPrjPoint(other) {\n        if (!(other instanceof Point))\n            throw new Error('ProjectivePoint expected');\n    }\n    // Memoized toAffine / validity check. They are heavy. Points are immutable.\n    // Converts Projective point to affine (x, y) coordinates.\n    // Can accept precomputed Z^-1 - for example, from invertBatch.\n    // (x, y, z) ∋ (x=x/z, y=y/z)\n    const toAffineMemo = memoized((p, iz) => {\n        const { px: x, py: y, pz: z } = p;\n        // Fast-path for normalized points\n        if (Fp.eql(z, Fp.ONE))\n            return { x, y };\n        const is0 = p.is0();\n        // If invZ was 0, we return zero point. However we still want to execute\n        // all operations, so we replace invZ with a random number, 1.\n        if (iz == null)\n            iz = is0 ? Fp.ONE : Fp.inv(z);\n        const ax = Fp.mul(x, iz);\n        const ay = Fp.mul(y, iz);\n        const zz = Fp.mul(z, iz);\n        if (is0)\n            return { x: Fp.ZERO, y: Fp.ZERO };\n        if (!Fp.eql(zz, Fp.ONE))\n            throw new Error('invZ was invalid');\n        return { x: ax, y: ay };\n    });\n    // NOTE: on exception this will crash 'cached' and no value will be set.\n    // Otherwise true will be return\n    const assertValidMemo = memoized((p) => {\n        if (p.is0()) {\n            // (0, 1, 0) aka ZERO is invalid in most contexts.\n            // In BLS, ZERO can be serialized, so we allow it.\n            // (0, 0, 0) is wrong representation of ZERO and is always invalid.\n            if (CURVE.allowInfinityPoint && !Fp.is0(p.py))\n                return;\n            throw new Error('bad point: ZERO');\n        }\n        // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`\n        const { x, y } = p.toAffine();\n        // Check if x, y are valid field elements\n        if (!Fp.isValid(x) || !Fp.isValid(y))\n            throw new Error('bad point: x or y not FE');\n        const left = Fp.sqr(y); // y²\n        const right = weierstrassEquation(x); // x³ + ax + b\n        if (!Fp.eql(left, right))\n            throw new Error('bad point: equation left != right');\n        if (!p.isTorsionFree())\n            throw new Error('bad point: not in prime-order subgroup');\n        return true;\n    });\n    /**\n     * Projective Point works in 3d / projective (homogeneous) coordinates: (x, y, z) ∋ (x=x/z, y=y/z)\n     * Default Point works in 2d / affine coordinates: (x, y)\n     * We're doing calculations in projective, because its operations don't require costly inversion.\n     */\n    class Point {\n        constructor(px, py, pz) {\n            this.px = px;\n            this.py = py;\n            this.pz = pz;\n            if (px == null || !Fp.isValid(px))\n                throw new Error('x required');\n            if (py == null || !Fp.isValid(py))\n                throw new Error('y required');\n            if (pz == null || !Fp.isValid(pz))\n                throw new Error('z required');\n            Object.freeze(this);\n        }\n        // Does not validate if the point is on-curve.\n        // Use fromHex instead, or call assertValidity() later.\n        static fromAffine(p) {\n            const { x, y } = p || {};\n            if (!p || !Fp.isValid(x) || !Fp.isValid(y))\n                throw new Error('invalid affine point');\n            if (p instanceof Point)\n                throw new Error('projective point not allowed');\n            const is0 = (i) => Fp.eql(i, Fp.ZERO);\n            // fromAffine(x:0, y:0) would produce (x:0, y:0, z:1), but we need (x:0, y:1, z:0)\n            if (is0(x) && is0(y))\n                return Point.ZERO;\n            return new Point(x, y, Fp.ONE);\n        }\n        get x() {\n            return this.toAffine().x;\n        }\n        get y() {\n            return this.toAffine().y;\n        }\n        /**\n         * Takes a bunch of Projective Points but executes only one\n         * inversion on all of them. Inversion is very slow operation,\n         * so this improves performance massively.\n         * Optimization: converts a list of projective points to a list of identical points with Z=1.\n         */\n        static normalizeZ(points) {\n            const toInv = Fp.invertBatch(points.map((p) => p.pz));\n            return points.map((p, i) => p.toAffine(toInv[i])).map(Point.fromAffine);\n        }\n        /**\n         * Converts hash string or Uint8Array to Point.\n         * @param hex short/long ECDSA hex\n         */\n        static fromHex(hex) {\n            const P = Point.fromAffine(fromBytes(ensureBytes('pointHex', hex)));\n            P.assertValidity();\n            return P;\n        }\n        // Multiplies generator point by privateKey.\n        static fromPrivateKey(privateKey) {\n            return Point.BASE.multiply(normPrivateKeyToScalar(privateKey));\n        }\n        // Multiscalar Multiplication\n        static msm(points, scalars) {\n            return pippenger(Point, Fn, points, scalars);\n        }\n        // \"Private method\", don't use it directly\n        _setWindowSize(windowSize) {\n            wnaf.setWindowSize(this, windowSize);\n        }\n        // A point on curve is valid if it conforms to equation.\n        assertValidity() {\n            assertValidMemo(this);\n        }\n        hasEvenY() {\n            const { y } = this.toAffine();\n            if (Fp.isOdd)\n                return !Fp.isOdd(y);\n            throw new Error(\"Field doesn't support isOdd\");\n        }\n        /**\n         * Compare one point to another.\n         */\n        equals(other) {\n            assertPrjPoint(other);\n            const { px: X1, py: Y1, pz: Z1 } = this;\n            const { px: X2, py: Y2, pz: Z2 } = other;\n            const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));\n            const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));\n            return U1 && U2;\n        }\n        /**\n         * Flips point to one corresponding to (x, -y) in Affine coordinates.\n         */\n        negate() {\n            return new Point(this.px, Fp.neg(this.py), this.pz);\n        }\n        // Renes-Costello-Batina exception-free doubling formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 3\n        // Cost: 8M + 3S + 3*a + 2*b3 + 15add.\n        double() {\n            const { a, b } = CURVE;\n            const b3 = Fp.mul(b, _3n);\n            const { px: X1, py: Y1, pz: Z1 } = this;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            let t0 = Fp.mul(X1, X1); // step 1\n            let t1 = Fp.mul(Y1, Y1);\n            let t2 = Fp.mul(Z1, Z1);\n            let t3 = Fp.mul(X1, Y1);\n            t3 = Fp.add(t3, t3); // step 5\n            Z3 = Fp.mul(X1, Z1);\n            Z3 = Fp.add(Z3, Z3);\n            X3 = Fp.mul(a, Z3);\n            Y3 = Fp.mul(b3, t2);\n            Y3 = Fp.add(X3, Y3); // step 10\n            X3 = Fp.sub(t1, Y3);\n            Y3 = Fp.add(t1, Y3);\n            Y3 = Fp.mul(X3, Y3);\n            X3 = Fp.mul(t3, X3);\n            Z3 = Fp.mul(b3, Z3); // step 15\n            t2 = Fp.mul(a, t2);\n            t3 = Fp.sub(t0, t2);\n            t3 = Fp.mul(a, t3);\n            t3 = Fp.add(t3, Z3);\n            Z3 = Fp.add(t0, t0); // step 20\n            t0 = Fp.add(Z3, t0);\n            t0 = Fp.add(t0, t2);\n            t0 = Fp.mul(t0, t3);\n            Y3 = Fp.add(Y3, t0);\n            t2 = Fp.mul(Y1, Z1); // step 25\n            t2 = Fp.add(t2, t2);\n            t0 = Fp.mul(t2, t3);\n            X3 = Fp.sub(X3, t0);\n            Z3 = Fp.mul(t2, t1);\n            Z3 = Fp.add(Z3, Z3); // step 30\n            Z3 = Fp.add(Z3, Z3);\n            return new Point(X3, Y3, Z3);\n        }\n        // Renes-Costello-Batina exception-free addition formula.\n        // There is 30% faster Jacobian formula, but it is not complete.\n        // https://eprint.iacr.org/2015/1060, algorithm 1\n        // Cost: 12M + 0S + 3*a + 3*b3 + 23add.\n        add(other) {\n            assertPrjPoint(other);\n            const { px: X1, py: Y1, pz: Z1 } = this;\n            const { px: X2, py: Y2, pz: Z2 } = other;\n            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore\n            const a = CURVE.a;\n            const b3 = Fp.mul(CURVE.b, _3n);\n            let t0 = Fp.mul(X1, X2); // step 1\n            let t1 = Fp.mul(Y1, Y2);\n            let t2 = Fp.mul(Z1, Z2);\n            let t3 = Fp.add(X1, Y1);\n            let t4 = Fp.add(X2, Y2); // step 5\n            t3 = Fp.mul(t3, t4);\n            t4 = Fp.add(t0, t1);\n            t3 = Fp.sub(t3, t4);\n            t4 = Fp.add(X1, Z1);\n            let t5 = Fp.add(X2, Z2); // step 10\n            t4 = Fp.mul(t4, t5);\n            t5 = Fp.add(t0, t2);\n            t4 = Fp.sub(t4, t5);\n            t5 = Fp.add(Y1, Z1);\n            X3 = Fp.add(Y2, Z2); // step 15\n            t5 = Fp.mul(t5, X3);\n            X3 = Fp.add(t1, t2);\n            t5 = Fp.sub(t5, X3);\n            Z3 = Fp.mul(a, t4);\n            X3 = Fp.mul(b3, t2); // step 20\n            Z3 = Fp.add(X3, Z3);\n            X3 = Fp.sub(t1, Z3);\n            Z3 = Fp.add(t1, Z3);\n            Y3 = Fp.mul(X3, Z3);\n            t1 = Fp.add(t0, t0); // step 25\n            t1 = Fp.add(t1, t0);\n            t2 = Fp.mul(a, t2);\n            t4 = Fp.mul(b3, t4);\n            t1 = Fp.add(t1, t2);\n            t2 = Fp.sub(t0, t2); // step 30\n            t2 = Fp.mul(a, t2);\n            t4 = Fp.add(t4, t2);\n            t0 = Fp.mul(t1, t4);\n            Y3 = Fp.add(Y3, t0);\n            t0 = Fp.mul(t5, t4); // step 35\n            X3 = Fp.mul(t3, X3);\n            X3 = Fp.sub(X3, t0);\n            t0 = Fp.mul(t3, t1);\n            Z3 = Fp.mul(t5, Z3);\n            Z3 = Fp.add(Z3, t0); // step 40\n            return new Point(X3, Y3, Z3);\n        }\n        subtract(other) {\n            return this.add(other.negate());\n        }\n        is0() {\n            return this.equals(Point.ZERO);\n        }\n        wNAF(n) {\n            return wnaf.wNAFCached(this, n, Point.normalizeZ);\n        }\n        /**\n         * Non-constant-time multiplication. Uses double-and-add algorithm.\n         * It's faster, but should only be used when you don't care about\n         * an exposed private key e.g. sig verification, which works over *public* keys.\n         */\n        multiplyUnsafe(sc) {\n            ut.aInRange('scalar', sc, _0n, CURVE.n);\n            const I = Point.ZERO;\n            if (sc === _0n)\n                return I;\n            if (sc === _1n)\n                return this;\n            const { endo } = CURVE;\n            if (!endo)\n                return wnaf.unsafeLadder(this, sc);\n            // Apply endomorphism\n            let { k1neg, k1, k2neg, k2 } = endo.splitScalar(sc);\n            let k1p = I;\n            let k2p = I;\n            let d = this;\n            while (k1 > _0n || k2 > _0n) {\n                if (k1 & _1n)\n                    k1p = k1p.add(d);\n                if (k2 & _1n)\n                    k2p = k2p.add(d);\n                d = d.double();\n                k1 >>= _1n;\n                k2 >>= _1n;\n            }\n            if (k1neg)\n                k1p = k1p.negate();\n            if (k2neg)\n                k2p = k2p.negate();\n            k2p = new Point(Fp.mul(k2p.px, endo.beta), k2p.py, k2p.pz);\n            return k1p.add(k2p);\n        }\n        /**\n         * Constant time multiplication.\n         * Uses wNAF method. Windowed method may be 10% faster,\n         * but takes 2x longer to generate and consumes 2x memory.\n         * Uses precomputes when available.\n         * Uses endomorphism for Koblitz curves.\n         * @param scalar by which the point would be multiplied\n         * @returns New point\n         */\n        multiply(scalar) {\n            const { endo, n: N } = CURVE;\n            ut.aInRange('scalar', scalar, _1n, N);\n            let point, fake; // Fake point is used to const-time mult\n            if (endo) {\n                const { k1neg, k1, k2neg, k2 } = endo.splitScalar(scalar);\n                let { p: k1p, f: f1p } = this.wNAF(k1);\n                let { p: k2p, f: f2p } = this.wNAF(k2);\n                k1p = wnaf.constTimeNegate(k1neg, k1p);\n                k2p = wnaf.constTimeNegate(k2neg, k2p);\n                k2p = new Point(Fp.mul(k2p.px, endo.beta), k2p.py, k2p.pz);\n                point = k1p.add(k2p);\n                fake = f1p.add(f2p);\n            }\n            else {\n                const { p, f } = this.wNAF(scalar);\n                point = p;\n                fake = f;\n            }\n            // Normalize `z` for both points, but return only real one\n            return Point.normalizeZ([point, fake])[0];\n        }\n        /**\n         * Efficiently calculate `aP + bQ`. Unsafe, can expose private key, if used incorrectly.\n         * Not using Strauss-Shamir trick: precomputation tables are faster.\n         * The trick could be useful if both P and Q are not G (not in our case).\n         * @returns non-zero affine point\n         */\n        multiplyAndAddUnsafe(Q, a, b) {\n            const G = Point.BASE; // No Strauss-Shamir trick: we have 10% faster G precomputes\n            const mul = (P, a // Select faster multiply() method\n            ) => (a === _0n || a === _1n || !P.equals(G) ? P.multiplyUnsafe(a) : P.multiply(a));\n            const sum = mul(this, a).add(mul(Q, b));\n            return sum.is0() ? undefined : sum;\n        }\n        // Converts Projective point to affine (x, y) coordinates.\n        // Can accept precomputed Z^-1 - for example, from invertBatch.\n        // (x, y, z) ∋ (x=x/z, y=y/z)\n        toAffine(iz) {\n            return toAffineMemo(this, iz);\n        }\n        isTorsionFree() {\n            const { h: cofactor, isTorsionFree } = CURVE;\n            if (cofactor === _1n)\n                return true; // No subgroups, always torsion-free\n            if (isTorsionFree)\n                return isTorsionFree(Point, this);\n            throw new Error('isTorsionFree() has not been declared for the elliptic curve');\n        }\n        clearCofactor() {\n            const { h: cofactor, clearCofactor } = CURVE;\n            if (cofactor === _1n)\n                return this; // Fast-path\n            if (clearCofactor)\n                return clearCofactor(Point, this);\n            return this.multiplyUnsafe(CURVE.h);\n        }\n        toRawBytes(isCompressed = true) {\n            abool('isCompressed', isCompressed);\n            this.assertValidity();\n            return toBytes(Point, this, isCompressed);\n        }\n        toHex(isCompressed = true) {\n            abool('isCompressed', isCompressed);\n            return ut.bytesToHex(this.toRawBytes(isCompressed));\n        }\n    }\n    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);\n    Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO);\n    const _bits = CURVE.nBitLength;\n    const wnaf = wNAF(Point, CURVE.endo ? Math.ceil(_bits / 2) : _bits);\n    // Validate if generator point is on curve\n    return {\n        CURVE,\n        ProjectivePoint: Point,\n        normPrivateKeyToScalar,\n        weierstrassEquation,\n        isWithinCurveOrder,\n    };\n}\nfunction validateOpts(curve) {\n    const opts = validateBasic(curve);\n    ut.validateObject(opts, {\n        hash: 'hash',\n        hmac: 'function',\n        randomBytes: 'function',\n    }, {\n        bits2int: 'function',\n        bits2int_modN: 'function',\n        lowS: 'boolean',\n    });\n    return Object.freeze({ lowS: true, ...opts });\n}\n/**\n * Creates short weierstrass curve and ECDSA signature methods for it.\n * @example\n * import { Field } from '@noble/curves/abstract/modular';\n * // Before that, define BigInt-s: a, b, p, n, Gx, Gy\n * const curve = weierstrass({ a, b, Fp: Field(p), n, Gx, Gy, h: 1n })\n */\nexport function weierstrass(curveDef) {\n    const CURVE = validateOpts(curveDef);\n    const { Fp, n: CURVE_ORDER } = CURVE;\n    const compressedLen = Fp.BYTES + 1; // e.g. 33 for 32\n    const uncompressedLen = 2 * Fp.BYTES + 1; // e.g. 65 for 32\n    function modN(a) {\n        return mod.mod(a, CURVE_ORDER);\n    }\n    function invN(a) {\n        return mod.invert(a, CURVE_ORDER);\n    }\n    const { ProjectivePoint: Point, normPrivateKeyToScalar, weierstrassEquation, isWithinCurveOrder, } = weierstrassPoints({\n        ...CURVE,\n        toBytes(_c, point, isCompressed) {\n            const a = point.toAffine();\n            const x = Fp.toBytes(a.x);\n            const cat = ut.concatBytes;\n            abool('isCompressed', isCompressed);\n            if (isCompressed) {\n                return cat(Uint8Array.from([point.hasEvenY() ? 0x02 : 0x03]), x);\n            }\n            else {\n                return cat(Uint8Array.from([0x04]), x, Fp.toBytes(a.y));\n            }\n        },\n        fromBytes(bytes) {\n            const len = bytes.length;\n            const head = bytes[0];\n            const tail = bytes.subarray(1);\n            // this.assertValidity() is done inside of fromHex\n            if (len === compressedLen && (head === 0x02 || head === 0x03)) {\n                const x = ut.bytesToNumberBE(tail);\n                if (!ut.inRange(x, _1n, Fp.ORDER))\n                    throw new Error('Point is not on curve');\n                const y2 = weierstrassEquation(x); // y² = x³ + ax + b\n                let y;\n                try {\n                    y = Fp.sqrt(y2); // y = y² ^ (p+1)/4\n                }\n                catch (sqrtError) {\n                    const suffix = sqrtError instanceof Error ? ': ' + sqrtError.message : '';\n                    throw new Error('Point is not on curve' + suffix);\n                }\n                const isYOdd = (y & _1n) === _1n;\n                // ECDSA\n                const isHeadOdd = (head & 1) === 1;\n                if (isHeadOdd !== isYOdd)\n                    y = Fp.neg(y);\n                return { x, y };\n            }\n            else if (len === uncompressedLen && head === 0x04) {\n                const x = Fp.fromBytes(tail.subarray(0, Fp.BYTES));\n                const y = Fp.fromBytes(tail.subarray(Fp.BYTES, 2 * Fp.BYTES));\n                return { x, y };\n            }\n            else {\n                throw new Error(`Point of length ${len} was invalid. Expected ${compressedLen} compressed bytes or ${uncompressedLen} uncompressed bytes`);\n            }\n        },\n    });\n    const numToNByteStr = (num) => ut.bytesToHex(ut.numberToBytesBE(num, CURVE.nByteLength));\n    function isBiggerThanHalfOrder(number) {\n        const HALF = CURVE_ORDER >> _1n;\n        return number > HALF;\n    }\n    function normalizeS(s) {\n        return isBiggerThanHalfOrder(s) ? modN(-s) : s;\n    }\n    // slice bytes num\n    const slcNum = (b, from, to) => ut.bytesToNumberBE(b.slice(from, to));\n    /**\n     * ECDSA signature with its (r, s) properties. Supports DER & compact representations.\n     */\n    class Signature {\n        constructor(r, s, recovery) {\n            this.r = r;\n            this.s = s;\n            this.recovery = recovery;\n            this.assertValidity();\n        }\n        // pair (bytes of r, bytes of s)\n        static fromCompact(hex) {\n            const l = CURVE.nByteLength;\n            hex = ensureBytes('compactSignature', hex, l * 2);\n            return new Signature(slcNum(hex, 0, l), slcNum(hex, l, 2 * l));\n        }\n        // DER encoded ECDSA signature\n        // https://bitcoin.stackexchange.com/questions/57644/what-are-the-parts-of-a-bitcoin-transaction-input-script\n        static fromDER(hex) {\n            const { r, s } = DER.toSig(ensureBytes('DER', hex));\n            return new Signature(r, s);\n        }\n        assertValidity() {\n            ut.aInRange('r', this.r, _1n, CURVE_ORDER); // r in [1..N]\n            ut.aInRange('s', this.s, _1n, CURVE_ORDER); // s in [1..N]\n        }\n        addRecoveryBit(recovery) {\n            return new Signature(this.r, this.s, recovery);\n        }\n        recoverPublicKey(msgHash) {\n            const { r, s, recovery: rec } = this;\n            const h = bits2int_modN(ensureBytes('msgHash', msgHash)); // Truncate hash\n            if (rec == null || ![0, 1, 2, 3].includes(rec))\n                throw new Error('recovery id invalid');\n            const radj = rec === 2 || rec === 3 ? r + CURVE.n : r;\n            if (radj >= Fp.ORDER)\n                throw new Error('recovery id 2 or 3 invalid');\n            const prefix = (rec & 1) === 0 ? '02' : '03';\n            const R = Point.fromHex(prefix + numToNByteStr(radj));\n            const ir = invN(radj); // r^-1\n            const u1 = modN(-h * ir); // -hr^-1\n            const u2 = modN(s * ir); // sr^-1\n            const Q = Point.BASE.multiplyAndAddUnsafe(R, u1, u2); // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1)\n            if (!Q)\n                throw new Error('point at infinify'); // unsafe is fine: no priv data leaked\n            Q.assertValidity();\n            return Q;\n        }\n        // Signatures should be low-s, to prevent malleability.\n        hasHighS() {\n            return isBiggerThanHalfOrder(this.s);\n        }\n        normalizeS() {\n            return this.hasHighS() ? new Signature(this.r, modN(-this.s), this.recovery) : this;\n        }\n        // DER-encoded\n        toDERRawBytes() {\n            return ut.hexToBytes(this.toDERHex());\n        }\n        toDERHex() {\n            return DER.hexFromSig({ r: this.r, s: this.s });\n        }\n        // padded bytes of r, then padded bytes of s\n        toCompactRawBytes() {\n            return ut.hexToBytes(this.toCompactHex());\n        }\n        toCompactHex() {\n            return numToNByteStr(this.r) + numToNByteStr(this.s);\n        }\n    }\n    const utils = {\n        isValidPrivateKey(privateKey) {\n            try {\n                normPrivateKeyToScalar(privateKey);\n                return true;\n            }\n            catch (error) {\n                return false;\n            }\n        },\n        normPrivateKeyToScalar: normPrivateKeyToScalar,\n        /**\n         * Produces cryptographically secure private key from random of size\n         * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.\n         */\n        randomPrivateKey: () => {\n            const length = mod.getMinHashLength(CURVE.n);\n            return mod.mapHashToField(CURVE.randomBytes(length), CURVE.n);\n        },\n        /**\n         * Creates precompute table for an arbitrary EC point. Makes point \"cached\".\n         * Allows to massively speed-up `point.multiply(scalar)`.\n         * @returns cached point\n         * @example\n         * const fast = utils.precompute(8, ProjectivePoint.fromHex(someonesPubKey));\n         * fast.multiply(privKey); // much faster ECDH now\n         */\n        precompute(windowSize = 8, point = Point.BASE) {\n            point._setWindowSize(windowSize);\n            point.multiply(BigInt(3)); // 3 is arbitrary, just need any number here\n            return point;\n        },\n    };\n    /**\n     * Computes public key for a private key. Checks for validity of the private key.\n     * @param privateKey private key\n     * @param isCompressed whether to return compact (default), or full key\n     * @returns Public key, full when isCompressed=false; short when isCompressed=true\n     */\n    function getPublicKey(privateKey, isCompressed = true) {\n        return Point.fromPrivateKey(privateKey).toRawBytes(isCompressed);\n    }\n    /**\n     * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.\n     */\n    function isProbPub(item) {\n        const arr = ut.isBytes(item);\n        const str = typeof item === 'string';\n        const len = (arr || str) && item.length;\n        if (arr)\n            return len === compressedLen || len === uncompressedLen;\n        if (str)\n            return len === 2 * compressedLen || len === 2 * uncompressedLen;\n        if (item instanceof Point)\n            return true;\n        return false;\n    }\n    /**\n     * ECDH (Elliptic Curve Diffie Hellman).\n     * Computes shared public key from private key and public key.\n     * Checks: 1) private key validity 2) shared key is on-curve.\n     * Does NOT hash the result.\n     * @param privateA private key\n     * @param publicB different public key\n     * @param isCompressed whether to return compact (default), or full key\n     * @returns shared public key\n     */\n    function getSharedSecret(privateA, publicB, isCompressed = true) {\n        if (isProbPub(privateA))\n            throw new Error('first arg must be private key');\n        if (!isProbPub(publicB))\n            throw new Error('second arg must be public key');\n        const b = Point.fromHex(publicB); // check for being on-curve\n        return b.multiply(normPrivateKeyToScalar(privateA)).toRawBytes(isCompressed);\n    }\n    // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.\n    // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.\n    // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.\n    // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors\n    const bits2int = CURVE.bits2int ||\n        function (bytes) {\n            // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)\n            // for some cases, since bytes.length * 8 is not actual bitLength.\n            const num = ut.bytesToNumberBE(bytes); // check for == u8 done here\n            const delta = bytes.length * 8 - CURVE.nBitLength; // truncate to nBitLength leftmost bits\n            return delta > 0 ? num >> BigInt(delta) : num;\n        };\n    const bits2int_modN = CURVE.bits2int_modN ||\n        function (bytes) {\n            return modN(bits2int(bytes)); // can't use bytesToNumberBE here\n        };\n    // NOTE: pads output with zero as per spec\n    const ORDER_MASK = ut.bitMask(CURVE.nBitLength);\n    /**\n     * Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`.\n     */\n    function int2octets(num) {\n        ut.aInRange(`num < 2^${CURVE.nBitLength}`, num, _0n, ORDER_MASK);\n        // works with order, can have different size than numToField!\n        return ut.numberToBytesBE(num, CURVE.nByteLength);\n    }\n    // Steps A, D of RFC6979 3.2\n    // Creates RFC6979 seed; converts msg/privKey to numbers.\n    // Used only in sign, not in verify.\n    // NOTE: we cannot assume here that msgHash has same amount of bytes as curve order, this will be wrong at least for P521.\n    // Also it can be bigger for P224 + SHA256\n    function prepSig(msgHash, privateKey, opts = defaultSigOpts) {\n        if (['recovered', 'canonical'].some((k) => k in opts))\n            throw new Error('sign() legacy options not supported');\n        const { hash, randomBytes } = CURVE;\n        let { lowS, prehash, extraEntropy: ent } = opts; // generates low-s sigs by default\n        if (lowS == null)\n            lowS = true; // RFC6979 3.2: we skip step A, because we already provide hash\n        msgHash = ensureBytes('msgHash', msgHash);\n        validateSigVerOpts(opts);\n        if (prehash)\n            msgHash = ensureBytes('prehashed msgHash', hash(msgHash));\n        // We can't later call bits2octets, since nested bits2int is broken for curves\n        // with nBitLength % 8 !== 0. Because of that, we unwrap it here as int2octets call.\n        // const bits2octets = (bits) => int2octets(bits2int_modN(bits))\n        const h1int = bits2int_modN(msgHash);\n        const d = normPrivateKeyToScalar(privateKey); // validate private key, convert to bigint\n        const seedArgs = [int2octets(d), int2octets(h1int)];\n        // extraEntropy. RFC6979 3.6: additional k' (optional).\n        if (ent != null && ent !== false) {\n            // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')\n            const e = ent === true ? randomBytes(Fp.BYTES) : ent; // generate random bytes OR pass as-is\n            seedArgs.push(ensureBytes('extraEntropy', e)); // check for being bytes\n        }\n        const seed = ut.concatBytes(...seedArgs); // Step D of RFC6979 3.2\n        const m = h1int; // NOTE: no need to call bits2int second time here, it is inside truncateHash!\n        // Converts signature params into point w r/s, checks result for validity.\n        function k2sig(kBytes) {\n            // RFC 6979 Section 3.2, step 3: k = bits2int(T)\n            const k = bits2int(kBytes); // Cannot use fields methods, since it is group element\n            if (!isWithinCurveOrder(k))\n                return; // Important: all mod() calls here must be done over N\n            const ik = invN(k); // k^-1 mod n\n            const q = Point.BASE.multiply(k).toAffine(); // q = Gk\n            const r = modN(q.x); // r = q.x mod n\n            if (r === _0n)\n                return;\n            // Can use scalar blinding b^-1(bm + bdr) where b ∈ [1,q−1] according to\n            // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. We've decided against it:\n            // a) dependency on CSPRNG b) 15% slowdown c) doesn't really help since bigints are not CT\n            const s = modN(ik * modN(m + r * d)); // Not using blinding here\n            if (s === _0n)\n                return;\n            let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3, when q.x > n)\n            let normS = s;\n            if (lowS && isBiggerThanHalfOrder(s)) {\n                normS = normalizeS(s); // if lowS was passed, ensure s is always\n                recovery ^= 1; // // in the bottom half of N\n            }\n            return new Signature(r, normS, recovery); // use normS, not s\n        }\n        return { seed, k2sig };\n    }\n    const defaultSigOpts = { lowS: CURVE.lowS, prehash: false };\n    const defaultVerOpts = { lowS: CURVE.lowS, prehash: false };\n    /**\n     * Signs message hash with a private key.\n     * ```\n     * sign(m, d, k) where\n     *   (x, y) = G × k\n     *   r = x mod n\n     *   s = (m + dr)/k mod n\n     * ```\n     * @param msgHash NOT message. msg needs to be hashed to `msgHash`, or use `prehash`.\n     * @param privKey private key\n     * @param opts lowS for non-malleable sigs. extraEntropy for mixing randomness into k. prehash will hash first arg.\n     * @returns signature with recovery param\n     */\n    function sign(msgHash, privKey, opts = defaultSigOpts) {\n        const { seed, k2sig } = prepSig(msgHash, privKey, opts); // Steps A, D of RFC6979 3.2.\n        const C = CURVE;\n        const drbg = ut.createHmacDrbg(C.hash.outputLen, C.nByteLength, C.hmac);\n        return drbg(seed, k2sig); // Steps B, C, D, E, F, G\n    }\n    // Enable precomputes. Slows down first publicKey computation by 20ms.\n    Point.BASE._setWindowSize(8);\n    // utils.precompute(8, ProjectivePoint.BASE)\n    /**\n     * Verifies a signature against message hash and public key.\n     * Rejects lowS signatures by default: to override,\n     * specify option `{lowS: false}`. Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:\n     *\n     * ```\n     * verify(r, s, h, P) where\n     *   U1 = hs^-1 mod n\n     *   U2 = rs^-1 mod n\n     *   R = U1⋅G - U2⋅P\n     *   mod(R.x, n) == r\n     * ```\n     */\n    function verify(signature, msgHash, publicKey, opts = defaultVerOpts) {\n        const sg = signature;\n        msgHash = ensureBytes('msgHash', msgHash);\n        publicKey = ensureBytes('publicKey', publicKey);\n        if ('strict' in opts)\n            throw new Error('options.strict was renamed to lowS');\n        validateSigVerOpts(opts);\n        const { lowS, prehash } = opts;\n        let _sig = undefined;\n        let P;\n        try {\n            if (typeof sg === 'string' || ut.isBytes(sg)) {\n                // Signature can be represented in 2 ways: compact (2*nByteLength) & DER (variable-length).\n                // Since DER can also be 2*nByteLength bytes, we check for it first.\n                try {\n                    _sig = Signature.fromDER(sg);\n                }\n                catch (derError) {\n                    if (!(derError instanceof DER.Err))\n                        throw derError;\n                    _sig = Signature.fromCompact(sg);\n                }\n            }\n            else if (typeof sg === 'object' && typeof sg.r === 'bigint' && typeof sg.s === 'bigint') {\n                const { r, s } = sg;\n                _sig = new Signature(r, s);\n            }\n            else {\n                throw new Error('PARSE');\n            }\n            P = Point.fromHex(publicKey);\n        }\n        catch (error) {\n            if (error.message === 'PARSE')\n                throw new Error(`signature must be Signature instance, Uint8Array or hex string`);\n            return false;\n        }\n        if (lowS && _sig.hasHighS())\n            return false;\n        if (prehash)\n            msgHash = CURVE.hash(msgHash);\n        const { r, s } = _sig;\n        const h = bits2int_modN(msgHash); // Cannot use fields methods, since it is group element\n        const is = invN(s); // s^-1\n        const u1 = modN(h * is); // u1 = hs^-1 mod n\n        const u2 = modN(r * is); // u2 = rs^-1 mod n\n        const R = Point.BASE.multiplyAndAddUnsafe(P, u1, u2)?.toAffine(); // R = u1⋅G + u2⋅P\n        if (!R)\n            return false;\n        const v = modN(R.x);\n        return v === r;\n    }\n    return {\n        CURVE,\n        getPublicKey,\n        getSharedSecret,\n        sign,\n        verify,\n        ProjectivePoint: Point,\n        Signature,\n        utils,\n    };\n}\n/**\n * Implementation of the Shallue and van de Woestijne method for any weierstrass curve.\n * TODO: check if there is a way to merge this with uvRatio in Edwards; move to modular.\n * b = True and y = sqrt(u / v) if (u / v) is square in F, and\n * b = False and y = sqrt(Z * (u / v)) otherwise.\n * @param Fp\n * @param Z\n * @returns\n */\nexport function SWUFpSqrtRatio(Fp, Z) {\n    // Generic implementation\n    const q = Fp.ORDER;\n    let l = _0n;\n    for (let o = q - _1n; o % _2n === _0n; o /= _2n)\n        l += _1n;\n    const c1 = l; // 1. c1, the largest integer such that 2^c1 divides q - 1.\n    // We need 2n ** c1 and 2n ** (c1-1). We can't use **; but we can use <<.\n    // 2n ** c1 == 2n << (c1-1)\n    const _2n_pow_c1_1 = _2n << (c1 - _1n - _1n);\n    const _2n_pow_c1 = _2n_pow_c1_1 * _2n;\n    const c2 = (q - _1n) / _2n_pow_c1; // 2. c2 = (q - 1) / (2^c1)  # Integer arithmetic\n    const c3 = (c2 - _1n) / _2n; // 3. c3 = (c2 - 1) / 2            # Integer arithmetic\n    const c4 = _2n_pow_c1 - _1n; // 4. c4 = 2^c1 - 1                # Integer arithmetic\n    const c5 = _2n_pow_c1_1; // 5. c5 = 2^(c1 - 1)                  # Integer arithmetic\n    const c6 = Fp.pow(Z, c2); // 6. c6 = Z^c2\n    const c7 = Fp.pow(Z, (c2 + _1n) / _2n); // 7. c7 = Z^((c2 + 1) / 2)\n    let sqrtRatio = (u, v) => {\n        let tv1 = c6; // 1. tv1 = c6\n        let tv2 = Fp.pow(v, c4); // 2. tv2 = v^c4\n        let tv3 = Fp.sqr(tv2); // 3. tv3 = tv2^2\n        tv3 = Fp.mul(tv3, v); // 4. tv3 = tv3 * v\n        let tv5 = Fp.mul(u, tv3); // 5. tv5 = u * tv3\n        tv5 = Fp.pow(tv5, c3); // 6. tv5 = tv5^c3\n        tv5 = Fp.mul(tv5, tv2); // 7. tv5 = tv5 * tv2\n        tv2 = Fp.mul(tv5, v); // 8. tv2 = tv5 * v\n        tv3 = Fp.mul(tv5, u); // 9. tv3 = tv5 * u\n        let tv4 = Fp.mul(tv3, tv2); // 10. tv4 = tv3 * tv2\n        tv5 = Fp.pow(tv4, c5); // 11. tv5 = tv4^c5\n        let isQR = Fp.eql(tv5, Fp.ONE); // 12. isQR = tv5 == 1\n        tv2 = Fp.mul(tv3, c7); // 13. tv2 = tv3 * c7\n        tv5 = Fp.mul(tv4, tv1); // 14. tv5 = tv4 * tv1\n        tv3 = Fp.cmov(tv2, tv3, isQR); // 15. tv3 = CMOV(tv2, tv3, isQR)\n        tv4 = Fp.cmov(tv5, tv4, isQR); // 16. tv4 = CMOV(tv5, tv4, isQR)\n        // 17. for i in (c1, c1 - 1, ..., 2):\n        for (let i = c1; i > _1n; i--) {\n            let tv5 = i - _2n; // 18.    tv5 = i - 2\n            tv5 = _2n << (tv5 - _1n); // 19.    tv5 = 2^tv5\n            let tvv5 = Fp.pow(tv4, tv5); // 20.    tv5 = tv4^tv5\n            const e1 = Fp.eql(tvv5, Fp.ONE); // 21.    e1 = tv5 == 1\n            tv2 = Fp.mul(tv3, tv1); // 22.    tv2 = tv3 * tv1\n            tv1 = Fp.mul(tv1, tv1); // 23.    tv1 = tv1 * tv1\n            tvv5 = Fp.mul(tv4, tv1); // 24.    tv5 = tv4 * tv1\n            tv3 = Fp.cmov(tv2, tv3, e1); // 25.    tv3 = CMOV(tv2, tv3, e1)\n            tv4 = Fp.cmov(tvv5, tv4, e1); // 26.    tv4 = CMOV(tv5, tv4, e1)\n        }\n        return { isValid: isQR, value: tv3 };\n    };\n    if (Fp.ORDER % _4n === _3n) {\n        // sqrt_ratio_3mod4(u, v)\n        const c1 = (Fp.ORDER - _3n) / _4n; // 1. c1 = (q - 3) / 4     # Integer arithmetic\n        const c2 = Fp.sqrt(Fp.neg(Z)); // 2. c2 = sqrt(-Z)\n        sqrtRatio = (u, v) => {\n            let tv1 = Fp.sqr(v); // 1. tv1 = v^2\n            const tv2 = Fp.mul(u, v); // 2. tv2 = u * v\n            tv1 = Fp.mul(tv1, tv2); // 3. tv1 = tv1 * tv2\n            let y1 = Fp.pow(tv1, c1); // 4. y1 = tv1^c1\n            y1 = Fp.mul(y1, tv2); // 5. y1 = y1 * tv2\n            const y2 = Fp.mul(y1, c2); // 6. y2 = y1 * c2\n            const tv3 = Fp.mul(Fp.sqr(y1), v); // 7. tv3 = y1^2; 8. tv3 = tv3 * v\n            const isQR = Fp.eql(tv3, u); // 9. isQR = tv3 == u\n            let y = Fp.cmov(y2, y1, isQR); // 10. y = CMOV(y2, y1, isQR)\n            return { isValid: isQR, value: y }; // 11. return (isQR, y) isQR ? y : y*c2\n        };\n    }\n    // No curves uses that\n    // if (Fp.ORDER % _8n === _5n) // sqrt_ratio_5mod8\n    return sqrtRatio;\n}\n/**\n * Simplified Shallue-van de Woestijne-Ulas Method\n * https://www.rfc-editor.org/rfc/rfc9380#section-6.6.2\n */\nexport function mapToCurveSimpleSWU(Fp, opts) {\n    mod.validateField(Fp);\n    if (!Fp.isValid(opts.A) || !Fp.isValid(opts.B) || !Fp.isValid(opts.Z))\n        throw new Error('mapToCurveSimpleSWU: invalid opts');\n    const sqrtRatio = SWUFpSqrtRatio(Fp, opts.Z);\n    if (!Fp.isOdd)\n        throw new Error('Fp.isOdd is not implemented!');\n    // Input: u, an element of F.\n    // Output: (x, y), a point on E.\n    return (u) => {\n        // prettier-ignore\n        let tv1, tv2, tv3, tv4, tv5, tv6, x, y;\n        tv1 = Fp.sqr(u); // 1.  tv1 = u^2\n        tv1 = Fp.mul(tv1, opts.Z); // 2.  tv1 = Z * tv1\n        tv2 = Fp.sqr(tv1); // 3.  tv2 = tv1^2\n        tv2 = Fp.add(tv2, tv1); // 4.  tv2 = tv2 + tv1\n        tv3 = Fp.add(tv2, Fp.ONE); // 5.  tv3 = tv2 + 1\n        tv3 = Fp.mul(tv3, opts.B); // 6.  tv3 = B * tv3\n        tv4 = Fp.cmov(opts.Z, Fp.neg(tv2), !Fp.eql(tv2, Fp.ZERO)); // 7.  tv4 = CMOV(Z, -tv2, tv2 != 0)\n        tv4 = Fp.mul(tv4, opts.A); // 8.  tv4 = A * tv4\n        tv2 = Fp.sqr(tv3); // 9.  tv2 = tv3^2\n        tv6 = Fp.sqr(tv4); // 10. tv6 = tv4^2\n        tv5 = Fp.mul(tv6, opts.A); // 11. tv5 = A * tv6\n        tv2 = Fp.add(tv2, tv5); // 12. tv2 = tv2 + tv5\n        tv2 = Fp.mul(tv2, tv3); // 13. tv2 = tv2 * tv3\n        tv6 = Fp.mul(tv6, tv4); // 14. tv6 = tv6 * tv4\n        tv5 = Fp.mul(tv6, opts.B); // 15. tv5 = B * tv6\n        tv2 = Fp.add(tv2, tv5); // 16. tv2 = tv2 + tv5\n        x = Fp.mul(tv1, tv3); // 17.   x = tv1 * tv3\n        const { isValid, value } = sqrtRatio(tv2, tv6); // 18. (is_gx1_square, y1) = sqrt_ratio(tv2, tv6)\n        y = Fp.mul(tv1, u); // 19.   y = tv1 * u  -> Z * u^3 * y1\n        y = Fp.mul(y, value); // 20.   y = y * y1\n        x = Fp.cmov(x, tv3, isValid); // 21.   x = CMOV(x, tv3, is_gx1_square)\n        y = Fp.cmov(y, value, isValid); // 22.   y = CMOV(y, y1, is_gx1_square)\n        const e1 = Fp.isOdd(u) === Fp.isOdd(y); // 23.  e1 = sgn0(u) == sgn0(y)\n        y = Fp.cmov(Fp.neg(y), y, e1); // 24.   y = CMOV(-y, y, e1)\n        x = Fp.div(x, tv4); // 25.   x = x / tv4\n        return { x, y };\n    };\n}\n//# sourceMappingURL=weierstrass.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { hmac } from '@noble/hashes/hmac';\nimport { concatBytes, randomBytes } from '@noble/hashes/utils';\nimport { weierstrass } from './abstract/weierstrass.js';\n// connects noble-curves to noble-hashes\nexport function getHash(hash) {\n    return {\n        hash,\n        hmac: (key, ...msgs) => hmac(hash, key, concatBytes(...msgs)),\n        randomBytes,\n    };\n}\nexport function createCurve(curveDef, defHash) {\n    const create = (hash) => weierstrass({ ...curveDef, ...getHash(hash) });\n    return Object.freeze({ ...create(defHash), create });\n}\n//# sourceMappingURL=_shortw_utils.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha256 } from '@noble/hashes/sha256';\nimport { createCurve } from './_shortw_utils.js';\nimport { createHasher } from './abstract/hash-to-curve.js';\nimport { Field } from './abstract/modular.js';\nimport { mapToCurveSimpleSWU } from './abstract/weierstrass.js';\n// NIST secp256r1 aka p256\n// https://www.secg.org/sec2-v2.pdf, https://neuromancer.sk/std/nist/P-256\nconst Fp = Field(BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff'));\nconst CURVE_A = Fp.create(BigInt('-3'));\nconst CURVE_B = BigInt('0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b');\n// prettier-ignore\nexport const p256 = createCurve({\n    a: CURVE_A, // Equation params: a, b\n    b: CURVE_B,\n    Fp, // Field: 2n**224n * (2n**32n-1n) + 2n**192n + 2n**96n-1n\n    // Curve order, total count of valid points in the field\n    n: BigInt('0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'),\n    // Base (generator) point (x, y)\n    Gx: BigInt('0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296'),\n    Gy: BigInt('0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5'),\n    h: BigInt(1),\n    lowS: false,\n}, sha256);\nexport const secp256r1 = p256;\nconst mapSWU = /* @__PURE__ */ (() => mapToCurveSimpleSWU(Fp, {\n    A: CURVE_A,\n    B: CURVE_B,\n    Z: Fp.create(BigInt('-10')),\n}))();\nconst htf = /* @__PURE__ */ (() => createHasher(secp256r1.ProjectivePoint, (scalars) => mapSWU(scalars[0]), {\n    DST: 'P256_XMD:SHA-256_SSWU_RO_',\n    encodeDST: 'P256_XMD:SHA-256_SSWU_NU_',\n    p: Fp.ORDER,\n    m: 1,\n    k: 128,\n    expand: 'xmd',\n    hash: sha256,\n}))();\nexport const hashToCurve = /* @__PURE__ */ (() => htf.hashToCurve)();\nexport const encodeToCurve = /* @__PURE__ */ (() => htf.encodeToCurve)();\n//# sourceMappingURL=p256.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha384 } from '@noble/hashes/sha512';\nimport { createCurve } from './_shortw_utils.js';\nimport { createHasher } from './abstract/hash-to-curve.js';\nimport { Field } from './abstract/modular.js';\nimport { mapToCurveSimpleSWU } from './abstract/weierstrass.js';\n// NIST secp384r1 aka p384\n// https://www.secg.org/sec2-v2.pdf, https://neuromancer.sk/std/nist/P-384\n// Field over which we'll do calculations.\n// prettier-ignore\nconst P = BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff');\nconst Fp = Field(P);\nconst CURVE_A = Fp.create(BigInt('-3'));\n// prettier-ignore\nconst CURVE_B = BigInt('0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef');\n// prettier-ignore\nexport const p384 = createCurve({\n    a: CURVE_A, // Equation params: a, b\n    b: CURVE_B,\n    Fp, // Field: 2n**384n - 2n**128n - 2n**96n + 2n**32n - 1n\n    // Curve order, total count of valid points in the field.\n    n: BigInt('0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973'),\n    // Base (generator) point (x, y)\n    Gx: BigInt('0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7'),\n    Gy: BigInt('0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f'),\n    h: BigInt(1),\n    lowS: false,\n}, sha384);\nexport const secp384r1 = p384;\nconst mapSWU = /* @__PURE__ */ (() => mapToCurveSimpleSWU(Fp, {\n    A: CURVE_A,\n    B: CURVE_B,\n    Z: Fp.create(BigInt('-12')),\n}))();\nconst htf = /* @__PURE__ */ (() => createHasher(secp384r1.ProjectivePoint, (scalars) => mapSWU(scalars[0]), {\n    DST: 'P384_XMD:SHA-384_SSWU_RO_',\n    encodeDST: 'P384_XMD:SHA-384_SSWU_NU_',\n    p: Fp.ORDER,\n    m: 1,\n    k: 192,\n    expand: 'xmd',\n    hash: sha384,\n}))();\nexport const hashToCurve = /* @__PURE__ */ (() => htf.hashToCurve)();\nexport const encodeToCurve = /* @__PURE__ */ (() => htf.encodeToCurve)();\n//# sourceMappingURL=p384.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha512 } from '@noble/hashes/sha512';\nimport { createCurve } from './_shortw_utils.js';\nimport { createHasher } from './abstract/hash-to-curve.js';\nimport { Field } from './abstract/modular.js';\nimport { mapToCurveSimpleSWU } from './abstract/weierstrass.js';\n// NIST secp521r1 aka p521\n// Note that it's 521, which differs from 512 of its hash function.\n// https://www.secg.org/sec2-v2.pdf, https://neuromancer.sk/std/nist/P-521\n// Field over which we'll do calculations.\n// prettier-ignore\nconst P = BigInt('0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff');\nconst Fp = Field(P);\nconst CURVE = {\n    a: Fp.create(BigInt('-3')),\n    b: BigInt('0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00'),\n    Fp,\n    n: BigInt('0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409'),\n    Gx: BigInt('0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66'),\n    Gy: BigInt('0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650'),\n    h: BigInt(1),\n};\n// prettier-ignore\nexport const p521 = createCurve({\n    a: CURVE.a, // Equation params: a, b\n    b: CURVE.b,\n    Fp, // Field: 2n**521n - 1n\n    // Curve order, total count of valid points in the field\n    n: CURVE.n,\n    Gx: CURVE.Gx, // Base point (x, y) aka generator point\n    Gy: CURVE.Gy,\n    h: CURVE.h,\n    lowS: false,\n    allowedPrivateKeyLengths: [130, 131, 132] // P521 keys are variable-length. Normalize to 132b\n}, sha512);\nexport const secp521r1 = p521;\nconst mapSWU = /* @__PURE__ */ (() => mapToCurveSimpleSWU(Fp, {\n    A: CURVE.a,\n    B: CURVE.b,\n    Z: Fp.create(BigInt('-4')),\n}))();\nconst htf = /* @__PURE__ */ (() => createHasher(secp521r1.ProjectivePoint, (scalars) => mapSWU(scalars[0]), {\n    DST: 'P521_XMD:SHA-512_SSWU_RO_',\n    encodeDST: 'P521_XMD:SHA-512_SSWU_NU_',\n    p: Fp.ORDER,\n    m: 1,\n    k: 256,\n    expand: 'xmd',\n    hash: sha512,\n}))();\nexport const hashToCurve = /* @__PURE__ */ (() => htf.hashToCurve)();\nexport const encodeToCurve = /* @__PURE__ */ (() => htf.encodeToCurve)();\n//# sourceMappingURL=p521.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\n// Twisted Edwards curve. The formula is: ax² + y² = 1 + dx²y²\nimport { validateBasic, wNAF, pippenger, } from './curve.js';\nimport { mod, Field } from './modular.js';\nimport * as ut from './utils.js';\nimport { ensureBytes, memoized, abool } from './utils.js';\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _8n = BigInt(8);\n// verification rule is either zip215 or rfc8032 / nist186-5. Consult fromHex:\nconst VERIFY_DEFAULT = { zip215: true };\nfunction validateOpts(curve) {\n    const opts = validateBasic(curve);\n    ut.validateObject(curve, {\n        hash: 'function',\n        a: 'bigint',\n        d: 'bigint',\n        randomBytes: 'function',\n    }, {\n        adjustScalarBytes: 'function',\n        domain: 'function',\n        uvRatio: 'function',\n        mapToCurve: 'function',\n    });\n    // Set defaults\n    return Object.freeze({ ...opts });\n}\n/**\n * Creates Twisted Edwards curve with EdDSA signatures.\n * @example\n * import { Field } from '@noble/curves/abstract/modular';\n * // Before that, define BigInt-s: a, d, p, n, Gx, Gy, h\n * const curve = twistedEdwards({ a, d, Fp: Field(p), n, Gx, Gy, h })\n */\nexport function twistedEdwards(curveDef) {\n    const CURVE = validateOpts(curveDef);\n    const { Fp, n: CURVE_ORDER, prehash: prehash, hash: cHash, randomBytes, nByteLength, h: cofactor, } = CURVE;\n    const MASK = _2n << (BigInt(nByteLength * 8) - _1n);\n    const modP = Fp.create; // Function overrides\n    const Fn = Field(CURVE.n, CURVE.nBitLength);\n    // sqrt(u/v)\n    const uvRatio = CURVE.uvRatio ||\n        ((u, v) => {\n            try {\n                return { isValid: true, value: Fp.sqrt(u * Fp.inv(v)) };\n            }\n            catch (e) {\n                return { isValid: false, value: _0n };\n            }\n        });\n    const adjustScalarBytes = CURVE.adjustScalarBytes || ((bytes) => bytes); // NOOP\n    const domain = CURVE.domain ||\n        ((data, ctx, phflag) => {\n            abool('phflag', phflag);\n            if (ctx.length || phflag)\n                throw new Error('Contexts/pre-hash are not supported');\n            return data;\n        }); // NOOP\n    // 0 <= n < MASK\n    // Coordinates larger than Fp.ORDER are allowed for zip215\n    function aCoordinate(title, n) {\n        ut.aInRange('coordinate ' + title, n, _0n, MASK);\n    }\n    function assertPoint(other) {\n        if (!(other instanceof Point))\n            throw new Error('ExtendedPoint expected');\n    }\n    // Converts Extended point to default (x, y) coordinates.\n    // Can accept precomputed Z^-1 - for example, from invertBatch.\n    const toAffineMemo = memoized((p, iz) => {\n        const { ex: x, ey: y, ez: z } = p;\n        const is0 = p.is0();\n        if (iz == null)\n            iz = is0 ? _8n : Fp.inv(z); // 8 was chosen arbitrarily\n        const ax = modP(x * iz);\n        const ay = modP(y * iz);\n        const zz = modP(z * iz);\n        if (is0)\n            return { x: _0n, y: _1n };\n        if (zz !== _1n)\n            throw new Error('invZ was invalid');\n        return { x: ax, y: ay };\n    });\n    const assertValidMemo = memoized((p) => {\n        const { a, d } = CURVE;\n        if (p.is0())\n            throw new Error('bad point: ZERO'); // TODO: optimize, with vars below?\n        // Equation in affine coordinates: ax² + y² = 1 + dx²y²\n        // Equation in projective coordinates (X/Z, Y/Z, Z):  (aX² + Y²)Z² = Z⁴ + dX²Y²\n        const { ex: X, ey: Y, ez: Z, et: T } = p;\n        const X2 = modP(X * X); // X²\n        const Y2 = modP(Y * Y); // Y²\n        const Z2 = modP(Z * Z); // Z²\n        const Z4 = modP(Z2 * Z2); // Z⁴\n        const aX2 = modP(X2 * a); // aX²\n        const left = modP(Z2 * modP(aX2 + Y2)); // (aX² + Y²)Z²\n        const right = modP(Z4 + modP(d * modP(X2 * Y2))); // Z⁴ + dX²Y²\n        if (left !== right)\n            throw new Error('bad point: equation left != right (1)');\n        // In Extended coordinates we also have T, which is x*y=T/Z: check X*Y == Z*T\n        const XY = modP(X * Y);\n        const ZT = modP(Z * T);\n        if (XY !== ZT)\n            throw new Error('bad point: equation left != right (2)');\n        return true;\n    });\n    // Extended Point works in extended coordinates: (x, y, z, t) ∋ (x=x/z, y=y/z, t=xy).\n    // https://en.wikipedia.org/wiki/Twisted_Edwards_curve#Extended_coordinates\n    class Point {\n        constructor(ex, ey, ez, et) {\n            this.ex = ex;\n            this.ey = ey;\n            this.ez = ez;\n            this.et = et;\n            aCoordinate('x', ex);\n            aCoordinate('y', ey);\n            aCoordinate('z', ez);\n            aCoordinate('t', et);\n            Object.freeze(this);\n        }\n        get x() {\n            return this.toAffine().x;\n        }\n        get y() {\n            return this.toAffine().y;\n        }\n        static fromAffine(p) {\n            if (p instanceof Point)\n                throw new Error('extended point not allowed');\n            const { x, y } = p || {};\n            aCoordinate('x', x);\n            aCoordinate('y', y);\n            return new Point(x, y, _1n, modP(x * y));\n        }\n        static normalizeZ(points) {\n            const toInv = Fp.invertBatch(points.map((p) => p.ez));\n            return points.map((p, i) => p.toAffine(toInv[i])).map(Point.fromAffine);\n        }\n        // Multiscalar Multiplication\n        static msm(points, scalars) {\n            return pippenger(Point, Fn, points, scalars);\n        }\n        // \"Private method\", don't use it directly\n        _setWindowSize(windowSize) {\n            wnaf.setWindowSize(this, windowSize);\n        }\n        // Not required for fromHex(), which always creates valid points.\n        // Could be useful for fromAffine().\n        assertValidity() {\n            assertValidMemo(this);\n        }\n        // Compare one point to another.\n        equals(other) {\n            assertPoint(other);\n            const { ex: X1, ey: Y1, ez: Z1 } = this;\n            const { ex: X2, ey: Y2, ez: Z2 } = other;\n            const X1Z2 = modP(X1 * Z2);\n            const X2Z1 = modP(X2 * Z1);\n            const Y1Z2 = modP(Y1 * Z2);\n            const Y2Z1 = modP(Y2 * Z1);\n            return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;\n        }\n        is0() {\n            return this.equals(Point.ZERO);\n        }\n        negate() {\n            // Flips point sign to a negative one (-x, y in affine coords)\n            return new Point(modP(-this.ex), this.ey, this.ez, modP(-this.et));\n        }\n        // Fast algo for doubling Extended Point.\n        // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd\n        // Cost: 4M + 4S + 1*a + 6add + 1*2.\n        double() {\n            const { a } = CURVE;\n            const { ex: X1, ey: Y1, ez: Z1 } = this;\n            const A = modP(X1 * X1); // A = X12\n            const B = modP(Y1 * Y1); // B = Y12\n            const C = modP(_2n * modP(Z1 * Z1)); // C = 2*Z12\n            const D = modP(a * A); // D = a*A\n            const x1y1 = X1 + Y1;\n            const E = modP(modP(x1y1 * x1y1) - A - B); // E = (X1+Y1)2-A-B\n            const G = D + B; // G = D+B\n            const F = G - C; // F = G-C\n            const H = D - B; // H = D-B\n            const X3 = modP(E * F); // X3 = E*F\n            const Y3 = modP(G * H); // Y3 = G*H\n            const T3 = modP(E * H); // T3 = E*H\n            const Z3 = modP(F * G); // Z3 = F*G\n            return new Point(X3, Y3, Z3, T3);\n        }\n        // Fast algo for adding 2 Extended Points.\n        // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd\n        // Cost: 9M + 1*a + 1*d + 7add.\n        add(other) {\n            assertPoint(other);\n            const { a, d } = CURVE;\n            const { ex: X1, ey: Y1, ez: Z1, et: T1 } = this;\n            const { ex: X2, ey: Y2, ez: Z2, et: T2 } = other;\n            // Faster algo for adding 2 Extended Points when curve's a=-1.\n            // http://hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html#addition-add-2008-hwcd-4\n            // Cost: 8M + 8add + 2*2.\n            // Note: It does not check whether the `other` point is valid.\n            if (a === BigInt(-1)) {\n                const A = modP((Y1 - X1) * (Y2 + X2));\n                const B = modP((Y1 + X1) * (Y2 - X2));\n                const F = modP(B - A);\n                if (F === _0n)\n                    return this.double(); // Same point. Tests say it doesn't affect timing\n                const C = modP(Z1 * _2n * T2);\n                const D = modP(T1 * _2n * Z2);\n                const E = D + C;\n                const G = B + A;\n                const H = D - C;\n                const X3 = modP(E * F);\n                const Y3 = modP(G * H);\n                const T3 = modP(E * H);\n                const Z3 = modP(F * G);\n                return new Point(X3, Y3, Z3, T3);\n            }\n            const A = modP(X1 * X2); // A = X1*X2\n            const B = modP(Y1 * Y2); // B = Y1*Y2\n            const C = modP(T1 * d * T2); // C = T1*d*T2\n            const D = modP(Z1 * Z2); // D = Z1*Z2\n            const E = modP((X1 + Y1) * (X2 + Y2) - A - B); // E = (X1+Y1)*(X2+Y2)-A-B\n            const F = D - C; // F = D-C\n            const G = D + C; // G = D+C\n            const H = modP(B - a * A); // H = B-a*A\n            const X3 = modP(E * F); // X3 = E*F\n            const Y3 = modP(G * H); // Y3 = G*H\n            const T3 = modP(E * H); // T3 = E*H\n            const Z3 = modP(F * G); // Z3 = F*G\n            return new Point(X3, Y3, Z3, T3);\n        }\n        subtract(other) {\n            return this.add(other.negate());\n        }\n        wNAF(n) {\n            return wnaf.wNAFCached(this, n, Point.normalizeZ);\n        }\n        // Constant-time multiplication.\n        multiply(scalar) {\n            const n = scalar;\n            ut.aInRange('scalar', n, _1n, CURVE_ORDER); // 1 <= scalar < L\n            const { p, f } = this.wNAF(n);\n            return Point.normalizeZ([p, f])[0];\n        }\n        // Non-constant-time multiplication. Uses double-and-add algorithm.\n        // It's faster, but should only be used when you don't care about\n        // an exposed private key e.g. sig verification.\n        // Does NOT allow scalars higher than CURVE.n.\n        multiplyUnsafe(scalar) {\n            const n = scalar;\n            ut.aInRange('scalar', n, _0n, CURVE_ORDER); // 0 <= scalar < L\n            if (n === _0n)\n                return I;\n            if (this.equals(I) || n === _1n)\n                return this;\n            if (this.equals(G))\n                return this.wNAF(n).p;\n            return wnaf.unsafeLadder(this, n);\n        }\n        // Checks if point is of small order.\n        // If you add something to small order point, you will have \"dirty\"\n        // point with torsion component.\n        // Multiplies point by cofactor and checks if the result is 0.\n        isSmallOrder() {\n            return this.multiplyUnsafe(cofactor).is0();\n        }\n        // Multiplies point by curve order and checks if the result is 0.\n        // Returns `false` is the point is dirty.\n        isTorsionFree() {\n            return wnaf.unsafeLadder(this, CURVE_ORDER).is0();\n        }\n        // Converts Extended point to default (x, y) coordinates.\n        // Can accept precomputed Z^-1 - for example, from invertBatch.\n        toAffine(iz) {\n            return toAffineMemo(this, iz);\n        }\n        clearCofactor() {\n            const { h: cofactor } = CURVE;\n            if (cofactor === _1n)\n                return this;\n            return this.multiplyUnsafe(cofactor);\n        }\n        // Converts hash string or Uint8Array to Point.\n        // Uses algo from RFC8032 5.1.3.\n        static fromHex(hex, zip215 = false) {\n            const { d, a } = CURVE;\n            const len = Fp.BYTES;\n            hex = ensureBytes('pointHex', hex, len); // copy hex to a new array\n            abool('zip215', zip215);\n            const normed = hex.slice(); // copy again, we'll manipulate it\n            const lastByte = hex[len - 1]; // select last byte\n            normed[len - 1] = lastByte & ~0x80; // clear last bit\n            const y = ut.bytesToNumberLE(normed);\n            // RFC8032 prohibits >= p, but ZIP215 doesn't\n            // zip215=true:  0 <= y < MASK (2^256 for ed25519)\n            // zip215=false: 0 <= y < P (2^255-19 for ed25519)\n            const max = zip215 ? MASK : Fp.ORDER;\n            ut.aInRange('pointHex.y', y, _0n, max);\n            // Ed25519: x² = (y²-1)/(dy²+1) mod p. Ed448: x² = (y²-1)/(dy²-1) mod p. Generic case:\n            // ax²+y²=1+dx²y² => y²-1=dx²y²-ax² => y²-1=x²(dy²-a) => x²=(y²-1)/(dy²-a)\n            const y2 = modP(y * y); // denominator is always non-0 mod p.\n            const u = modP(y2 - _1n); // u = y² - 1\n            const v = modP(d * y2 - a); // v = d y² + 1.\n            let { isValid, value: x } = uvRatio(u, v); // √(u/v)\n            if (!isValid)\n                throw new Error('Point.fromHex: invalid y coordinate');\n            const isXOdd = (x & _1n) === _1n; // There are 2 square roots. Use x_0 bit to select proper\n            const isLastByteOdd = (lastByte & 0x80) !== 0; // x_0, last bit\n            if (!zip215 && x === _0n && isLastByteOdd)\n                // if x=0 and x_0 = 1, fail\n                throw new Error('Point.fromHex: x=0 and x_0=1');\n            if (isLastByteOdd !== isXOdd)\n                x = modP(-x); // if x_0 != x mod 2, set x = p-x\n            return Point.fromAffine({ x, y });\n        }\n        static fromPrivateKey(privKey) {\n            return getExtendedPublicKey(privKey).point;\n        }\n        toRawBytes() {\n            const { x, y } = this.toAffine();\n            const bytes = ut.numberToBytesLE(y, Fp.BYTES); // each y has 2 x values (x, -y)\n            bytes[bytes.length - 1] |= x & _1n ? 0x80 : 0; // when compressing, it's enough to store y\n            return bytes; // and use the last byte to encode sign of x\n        }\n        toHex() {\n            return ut.bytesToHex(this.toRawBytes()); // Same as toRawBytes, but returns string.\n        }\n    }\n    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, _1n, modP(CURVE.Gx * CURVE.Gy));\n    Point.ZERO = new Point(_0n, _1n, _1n, _0n); // 0, 1, 1, 0\n    const { BASE: G, ZERO: I } = Point;\n    const wnaf = wNAF(Point, nByteLength * 8);\n    function modN(a) {\n        return mod(a, CURVE_ORDER);\n    }\n    // Little-endian SHA512 with modulo n\n    function modN_LE(hash) {\n        return modN(ut.bytesToNumberLE(hash));\n    }\n    /** Convenience method that creates public key and other stuff. RFC8032 5.1.5 */\n    function getExtendedPublicKey(key) {\n        const len = nByteLength;\n        key = ensureBytes('private key', key, len);\n        // Hash private key with curve's hash function to produce uniformingly random input\n        // Check byte lengths: ensure(64, h(ensure(32, key)))\n        const hashed = ensureBytes('hashed private key', cHash(key), 2 * len);\n        const head = adjustScalarBytes(hashed.slice(0, len)); // clear first half bits, produce FE\n        const prefix = hashed.slice(len, 2 * len); // second half is called key prefix (5.1.6)\n        const scalar = modN_LE(head); // The actual private scalar\n        const point = G.multiply(scalar); // Point on Edwards curve aka public key\n        const pointBytes = point.toRawBytes(); // Uint8Array representation\n        return { head, prefix, scalar, point, pointBytes };\n    }\n    // Calculates EdDSA pub key. RFC8032 5.1.5. Privkey is hashed. Use first half with 3 bits cleared\n    function getPublicKey(privKey) {\n        return getExtendedPublicKey(privKey).pointBytes;\n    }\n    // int('LE', SHA512(dom2(F, C) || msgs)) mod N\n    function hashDomainToScalar(context = new Uint8Array(), ...msgs) {\n        const msg = ut.concatBytes(...msgs);\n        return modN_LE(cHash(domain(msg, ensureBytes('context', context), !!prehash)));\n    }\n    /** Signs message with privateKey. RFC8032 5.1.6 */\n    function sign(msg, privKey, options = {}) {\n        msg = ensureBytes('message', msg);\n        if (prehash)\n            msg = prehash(msg); // for ed25519ph etc.\n        const { prefix, scalar, pointBytes } = getExtendedPublicKey(privKey);\n        const r = hashDomainToScalar(options.context, prefix, msg); // r = dom2(F, C) || prefix || PH(M)\n        const R = G.multiply(r).toRawBytes(); // R = rG\n        const k = hashDomainToScalar(options.context, R, pointBytes, msg); // R || A || PH(M)\n        const s = modN(r + k * scalar); // S = (r + k * s) mod L\n        ut.aInRange('signature.s', s, _0n, CURVE_ORDER); // 0 <= s < l\n        const res = ut.concatBytes(R, ut.numberToBytesLE(s, Fp.BYTES));\n        return ensureBytes('result', res, nByteLength * 2); // 64-byte signature\n    }\n    const verifyOpts = VERIFY_DEFAULT;\n    function verify(sig, msg, publicKey, options = verifyOpts) {\n        const { context, zip215 } = options;\n        const len = Fp.BYTES; // Verifies EdDSA signature against message and public key. RFC8032 5.1.7.\n        sig = ensureBytes('signature', sig, 2 * len); // An extended group equation is checked.\n        msg = ensureBytes('message', msg);\n        if (zip215 !== undefined)\n            abool('zip215', zip215);\n        if (prehash)\n            msg = prehash(msg); // for ed25519ph, etc\n        const s = ut.bytesToNumberLE(sig.slice(len, 2 * len));\n        // zip215: true is good for consensus-critical apps and allows points < 2^256\n        // zip215: false follows RFC8032 / NIST186-5 and restricts points to CURVE.p\n        let A, R, SB;\n        try {\n            A = Point.fromHex(publicKey, zip215);\n            R = Point.fromHex(sig.slice(0, len), zip215);\n            SB = G.multiplyUnsafe(s); // 0 <= s < l is done inside\n        }\n        catch (error) {\n            return false;\n        }\n        if (!zip215 && A.isSmallOrder())\n            return false;\n        const k = hashDomainToScalar(context, R.toRawBytes(), A.toRawBytes(), msg);\n        const RkA = R.add(A.multiplyUnsafe(k));\n        // [8][S]B = [8]R + [8][k]A'\n        return RkA.subtract(SB).clearCofactor().equals(Point.ZERO);\n    }\n    G._setWindowSize(8); // Enable precomputes. Slows down first publicKey computation by 20ms.\n    const utils = {\n        getExtendedPublicKey,\n        // ed25519 private keys are uniform 32b. No need to check for modulo bias, like in secp256k1.\n        randomPrivateKey: () => randomBytes(Fp.BYTES),\n        /**\n         * We're doing scalar multiplication (used in getPublicKey etc) with precomputed BASE_POINT\n         * values. This slows down first getPublicKey() by milliseconds (see Speed section),\n         * but allows to speed-up subsequent getPublicKey() calls up to 20x.\n         * @param windowSize 2, 4, 8, 16\n         */\n        precompute(windowSize = 8, point = Point.BASE) {\n            point._setWindowSize(windowSize);\n            point.multiply(BigInt(3));\n            return point;\n        },\n    };\n    return {\n        CURVE,\n        getPublicKey,\n        sign,\n        verify,\n        ExtendedPoint: Point,\n        utils,\n    };\n}\n//# sourceMappingURL=edwards.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { mod, pow } from './modular.js';\nimport { aInRange, bytesToNumberLE, ensureBytes, numberToBytesLE, validateObject, } from './utils.js';\nconst _0n = BigInt(0);\nconst _1n = BigInt(1);\nfunction validateOpts(curve) {\n    validateObject(curve, {\n        a: 'bigint',\n    }, {\n        montgomeryBits: 'isSafeInteger',\n        nByteLength: 'isSafeInteger',\n        adjustScalarBytes: 'function',\n        domain: 'function',\n        powPminus2: 'function',\n        Gu: 'bigint',\n    });\n    // Set defaults\n    return Object.freeze({ ...curve });\n}\n// NOTE: not really montgomery curve, just bunch of very specific methods for X25519/X448 (RFC 7748, https://www.rfc-editor.org/rfc/rfc7748)\n// Uses only one coordinate instead of two\nexport function montgomery(curveDef) {\n    const CURVE = validateOpts(curveDef);\n    const { P } = CURVE;\n    const modP = (n) => mod(n, P);\n    const montgomeryBits = CURVE.montgomeryBits;\n    const montgomeryBytes = Math.ceil(montgomeryBits / 8);\n    const fieldLen = CURVE.nByteLength;\n    const adjustScalarBytes = CURVE.adjustScalarBytes || ((bytes) => bytes);\n    const powPminus2 = CURVE.powPminus2 || ((x) => pow(x, P - BigInt(2), P));\n    // cswap from RFC7748. But it is not from RFC7748!\n    /*\n      cswap(swap, x_2, x_3):\n           dummy = mask(swap) AND (x_2 XOR x_3)\n           x_2 = x_2 XOR dummy\n           x_3 = x_3 XOR dummy\n           Return (x_2, x_3)\n    Where mask(swap) is the all-1 or all-0 word of the same length as x_2\n     and x_3, computed, e.g., as mask(swap) = 0 - swap.\n    */\n    function cswap(swap, x_2, x_3) {\n        const dummy = modP(swap * (x_2 - x_3));\n        x_2 = modP(x_2 - dummy);\n        x_3 = modP(x_3 + dummy);\n        return [x_2, x_3];\n    }\n    // x25519 from 4\n    // The constant a24 is (486662 - 2) / 4 = 121665 for curve25519/X25519\n    const a24 = (CURVE.a - BigInt(2)) / BigInt(4);\n    /**\n     *\n     * @param pointU u coordinate (x) on Montgomery Curve 25519\n     * @param scalar by which the point would be multiplied\n     * @returns new Point on Montgomery curve\n     */\n    function montgomeryLadder(u, scalar) {\n        aInRange('u', u, _0n, P);\n        aInRange('scalar', scalar, _0n, P);\n        // Section 5: Implementations MUST accept non-canonical values and process them as\n        // if they had been reduced modulo the field prime.\n        const k = scalar;\n        const x_1 = u;\n        let x_2 = _1n;\n        let z_2 = _0n;\n        let x_3 = u;\n        let z_3 = _1n;\n        let swap = _0n;\n        let sw;\n        for (let t = BigInt(montgomeryBits - 1); t >= _0n; t--) {\n            const k_t = (k >> t) & _1n;\n            swap ^= k_t;\n            sw = cswap(swap, x_2, x_3);\n            x_2 = sw[0];\n            x_3 = sw[1];\n            sw = cswap(swap, z_2, z_3);\n            z_2 = sw[0];\n            z_3 = sw[1];\n            swap = k_t;\n            const A = x_2 + z_2;\n            const AA = modP(A * A);\n            const B = x_2 - z_2;\n            const BB = modP(B * B);\n            const E = AA - BB;\n            const C = x_3 + z_3;\n            const D = x_3 - z_3;\n            const DA = modP(D * A);\n            const CB = modP(C * B);\n            const dacb = DA + CB;\n            const da_cb = DA - CB;\n            x_3 = modP(dacb * dacb);\n            z_3 = modP(x_1 * modP(da_cb * da_cb));\n            x_2 = modP(AA * BB);\n            z_2 = modP(E * (AA + modP(a24 * E)));\n        }\n        // (x_2, x_3) = cswap(swap, x_2, x_3)\n        sw = cswap(swap, x_2, x_3);\n        x_2 = sw[0];\n        x_3 = sw[1];\n        // (z_2, z_3) = cswap(swap, z_2, z_3)\n        sw = cswap(swap, z_2, z_3);\n        z_2 = sw[0];\n        z_3 = sw[1];\n        // z_2^(p - 2)\n        const z2 = powPminus2(z_2);\n        // Return x_2 * (z_2^(p - 2))\n        return modP(x_2 * z2);\n    }\n    function encodeUCoordinate(u) {\n        return numberToBytesLE(modP(u), montgomeryBytes);\n    }\n    function decodeUCoordinate(uEnc) {\n        // Section 5: When receiving such an array, implementations of X25519\n        // MUST mask the most significant bit in the final byte.\n        const u = ensureBytes('u coordinate', uEnc, montgomeryBytes);\n        if (fieldLen === 32)\n            u[31] &= 127; // 0b0111_1111\n        return bytesToNumberLE(u);\n    }\n    function decodeScalar(n) {\n        const bytes = ensureBytes('scalar', n);\n        const len = bytes.length;\n        if (len !== montgomeryBytes && len !== fieldLen)\n            throw new Error(`Expected ${montgomeryBytes} or ${fieldLen} bytes, got ${len}`);\n        return bytesToNumberLE(adjustScalarBytes(bytes));\n    }\n    function scalarMult(scalar, u) {\n        const pointU = decodeUCoordinate(u);\n        const _scalar = decodeScalar(scalar);\n        const pu = montgomeryLadder(pointU, _scalar);\n        // The result was not contributory\n        // https://cr.yp.to/ecdh.html#validate\n        if (pu === _0n)\n            throw new Error('Invalid private or public key received');\n        return encodeUCoordinate(pu);\n    }\n    // Computes public key from private. By doing scalar multiplication of base point.\n    const GuBytes = encodeUCoordinate(CURVE.Gu);\n    function scalarMultBase(scalar) {\n        return scalarMult(scalar, GuBytes);\n    }\n    return {\n        scalarMult,\n        scalarMultBase,\n        getSharedSecret: (privateKey, publicKey) => scalarMult(privateKey, publicKey),\n        getPublicKey: (privateKey) => scalarMultBase(privateKey),\n        utils: { randomPrivateKey: () => CURVE.randomBytes(CURVE.nByteLength) },\n        GuBytes: GuBytes,\n    };\n}\n//# sourceMappingURL=montgomery.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { shake256 } from '@noble/hashes/sha3';\nimport { concatBytes, randomBytes, utf8ToBytes, wrapConstructor } from '@noble/hashes/utils';\nimport { twistedEdwards } from './abstract/edwards.js';\nimport { createHasher, expand_message_xof } from './abstract/hash-to-curve.js';\nimport { Field, isNegativeLE, mod, pow2 } from './abstract/modular.js';\nimport { montgomery } from './abstract/montgomery.js';\nimport { bytesToHex, bytesToNumberLE, ensureBytes, equalBytes, numberToBytesLE, } from './abstract/utils.js';\n/**\n * Edwards448 (not Ed448-Goldilocks) curve with following addons:\n * - X448 ECDH\n * - Decaf cofactor elimination\n * - Elligator hash-to-group / point indistinguishability\n * Conforms to RFC 8032 https://www.rfc-editor.org/rfc/rfc8032.html#section-5.2\n */\nconst shake256_114 = wrapConstructor(() => shake256.create({ dkLen: 114 }));\nconst shake256_64 = wrapConstructor(() => shake256.create({ dkLen: 64 }));\nconst ed448P = BigInt('726838724295606890549323807888004534353641360687318060281490199180612328166730772686396383698676545930088884461843637361053498018365439');\n// prettier-ignore\nconst _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4), _11n = BigInt(11);\n// prettier-ignore\nconst _22n = BigInt(22), _44n = BigInt(44), _88n = BigInt(88), _223n = BigInt(223);\n// powPminus3div4 calculates z = x^k mod p, where k = (p-3)/4.\n// Used for efficient square root calculation.\n// ((P-3)/4).toString(2) would produce bits [223x 1, 0, 222x 1]\nfunction ed448_pow_Pminus3div4(x) {\n    const P = ed448P;\n    const b2 = (x * x * x) % P;\n    const b3 = (b2 * b2 * x) % P;\n    const b6 = (pow2(b3, _3n, P) * b3) % P;\n    const b9 = (pow2(b6, _3n, P) * b3) % P;\n    const b11 = (pow2(b9, _2n, P) * b2) % P;\n    const b22 = (pow2(b11, _11n, P) * b11) % P;\n    const b44 = (pow2(b22, _22n, P) * b22) % P;\n    const b88 = (pow2(b44, _44n, P) * b44) % P;\n    const b176 = (pow2(b88, _88n, P) * b88) % P;\n    const b220 = (pow2(b176, _44n, P) * b44) % P;\n    const b222 = (pow2(b220, _2n, P) * b2) % P;\n    const b223 = (pow2(b222, _1n, P) * x) % P;\n    return (pow2(b223, _223n, P) * b222) % P;\n}\nfunction adjustScalarBytes(bytes) {\n    // Section 5: Likewise, for X448, set the two least significant bits of the first byte to 0, and the most\n    // significant bit of the last byte to 1.\n    bytes[0] &= 252; // 0b11111100\n    // and the most significant bit of the last byte to 1.\n    bytes[55] |= 128; // 0b10000000\n    // NOTE: is is NOOP for 56 bytes scalars (X25519/X448)\n    bytes[56] = 0; // Byte outside of group (456 buts vs 448 bits)\n    return bytes;\n}\n// Constant-time ratio of u to v. Allows to combine inversion and square root u/√v.\n// Uses algo from RFC8032 5.1.3.\nfunction uvRatio(u, v) {\n    const P = ed448P;\n    // https://www.rfc-editor.org/rfc/rfc8032#section-5.2.3\n    // To compute the square root of (u/v), the first step is to compute the\n    //   candidate root x = (u/v)^((p+1)/4).  This can be done using the\n    // following trick, to use a single modular powering for both the\n    // inversion of v and the square root:\n    // x = (u/v)^((p+1)/4)   = u³v(u⁵v³)^((p-3)/4)   (mod p)\n    const u2v = mod(u * u * v, P); // u²v\n    const u3v = mod(u2v * u, P); // u³v\n    const u5v3 = mod(u3v * u2v * v, P); // u⁵v³\n    const root = ed448_pow_Pminus3div4(u5v3);\n    const x = mod(u3v * root, P);\n    // Verify that root is exists\n    const x2 = mod(x * x, P); // x²\n    // If vx² = u, the recovered x-coordinate is x.  Otherwise, no\n    // square root exists, and the decoding fails.\n    return { isValid: mod(x2 * v, P) === u, value: x };\n}\nconst Fp = Field(ed448P, 456, true);\nconst ED448_DEF = {\n    // Param: a\n    a: BigInt(1),\n    // -39081. Negative number is P - number\n    d: BigInt('726838724295606890549323807888004534353641360687318060281490199180612328166730772686396383698676545930088884461843637361053498018326358'),\n    // Finite field 𝔽p over which we'll do calculations; 2n**448n - 2n**224n - 1n\n    Fp,\n    // Subgroup order: how many points curve has;\n    // 2n**446n - 13818066809895115352007386748515426880336692474882178609894547503885n\n    n: BigInt('181709681073901722637330951972001133588410340171829515070372549795146003961539585716195755291692375963310293709091662304773755859649779'),\n    // RFC 7748 has 56-byte keys, RFC 8032 has 57-byte keys\n    nBitLength: 456,\n    // Cofactor\n    h: BigInt(4),\n    // Base point (x, y) aka generator point\n    Gx: BigInt('224580040295924300187604334099896036246789641632564134246125461686950415467406032909029192869357953282578032075146446173674602635247710'),\n    Gy: BigInt('298819210078481492676017930443930673437544040154080242095928241372331506189835876003536878655418784733982303233503462500531545062832660'),\n    // SHAKE256(dom4(phflag,context)||x, 114)\n    hash: shake256_114,\n    randomBytes,\n    adjustScalarBytes,\n    // dom4\n    domain: (data, ctx, phflag) => {\n        if (ctx.length > 255)\n            throw new Error(`Context is too big: ${ctx.length}`);\n        return concatBytes(utf8ToBytes('SigEd448'), new Uint8Array([phflag ? 1 : 0, ctx.length]), ctx, data);\n    },\n    uvRatio,\n};\nexport const ed448 = /* @__PURE__ */ twistedEdwards(ED448_DEF);\n// NOTE: there is no ed448ctx, since ed448 supports ctx by default\nexport const ed448ph = /* @__PURE__ */ twistedEdwards({ ...ED448_DEF, prehash: shake256_64 });\nexport const x448 = /* @__PURE__ */ (() => montgomery({\n    a: BigInt(156326),\n    // RFC 7748 has 56-byte keys, RFC 8032 has 57-byte keys\n    montgomeryBits: 448,\n    nByteLength: 56,\n    P: ed448P,\n    Gu: BigInt(5),\n    powPminus2: (x) => {\n        const P = ed448P;\n        const Pminus3div4 = ed448_pow_Pminus3div4(x);\n        const Pminus3 = pow2(Pminus3div4, BigInt(2), P);\n        return mod(Pminus3 * x, P); // Pminus3 * x = Pminus2\n    },\n    adjustScalarBytes,\n    randomBytes,\n}))();\n/**\n * Converts edwards448 public key to x448 public key. Uses formula:\n * * `(u, v) = ((y-1)/(y+1), sqrt(156324)*u/x)`\n * * `(x, y) = (sqrt(156324)*u/v, (1+u)/(1-u))`\n * @example\n *   const aPub = ed448.getPublicKey(utils.randomPrivateKey());\n *   x448.getSharedSecret(edwardsToMontgomery(aPub), edwardsToMontgomery(someonesPub))\n */\nexport function edwardsToMontgomeryPub(edwardsPub) {\n    const { y } = ed448.ExtendedPoint.fromHex(edwardsPub);\n    const _1n = BigInt(1);\n    return Fp.toBytes(Fp.create((y - _1n) * Fp.inv(y + _1n)));\n}\nexport const edwardsToMontgomery = edwardsToMontgomeryPub; // deprecated\n// TODO: add edwardsToMontgomeryPriv, similar to ed25519 version\n// Hash To Curve Elligator2 Map\nconst ELL2_C1 = (Fp.ORDER - BigInt(3)) / BigInt(4); // 1. c1 = (q - 3) / 4         # Integer arithmetic\nconst ELL2_J = BigInt(156326);\nfunction map_to_curve_elligator2_curve448(u) {\n    let tv1 = Fp.sqr(u); // 1.  tv1 = u^2\n    let e1 = Fp.eql(tv1, Fp.ONE); // 2.   e1 = tv1 == 1\n    tv1 = Fp.cmov(tv1, Fp.ZERO, e1); // 3.  tv1 = CMOV(tv1, 0, e1)  # If Z * u^2 == -1, set tv1 = 0\n    let xd = Fp.sub(Fp.ONE, tv1); // 4.   xd = 1 - tv1\n    let x1n = Fp.neg(ELL2_J); // 5.  x1n = -J\n    let tv2 = Fp.sqr(xd); // 6.  tv2 = xd^2\n    let gxd = Fp.mul(tv2, xd); // 7.  gxd = tv2 * xd          # gxd = xd^3\n    let gx1 = Fp.mul(tv1, Fp.neg(ELL2_J)); // 8.  gx1 = -J * tv1          # x1n + J * xd\n    gx1 = Fp.mul(gx1, x1n); // 9.  gx1 = gx1 * x1n         # x1n^2 + J * x1n * xd\n    gx1 = Fp.add(gx1, tv2); // 10. gx1 = gx1 + tv2         # x1n^2 + J * x1n * xd + xd^2\n    gx1 = Fp.mul(gx1, x1n); // 11. gx1 = gx1 * x1n         # x1n^3 + J * x1n^2 * xd + x1n * xd^2\n    let tv3 = Fp.sqr(gxd); // 12. tv3 = gxd^2\n    tv2 = Fp.mul(gx1, gxd); // 13. tv2 = gx1 * gxd         # gx1 * gxd\n    tv3 = Fp.mul(tv3, tv2); // 14. tv3 = tv3 * tv2         # gx1 * gxd^3\n    let y1 = Fp.pow(tv3, ELL2_C1); // 15.  y1 = tv3^c1            # (gx1 * gxd^3)^((p - 3) / 4)\n    y1 = Fp.mul(y1, tv2); // 16.  y1 = y1 * tv2          # gx1 * gxd * (gx1 * gxd^3)^((p - 3) / 4)\n    let x2n = Fp.mul(x1n, Fp.neg(tv1)); // 17. x2n = -tv1 * x1n        # x2 = x2n / xd = -1 * u^2 * x1n / xd\n    let y2 = Fp.mul(y1, u); // 18.  y2 = y1 * u\n    y2 = Fp.cmov(y2, Fp.ZERO, e1); // 19.  y2 = CMOV(y2, 0, e1)\n    tv2 = Fp.sqr(y1); // 20. tv2 = y1^2\n    tv2 = Fp.mul(tv2, gxd); // 21. tv2 = tv2 * gxd\n    let e2 = Fp.eql(tv2, gx1); // 22.  e2 = tv2 == gx1\n    let xn = Fp.cmov(x2n, x1n, e2); // 23.  xn = CMOV(x2n, x1n, e2)  # If e2, x = x1, else x = x2\n    let y = Fp.cmov(y2, y1, e2); // 24.   y = CMOV(y2, y1, e2)    # If e2, y = y1, else y = y2\n    let e3 = Fp.isOdd(y); // 25.  e3 = sgn0(y) == 1        # Fix sign of y\n    y = Fp.cmov(y, Fp.neg(y), e2 !== e3); // 26.   y = CMOV(y, -y, e2 XOR e3)\n    return { xn, xd, yn: y, yd: Fp.ONE }; // 27. return (xn, xd, y, 1)\n}\nfunction map_to_curve_elligator2_edwards448(u) {\n    let { xn, xd, yn, yd } = map_to_curve_elligator2_curve448(u); // 1. (xn, xd, yn, yd) = map_to_curve_elligator2_curve448(u)\n    let xn2 = Fp.sqr(xn); // 2.  xn2 = xn^2\n    let xd2 = Fp.sqr(xd); // 3.  xd2 = xd^2\n    let xd4 = Fp.sqr(xd2); // 4.  xd4 = xd2^2\n    let yn2 = Fp.sqr(yn); // 5.  yn2 = yn^2\n    let yd2 = Fp.sqr(yd); // 6.  yd2 = yd^2\n    let xEn = Fp.sub(xn2, xd2); // 7.  xEn = xn2 - xd2\n    let tv2 = Fp.sub(xEn, xd2); // 8.  tv2 = xEn - xd2\n    xEn = Fp.mul(xEn, xd2); // 9.  xEn = xEn * xd2\n    xEn = Fp.mul(xEn, yd); // 10. xEn = xEn * yd\n    xEn = Fp.mul(xEn, yn); // 11. xEn = xEn * yn\n    xEn = Fp.mul(xEn, _4n); // 12. xEn = xEn * 4\n    tv2 = Fp.mul(tv2, xn2); // 13. tv2 = tv2 * xn2\n    tv2 = Fp.mul(tv2, yd2); // 14. tv2 = tv2 * yd2\n    let tv3 = Fp.mul(yn2, _4n); // 15. tv3 = 4 * yn2\n    let tv1 = Fp.add(tv3, yd2); // 16. tv1 = tv3 + yd2\n    tv1 = Fp.mul(tv1, xd4); // 17. tv1 = tv1 * xd4\n    let xEd = Fp.add(tv1, tv2); // 18. xEd = tv1 + tv2\n    tv2 = Fp.mul(tv2, xn); // 19. tv2 = tv2 * xn\n    let tv4 = Fp.mul(xn, xd4); // 20. tv4 = xn * xd4\n    let yEn = Fp.sub(tv3, yd2); // 21. yEn = tv3 - yd2\n    yEn = Fp.mul(yEn, tv4); // 22. yEn = yEn * tv4\n    yEn = Fp.sub(yEn, tv2); // 23. yEn = yEn - tv2\n    tv1 = Fp.add(xn2, xd2); // 24. tv1 = xn2 + xd2\n    tv1 = Fp.mul(tv1, xd2); // 25. tv1 = tv1 * xd2\n    tv1 = Fp.mul(tv1, xd); // 26. tv1 = tv1 * xd\n    tv1 = Fp.mul(tv1, yn2); // 27. tv1 = tv1 * yn2\n    tv1 = Fp.mul(tv1, BigInt(-2)); // 28. tv1 = -2 * tv1\n    let yEd = Fp.add(tv2, tv1); // 29. yEd = tv2 + tv1\n    tv4 = Fp.mul(tv4, yd2); // 30. tv4 = tv4 * yd2\n    yEd = Fp.add(yEd, tv4); // 31. yEd = yEd + tv4\n    tv1 = Fp.mul(xEd, yEd); // 32. tv1 = xEd * yEd\n    let e = Fp.eql(tv1, Fp.ZERO); // 33.   e = tv1 == 0\n    xEn = Fp.cmov(xEn, Fp.ZERO, e); // 34. xEn = CMOV(xEn, 0, e)\n    xEd = Fp.cmov(xEd, Fp.ONE, e); // 35. xEd = CMOV(xEd, 1, e)\n    yEn = Fp.cmov(yEn, Fp.ONE, e); // 36. yEn = CMOV(yEn, 1, e)\n    yEd = Fp.cmov(yEd, Fp.ONE, e); // 37. yEd = CMOV(yEd, 1, e)\n    const inv = Fp.invertBatch([xEd, yEd]); // batch division\n    return { x: Fp.mul(xEn, inv[0]), y: Fp.mul(yEn, inv[1]) }; // 38. return (xEn, xEd, yEn, yEd)\n}\nconst htf = /* @__PURE__ */ (() => createHasher(ed448.ExtendedPoint, (scalars) => map_to_curve_elligator2_edwards448(scalars[0]), {\n    DST: 'edwards448_XOF:SHAKE256_ELL2_RO_',\n    encodeDST: 'edwards448_XOF:SHAKE256_ELL2_NU_',\n    p: Fp.ORDER,\n    m: 1,\n    k: 224,\n    expand: 'xof',\n    hash: shake256,\n}))();\nexport const hashToCurve = /* @__PURE__ */ (() => htf.hashToCurve)();\nexport const encodeToCurve = /* @__PURE__ */ (() => htf.encodeToCurve)();\nfunction assertDcfPoint(other) {\n    if (!(other instanceof DcfPoint))\n        throw new Error('DecafPoint expected');\n}\n// 1-d\nconst ONE_MINUS_D = BigInt('39082');\n// 1-2d\nconst ONE_MINUS_TWO_D = BigInt('78163');\n// √(-d)\nconst SQRT_MINUS_D = BigInt('98944233647732219769177004876929019128417576295529901074099889598043702116001257856802131563896515373927712232092845883226922417596214');\n// 1 / √(-d)\nconst INVSQRT_MINUS_D = BigInt('315019913931389607337177038330951043522456072897266928557328499619017160722351061360252776265186336876723201881398623946864393857820716');\n// Calculates 1/√(number)\nconst invertSqrt = (number) => uvRatio(_1n, number);\nconst MAX_448B = BigInt('0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff');\nconst bytes448ToNumberLE = (bytes) => ed448.CURVE.Fp.create(bytesToNumberLE(bytes) & MAX_448B);\n// Computes Elligator map for Decaf\n// https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-ristretto255-decaf448-07#name-element-derivation-2\nfunction calcElligatorDecafMap(r0) {\n    const { d } = ed448.CURVE;\n    const P = ed448.CURVE.Fp.ORDER;\n    const mod = ed448.CURVE.Fp.create;\n    const r = mod(-(r0 * r0)); // 1\n    const u0 = mod(d * (r - _1n)); // 2\n    const u1 = mod((u0 + _1n) * (u0 - r)); // 3\n    const { isValid: was_square, value: v } = uvRatio(ONE_MINUS_TWO_D, mod((r + _1n) * u1)); // 4\n    let v_prime = v; // 5\n    if (!was_square)\n        v_prime = mod(r0 * v);\n    let sgn = _1n; // 6\n    if (!was_square)\n        sgn = mod(-_1n);\n    const s = mod(v_prime * (r + _1n)); // 7\n    let s_abs = s;\n    if (isNegativeLE(s, P))\n        s_abs = mod(-s);\n    const s2 = s * s;\n    const W0 = mod(s_abs * _2n); // 8\n    const W1 = mod(s2 + _1n); // 9\n    const W2 = mod(s2 - _1n); // 10\n    const W3 = mod(v_prime * s * (r - _1n) * ONE_MINUS_TWO_D + sgn); // 11\n    return new ed448.ExtendedPoint(mod(W0 * W3), mod(W2 * W1), mod(W1 * W3), mod(W0 * W2));\n}\n/**\n * Each ed448/ExtendedPoint has 4 different equivalent points. This can be\n * a source of bugs for protocols like ring signatures. Decaf was created to solve this.\n * Decaf point operates in X:Y:Z:T extended coordinates like ExtendedPoint,\n * but it should work in its own namespace: do not combine those two.\n * https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-ristretto255-decaf448\n */\nclass DcfPoint {\n    // Private property to discourage combining ExtendedPoint + DecafPoint\n    // Always use Decaf encoding/decoding instead.\n    constructor(ep) {\n        this.ep = ep;\n    }\n    static fromAffine(ap) {\n        return new DcfPoint(ed448.ExtendedPoint.fromAffine(ap));\n    }\n    /**\n     * Takes uniform output of 112-byte hash function like shake256 and converts it to `DecafPoint`.\n     * The hash-to-group operation applies Elligator twice and adds the results.\n     * **Note:** this is one-way map, there is no conversion from point to hash.\n     * https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-ristretto255-decaf448-07#name-element-derivation-2\n     * @param hex 112-byte output of a hash function\n     */\n    static hashToCurve(hex) {\n        hex = ensureBytes('decafHash', hex, 112);\n        const r1 = bytes448ToNumberLE(hex.slice(0, 56));\n        const R1 = calcElligatorDecafMap(r1);\n        const r2 = bytes448ToNumberLE(hex.slice(56, 112));\n        const R2 = calcElligatorDecafMap(r2);\n        return new DcfPoint(R1.add(R2));\n    }\n    /**\n     * Converts decaf-encoded string to decaf point.\n     * https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-ristretto255-decaf448-07#name-decode-2\n     * @param hex Decaf-encoded 56 bytes. Not every 56-byte string is valid decaf encoding\n     */\n    static fromHex(hex) {\n        hex = ensureBytes('decafHex', hex, 56);\n        const { d } = ed448.CURVE;\n        const P = ed448.CURVE.Fp.ORDER;\n        const mod = ed448.CURVE.Fp.create;\n        const emsg = 'DecafPoint.fromHex: the hex is not valid encoding of DecafPoint';\n        const s = bytes448ToNumberLE(hex);\n        // 1. Check that s_bytes is the canonical encoding of a field element, or else abort.\n        // 2. Check that s is non-negative, or else abort\n        if (!equalBytes(numberToBytesLE(s, 56), hex) || isNegativeLE(s, P))\n            throw new Error(emsg);\n        const s2 = mod(s * s); // 1\n        const u1 = mod(_1n + s2); // 2\n        const u1sq = mod(u1 * u1);\n        const u2 = mod(u1sq - _4n * d * s2); // 3\n        const { isValid, value: invsqrt } = invertSqrt(mod(u2 * u1sq)); // 4\n        let u3 = mod((s + s) * invsqrt * u1 * SQRT_MINUS_D); // 5\n        if (isNegativeLE(u3, P))\n            u3 = mod(-u3);\n        const x = mod(u3 * invsqrt * u2 * INVSQRT_MINUS_D); // 6\n        const y = mod((_1n - s2) * invsqrt * u1); // 7\n        const t = mod(x * y); // 8\n        if (!isValid)\n            throw new Error(emsg);\n        return new DcfPoint(new ed448.ExtendedPoint(x, y, _1n, t));\n    }\n    /**\n     * Encodes decaf point to Uint8Array.\n     * https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-ristretto255-decaf448-07#name-encode-2\n     */\n    toRawBytes() {\n        let { ex: x, ey: _y, ez: z, et: t } = this.ep;\n        const P = ed448.CURVE.Fp.ORDER;\n        const mod = ed448.CURVE.Fp.create;\n        const u1 = mod(mod(x + t) * mod(x - t)); // 1\n        const x2 = mod(x * x);\n        const { value: invsqrt } = invertSqrt(mod(u1 * ONE_MINUS_D * x2)); // 2\n        let ratio = mod(invsqrt * u1 * SQRT_MINUS_D); // 3\n        if (isNegativeLE(ratio, P))\n            ratio = mod(-ratio);\n        const u2 = mod(INVSQRT_MINUS_D * ratio * z - t); // 4\n        let s = mod(ONE_MINUS_D * invsqrt * x * u2); // 5\n        if (isNegativeLE(s, P))\n            s = mod(-s);\n        return numberToBytesLE(s, 56);\n    }\n    toHex() {\n        return bytesToHex(this.toRawBytes());\n    }\n    toString() {\n        return this.toHex();\n    }\n    // Compare one point to another.\n    // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-ristretto255-decaf448-07#name-equals-2\n    equals(other) {\n        assertDcfPoint(other);\n        const { ex: X1, ey: Y1 } = this.ep;\n        const { ex: X2, ey: Y2 } = other.ep;\n        const mod = ed448.CURVE.Fp.create;\n        // (x1 * y2 == y1 * x2)\n        return mod(X1 * Y2) === mod(Y1 * X2);\n    }\n    add(other) {\n        assertDcfPoint(other);\n        return new DcfPoint(this.ep.add(other.ep));\n    }\n    subtract(other) {\n        assertDcfPoint(other);\n        return new DcfPoint(this.ep.subtract(other.ep));\n    }\n    multiply(scalar) {\n        return new DcfPoint(this.ep.multiply(scalar));\n    }\n    multiplyUnsafe(scalar) {\n        return new DcfPoint(this.ep.multiplyUnsafe(scalar));\n    }\n    double() {\n        return new DcfPoint(this.ep.double());\n    }\n    negate() {\n        return new DcfPoint(this.ep.negate());\n    }\n}\nexport const DecafPoint = /* @__PURE__ */ (() => {\n    // decaf448 base point is ed448 base x 2\n    // https://github.com/dalek-cryptography/curve25519-dalek/blob/59837c6ecff02b77b9d5ff84dbc239d0cf33ef90/vendor/ristretto.sage#L699\n    if (!DcfPoint.BASE)\n        DcfPoint.BASE = new DcfPoint(ed448.ExtendedPoint.BASE).multiply(_2n);\n    if (!DcfPoint.ZERO)\n        DcfPoint.ZERO = new DcfPoint(ed448.ExtendedPoint.ZERO);\n    return DcfPoint;\n})();\n// Hashing to decaf448. https://www.rfc-editor.org/rfc/rfc9380#appendix-C\nexport const hashToDecaf448 = (msg, options) => {\n    const d = options.DST;\n    const DST = typeof d === 'string' ? utf8ToBytes(d) : d;\n    const uniform_bytes = expand_message_xof(msg, DST, 112, 224, shake256);\n    const P = DcfPoint.hashToCurve(uniform_bytes);\n    return P;\n};\nexport const hash_to_decaf448 = hashToDecaf448; // legacy\n//# sourceMappingURL=ed448.js.map","/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nimport { sha256 } from '@noble/hashes/sha256';\nimport { randomBytes } from '@noble/hashes/utils';\nimport { createCurve } from './_shortw_utils.js';\nimport { createHasher, isogenyMap } from './abstract/hash-to-curve.js';\nimport { Field, mod, pow2 } from './abstract/modular.js';\nimport { inRange, aInRange, bytesToNumberBE, concatBytes, ensureBytes, numberToBytesBE, } from './abstract/utils.js';\nimport { mapToCurveSimpleSWU } from './abstract/weierstrass.js';\nconst secp256k1P = BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f');\nconst secp256k1N = BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141');\nconst _1n = BigInt(1);\nconst _2n = BigInt(2);\nconst divNearest = (a, b) => (a + b / _2n) / b;\n/**\n * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.\n * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]\n */\nfunction sqrtMod(y) {\n    const P = secp256k1P;\n    // prettier-ignore\n    const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);\n    // prettier-ignore\n    const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);\n    const b2 = (y * y * y) % P; // x^3, 11\n    const b3 = (b2 * b2 * y) % P; // x^7\n    const b6 = (pow2(b3, _3n, P) * b3) % P;\n    const b9 = (pow2(b6, _3n, P) * b3) % P;\n    const b11 = (pow2(b9, _2n, P) * b2) % P;\n    const b22 = (pow2(b11, _11n, P) * b11) % P;\n    const b44 = (pow2(b22, _22n, P) * b22) % P;\n    const b88 = (pow2(b44, _44n, P) * b44) % P;\n    const b176 = (pow2(b88, _88n, P) * b88) % P;\n    const b220 = (pow2(b176, _44n, P) * b44) % P;\n    const b223 = (pow2(b220, _3n, P) * b3) % P;\n    const t1 = (pow2(b223, _23n, P) * b22) % P;\n    const t2 = (pow2(t1, _6n, P) * b2) % P;\n    const root = pow2(t2, _2n, P);\n    if (!Fp.eql(Fp.sqr(root), y))\n        throw new Error('Cannot find square root');\n    return root;\n}\nconst Fp = Field(secp256k1P, undefined, undefined, { sqrt: sqrtMod });\n/**\n * secp256k1 short weierstrass curve and ECDSA signatures over it.\n */\nexport const secp256k1 = createCurve({\n    a: BigInt(0), // equation params: a, b\n    b: BigInt(7), // Seem to be rigid: bitcointalk.org/index.php?topic=289795.msg3183975#msg3183975\n    Fp, // Field's prime: 2n**256n - 2n**32n - 2n**9n - 2n**8n - 2n**7n - 2n**6n - 2n**4n - 1n\n    n: secp256k1N, // Curve order, total count of valid points in the field\n    // Base point (x, y) aka generator point\n    Gx: BigInt('55066263022277343669578718895168534326250603453777594175500187360389116729240'),\n    Gy: BigInt('32670510020758816978083085130507043184471273380659243275938904335757337482424'),\n    h: BigInt(1), // Cofactor\n    lowS: true, // Allow only low-S signatures by default in sign() and verify()\n    /**\n     * secp256k1 belongs to Koblitz curves: it has efficiently computable endomorphism.\n     * Endomorphism uses 2x less RAM, speeds up precomputation by 2x and ECDH / key recovery by 20%.\n     * For precomputed wNAF it trades off 1/2 init time & 1/3 ram for 20% perf hit.\n     * Explanation: https://gist.github.com/paulmillr/eb670806793e84df628a7c434a873066\n     */\n    endo: {\n        beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),\n        splitScalar: (k) => {\n            const n = secp256k1N;\n            const a1 = BigInt('0x3086d221a7d46bcde86c90e49284eb15');\n            const b1 = -_1n * BigInt('0xe4437ed6010e88286f547fa90abfe4c3');\n            const a2 = BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8');\n            const b2 = a1;\n            const POW_2_128 = BigInt('0x100000000000000000000000000000000'); // (2n**128n).toString(16)\n            const c1 = divNearest(b2 * k, n);\n            const c2 = divNearest(-b1 * k, n);\n            let k1 = mod(k - c1 * a1 - c2 * a2, n);\n            let k2 = mod(-c1 * b1 - c2 * b2, n);\n            const k1neg = k1 > POW_2_128;\n            const k2neg = k2 > POW_2_128;\n            if (k1neg)\n                k1 = n - k1;\n            if (k2neg)\n                k2 = n - k2;\n            if (k1 > POW_2_128 || k2 > POW_2_128) {\n                throw new Error('splitScalar: Endomorphism failed, k=' + k);\n            }\n            return { k1neg, k1, k2neg, k2 };\n        },\n    },\n}, sha256);\n// Schnorr signatures are superior to ECDSA from above. Below is Schnorr-specific BIP0340 code.\n// https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki\nconst _0n = BigInt(0);\n/** An object mapping tags to their tagged hash prefix of [SHA256(tag) | SHA256(tag)] */\nconst TAGGED_HASH_PREFIXES = {};\nfunction taggedHash(tag, ...messages) {\n    let tagP = TAGGED_HASH_PREFIXES[tag];\n    if (tagP === undefined) {\n        const tagH = sha256(Uint8Array.from(tag, (c) => c.charCodeAt(0)));\n        tagP = concatBytes(tagH, tagH);\n        TAGGED_HASH_PREFIXES[tag] = tagP;\n    }\n    return sha256(concatBytes(tagP, ...messages));\n}\n// ECDSA compact points are 33-byte. Schnorr is 32: we strip first byte 0x02 or 0x03\nconst pointToBytes = (point) => point.toRawBytes(true).slice(1);\nconst numTo32b = (n) => numberToBytesBE(n, 32);\nconst modP = (x) => mod(x, secp256k1P);\nconst modN = (x) => mod(x, secp256k1N);\nconst Point = secp256k1.ProjectivePoint;\nconst GmulAdd = (Q, a, b) => Point.BASE.multiplyAndAddUnsafe(Q, a, b);\n// Calculate point, scalar and bytes\nfunction schnorrGetExtPubKey(priv) {\n    let d_ = secp256k1.utils.normPrivateKeyToScalar(priv); // same method executed in fromPrivateKey\n    let p = Point.fromPrivateKey(d_); // P = d'⋅G; 0 < d' < n check is done inside\n    const scalar = p.hasEvenY() ? d_ : modN(-d_);\n    return { scalar: scalar, bytes: pointToBytes(p) };\n}\n/**\n * lift_x from BIP340. Convert 32-byte x coordinate to elliptic curve point.\n * @returns valid point checked for being on-curve\n */\nfunction lift_x(x) {\n    aInRange('x', x, _1n, secp256k1P); // Fail if x ≥ p.\n    const xx = modP(x * x);\n    const c = modP(xx * x + BigInt(7)); // Let c = x³ + 7 mod p.\n    let y = sqrtMod(c); // Let y = c^(p+1)/4 mod p.\n    if (y % _2n !== _0n)\n        y = modP(-y); // Return the unique point P such that x(P) = x and\n    const p = new Point(x, y, _1n); // y(P) = y if y mod 2 = 0 or y(P) = p-y otherwise.\n    p.assertValidity();\n    return p;\n}\nconst num = bytesToNumberBE;\n/**\n * Create tagged hash, convert it to bigint, reduce modulo-n.\n */\nfunction challenge(...args) {\n    return modN(num(taggedHash('BIP0340/challenge', ...args)));\n}\n/**\n * Schnorr public key is just `x` coordinate of Point as per BIP340.\n */\nfunction schnorrGetPublicKey(privateKey) {\n    return schnorrGetExtPubKey(privateKey).bytes; // d'=int(sk). Fail if d'=0 or d'≥n. Ret bytes(d'⋅G)\n}\n/**\n * Creates Schnorr signature as per BIP340. Verifies itself before returning anything.\n * auxRand is optional and is not the sole source of k generation: bad CSPRNG won't be dangerous.\n */\nfunction schnorrSign(message, privateKey, auxRand = randomBytes(32)) {\n    const m = ensureBytes('message', message);\n    const { bytes: px, scalar: d } = schnorrGetExtPubKey(privateKey); // checks for isWithinCurveOrder\n    const a = ensureBytes('auxRand', auxRand, 32); // Auxiliary random data a: a 32-byte array\n    const t = numTo32b(d ^ num(taggedHash('BIP0340/aux', a))); // Let t be the byte-wise xor of bytes(d) and hash/aux(a)\n    const rand = taggedHash('BIP0340/nonce', t, px, m); // Let rand = hash/nonce(t || bytes(P) || m)\n    const k_ = modN(num(rand)); // Let k' = int(rand) mod n\n    if (k_ === _0n)\n        throw new Error('sign failed: k is zero'); // Fail if k' = 0.\n    const { bytes: rx, scalar: k } = schnorrGetExtPubKey(k_); // Let R = k'⋅G.\n    const e = challenge(rx, px, m); // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.\n    const sig = new Uint8Array(64); // Let sig = bytes(R) || bytes((k + ed) mod n).\n    sig.set(rx, 0);\n    sig.set(numTo32b(modN(k + e * d)), 32);\n    // If Verify(bytes(P), m, sig) (see below) returns failure, abort\n    if (!schnorrVerify(sig, m, px))\n        throw new Error('sign: Invalid signature produced');\n    return sig;\n}\n/**\n * Verifies Schnorr signature.\n * Will swallow errors & return false except for initial type validation of arguments.\n */\nfunction schnorrVerify(signature, message, publicKey) {\n    const sig = ensureBytes('signature', signature, 64);\n    const m = ensureBytes('message', message);\n    const pub = ensureBytes('publicKey', publicKey, 32);\n    try {\n        const P = lift_x(num(pub)); // P = lift_x(int(pk)); fail if that fails\n        const r = num(sig.subarray(0, 32)); // Let r = int(sig[0:32]); fail if r ≥ p.\n        if (!inRange(r, _1n, secp256k1P))\n            return false;\n        const s = num(sig.subarray(32, 64)); // Let s = int(sig[32:64]); fail if s ≥ n.\n        if (!inRange(s, _1n, secp256k1N))\n            return false;\n        const e = challenge(numTo32b(r), pointToBytes(P), m); // int(challenge(bytes(r)||bytes(P)||m))%n\n        const R = GmulAdd(P, s, modN(-e)); // R = s⋅G - e⋅P\n        if (!R || !R.hasEvenY() || R.toAffine().x !== r)\n            return false; // -eP == (n-e)P\n        return true; // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.\n    }\n    catch (error) {\n        return false;\n    }\n}\n/**\n * Schnorr signatures over secp256k1.\n */\nexport const schnorr = /* @__PURE__ */ (() => ({\n    getPublicKey: schnorrGetPublicKey,\n    sign: schnorrSign,\n    verify: schnorrVerify,\n    utils: {\n        randomPrivateKey: secp256k1.utils.randomPrivateKey,\n        lift_x,\n        pointToBytes,\n        numberToBytesBE,\n        bytesToNumberBE,\n        taggedHash,\n        mod,\n    },\n}))();\nconst isoMap = /* @__PURE__ */ (() => isogenyMap(Fp, [\n    // xNum\n    [\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7',\n        '0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581',\n        '0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262',\n        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c',\n    ],\n    // xDen\n    [\n        '0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b',\n        '0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n    // yNum\n    [\n        '0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c',\n        '0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3',\n        '0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931',\n        '0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84',\n    ],\n    // yDen\n    [\n        '0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b',\n        '0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573',\n        '0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f',\n        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1\n    ],\n].map((i) => i.map((j) => BigInt(j)))))();\nconst mapSWU = /* @__PURE__ */ (() => mapToCurveSimpleSWU(Fp, {\n    A: BigInt('0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533'),\n    B: BigInt('1771'),\n    Z: Fp.create(BigInt('-11')),\n}))();\nconst htf = /* @__PURE__ */ (() => createHasher(secp256k1.ProjectivePoint, (scalars) => {\n    const { x, y } = mapSWU(Fp.create(scalars[0]));\n    return isoMap(x, y);\n}, {\n    DST: 'secp256k1_XMD:SHA-256_SSWU_RO_',\n    encodeDST: 'secp256k1_XMD:SHA-256_SSWU_NU_',\n    p: Fp.ORDER,\n    m: 1,\n    k: 128,\n    expand: 'xmd',\n    hash: sha256,\n}))();\nexport const hashToCurve = /* @__PURE__ */ (() => htf.hashToCurve)();\nexport const encodeToCurve = /* @__PURE__ */ (() => htf.encodeToCurve)();\n//# sourceMappingURL=secp256k1.js.map","import { createCurve } from '@noble/curves/_shortw_utils';\nimport { sha256 } from '@noble/hashes/sha256';\nimport { Field } from '@noble/curves/abstract/modular';\n\n// brainpoolP256r1: https://datatracker.ietf.org/doc/html/rfc5639#section-3.4\n\n// eslint-disable-next-line new-cap\nconst Fp = Field(BigInt('0xa9fb57dba1eea9bc3e660a909d838d726e3bf623d52620282013481d1f6e5377'));\nconst CURVE_A = Fp.create(BigInt('0x7d5a0975fc2c3057eef67530417affe7fb8055c126dc5c6ce94a4b44f330b5d9'));\nconst CURVE_B = BigInt('0x26dc5c6ce94a4b44f330b5d9bbd77cbf958416295cf7e1ce6bccdc18ff8c07b6');\n\n// prettier-ignore\nexport const brainpoolP256r1 = createCurve({\n  a: CURVE_A, // Equation params: a, b\n  b: CURVE_B,\n  Fp,\n  // Curve order (q), total count of valid points in the field\n  n: BigInt('0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974856a7'),\n  // Base (generator) point (x, y)\n  Gx: BigInt('0x8bd2aeb9cb7e57cb2c4b482ffc81b7afb9de27e1e3bd23c23a4453bd9ace3262'),\n  Gy: BigInt('0x547ef835c3dac4fd97f8461a14611dc9c27745132ded8e545c1d54c72f046997'),\n  h: BigInt(1),\n  lowS: false\n} as const, sha256);\n","import { createCurve } from '@noble/curves/_shortw_utils';\nimport { sha384 } from '@noble/hashes/sha512';\nimport { Field } from '@noble/curves/abstract/modular';\n\n// brainpoolP384 r1: https://datatracker.ietf.org/doc/html/rfc5639#section-3.6\n\n// eslint-disable-next-line new-cap\nconst Fp = Field(BigInt('0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b412b1da197fb71123acd3a729901d1a71874700133107ec53'));\nconst CURVE_A = Fp.create(BigInt('0x7bc382c63d8c150c3c72080ace05afa0c2bea28e4fb22787139165efba91f90f8aa5814a503ad4eb04a8c7dd22ce2826'));\nconst CURVE_B = BigInt('0x04a8c7dd22ce28268b39b55416f0447c2fb77de107dcd2a62e880ea53eeb62d57cb4390295dbc9943ab78696fa504c11');\n\n// prettier-ignore\nexport const brainpoolP384r1 = createCurve({\n  a: CURVE_A, // Equation params: a, b\n  b: CURVE_B,\n  Fp,\n  // Curve order (q), total count of valid points in the field\n  n: BigInt('0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e9046565'),\n  // Base (generator) point (x, y)\n  Gx: BigInt('0x1d1c64f068cf45ffa2a63a81b7c13f6b8847a3e77ef14fe3db7fcafe0cbd10e8e826e03436d646aaef87b2e247d4af1e'),\n  Gy: BigInt('0x8abe1d7520f9c2a45cb1eb8e95cfd55262b70b29feec5864e19c054ff99129280e4646217791811142820341263c5315'),\n  h: BigInt(1),\n  lowS: false\n} as const, sha384);\n","import { createCurve } from '@noble/curves/_shortw_utils';\nimport { sha512 } from '@noble/hashes/sha512';\nimport { Field } from '@noble/curves/abstract/modular';\n\n// brainpoolP512r1: https://datatracker.ietf.org/doc/html/rfc5639#section-3.7\n\n// eslint-disable-next-line new-cap\nconst Fp = Field(BigInt('0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca703308717d4d9b009bc66842aecda12ae6a380e62881ff2f2d82c68528aa6056583a48f3'));\nconst CURVE_A = Fp.create(BigInt('0x7830a3318b603b89e2327145ac234cc594cbdd8d3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94ca'));\nconst CURVE_B = BigInt('0x3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94cadc083e67984050b75ebae5dd2809bd638016f723');\n\n// prettier-ignore\nexport const brainpoolP512r1 = createCurve({\n  a: CURVE_A, // Equation params: a, b\n  b: CURVE_B,\n  Fp,\n  // Curve order (q), total count of valid points in the field\n  n: BigInt('0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90069'),\n  // Base (generator) point (x, y)\n  Gx: BigInt('0x81aee4bdd82ed9645a21322e9c4c6a9385ed9f70b5d916c1b43b62eef4d0098eff3b1f78e2d0d48d50d1687b93b97d5f7c6d5047406a5e688b352209bcb9f822'),\n  Gy: BigInt('0x7dde385d566332ecc0eabfa9cf7822fdf209f70024a57b1aa000c55b881f8111b2dcde494a5f485e5bca4bd88a2763aed1ca2b2fa8f0540678cd1e0f3ad80892'),\n  h: BigInt(1),\n  lowS: false\n} as const, sha512);\n","/**\n * This file is needed to dynamic import the noble-curves.\n * Separate dynamic imports are not convenient as they result in too many chunks,\n * which share a lot of code anyway.\n */\n\nimport { p256 as nistP256 } from '@noble/curves/p256';\nimport { p384 as nistP384 } from '@noble/curves/p384';\nimport { p521 as nistP521 } from '@noble/curves/p521';\nimport { x448, ed448 } from '@noble/curves/ed448';\nimport { secp256k1 } from '@noble/curves/secp256k1';\nimport { brainpoolP256r1 } from './brainpool/brainpoolP256r1';\nimport { brainpoolP384r1 } from './brainpool/brainpoolP384r1';\nimport { brainpoolP512r1 } from './brainpool/brainpoolP512r1';\n\nexport const nobleCurves = new Map(Object.entries({\n  nistP256,\n  nistP384,\n  nistP521,\n  brainpoolP256r1,\n  brainpoolP384r1,\n  brainpoolP512r1,\n  secp256k1,\n  x448,\n  ed448\n}));\n\n"],"names":["HMAC","Hash","constructor","hash","_key","super","this","finished","destroyed","assertHash","key","toBytes","iHash","create","update","Error","blockLen","outputLen","pad","Uint8Array","set","length","digest","i","oHash","fill","buf","assertExists","digestInto","out","assertBytes","destroy","_cloneInto","to","Object","getPrototypeOf","hmac","message","_0n","BigInt","_1n","_2n","isBytes","a","name","abytes","item","abool","title","value","hexes","Array","from","_","toString","padStart","bytesToHex","bytes","hex","numberToHexUnpadded","num","hexToNumber","asciis","_0","_9","_A","_F","_a","_f","asciiToBase16","char","hexToBytes","hl","al","array","ai","hi","n1","charCodeAt","n2","undefined","bytesToNumberBE","bytesToNumberLE","reverse","numberToBytesBE","n","len","numberToBytesLE","ensureBytes","expectedLength","res","e","concatBytes","arrays","sum","isPosBig","inRange","min","max","aInRange","bitLen","bitMask","u8n","data","u8fr","arr","createHmacDrbg","hashLen","qByteLen","hmacFn","v","k","reset","h","b","reseed","seed","gen","sl","slice","push","pred","validatorFns","bigint","val","function","boolean","string","stringOrUint8Array","isSafeInteger","Number","isArray","field","object","Fp","isValid","validateObject","validators","optValidators","checkField","fieldName","type","isOptional","checkVal","String","entries","memoized","fn","map","WeakMap","arg","args","get","computed","pos","diff","str","TextEncoder","encode","_3n","_4n","_5n","_8n","mod","result","pow","power","modulo","pow2","x","invert","number","u","r","m","FpSqrt","P","p1div4","root","eql","sqr","c1","mul","nv","sub","ONE","legendreC","Q","S","Z","Q1div2","neg","g","ZERO","t2","ge","tonelliShanks","FIELD_FIELDS","nLength","nBitLength","_nBitLength","nByteLength","Math","ceil","Field","ORDER","isLE","redef","BITS","BYTES","sqrtP","f","freeze","MASK","is0","isOdd","lhs","rhs","add","p","d","FpPow","div","sqrN","addN","subN","mulN","inv","sqrt","invertBatch","lst","nums","tmp","lastMultiplied","reduce","acc","inverted","reduceRight","FpInvertBatch","cmov","c","fromBytes","getFieldBytesLength","fieldOrder","bitLength","getMinHashLength","pointPrecomputes","pointWindowSizes","wNAF","bits","constTimeNegate","condition","negate","validateW","W","opts","windows","windowSize","unsafeLadder","elm","double","precomputeWindow","points","base","window","precomputes","BASE","mask","maxNumber","shiftBy","offset","wbits","offset1","offset2","abs","cond1","cond2","wNAFCached","transform","comp","setWindowSize","delete","pippenger","scalars","forEach","s","buckets","lastBits","floor","j","scalar","resI","sumI","validateBasic","curve","Gx","Gy","validateSigVerOpts","lowS","prehash","b2n","h2b","ut","DER","Err","_tlv","tag","E","dataLen","ut.numberToHexUnpadded","lenLen","decode","first","lengthBytes","subarray","l","_int","parseInt","toSig","int","tlv","ut.abytes","seqBytes","seqLeftBytes","rBytes","rLeftBytes","sBytes","sLeftBytes","hexFromSig","sig","seq","weierstrassPoints","CURVE","ut.validateObject","allowedPrivateKeyLengths","wrapPrivateKey","isTorsionFree","clearCofactor","allowInfinityPoint","endo","beta","splitScalar","validatePointOpts","Fn","mod.Field","_c","point","_isCompressed","toAffine","ut.concatBytes","y","tail","weierstrassEquation","x2","x3","normPrivateKeyToScalar","lengths","N","ut.isBytes","ut.bytesToHex","includes","ut.bytesToNumberBE","error","mod.mod","ut.aInRange","assertPrjPoint","other","Point","toAffineMemo","iz","px","py","pz","z","ax","ay","zz","assertValidMemo","left","right","fromAffine","normalizeZ","toInv","fromHex","assertValidity","fromPrivateKey","privateKey","multiply","msm","_setWindowSize","wnaf","hasEvenY","equals","X1","Y1","Z1","X2","Y2","Z2","U1","U2","b3","X3","Y3","Z3","t0","t1","t3","t4","t5","subtract","multiplyUnsafe","sc","I","k1neg","k1","k2neg","k2","k1p","k2p","fake","f1p","f2p","multiplyAndAddUnsafe","G","cofactor","toRawBytes","isCompressed","toHex","_bits","ProjectivePoint","isWithinCurveOrder","ut.inRange","weierstrass","curveDef","randomBytes","bits2int","bits2int_modN","validateOpts","CURVE_ORDER","compressedLen","uncompressedLen","modN","invN","mod.invert","cat","head","y2","sqrtError","suffix","numToNByteStr","ut.numberToBytesBE","isBiggerThanHalfOrder","slcNum","Signature","recovery","fromCompact","fromDER","addRecoveryBit","recoverPublicKey","msgHash","rec","radj","prefix","R","ir","u1","u2","hasHighS","normalizeS","toDERRawBytes","ut.hexToBytes","toDERHex","toCompactRawBytes","toCompactHex","utils","isValidPrivateKey","randomPrivateKey","mod.getMinHashLength","fieldLen","minLen","reduced","mod.mapHashToField","precompute","isProbPub","delta","ORDER_MASK","ut.bitMask","int2octets","prepSig","defaultSigOpts","some","extraEntropy","ent","h1int","seedArgs","k2sig","kBytes","ik","q","normS","defaultVerOpts","getPublicKey","getSharedSecret","privateA","publicB","sign","privKey","C","ut.createHmacDrbg","drbg","verify","signature","publicKey","sg","_sig","derError","is","getHash","msgs","createCurve","defHash","p256","sha256","p384","sha384","p521","sha512","VERIFY_DEFAULT","zip215","twistedEdwards","adjustScalarBytes","domain","uvRatio","mapToCurve","cHash","modP","ctx","phflag","aCoordinate","assertPoint","ex","ey","ez","X","Y","et","T","Z4","aX2","X1Z2","X2Z1","Y1Z2","Y2Z1","A","B","D","x1y1","F","H","T3","T1","T2","isSmallOrder","normed","lastByte","ut.bytesToNumberLE","isXOdd","isLastByteOdd","getExtendedPublicKey","ut.numberToBytesLE","modN_LE","hashed","pointBytes","hashDomainToScalar","context","msg","verifyOpts","options","SB","ExtendedPoint","montgomery","montgomeryBits","powPminus2","Gu","montgomeryBytes","cswap","swap","x_2","x_3","dummy","a24","encodeUCoordinate","scalarMult","pointU","uEnc","decodeUCoordinate","_scalar","decodeScalar","pu","x_1","sw","z_2","z_3","t","k_t","AA","BB","DA","CB","dacb","da_cb","z2","montgomeryLadder","GuBytes","scalarMultBase","shake256_114","wrapConstructor","shake256","dkLen","ed448P","_11n","_22n","_44n","_88n","_223n","ed448_pow_Pminus3div4","b2","b6","b9","b11","b22","b44","b88","b176","b220","b222","b223","ED448_DEF","utf8ToBytes","u2v","u3v","u5v3","ed448","x448","secp256k1P","secp256k1N","divNearest","_6n","_23n","secp256k1","a1","b1","a2","POW_2_128","c2","brainpoolP256r1","brainpoolP384r1","brainpoolP512r1","nobleCurves","Map","nistP256","nistP384","nistP521"],"mappings":";2MAGO,MAAMA,UAAaC,EACtB,WAAAC,CAAYC,EAAMC,GACdC,QACAC,KAAKC,UAAW,EAChBD,KAAKE,WAAY,EACjBC,EAAWN,GACX,MAAMO,EAAMC,EAAQP,GAEpB,GADAE,KAAKM,MAAQT,EAAKU,SACe,mBAAtBP,KAAKM,MAAME,OAClB,MAAUC,MAAM,uDACpBT,KAAKU,SAAWV,KAAKM,MAAMI,SAC3BV,KAAKW,UAAYX,KAAKM,MAAMK,UAC5B,MAAMD,EAAWV,KAAKU,SAChBE,EAAM,IAAIC,WAAWH,GAE3BE,EAAIE,IAAIV,EAAIW,OAASL,EAAWb,EAAKU,SAASC,OAAOJ,GAAKY,SAAWZ,GACrE,IAAK,IAAIa,EAAI,EAAGA,EAAIL,EAAIG,OAAQE,IAC5BL,EAAIK,IAAM,GACdjB,KAAKM,MAAME,OAAOI,GAElBZ,KAAKkB,MAAQrB,EAAKU,SAElB,IAAK,IAAIU,EAAI,EAAGA,EAAIL,EAAIG,OAAQE,IAC5BL,EAAIK,IAAM,IACdjB,KAAKkB,MAAMV,OAAOI,GAClBA,EAAIO,KAAK,EACjB,CACI,MAAAX,CAAOY,GAGH,OAFAC,EAAarB,MACbA,KAAKM,MAAME,OAAOY,GACXpB,IACf,CACI,UAAAsB,CAAWC,GACPF,EAAarB,MACbwB,EAAYD,EAAKvB,KAAKW,WACtBX,KAAKC,UAAW,EAChBD,KAAKM,MAAMgB,WAAWC,GACtBvB,KAAKkB,MAAMV,OAAOe,GAClBvB,KAAKkB,MAAMI,WAAWC,GACtBvB,KAAKyB,SACb,CACI,MAAAT,GACI,MAAMO,EAAM,IAAIV,WAAWb,KAAKkB,MAAMP,WAEtC,OADAX,KAAKsB,WAAWC,GACTA,CACf,CACI,UAAAG,CAAWC,GAEPA,IAAOA,EAAKC,OAAOrB,OAAOqB,OAAOC,eAAe7B,MAAO,CAAA,IACvD,MAAMkB,MAAEA,EAAKZ,MAAEA,EAAKL,SAAEA,EAAQC,UAAEA,EAASQ,SAAEA,EAAQC,UAAEA,GAAcX,KAQnE,OANA2B,EAAG1B,SAAWA,EACd0B,EAAGzB,UAAYA,EACfyB,EAAGjB,SAAWA,EACdiB,EAAGhB,UAAYA,EACfgB,EAAGT,MAAQA,EAAMQ,WAAWC,EAAGT,OAC/BS,EAAGrB,MAAQA,EAAMoB,WAAWC,EAAGrB,OACxBqB,CACf,CACI,OAAAF,GACIzB,KAAKE,WAAY,EACjBF,KAAKkB,MAAMO,UACXzB,KAAKM,MAAMmB,SACnB,EAYO,MAAMK,EAAO,CAACjC,EAAMO,EAAK2B,IAAY,IAAIrC,EAAKG,EAAMO,GAAKI,OAAOuB,GAASf,SAChFc,EAAKvB,OAAS,CAACV,EAAMO,IAAQ,IAAIV,EAAKG,EAAMO;uEC1E5C,MAAM4B,iBAAsBC,OAAO,GAC7BC,iBAAsBD,OAAO,GAC7BE,iBAAsBF,OAAO,GAC5B,SAASG,EAAQC,GACpB,OAAQA,aAAaxB,YACX,MAALwB,GAA0B,iBAANA,GAAyC,eAAvBA,EAAEzC,YAAY0C,IAC7D,CACO,SAASC,EAAOC,GACnB,IAAKJ,EAAQI,GACT,MAAU/B,MAAM,sBACxB,CACO,SAASgC,EAAMC,EAAOC,GACzB,GAAqB,kBAAVA,EACP,MAAUlC,MAAM,GAAGiC,iCAAqCC,MAChE,CAEA,MAAMC,iBAAwBC,MAAMC,KAAK,CAAE/B,OAAQ,MAAO,CAACgC,EAAG9B,IAAMA,EAAE+B,SAAS,IAAIC,SAAS,EAAG,OAIxF,SAASC,EAAWC,GACvBZ,EAAOY,GAEP,IAAIC,EAAM,GACV,IAAK,IAAInC,EAAI,EAAGA,EAAIkC,EAAMpC,OAAQE,IAC9BmC,GAAOR,EAAMO,EAAMlC,IAEvB,OAAOmC,CACX,CACO,SAASC,EAAoBC,GAChC,MAAMF,EAAME,EAAIN,SAAS,IACzB,OAAoB,EAAbI,EAAIrC,OAAa,IAAIqC,EAAQA,CACxC,CACO,SAASG,EAAYH,GACxB,GAAmB,iBAARA,EACP,MAAU3C,MAAM,mCAAqC2C,GAEzD,OAAOnB,OAAe,KAARmB,EAAa,IAAM,KAAKA,EAC1C,CAEA,MAAMI,EAAS,CAAEC,GAAI,GAAIC,GAAI,GAAIC,GAAI,GAAIC,GAAI,GAAIC,GAAI,GAAIC,GAAI,KAC7D,SAASC,EAAcC,GACnB,OAAIA,GAAQR,EAAOC,IAAMO,GAAQR,EAAOE,GAC7BM,EAAOR,EAAOC,GACrBO,GAAQR,EAAOG,IAAMK,GAAQR,EAAOI,GAC7BI,GAAQR,EAAOG,GAAK,IAC3BK,GAAQR,EAAOK,IAAMG,GAAQR,EAAOM,GAC7BE,GAAQR,EAAOK,GAAK,SAD/B,CAGJ,CAIO,SAASI,EAAWb,GACvB,GAAmB,iBAARA,EACP,MAAU3C,MAAM,mCAAqC2C,GACzD,MAAMc,EAAKd,EAAIrC,OACToD,EAAKD,EAAK,EAChB,GAAIA,EAAK,EACL,MAAUzD,MAAM,0DAA4DyD,GAChF,MAAME,EAAQ,IAAIvD,WAAWsD,GAC7B,IAAK,IAAIE,EAAK,EAAGC,EAAK,EAAGD,EAAKF,EAAIE,IAAMC,GAAM,EAAG,CAC7C,MAAMC,EAAKR,EAAcX,EAAIoB,WAAWF,IAClCG,EAAKV,EAAcX,EAAIoB,WAAWF,EAAK,IAC7C,QAAWI,IAAPH,QAA2BG,IAAPD,EAAkB,CACtC,MAAMT,EAAOZ,EAAIkB,GAAMlB,EAAIkB,EAAK,GAChC,MAAU7D,MAAM,+CAAiDuD,EAAO,cAAgBM,EACpG,CACQF,EAAMC,GAAW,GAALE,EAAUE,CAC9B,CACI,OAAOL,CACX,CAEO,SAASO,EAAgBxB,GAC5B,OAAOI,EAAYL,EAAWC,GAClC,CACO,SAASyB,EAAgBzB,GAE5B,OADAZ,EAAOY,GACAI,EAAYL,EAAWrC,WAAWiC,KAAKK,GAAO0B,WACzD,CACO,SAASC,EAAgBC,EAAGC,GAC/B,OAAOf,EAAWc,EAAE/B,SAAS,IAAIC,SAAe,EAAN+B,EAAS,KACvD,CACO,SAASC,EAAgBF,EAAGC,GAC/B,OAAOF,EAAgBC,EAAGC,GAAKH,SACnC,CAcO,SAASK,EAAYxC,EAAOU,EAAK+B,GACpC,IAAIC,EACJ,GAAmB,iBAARhC,EACP,IACIgC,EAAMnB,EAAWb,EAC7B,CACQ,MAAOiC,GACH,MAAU5E,MAAM,GAAGiC,oCAAwCU,cAAgBiC,IACvF,KAES,KAAIjD,EAAQgB,GAMb,MAAU3C,MAASiC,EAAH,qCAHhB0C,EAAMvE,WAAWiC,KAAKM,EAI9B,CACI,MAAM4B,EAAMI,EAAIrE,OAChB,GAA8B,iBAAnBoE,GAA+BH,IAAQG,EAC9C,MAAU1E,MAAM,GAAGiC,cAAkByC,gBAA6BH,KACtE,OAAOI,CACX,CAIO,SAASE,KAAeC,GAC3B,IAAIC,EAAM,EACV,IAAK,IAAIvE,EAAI,EAAGA,EAAIsE,EAAOxE,OAAQE,IAAK,CACpC,MAAMoB,EAAIkD,EAAOtE,GACjBsB,EAAOF,GACPmD,GAAOnD,EAAEtB,MACjB,CACI,MAAMqE,EAAM,IAAIvE,WAAW2E,GAC3B,IAAK,IAAIvE,EAAI,EAAGL,EAAM,EAAGK,EAAIsE,EAAOxE,OAAQE,IAAK,CAC7C,MAAMoB,EAAIkD,EAAOtE,GACjBmE,EAAItE,IAAIuB,EAAGzB,GACXA,GAAOyB,EAAEtB,MACjB,CACI,OAAOqE,CACX,CAmBA,MAAMK,EAAYV,GAAmB,iBAANA,GAAkB/C,GAAO+C,EACjD,SAASW,EAAQX,EAAGY,EAAKC,GAC5B,OAAOH,EAASV,IAAMU,EAASE,IAAQF,EAASG,IAAQD,GAAOZ,GAAKA,EAAIa,CAC5E,CAMO,SAASC,EAASnD,EAAOqC,EAAGY,EAAKC,GAMpC,IAAKF,EAAQX,EAAGY,EAAKC,GACjB,MAAUnF,MAAM,kBAAkBiC,MAAUiD,YAAcC,iBAAmBb,KAAKA,IAC1F,CAMO,SAASe,EAAOf,GACnB,IAAIC,EACJ,IAAKA,EAAM,EAAGD,EAAI/C,EAAK+C,IAAM7C,EAAK8C,GAAO,GAEzC,OAAOA,CACX,CAmBO,MAAMe,EAAWhB,IAAO5C,GAAOF,OAAO8C,EAAI,IAAM7C,EAEjD8D,EAAOC,GAAS,IAAIpF,WAAWoF,GAC/BC,EAAQC,GAAQtF,WAAWiC,KAAKqD,GAQ/B,SAASC,EAAeC,EAASC,EAAUC,GAC9C,GAAuB,iBAAZF,GAAwBA,EAAU,EACzC,MAAU5F,MAAM,4BACpB,GAAwB,iBAAb6F,GAAyBA,EAAW,EAC3C,MAAU7F,MAAM,6BACpB,GAAsB,mBAAX8F,EACP,MAAU9F,MAAM,6BAEpB,IAAI+F,EAAIR,EAAIK,GACRI,EAAIT,EAAIK,GACRpF,EAAI,EACR,MAAMyF,EAAQ,KACVF,EAAErF,KAAK,GACPsF,EAAEtF,KAAK,GACPF,EAAI,CAAC,EAEH0F,EAAI,IAAIC,IAAML,EAAOE,EAAGD,KAAMI,GAC9BC,EAAS,CAACC,EAAOd,OAEnBS,EAAIE,EAAET,EAAK,CAAC,IAAQY,GACpBN,EAAIG,IACgB,IAAhBG,EAAK/F,SAET0F,EAAIE,EAAET,EAAK,CAAC,IAAQY,GACpBN,EAAIG,IAAG,EAELI,EAAM,KAER,GAAI9F,KAAO,IACP,MAAUR,MAAM,2BACpB,IAAIuE,EAAM,EACV,MAAMzD,EAAM,GACZ,KAAOyD,EAAMsB,GAAU,CACnBE,EAAIG,IACJ,MAAMK,EAAKR,EAAES,QACb1F,EAAI2F,KAAKF,GACThC,GAAOwB,EAAEzF,MACrB,CACQ,OAAOuE,KAAe/D,EAAI,EAW9B,MATiB,CAACuF,EAAMK,KAGpB,IAAI/B,EACJ,IAHAsB,IACAG,EAAOC,KAEE1B,EAAM+B,EAAKJ,OAChBF,IAEJ,OADAH,IACOtB,CAAG,CAGlB,CAEA,MAAMgC,EAAe,CACjBC,OAASC,GAAuB,iBAARA,EACxBC,SAAWD,GAAuB,mBAARA,EAC1BE,QAAUF,GAAuB,kBAARA,EACzBG,OAASH,GAAuB,iBAARA,EACxBI,mBAAqBJ,GAAuB,iBAARA,GAAoBlF,EAAQkF,GAChEK,cAAgBL,GAAQM,OAAOD,cAAcL,GAC7ClD,MAAQkD,GAAQzE,MAAMgF,QAAQP,GAC9BQ,MAAO,CAACR,EAAKS,IAAWA,EAAOC,GAAGC,QAAQX,GAC1CzH,KAAOyH,GAAuB,mBAARA,GAAsBM,OAAOD,cAAcL,EAAI3G,YAGlE,SAASuH,EAAeH,EAAQI,EAAYC,EAAgB,CAAA,GAC/D,MAAMC,EAAa,CAACC,EAAWC,EAAMC,KACjC,MAAMC,EAAWrB,EAAamB,GAC9B,GAAwB,mBAAbE,EACP,MAAUhI,MAAM,sBAAsB8H,yBAC1C,MAAMjB,EAAMS,EAAOO,GACnB,KAAIE,QAAsB9D,IAAR4C,GAEbmB,EAASnB,EAAKS,IACf,MAAUtH,MAAM,iBAAwB6H,EAAPI,MAAqBpB,aAAeA,gBAAkBiB,IACnG,EAEI,IAAK,MAAOD,EAAWC,KAAS3G,OAAO+G,QAAQR,GAC3CE,EAAWC,EAAWC,GAAM,GAChC,IAAK,MAAOD,EAAWC,KAAS3G,OAAO+G,QAAQP,GAC3CC,EAAWC,EAAWC,GAAM,GAChC,OAAOR,CACX,CAmBO,SAASa,EAASC,GACrB,MAAMC,EAAM,IAAIC,QAChB,MAAO,CAACC,KAAQC,KACZ,MAAM3B,EAAMwB,EAAII,IAAIF,GACpB,QAAYtE,IAAR4C,EACA,OAAOA,EACX,MAAM6B,EAAWN,EAAGG,KAAQC,GAE5B,OADAH,EAAIhI,IAAIkI,EAAKG,GACNA,CAAQ,CAEvB,qFAtIO,SAAgBpE,EAAGqE,GACtB,OAAQrE,GAAK9C,OAAOmH,GAAQlH,CAChC,4BAIO,SAAgB6C,EAAGqE,EAAKzG,GAC3B,OAAOoC,GAAMpC,EAAQT,EAAMF,IAAQC,OAAOmH,EAC9C,2GA3DO,SAAoB/G,EAAGuE,GAC1B,GAAIvE,EAAEtB,SAAW6F,EAAE7F,OACf,OAAO,EACX,IAAIsI,EAAO,EACX,IAAK,IAAIpI,EAAI,EAAGA,EAAIoB,EAAEtB,OAAQE,IAC1BoI,GAAQhH,EAAEpB,GAAK2F,EAAE3F,GACrB,OAAgB,IAAToI,CACX,2EAiK8B,KAC1B,MAAU5I,MAAM,kBAAkB,+EA/N/B,SAA4BsE,GAC/B,OAAOd,EAAWZ,EAAoB0B,GAC1C,cA+DO,SAAqBuE,GACxB,GAAmB,iBAARA,EACP,MAAU7I,MAAM,2CAA2C6I,GAC/D,OAAO,IAAIzI,YAAW,IAAI0I,aAAcC,OAAOF,GACnD;sEC7JA,MAAMtH,EAAMC,OAAO,GAAIC,EAAMD,OAAO,GAAIE,EAAMF,OAAO,GAAIwH,EAAMxH,OAAO,GAEhEyH,EAAMzH,OAAO,GAAI0H,EAAM1H,OAAO,GAAI2H,EAAM3H,OAAO,GAI9C,SAAS4H,EAAIxH,EAAGuE,GACnB,MAAMkD,EAASzH,EAAIuE,EACnB,OAAOkD,GAAU9H,EAAM8H,EAASlD,EAAIkD,CACxC,CAQO,SAASC,GAAIzG,EAAK0G,EAAOC,GAC5B,GAAIA,GAAUjI,GAAOgI,EAAQhI,EACzB,MAAUvB,MAAM,6BACpB,GAAIwJ,IAAW/H,EACX,OAAOF,EACX,IAAIoD,EAAMlD,EACV,KAAO8H,EAAQhI,GACPgI,EAAQ9H,IACRkD,EAAOA,EAAM9B,EAAO2G,GACxB3G,EAAOA,EAAMA,EAAO2G,EACpBD,IAAU9H,EAEd,OAAOkD,CACX,CAEO,SAAS8E,GAAKC,EAAGH,EAAOC,GAC3B,IAAI7E,EAAM+E,EACV,KAAOH,KAAUhI,GACboD,GAAOA,EACPA,GAAO6E,EAEX,OAAO7E,CACX,CAEO,SAASgF,GAAOC,EAAQJ,GAC3B,GAAII,IAAWrI,GAAOiI,GAAUjI,EAC5B,MAAUvB,MAAM,6CAA6C4J,SAAcJ,KAI/E,IAAI5H,EAAIwH,EAAIQ,EAAQJ,GAChBrD,EAAIqD,EAEJE,EAAInI,EAAcsI,EAAIpI,EAC1B,KAAOG,IAAML,GAAK,CAEd,MACMuI,EAAI3D,EAAIvE,EACRmI,EAAIL,EAAIG,GAFJ1D,EAAIvE,GAKduE,EAAIvE,EAAGA,EAAIkI,EAAGJ,EAAIG,EAAUA,EAAIE,CACxC,CAEI,GADY5D,IACA1E,EACR,MAAUzB,MAAM,0BACpB,OAAOoJ,EAAIM,EAAGF,EAClB,CAiEO,SAASQ,GAAOC,GAKnB,GAAIA,EAAIhB,IAAQD,EAAK,CAKjB,MAAMkB,GAAUD,EAAIxI,GAAOwH,EAC3B,OAAO,SAAmB1B,EAAIjD,GAC1B,MAAM6F,EAAO5C,EAAG+B,IAAIhF,EAAG4F,GAEvB,IAAK3C,EAAG6C,IAAI7C,EAAG8C,IAAIF,GAAO7F,GACtB,MAAUtE,MAAM,2BACpB,OAAOmK,CACV,CACT,CAEI,GAAIF,EAAId,IAAQD,EAAK,CACjB,MAAMoB,GAAML,EAAIf,GAAOC,EACvB,OAAO,SAAmB5B,EAAIjD,GAC1B,MAAMN,EAAKuD,EAAGgD,IAAIjG,EAAG5C,GACfqE,EAAIwB,EAAG+B,IAAItF,EAAIsG,GACfE,EAAKjD,EAAGgD,IAAIjG,EAAGyB,GACfvF,EAAI+G,EAAGgD,IAAIhD,EAAGgD,IAAIC,EAAI9I,GAAMqE,GAC5BoE,EAAO5C,EAAGgD,IAAIC,EAAIjD,EAAGkD,IAAIjK,EAAG+G,EAAGmD,MACrC,IAAKnD,EAAG6C,IAAI7C,EAAG8C,IAAIF,GAAO7F,GACtB,MAAUtE,MAAM,2BACpB,OAAOmK,CACV,CACT,CAwBI,OAhHG,SAAuBF,GAM1B,MAAMU,GAAaV,EAAIxI,GAAOC,EAC9B,IAAIkJ,EAAGC,EAAGC,EAGV,IAAKF,EAAIX,EAAIxI,EAAKoJ,EAAI,EAAGD,EAAIlJ,IAAQH,EAAKqJ,GAAKlJ,EAAKmJ,KAGpD,IAAKC,EAAIpJ,EAAKoJ,EAAIb,GAAKX,GAAIwB,EAAGH,EAAWV,KAAOA,EAAIxI,EAAKqJ,KAGzD,GAAU,IAAND,EAAS,CACT,MAAMX,GAAUD,EAAIxI,GAAOwH,EAC3B,OAAO,SAAqB1B,EAAIjD,GAC5B,MAAM6F,EAAO5C,EAAG+B,IAAIhF,EAAG4F,GACvB,IAAK3C,EAAG6C,IAAI7C,EAAG8C,IAAIF,GAAO7F,GACtB,MAAUtE,MAAM,2BACpB,OAAOmK,CACV,CACT,CAEI,MAAMY,GAAUH,EAAInJ,GAAOC,EAC3B,OAAO,SAAqB6F,EAAIjD,GAE5B,GAAIiD,EAAG+B,IAAIhF,EAAGqG,KAAepD,EAAGyD,IAAIzD,EAAGmD,KACnC,MAAU1K,MAAM,2BACpB,IAAI8J,EAAIe,EAEJI,EAAI1D,EAAG+B,IAAI/B,EAAGgD,IAAIhD,EAAGmD,IAAKI,GAAIF,GAC9BlB,EAAInC,EAAG+B,IAAIhF,EAAGyG,GACd5E,EAAIoB,EAAG+B,IAAIhF,EAAGsG,GAClB,MAAQrD,EAAG6C,IAAIjE,EAAGoB,EAAGmD,MAAM,CACvB,GAAInD,EAAG6C,IAAIjE,EAAGoB,EAAG2D,MACb,OAAO3D,EAAG2D,KAEd,IAAInB,EAAI,EACR,IAAK,IAAIoB,EAAK5D,EAAG8C,IAAIlE,GAAI4D,EAAID,IACrBvC,EAAG6C,IAAIe,EAAI5D,EAAGmD,KADUX,IAG5BoB,EAAK5D,EAAG8C,IAAIc,GAGhB,MAAMC,EAAK7D,EAAG+B,IAAI2B,EAAGxJ,GAAOD,OAAOsI,EAAIC,EAAI,IAC3CkB,EAAI1D,EAAG8C,IAAIe,GACX1B,EAAInC,EAAGgD,IAAIb,EAAG0B,GACdjF,EAAIoB,EAAGgD,IAAIpE,EAAG8E,GACdnB,EAAIC,CAChB,CACQ,OAAOL,CACV,CACL,CAyDW2B,CAAcpB,EACzB,CAtLYzI,OAAO,GAAWA,OAAO,IA0LrC,MAAM8J,GAAe,CACjB,SAAU,UAAW,MAAO,MAAO,MAAO,OAAQ,MAClD,MAAO,MAAO,MAAO,MAAO,MAAO,MACnC,OAAQ,OAAQ,OAAQ,QAkFrB,SAASC,GAAQjH,EAAGkH,GAEvB,MAAMC,OAA6BxH,IAAfuH,EAA2BA,EAAalH,EAAE/B,SAAS,GAAGjC,OAE1E,MAAO,CAAEkL,WAAYC,EAAaC,YADdC,KAAKC,KAAKH,EAAc,GAEhD,CAgBO,SAASI,GAAMC,EAAOzG,EAAQ0G,GAAO,EAAOC,EAAQ,IACvD,GAAIF,GAASvK,EACT,MAAUvB,MAAM,iCAAiC8L,GACrD,MAAQN,WAAYS,EAAMP,YAAaQ,GAAUX,GAAQO,EAAOzG,GAChE,GAAI6G,EAAQ,KACR,MAAUlM,MAAM,mDACpB,MAAMmM,EAAQnC,GAAO8B,GACfM,EAAIjL,OAAOkL,OAAO,CACpBP,QACAG,OACAC,QACAI,KAAMhH,EAAQ2G,GACdf,KAAM3J,EACNmJ,IAAKjJ,EACL3B,OAAS+C,GAAQuG,EAAIvG,EAAKiJ,GAC1BtE,QAAU3E,IACN,GAAmB,iBAARA,EACP,MAAU7C,MAAM,sDAAsD6C,GAC1E,OAAOtB,GAAOsB,GAAOA,EAAMiJ,CAAK,EAEpCS,IAAM1J,GAAQA,IAAQtB,EACtBiL,MAAQ3J,IAASA,EAAMpB,KAASA,EAChCuJ,IAAMnI,GAAQuG,GAAKvG,EAAKiJ,GACxB1B,IAAK,CAACqC,EAAKC,IAAQD,IAAQC,EAC3BrC,IAAMxH,GAAQuG,EAAIvG,EAAMA,EAAKiJ,GAC7Ba,IAAK,CAACF,EAAKC,IAAQtD,EAAIqD,EAAMC,EAAKZ,GAClCrB,IAAK,CAACgC,EAAKC,IAAQtD,EAAIqD,EAAMC,EAAKZ,GAClCvB,IAAK,CAACkC,EAAKC,IAAQtD,EAAIqD,EAAMC,EAAKZ,GAClCxC,IAAK,CAACzG,EAAK0G,IA/GZ,SAAe6C,EAAGvJ,EAAK0G,GAG1B,GAAIA,EAAQhI,EACR,MAAUvB,MAAM,sBACpB,GAAIuJ,IAAUhI,EACV,OAAO6K,EAAE1B,IACb,GAAInB,IAAU9H,EACV,OAAOoB,EACX,IAAI+J,EAAIR,EAAE1B,IACNmC,EAAIhK,EACR,KAAO0G,EAAQhI,GACPgI,EAAQ9H,IACRmL,EAAIR,EAAE7B,IAAIqC,EAAGC,IACjBA,EAAIT,EAAE/B,IAAIwC,GACVtD,IAAU9H,EAEd,OAAOmL,CACX,CA6F6BE,CAAMV,EAAGvJ,EAAK0G,GACnCwD,IAAK,CAACN,EAAKC,IAAQtD,EAAIqD,EAAM9C,GAAO+C,EAAKZ,GAAQA,GAEjDkB,KAAOnK,GAAQA,EAAMA,EACrBoK,KAAM,CAACR,EAAKC,IAAQD,EAAMC,EAC1BQ,KAAM,CAACT,EAAKC,IAAQD,EAAMC,EAC1BS,KAAM,CAACV,EAAKC,IAAQD,EAAMC,EAC1BU,IAAMvK,GAAQ8G,GAAO9G,EAAKiJ,GAC1BuB,KAAMrB,EAAMqB,MAAS,CAAC/I,GAAM6H,EAAMC,EAAG9H,IACrCgJ,YAAcC,GAjGf,SAAuBnB,EAAGoB,GAC7B,MAAMC,EAAUrL,MAAMoL,EAAKlN,QAErBoN,EAAiBF,EAAKG,QAAO,CAACC,EAAK/K,EAAKrC,IACtC4L,EAAEG,IAAI1J,GACC+K,GACXH,EAAIjN,GAAKoN,EACFxB,EAAE7B,IAAIqD,EAAK/K,KACnBuJ,EAAE1B,KAECmD,EAAWzB,EAAEgB,IAAIM,GAQvB,OANAF,EAAKM,aAAY,CAACF,EAAK/K,EAAKrC,IACpB4L,EAAEG,IAAI1J,GACC+K,GACXH,EAAIjN,GAAK4L,EAAE7B,IAAIqD,EAAKH,EAAIjN,IACjB4L,EAAE7B,IAAIqD,EAAK/K,KACnBgL,GACIJ,CACX,CA8E8BM,CAAc3B,EAAGmB,GAGvCS,KAAM,CAACpM,EAAGuE,EAAG8H,IAAOA,EAAI9H,EAAIvE,EAC5BhC,QAAUiD,GAASkJ,EAAOvH,EAAgB3B,EAAKqJ,GAAS7H,EAAgBxB,EAAKqJ,GAC7EgC,UAAYxL,IACR,GAAIA,EAAMpC,SAAW4L,EACjB,MAAUlM,MAAM,0BAA0BkM,UAAcxJ,EAAMpC,UAClE,OAAOyL,EAAO5H,EAAgBzB,GAASwB,EAAgBxB,EAAM,IAGrE,OAAOvB,OAAOkL,OAAOD,EACzB,CAkCO,SAAS+B,GAAoBC,GAChC,GAA0B,iBAAfA,EACP,MAAUpO,MAAM,8BACpB,MAAMqO,EAAYD,EAAW7L,SAAS,GAAGjC,OACzC,OAAOqL,KAAKC,KAAKyC,EAAY,EACjC,CAQO,SAASC,GAAiBF,GAC7B,MAAM9N,EAAS6N,GAAoBC,GACnC,OAAO9N,EAASqL,KAAKC,KAAKtL,EAAS,EACvC;;AC3YA,MAAMiB,GAAMC,OAAO,GACbC,GAAMD,OAAO,GAGb+M,GAAmB,IAAIjG,QACvBkG,GAAmB,IAAIlG,QAYtB,SAASmG,GAAKR,EAAGS,GACpB,MAAMC,EAAkB,CAACC,EAAW7M,KAChC,MAAMiJ,EAAMjJ,EAAK8M,SACjB,OAAOD,EAAY5D,EAAMjJ,CAAI,EAE3B+M,EAAaC,IACf,IAAK5H,OAAOD,cAAc6H,IAAMA,GAAK,GAAKA,EAAIL,EAC1C,MAAU1O,MAAM,qBAAqB+O,oBAAoBL,KAAQ,EAEnEM,EAAQD,IACVD,EAAUC,GAGV,MAAO,CAAEE,QAFOtD,KAAKC,KAAK8C,EAAOK,GAAK,EAEpBG,WADC,IAAMH,EAAI,GACC,EAElC,MAAO,CACHJ,kBAEA,YAAAQ,CAAaC,EAAK9K,GACd,IAAIsI,EAAIqB,EAAE/C,KACN2B,EAAIuC,EACR,KAAO9K,EAAI/C,IACH+C,EAAI7C,KACJmL,EAAIA,EAAED,IAAIE,IACdA,EAAIA,EAAEwC,SACN/K,IAAM7C,GAEV,OAAOmL,CACV,EAWD,gBAAA0C,CAAiBF,EAAKL,GAClB,MAAME,QAAEA,EAAOC,WAAEA,GAAeF,EAAKD,GAC/BQ,EAAS,GACf,IAAI3C,EAAIwC,EACJI,EAAO5C,EACX,IAAK,IAAI6C,EAAS,EAAGA,EAASR,EAASQ,IAAU,CAC7CD,EAAO5C,EACP2C,EAAO9I,KAAK+I,GAEZ,IAAK,IAAIhP,EAAI,EAAGA,EAAI0O,EAAY1O,IAC5BgP,EAAOA,EAAK7C,IAAIC,GAChB2C,EAAO9I,KAAK+I,GAEhB5C,EAAI4C,EAAKH,QACzB,CACY,OAAOE,CACV,EAQD,IAAAd,CAAKM,EAAGW,EAAapL,GAGjB,MAAM2K,QAAEA,EAAOC,WAAEA,GAAeF,EAAKD,GACrC,IAAInC,EAAIqB,EAAE/C,KACNkB,EAAI6B,EAAE0B,KACV,MAAMC,EAAOpO,OAAO,GAAKuN,EAAI,GACvBc,EAAY,GAAKd,EACjBe,EAAUtO,OAAOuN,GACvB,IAAK,IAAIU,EAAS,EAAGA,EAASR,EAASQ,IAAU,CAC7C,MAAMM,EAASN,EAASP,EAExB,IAAIc,EAAQ7I,OAAO7C,EAAIsL,GAEvBtL,IAAMwL,EAGFE,EAAQd,IACRc,GAASH,EACTvL,GAAK7C,IAST,MAAMwO,EAAUF,EACVG,EAAUH,EAASpE,KAAKwE,IAAIH,GAAS,EACrCI,EAAQX,EAAS,GAAM,EACvBY,EAAQL,EAAQ,EACR,IAAVA,EAEA5D,EAAIA,EAAEO,IAAIgC,EAAgByB,EAAOV,EAAYO,KAG7CrD,EAAIA,EAAED,IAAIgC,EAAgB0B,EAAOX,EAAYQ,IAEjE,CAMY,MAAO,CAAEtD,IAAGR,IACf,EACD,UAAAkE,CAAWrG,EAAG3F,EAAGiM,GACb,MAAMxB,EAAIP,GAAiB/F,IAAIwB,IAAM,EAErC,IAAIuG,EAAOjC,GAAiB9F,IAAIwB,GAMhC,OALKuG,IACDA,EAAOjR,KAAK+P,iBAAiBrF,EAAG8E,GACtB,IAANA,GACAR,GAAiBlO,IAAI4J,EAAGsG,EAAUC,KAEnCjR,KAAKkP,KAAKM,EAAGyB,EAAMlM,EAC7B,EAID,aAAAmM,CAAcxG,EAAG8E,GACbD,EAAUC,GACVP,GAAiBnO,IAAI4J,EAAG8E,GACxBR,GAAiBmC,OAAOzG,EAC3B,EAET,CAYO,SAAS0G,GAAU1C,EAAG5G,EAAOkI,EAAQqB,GAOxC,IAAKxO,MAAMgF,QAAQmI,KAAYnN,MAAMgF,QAAQwJ,IAAYA,EAAQtQ,SAAWiP,EAAOjP,OAC/E,MAAUN,MAAM,uDACpB4Q,EAAQC,SAAQ,CAACC,EAAGtQ,KAChB,IAAK6G,EAAMG,QAAQsJ,GACf,MAAU9Q,MAAM,yBAAyBQ,EAAI,IAErD+O,EAAOsB,SAAQ,CAACjE,EAAGpM,KACf,KAAMoM,aAAaqB,GACf,MAAUjO,MAAM,wBAAwBQ,EAAI,IAEpD,MAAMwP,EAAQ3K,EAAO7D,OAAO+N,EAAOjP,SAC7B4O,EAAac,EAAQ,GAAKA,EAAQ,EAAIA,EAAQ,EAAIA,EAAQ,EAAIA,EAAQ,EAAI,EAC1E1D,GAAQ,GAAK4C,GAAc,EAC3B6B,EAAc3O,MAAMkK,EAAO,GAAG5L,KAAKuN,EAAE/C,MACrC8F,EAAWrF,KAAKsF,OAAO5J,EAAM4E,KAAO,GAAKiD,GAAcA,EAC7D,IAAInK,EAAMkJ,EAAE/C,KACZ,IAAK,IAAI1K,EAAIwQ,EAAUxQ,GAAK,EAAGA,GAAK0O,EAAY,CAC5C6B,EAAQrQ,KAAKuN,EAAE/C,MACf,IAAK,IAAIgG,EAAI,EAAGA,EAAIN,EAAQtQ,OAAQ4Q,IAAK,CACrC,MAAMC,EAASP,EAAQM,GACjBlB,EAAQ7I,OAAQgK,GAAU3P,OAAOhB,GAAMgB,OAAO8K,IACpDyE,EAAQf,GAASe,EAAQf,GAAOrD,IAAI4C,EAAO2B,GACvD,CACQ,IAAIE,EAAOnD,EAAE/C,KAEb,IAAK,IAAIgG,EAAIH,EAAQzQ,OAAS,EAAG+Q,EAAOpD,EAAE/C,KAAMgG,EAAI,EAAGA,IACnDG,EAAOA,EAAK1E,IAAIoE,EAAQG,IACxBE,EAAOA,EAAKzE,IAAI0E,GAGpB,GADAtM,EAAMA,EAAI4H,IAAIyE,GACJ,IAAN5Q,EACA,IAAK,IAAI0Q,EAAI,EAAGA,EAAIhC,EAAYgC,IAC5BnM,EAAMA,EAAIsK,QAC1B,CACI,OAAOtK,CACX,CACO,SAASuM,GAAcC,GAY1B,ODRO9J,ECHO8J,EAAMhK,GDDP+D,GAAaqC,QAAO,CAACtF,EAAKxB,KACnCwB,EAAIxB,GAAO,WACJwB,IARK,CACZyD,MAAO,SACPQ,KAAM,SACNJ,MAAO,gBACPD,KAAM,mBCIVxE,EAAe8J,EAAO,CAClBjN,EAAG,SACH4B,EAAG,SACHsL,GAAI,QACJC,GAAI,SACL,CACCjG,WAAY,gBACZE,YAAa,kBAGVvK,OAAOkL,OAAO,IACdd,GAAQgG,EAAMjN,EAAGiN,EAAM/F,eACvB+F,EACE3E,EAAG2E,EAAMhK,GAAGuE,OAEzB;sECzNA,SAAS4F,GAAmB1C,QACN/K,IAAd+K,EAAK2C,MACL3P,EAAM,OAAQgN,EAAK2C,WACF1N,IAAjB+K,EAAK4C,SACL5P,EAAM,UAAWgN,EAAK4C,QAC9B,CA4BA,MAAQ1N,gBAAiB2N,GAAKrO,WAAYsO,IAAQC,EAQrCC,GAAM,CAEfC,IAAK,cAAqBjS,MACtB,WAAAb,CAAY4K,EAAI,IACZzK,MAAMyK,EAClB,GAGImI,KAAM,CACFnJ,OAAQ,CAACoJ,EAAK3M,KACV,MAAQyM,IAAKG,GAAMJ,GACnB,GAAIG,EAAM,GAAKA,EAAM,IACjB,MAAM,IAAIC,EAAE,yBAChB,GAAkB,EAAd5M,EAAKlF,OACL,MAAM,IAAI8R,EAAE,6BAChB,MAAMC,EAAU7M,EAAKlF,OAAS,EACxBiE,EAAM+N,EAAuBD,GACnC,GAAK9N,EAAIjE,OAAS,EAAK,IACnB,MAAM,IAAI8R,EAAE,wCAEhB,MAAMG,EAASF,EAAU,IAAMC,EAAwB/N,EAAIjE,OAAS,EAAK,KAAO,GAChF,MAAO,GAAGgS,EAAuBH,KAAOI,IAAShO,IAAMiB,GAAM,EAGjE,MAAAgN,CAAOL,EAAK3M,GACR,MAAQyM,IAAKG,GAAMJ,GACnB,IAAIrJ,EAAM,EACV,GAAIwJ,EAAM,GAAKA,EAAM,IACjB,MAAM,IAAIC,EAAE,yBAChB,GAAI5M,EAAKlF,OAAS,GAAKkF,EAAKmD,OAAWwJ,EACnC,MAAM,IAAIC,EAAE,yBAChB,MAAMK,EAAQjN,EAAKmD,KAEnB,IAAIrI,EAAS,EACb,MAF0B,IAARmS,GAIb,CAED,MAAMF,EAAiB,IAARE,EACf,IAAKF,EACD,MAAM,IAAIH,EAAE,qDAChB,GAAIG,EAAS,EACT,MAAM,IAAIH,EAAE,4CAChB,MAAMM,EAAclN,EAAKmN,SAAShK,EAAKA,EAAM4J,GAC7C,GAAIG,EAAYpS,SAAWiS,EACvB,MAAM,IAAIH,EAAE,yCAChB,GAAuB,IAAnBM,EAAY,GACZ,MAAM,IAAIN,EAAE,wCAChB,IAAK,MAAMjM,KAAKuM,EACZpS,EAAUA,GAAU,EAAK6F,EAE7B,GADAwC,GAAO4J,EACHjS,EAAS,IACT,MAAM,IAAI8R,EAAE,yCAChC,MAlBgB9R,EAASmS,EAmBb,MAAM1M,EAAIP,EAAKmN,SAAShK,EAAKA,EAAMrI,GACnC,GAAIyF,EAAEzF,SAAWA,EACb,MAAM,IAAI8R,EAAE,kCAChB,MAAO,CAAErM,IAAG6M,EAAGpN,EAAKmN,SAAShK,EAAMrI,GACtC,GAMLuS,KAAM,CACF,MAAA9J,CAAOlG,GACH,MAAQoP,IAAKG,GAAMJ,GACnB,GAAInP,EAAMtB,GACN,MAAM,IAAI6Q,EAAE,8CAChB,IAAIzP,EAAM2P,EAAuBzP,GAIjC,GAFkC,EAA9BsE,OAAO2L,SAASnQ,EAAI,GAAI,MACxBA,EAAM,KAAOA,GACA,EAAbA,EAAIrC,OACJ,MAAM,IAAI8R,EAAE,wBAChB,OAAOzP,CACV,EACD,MAAA6P,CAAOhN,GACH,MAAQyM,IAAKG,GAAMJ,GACnB,GAAc,IAAVxM,EAAK,GACL,MAAM,IAAI4M,EAAE,uCAChB,GAAgB,IAAZ5M,EAAK,MAA2B,IAAVA,EAAK,IAC3B,MAAM,IAAI4M,EAAE,uDAChB,OAAOP,GAAIrM,EACd,GAEL,KAAAuN,CAAMpQ,GAEF,MAAQsP,IAAKG,EAAGS,KAAMG,EAAKd,KAAMe,GAAQjB,GACnCxM,EAAsB,iBAAR7C,EAAmBmP,GAAInP,GAAOA,EAClDuQ,EAAU1N,GACV,MAAQO,EAAGoN,EAAUP,EAAGQ,GAAiBH,EAAIT,OAAO,GAAMhN,GAC1D,GAAI4N,EAAa9S,OACb,MAAM,IAAI8R,EAAE,+CAChB,MAAQrM,EAAGsN,EAAQT,EAAGU,GAAeL,EAAIT,OAAO,EAAMW,IAC9CpN,EAAGwN,EAAQX,EAAGY,GAAeP,EAAIT,OAAO,EAAMc,GACtD,GAAIE,EAAWlT,OACX,MAAM,IAAI8R,EAAE,+CAChB,MAAO,CAAEtI,EAAGkJ,EAAIR,OAAOa,GAASvC,EAAGkC,EAAIR,OAAOe,GACjD,EACD,UAAAE,CAAWC,GACP,MAAQxB,KAAMe,EAAKJ,KAAMG,GAAQhB,GAC3B2B,EAAM,GAAGV,EAAIlK,OAAO,EAAMiK,EAAIjK,OAAO2K,EAAI5J,MAAMmJ,EAAIlK,OAAO,EAAMiK,EAAIjK,OAAO2K,EAAI5C,MACrF,OAAOmC,EAAIlK,OAAO,GAAM4K,EAC3B,GAICpS,GAAMC,OAAO,GAAIC,GAAMD,OAAO,GAAUA,OAAO,GAAG,MAACwH,GAAMxH,OAAO,GAC/D,SAASoS,GAAkB5E,GAC9B,MAAM6E,EAjJV,SAA2BtC,GACvB,MAAMvC,EAAOsC,GAAcC,GAC3BuC,EAAkB9E,EAAM,CACpBpN,EAAG,QACHuE,EAAG,SACJ,CACC4N,yBAA0B,QAC1BC,eAAgB,UAChBC,cAAe,WACfC,cAAe,WACfC,mBAAoB,UACpBjG,UAAW,WACXtO,QAAS,aAEb,MAAMwU,KAAEA,EAAI7M,GAAEA,EAAE3F,EAAEA,GAAMoN,EACxB,GAAIoF,EAAM,CACN,IAAK7M,EAAG6C,IAAIxI,EAAG2F,EAAG2D,MACd,MAAUlL,MAAM,qEAEpB,GAAoB,iBAAToU,GACc,iBAAdA,EAAKC,MACgB,mBAArBD,EAAKE,YACZ,MAAUtU,MAAM,oEAE5B,CACI,OAAOmB,OAAOkL,OAAO,IAAK2C,GAC9B,CAuHkBuF,CAAkBvF,IAC1BzH,GAAEA,GAAOsM,EACTW,EAAKC,GAAUZ,EAAMvP,EAAGuP,EAAMrI,YAC9B5L,EAAUiU,EAAMjU,SAC1B,EAAU8U,EAAIC,EAAOC,KACT,MAAMhT,EAAI+S,EAAME,WAChB,OAAOC,EAAe1U,WAAWiC,KAAK,CAAC,IAAQkF,EAAG3H,QAAQgC,EAAE8H,GAAInC,EAAG3H,QAAQgC,EAAEmT,GAChF,GACC7G,EAAY2F,EAAM3F,WACnB,CAACxL,IAEE,MAAMsS,EAAOtS,EAAMiQ,SAAS,GAI5B,MAAO,CAAEjJ,EAFCnC,EAAG2G,UAAU8G,EAAKrC,SAAS,EAAGpL,EAAG2E,QAE/B6I,EADFxN,EAAG2G,UAAU8G,EAAKrC,SAASpL,EAAG2E,MAAO,EAAI3E,EAAG2E,QAEzD,GAKL,SAAS+I,EAAoBvL,GACzB,MAAM9H,EAAEA,EAACuE,EAAEA,GAAM0N,EACXqB,EAAK3N,EAAG8C,IAAIX,GACZyL,EAAK5N,EAAGgD,IAAI2K,EAAIxL,GACtB,OAAOnC,EAAGoF,IAAIpF,EAAGoF,IAAIwI,EAAI5N,EAAGgD,IAAIb,EAAG9H,IAAKuE,EAChD,CAKI,IAAKoB,EAAG6C,IAAI7C,EAAG8C,IAAIwJ,EAAMpC,IAAKwD,EAAoBpB,EAAMrC,KACpD,MAAUxR,MAAM,+CAOpB,SAASoV,EAAuBzV,GAC5B,MAAQoU,yBAA0BsB,EAAO3J,YAAEA,EAAWsI,eAAEA,EAAgB1P,EAAGgR,GAAMzB,EACjF,GAAIwB,GAA0B,iBAAR1V,EAAkB,CAIpC,GAHI4V,EAAW5V,KACXA,EAAM6V,EAAc7V,IAEL,iBAARA,IAAqB0V,EAAQI,SAAS9V,EAAIW,QACjD,MAAUN,MAAM,eACpBL,EAAMA,EAAI6C,SAAuB,EAAdkJ,EAAiB,IAChD,CACQ,IAAI7I,EACJ,IACIA,EACmB,iBAARlD,EACDA,EACA+V,EAAmBjR,EAAY,cAAe9E,EAAK+L,GACzE,CACQ,MAAOiK,GACH,MAAU3V,MAAM,uBAAuB0L,sCAAgD/L,IACnG,CAIQ,OAHIqU,IACAnR,EAAM+S,EAAQ/S,EAAKyS,IACvBO,EAAY,cAAehT,EAAKpB,GAAK6T,GAC9BzS,CACf,CACI,SAASiT,EAAeC,GACpB,KAAMA,aAAiBC,GACnB,MAAUhW,MAAM,2BAC5B,CAKI,MAAMiW,EAAe9N,GAAS,CAACyE,EAAGsJ,KAC9B,MAAQC,GAAIzM,EAAG0M,GAAIrB,EAAGsB,GAAIC,GAAM1J,EAEhC,GAAIrF,EAAG6C,IAAIkM,EAAG/O,EAAGmD,KACb,MAAO,CAAEhB,IAAGqL,KAChB,MAAMxI,EAAMK,EAAEL,MAGJ,MAAN2J,IACAA,EAAK3J,EAAMhF,EAAGmD,IAAMnD,EAAG6F,IAAIkJ,IAC/B,MAAMC,EAAKhP,EAAGgD,IAAIb,EAAGwM,GACfM,EAAKjP,EAAGgD,IAAIwK,EAAGmB,GACfO,EAAKlP,EAAGgD,IAAI+L,EAAGJ,GACrB,GAAI3J,EACA,MAAO,CAAE7C,EAAGnC,EAAG2D,KAAM6J,EAAGxN,EAAG2D,MAC/B,IAAK3D,EAAG6C,IAAIqM,EAAIlP,EAAGmD,KACf,MAAU1K,MAAM,oBACpB,MAAO,CAAE0J,EAAG6M,EAAIxB,EAAGyB,EAAI,IAIrBE,EAAkBvO,GAAUyE,IAC9B,GAAIA,EAAEL,MAAO,CAIT,GAAIsH,EAAMM,qBAAuB5M,EAAGgF,IAAIK,EAAEwJ,IACtC,OACJ,MAAUpW,MAAM,kBAC5B,CAEQ,MAAM0J,EAAEA,EAACqL,EAAEA,GAAMnI,EAAEiI,WAEnB,IAAKtN,EAAGC,QAAQkC,KAAOnC,EAAGC,QAAQuN,GAC9B,MAAU/U,MAAM,4BACpB,MAAM2W,EAAOpP,EAAG8C,IAAI0K,GACd6B,EAAQ3B,EAAoBvL,GAClC,IAAKnC,EAAG6C,IAAIuM,EAAMC,GACd,MAAU5W,MAAM,qCACpB,IAAK4M,EAAEqH,gBACH,MAAUjU,MAAM,0CACpB,OAAO,CAAI,IAOf,MAAMgW,EACF,WAAA7W,CAAYgX,EAAIC,EAAIC,GAIhB,GAHA9W,KAAK4W,GAAKA,EACV5W,KAAK6W,GAAKA,EACV7W,KAAK8W,GAAKA,EACA,MAANF,IAAe5O,EAAGC,QAAQ2O,GAC1B,MAAUnW,MAAM,cACpB,GAAU,MAANoW,IAAe7O,EAAGC,QAAQ4O,GAC1B,MAAUpW,MAAM,cACpB,GAAU,MAANqW,IAAe9O,EAAGC,QAAQ6O,GAC1B,MAAUrW,MAAM,cACpBmB,OAAOkL,OAAO9M,KAC1B,CAGQ,iBAAOsX,CAAWjK,GACd,MAAMlD,EAAEA,EAACqL,EAAEA,GAAMnI,GAAK,CAAE,EACxB,IAAKA,IAAMrF,EAAGC,QAAQkC,KAAOnC,EAAGC,QAAQuN,GACpC,MAAU/U,MAAM,wBACpB,GAAI4M,aAAaoJ,EACb,MAAUhW,MAAM,gCACpB,MAAMuM,EAAO/L,GAAM+G,EAAG6C,IAAI5J,EAAG+G,EAAG2D,MAEhC,OAAIqB,EAAI7C,IAAM6C,EAAIwI,GACPiB,EAAM9K,KACV,IAAI8K,EAAMtM,EAAGqL,EAAGxN,EAAGmD,IACtC,CACQ,KAAIhB,GACA,OAAOnK,KAAKsV,WAAWnL,CACnC,CACQ,KAAIqL,GACA,OAAOxV,KAAKsV,WAAWE,CACnC,CAOQ,iBAAO+B,CAAWvH,GACd,MAAMwH,EAAQxP,EAAG+F,YAAYiC,EAAOlH,KAAKuE,GAAMA,EAAEyJ,MACjD,OAAO9G,EAAOlH,KAAI,CAACuE,EAAGpM,IAAMoM,EAAEiI,SAASkC,EAAMvW,MAAK6H,IAAI2N,EAAMa,WACxE,CAKQ,cAAOG,CAAQrU,GACX,MAAMsH,EAAI+L,EAAMa,WAAW3I,EAAUzJ,EAAY,WAAY9B,KAE7D,OADAsH,EAAEgN,iBACKhN,CACnB,CAEQ,qBAAOiN,CAAeC,GAClB,OAAOnB,EAAMrG,KAAKyH,SAAShC,EAAuB+B,GAC9D,CAEQ,UAAOE,CAAI9H,EAAQqB,GACf,OAAOD,GAAUqF,EAAOxB,EAAIjF,EAAQqB,EAChD,CAEQ,cAAA0G,CAAepI,GACXqI,EAAK9G,cAAclR,KAAM2P,EACrC,CAEQ,cAAA+H,GACIP,EAAgBnX,KAC5B,CACQ,QAAAiY,GACI,MAAMzC,EAAEA,GAAMxV,KAAKsV,WACnB,GAAItN,EAAGiF,MACH,OAAQjF,EAAGiF,MAAMuI,GACrB,MAAU/U,MAAM,8BAC5B,CAIQ,MAAAyX,CAAO1B,GACHD,EAAeC,GACf,MAAQI,GAAIuB,EAAItB,GAAIuB,EAAItB,GAAIuB,GAAOrY,MAC3B4W,GAAI0B,EAAIzB,GAAI0B,EAAIzB,GAAI0B,GAAOhC,EAC7BiC,EAAKzQ,EAAG6C,IAAI7C,EAAGgD,IAAImN,EAAIK,GAAKxQ,EAAGgD,IAAIsN,EAAID,IACvCK,EAAK1Q,EAAG6C,IAAI7C,EAAGgD,IAAIoN,EAAII,GAAKxQ,EAAGgD,IAAIuN,EAAIF,IAC7C,OAAOI,GAAMC,CACzB,CAIQ,MAAApJ,GACI,OAAO,IAAImH,EAAMzW,KAAK4W,GAAI5O,EAAGyD,IAAIzL,KAAK6W,IAAK7W,KAAK8W,GAC5D,CAKQ,MAAAhH,GACI,MAAMzN,EAAEA,EAACuE,EAAEA,GAAM0N,EACXqE,EAAK3Q,EAAGgD,IAAIpE,EAAG6C,KACbmN,GAAIuB,EAAItB,GAAIuB,EAAItB,GAAIuB,GAAOrY,KACnC,IAAI4Y,EAAK5Q,EAAG2D,KAAMkN,EAAK7Q,EAAG2D,KAAMmN,EAAK9Q,EAAG2D,KACpCoN,EAAK/Q,EAAGgD,IAAImN,EAAIA,GAChBa,EAAKhR,EAAGgD,IAAIoN,EAAIA,GAChBxM,EAAK5D,EAAGgD,IAAIqN,EAAIA,GAChBY,EAAKjR,EAAGgD,IAAImN,EAAIC,GA4BpB,OA3BAa,EAAKjR,EAAGoF,IAAI6L,EAAIA,GAChBH,EAAK9Q,EAAGgD,IAAImN,EAAIE,GAChBS,EAAK9Q,EAAGoF,IAAI0L,EAAIA,GAChBF,EAAK5Q,EAAGgD,IAAI3I,EAAGyW,GACfD,EAAK7Q,EAAGgD,IAAI2N,EAAI/M,GAChBiN,EAAK7Q,EAAGoF,IAAIwL,EAAIC,GAChBD,EAAK5Q,EAAGkD,IAAI8N,EAAIH,GAChBA,EAAK7Q,EAAGoF,IAAI4L,EAAIH,GAChBA,EAAK7Q,EAAGgD,IAAI4N,EAAIC,GAChBD,EAAK5Q,EAAGgD,IAAIiO,EAAIL,GAChBE,EAAK9Q,EAAGgD,IAAI2N,EAAIG,GAChBlN,EAAK5D,EAAGgD,IAAI3I,EAAGuJ,GACfqN,EAAKjR,EAAGkD,IAAI6N,EAAInN,GAChBqN,EAAKjR,EAAGgD,IAAI3I,EAAG4W,GACfA,EAAKjR,EAAGoF,IAAI6L,EAAIH,GAChBA,EAAK9Q,EAAGoF,IAAI2L,EAAIA,GAChBA,EAAK/Q,EAAGoF,IAAI0L,EAAIC,GAChBA,EAAK/Q,EAAGoF,IAAI2L,EAAInN,GAChBmN,EAAK/Q,EAAGgD,IAAI+N,EAAIE,GAChBJ,EAAK7Q,EAAGoF,IAAIyL,EAAIE,GAChBnN,EAAK5D,EAAGgD,IAAIoN,EAAIC,GAChBzM,EAAK5D,EAAGoF,IAAIxB,EAAIA,GAChBmN,EAAK/Q,EAAGgD,IAAIY,EAAIqN,GAChBL,EAAK5Q,EAAGkD,IAAI0N,EAAIG,GAChBD,EAAK9Q,EAAGgD,IAAIY,EAAIoN,GAChBF,EAAK9Q,EAAGoF,IAAI0L,EAAIA,GAChBA,EAAK9Q,EAAGoF,IAAI0L,EAAIA,GACT,IAAIrC,EAAMmC,EAAIC,EAAIC,EACrC,CAKQ,GAAA1L,CAAIoJ,GACAD,EAAeC,GACf,MAAQI,GAAIuB,EAAItB,GAAIuB,EAAItB,GAAIuB,GAAOrY,MAC3B4W,GAAI0B,EAAIzB,GAAI0B,EAAIzB,GAAI0B,GAAOhC,EACnC,IAAIoC,EAAK5Q,EAAG2D,KAAMkN,EAAK7Q,EAAG2D,KAAMmN,EAAK9Q,EAAG2D,KACxC,MAAMtJ,EAAIiS,EAAMjS,EACVsW,EAAK3Q,EAAGgD,IAAIsJ,EAAM1N,EAAG6C,IAC3B,IAAIsP,EAAK/Q,EAAGgD,IAAImN,EAAIG,GAChBU,EAAKhR,EAAGgD,IAAIoN,EAAIG,GAChB3M,EAAK5D,EAAGgD,IAAIqN,EAAIG,GAChBS,EAAKjR,EAAGoF,IAAI+K,EAAIC,GAChBc,EAAKlR,EAAGoF,IAAIkL,EAAIC,GACpBU,EAAKjR,EAAGgD,IAAIiO,EAAIC,GAChBA,EAAKlR,EAAGoF,IAAI2L,EAAIC,GAChBC,EAAKjR,EAAGkD,IAAI+N,EAAIC,GAChBA,EAAKlR,EAAGoF,IAAI+K,EAAIE,GAChB,IAAIc,EAAKnR,EAAGoF,IAAIkL,EAAIE,GA+BpB,OA9BAU,EAAKlR,EAAGgD,IAAIkO,EAAIC,GAChBA,EAAKnR,EAAGoF,IAAI2L,EAAInN,GAChBsN,EAAKlR,EAAGkD,IAAIgO,EAAIC,GAChBA,EAAKnR,EAAGoF,IAAIgL,EAAIC,GAChBO,EAAK5Q,EAAGoF,IAAImL,EAAIC,GAChBW,EAAKnR,EAAGgD,IAAImO,EAAIP,GAChBA,EAAK5Q,EAAGoF,IAAI4L,EAAIpN,GAChBuN,EAAKnR,EAAGkD,IAAIiO,EAAIP,GAChBE,EAAK9Q,EAAGgD,IAAI3I,EAAG6W,GACfN,EAAK5Q,EAAGgD,IAAI2N,EAAI/M,GAChBkN,EAAK9Q,EAAGoF,IAAIwL,EAAIE,GAChBF,EAAK5Q,EAAGkD,IAAI8N,EAAIF,GAChBA,EAAK9Q,EAAGoF,IAAI4L,EAAIF,GAChBD,EAAK7Q,EAAGgD,IAAI4N,EAAIE,GAChBE,EAAKhR,EAAGoF,IAAI2L,EAAIA,GAChBC,EAAKhR,EAAGoF,IAAI4L,EAAID,GAChBnN,EAAK5D,EAAGgD,IAAI3I,EAAGuJ,GACfsN,EAAKlR,EAAGgD,IAAI2N,EAAIO,GAChBF,EAAKhR,EAAGoF,IAAI4L,EAAIpN,GAChBA,EAAK5D,EAAGkD,IAAI6N,EAAInN,GAChBA,EAAK5D,EAAGgD,IAAI3I,EAAGuJ,GACfsN,EAAKlR,EAAGoF,IAAI8L,EAAItN,GAChBmN,EAAK/Q,EAAGgD,IAAIgO,EAAIE,GAChBL,EAAK7Q,EAAGoF,IAAIyL,EAAIE,GAChBA,EAAK/Q,EAAGgD,IAAImO,EAAID,GAChBN,EAAK5Q,EAAGgD,IAAIiO,EAAIL,GAChBA,EAAK5Q,EAAGkD,IAAI0N,EAAIG,GAChBA,EAAK/Q,EAAGgD,IAAIiO,EAAID,GAChBF,EAAK9Q,EAAGgD,IAAImO,EAAIL,GAChBA,EAAK9Q,EAAGoF,IAAI0L,EAAIC,GACT,IAAItC,EAAMmC,EAAIC,EAAIC,EACrC,CACQ,QAAAM,CAAS5C,GACL,OAAOxW,KAAKoN,IAAIoJ,EAAMlH,SAClC,CACQ,GAAAtC,GACI,OAAOhN,KAAKkY,OAAOzB,EAAM9K,KACrC,CACQ,IAAAuD,CAAKnK,GACD,OAAOiT,EAAKjH,WAAW/Q,KAAM+E,EAAG0R,EAAMc,WAClD,CAMQ,cAAA8B,CAAeC,GACXhD,EAAY,SAAUgD,EAAItX,GAAKsS,EAAMvP,GACrC,MAAMwU,EAAI9C,EAAM9K,KAChB,GAAI2N,IAAOtX,GACP,OAAOuX,EACX,GAAID,IAAOpX,GACP,OAAOlC,KACX,MAAM6U,KAAEA,GAASP,EACjB,IAAKO,EACD,OAAOmD,EAAKpI,aAAa5P,KAAMsZ,GAEnC,IAAIE,MAAEA,EAAKC,GAAEA,EAAEC,MAAEA,EAAKC,GAAEA,GAAO9E,EAAKE,YAAYuE,GAC5CM,EAAML,EACNM,EAAMN,EACNjM,EAAItN,KACR,KAAOyZ,EAAKzX,IAAO2X,EAAK3X,IAChByX,EAAKvX,KACL0X,EAAMA,EAAIxM,IAAIE,IACdqM,EAAKzX,KACL2X,EAAMA,EAAIzM,IAAIE,IAClBA,EAAIA,EAAEwC,SACN2J,IAAOvX,GACPyX,IAAOzX,GAOX,OALIsX,IACAI,EAAMA,EAAItK,UACVoK,IACAG,EAAMA,EAAIvK,UACduK,EAAM,IAAIpD,EAAMzO,EAAGgD,IAAI6O,EAAIjD,GAAI/B,EAAKC,MAAO+E,EAAIhD,GAAIgD,EAAI/C,IAChD8C,EAAIxM,IAAIyM,EAC3B,CAUQ,QAAAhC,CAASjG,GACL,MAAMiD,KAAEA,EAAM9P,EAAGgR,GAAMzB,EAEvB,IAAIc,EAAO0E,EACX,GAFAxD,EAAY,SAAU1E,EAAQ1P,GAAK6T,GAE/BlB,EAAM,CACN,MAAM2E,MAAEA,EAAKC,GAAEA,EAAEC,MAAEA,EAAKC,GAAEA,GAAO9E,EAAKE,YAAYnD,GAClD,IAAMvE,EAAGuM,EAAK/M,EAAGkN,GAAQ/Z,KAAKkP,KAAKuK,IAC7BpM,EAAGwM,EAAKhN,EAAGmN,GAAQha,KAAKkP,KAAKyK,GACnCC,EAAM5B,EAAK5I,gBAAgBoK,EAAOI,GAClCC,EAAM7B,EAAK5I,gBAAgBsK,EAAOG,GAClCA,EAAM,IAAIpD,EAAMzO,EAAGgD,IAAI6O,EAAIjD,GAAI/B,EAAKC,MAAO+E,EAAIhD,GAAIgD,EAAI/C,IACvD1B,EAAQwE,EAAIxM,IAAIyM,GAChBC,EAAOC,EAAI3M,IAAI4M,EAC/B,KACiB,CACD,MAAM3M,EAAEA,EAACR,EAAEA,GAAM7M,KAAKkP,KAAK0C,GAC3BwD,EAAQ/H,EACRyM,EAAOjN,CACvB,CAEY,OAAO4J,EAAMc,WAAW,CAACnC,EAAO0E,IAAO,EACnD,CAOQ,oBAAAG,CAAqB5O,EAAGhJ,EAAGuE,GACvB,MAAMsT,EAAIzD,EAAMrG,KACVpF,EAAM,CAACN,EAAGrI,IACVA,IAAML,IAAOK,IAAMH,IAAQwI,EAAEwN,OAAOgC,GAA2BxP,EAAEmN,SAASxV,GAAjCqI,EAAE2O,eAAehX,GAC1DmD,EAAMwF,EAAIhL,KAAMqC,GAAG+K,IAAIpC,EAAIK,EAAGzE,IACpC,OAAOpB,EAAIwH,WAAQtI,EAAYc,CAC3C,CAIQ,QAAA8P,CAASqB,GACL,OAAOD,EAAa1W,KAAM2W,EACtC,CACQ,aAAAjC,GACI,MAAQ/N,EAAGwT,EAAQzF,cAAEA,GAAkBJ,EACvC,GAAI6F,IAAajY,GACb,OAAO,EACX,GAAIwS,EACA,OAAOA,EAAc+B,EAAOzW,MAChC,MAAUS,MAAM,+DAC5B,CACQ,aAAAkU,GACI,MAAQhO,EAAGwT,EAAQxF,cAAEA,GAAkBL,EACvC,OAAI6F,IAAajY,GACNlC,KACP2U,EACOA,EAAc8B,EAAOzW,MACzBA,KAAKqZ,eAAe/E,EAAM3N,EAC7C,CACQ,UAAAyT,CAAWC,GAAe,GAGtB,OAFA5X,EAAM,eAAgB4X,GACtBra,KAAK0X,iBACErX,EAAQoW,EAAOzW,KAAMqa,EACxC,CACQ,KAAAC,CAAMD,GAAe,GAEjB,OADA5X,EAAM,eAAgB4X,GACfpE,EAAcjW,KAAKoa,WAAWC,GACjD,EAEI5D,EAAMrG,KAAO,IAAIqG,EAAMnC,EAAMrC,GAAIqC,EAAMpC,GAAIlK,EAAGmD,KAC9CsL,EAAM9K,KAAO,IAAI8K,EAAMzO,EAAG2D,KAAM3D,EAAGmD,IAAKnD,EAAG2D,MAC3C,MAAM4O,EAAQjG,EAAMrI,WACd+L,EAAO9I,GAAKuH,EAAOnC,EAAMO,KAAOzI,KAAKC,KAAKkO,EAAQ,GAAKA,GAE7D,MAAO,CACHjG,QACAkG,gBAAiB/D,EACjBZ,yBACAH,sBACA+E,mBAnZJ,SAA4BnX,GACxB,OAAOoX,EAAWpX,EAAKpB,GAAKoS,EAAMvP,EAC1C,EAmZA,CAqBO,SAAS4V,GAAYC,GACxB,MAAMtG,EArBV,SAAsBtC,GAClB,MAAMvC,EAAOsC,GAAcC,GAU3B,OATAuC,EAAkB9E,EAAM,CACpB5P,KAAM,OACNiC,KAAM,WACN+Y,YAAa,YACd,CACCC,SAAU,WACVC,cAAe,WACf3I,KAAM,YAEHxQ,OAAOkL,OAAO,CAAEsF,MAAM,KAAS3C,GAC1C,CASkBuL,CAAaJ,IACrB5S,GAAEA,EAAIjD,EAAGkW,GAAgB3G,EACzB4G,EAAgBlT,EAAG2E,MAAQ,EAC3BwO,EAAkB,EAAInT,EAAG2E,MAAQ,EACvC,SAASyO,EAAK/Y,GACV,OAAOgU,EAAQhU,EAAG4Y,EAC1B,CACI,SAASI,EAAKhZ,GACV,OAAOiZ,GAAWjZ,EAAG4Y,EAC7B,CACI,MAAQT,gBAAiB/D,EAAKZ,uBAAEA,EAAsBH,oBAAEA,EAAmB+E,mBAAEA,GAAwBpG,GAAkB,IAChHC,EACH,OAAAjU,CAAQ8U,EAAIC,EAAOiF,GACf,MAAMhY,EAAI+S,EAAME,WACVnL,EAAInC,EAAG3H,QAAQgC,EAAE8H,GACjBoR,EAAMhG,EAEZ,OADA9S,EAAM,eAAgB4X,GAClBA,EACOkB,EAAI1a,WAAWiC,KAAK,CAACsS,EAAM6C,WAAa,EAAO,IAAQ9N,GAGvDoR,EAAI1a,WAAWiC,KAAK,CAAC,IAAQqH,EAAGnC,EAAG3H,QAAQgC,EAAEmT,GAE3D,EACD,SAAA7G,CAAUxL,GACN,MAAM6B,EAAM7B,EAAMpC,OACZya,EAAOrY,EAAM,GACbsS,EAAOtS,EAAMiQ,SAAS,GAE5B,GAAIpO,IAAQkW,GAA2B,IAATM,GAA0B,IAATA,EAoB1C,IAAIxW,IAAQmW,GAA4B,IAATK,EAAe,CAG/C,MAAO,CAAErR,EAFCnC,EAAG2G,UAAU8G,EAAKrC,SAAS,EAAGpL,EAAG2E,QAE/B6I,EADFxN,EAAG2G,UAAU8G,EAAKrC,SAASpL,EAAG2E,MAAO,EAAI3E,EAAG2E,QAEtE,CAEgB,MAAUlM,MAAM,mBAAmBuE,2BAA6BkW,yBAAqCC,uBACrH,CA3B2E,CAC3D,MAAMhR,EAAIgM,EAAmBV,GAC7B,IAAKiF,EAAWvQ,EAAGjI,GAAK8F,EAAGuE,OACvB,MAAU9L,MAAM,yBACpB,MAAMgb,EAAK/F,EAAoBvL,GAC/B,IAAIqL,EACJ,IACIA,EAAIxN,EAAG8F,KAAK2N,EAChC,CACgB,MAAOC,GACH,MAAMC,EAASD,aAAqBjb,MAAQ,KAAOib,EAAU3Z,QAAU,GACvE,MAAUtB,MAAM,wBAA0Bkb,EAC9D,CAMgB,QAHiC,GAAdH,OAFHhG,EAAItT,MAASA,MAIzBsT,EAAIxN,EAAGyD,IAAI+J,IACR,CAAErL,IAAGqL,IAC5B,CASS,IAECoG,EAAiBtY,GAAQ2S,EAAc4F,EAAmBvY,EAAKgR,EAAMnI,cAC3E,SAAS2P,EAAsBzR,GAE3B,OAAOA,EADM4Q,GAAe/Y,EAEpC,CAKI,MAAM6Z,EAAS,CAACnV,EAAG9D,EAAMnB,IAAOwU,EAAmBvP,EAAEK,MAAMnE,EAAMnB,IAIjE,MAAMqa,EACF,WAAApc,CAAY2K,EAAGgH,EAAG0K,GACdjc,KAAKuK,EAAIA,EACTvK,KAAKuR,EAAIA,EACTvR,KAAKic,SAAWA,EAChBjc,KAAK0X,gBACjB,CAEQ,kBAAOwE,CAAY9Y,GACf,MAAMiQ,EAAIiB,EAAMnI,YAEhB,OADA/I,EAAM8B,EAAY,mBAAoB9B,EAAS,EAAJiQ,GACpC,IAAI2I,EAAUD,EAAO3Y,EAAK,EAAGiQ,GAAI0I,EAAO3Y,EAAKiQ,EAAG,EAAIA,GACvE,CAGQ,cAAO8I,CAAQ/Y,GACX,MAAMmH,EAAEA,EAACgH,EAAEA,GAAMkB,GAAIe,MAAMtO,EAAY,MAAO9B,IAC9C,OAAO,IAAI4Y,EAAUzR,EAAGgH,EACpC,CACQ,cAAAmG,GACIpB,EAAY,IAAKtW,KAAKuK,EAAGrI,GAAK+Y,GAC9B3E,EAAY,IAAKtW,KAAKuR,EAAGrP,GAAK+Y,EAC1C,CACQ,cAAAmB,CAAeH,GACX,OAAO,IAAID,EAAUhc,KAAKuK,EAAGvK,KAAKuR,EAAG0K,EACjD,CACQ,gBAAAI,CAAiBC,GACb,MAAM/R,EAAGgH,EAAEA,EAAG0K,SAAUM,GAAQvc,KAC1B2G,EAAIoU,EAAc7V,EAAY,UAAWoX,IAC/C,GAAW,MAAPC,IAAgB,CAAC,EAAG,EAAG,EAAG,GAAGrG,SAASqG,GACtC,MAAU9b,MAAM,uBACpB,MAAM+b,EAAe,IAARD,GAAqB,IAARA,EAAYhS,EAAI+J,EAAMvP,EAAIwF,EACpD,GAAIiS,GAAQxU,EAAGuE,MACX,MAAU9L,MAAM,8BACpB,MAAMgc,EAAgB,EAANF,EAAwB,KAAP,KAC3BG,EAAIjG,EAAMgB,QAAQgF,EAASb,EAAcY,IACzCG,EAAKtB,EAAKmB,GACVI,EAAKxB,GAAMzU,EAAIgW,GACfE,EAAKzB,EAAK7J,EAAIoL,GACdtR,EAAIoL,EAAMrG,KAAK6J,qBAAqByC,EAAGE,EAAIC,GACjD,IAAKxR,EACD,MAAU5K,MAAM,qBAEpB,OADA4K,EAAEqM,iBACKrM,CACnB,CAEQ,QAAAyR,GACI,OAAOhB,EAAsB9b,KAAKuR,EAC9C,CACQ,UAAAwL,GACI,OAAO/c,KAAK8c,WAAa,IAAId,EAAUhc,KAAKuK,EAAG6Q,GAAMpb,KAAKuR,GAAIvR,KAAKic,UAAYjc,IAC3F,CAEQ,aAAAgd,GACI,OAAOC,EAAcjd,KAAKkd,WACtC,CACQ,QAAAA,GACI,OAAOzK,GAAIyB,WAAW,CAAE3J,EAAGvK,KAAKuK,EAAGgH,EAAGvR,KAAKuR,GACvD,CAEQ,iBAAA4L,GACI,OAAOF,EAAcjd,KAAKod,eACtC,CACQ,YAAAA,GACI,OAAOxB,EAAc5b,KAAKuK,GAAKqR,EAAc5b,KAAKuR,EAC9D,EAEI,MAAM8L,EAAQ,CACV,iBAAAC,CAAkB1F,GACd,IAEI,OADA/B,EAAuB+B,IAChB,CACvB,CACY,MAAOxB,GACH,OAAO,CACvB,CACS,EACDP,uBAAwBA,EAKxB0H,iBAAkB,KACd,MAAMxc,EAASyc,GAAqBlJ,EAAMvP,GAC1C,OFzWL,SAAwB3E,EAAKyO,EAAYrC,GAAO,GACnD,MAAMxH,EAAM5E,EAAIW,OACV0c,EAAW7O,GAAoBC,GAC/B6O,EAAS3O,GAAiBF,GAEhC,GAAI7J,EAAM,IAAMA,EAAM0Y,GAAU1Y,EAAM,KAClC,MAAUvE,MAAM,YAAYid,8BAAmC1Y,KACnE,MAEM2Y,EAAU9T,EAFJ2C,EAAO7H,EAAgBvE,GAAOwE,EAAgBxE,GAEjCyO,EAAa3M,GAAOA,EAC7C,OAAOsK,EAAOvH,EAAgB0Y,EAASF,GAAY3Y,EAAgB6Y,EAASF,EAChF,CE8VmBG,CAAmBtJ,EAAMuG,YAAY9Z,GAASuT,EAAMvP,EAAE,EAUjE8Y,WAAU,CAAClO,EAAa,EAAGyF,EAAQqB,EAAMrG,QACrCgF,EAAM2C,eAAepI,GACrByF,EAAMyC,SAAS5V,OAAO,IACfmT,IAef,SAAS0I,EAAUtb,GACf,MAAM2D,EAAM6P,EAAWxT,GACjB8G,EAAsB,iBAAT9G,EACbwC,GAAOmB,GAAOmD,IAAQ9G,EAAKzB,OACjC,OAAIoF,EACOnB,IAAQkW,GAAiBlW,IAAQmW,EACxC7R,EACOtE,IAAQ,EAAIkW,GAAiBlW,IAAQ,EAAImW,EAChD3Y,aAAgBiU,CAG5B,CAuBI,MAAMqE,EAAWxG,EAAMwG,UACnB,SAAU3X,GAGN,MAAMG,EAAM6S,EAAmBhT,GACzB4a,EAAuB,EAAf5a,EAAMpC,OAAauT,EAAMrI,WACvC,OAAO8R,EAAQ,EAAIza,GAAOrB,OAAO8b,GAASza,CAC7C,EACCyX,EAAgBzG,EAAMyG,eACxB,SAAU5X,GACN,OAAOiY,EAAKN,EAAS3X,GACxB,EAEC6a,EAAaC,EAAW3J,EAAMrI,YAIpC,SAASiS,EAAW5a,GAGhB,OAFAgT,EAAY,WAAWhC,EAAMrI,WAAc3I,EAAKtB,GAAKgc,GAE9CnC,EAAmBvY,EAAKgR,EAAMnI,YAC7C,CAMI,SAASgS,EAAQ7B,EAAS1E,EAAYnI,EAAO2O,GACzC,GAAI,CAAC,YAAa,aAAaC,MAAM5X,GAAMA,KAAKgJ,IAC5C,MAAUhP,MAAM,uCACpB,MAAMZ,KAAEA,EAAIgb,YAAEA,GAAgBvG,EAC9B,IAAIlC,KAAEA,EAAIC,QAAEA,EAASiM,aAAcC,GAAQ9O,EAC/B,MAAR2C,IACAA,GAAO,GACXkK,EAAUpX,EAAY,UAAWoX,GACjCnK,GAAmB1C,GACf4C,IACAiK,EAAUpX,EAAY,oBAAqBrF,EAAKyc,KAIpD,MAAMkC,EAAQzD,EAAcuB,GACtBhP,EAAIuI,EAAuB+B,GAC3B6G,EAAW,CAACP,EAAW5Q,GAAI4Q,EAAWM,IAE5C,GAAW,MAAPD,IAAuB,IAARA,EAAe,CAE9B,MAAMlZ,GAAY,IAARkZ,EAAe1D,EAAY7S,EAAG2E,OAAS4R,EACjDE,EAASvX,KAAKhC,EAAY,eAAgBG,GACtD,CACQ,MAAMyB,EAAOyO,KAAkBkJ,GACzBjU,EAAIgU,EA0BV,MAAO,CAAE1X,OAAM4X,MAxBf,SAAeC,GAEX,MAAMlY,EAAIqU,EAAS6D,GACnB,IAAKlE,EAAmBhU,GACpB,OACJ,MAAMmY,EAAKvD,EAAK5U,GACVoY,EAAIpI,EAAMrG,KAAKyH,SAASpR,GAAG6O,WAC3B/K,EAAI6Q,EAAKyD,EAAE1U,GACjB,GAAII,IAAMvI,GACN,OAIJ,MAAMuP,EAAI6J,EAAKwD,EAAKxD,EAAK5Q,EAAID,EAAI+C,IACjC,GAAIiE,IAAMvP,GACN,OACJ,IAAIia,GAAY4C,EAAE1U,IAAMI,EAAI,EAAI,GAAK3C,OAAOiX,EAAErJ,EAAItT,IAC9C4c,EAAQvN,EAKZ,OAJIa,GAAQ0J,EAAsBvK,KAC9BuN,EAlOZ,SAAoBvN,GAChB,OAAOuK,EAAsBvK,GAAK6J,GAAM7J,GAAKA,CACrD,CAgOwBwL,CAAWxL,GACnB0K,GAAY,GAET,IAAID,EAAUzR,EAAGuU,EAAO7C,EAC3C,EAEA,CACI,MAAMmC,EAAiB,CAAEhM,KAAMkC,EAAMlC,KAAMC,SAAS,GAC9C0M,EAAiB,CAAE3M,KAAMkC,EAAMlC,KAAMC,SAAS,GAwFpD,OAnEAoE,EAAMrG,KAAK2H,eAAe,GAmEnB,CACHzD,QACA0K,aAlNJ,SAAsBpH,EAAYyC,GAAe,GAC7C,OAAO5D,EAAMkB,eAAeC,GAAYwC,WAAWC,EAC3D,EAiNQ4E,gBAvLJ,SAAyBC,EAAUC,EAAS9E,GAAe,GACvD,GAAIyD,EAAUoB,GACV,MAAUze,MAAM,iCACpB,IAAKqd,EAAUqB,GACX,MAAU1e,MAAM,iCAEpB,OADUgW,EAAMgB,QAAQ0H,GACftH,SAAShC,EAAuBqJ,IAAW9E,WAAWC,EACvE,EAiLQ+E,KA9EJ,SAAc9C,EAAS+C,EAAS5P,EAAO2O,GACnC,MAAMtX,KAAEA,EAAI4X,MAAEA,GAAUP,EAAQ7B,EAAS+C,EAAS5P,GAC5C6P,EAAIhL,EAEV,OADaiL,EAAkBD,EAAEzf,KAAKc,UAAW2e,EAAEnT,YAAamT,EAAExd,KAC3D0d,CAAK1Y,EAAM4X,EAC1B,EA0EQe,OAzDJ,SAAgBC,EAAWpD,EAASqD,EAAWlQ,EAAOsP,GAClD,MAAMa,EAAKF,EAGX,GAFApD,EAAUpX,EAAY,UAAWoX,GACjCqD,EAAYza,EAAY,YAAaya,GACjC,WAAYlQ,EACZ,MAAUhP,MAAM,sCACpB0R,GAAmB1C,GACnB,MAAM2C,KAAEA,EAAIC,QAAEA,GAAY5C,EAC1B,IAAIoQ,EACAnV,EACJ,IACI,GAAkB,iBAAPkV,GAAmB5J,EAAW4J,GAGrC,IACIC,EAAO7D,EAAUG,QAAQyD,EAC7C,CACgB,MAAOE,GACH,KAAMA,aAAoBrN,GAAIC,KAC1B,MAAMoN,EACVD,EAAO7D,EAAUE,YAAY0D,EACjD,KAEiB,IAAkB,iBAAPA,GAAmC,iBAATA,EAAGrV,GAAkC,iBAATqV,EAAGrO,EAKrE,MAAU9Q,MAAM,SALqE,CACrF,MAAM8J,EAAEA,EAACgH,EAAEA,GAAMqO,EACjBC,EAAO,IAAI7D,EAAUzR,EAAGgH,EACxC,CAGA,CACY7G,EAAI+L,EAAMgB,QAAQkI,EAC9B,CACQ,MAAOvJ,GACH,GAAsB,UAAlBA,EAAMrU,QACN,MAAUtB,MAAM,kEACpB,OAAO,CACnB,CACQ,GAAI2R,GAAQyN,EAAK/C,WACb,OAAO,EACPzK,IACAiK,EAAUhI,EAAMzU,KAAKyc,IACzB,MAAM/R,EAAEA,EAACgH,EAAEA,GAAMsO,EACXlZ,EAAIoU,EAAcuB,GAClByD,EAAK1E,EAAK9J,GACVqL,EAAKxB,EAAKzU,EAAIoZ,GACdlD,EAAKzB,EAAK7Q,EAAIwV,GACdrD,EAAIjG,EAAMrG,KAAK6J,qBAAqBvP,EAAGkS,EAAIC,IAAKvH,WACtD,QAAKoH,GAEKtB,EAAKsB,EAAEvS,KACJI,CACrB,EAOQiQ,gBAAiB/D,EACjBuF,YACAqB,QAER;sECj/BO,SAAS2C,GAAQngB,GACpB,MAAO,CACHA,OACAiC,KAAM,CAAC1B,KAAQ6f,IAASne,EAAKjC,EAAMO,EAAKkF,KAAe2a,IACvDpF,cAER,CACO,SAASqF,GAAYtF,EAAUuF,GAClC,MAAM5f,EAAUV,GAAS8a,GAAY,IAAKC,KAAaoF,GAAQngB,KAC/D,OAAO+B,OAAOkL,OAAO,IAAKvM,EAAO4f,GAAU5f,UAC/C;sED4IgF0B,OAAO,GEnJvF,MAAM+F,GAAKsE,GAAMrK,OAAO,uEAIXme,GAAOF,GAAY,CAC5B7d,EAJY2F,GAAGzH,OAAO0B,OAAO,OAK7B2E,EAJY3E,OAAO,sEAKvB+F,GAAIA,GAEAjD,EAAG9C,OAAO,sEAEVgQ,GAAIhQ,OAAO,sEACXiQ,GAAIjQ,OAAO,sEACX0E,EAAG1E,OAAO,GACVmQ,MAAM,GACPiO,GCZGrY,GAAKsE,GADDrK,OAAO,uGAMJqe,GAAOJ,GAAY,CAC5B7d,EALY2F,GAAGzH,OAAO0B,OAAO,OAM7B2E,EAJY3E,OAAO,sGAKvB+F,GAAIA,GAEAjD,EAAG9C,OAAO,sGAEVgQ,GAAIhQ,OAAO,sGACXiQ,GAAIjQ,OAAO,sGACX0E,EAAG1E,OAAO,GACVmQ,MAAM,GACPmO,GCfGvY,GAAKsE,GADDrK,OAAO,0IAEXqS,GAAQ,CACVjS,EAAG2F,GAAGzH,OAAO0B,OAAO,OACpB2E,EAAG3E,OAAO,0IACd+F,GAAIA,GACAjD,EAAG9C,OAAO,0IACVgQ,GAAIhQ,OAAO,0IACXiQ,GAAIjQ,OAAO,0IACX0E,EAAG1E,OAAO,IAGDue,GAAON,GAAY,CAC5B7d,EAAGiS,GAAMjS,EACTuE,EAAG0N,GAAM1N,EACboB,GAAIA,GAEAjD,EAAGuP,GAAMvP,EACTkN,GAAIqC,GAAMrC,GACVC,GAAIoC,GAAMpC,GACVvL,EAAG2N,GAAM3N,EACTyL,MAAM,EACNoC,yBAA0B,CAAC,IAAK,IAAK,MACtCiM,GC1BGze,GAAMC,OAAO,GAAIC,GAAMD,OAAO,GAAIE,GAAMF,OAAO,GAAI2H,GAAM3H,OAAO,GAEhEye,GAAiB,CAAEC,QAAQ,GAwB1B,SAASC,GAAehG,GAC3B,MAAMtG,EAxBV,SAAsBtC,GAClB,MAAMvC,EAAOsC,GAAcC,GAa3B,OAZAuC,EAAkBvC,EAAO,CACrBnS,KAAM,WACNwC,EAAG,SACHiL,EAAG,SACHuN,YAAa,YACd,CACCgG,kBAAmB,WACnBC,OAAQ,WACRC,QAAS,WACTC,WAAY,aAGTpf,OAAOkL,OAAO,IAAK2C,GAC9B,CASkBuL,CAAaJ,IACrB5S,GAAEA,EAAIjD,EAAGkW,EAAa5I,QAASA,EAASxS,KAAMohB,EAAKpG,YAAEA,EAAW1O,YAAEA,EAAaxF,EAAGwT,GAAc7F,EAChGvH,EAAO5K,IAAQF,OAAqB,EAAdkK,GAAmBjK,GACzCgf,EAAOlZ,EAAGzH,OACV0U,EAAK3I,GAAMgI,EAAMvP,EAAGuP,EAAMrI,YAE1B8U,EAAUzM,EAAMyM,SAC1B,EAAUzW,EAAG9D,KACD,IACI,MAAO,CAAEyB,SAAS,EAAMtF,MAAOqF,EAAG8F,KAAKxD,EAAItC,EAAG6F,IAAIrH,IAClE,CACY,MAAOnB,GACH,MAAO,CAAE4C,SAAS,EAAOtF,MAAOX,GAChD,CACS,GACC6e,EAAoBvM,EAAMuM,mBAAsB,CAAC1d,GAAUA,GAC3D2d,EAASxM,EAAMwM,QACzB,EAAU7a,EAAMkb,EAAKC,KAET,GADA3e,EAAM,SAAU2e,GACZD,EAAIpgB,QAAUqgB,EACd,MAAU3gB,MAAM,uCACpB,OAAOwF,CACV,GAGL,SAASob,EAAY3e,EAAOqC,GACxBuR,EAAY,cAAgB5T,EAAOqC,EAAG/C,GAAK+K,EACnD,CACI,SAASuU,EAAY9K,GACjB,KAAMA,aAAiBC,GACnB,MAAUhW,MAAM,yBAC5B,CAGI,MAAMiW,EAAe9N,GAAS,CAACyE,EAAGsJ,KAC9B,MAAQ4K,GAAIpX,EAAGqX,GAAIhM,EAAGiM,GAAI1K,GAAM1J,EAC1BL,EAAMK,EAAEL,MACJ,MAAN2J,IACAA,EAAK3J,EAAMpD,GAAM5B,EAAG6F,IAAIkJ,IAC5B,MAAMC,EAAKkK,EAAK/W,EAAIwM,GACdM,EAAKiK,EAAK1L,EAAImB,GACdO,EAAKgK,EAAKnK,EAAIJ,GACpB,GAAI3J,EACA,MAAO,CAAE7C,EAAGnI,GAAKwT,EAAGtT,IACxB,GAAIgV,IAAOhV,GACP,MAAUzB,MAAM,oBACpB,MAAO,CAAE0J,EAAG6M,EAAIxB,EAAGyB,EAAI,IAErBE,EAAkBvO,GAAUyE,IAC9B,MAAMhL,EAAEA,EAACiL,EAAEA,GAAMgH,EACjB,GAAIjH,EAAEL,MACF,MAAUvM,MAAM,mBAGpB,MAAQ8gB,GAAIG,EAAGF,GAAIG,EAAGF,GAAIlW,EAAGqW,GAAIC,GAAMxU,EACjCiL,EAAK4I,EAAKQ,EAAIA,GACdnJ,EAAK2I,EAAKS,EAAIA,GACdnJ,EAAK0I,EAAK3V,EAAIA,GACduW,EAAKZ,EAAK1I,EAAKA,GACfuJ,EAAMb,EAAK5I,EAAKjW,GAGtB,GAFa6e,EAAK1I,EAAK0I,EAAKa,EAAMxJ,MACpB2I,EAAKY,EAAKZ,EAAK5T,EAAI4T,EAAK5I,EAAKC,KAEvC,MAAU9X,MAAM,yCAIpB,GAFWygB,EAAKQ,EAAIC,KACTT,EAAK3V,EAAIsW,GAEhB,MAAUphB,MAAM,yCACpB,OAAO,CAAI,IAIf,MAAMgW,EACF,WAAA7W,CAAY2hB,EAAIC,EAAIC,EAAIG,GACpB5hB,KAAKuhB,GAAKA,EACVvhB,KAAKwhB,GAAKA,EACVxhB,KAAKyhB,GAAKA,EACVzhB,KAAK4hB,GAAKA,EACVP,EAAY,IAAKE,GACjBF,EAAY,IAAKG,GACjBH,EAAY,IAAKI,GACjBJ,EAAY,IAAKO,GACjBhgB,OAAOkL,OAAO9M,KAC1B,CACQ,KAAImK,GACA,OAAOnK,KAAKsV,WAAWnL,CACnC,CACQ,KAAIqL,GACA,OAAOxV,KAAKsV,WAAWE,CACnC,CACQ,iBAAO8B,CAAWjK,GACd,GAAIA,aAAaoJ,EACb,MAAUhW,MAAM,8BACpB,MAAM0J,EAAEA,EAACqL,EAAEA,GAAMnI,GAAK,CAAE,EAGxB,OAFAgU,EAAY,IAAKlX,GACjBkX,EAAY,IAAK7L,GACV,IAAIiB,EAAMtM,EAAGqL,EAAGtT,GAAKgf,EAAK/W,EAAIqL,GACjD,CACQ,iBAAO+B,CAAWvH,GACd,MAAMwH,EAAQxP,EAAG+F,YAAYiC,EAAOlH,KAAKuE,GAAMA,EAAEoU,MACjD,OAAOzR,EAAOlH,KAAI,CAACuE,EAAGpM,IAAMoM,EAAEiI,SAASkC,EAAMvW,MAAK6H,IAAI2N,EAAMa,WACxE,CAEQ,UAAOQ,CAAI9H,EAAQqB,GACf,OAAOD,GAAUqF,EAAOxB,EAAIjF,EAAQqB,EAChD,CAEQ,cAAA0G,CAAepI,GACXqI,EAAK9G,cAAclR,KAAM2P,EACrC,CAGQ,cAAA+H,GACIP,EAAgBnX,KAC5B,CAEQ,MAAAkY,CAAO1B,GACH8K,EAAY9K,GACZ,MAAQ+K,GAAIpJ,EAAIqJ,GAAIpJ,EAAIqJ,GAAIpJ,GAAOrY,MAC3BuhB,GAAIjJ,EAAIkJ,GAAIjJ,EAAIkJ,GAAIjJ,GAAOhC,EAC7BwL,EAAOd,EAAK/I,EAAKK,GACjByJ,EAAOf,EAAK5I,EAAKD,GACjB6J,EAAOhB,EAAK9I,EAAKI,GACjB2J,EAAOjB,EAAK3I,EAAKF,GACvB,OAAO2J,IAASC,GAAQC,IAASC,CAC7C,CACQ,GAAAnV,GACI,OAAOhN,KAAKkY,OAAOzB,EAAM9K,KACrC,CACQ,MAAA2D,GAEI,OAAO,IAAImH,EAAMyK,GAAMlhB,KAAKuhB,IAAKvhB,KAAKwhB,GAAIxhB,KAAKyhB,GAAIP,GAAMlhB,KAAK4hB,IAC1E,CAIQ,MAAA9R,GACI,MAAMzN,EAAEA,GAAMiS,GACNiN,GAAIpJ,EAAIqJ,GAAIpJ,EAAIqJ,GAAIpJ,GAAOrY,KAC7BoiB,EAAIlB,EAAK/I,EAAKA,GACdkK,EAAInB,EAAK9I,EAAKA,GACdkH,EAAI4B,EAAK/e,GAAM+e,EAAK7I,EAAKA,IACzBiK,EAAIpB,EAAK7e,EAAI+f,GACbG,EAAOpK,EAAKC,EACZvF,EAAIqO,EAAKA,EAAKqB,EAAOA,GAAQH,EAAIC,GACjCnI,EAAIoI,EAAID,EACRG,EAAItI,EAAIoF,EACRmD,EAAIH,EAAID,EACRzJ,EAAKsI,EAAKrO,EAAI2P,GACd3J,EAAKqI,EAAKhH,EAAIuI,GACdC,EAAKxB,EAAKrO,EAAI4P,GACd3J,EAAKoI,EAAKsB,EAAItI,GACpB,OAAO,IAAIzD,EAAMmC,EAAIC,EAAIC,EAAI4J,EACzC,CAIQ,GAAAtV,CAAIoJ,GACA8K,EAAY9K,GACZ,MAAMnU,EAAEA,EAACiL,EAAEA,GAAMgH,GACTiN,GAAIpJ,EAAIqJ,GAAIpJ,EAAIqJ,GAAIpJ,EAAIuJ,GAAIe,GAAO3iB,MACnCuhB,GAAIjJ,EAAIkJ,GAAIjJ,EAAIkJ,GAAIjJ,EAAIoJ,GAAIgB,GAAOpM,EAK3C,GAAInU,IAAMJ,QAAQ,GAAI,CAClB,MAAMmgB,EAAIlB,GAAM9I,EAAKD,IAAOI,EAAKD,IAC3B+J,EAAInB,GAAM9I,EAAKD,IAAOI,EAAKD,IAC3BkK,EAAItB,EAAKmB,EAAID,GACnB,GAAII,IAAMxgB,GACN,OAAOhC,KAAK8P,SAChB,MAAMwP,EAAI4B,EAAK7I,EAAKlW,GAAMygB,GACpBN,EAAIpB,EAAKyB,EAAKxgB,GAAMqW,GACpB3F,EAAIyP,EAAIhD,EACRpF,EAAImI,EAAID,EACRK,EAAIH,EAAIhD,EACR1G,EAAKsI,EAAKrO,EAAI2P,GACd3J,EAAKqI,EAAKhH,EAAIuI,GACdC,EAAKxB,EAAKrO,EAAI4P,GACd3J,EAAKoI,EAAKsB,EAAItI,GACpB,OAAO,IAAIzD,EAAMmC,EAAIC,EAAIC,EAAI4J,EAC7C,CACY,MAAMN,EAAIlB,EAAK/I,EAAKG,GACd+J,EAAInB,EAAK9I,EAAKG,GACd+G,EAAI4B,EAAKyB,EAAKrV,EAAIsV,GAClBN,EAAIpB,EAAK7I,EAAKG,GACd3F,EAAIqO,GAAM/I,EAAKC,IAAOE,EAAKC,GAAM6J,EAAIC,GACrCG,EAAIF,EAAIhD,EACRpF,EAAIoI,EAAIhD,EACRmD,EAAIvB,EAAKmB,EAAIhgB,EAAI+f,GACjBxJ,EAAKsI,EAAKrO,EAAI2P,GACd3J,EAAKqI,EAAKhH,EAAIuI,GACdC,EAAKxB,EAAKrO,EAAI4P,GACd3J,EAAKoI,EAAKsB,EAAItI,GACpB,OAAO,IAAIzD,EAAMmC,EAAIC,EAAIC,EAAI4J,EACzC,CACQ,QAAAtJ,CAAS5C,GACL,OAAOxW,KAAKoN,IAAIoJ,EAAMlH,SAClC,CACQ,IAAAJ,CAAKnK,GACD,OAAOiT,EAAKjH,WAAW/Q,KAAM+E,EAAG0R,EAAMc,WAClD,CAEQ,QAAAM,CAASjG,GACL,MAAM7M,EAAI6M,EACV0E,EAAY,SAAUvR,EAAG7C,GAAK+Y,GAC9B,MAAM5N,EAAEA,EAACR,GAAQ7M,KAAKkP,KAAKnK,GAC3B,OAAO0R,EAAMc,WAAW,CAAClK,EAAGR,IAAI,EAC5C,CAKQ,cAAAwM,CAAezH,GACX,MAAM7M,EAAI6M,EAEV,OADA0E,EAAY,SAAUvR,EAAG/C,GAAKiZ,GAC1BlW,IAAM/C,GACCuX,EACPvZ,KAAKkY,OAAOqB,IAAMxU,IAAM7C,GACjBlC,KACPA,KAAKkY,OAAOgC,GACLla,KAAKkP,KAAKnK,GAAGsI,EACjB2K,EAAKpI,aAAa5P,KAAM+E,EAC3C,CAKQ,YAAA8d,GACI,OAAO7iB,KAAKqZ,eAAec,GAAUnN,KACjD,CAGQ,aAAA0H,GACI,OAAOsD,EAAKpI,aAAa5P,KAAMib,GAAajO,KACxD,CAGQ,QAAAsI,CAASqB,GACL,OAAOD,EAAa1W,KAAM2W,EACtC,CACQ,aAAAhC,GACI,MAAQhO,EAAGwT,GAAa7F,EACxB,OAAI6F,IAAajY,GACNlC,KACJA,KAAKqZ,eAAec,EACvC,CAGQ,cAAO1C,CAAQrU,EAAKud,GAAS,GACzB,MAAMrT,EAAEA,EAACjL,EAAEA,GAAMiS,EACXtP,EAAMgD,EAAG2E,MACfvJ,EAAM8B,EAAY,WAAY9B,EAAK4B,GACnCvC,EAAM,SAAUke,GAChB,MAAMmC,EAAS1f,EAAI6D,QACb8b,EAAW3f,EAAI4B,EAAM,GAC3B8d,EAAO9d,EAAM,IAAgB,IAAX+d,EAClB,MAAMvN,EAAIwN,EAAmBF,GAIvBld,EAAM+a,EAAS5T,EAAO/E,EAAGuE,MAC/B+J,EAAY,aAAcd,EAAGxT,GAAK4D,GAGlC,MAAM6V,EAAKyF,EAAK1L,EAAIA,GACdlL,EAAI4W,EAAKzF,EAAKvZ,IACdsE,EAAI0a,EAAK5T,EAAImO,EAAKpZ,GACxB,IAAI4F,QAAEA,EAAStF,MAAOwH,GAAM4W,EAAQzW,EAAG9D,GACvC,IAAKyB,EACD,MAAUxH,MAAM,uCACpB,MAAMwiB,GAAU9Y,EAAIjI,MAASA,GACvBghB,KAA4B,IAAXH,GACvB,IAAKpC,GAAUxW,IAAMnI,IAAOkhB,EAExB,MAAUziB,MAAM,gCAGpB,OAFIyiB,IAAkBD,IAClB9Y,EAAI+W,GAAM/W,IACPsM,EAAMa,WAAW,CAAEnN,IAAGqL,KACzC,CACQ,qBAAOmC,CAAe0H,GAClB,OAAO8D,EAAqB9D,GAASjK,KACjD,CACQ,UAAAgF,GACI,MAAMjQ,EAAEA,EAACqL,EAAEA,GAAMxV,KAAKsV,WAChBnS,EAAQigB,EAAmB5N,EAAGxN,EAAG2E,OAEvC,OADAxJ,EAAMA,EAAMpC,OAAS,IAAMoJ,EAAIjI,GAAM,IAAO,EACrCiB,CACnB,CACQ,KAAAmX,GACI,OAAOrE,EAAcjW,KAAKoa,aACtC,EAEI3D,EAAMrG,KAAO,IAAIqG,EAAMnC,EAAMrC,GAAIqC,EAAMpC,GAAIhQ,GAAKgf,EAAK5M,EAAMrC,GAAKqC,EAAMpC,KACtEuE,EAAM9K,KAAO,IAAI8K,EAAMzU,GAAKE,GAAKA,GAAKF,IACtC,MAAQoO,KAAM8J,EAAGvO,KAAM4N,GAAM9C,EACvBuB,EAAO9I,GAAKuH,EAAqB,EAAdtK,GACzB,SAASiP,EAAK/Y,GACV,OAAOwH,EAAIxH,EAAG4Y,EACtB,CAEI,SAASoI,EAAQxjB,GACb,OAAOub,EAAK4H,EAAmBnjB,GACvC,CAEI,SAASsjB,EAAqB/iB,GAC1B,MAAM4E,EAAMmH,EACZ/L,EAAM8E,EAAY,cAAe9E,EAAK4E,GAGtC,MAAMse,EAASpe,EAAY,qBAAsB+b,EAAM7gB,GAAM,EAAI4E,GAC3DwW,EAAOqF,EAAkByC,EAAOrc,MAAM,EAAGjC,IACzCyX,EAAS6G,EAAOrc,MAAMjC,EAAK,EAAIA,GAC/B4M,EAASyR,EAAQ7H,GACjBpG,EAAQ8E,EAAErC,SAASjG,GACnB2R,EAAanO,EAAMgF,aACzB,MAAO,CAAEoB,OAAMiB,SAAQ7K,SAAQwD,QAAOmO,aAC9C,CAMI,SAASC,EAAmBC,EAAU,IAAI5iB,cAAiBof,GACvD,MAAMyD,EAAMnO,KAAkB0K,GAC9B,OAAOoD,EAAQpC,EAAMH,EAAO4C,EAAKxe,EAAY,UAAWue,KAAYpR,IAC5E,CAeI,MAAMsR,EAAajD,GA6BnBxG,EAAEnC,eAAe,GAiBjB,MAAO,CACHzD,QACA0K,aAtEJ,SAAsBK,GAClB,OAAO8D,EAAqB9D,GAASkE,UAC7C,EAqEQnE,KA9DJ,SAAcsE,EAAKrE,EAASuE,EAAU,CAAA,GAClCF,EAAMxe,EAAY,UAAWwe,GACzBrR,IACAqR,EAAMrR,EAAQqR,IAClB,MAAMjH,OAAEA,EAAM7K,OAAEA,EAAM2R,WAAEA,GAAeJ,EAAqB9D,GACtD9U,EAAIiZ,EAAmBI,EAAQH,QAAShH,EAAQiH,GAChDhH,EAAIxC,EAAErC,SAAStN,GAAG6P,aAElB7I,EAAI6J,EAAK7Q,EADLiZ,EAAmBI,EAAQH,QAAS/G,EAAG6G,EAAYG,GACtC9R,GAGvB,OAFA0E,EAAY,cAAe/E,EAAGvP,GAAKiZ,GAE5B/V,EAAY,SADPqQ,EAAemH,EAAG0G,EAAmB7R,EAAGvJ,EAAG2E,QACP,EAAdR,EAC1C,EAmDQsT,OAjDJ,SAAgBtL,EAAKuP,EAAK/D,EAAWiE,EAAUD,GAC3C,MAAMF,QAAEA,EAAO9C,OAAEA,GAAWiD,EACtB5e,EAAMgD,EAAG2E,MACfwH,EAAMjP,EAAY,YAAaiP,EAAK,EAAInP,GACxC0e,EAAMxe,EAAY,UAAWwe,QACdhf,IAAXic,GACAle,EAAM,SAAUke,GAChBtO,IACAqR,EAAMrR,EAAQqR,IAClB,MAAMnS,EAAIyR,EAAmB7O,EAAIlN,MAAMjC,EAAK,EAAIA,IAGhD,IAAIod,EAAG1F,EAAGmH,EACV,IACIzB,EAAI3L,EAAMgB,QAAQkI,EAAWgB,GAC7BjE,EAAIjG,EAAMgB,QAAQtD,EAAIlN,MAAM,EAAGjC,GAAM2b,GACrCkD,EAAK3J,EAAEb,eAAe9H,EAClC,CACQ,MAAO6E,GACH,OAAO,CACnB,CACQ,IAAKuK,GAAUyB,EAAES,eACb,OAAO,EACX,MAAMpc,EAAI+c,EAAmBC,EAAS/G,EAAEtC,aAAcgI,EAAEhI,aAAcsJ,GAGtE,OAFYhH,EAAEtP,IAAIgV,EAAE/I,eAAe5S,IAExB2S,SAASyK,GAAIlP,gBAAgBuD,OAAOzB,EAAM9K,KAC7D,EAuBQmY,cAAerN,EACf4G,MAtBU,CACV8F,uBAEA5F,iBAAkB,IAAM1C,EAAY7S,EAAG2E,OAOvCkR,WAAU,CAAClO,EAAa,EAAGyF,EAAQqB,EAAMrG,QACrCgF,EAAM2C,eAAepI,GACrByF,EAAMyC,SAAS5V,OAAO,IACfmT,IAWnB;sEC7aA,MAAMpT,GAAMC,OAAO,GACbC,GAAMD,OAAO,GAiBZ,SAAS8hB,GAAWnJ,GACvB,MAAMtG,GAhBNpM,EADkB8J,EAiBS4I,EAhBL,CAClBvY,EAAG,UACJ,CACC2hB,eAAgB,gBAChB7X,YAAa,gBACb0U,kBAAmB,WACnBC,OAAQ,WACRmD,WAAY,WACZC,GAAI,WAGDtiB,OAAOkL,OAAO,IAAKkF,KAZ9B,IAAsBA,EAkBlB,MAAMtH,EAAEA,GAAM4J,EACR4M,EAAQnc,GAAM8E,EAAI9E,EAAG2F,GACrBsZ,EAAiB1P,EAAM0P,eACvBG,EAAkB/X,KAAKC,KAAK2X,EAAiB,GAC7CvG,EAAWnJ,EAAMnI,YACjB0U,EAAoBvM,EAAMuM,mBAAiB,CAAM1d,GAAUA,GAC3D8gB,EAAa3P,EAAM2P,YAAU,CAAM9Z,GAAMJ,GAAII,EAAGO,EAAIzI,OAAO,GAAIyI,IAWrE,SAAS0Z,EAAMC,EAAMC,EAAKC,GACtB,MAAMC,EAAQtD,EAAKmD,GAAQC,EAAMC,IAGjC,MAAO,CAFPD,EAAMpD,EAAKoD,EAAME,GACjBD,EAAMrD,EAAKqD,EAAMC,GAEzB,CAGI,MAAMC,GAAOnQ,EAAMjS,EAAIJ,OAAO,IAAMA,OAAO,GA2D3C,SAASyiB,EAAkBpa,GACvB,OAAOrF,EAAgBic,EAAK5W,GAAI6Z,EACxC,CAgBI,SAASQ,EAAW/S,EAAQtH,GACxB,MAAMsa,EAhBV,SAA2BC,GAGvB,MAAMva,EAAIpF,EAAY,eAAgB2f,EAAMV,GAG5C,OAFiB,KAAb1G,IACAnT,EAAE,KAAO,KACN1F,EAAgB0F,EAC/B,CASuBwa,CAAkBxa,GAC3Bya,EATV,SAAsBhgB,GAClB,MAAM5B,EAAQ+B,EAAY,SAAUH,GAC9BC,EAAM7B,EAAMpC,OAClB,GAAIiE,IAAQmf,GAAmBnf,IAAQyY,EACnC,MAAUhd,MAAM,YAAY0jB,QAAsB1G,gBAAuBzY,KAC7E,OAAOJ,EAAgBic,EAAkB1d,GACjD,CAGwB6hB,CAAapT,GACvBqT,EAzEV,SAA0B3a,EAAGsH,GACzB/L,EAAS,IAAKyE,EAAGtI,GAAK0I,GACtB7E,EAAS,SAAU+L,EAAQ5P,GAAK0I,GAGhC,MAAMjE,EAAImL,EACJsT,EAAM5a,EACZ,IAKI6a,EALAb,EAAMpiB,GACNkjB,EAAMpjB,GACNuiB,EAAMja,EACN+a,EAAMnjB,GACNmiB,EAAOriB,GAEX,IAAK,IAAIsjB,EAAIrjB,OAAO+hB,EAAiB,GAAIsB,GAAKtjB,GAAKsjB,IAAK,CACpD,MAAMC,EAAO9e,GAAK6e,EAAKpjB,GACvBmiB,GAAQkB,EACRJ,EAAKf,EAAMC,EAAMC,EAAKC,GACtBD,EAAMa,EAAG,GACTZ,EAAMY,EAAG,GACTA,EAAKf,EAAMC,EAAMe,EAAKC,GACtBD,EAAMD,EAAG,GACTE,EAAMF,EAAG,GACTd,EAAOkB,EACP,MAAMnD,EAAIkC,EAAMc,EACVI,EAAKtE,EAAKkB,EAAIA,GACdC,EAAIiC,EAAMc,EACVK,EAAKvE,EAAKmB,EAAIA,GACdxP,EAAI2S,EAAKC,EACTnG,EAAIiF,EAAMc,EAEVK,EAAKxE,GADDqD,EAAMc,GACIjD,GACduD,EAAKzE,EAAK5B,EAAI+C,GACduD,EAAOF,EAAKC,EACZE,EAAQH,EAAKC,EACnBpB,EAAMrD,EAAK0E,EAAOA,GAClBP,EAAMnE,EAAKgE,EAAMhE,EAAK2E,EAAQA,IAC9BvB,EAAMpD,EAAKsE,EAAKC,GAChBL,EAAMlE,EAAKrO,GAAK2S,EAAKtE,EAAKuD,EAAM5R,IAC5C,CAEQsS,EAAKf,EAAMC,EAAMC,EAAKC,GACtBD,EAAMa,EAAG,GACTZ,EAAMY,EAAG,GAETA,EAAKf,EAAMC,EAAMe,EAAKC,GACtBD,EAAMD,EAAG,GACTE,EAAMF,EAAG,GAET,MAAMW,EAAK7B,EAAWmB,GAEtB,OAAOlE,EAAKoD,EAAMwB,EAC1B,CAsBmBC,CAAiBnB,EAAQG,GAGpC,GAAIE,IAAOjjB,GACP,MAAUvB,MAAM,0CACpB,OAAOikB,EAAkBO,EACjC,CAEI,MAAMe,EAAUtB,EAAkBpQ,EAAM4P,IACxC,SAAS+B,EAAerU,GACpB,OAAO+S,EAAW/S,EAAQoU,EAClC,CACI,MAAO,CACHrB,aACAsB,iBACAhH,gBAAiB,CAACrH,EAAY+H,IAAcgF,EAAW/M,EAAY+H,GACnEX,aAAepH,GAAeqO,EAAerO,GAC7CyF,MAAO,CAAEE,iBAAkB,IAAMjJ,EAAMuG,YAAYvG,EAAMnI,cACzD6Z,QAASA,EAEjB;sECrIA,MAAME,GAAeC,GAAgB,IAAMC,EAAS7lB,OAAO,CAAE8lB,MAAO,QAE9DC,IADcH,GAAgB,IAAMC,EAAS7lB,OAAO,CAAE8lB,MAAO,OACpDpkB,OAAO,4IAEhBC,GAAMD,OAAO,GAAIE,GAAMF,OAAO,GAAIwH,GAAMxH,OAAO,GAAUA,OAAO,GAAI,MAAAskB,GAAOtkB,OAAO,IAElFukB,GAAOvkB,OAAO,IAAKwkB,GAAOxkB,OAAO,IAAKykB,GAAOzkB,OAAO,IAAK0kB,GAAQ1kB,OAAO,KAI9E,SAAS2kB,GAAsBzc,GAC3B,MAAMO,EAAI4b,GACJO,EAAM1c,EAAIA,EAAIA,EAAKO,EACnBiO,EAAMkO,EAAKA,EAAK1c,EAAKO,EACrBoc,EAAM5c,GAAKyO,EAAIlP,GAAKiB,GAAKiO,EAAMjO,EAC/Bqc,EAAM7c,GAAK4c,EAAIrd,GAAKiB,GAAKiO,EAAMjO,EAC/Bsc,EAAO9c,GAAK6c,EAAI5kB,GAAKuI,GAAKmc,EAAMnc,EAChCuc,EAAO/c,GAAK8c,EAAKT,GAAM7b,GAAKsc,EAAOtc,EACnCwc,EAAOhd,GAAK+c,EAAKT,GAAM9b,GAAKuc,EAAOvc,EACnCyc,EAAOjd,GAAKgd,EAAKT,GAAM/b,GAAKwc,EAAOxc,EACnC0c,EAAQld,GAAKid,EAAKT,GAAMhc,GAAKyc,EAAOzc,EACpC2c,EAAQnd,GAAKkd,EAAMX,GAAM/b,GAAKwc,EAAOxc,EACrC4c,EAAQpd,GAAKmd,EAAMllB,GAAKuI,GAAKmc,EAAMnc,EACnC6c,EAAQrd,GAAKod,EAAMplB,GAAKwI,GAAKP,EAAKO,EACxC,OAAQR,GAAKqd,EAAMZ,GAAOjc,GAAK4c,EAAQ5c,CAC3C,CACA,SAASmW,GAAkB1d,GAQvB,OALAA,EAAM,IAAM,IAEZA,EAAM,KAAO,IAEbA,EAAM,IAAM,EACLA,CACX,CAsBA,MAAM6E,GAAKsE,GAAMga,GAAQ,KAAK,GACxBkB,GAAY,CAEdnlB,EAAGJ,OAAO,GAEVqL,EAAGrL,OAAO,2IAEd+F,GAAIA,GAGAjD,EAAG9C,OAAO,2IAEVgK,WAAY,IAEZtF,EAAG1E,OAAO,GAEVgQ,GAAIhQ,OAAO,2IACXiQ,GAAIjQ,OAAO,2IAEXpC,KAAMqmB,GACNrL,cACAgG,qBAEAC,OAAQ,CAAC7a,EAAMkb,EAAKC,KAChB,GAAID,EAAIpgB,OAAS,IACb,MAAUN,MAAM,uBAAuB0gB,EAAIpgB,QAC/C,OAAOuE,EAAYmiB,EAAY,YAAa,IAAI5mB,WAAW,CAACugB,EAAS,EAAI,EAAGD,EAAIpgB,SAAUogB,EAAKlb,EAAK,EAExG8a,QA/CJ,SAAiBzW,EAAG9D,GAChB,MAAMkE,EAAI4b,GAOJoB,EAAM7d,EAAIS,EAAIA,EAAI9D,EAAGkE,GACrBid,EAAM9d,EAAI6d,EAAMpd,EAAGI,GACnBkd,EAAO/d,EAAI8d,EAAMD,EAAMlhB,EAAGkE,GAE1BP,EAAIN,EAAI8d,EADDf,GAAsBgB,GACTld,GAEpBiL,EAAK9L,EAAIM,EAAIA,EAAGO,GAGtB,MAAO,CAAEzC,QAAS4B,EAAI8L,EAAKnP,EAAGkE,KAAOJ,EAAG3H,MAAOwH,EACnD,GA+Ba0d,kBAAwBjH,GAAe4G,IAGvCM,kBAAuB,KAAO/D,GAAW,CAClD1hB,EAAGJ,OAAO,QAEV+hB,eAAgB,IAChB7X,YAAa,GACbzB,EAAG4b,GACHpC,GAAIjiB,OAAO,GACXgiB,WAAa9Z,IACT,MAAMO,EAAI4b,GAGV,OAAOzc,EADSK,GADI0c,GAAsBzc,GACRlI,OAAO,GAAIyI,GACxBP,EAAGO,EAAE,EAE9BmW,qBACAhG,gBAdgC,GAgCnB7S,GAAGuE,MAAQtK,OAAO,GAAMA,OAAO,GACjCA,OAAO,QAuFFA,OAAO,SAEHA,OAAO,SAEVA,OAAO,0IAEJA,OAAO,2IAGdA,OAAO;;AClOxB,MAAM8lB,GAAa9lB,OAAO,sEACpB+lB,GAAa/lB,OAAO,sEACpBC,GAAMD,OAAO,GACbE,GAAMF,OAAO,GACbgmB,GAAa,CAAC5lB,EAAGuE,KAAOvE,EAAIuE,EAAIzE,IAAOyE,EA6B7C,MAAMoB,GAAKsE,GAAMyb,QAAYrjB,OAAWA,EAAW,CAAEoJ,KAxBrD,SAAiB0H,GACb,MAAM9K,EAAIqd,GAEJte,EAAMxH,OAAO,GAAIimB,EAAMjmB,OAAO,GAAIskB,EAAOtkB,OAAO,IAAKukB,EAAOvkB,OAAO,IAEnEkmB,EAAOlmB,OAAO,IAAKwkB,EAAOxkB,OAAO,IAAKykB,EAAOzkB,OAAO,IACpD4kB,EAAMrR,EAAIA,EAAIA,EAAK9K,EACnBiO,EAAMkO,EAAKA,EAAKrR,EAAK9K,EACrBoc,EAAM5c,GAAKyO,EAAIlP,EAAKiB,GAAKiO,EAAMjO,EAC/Bqc,EAAM7c,GAAK4c,EAAIrd,EAAKiB,GAAKiO,EAAMjO,EAC/Bsc,EAAO9c,GAAK6c,EAAI5kB,GAAKuI,GAAKmc,EAAMnc,EAChCuc,EAAO/c,GAAK8c,EAAKT,EAAM7b,GAAKsc,EAAOtc,EACnCwc,EAAOhd,GAAK+c,EAAKT,EAAM9b,GAAKuc,EAAOvc,EACnCyc,EAAOjd,GAAKgd,EAAKT,EAAM/b,GAAKwc,EAAOxc,EACnC0c,EAAQld,GAAKid,EAAKT,EAAMhc,GAAKyc,EAAOzc,EACpC2c,EAAQnd,GAAKkd,EAAMX,EAAM/b,GAAKwc,EAAOxc,EACrC6c,EAAQrd,GAAKmd,EAAM5d,EAAKiB,GAAKiO,EAAMjO,EACnCsO,EAAM9O,GAAKqd,EAAMY,EAAMzd,GAAKuc,EAAOvc,EACnCkB,EAAM1B,GAAK8O,EAAIkP,EAAKxd,GAAKmc,EAAMnc,EAC/BE,EAAOV,GAAK0B,EAAIzJ,GAAKuI,GAC3B,IAAK1C,GAAG6C,IAAI7C,GAAG8C,IAAIF,GAAO4K,GACtB,MAAU/U,MAAM,2BACpB,OAAOmK,CACX,IAKawd,GAAYlI,GAAY,CACjC7d,EAAGJ,OAAO,GACV2E,EAAG3E,OAAO,GACd+F,GAAIA,GACAjD,EAAGijB,GAEH/V,GAAIhQ,OAAO,iFACXiQ,GAAIjQ,OAAO,iFACX0E,EAAG1E,OAAO,GACVmQ,MAAM,EAONyC,KAAM,CACFC,KAAM7S,OAAO,sEACb8S,YAActO,IACV,MAAM1B,EAAIijB,GACJK,EAAKpmB,OAAO,sCACZqmB,GAAMpmB,GAAMD,OAAO,sCACnBsmB,EAAKtmB,OAAO,uCACZ4kB,EAAKwB,EACLG,EAAYvmB,OAAO,uCACnB8I,EAAKkd,GAAWpB,EAAKpgB,EAAG1B,GACxB0jB,EAAKR,IAAYK,EAAK7hB,EAAG1B,GAC/B,IAAI0U,EAAK5P,EAAIpD,EAAIsE,EAAKsd,EAAKI,EAAKF,EAAIxjB,GAChC4U,EAAK9P,GAAKkB,EAAKud,EAAKG,EAAK5B,EAAI9hB,GACjC,MAAMyU,EAAQC,EAAK+O,EACb9O,EAAQC,EAAK6O,EAKnB,GAJIhP,IACAC,EAAK1U,EAAI0U,GACTC,IACAC,EAAK5U,EAAI4U,GACTF,EAAK+O,GAAa7O,EAAK6O,EACvB,MAAU/nB,MAAM,uCAAyCgG,GAE7D,MAAO,CAAE+S,QAAOC,KAAIC,QAAOC,KAAI,IAGxC0G,GAGSpe,OAAO,GAiBLmmB,GAAU5N,gBCnGxB,MAAMxS,GAAKsE,GAAMrK,OAAO,uEAKXymB,GAAkBxI,GAAY,CACzC7d,EALc2F,GAAGzH,OAAO0B,OAAO,uEAM/B2E,EALc3E,OAAO,yEAMrB+F,GAEAjD,EAAG9C,OAAO,sEAEVgQ,GAAIhQ,OAAO,sEACXiQ,GAAIjQ,OAAO,sEACX0E,EAAG1E,OAAO,GACVmQ,MAAM,GACIiO,GChBNrY,GAAKsE,GAAMrK,OAAO,uGAKX0mB,GAAkBzI,GAAY,CACzC7d,EALc2F,GAAGzH,OAAO0B,OAAO,uGAM/B2E,EALc3E,OAAO,yGAMrB+F,GAEAjD,EAAG9C,OAAO,sGAEVgQ,GAAIhQ,OAAO,sGACXiQ,GAAIjQ,OAAO,sGACX0E,EAAG1E,OAAO,GACVmQ,MAAM,GACImO,GChBNvY,GAAKsE,GAAMrK,OAAO,uIAKX2mB,GAAkB1I,GAAY,CACzC7d,EALc2F,GAAGzH,OAAO0B,OAAO,uIAM/B2E,EALc3E,OAAO,sIAMrB+F,MAEAjD,EAAG9C,OAAO,sIAEVgQ,GAAIhQ,OAAO,sIACXiQ,GAAIjQ,OAAO,sIACX0E,EAAG1E,OAAO,GACVmQ,MAAM,GACIqO,GCRCoI,GAAc,IAAIC,IAAIlnB,OAAO+G,QAAQ,CAClDogB,SAAEA,GACFC,SAAEA,GACFC,SAAEA,GACAP,mBACAC,mBACAC,mBACAR,aACAN,QACAD","x_google_ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11,12]}